A large model-based behavior data intelligent analysis method

Abstract

The application relates to the field of data processing and intelligent analysis, and discloses a behavior data intelligent analysis method based on a large model; behavior data of at least two types of data sources is acquired, behavior event streams are generated by eventization, and cross-source alignment is completed; a behavior primitive library is established and is mapped into a primitive sequence, is cut to form a behavior segment, and a time sequence chain is constructed; an analysis request is received, a structured analysis plan is generated by a pre-trained large model; index results are calculated in a controlled environment according to the analysis plan, and an evidence package is retrieved and assembled, an attribution explanation and an optimized action are generated by inputting the large model; consistency verification is performed on the index results and the attribution explanation, and if the verification fails, re-planning or degradation is triggered; and analysis results, a confidence score and a reproducible identifier are output. The method realizes unified analysis caliber, and the results are verifiable and traceable.

Description

Technical Field

[0001] This invention relates to the field of data processing and intelligent analysis, specifically to a method for intelligent analysis of behavioral data based on a large model. Background Technology

[0002] With the rapid development of internet businesses, mobile applications, and industrial information systems, user behavior data, such as browsing, searching and ordering, work order processing, and terminal operations, exhibits high-frequency, multi-source, and strong time-series characteristics. Enterprises typically rely on behavioral analysis to achieve conversion funnel assessment, function iteration verification, anomaly risk identification, and refined operations. Therefore, higher requirements are placed on the stability, interpretability, and verifiability of the analysis results.

[0003] Existing solutions typically aggregate behavioral data through event tracking SDKs, log collection chains, or message queues. After cleaning, deduplication, field standardization, and session segmentation, event sequences are constructed. Then, metrics results are output using methods such as cluster statistics, funnel transformation, retention and follow-up analysis, and path analysis. Some systems use rule engines or machine learning models for attribution filtering and anomaly detection, and provide multi-dimensional filtering, drill-down, and visualization in reporting platforms. With the emergence of large-scale model applications, some platforms have introduced natural language retrieval and automatic interpretation capabilities to parse analysis requests and generate conclusion descriptions.

[0004] Because behavioral data comes from diverse sources and the collection criteria, field meanings, and semantic mapping rules are inconsistent across different systems, the analysis process often struggles to form a reproducible, unified computational chain and verifiable evidence citation relationships. This leads to fluctuations in output results for the same analytical objective at different times or with different data calibers, making it difficult to reliably trace and verify conclusions, thus affecting their credibility and usability in critical decision-making scenarios. Summary of the Invention

[0005] To address the shortcomings of existing technologies, this invention provides a method for intelligent analysis of behavioral data based on large models, thereby solving the technical problems existing in the prior art.

[0006] The above-mentioned technical objective of the present invention is achieved through the following technical solution: A behavioral data intelligent analysis method based on a large model includes the following steps: S1: Behavior event-based construction: Obtain behavioral data from at least two types of data sources, encapsulate the behavioral data into events to generate a behavioral event stream. Each behavioral event in the behavioral event stream includes at least the subject identifier, behavior type, object identifier, occurrence time, source identifier, and context attributes. The context attributes include one or more of the following: session identifier, terminal identifier, page identifier, and business process identifier. S2: Behavior semantic alignment and primitive mapping: A behavior primitive library is built based on behavior semantic alignment rules, and behavior events in the behavior event stream are mapped to behavior primitive sequences; S3: Construction of Behavioral Segments and Temporal Chains: The sequence of behavioral primitives is segmented according to time windows to generate multiple behavioral segments, and a temporal chain is constructed for each behavioral segment. The temporal chain includes at least the starting primitive, the key primitive, the ending primitive, and the primitive transfer relationship. S4: Analysis Plan Generation: Receives analysis requests, calls a pre-trained large model to parse the analysis requests, determines the analysis objectives, indicator set, constraints, cluster dimensions, and confidence requirements, and outputs the analysis plan in the form of structured fields. The structured fields include at least the analysis objectives, indicator set, constraints, cluster dimensions, confidence requirements, indicator calculation steps, data filtering conditions, cluster logic, and attribution candidate paths. S5: Statistical Feature Generation and Deterministic Indicator Calculation: Statistical features are generated based on behavioral segments and time series chains, and indicators are calculated on the statistical features through a deterministic execution path according to the analysis plan to obtain indicator results; S6: Evidence Package Retrieval and Assembly: Retrieve and assemble evidence packages from the evidence database according to the analysis plan. Each evidence package shall include at least the definition of indicators, mapping relationships of behavioral primitives, and fragments of similar historical behaviors. S7: Large Model Attribution Reasoning: The evidence package and indicator results are input into the pre-trained large model through the large model reasoning path to generate attribution explanations, key driving factors, and optimized actions corresponding to behavioral primitives or behavioral fragments. S8: Consistency Verification and Strategy Triggering: Perform consistency verification between the indicator results output by the deterministic execution path and the attribution explanation output by the large model inference path. If the consistency verification fails, trigger the regeneration of the analysis plan or trigger the degradation strategy to generate degradation analysis results. S9. Results Output and Credibility Labeling: Output the analysis results and generate a confidence score for the analysis results. At the same time, output the evidence citation index and reproducible execution identifier corresponding to the confidence score.

[0007] Preferably, step S1 includes: Timestamp alignment is performed on behavioral data from different data sources to form a unified time base; Based on the subject identifier, cross-source association is performed on behavioral events corresponding to different behavioral data sources, and behavioral events of the same subject within the same session identifier within the same time range are merged into the same behavioral event stream; The context attributes of the behavior events are completed, and the completed behavior events are sorted by occurrence time to form a globally time-consistent behavior event stream, thereby providing a unified input for subsequent behavior primitive sequence mapping and behavior segmentation.

[0008] Preferably, the behavior primitive library established in step S2 includes at least primitive encoding, primitive semantic description, trigger condition template, field mapping relationship, and mapping version identifier; The trigger condition template is used to limit the event type conditions and context attribute conditions that the behavior event must satisfy in order to trigger the matching of the corresponding behavior primitive; The field mapping relationship is used to map behavioral event fields to a standard set of behavioral primitives, and to distinguish behavioral primitive sequences generated under different versions based on the mapping version identifier, so as to support the retrospective reproduction and audit traceability of historical analysis results.

