Cognitive test-oriented time series data exception identification and verification method and system

Abstract

The invention provides a time series data exception identification and verification method and system oriented to cognitive testing, and relates to the technical field of data processing, and the method comprises the steps: collecting a time series data sample set; extracting time domain features and domain difference features from the original data based on the time sequence data sample set; performing multi-level anomaly recognition according to the time domain features and the domain difference features; and inputting the obtained anomaly detection result of each level into a meta classifier to carry out anomaly comprehensive analysis and confidence judgment at each time point, outputting an anomaly identification verification result, and carrying out verification result identification through the anomaly confidence. The technical problem that in the prior art, due to the fact that standardized cognitive testing depends on macroscopic summary indexes, subtle cognitive anomalies are masked, and then the confidence coefficient of a time series data anomaly recognition result is affected is solved, anomaly analysis is conducted through the multi-level anomaly features and input into the meta classifier, and the time series data anomaly recognition accuracy is improved. And the accuracy and the credibility of time series data exception identification are improved.

Description

Technical Field

[0001] This application relates to the field of data processing technology, and in particular to a method and system for identifying and verifying anomalies in time-series data for cognitive testing. Background Technology

[0002] Currently, standardized cognitive tests assess cognitive processing abilities by recording subjects' behavioral responses to specific stimuli, typically relying on macro-level aggregate indicators such as average reaction time and overall accuracy as the primary basis for analysis. However, aggregate indicators compress fine-grained performance changes over time during the test, masking temporal dynamics at the trial level. Furthermore, because they completely remove the task context, they fail to reflect the potential phased fluctuations and local anomalies that subjects may exhibit in different test blocks and under different stimulus types, resulting in low accuracy in identifying subtle anomalies. This, in turn, affects the reliability and interpretability of cognitive test data.

[0003] In summary, existing technologies suffer from a technical problem: because standardized cognitive tests rely on macro-level aggregated indicators, subtle cognitive anomalies are masked, which in turn affects the confidence level of anomaly identification results in time-series data. Summary of the Invention

[0004] The purpose of this application is to provide a method and system for identifying and verifying anomalies in time-series data for cognitive tests, in order to solve the technical problem in the prior art where subtle cognitive anomalies are masked due to the reliance of standardized cognitive tests on macro-level summary indicators, which in turn affects the confidence level of the time-series data anomaly identification results.

[0005] In view of the above problems, this application provides a method and system for identifying and verifying anomalies in time-series data for cognitive testing.

[0006] Firstly, this application provides a method for identifying and verifying anomalies in time-series data for cognitive testing. This method is implemented through a system for identifying and verifying anomalies in time-series data for cognitive testing. The method includes: collecting a time-series data sample set, including reaction time, reaction correctness, stimulus type, and test block index; extracting temporal features and domain-specific features from the original data based on the time-series data sample set, wherein the temporal features include calculating the mean and standard deviation of reaction time using a sliding window as a unit, and the domain-specific features include the block index to which the window belongs and the error rate of the target stimulus; performing multi-level anomaly identification based on the temporal features and domain-specific features, including point anomaly detection, pattern anomaly detection, and context anomaly detection; inputting the obtained anomaly detection results at each level into a meta-classifier for comprehensive analysis of anomalies at each time point and confidence level judgment, outputting anomaly identification and verification results, and identifying the verification results through anomaly confidence levels.

[0007] Optionally, the original data is cleaned to remove extreme values, missing data, and invalid data caused by equipment failure; the cleaned original data is segmented according to a preset sliding window size, and the mean and standard deviation of the reaction time within each sliding window are calculated to obtain temporal features; based on the test block index of the original data, the order and division rules of the test blocks to which the data within the sliding window belong are located, and the block index corresponding to the data is marked; based on the number of trials and correctness of all target stimuli within each sliding window, the error ratio is calculated to obtain the target stimulus error ratio; wherein, the domain difference features are determined by the block index of the sliding window and the target stimulus error ratio.

[0008] Optionally, a multi-level anomaly detection space is established, including a point anomaly detection module, a pattern anomaly detection module, and a context anomaly detection module; the point anomaly detection module is used to identify anomalies in reaction time and error rate data points; the pattern anomaly detection module is used to identify abnormal patterns in reaction time and error rate that gradually decrease or fluctuate in frequency; the context anomaly detection module is used to analyze the context information of the cognitive test and identify behaviors that do not conform to the task requirements.

[0009] Optionally, an anomaly feature learning is performed based on a multi-scenario sample set for anomaly identification. Anomaly detection is performed on each data point using a local outlier factor algorithm, constructing a point anomaly detection module. By analyzing the density difference of each data point relative to its neighborhood, anomaly data points deviating from normal behavior patterns are identified. Pattern feature learning is performed based on time-series data. An LSTM autoencoder is used to train and reconstruct the features of each data window, identifying anomalies in reaction time or error rate change patterns, constructing a pattern anomaly detection module. Combining task background information and contextual features of time-series data, a Transformer model is used to model the data, identifying behavioral patterns inconsistent with task requirements, constructing a context anomaly detection module. The point anomaly detection module, pattern anomaly detection module, and context anomaly detection module are connected in parallel to construct the multi-level anomaly identification space.

[0010] Optionally, the meta-classifier adopts a weighted decision mechanism. By training on historical datasets, the meta-classifier learns weighted rules under different types of anomalies and user cognitive differences. Based on the weighted rules, it performs weighted fusion on the anomaly identification results of the input multi-level system and outputs the final anomaly label and its confidence level at each time point.

[0011] Optionally, the meta-classifier includes: an attention weighting layer, used to receive the preliminary results and contributing features of the point anomaly detection module, pattern anomaly detection module, and context anomaly detection module, and dynamically calculate the importance weight of each level result in the current context through a lightweight attention network; an incremental learning unit, used to incrementally update the data by interacting with expert-annotated sample data, dynamically adjust the internal weighting rules and decision boundaries, adapt to the differences in cognitive behavior of different users and the concept drift that occurs over time; and an interpretable output layer, used to perform anomaly attribution analysis based on the SHAP model, calculate the contribution of each input feature to the final anomaly judgment result, generate a readable attribution report, and identify the key features that cause the anomaly and the corresponding anomaly type.

[0012] Optionally, an anomaly collaboration relationship is established among the point anomaly detection module, the pattern anomaly detection module, and the context anomaly detection module; fusion verification constraints are performed based on the anomaly collaboration relationship; interactive verification is performed on the anomaly detection results of each level based on the fusion verification constraints, and the multi-level anomaly identification results that have passed the interactive verification are input into the meta-classifier.

[0013] Optionally, based on historical time-series data and expert knowledge, node relationship analysis is performed using the point anomaly detection module, pattern anomaly detection module, and context anomaly detection module as nodes. This analysis includes at least: fusion relationships, dependency relationships, and contradictory relationships. The fusion relationship reflects anomaly results identified by different modules that are temporally adjacent and semantically mutually supportive, and their joint occurrence points to a composite anomaly event with higher confidence. The dependency relationship indicates that the anomaly identification result of one module is a prerequisite or strong contextual clue for another module to trigger a specific analysis process. The contradictory relationship reflects logical conflicts in the judgment results of different modules regarding the same time period or related events. Based on the fusion relationship, dependency relationship, and contradictory relationship, connection edge attributes are established between nodes to construct a collaborative relationship graph structure that reflects the anomaly collaborative relationships.