[0009] Preferably, step S3 includes: A behavior segmentation strategy combining fixed time windows and event-triggered windows is adopted. Fixed time windows are used to generate basic behavior segments, while event-triggered windows are used to extract enhanced behavior segments centered on key primitives when preset key primitives are detected. Preset key primitives are behavior primitives marked as key in the behavior primitive library or behavior primitives specified by the analysis plan. The temporal chain is constructed as a directed structure, and the number of transitions, the time interval between transitions, and the direction of transition are recorded for each primitive transition relation to generate temporal chain features; Temporal chain features are used to support at least the generation of attribution candidate paths and the retrieval of historically similar behavioral fragments.

[0010] Preferably, step S5 includes: Statistical features are generated based on behavioral segments. The statistical features include at least two or more of the following: frequency features, dwell time features, conversion path length features, return visit interval features, and funnel conversion features. Generate structured query statements or domain-specific language scripts based on the analysis plan, and execute them in an isolated, controlled execution environment to output metric results; When outputting indicator results, sample size statistics, outlier statistics, and missing value statistics are output simultaneously to form verifiable supporting information for the indicator results; When the sample size statistics do not meet the confidence requirements or the proportion of outliers exceeds the preset threshold, the data filtering conditions or cluster dimensions are adjusted, and the deterministic execution path is re-executed to update the indicator results.

[0011] Preferably, the analysis plan output in step S4 further includes an execution budget and a verification threshold. The execution budget is used to limit the maximum amount of data, the maximum execution time, or the maximum number of cluster combinations for indicator calculation, and the verification threshold is used to limit the conditions for passing the consistency verification. When the execution budget is triggered, the degradation strategy includes at least reducing the cluster granularity, shortening the time window range, or reducing non-critical indicators in the indicator set, in order to generate degradation analysis results that meet the execution budget constraints and keep the degradation analysis results consistent with the analysis objectives. The analysis plan is also used to output a set of behavioral primitives that match the attribution candidate paths, in order to constrain the scope of evidence retrieval and improve the consistency of subsequent attribution reasoning.

[0012] Preferably, step S6 includes: Based on the mapping relationship of behavioral primitives, determine the primitive coverage set corresponding to the indicator set, and retrieve historical similar behavioral fragments that match the primitive coverage set from the evidence base; Calculate the similarity of historical similar behavior segments and sort them to obtain TopK similar segments. The similarity is determined based on at least two or more of the following: key primitive sequence overlap, temporal chain transition pattern similarity, and distance measure of statistical features. The fragment summaries, key primitive sequences, historical indicator results, and mapping version identifiers corresponding to TopK similar fragments are written into the evidence package to form evidence items, so that subsequent attribution inference can output stable conclusions based on historical comparison evidence.

[0013] Preferably, the attribution explanation generated in step S7 is a structured output, which includes attribution conclusions, a list of driving factors, direction of influence, intensity of influence, and corresponding evidence citation index. The evidence reference index points to evidence entries in the evidence package that define the indicator criteria, map the behavioral primitives, or identify historically similar behavioral fragments. The attribution explanation further includes counterfactual comparison information, which is used to characterize the trend of change of the comparison index results obtained by re-executing the deterministic execution path based on the analysis plan after removing the behavioral primitives or behavioral fragments corresponding to the selected driving factors in the list of driving factors, so as to enhance the verifiability of the attribution explanation.

[0014] Preferably, the consistency check in step S8 includes at least two or more of the following check items: Sample size consistency check is used to determine whether the sample range covered by the attribution explanation is consistent with the sample range corresponding to the indicator results. Boundary consistency check is used to determine whether changes in key indicators involved in the attribution explanation fall within the threshold range of the indicator results; Trend consistency check is used to determine whether the trend direction described by the attribution explanation is consistent with the time series trend direction of the indicator results. When any verification item fails to meet the verification threshold, the analysis plan is regenerated to regenerate the evidence package and re-execute the deterministic execution path and the large model inference path. When the number of replanning attempts reaches the preset limit or the execution budget is triggered, the degradation strategy is executed and the degradation analysis results are output.

[0015] Preferably, the confidence score in step S9 is determined by at least the following factors: Sample size score is used to characterize the statistical stability of the indicator results; Consistency score, used to characterize the degree to which consistency verification passes; Evidence coverage score is used to characterize the degree to which the evidence package covers the mapping relationship between the indicator set and the behavioral primitives; The reproducible execution identifier includes one or more of the following: hash value of structured query statement, version number of domain-specific language script, or execution plan identifier, to support the reproducibility verification of analysis results; The method also includes a drift monitoring and updating step, which is used to monitor the distribution of behavioral primitive sequences, indicator results, or driving factor categories, and generate a drift score. When the drift score exceeds the drift threshold, it triggers an update to the trigger condition template, field mapping relationship, or mapping version identifier of the behavioral primitive library. At the same time, it iterates the version of the indicator caliber definition and historical similar behavioral fragments in the evidence library to maintain the consistency and interpretability of the analysis results under changes in behavioral patterns.

[0016] In summary, the present invention has the following main beneficial effects: This invention encapsulates behavioral data from at least two types of data sources into event-based streams, and further constructs a globally consistent input through timestamp alignment and cross-source association. This enables behavioral data from different sources and with different collection criteria to be processed consistently within the same session identifier and context attribute framework. By establishing a behavioral primitive library containing primitive encoding, trigger condition templates, and field mapping relationships, and introducing a mapping version identifier into the mapping process, the behavioral event stream can be stably mapped into a sequence of behavioral primitives with a traceable caliber benchmark. Thus, even when behavioral data has differences in fields, sources, and long-term evolution, it can still achieve unified semantic alignment and result reproducibility for behavioral analysis, reducing ambiguity and analytical bias caused by cross-source data fusion.

[0017] This invention generates behavioral fragments by combining fixed time windows with event trigger windows, and constructs a temporal chain containing start primitives, key primitives, end primitives, and primitive transition relationships. It also records the number of transitions and the time interval between transitions to form temporal chain features, enabling the changes in behavioral paths to be characterized in a structured manner and used for subsequent retrieval and attribution. By receiving analysis requests and calling a pre-trained large model to output a structured field analysis plan, and generating structured query statements or domain-specific language scripts according to the analysis plan in a deterministic execution path, it executes these in an isolated, controlled execution environment. Simultaneously, it outputs sample size statistics, outlier statistics, and missing value statistics, thereby achieving deterministic calculation and verifiable support for indicator results. This avoids the problems of caliber drift and unverifiable results caused by relying solely on inference generation, improving the stability and feasibility of behavioral data analysis.

[0018] This invention retrieves and assembles an evidence package from an evidence database based on an analysis plan. This package includes definitional indicators, mapping relationships between behavioral primitives, and historical similar behavioral fragments. The historical similar behavioral fragments are then ranked by similarity to obtain Top K similar fragments. The evidence entries and indicator results are input into a pre-trained large-scale model to generate structured attribution explanations. Consistency checks are performed between the attribution explanations and the indicator results. If the consistency check fails, the analysis plan is regenerated or a degradation strategy is implemented. This ensures that the large-scale model's inference path is constrained by a deterministic execution path and evidence citation index, thus maintaining verifiability and consistency while outputting attribution conclusions and optimization actions. Furthermore, by generating confidence scores, outputting reproducible execution identifiers, and implementing drift monitoring and version iteration, the analysis results can be reliably labeled, reproducibly verified, and stably operated even under changing behavioral patterns, improving the usability and reliability of intelligent behavioral data analysis in practical business applications. Attached Figure Description

[0019] Figure 1 This is a flowchart of the method of the present invention. Detailed Implementation

[0020] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0021] Example 1 refer to Figure 1 A behavioral data intelligent analysis method based on a large model includes the following steps: S1: Behavior event-based construction: Obtain behavioral data from at least two types of data sources, encapsulate the behavioral data into events to generate a behavioral event stream. Each behavioral event in the behavioral event stream includes at least the subject identifier, behavior type, object identifier, occurrence time, source identifier, and context attributes. The context attributes include one or more of the following: session identifier, terminal identifier, page identifier, and business process identifier. S2: Behavior semantic alignment and primitive mapping: A behavior primitive library is built based on behavior semantic alignment rules, and behavior events in the behavior event stream are mapped to behavior primitive sequences; S3: Construction of Behavioral Segments and Temporal Chains: The sequence of behavioral primitives is segmented according to time windows to generate multiple behavioral segments, and a temporal chain is constructed for each behavioral segment. The temporal chain includes at least the starting primitive, the key primitive, the ending primitive, and the primitive transfer relationship. S4: Analysis Plan Generation: Receives analysis requests, calls a pre-trained large model to parse the analysis requests, determines the analysis objectives, indicator set, constraints, cluster dimensions, and confidence requirements, and outputs the analysis plan in the form of structured fields. The structured fields include at least the analysis objectives, indicator set, constraints, cluster dimensions, confidence requirements, indicator calculation steps, data filtering conditions, cluster logic, and attribution candidate paths. S5: Statistical Feature Generation and Deterministic Indicator Calculation: Statistical features are generated based on behavioral segments and time series chains, and indicators are calculated on the statistical features through a deterministic execution path according to the analysis plan to obtain indicator results; S6: Evidence Package Retrieval and Assembly: Retrieve and assemble evidence packages from the evidence database according to the analysis plan. Each evidence package shall include at least the definition of indicators, mapping relationships of behavioral primitives, and fragments of similar historical behaviors. S7: Large Model Attribution Reasoning: The evidence package and indicator results are input into the pre-trained large model through the large model reasoning path to generate attribution explanations, key driving factors, and optimized actions corresponding to behavioral primitives or behavioral fragments. S8: Consistency Verification and Strategy Triggering: Perform consistency verification between the indicator results output by the deterministic execution path and the attribution explanation output by the large model inference path. If the consistency verification fails, trigger the regeneration of the analysis plan or trigger the degradation strategy to generate degradation analysis results. S9. Results Output and Credibility Labeling: Output the analysis results and generate a confidence score for the analysis results. At the same time, output the evidence citation index and reproducible execution identifier corresponding to the confidence score.

[0022] The method described herein is used to automatically calculate metrics, locate discrepancies, and output attribution explanations for user behavior, device operation behavior, or business process behavior. To ensure the verifiability and reproducibility of the output results, this embodiment divides the analysis process into a deterministic execution path and a large-model inference path, and uses consistency checks to align the outputs of the two paths, enabling those skilled in the art to achieve stable and usable intelligent analysis of behavioral data based on the description in this embodiment.

[0023] In one possible implementation, the method is collaboratively completed by a data access service, a behavior processing service, an indicator calculation engine, an evidence base and evidence retrieval service, a large model service, a consistency verification service, and a result output service. The data access service is used to access behavioral data from different sources; the behavior processing service is used to perform behavior eventification, behavior primitive mapping, behavior fragment segmentation, and time-series chain construction; the indicator calculation engine is used to execute structured query statements or domain-specific language scripts and output indicator results; the evidence base is used to store indicator definitions, behavior primitive mapping relationships, and historical similar behavior fragment indexes; the large model service is used to output analysis plans and attribution explanations; the consistency verification service is used to perform consistency verification on indicator results and attribution explanations and trigger the regeneration of analysis plans or degradation strategies; and the result output service is used to generate confidence scores, evidence citation indexes, and reproducible execution identifiers.

[0024] In one possible implementation, the data access service, behavior processing service, indicator calculation engine, consistency verification service, and result output service run on at least one server or computing node. The server includes a processor, a memory, and a communication interface. The memory stores a computer program, which, when executed by the processor, implements steps S1 to S9. The communication interface is used to interact with external data sources, evidence libraries, and pre-trained large model services, thereby supporting the collaborative execution of behavior data collection and processing, indicator calculation, evidence retrieval, and attribution reasoning.

[0025] In step S1, behavioral data from at least two types of data sources is acquired, and the behavioral data is encapsulated into events to generate a behavioral event stream. The data sources may include two or more types of data, such as application logs, web page tracking logs, terminal device operation logs, and business system operation records. The data sources are associated with each other through a subject identifier.

[0026] To avoid ambiguity in subsequent processing caused by differences in fields from multiple data sources, this embodiment encapsulates different behavioral data into a unified behavioral event structure. Each behavioral event in the behavioral event stream includes at least a subject identifier, behavior type, object identifier, occurrence time, source identifier, and context attributes. Context attributes include one or more of the following: session identifier, terminal identifier, page identifier, and business process identifier. Specifically, the session identifier represents the set of sessions formed by the same subject during continuous interaction, and the time range corresponding to the session identifier can be determined by the start and end event times. The terminal identifier distinguishes the terminal instance where the behavior occurs. The page identifier describes the interface or functional module where the behavior occurs, and the business process identifier describes the business link or task stage to which the behavior belongs.

[0027] In one possible implementation, this embodiment timestamps behavioral data from different data sources to form a unified time reference. Timestamp alignment can be achieved through server-received time calibration, acquisition-end clock deviation estimation, or alignment window sliding matching. After timestamp alignment, cross-source association is performed on behavioral events corresponding to different behavioral data sources based on the subject identifier. Behavioral events of the same subject within the same session identifier's time range are merged into the same behavioral event stream. The completed behavioral events are then sorted by occurrence time to form a globally time-consistent behavioral event stream, thus providing a unified input for subsequent behavioral primitive sequence mapping and behavioral segmentation.