[0014] Optionally, the final anomaly labels, anomaly confidence levels, and attribution reports can be visualized to generate an interactive timeline anomaly map, in which different levels and types of anomaly events are identified with different colors and markers, and attribution analysis is inserted into the anomaly events.

[0015] Secondly, this application also provides a temporal data anomaly identification and verification system for cognitive testing, used to execute the temporal data anomaly identification and verification method for cognitive testing as described in the first aspect. The temporal data anomaly identification and verification system for cognitive testing includes: a data collection module for collecting a temporal data sample set, including reaction time, reaction correctness, stimulus mode, and test block index; a feature extraction module for extracting temporal features and domain-specific features from the original data based on the temporal data sample set, wherein the temporal features include the mean and standard deviation of reaction time calculated in units of sliding windows, and the domain-specific features include the block index to which the window belongs and the error rate of the target stimulus; a multi-level anomaly identification module for performing multi-level anomaly identification based on the temporal features and domain-specific features, including point anomaly detection, pattern anomaly detection, and context anomaly detection; and an anomaly analysis module for inputting the obtained anomaly detection results at each level into a meta-classifier for comprehensive anomaly analysis and confidence judgment at each time point, outputting anomaly identification and verification results, and identifying the verification results through anomaly confidence.

[0016] One or more technical solutions provided in this application have at least the following beneficial effects: By collecting a time-series data sample set, including reaction time, reaction accuracy, stimulus type, and test block index, temporal features and domain-specific features are extracted from the original data based on the time-series data sample set. The temporal features include the mean and standard deviation of reaction time calculated in units of sliding windows, and the domain-specific features include the block index to which the window belongs and the error rate of the target stimulus. Multi-level anomaly identification is performed based on the temporal features and domain-specific features, including point anomaly detection, pattern anomaly detection, and context anomaly detection. The obtained anomaly detection results at each level are input into a meta-classifier for comprehensive analysis of anomalies at each time point and confidence level judgment, outputting anomaly identification verification results, and identifying the verification results through anomaly confidence. In other words, by collecting a time-series data sample set, extracting temporal and domain-specific features from it, performing multi-level anomaly identification, and inputting the anomaly detection results at each level into a meta-classifier for comprehensive analysis of anomalies at each time point and confidence level judgment, the accuracy and reliability of time-series data anomaly identification are improved, thereby enhancing the reliability of cognitive testing.

[0017] The above description is merely an overview of the technical solution of this application. To better understand the technical means of this application and to facilitate its implementation according to the description, and to make the above and other objects, features, and advantages of this application more apparent, specific embodiments of this application are described below. It should be understood that the content described in this section is not intended to identify key or important features of the embodiments of this application, nor is it intended to limit the scope of this application. Other features of this application will become readily apparent through the following description. Attached Figure Description

[0018] To more clearly illustrate the technical solutions in this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are merely exemplary. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0019] Figure 1 This is a flowchart illustrating the time-series data anomaly identification and verification method for cognitive testing proposed in this application.

[0020] Figure 2 This is a schematic diagram of the structure of the time-series data anomaly identification and verification system for cognitive testing in this application.

[0021] Figure labeling: Data collection module 11, feature extraction module 12, multi-level anomaly identification module 13, anomaly analysis module 14. Detailed Implementation

[0022] This application provides a method and system for identifying and verifying anomalies in time-series data for cognitive testing. It addresses the technical problem in existing technologies where the reliance on macroscopic summary indicators in standardized cognitive tests masks subtle cognitive anomalies, thus affecting the confidence level of time-series data anomaly identification results. By collecting a time-series data sample set and extracting temporal and domain-specific features, multi-level anomaly identification is performed. The results of anomaly detection at each level are then input into a meta-classifier for comprehensive analysis of anomalies at each time point and confidence level assessment. This improves the accuracy and reliability of time-series data anomaly identification, thereby enhancing the reliability of cognitive testing.

[0023] The technical solutions of this application will now be clearly and completely described with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of them. It should be understood that this application is not limited to the exemplary embodiments described herein. All other embodiments obtained by those skilled in the art based on the embodiments of this application without creative effort are within the scope of protection of this application. It should also be noted that, for ease of description, only the parts related to this application are shown in the accompanying drawings, not all of them.

[0024] Example 1, please refer to the appendix. Figure 1 This application provides a method for identifying and verifying anomalies in time-series data for cognitive testing. The method is executed by a system for identifying and verifying anomalies in time-series data for cognitive testing, and specifically includes the following steps: Collect a time-series data sample set, including reaction time, reaction correctness, stimulus type, and test block index.

[0025] Specifically, a time-series data sample set is collected simultaneously while subjects perform standardized cognitive tests. At the start of each trial, a timestamp and the stimulus type for that trial are recorded. Immediately after the subject responds, the content and time of their response are recorded, and the correctness of their response is automatically determined according to the task rules. Based on the pre-set test structure, each trial is labeled with its corresponding block index. A complete cognitive test is typically divided into multiple consecutive stages or blocks; the test block index is an identifier used to indicate the test stage or task difficulty range to which the current trial belongs.

[0026] Reaction time, response accuracy, stimulus modality, and test block index are integrated into a structured data entry and appended to the time-series data sample set in chronological order. The time-series data sample set is a collection of cognitive test behavioral data recorded chronologically, preserving the temporal relationship and continuity between each stimulus presentation and the subject's response. Reaction time is the elapsed time from the presentation of the stimulus to the subject's effective response, typically measured in milliseconds. Response accuracy is whether the subject's response in the current trial meets the task requirements, usually expressed as a Boolean value (1 / 0 or correct / incorrect). Stimulus modality is the type of stimulus presented to the subject during the test, such as visual stimuli (shapes, colors, directions), auditory stimuli (cues), or semantic stimuli (textual information).

[0027] For example, taking a classic color word task as an example, participants are asked to ignore the semantics of the words and report their printed color as quickly as possible. The test consists of two blocks, each containing 12 trials. Timestamp 10:00:01.200; stimulus: color selection, word "blue," printed in blue; participant responds with "blue"; reaction time 450ms; system judges correct; block index 1. Timestamp 10:00:02.050; stimulus: color selection, word "red," printed in blue; participant responds with "red"; reaction time 780ms; system judges incorrect; block index 1. Timestamp 10:00:03.100; stimulus: color selection, word "green," printed in "red"; participant responds with "red"; reaction time 820ms; system judges correct; block index 1. Timestamp 10:00:04.000; stimulus: color selection, word "red," printed in "red"; participant responds with "red"; reaction time 430ms; system judges correct; block index 1. Timestamp 10:05:15.500; Stimulus type: direction judgment; word: yellow; printed in yellow; subject's response: yellow; reaction time: 510ms; system judgment: correct; block index: 2. Trials 2 and 3 show that under inconsistent color stimuli, the subject's reaction time was significantly prolonged; in trial 2, the subject made an error, indicating a failure in response control under cognitive conflict.

[0028] By synchronously recording time, behavior, task background, and testing phase information, the micro-level cognitive dynamics that might otherwise be obscured by macro averages are completely preserved, ensuring that subsequent analysis can trace the specific context of each abnormal performance in order to pinpoint the specific time period and task context in which the anomaly occurred.

[0029] Based on the time-series data sample set, temporal features and domain-specific features are extracted from the original data. The temporal features include the mean and standard deviation of reaction time calculated in units of sliding windows, and the domain-specific features include the block index to which the window belongs and the error rate of the target stimulus.