[0028] In one implementation, when the terminal identifier, page identifier, or business process identifier of a behavioral event is missing, the system performs completion according to a preset field completion priority. This completion priority includes at least session cache information, terminal registration information, and business process mapping table information. When completion is impossible, the missing field is recorded as an empty value and marked as missing. Furthermore, behavioral events or fragments with missing key field markers can be excluded in subsequent data filtering conditions to avoid clustering ambiguity or indicator deviation caused by missing fields. For behavioral events with time anomalies, the system can correct or remove them based on a unified time benchmark and record the removal ratio in the outlier statistics.

[0029] In step S2, a behavioral primitive library is established based on behavioral semantic alignment rules, and behavioral events in the behavioral event stream are mapped to sequences of behavioral primitives. Behavioral primitives are used to describe standardized behavioral units with clear semantics and triggering conditions, enabling behavioral analysis to be performed based on stable criteria.

[0030] In one possible implementation, the behavior primitive library includes at least primitive encoding, primitive semantic description, trigger condition templates, field mapping relationships, and mapping version identifiers. Trigger condition templates are used to limit the event type conditions and contextual attribute conditions that a behavior event must satisfy to trigger the matching of the corresponding behavior primitive. Field mapping relationships are used to map behavior event fields to a standard set of field values ​​for the behavior primitive. Mapping version identifiers are used to distinguish between different versions of trigger condition templates and field mapping relationships to support the retrospective reproduction and audit traceability of historical analysis results.

[0031] During the mapping process, this embodiment performs primitive matching sequentially for each behavior event in the behavior event stream. If a behavior event satisfies a certain triggering condition template, the corresponding primitive code is output and a behavior primitive record is generated. If the same behavior event can match multiple primitives simultaneously, the primitive with higher priority is selected and output according to the template priority rule. This generates a sequence of behavior primitives ordered by occurrence time, and the behavior primitive record carries a mapping version identifier to identify the version of the mapping rule on which the primitive sequence is based.

[0032] For example, a behavioral event may include: subject identifier U01, behavior type click, object identifier button B03, occurrence time T1, source identifier tracking system A, and context attributes including session identifier S01, terminal identifier D01, page identifier P02, and business process identifier F01. Based on this behavioral event, a behavioral primitive record is mapped: primitive code PR_CLICK_B03, occurrence time T1, subject identifier U01, and mapping version identifier V1. This example demonstrates that behavioral events can be mapped to a controllable sequence of behavioral primitives, providing a unified semantic foundation for subsequent segmentation, retrieval, and attribution.

[0033] Through the above-mentioned behavioral semantic alignment and versioned primitive mapping, subsequent indicator calculations and attribution explanations can be based on a unified standard and have traceability and reproducibility.

[0034] In step S3, the action primitive sequence is segmented according to the time window to generate multiple action segments, and a time sequence chain is constructed for each action segment. The time sequence chain includes at least the start primitive, the key primitive, the end primitive, and the primitive transfer relationship.

[0035] In one feasible approach, behavior segmentation employs a strategy combining fixed-time windows and event-triggered windows. Fixed-time windows are used to generate basic behavior segments, such as segmenting behavior primitive sequences into basic segments every five or ten minutes. Event-triggered windows are used to extract enhanced behavior segments centered around preset key primitives when these primitives are detected. These preset key primitives are either marked as key primitives in a behavior primitive library or are specified by the analysis plan. This approach allows for enhanced characterization of behavior paths before and after key nodes while maintaining global statistical coverage.

[0036] For each behavior segment, this embodiment constructs a temporal chain and builds the temporal chain as a directed structure. The nodes of the temporal chain correspond to behavior primitives, and the edges correspond to primitive transition relationships. For each primitive transition relationship, the number of transitions, the transition time interval, and the transition direction are recorded. The transition time interval can be obtained from the occurrence time difference between two adjacent primitives. The starting primitive can be the earliest occurring primitive in the segment, the ending primitive can be the latest occurring primitive in the segment, and the key primitive can be the enhanced segment center primitive or determined according to primitive weight rules. This generates temporal chain features, which are at least used to support attribution candidate path generation and historical similar behavior segment retrieval.

[0037] In step S4, an analysis request is received, and a pre-trained large model is invoked to parse the analysis request to determine the analysis objective, indicator set, constraints, cluster dimensions, and confidence requirements. The analysis plan is then output in structured field format. The analysis request can be a natural language description or a structured form input.

[0038] To avoid caliber drift caused by arbitrary expansion of the large model output, this embodiment imposes structured field constraints on the analysis plan output. These structured fields include at least the analysis objective, indicator set, constraints, clustering dimensions, confidence requirements, indicator calculation steps, data filtering conditions, clustering logic, and attribution candidate paths. The indicator set includes one or more indicator names and their caliber identifiers. Constraints include time range, data source range, and subject range. Clustering dimensions include one or more of terminal identifiers, page identifiers, or business process identifiers. Confidence requirements include a minimum sample size threshold and a consistency verification threshold. The indicator calculation steps describe the indicator items and calculation order that should be calculated by a deterministic execution path. Data filtering conditions limit the range of data participating in the calculation. Clustering logic defines the clustering rules.

[0039] Among them, the attribution candidate path is used to describe the behavioral primitive sequence pattern or temporal chain transition pattern that needs to be retrieved and analyzed. The attribution candidate path can be generated by the pre-trained large model according to the analysis target, or it can be obtained by screening historical high-frequency transition patterns based on temporal chain features. It is used to constrain the scope of evidence retrieval and improve the stability of attribution reasoning.

[0040] To ensure the analysis plan can be executed directly, this embodiment performs integrity and consistency checks on the structured fields after receiving the output of the pre-trained large model. Integrity checks verify that all fields are present and parsable. When a field is missing, a preset default value is used to fill in the missing field, and the reason for the completion is recorded as plan correction information. When field type mismatches exist, the natural language description is converted into an executable structured expression according to field mapping rules. This embodiment also generates an analysis plan identifier to represent the version of this analysis plan, used for the generation and traceability of subsequent reproducible execution identifiers.

[0041] Furthermore, the analysis plan output in step S4 includes an execution budget and a validation threshold. The execution budget limits the maximum amount of data, maximum execution time, or maximum number of cluster combinations for metric calculation, while the validation threshold limits the conditions for passing consistency checks. The analysis plan also outputs a set of behavioral primitives that match the attribution candidate paths to constrain the scope of evidence retrieval and improve the consistency of subsequent attribution inference.

[0042] In step S5, statistical features are generated based on behavioral fragments and time sequence chains, and the statistical features are used to calculate indicators through a deterministic execution path according to the analysis plan to obtain indicator results.

[0043] In one feasible approach, the statistical features include at least two or more of the following: frequency features, dwell time features, conversion path length features, return visit interval features, and funnel conversion features. Frequency features describe the number of times a certain type of primitive appears; dwell time features describe the time span before and after a key primitive; conversion path length features describe the path length from the initial primitive to the key primitive; return visit interval features describe the session interval; and funnel conversion features describe the conversion rate from the entry primitive to the target primitive.

[0044] This embodiment generates structured query statements or domain-specific language scripts based on the analysis plan and executes them in an isolated, controlled execution environment to output metric results. The isolated, controlled execution environment is used to constrain permissions and resources during the execution process. In one implementation, the isolated, controlled execution environment is limited to read-only access and restricts the set of data tables or data views that can be accessed. A maximum execution duration and a maximum number of rows returned are also set to prevent script execution from impacting the business system. Execution terminates and returns an execution exception message when the execution duration exceeds the maximum. If the number of rows returned exceeds the maximum number of rows returned, pagination and aggregation are performed to ensure the stability of the output metric results.

[0045] In one implementation, a domain-specific language script is used to express the metric calculation logic. Its minimum executable structure includes at least the metric name and caliber identifier, time window range, data filtering conditions, and clustering dimensions, as well as a calculation instruction field indicating the aggregation method. The metric calculation engine parses the script to obtain the corresponding data access range and calculation logic, and generates an equivalent execution plan in an isolated, controlled execution environment to output the metric results. This ensures that the script maintains consistent executability and reproducibility across different deployment environments.

[0046] When outputting indicator results, this embodiment simultaneously outputs sample size statistics, outlier statistics, and missing value statistics to provide verifiable supporting information for the indicator results. Sample size statistics include the number of entities and events participating in the calculation; outlier statistics include the proportion of data exceeding a threshold range; and missing value statistics include the proportion of missing key fields. When the sample size statistics do not meet the confidence requirements or the outlier proportion exceeds a preset threshold, adjustments to the data filtering conditions or cluster dimensions are triggered, and the deterministic execution path is re-executed to update the indicator results. For example, when the sample size of a certain cluster is insufficient, the cluster dimension can be changed from page identifier to business process identifier to improve statistical stability.

[0047] In step S6, evidence packages are retrieved from the evidence database and assembled according to the analysis plan. The evidence packages include at least the definition of indicators, the mapping relationship of behavioral primitives, and historical similar behavioral fragments.

[0048] In one possible implementation, the evidence base includes a set of indicator definitions, a set of behavioral primitive mapping relationships, and a set of historical similar behavioral fragment indexes. The set of indicator definitions stores the calculation scope, granularity, definition identifier, and applicable scope of each indicator. The set of behavioral primitive mapping relationships stores trigger condition templates, field mapping relationships, and mapping version identifiers. The set of historical similar behavioral fragment indexes stores summary information, key primitive sequences, time-series chain features, and historical indicator results of historical behavioral fragments.

[0049] This embodiment first determines the primitive coverage set corresponding to the indicator set based on the behavior primitive mapping relationship, and then retrieves historical similar behavior fragments that match the primitive coverage set from the evidence base. Subsequently, the similarity of the historical similar behavior fragments is calculated and sorted to obtain the Top K similar fragments. The similarity is determined based on at least two or more of the following: key primitive sequence overlap, temporal chain transition pattern similarity, and distance measure of statistical features.

[0050] To improve retrieval stability, this embodiment combines the aforementioned similarity factors to obtain fragment similarity, where each weight can be configured as a retrieval parameter in the evidence retrieval service. When similarities are tied, historically similar behavior fragments with mapping version identifiers consistent with the mapping relationship of the current behavior primitive are prioritized as candidate evidence entries to reduce evidence bias caused by differences in caliber. When the combined similarity is below the similarity threshold, it is not included in the TopK similar fragment set to avoid using weakly related fragments as evidence input into the large model's inference path.

[0051] Finally, the fragment summaries, key primitive sequences, historical indicator results, and mapping version identifiers corresponding to the TopK similar fragments are written into the evidence package to form evidence items. The indicator definitions and the mapping relationship between behavioral primitives are also written into the evidence package, making the evidence package a traceable structured input.

[0052] In step S7, the evidence package and indicator results are input into the pre-trained large model through the large model inference path to generate attribution explanations, key driving factors, and optimized actions corresponding to behavioral primitives or behavioral fragments.

[0053] To avoid output ambiguity, this embodiment requires that the attribution interpretation be structured. The structured output should include attribution conclusions, a list of driving factors, the direction of influence, the intensity of influence, and a corresponding evidence citation index. The list of driving factors contains one or more driving factor entries, each associated with one or more behavioral primitive codes or temporal chain transition relationships. The direction of influence describes the effect of the driving factor on the indicator's improvement or decline, and the intensity of influence describes the degree of influence.

[0054] The evidence citation index is used to point to evidence entries in the evidence package that represent indicator definitions, behavioral primitive mappings, or historically similar behavioral fragments. This establishes a correspondence between attribution explanations and evidence, making the attribution explanations verifiable and traceable. The optimization actions output by attribution reasoning correspond to behavioral primitives or behavioral fragments, guiding subsequent behavioral path optimization or business process adjustments. For example, if the dwell time before a key primitive increases abnormally due to a driving factor, an interaction optimization action or process node adjustment action corresponding to that primitive can be output.

[0055] This embodiment also supports the generation of counterfactual control information. Counterfactual control information is used to characterize the trend of changes in control indicators obtained by re-executing the deterministic execution path based on the analysis plan after removing the behavioral primitives or behavioral fragments corresponding to the selected driving factors from the list of driving factors, in order to enhance the verifiability of attribution explanations.

[0056] In one feasible approach, the removal of behavioral primitives or behavioral fragments corresponding to driving factors is achieved through data filtering conditions in a deterministic execution path. Specifically, this includes adding exclusion conditions to structured query statements or domain-specific language scripts to filter out primitive codes, object identifiers, or primitive transfer relationships corresponding to the driving factors, or marking the corresponding primitives as invalid and excluding them from statistical feature calculations during the behavioral fragment construction stage. Subsequently, the deterministic execution path is re-executed under the same indicator definitions and the same clustering logic to obtain the comparison indicator results and output the changing trends, which are used to verify the attribution explanation.