[0030] Furthermore, this application also includes the following steps: cleaning the original data to remove extreme values, missing data, and invalid data caused by equipment failure; segmenting the cleaned original data into sample data according to a preset sliding window size, calculating the mean and standard deviation of reaction time within each sliding window to obtain temporal features; locating the order and division rules of the test blocks to which the data within the sliding window belongs based on the test block index of the original data, and marking the block index corresponding to the data; calculating the error ratio based on the number of trials and correctness of all target stimuli within each sliding window to obtain the target stimulus error ratio; wherein, the domain difference features are determined by the block index of the sliding window and the target stimulus error ratio.

[0031] Specifically, the raw data undergoes data cleaning to remove unreasonable data points caused by device latency, network lag, missed responses, etc., including extreme values, missing data, and invalid data caused by device malfunction. Extreme values ​​are data points that significantly deviate from the normal physiological or behavioral range, i.e., reaction times that are physiologically impossible or have an extremely low probability due to button press errors, brief distractions, etc., such as shorter than 100ms or longer than 3000ms. Missing data are trials in which the subject did not respond or the device failed to record them. Invalid data caused by device malfunction are obvious data anomalies caused by technical problems, such as reaction times recorded as 0 or negative values.

[0032] A pre-defined sliding window is a fixed-length data segmentation method used to divide continuous time-series data into a series of continuous, potentially overlapping local segments for analysis. The cleaned raw data is segmented according to the size of the pre-defined sliding window. For each sliding window, the mean and standard deviation of reaction time are calculated to obtain temporal characteristics. The mean reaction time is the arithmetic mean of all effective reaction times within the sliding window, reflecting the average cognitive processing speed within that time period. The standard deviation of reaction time is the standard deviation of all effective reaction times within the sliding window, reflecting the volatility or stability of reaction time within that time period; a high standard deviation is a typical indicator of inattention.

[0033] Cognitive tests are typically divided into multiple blocks, each containing several trials. Block indexes help identify the block to which a specific data point belongs and allow for analysis based on the different characteristics of each block. For example, some blocks may exhibit learning or fatigue effects, influencing the subject's reaction speed and error rate. Based on the test block index of the raw data—that is, the test phase to which a particular data segment belongs—the order and division rules of the test blocks to which the data within the sliding window belong are determined, and the corresponding block index label for each sliding window is identified. The number of occurrences, correct answers, and incorrect answers of all target stimuli within each sliding window are statistically analyzed. The error ratio is calculated by the ratio of the number of errors to the number of occurrences, reflecting the subject's performance deviation under specific task rules. Domain-specific characteristics are determined from the block index of the sliding window and the target stimulus error ratio. These characteristics include marking the main test phase to which each sliding window belongs, i.e., the proportion of incorrect answers for a specific stimulus type within each sliding window to the total number of trials for that stimulus.

[0034] For example, consider a continuous operation test. The test consists of 3 blocks, each with 50 trials. The target stimulus is the letter X, with a probability of 20%, and the non-target stimuli are other letters. The sliding window size is set to 10 trials, with a step size of 1. In the raw data, the reaction time for trial 15 is 89ms, indicating an early response, and is therefore considered an extreme value and discarded. Trial 38 is treated as missing data because the device did not record a response. Assume that a certain sliding window contains 10 trials, including 2 target stimuli and 8 non-target stimuli. The reaction times are 450ms, 520ms, 410ms, 480ms, 1100ms (distraction), 460ms, 490ms, 430ms, 510ms, and 440ms, respectively. Before calculation, the data is cleaned again to remove the extreme value of 1100ms within the window. The mean reaction time was calculated as (450+520+410+480+460+490+430+510+440) / 9 = 465.6 ms, and the standard deviation was 35.2 ms, indicating that the reaction speed was very stable within this window. Domain-specific characteristics were calculated: the block index belonged to block 3, i.e., the later stage of the test; the target stimulus error rate was calculated as follows: there were two target stimuli within the window, one was responded to correctly, and the other was not responded to due to the subject's inattention (reaction time 1100 ms), which was counted as an error, resulting in an error rate of 50%. The temporal characteristics were a mean of 465.6 ms and a standard deviation of 35.2 ms; the domain-specific characteristics were block 3 and a target stimulus error rate of 50%. In test block 3, based on the mean of 465.6ms and the standard deviation of 35.2ms, it can be determined that the subjects' reaction speed is still fast and stable. However, their false negative rate for key target stimuli is extremely high, at 50%. This is a very typical phenomenon of cognitive stripping caused by fatigue. That is, in order to maintain reaction speed, the subjects sacrificed accuracy, and their cognitive resources may no longer be sufficient to support the effective identification of target stimuli.

[0035] Multi-level anomaly identification is performed based on the temporal and domain-specific features, including point anomaly detection, pattern anomaly detection, and context anomaly detection.

[0036] Furthermore, this application also includes the following steps: establishing a multi-level anomaly detection space, including a point anomaly detection module, a pattern anomaly detection module, and a context anomaly detection module; the point anomaly detection module is used to identify anomalies in reaction time and error rate data points; the pattern anomaly detection module is used to identify abnormal patterns in reaction time and error rate that gradually decrease or fluctuate in frequency; the context anomaly detection module is used to analyze the context information of the cognitive test and identify behaviors that do not conform to the task requirements.

[0037] Furthermore, this application also includes the following steps: learning anomaly features based on a multi-scenario sample set for identifying anomalies, performing anomaly detection for each data point using the local outlier factor algorithm, constructing a point anomaly detection module, and identifying anomalous data points that deviate from normal behavior patterns by analyzing the density differences of each data point relative to its neighborhood; learning pattern features based on time-series data, training and reconstructing the features of each data window using an LSTM autoencoder to identify anomalies in reaction time or error rate change patterns, and constructing a pattern anomaly detection module; combining task background information and contextual features of time-series data, modeling the data using a Transformer model to identify behavioral patterns that do not conform to task requirements, and constructing a context anomaly detection module; and connecting the point anomaly detection module, pattern anomaly detection module, and context anomaly detection module in parallel to construct the multi-level anomaly recognition space.

[0038] Specifically, this involves acquiring a multi-scenario sample set for anomaly identification, containing training data on various behavioral patterns, including normal behavior, known abnormal behavior, and abnormal behavior generated through data augmentation or artificial injection. By performing anomaly feature learning on this multi-scenario sample set, the distribution structure of normal data points in the feature space is learned, particularly their local density characteristics. Anomaly feature learning refers to the process of automatically learning and identifying feature patterns from data that can distinguish between normal and abnormal data points.