[0057] In step S8, a consistency check is performed between the indicator results output by the deterministic execution path and the attribution explanation output by the large model inference path. If the consistency check fails, a regeneration of the analysis plan or a degradation strategy is triggered to generate degradation analysis results.

[0058] Consistency checks should include at least two or more of the following checks: sample size consistency check, boundary consistency check, and trend consistency check. Sample size consistency check determines whether the sample range covered by the attribution explanation matches the sample range corresponding to the indicator results. Boundary consistency check determines whether the changes in key indicators involved in the attribution explanation fall within the threshold range of the indicator results. Trend consistency check determines whether the trend direction described by the attribution explanation matches the time series trend direction of the indicator results.

[0059] In one possible implementation, sample size consistency verification is performed by calculating the overlap ratio between the attribution explanation coverage samples and the indicator result samples. If the overlap ratio is lower than a preset threshold, the verification fails. Boundary consistency verification is performed by determining whether the change magnitude of the indicator involved in the attribution explanation falls within the threshold range corresponding to the indicator result. If the change magnitude exceeds the threshold range, the verification fails. Trend consistency verification is performed by determining the rate of convergence between the trend direction described by the attribution explanation and the time series of the indicator result. If the rate of convergence is lower than a preset trend threshold, the verification fails. The aforementioned ratio thresholds, threshold ranges, and trend thresholds can be provided by the verification threshold field in the analysis plan or preset by the system configuration table to ensure that consistency verification can be directly calculated and executed.

[0060] When any validation item fails to meet the validation threshold, the analysis plan is regenerated to regenerate the evidence package and re-execute the deterministic execution path and the large model inference path. Strategies for regenerating the analysis plan may include adjusting data filtering conditions, adjusting cluster dimensions, adjusting attribution candidate paths, or increasing the minimum sample size threshold, thereby making the attribution explanation more consistent with the indicator results.

[0061] When the number of replanning iterations reaches a preset limit or the execution budget is triggered, a degradation strategy is executed and degradation analysis results are output. The degradation strategy includes at least reducing the cluster granularity, shortening the time window range, or reducing non-critical indicators in the indicator set, in order to generate degradation analysis results that meet the execution budget constraints and ensure that the degradation analysis results are consistent with the analysis objectives.

[0062] In one implementation, the maximum number of replanning attempts, maximum data volume, maximum execution time, and maximum number of cluster combinations are all configured as system operating parameters in a configuration table. Different parameter values ​​can be set according to different indicator sets and different cluster dimensions. When consistency checks fail consecutively and the number of replanning attempts reaches the maximum number of replanning attempts, the system executes a degradation strategy and outputs degradation analysis results. The results indicate the reason for the degradation trigger and the degradation method used, so as to facilitate subsequent review and further optimization of the analysis plan.

[0063] In step S9, the analysis results are output, and a confidence score is generated for the analysis results. At the same time, the evidence citation index and reproducible execution identifier corresponding to the confidence score are output.

[0064] The confidence score is determined by at least the following factors: sample size score, consistency score, and evidence coverage score. The sample size score characterizes the statistical stability of the indicator results, the consistency score characterizes the degree to which the consistency check passes, and the evidence coverage score characterizes the extent to which the evidence package covers the mapping relationship between the indicator set and the behavioral primitives.

[0065] In one feasible approach, the confidence score is derived by combining the sample size score, consistency score, and evidence coverage score with preset weights, and individual scores are output simultaneously for result interpretation. An evidence citation index is used to point to evidence entries within the evidence package, making the analysis results verifiable and traceable.

[0066] Reproducible execution identifiers include one or more of the following: a hash value of a structured query statement, a version number of a domain-specific language script, or an execution plan identifier, to support the reproducibility and verification of analysis results. Specifically, the hash value of the structured query statement uniquely identifies the statement used in this metric calculation, the version number of the domain-specific language script identifies the script version, and the execution plan identifier identifies the version of the structured fields in this analysis plan. Using these reproducible execution identifiers, those skilled in the art can reproduce the metric results and attribution interpretation process under the same data range and the same mapped version identifier conditions.

[0067] Furthermore, this embodiment also includes a drift monitoring and updating step, used to monitor the distribution of behavioral primitive sequences, indicator results, or driving factor categories, and generate a drift score. When the drift score exceeds a drift threshold, it triggers an update to the trigger condition template, field mapping relationship, or mapping version identifier of the behavioral primitive library. At the same time, it iterates the version of the indicator definitions and historically similar behavioral fragments in the evidence library to maintain the consistency and interpretability of the analysis results under changes in behavioral patterns.

[0068] In one possible implementation, the drift score is obtained by measuring the difference between the current period's distribution of behavioral primitive sequences and the historical baseline distribution, which can be calculated based on distribution distance or statistical test statistic. After version iteration updates, the old and new mapping version identifiers coexist, and the indicator definition retains the version number, so that historical analysis results can still be reproduced and verified based on the reproducible execution identifier of the old version, and new analysis tasks are executed according to the new version, thus balancing stability and adaptability.

[0069] In one possible implementation, after a drift-triggered update, a new mapping version identifier is generated and bound to a newly created analysis task for execution. For previously generated historical analysis results, reproduction verification is performed based on the mapping version identifier and caliber identifier recorded in their reproducible execution identifier to ensure that the switch between old and new versions does not affect the traceability consistency of historical results. The version iteration of the evidence base also adopts a version identifier binding method, enabling the differentiation and retrieval of historically similar behavioral fragments under different versions for comparative verification.

[0070] In one possible implementation, the proportion threshold, trend threshold, similarity threshold, upper limit of replanning times, execution budget, and confidence score combination weights are all configured in a system configuration table. The configuration table can be configured hierarchically according to indicator set type, cluster dimension type, or business process identifier. When an analysis request hits different configuration items, the system loads the corresponding parameters and applies them throughout the indicator calculation, consistency verification, TopK similar behavior fragment retrieval, and confidence score generation processes to ensure the stability and consistency of analysis results under different business scenarios.

[0071] Through the above steps, this embodiment achieves event-based encapsulation, semantic alignment, and versioned primitive mapping of multi-source behavioral data. It constructs searchable behavioral sequence structural features based on behavioral fragments and temporal chains, and calculates indicator results using a deterministic execution path constrained by an analysis plan. Then, it drives the large-scale model inference path with evidence packages and indicator results to output structured attribution explanations. A consistency verification mechanism constrains the inference output; when verification fails, it triggers a regeneration of the analysis plan or the execution of a degradation strategy. The final output includes an analysis result containing confidence scores, evidence citation indexes, and reproducible execution identifiers. Long-term stable operation is achieved through drift monitoring and version iteration. Therefore, intelligent analysis of behavioral data can be completed while ensuring reproducibility and verifiability, and can be directly implemented by those skilled in the art.