[0039] Anomaly detection is performed on each data point using the Local Outlier Factor (LOF) algorithm. This involves comparing the density of a data point with the density of its local neighbors to determine if it is an outlier. A lower density generally indicates a more likely outlier. The LEF algorithm compares the density of each data point with its neighbors; if the local density of a target point is significantly lower than its surrounding neighborhood, it is marked as an outlier. Density is not defined by the number of points per unit space, but rather by reachability distance. The density of a point is the reciprocal of its average reachability distance to its k nearest neighbors. The greater the distance, the lower the density. Neighborhood density difference is the difference in local density between the target point and its k nearest neighbors. Specifically, for each data point, the LEF algorithm calculates its local outlier factor. If the LEF is approximately 1, the point's density is similar to its neighbors, belonging to the normal group. If the LEF is significantly greater than 1, the point's density is much lower than its neighbors, making it a local outlier, i.e., an anomaly. The point anomaly detection module is a component that encapsulates a local outlier factor algorithm. It receives input feature data, calculates an anomaly score for each data point, and determines whether it is an anomaly based on a threshold. For example, suppose there is a feature sequence with a length of 5 windows. The feature vector of each window contains the mean and the error rate of the target stimulus. Window 1 is 450ms, 0%; Window 2 is 650ms, 10%; Window 3 is 440ms, 0%; Window 4 is 430ms, 0%; and Window 5 is 1200ms, 100%. The subject suddenly loses focus. Window 5 is far from the dense cluster formed by all other points in the feature space, and is therefore an anomaly.

[0040] For the original cognitive test data, reaction time and error rate are used as basic features and input into the point anomaly detection module. The local outlier factor algorithm is used to determine whether the reaction performance at a certain moment deviates significantly from the average level of the subject or the group. The point anomaly detection module is used to identify anomalies in the reaction time and error rate data points.

[0041] Learning from the pattern characteristics of time-series data involves automatically extracting and identifying meaningful, recurring dynamic patterns from data arranged in chronological order, such as trends in reaction time and fluctuations in error rates. This is used to identify overall trend anomalies, not just single-point anomalies. An LSTM autoencoder is a special neural network structure consisting of an encoder and a decoder, both constructed using Long Short-Term Memory (LSTM) network units. LSTM uses internal gating mechanisms, such as input gates, forget gates, and output gates, to determine which information to remember or forget. An autoencoder is an unsupervised learning model whose goal is to learn an efficient representation of the input data, i.e., an encoding, and then reconstruct the original input as accurately as possible from this representation. Its core idea is that data that can be easily reconstructed is normal data, while data that is difficult to reconstruct is abnormal data.

[0042] The encoder compresses the feature sequence of each window into a fixed-dimensional vector, capturing the overall window pattern; the decoder attempts to reconstruct the original window features. During training, the network learns the feature distribution of normal patterns on a large amount of normal window data. During reconstruction, the reconstruction error is calculated for each window, and when the error exceeds a statistical threshold, such as the 95th percentile of the reconstruction error in the training set, the window is determined to have a pattern aberration.

[0043] Specifically, the new, detectable temporal feature window sequence is input into a pre-trained LSTM autoencoder, performing an encoding-decoding process to output a reconstructed sequence. The reconstruction error of this sequence is calculated using mean squared error (MSE). A threshold is set; if the reconstruction error of the tested sequence is significantly higher than this threshold, the sequence is determined to contain a pattern anomaly. MSE is the average of the sum of squared errors and is typically used to evaluate the accuracy and performance of predictive models. The pattern anomaly detection module is a component that encapsulates the LSTM autoencoder model. It receives continuous temporal feature windows, calculates their reconstruction errors, and determines whether the sequence contains an anomalous pattern based on the magnitude of the error. For example, assuming a 45-minute continuous attention test, with 5-minute sliding windows, the mean reaction time is extracted as a feature, forming a 9-window temporal sequence. Trained on normal test data from hundreds of subjects, it learns that normal attention performance involves reaction time fluctuating slightly around a baseline during the test, without drastic, persistent drift. The mean responses of a new subject across nine consecutive windows were 450ms, 455ms, 460ms, 470ms, 485ms, 500ms, 520ms, 545ms, and 575ms. An LSTM autoencoder attempted to reconstruct this sequence, outputting 448ms, 452ms, 458ms, 465ms, 475ms, 485ms, 495ms, 505ms, and 515ms. Comparing the original and reconstructed sequences, especially in the latter part of the sequence, the difference was very significant, resulting in a calculated reconstruction error of 850. The reconstruction error threshold for normal sequences is typically below 200; the current sequence's 850 is far above this threshold, thus marking the sequence as anomalous. The mean responses of the new subject across nine consecutive windows exhibited a clear, monotonically increasing trend, not a sudden point of failure, but a slowly developing pattern of declining performance. Because the LSTM autoencoder had never seen such a persistently deteriorating pattern in normal data, it was unable to accurately reconstruct it, resulting in a high reconstruction error. At the cognitive level, this is very likely a typical behavioral sign of cognitive fatigue. This subtle and gradual change is completely undetectable by point anomaly detection modules.

[0044] The anomaly detection module focuses on whether data patterns are abnormal over a period of time, such as gradually lengthening reaction times or periodic fluctuations in error rates. It uses an LSTM autoencoder model to identify whether behavioral performance exhibits fatigue patterns or fluctuations in attention.

[0045] Task context information refers to the task settings for each block or trial in a cognitive test, such as block difficulty, stimulus type sequence, cue conditions, and time limits. The temporal features of each window or trial are fused with its corresponding task context information to form a contextual feature vector. The Transformer model is a deep learning model based on a self-attention mechanism, capable of capturing dependencies and pattern features in long sequences. The self-attention mechanism allows the Transformer model to capture the relationship between behavior and context in long sequences, outputting an anomalous score for each window or trial, indicating whether the behavior deviates from task requirements. Contextual anomalies are marked using threshold judgment, constructing a contextual anomaly detection module. This module identifies modules whose behavior does not conform to the task context by analyzing the rationality of temporal data within the context, marking abnormal behaviors that violate task expectations or logic. The Transformer model receives the same feature sequence but also embeds the stimulus method and block index of each window as key contextual information into the model. After training, it can learn normal behavioral patterns in specific contexts. When the subject's actual behavior deviates significantly from the behavior predicted by the model based on the context, that window is marked as a contextual anomaly.

[0046] The context anomaly detection module considers the task background, experimental procedure, and contextual information to determine whether behavior conforms to the expected test structure, such as whether the subject suddenly skips task logic. Within this module, based on the test task flow and stimulus sequence, a Transformer model is used to determine whether the subject exhibits behaviors that violate the task rhythm, ignore prompts, or click randomly, thus achieving comprehensive anomaly identification across time scales.

[0047] The point anomaly detection module, pattern anomaly detection module, and context anomaly detection module are connected in parallel. This means that the three modules independently process the simultaneously input feature data, ensuring that each module can focus on its area of ​​expertise, unaffected by the decisions of other modules. Finally, the judgment results are aggregated. The multi-level anomaly recognition space is a parallel analysis framework integrating multiple anomaly detection technologies. It examines data from different dimensions (point, sequence pattern, context) to comprehensively capture different types of behavioral anomalies, avoiding the limitations of single methods.

[0048] The obtained anomaly detection results at each level are input into the meta-classifier for comprehensive anomaly analysis and confidence judgment at each time point, and the anomaly identification verification results are output. The verification results are identified by the anomaly confidence.

[0049] Furthermore, this application also includes the following steps: the meta-classifier adopts a weighted decision mechanism. By training on historical datasets, the meta-classifier learns weighted rules under different types of anomalies and user cognitive differences. Based on the weighted rules, the anomaly identification results of the input multi-level are weighted and fused to output the final anomaly label and its confidence level at each time point.