[0072] The working principle of this invention is as follows: First, behavioral data from at least two types of data sources are uniformly processed into events. A globally time-consistent behavioral event stream is formed through timestamp alignment and cross-source association. After completing contextual attributes such as session identifiers, terminal identifiers, page identifiers, and business process identifiers, a standard input suitable for unified analysis is obtained. Subsequently, a behavioral primitive library is established based on behavioral semantic alignment rules. The behavioral event stream is mapped to a sequence of behavioral primitives using trigger condition templates and field mapping relationships. Version management of the primitive mapping caliber is achieved through mapping version identifiers, thereby ensuring the traceability and reproducibility of analysis results under different times and data calibers.

[0073] Building upon this foundation, this invention segments behavioral primitive sequences using a combination of fixed time windows and event-triggered windows, generating multiple behavioral fragments. For each fragment, a temporal chain is constructed containing a starting primitive, a key primitive, an ending primitive, and primitive transition relationships. Temporal chain features are formed by recording the number of transitions and the transition time intervals, enabling behavioral path changes to be characterized and retrieved in a structured manner. For analysis requests, this invention invokes a pre-trained large model to generate an analysis plan. The analysis plan, in the form of structured fields, clearly defines the analysis objectives, indicator set, constraints, cluster dimensions, confidence requirements, indicator calculation steps, and attribution candidate paths. After integrity and consistency checks, an executable analysis plan identifier is formed to constrain the consistency of subsequent calculations and inference processes.

[0074] Subsequently, in the deterministic execution path, this invention generates statistical features based on behavioral fragments and time-series chains, and generates structured query statements or domain-specific language scripts according to the analysis plan. These are executed in an isolated, controlled execution environment to output indicator results, along with sample size statistics, outlier statistics, and missing value statistics, providing verifiable supporting information for the indicator results. Simultaneously, this invention retrieves and assembles an evidence package from the evidence library according to the analysis plan. The evidence package includes at least the indicator definition, behavioral primitive mapping relationships, and historical similar behavioral fragments. The similarity of these historical behavioral fragments is calculated and ranked to obtain TopK similar fragments. Fragment summaries, key primitive sequences, historical indicator results, and mapping version identifiers are written into the evidence package to form structured evidence entries.

[0075] In the large-scale model inference pathway, this invention inputs the evidence package and indicator results into the pre-trained large-scale model and outputs a structured attribution explanation. The attribution explanation includes at least the attribution conclusion, a list of driving factors, the direction of influence, the intensity of influence, and an evidence citation index. Furthermore, driving factors can be eliminated and recalculated through counterfactual comparison to enhance the verifiability of the attribution explanation. To ensure consistency between the inference results and the indicator results, this invention performs consistency checks on the indicator results output by the deterministic execution pathway and the attribution explanations output by the large-scale model inference pathway. Consistency checks include at least sample size consistency checks, boundary consistency checks, and trend consistency checks. When a check fails, the analysis plan is regenerated or a degradation strategy is triggered, thus ensuring that, under execution budget constraints, a degradation analysis result consistent with the analysis objective is still output.

[0076] Finally, this invention outputs the analysis results and generates a confidence score, which is jointly determined by the sample size score, consistency score, and evidence coverage score. It also outputs an evidence citation index and a reproducible execution identifier to support result review and reproducibility verification. Furthermore, it generates a drift score through drift monitoring. When the drift score exceeds the drift threshold, it triggers version iterations of the behavioral primitive library and the evidence library to ensure that the analysis criteria remain consistent under changing behavioral patterns, thereby achieving continuous, stable, intelligent analysis and reliable output of behavioral data.

[0077] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.

Claims

1. A method for intelligent analysis of behavioral data based on a large model, characterized in that, Includes the following steps: S1: Behavior event-based construction: Obtain behavioral data from at least two types of data sources, encapsulate the behavioral data into events to generate a behavioral event stream. Each behavioral event in the behavioral event stream includes at least the subject identifier, behavior type, object identifier, occurrence time, source identifier, and context attributes. The context attributes include one or more of the following: session identifier, terminal identifier, page identifier, and business process identifier. S2: Behavior semantic alignment and primitive mapping: A behavior primitive library is built based on behavior semantic alignment rules, and behavior events in the behavior event stream are mapped to behavior primitive sequences; S3: Construction of Behavioral Segments and Temporal Chains: The sequence of behavioral primitives is segmented according to time windows to generate multiple behavioral segments, and a temporal chain is constructed for each behavioral segment. The temporal chain includes at least the starting primitive, the key primitive, the ending primitive, and the primitive transfer relationship. S4: Analysis Plan Generation: Receives analysis requests, calls a pre-trained large model to parse the analysis requests, determines the analysis objectives, indicator set, constraints, cluster dimensions, and confidence requirements, and outputs the analysis plan in the form of structured fields. The structured fields include at least the analysis objectives, indicator set, constraints, cluster dimensions, confidence requirements, indicator calculation steps, data filtering conditions, cluster logic, and attribution candidate paths. S5: Statistical Feature Generation and Deterministic Indicator Calculation: Statistical features are generated based on behavioral segments and time series chains, and indicators are calculated on the statistical features through a deterministic execution path according to the analysis plan to obtain indicator results; S6: Evidence Package Retrieval and Assembly: Retrieve and assemble evidence packages from the evidence database according to the analysis plan. Each evidence package shall include at least the definition of indicators, mapping relationships of behavioral primitives, and fragments of similar historical behaviors. S7: Large Model Attribution Reasoning: The evidence package and indicator results are input into the pre-trained large model through the large model reasoning path to generate attribution explanations, key driving factors, and optimized actions corresponding to behavioral primitives or behavioral fragments. S8: Consistency Verification and Strategy Triggering: Perform consistency verification between the indicator results output by the deterministic execution path and the attribution explanation output by the large model inference path. If the consistency verification fails, trigger the regeneration of the analysis plan or trigger the degradation strategy to generate degradation analysis results. S9. Results Output and Credibility Labeling: Output the analysis results and generate a confidence score for the analysis results. At the same time, output the evidence citation index and reproducible execution identifier corresponding to the confidence score.

2. The intelligent analysis method for behavioral data based on a large model according to claim 1, characterized in that, Step S1 includes: Timestamp alignment is performed on behavioral data from different data sources to form a unified time base; Based on the subject identifier, cross-source association is performed on behavioral events corresponding to different behavioral data sources, and behavioral events of the same subject within the same session identifier within the same time range are merged into the same behavioral event stream; The context attributes of the behavior events are completed, and the completed behavior events are sorted by occurrence time to form a globally time-consistent behavior event stream, thereby providing a unified input for subsequent behavior primitive sequence mapping and behavior segmentation.

3. The intelligent analysis method for behavioral data based on a large model according to claim 2, characterized in that, The behavior primitive library established in step S2 includes at least primitive encoding, primitive semantic description, trigger condition template, field mapping relationship and mapping version identifier; The trigger condition template is used to limit the event type conditions and context attribute conditions that the behavior event must satisfy in order to trigger the matching of the corresponding behavior primitive; The field mapping relationship is used to map behavioral event fields to a standard set of behavioral primitives, and to distinguish behavioral primitive sequences generated under different versions based on the mapping version identifier, so as to support the retrospective reproduction and audit traceability of historical analysis results.

4. The intelligent analysis method for behavioral data based on a large model according to claim 3, characterized in that, Step S3 includes: A behavior segmentation strategy combining fixed time windows and event-triggered windows is adopted. Fixed time windows are used to generate basic behavior segments, while event-triggered windows are used to extract enhanced behavior segments centered on key primitives when preset key primitives are detected. Preset key primitives are behavior primitives marked as key in the behavior primitive library or behavior primitives specified by the analysis plan. The temporal chain is constructed as a directed structure, and the number of transitions, the time interval between transitions, and the direction of transition are recorded for each primitive transition relation to generate temporal chain features; Temporal chain features are used to support at least the generation of attribution candidate paths and the retrieval of historically similar behavioral fragments.

5. The intelligent analysis method for behavioral data based on a large model according to claim 4, characterized in that, Step S5 includes: Statistical features are generated based on behavioral segments. The statistical features include at least two or more of the following: frequency features, dwell time features, conversion path length features, return visit interval features, and funnel conversion features. Generate structured query statements or domain-specific language scripts based on the analysis plan, and execute them in an isolated, controlled execution environment to output metric results; When outputting indicator results, sample size statistics, outlier statistics, and missing value statistics are output simultaneously to form verifiable supporting information for the indicator results; When the sample size statistics do not meet the confidence requirements or the proportion of outliers exceeds the preset threshold, the data filtering conditions or cluster dimensions are adjusted, and the deterministic execution path is re-executed to update the indicator results.

6. The intelligent analysis method for behavioral data based on a large model according to claim 5, characterized in that, The analysis plan output in step S4 further includes an execution budget and a verification threshold. The execution budget is used to limit the maximum amount of data, the maximum execution time, or the maximum number of cluster combinations for indicator calculation. The verification threshold is used to limit the conditions for passing the consistency verification. When the execution budget is triggered, the degradation strategy includes at least reducing the cluster granularity, shortening the time window range, or reducing non-critical indicators in the indicator set, in order to generate degradation analysis results that meet the execution budget constraints and keep the degradation analysis results consistent with the analysis objectives. The analysis plan is also used to output a set of behavioral primitives that match the attribution candidate paths, in order to constrain the scope of evidence retrieval and improve the consistency of subsequent attribution reasoning.

7. The intelligent analysis method for behavioral data based on a large model according to claim 6, characterized in that, Step S6 includes: Based on the mapping relationship of behavioral primitives, determine the primitive coverage set corresponding to the indicator set, and retrieve historical similar behavioral fragments that match the primitive coverage set from the evidence base; Calculate the similarity of historical similar behavior segments and sort them to obtain TopK similar segments. The similarity is determined based on at least two or more of the following: key primitive sequence overlap, temporal chain transition pattern similarity, and distance measure of statistical features. The fragment summaries, key primitive sequences, historical indicator results, and mapping version identifiers corresponding to TopK similar fragments are written into the evidence package to form evidence items, so that subsequent attribution inference can output stable conclusions based on historical comparison evidence.

8. The intelligent analysis method for behavioral data based on a large model according to claim 7, characterized in that, The attribution explanation generated in step S7 is a structured output, which includes attribution conclusions, a list of driving factors, direction of influence, intensity of influence, and corresponding evidence citation index. The evidence reference index points to evidence entries in the evidence package that define the indicator criteria, map the behavioral primitives, or identify historically similar behavioral fragments. The attribution explanation further includes counterfactual comparison information, which is used to characterize the trend of change of the comparison index results obtained by re-executing the deterministic execution path based on the analysis plan after removing the behavioral primitives or behavioral fragments corresponding to the selected driving factors in the list of driving factors, so as to enhance the verifiability of the attribution explanation.

9. The intelligent analysis method for behavioral data based on a large model according to claim 8, characterized in that, The consistency check in step S8 includes at least two or more of the following check items: Sample size consistency check is used to determine whether the sample range covered by the attribution explanation is consistent with the sample range corresponding to the indicator results. Boundary consistency check is used to determine whether changes in key indicators involved in the attribution explanation fall within the threshold range of the indicator results; Trend consistency check is used to determine whether the trend direction described by the attribution explanation is consistent with the time series trend direction of the indicator results. When any verification item fails to meet the verification threshold, the analysis plan is regenerated to regenerate the evidence package and re-execute the deterministic execution path and the large model inference path. When the number of replanning attempts reaches the preset limit or the execution budget is triggered, the degradation strategy is executed and the degradation analysis results are output.

10. The intelligent analysis method for behavioral data based on a large model according to claim 9, characterized in that, The confidence score in step S9 is determined by at least the following factors: Sample size score is used to characterize the statistical stability of the indicator results; Consistency score, used to characterize the degree to which consistency verification passes; Evidence coverage score is used to characterize the degree to which the evidence package covers the mapping relationship between the indicator set and the behavioral primitives; The reproducible execution identifier includes one or more of the following: hash value of structured query statement, version number of domain-specific language script, or execution plan identifier, to support the reproducibility verification of analysis results; The method also includes a drift monitoring and updating step, which is used to monitor the distribution of behavioral primitive sequences, indicator results, or driving factor categories, and generate a drift score. When the drift score exceeds the drift threshold, it triggers an update to the trigger condition template, field mapping relationship, or mapping version identifier of the behavioral primitive library. At the same time, it iterates the version of the indicator caliber definition and historical similar behavioral fragments in the evidence library to maintain the consistency and interpretability of the analysis results under changes in behavioral patterns.

Images