[0050] Furthermore, this application also includes the following steps: the meta-classifier includes: an attention weighting layer, used to receive the preliminary results and contribution features of the point anomaly detection module, the pattern anomaly detection module, and the context anomaly detection module, and dynamically calculate the importance weight of each level result in the current context through a lightweight attention network; an incremental learning unit, used to incrementally update the sample data annotated by experts, dynamically adjust the internal weighting rules and decision boundaries, adapt to the differences in cognitive behavior of different users and the concept drift that occurs over time; and an interpretability output layer, used to perform anomaly attribution analysis based on the SHAP model, calculate the contribution of each input feature to the final anomaly judgment result, generate a readable attribution report, and identify the key features that cause the anomaly and the corresponding anomaly type.

[0051] Specifically, the meta-classifier is a high-level classifier built upon multiple base detectors. Its input consists of the anomaly detection results at each level: preliminary results and confidence scores for point anomaly detection, pattern anomaly detection, and context anomaly detection. The meta-classifier includes an attention-weighted layer, incremental learning units, and an interpretability output layer. It is trained using a historical dataset, where each sample contains preliminary scores from the three detectors and a true label determined by an expert. The meta-classifier's task is to learn a function: F(point anomaly score, pattern anomaly score, context anomaly score) → final label. Through learning, the meta-classifier automatically develops weighting rules. Based on these rules, it weights and fuses the anomaly detection results from the multiple levels, outputting the final anomaly label and its confidence score at each time point. The weighting rules define how to assign appropriate weights to the outputs of each detector given a specific scenario. For example, when both the pattern and context anomaly scores are high, it indicates a highly reliable anomaly signal and should be given high weights; conversely, when an isolated point anomaly has a high score but the other two scores are low, it may be a false alarm and should be given lower weights.

[0052] For each new time point, the meta-classifier receives scores from point anomaly detection, pattern anomaly detection, and context anomaly detection. It then uses its internally learned weighting rules to perform a weighted fusion calculation, outputting the final anomaly label and its confidence level for each time point. For example, assuming weights of 0.1 for point anomaly, 0.1 for pattern anomaly, and 0.8 for context anomaly, a point anomaly detection score of 0.15 indicates a reaction time within the normal range with no extreme values; a pattern anomaly detection score of 0.10 indicates a stable reaction time over the past few minutes with no trend change; and a context anomaly detection score of 0.90 indicates that in a high-risk context—with a pedestrian—the subject's reaction speed is only slightly faster than normal driving, far from the rapid reaction level required for emergency braking. The confidence level obtained through weighted fusion is 0.745, and the preset confidence threshold is 0.65. Since 0.745 > 0.65, the final anomaly label is determined to be an anomaly, with a confidence level of 0.745.

[0053] The attention-weighted layer receives preliminary results and contributing features from the point anomaly detection module, pattern anomaly detection module, and context anomaly detection module. A lightweight attention network dynamically calculates the importance weights of each layer's results within the current context. In other words, the attention-weighted layer receives preliminary anomaly results and related raw features from the three detection modules. The attention network analyzes these inputs. For example, if it finds that the scores for pattern anomalies and context anomalies are high, while the point anomaly score is low, and the raw features show a large label difference, based on patterns learned from historical data, it determines that this situation is more consistent with attention fluctuations than sudden anomalies. Therefore, it assigns higher weights (e.g., 0.5 and 0.4) to the outputs of the pattern anomaly and context anomaly modules, and lower weights (e.g., 0.1) to the point anomaly. A weighted average of the three scores is then calculated to obtain a final anomaly score. If this score exceeds a decision threshold (e.g., 0.65), the final anomaly label is output with a confidence level of 0.73.

[0054] Incremental learning units enable meta-classifiers to continuously learn and improve using newly labeled expert data after deployment, without requiring complete retraining. This addresses the issues of model adaptation to individual differences and concept drift, such as changes in user baseline performance over time. Incremental learning units are activated periodically or when a certain amount of data has accumulated, using this new data to fine-tune the parameters of the meta-classifier, rather than training from scratch. Concept drift is the phenomenon where the statistical properties behind the data slowly change over time. In cognitive tests, this can be caused by changes in the subject population, changes in the testing environment, or long-term changes in the subject's own state.

[0055] The interpretable output layer performs anomaly attribution analysis based on the SHAP model. It simulates inputting each feature one by one, observing the changes in the output score, and calculating a SHAP value for each input feature. Positive values ​​indicate that the feature pushes the prediction towards anomaly, while negative values ​​push it towards normality; the absolute value represents the influence. The SHAP model is based on game theory, calculating a SHAP value for each input feature, representing the contribution of that input feature to pushing the model output from the baseline value to the final predicted value. It traces and quantifies the root causes leading to the final decision, generating a readable attribution report that identifies the key features causing the anomaly and the corresponding anomaly type, thus clarifying which factors and their respective contributions jointly led to the anomaly determination.

[0056] Through a weighted decision-making mechanism and attention network, the meta-classifier is no longer a simple voting machine, but an expert that understands the scenario, knows how to weigh factors, and arrives at an accurate conclusion after comprehensive diagnosis. Incremental learning units can personalize and adapt to different users, maintaining accuracy over time and solving the problem of model rigidity. The SHAP-based interpretable layer provides a clear attribution chain.

[0057] Furthermore, this application also includes the following steps: establishing an anomaly collaboration relationship between the point anomaly detection module, the pattern anomaly detection module, and the context anomaly detection module; performing fusion verification constraints based on the anomaly collaboration relationship; performing interactive verification of the anomaly detection results at each level based on the fusion verification constraints; and inputting the multi-level anomaly identification results that have passed the interactive verification into the meta-classifier.

[0058] Furthermore, this application also includes the following steps: based on historical time-series data and expert knowledge, using the point anomaly detection module, pattern anomaly detection module, and context anomaly detection module as nodes, perform node relationship analysis, including at least: fusion relationship, dependency relationship, and contradictory relationship. The fusion relationship reflects the anomaly results identified by different modules that are temporally adjacent and semantically mutually supportive, and their joint occurrence points to a composite anomaly event with higher confidence. The dependency relationship indicates that the anomaly identification result of one module is a prerequisite or strong contextual clue for another module to trigger a specific analysis process. The contradictory relationship reflects logical conflicts in the judgment results of different modules on the same time period or related events. Based on the fusion relationship, dependency relationship, and contradictory relationship, establish connection edge attributes between nodes to construct a collaborative relationship graph structure that reflects the anomaly collaborative relationship.

[0059] Specifically, historical time-series data and expert knowledge are acquired. Historical time-series data consists of chronologically arranged records accumulated from past cognitive tests; expert knowledge comprises rules, annotations, typical anomaly patterns, labeled samples, and explanatory judgments provided by domain experts. Based on the historical time-series data and expert knowledge, the point anomaly detection module, pattern anomaly detection module, and context anomaly detection module are treated as nodes, and node relationship analysis is performed.

[0060] Node relationships include fusion, dependency, and contradiction. A fusion relationship refers to two or more modules being close in time, and the anomalies they detect mutually supporting and corroborating each other in cognitive interpretation, collectively pointing to a more convincing composite anomalous event. A dependency relationship refers to one module's anomaly identification result being a prerequisite or strong contextual cue for another module to initiate a specific analysis process. For example, the point anomaly detection module first identifies an extremely fast reaction time, such as 150ms, with an anomaly score of 0.90. As a strong signal, this triggers the context anomaly detection module to initiate a specific analysis process: checking the stimulus type corresponding to this extremely fast reaction. If the context anomaly detection module finds it to be a difficult stimulus with inconsistent color, then it will determine that this is an impulsive guessing contextual anomaly, resulting in a dependency relationship of point anomaly detection module → context anomaly detection module. A contradictory relationship refers to logical conflicts or inconsistencies in the judgment results of different modules on events occurring at the same time or logically closely related events. For example, the point anomaly detection module determines that the current time period is normal with an anomaly score of 0.1 because the reaction times are all within the normal range; however, the context anomaly detection module determines it as abnormal with an anomaly score of 0.8 because it finds that the subject's reaction speed on color-inconsistent stimuli is almost the same as that on color-consistent stimuli, which violates the basic law of the Stroop effect. Therefore, this constitutes a contradictory relationship between the anomaly detection module and the context anomaly detection module.

[0061] In graph data structures, the line connecting two nodes is called an edge, and attributes are descriptive information added to these edges. Specifically, attributes represent the type of relationship and can be extended to include the strength or confidence level of the relationship. Based on fusion relationships, dependency relationships, and contradictory relationships, connection edge attributes between nodes are established, thereby constructing a collaborative relationship graph structure. This structure reflects abnormal collaborative relationships and expresses the collaborative / triggering / conflict network structure between the point anomaly detection module, the pattern anomaly detection module, and the context anomaly detection module, resembling a knowledge graph or causal graph in form. The collaborative relationship graph structure is used to express which modules tend to collaboratively identify a certain type of anomaly, and which results are dependent on or contradictory to each other, thus supporting the fusion decision and verification constraints of the meta-classifier.

[0062] Based on abnormal collaborative relationships, fusion verification constraints are applied. These constraints are a series of conditions and standards established based on abnormal collaborative relationships to verify the credibility of the results, serving as a quality control and evidence integration mechanism. Specific verification actions and confidence adjustment strategies are defined for different types of collaborative relationships. For example, when a fusion relationship is triggered, the confidence of the final result should be significantly increased; when a contradictory relationship is triggered, the confidence of the final result should be significantly reduced, or a more complex arbitration mechanism must be initiated; when a dependency relationship is triggered, it must be ensured that the dependent module has executed its specific analysis process.

[0063] Based on the fusion verification constraints, the anomaly detection results at each level are interactively verified. This involves checking the logical consistency between the preliminary results output by the three detection modules according to the fusion verification constraints, and then correcting, weighting, or labeling them. The interactive verification process includes: evidence merging, dependency-triggered secondary checks, conflict resolution, and outputting a pass / fail / required-review label along with adjusted confidence levels. The multi-level anomaly identification results, after meeting the quality standards set by the fusion verification constraints, are used as the input feature set for the meta-classifier to perform the final anomaly determination and confidence level output. For example, assuming the point anomaly detection result is 0.1, the pattern anomaly detection result is 0.9, and the context anomaly detection result is 0.8, it is found that the pattern anomaly detection module and the context anomaly detection module have triggered a fusion relationship. Applying the corresponding consistency enhancement constraint, the joint output confidence of the pattern anomaly detection module and the context anomaly detection module is increased by 0.2. Simultaneously, the point anomaly detection module and the pattern anomaly detection module have triggered a contradictory relationship. Applying the conflict resolution constraint, since the pattern anomaly detection module and the context anomaly detection module have triggered a fusion relationship, the decision considers the conclusions of the pattern anomaly detection module and the context anomaly detection module to be more credible. Therefore, the weight of the point anomaly detection module in this decision is reduced, and the contradictory relationship between the point anomaly detection module and the pattern anomaly detection module is only recorded as a footnote, without significantly reducing the overall confidence. The anomaly identification result is marked as verified, and its comprehensive confidence is calculated to be 0.85, based on the high scores of the pattern anomaly detection module and the context anomaly detection module and the added benefit of the fusion relationship.

[0064] Through explicit collaborative relationships and fusion verification constraints, only highly reliable candidates that have undergone interactive verification are allowed to be sent to the final meta-classifier for decision-making, thereby maximizing the accuracy and reliability of the final anomaly labels at the source.

[0065] Furthermore, this application also includes the following steps: visualizing the final anomaly labels, anomaly confidence levels, and attribution reports to generate an interactive timeline anomaly map, wherein different levels and types of anomaly events are identified with different colors and markers, and attribution analysis is inserted into the anomaly events.

[0066] Specifically, the anomaly detection results obtained from multi-level anomaly identification are input into a meta-classifier for comprehensive anomaly analysis at each time point. An attention-weighted layer calculates the dynamic weights of each sub-module, and then a comprehensive anomaly score is calculated using a weighted fusion formula or a small fusion network. This comprehensive anomaly score is mapped to a confidence level. Based on the confidence level, the results are graded or labeled, such as high-confidence anomaly, medium-confidence anomaly, low-confidence anomaly, or normal. Comprehensive anomaly analysis at each time point means that the meta-classifier considers all levels of evidence at each time window, rather than viewing them in isolation. The confidence level judgment is a numerical value between 0 and 1 output by the meta-classifier, quantifying the reliability of its final decision. The final anomaly identification verification result includes anomaly labels and anomaly confidence levels. By running an interpretable output layer, anomaly attribution analysis is performed on the anomaly determination, calculating the contribution of each input feature to the final anomaly determination result, generating a readable attribution report, and identifying the key features leading to the anomaly and the corresponding anomaly type.

[0067] The final anomaly labels, anomaly confidence levels, and attribution reports are visualized using intuitive formats such as graphs and charts. The final anomaly labels, confidence levels, and attribution reports for each time point are linked to a timeline. A dynamic visualization tool uses the timeline as the horizontal axis, annotating anomaly events with different visual elements (colors, shapes, markers). Users can interact with the charts, such as clicking, zooming, and hovering to obtain more information. Different colors are used to categorize anomaly events, such as red for point anomalies, yellow for pattern anomalies, purple for contextual anomalies, triangles for high confidence, and circles for low confidence, etc.

[0068] The main view is a timeline overlaid with line charts representing behavioral metrics. Above the line charts, corresponding markers are drawn based on the time and type of the anomaly. For example, a high-confidence pattern anomaly is marked with a yellow inverted triangle at the corresponding time point. When the user clicks on this yellow inverted triangle, an information box pops up displaying a summary of the attribution report, such as: Anomaly type: Performance decline due to fatigue; Main contributing factors: Upward trend in reaction time 45%, delayed response to target stimulus 30%, late stage of testing 15%.

[0069] The timeline visualization allows participants to grasp the full picture, type, distribution, and severity of abnormalities throughout the testing process within seconds. Interactive attribution analysis enables users to quickly delve from "what" to "why," greatly enhancing the interpretability and persuasiveness of the results. The interactive timeline allows reviewers to quickly locate abnormalities, review the chain of evidence, and make judgments or feedback, significantly reducing manual review time. Clinicians can quickly identify participants' problems and develop intervention or research strategies based on clearly attributable abnormal events in cognitive tests.

[0070] In summary, the time-series data anomaly identification and verification method for cognitive testing provided in this application has the following beneficial effects: By collecting a time-series data sample set, including reaction time, reaction accuracy, stimulus type, and test block index, temporal features and domain-specific features are extracted from the original data based on the time-series data sample set. The temporal features include the mean and standard deviation of reaction time calculated in units of sliding windows, and the domain-specific features include the block index to which the window belongs and the error rate of the target stimulus. Multi-level anomaly identification is performed based on the temporal features and domain-specific features, including point anomaly detection, pattern anomaly detection, and context anomaly detection. The obtained anomaly detection results at each level are input into a meta-classifier for comprehensive analysis of anomalies at each time point and confidence level judgment, outputting anomaly identification verification results, and identifying the verification results through anomaly confidence. In other words, by collecting a time-series data sample set, extracting temporal and domain-specific features from it, performing multi-level anomaly identification, and inputting the anomaly detection results at each level into a meta-classifier for comprehensive analysis of anomalies at each time point and confidence level judgment, the accuracy and reliability of time-series data anomaly identification are improved, thereby enhancing the reliability of cognitive testing.

[0071] Example 2: Based on the same inventive concept as the time-series data anomaly identification and verification method for cognitive testing in Example 1, this application also provides a time-series data anomaly identification and verification system for cognitive testing. Please refer to the appendix. Figure 2 The time-series data anomaly identification and verification system for cognitive testing includes: The data collection module 11 is used to collect a time-series data sample set, including reaction time, reaction correctness, stimulus mode, and test block index; the feature extraction module 12 is used to extract temporal features and domain-specific features from the original data based on the time-series data sample set, wherein the temporal features include the mean and standard deviation of reaction time calculated in units of sliding windows, and the domain-specific features include the block index to which the window belongs and the error rate of the target stimulus; the multi-level anomaly identification module 13 is used to perform multi-level anomaly identification based on the temporal features and domain-specific features, including point anomaly detection, pattern anomaly detection, and context anomaly detection; the anomaly analysis module 14 is used to input the obtained anomaly detection results of each level into a meta-classifier for comprehensive anomaly analysis and confidence judgment at each time point, output anomaly identification verification results, and identify the verification results through anomaly confidence.

[0072] Furthermore, the feature extraction module 12 in the time-series data anomaly identification and verification system for cognitive testing is also used for: cleaning the original data to remove extreme values, missing data, and invalid data caused by equipment failure; segmenting the sample data from the cleaned original data according to a preset sliding window size, calculating the mean and standard deviation of reaction time within each sliding window to obtain temporal features; locating the order and division rules of the test blocks to which the data within the sliding window belongs based on the test block index of the original data, and marking the block index corresponding to the data; calculating the error ratio based on the number of trials and correctness of all target stimuli within each sliding window to obtain the target stimulus error ratio; wherein, the domain difference features are determined by the block index of the sliding window and the target stimulus error ratio.

[0073] Furthermore, the multi-level anomaly detection module 13 in the time-series data anomaly detection and verification system for cognitive testing is also used to: establish a multi-level anomaly detection space, including a point anomaly detection module, a pattern anomaly detection module, and a context anomaly detection module; the point anomaly detection module is used to identify anomalies in reaction time and error rate data points; the pattern anomaly detection module is used to identify anomaly patterns in reaction time and error rate that gradually decay or fluctuate in frequency; and the context anomaly detection module is used to analyze the context information of the cognitive test and identify behaviors that do not conform to the task requirements.

[0074] Furthermore, the multi-level anomaly detection module 13 in the time-series data anomaly detection verification system for cognitive testing is also used for: learning anomaly point features based on a multi-scenario sample set for anomaly identification; performing anomaly detection for each data point using the local outlier factor algorithm; constructing a point anomaly detection module; identifying anomalous data points that deviate from normal behavior patterns by analyzing the density differences of each data point relative to its neighborhood; learning pattern features based on time-series data; training and reconstructing the features of each data window using an LSTM autoencoder; identifying anomalies in reaction time or error rate change patterns; constructing a pattern anomaly detection module; combining task background information and contextual features of time-series data; modeling the data using a Transformer model; identifying behavioral patterns that do not conform to task requirements; and connecting the point anomaly detection module, pattern anomaly detection module, and context anomaly detection module in parallel to construct the multi-level anomaly detection space.

[0075] Furthermore, the anomaly analysis module 14 in the time-series data anomaly identification and verification system for cognitive testing is also used for: the meta-classifier adopts a weighted decision mechanism, and through training on historical datasets, the meta-classifier learns weighted rules under different types of anomalies and user cognitive difference scenarios, and performs weighted fusion on the input multi-level anomaly identification results based on the weighted rules, and outputs the final anomaly label and its confidence level at each time point.

[0076] Furthermore, the anomaly analysis module 14 in the time-series data anomaly identification and verification system for cognitive testing is also used for: the meta-classifier includes: an attention weighting layer, used to receive the preliminary results and contribution features of the point anomaly detection module, the pattern anomaly detection module, and the context anomaly detection module, and dynamically calculate the importance weight of each level result in the current context through a lightweight attention network; an incremental learning unit, used to incrementally update the sample data annotated by experts, dynamically adjust the internal weighting rules and decision boundaries, adapt to the differences in cognitive behavior of different users and the concept drift that occurs over time; and an interpretability output layer, used to perform anomaly attribution analysis based on the SHAP model, calculate the contribution of each input feature to the final anomaly judgment result, generate a readable attribution report, and identify the key features that cause the anomaly and the corresponding anomaly type.

[0077] Furthermore, the anomaly analysis module 14 in the time-series data anomaly identification and verification system for cognitive testing is also used to: establish anomaly collaboration relationships among the point anomaly detection module, the pattern anomaly detection module, and the context anomaly detection module; perform fusion verification constraints based on the anomaly collaboration relationships; perform interactive verification of the anomaly detection results at each level based on the fusion verification constraints; and input the multi-level anomaly identification results that have passed the interactive verification into the meta-classifier.

[0078] Furthermore, the anomaly analysis module 14 in the time-series data anomaly identification and verification system for cognitive testing is also used to: perform node relationship analysis based on historical time-series data and expert knowledge, using the point anomaly detection module, pattern anomaly detection module, and context anomaly detection module as nodes, including at least: fusion relationship, dependency relationship, and contradictory relationship. The fusion relationship reflects anomaly results identified by different modules that are temporally adjacent and semantically mutually supportive, and their joint occurrence points to a composite anomaly event with higher confidence. The dependency relationship indicates that the anomaly identification result of one module is a prerequisite or strong contextual clue for another module to trigger a specific analysis process. The contradictory relationship reflects logical conflicts in the judgment results of different modules on the same time period or related events. Based on the fusion relationship, dependency relationship, and contradictory relationship, connection edge attributes between nodes are established to construct a collaborative relationship graph structure, reflecting the anomaly collaborative relationship.

[0079] Furthermore, the anomaly analysis module 14 in the time-series data anomaly identification and verification system for cognitive testing is also used to: visualize the final anomaly label, anomaly confidence and attribution report, generate an interactive time-axis anomaly map, wherein different levels and types of anomaly events are identified with different colors and markers, and attribution analysis is inserted into the anomaly events.

[0080] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Figure 1 The time series data anomaly identification and verification method and specific examples for cognitive testing in Example 1 are also applicable to the time series data anomaly identification and verification system for cognitive testing in this embodiment. Through the foregoing detailed description of the time series data anomaly identification and verification method for cognitive testing, those skilled in the art can clearly understand the time series data anomaly identification and verification system for cognitive testing in this embodiment. Therefore, for the sake of brevity, it will not be described in detail here.

[0081] The above description of the disclosed embodiments enables those skilled in the art to make or use this application. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of this application. Therefore, this application is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

[0082] Obviously, those skilled in the art can make several improvements and modifications to this application without departing from the principles of this application, and these improvements and modifications also fall within the protection scope of this application.

Claims

1. A method for identifying and verifying anomalies in time-series data for cognitive testing, characterized in that, include: Collect a time-series data sample set, including reaction time, reaction correctness, stimulus type, and test block index; Based on the time-series data sample set, temporal features and domain-specific features are extracted from the original data. The temporal features include the mean and standard deviation of reaction time calculated in units of sliding windows. The domain-specific features include the block index to which the window belongs and the error rate of the target stimulus. Multi-level anomaly identification is performed based on the aforementioned temporal features and domain-specific differences, including point anomaly detection, pattern anomaly detection, and context anomaly detection. The obtained anomaly detection results at each level are input into the meta-classifier for comprehensive anomaly analysis and confidence judgment at each time point, and the anomaly identification verification results are output. The verification results are identified by the anomaly confidence.

2. The method for identifying and verifying anomalies in time-series data for cognitive testing according to claim 1, characterized in that, Based on the aforementioned time-series data sample set, temporal features and domain-specific features are extracted from the original data, including: Clean the raw data to remove extreme values, missing data, and invalid data caused by equipment failure; The sample data is segmented from the cleaned raw data according to the preset sliding window size, and the mean and standard deviation of the reaction time within each sliding window are calculated to obtain the time domain features. Based on the test block index of the original data, locate the order and division rules of the test blocks to which the data belongs within the sliding window, and mark the block index corresponding to the data; Based on the number of trials and correctness of all target stimuli within each sliding window, the error rate is calculated to obtain the target stimulus error rate. The domain-specific characteristics are determined by the block index of the sliding window and the error rate of the target stimulus.

3. The method for identifying and verifying anomalies in time-series data for cognitive testing according to claim 1, characterized in that, Before performing multi-level anomaly identification based on the aforementioned temporal features and domain-specific differences, the process includes: Establish a multi-level anomaly detection space, including a point anomaly detection module, a pattern anomaly detection module, and a context anomaly detection module; The point anomaly detection module is used to identify anomalies in reaction time and error rate data points; The anomaly detection module is used to identify abnormal patterns where the reaction time and error rate gradually decrease or fluctuate in frequency. The context anomaly detection module is used to analyze the context information of the cognitive test and identify behaviors that do not conform to the task requirements.

4. The method for identifying and verifying anomalies in time-series data for cognitive testing according to claim 3, characterized in that, Establish a multi-level anomaly detection space, including: Based on the anomaly identification multi-scenario sample set, anomaly point feature learning is performed. The local outlier factor algorithm is used to identify and detect anomalies for each data point. A point anomaly detection module is constructed. By analyzing the density difference of each data point relative to its neighborhood, abnormal data points that deviate from normal behavior patterns are identified. Based on time-series data pattern feature learning, the features of each data window are trained and reconstructed through an LSTM autoencoder to identify anomalies in reaction time or error rate change patterns and build a pattern anomaly detection module. By combining task background information and contextual features of time-series data, the data is modeled using the Transformer model to identify behavioral patterns that do not conform to task requirements and to build a context anomaly detection module. The point anomaly detection module, pattern anomaly detection module, and context anomaly detection module are connected in parallel to construct the multi-level anomaly recognition space.

5. The method for identifying and verifying anomalies in time-series data for cognitive testing according to claim 3, characterized in that, The meta-classifier adopts a weighted decision mechanism. By training on historical datasets, the meta-classifier learns weighted rules under different types of anomalies and user cognitive differences. Based on the weighted rules, it performs weighted fusion on the anomaly identification results of the input multi-level system and outputs the final anomaly label and its confidence level at each time point.

6. The method for identifying and verifying anomalies in time-series data for cognitive testing according to claim 5, characterized in that, The meta-classifier includes: The attention weighting layer is used to receive the preliminary results and contribution features of the point anomaly detection module, the pattern anomaly detection module and the context anomaly detection module, and dynamically calculate the importance weight of each layer's results in the current context through a lightweight attention network. The incremental learning unit is used to incrementally update the sample data annotated by experts, dynamically adjust the internal weighting rules and decision boundaries, and adapt to the differences in cognitive behavior of different users and the concept drift that occurs over time. The interpretable output layer is used for anomaly attribution analysis based on the SHAP model, calculating the contribution of each input feature to the final anomaly determination result, generating a readable attribution report, and identifying the key features that lead to the anomaly and the corresponding anomaly type.

7. The method for identifying and verifying anomalies in time-series data for cognitive testing according to claim 6, characterized in that, After outputting the anomaly detection verification results, the following is also included: The final anomaly labels, anomaly confidence levels, and attribution reports are visualized to generate an interactive timeline anomaly map. Different levels and types of anomaly events are identified with different colors and markers, and attribution analysis is inserted into the anomaly events.

8. The method for identifying and verifying anomalies in time-series data for cognitive testing according to claim 6, characterized in that, The weighted fusion of anomaly detection results from multiple levels of input based on weighted rules also includes: Establish the abnormal collaboration relationship between the point anomaly detection module, the pattern anomaly detection module, and the context anomaly detection module; Fusion verification constraints are performed based on the aforementioned abnormal collaborative relationships; Based on the fusion verification constraints, the anomaly detection results of each level are interactively verified, and the multi-level anomaly identification results that have passed the interactive verification are input into the meta-classifier.

9. The method for identifying and verifying anomalies in time-series data for cognitive testing according to claim 8, characterized in that, Establishing the anomaly coordination relationship among the point anomaly detection module, the pattern anomaly detection module, and the context anomaly detection module includes: Based on historical time-series data and expert knowledge, the point anomaly detection module, pattern anomaly detection module, and context anomaly detection module are used as nodes to perform node relationship analysis, which includes at least: fusion relationship, dependency relationship, and contradictory relationship. The fusion relationship reflects anomaly results identified by different modules that are temporally adjacent and semantically mutually supportive, and their joint occurrence points to a composite anomaly event with higher confidence. The dependency relationship indicates that the anomaly identification result of one module is a prerequisite or strong contextual clue for another module to trigger a specific analysis process. The contradictory relationship reflects logical conflicts in the judgment results of different modules on the same time period or related events. Based on the aforementioned fusion, dependency, and contradiction relationships, connection edge attributes are established between nodes to construct a collaborative relationship graph structure that reflects the abnormal collaborative relationships.

10. A time-series data anomaly identification and verification system for cognitive testing, characterized in that, The steps for implementing the time-series data anomaly identification and verification method for cognitive testing according to any one of claims 1 to 9, wherein the time-series data anomaly identification and verification system for cognitive testing comprises: The data collection module is used to collect time-series data samples, including reaction time, reaction correctness, stimulus type, and test block index. The feature extraction module is used to extract temporal features and domain-specific features from the original data based on the time-series data sample set. The temporal features include the mean and standard deviation of reaction time calculated in units of sliding windows, and the domain-specific features include the block index to which the window belongs and the error rate of the target stimulus. The multi-level anomaly detection module is used to perform multi-level anomaly detection based on the time-domain features and domain-specific features, including point anomaly detection, pattern anomaly detection, and context anomaly detection. The anomaly analysis module is used to input the obtained anomaly detection results at each level into the meta-classifier for comprehensive anomaly analysis and confidence judgment at each time point, and output the anomaly identification verification result. The verification result is identified by the anomaly confidence.

Images