A multi-source data fusion abnormal pattern recognition method and system

Abstract

The application provides a multi-source data fusion abnormal pattern recognition method and system, the method comprising: obtaining and standardizing multi-source data records of target video content in a target analysis window to generate standardized multi-source data records; dividing the target analysis window into continuous analysis time slices based on a preset basic analysis time window, and classifying the standardized multi-source data records into the analysis time slices according to event occurrence time or statistical time intervals to generate time slice index items and data update delay features, and obtaining a time slice aligned multi-source data set; generating an intra-source change feature set based on the time slice aligned multi-source data set; determining time slice index items with cross-source index corresponding relationships, and performing consistency comparison based on time slice index values and intra-source change features to generate a cross-source consistency deviation feature set; and inputting the intra-source change feature set, the cross-source consistency deviation feature set and the data update delay feature into an abnormal pattern recognition model to generate an abnormal pattern recognition result.

Description

Technical Field

[0001] This application relates to the field of data processing technology, and in particular to an anomaly pattern recognition method and system based on multi-source data fusion. Background Technology

[0002] As video platforms and content distribution platforms continuously expand their data processing scale, they typically need to comprehensively analyze data generated by target video content across different timeframes to determine content access status, user interaction status, and business statistics status. This data usually originates from multiple data sources, such as user access logs, behavioral interaction logs, and business system statistical records. Specifically, user access logs reflect access-side information such as the display, access, and playback requests of the target video content, as well as effective playback; behavioral interaction logs reflect interaction-side information such as likes, comments, favorites, shares, and follow triggers; and business system statistical records reflect statistical results generated by the platform's business systems according to statistical tasks, such as play counts, exposures, interactions, and recommendation distribution statistics.

[0003] In existing data processing methods, different data sources are typically generated and maintained by different business systems, resulting in inconsistent data structures, time representation methods, statistical granularity, and data update times. For example, user access logs and behavioral interaction logs usually record single access or interaction behaviors at the event occurrence time, while business system statistical records typically record summary results over a period of time using statistical time intervals. Furthermore, business system statistical records may be affected by statistical task execution cycles, data backfilling, or delayed updates. Directly aggregating and analyzing this multi-source data can easily lead to inaccurate correspondence between access-side data, interaction-side data, and business statistical data for the same target video content within the same actual time range.

[0004] Furthermore, existing systems, when identifying data anomalies, typically focus more on changes in metrics within a single data source, such as a sudden increase in visits or a concentrated increase in interactions, while lacking analysis of the consistency of changes across different data sources. When visitor-side metrics for target video content change significantly, business statistics or interaction-side metrics should usually change accordingly. If there are significant inconsistencies in the time-slice metric values, directions of change, or magnitudes of change between different data sources, it may indicate an anomaly in the data change status. However, because existing processing methods struggle to simultaneously consider intra-source changes, cross-source consistency deviations, and data update delays on a unified time scale, the system struggles to promptly identify anomaly patterns such as abnormal fluctuations in visitor volume, abnormal concentrations of behavioral data, inconsistencies in cross-source changes, and abnormal data update delays, thus affecting the accuracy and reliability of judging the data change status of target video content. Summary of the Invention

[0005] This application provides a method and system for anomaly pattern recognition based on multi-source data fusion, in order to solve the problems in the prior art.

[0006] This application provides an anomaly pattern recognition method based on multi-source data fusion, including:

[0007] Multi-source data recording acquisition and standardization: acquire multi-source data records corresponding to the target video content within the target analysis window, and perform standardization processing on the multi-source data records to generate standardized multi-source data records;

[0008] Time granularity alignment and update delay marking: Based on a preset basic analysis time window, the target analysis window is divided into multiple continuous analysis time slices. According to the event occurrence time or statistical time interval in the standardized multi-source data records, the standardized multi-source data records are assigned to the corresponding analysis time slices. Based on the standardized multi-source data records assigned to the same analysis time slice, time slice index items and data update delay characteristics are generated to obtain a time slice aligned multi-source data set.

[0009] Intra-source variation feature construction: Based on the time-slice aligned multi-source data set, according to the same target video content identifier, the same data source identifier, and the same indicator type, extract the changes in time-slice indicator values ​​within the continuous analysis time slice to generate an intra-source variation feature set;

[0010] Cross-source consistency deviation feature construction: Based on the time-slice aligned multi-source data set and the source-internal change feature set, according to the same target video content identifier and the same analysis time-slice identifier, time-slice indicator items with cross-source indicator correspondence between different data sources are determined, and consistency comparison is performed based on the time-slice indicator values ​​in the time-slice indicator items and the corresponding source-internal change features to generate a cross-source consistency deviation feature set.

[0011] The abnormal pattern recognition result is generated by inputting the source intra-source change feature set, cross-source consistency deviation feature set, and data update delay feature from the time-slice aligned multi-source data set into the abnormal pattern recognition model to generate the abnormal pattern recognition result corresponding to the target video content.

[0012] In one possible design, the multi-source data records are standardized to generate standardized multi-source data records, including:

[0013] Configure a data source identifier for each of the multi-source data records to distinguish whether the multi-source data records originate from user access log records, behavior interaction log records, or business system statistical records;

[0014] The original indicator fields in user access logs, behavior interaction logs, and business system statistical records are converted into indicator types and indicator values ​​in standardized multi-source data records. The indicator type is used to characterize the data meaning corresponding to the original indicator field, and the indicator value is used to characterize the value of the original indicator field within the corresponding time range.

[0015] The time field in multi-source data records is processed uniformly to generate event occurrence time, statistical time interval, and data update time.

[0016] The standardized multi-source data record includes target video content identifier, data source identifier, indicator type, indicator value, event occurrence time, statistical time interval, and data update time.

[0017] In one possible design, time granularity alignment and update delay flags include:

[0018] Based on the target video content identifier, the standardized multi-source data records are grouped to obtain a set of standardized multi-source data records corresponding to the same target video content;

[0019] Time slice attribution is performed on each standardized multi-source data record in the standardized multi-source data record set, and a time slice aligned subset is generated.

[0020] In each time-slice alignment subset, based on the same data source identifier and the same indicator type, the standardized multi-source data records belonging to the time-slice alignment subset are aggregated to generate time-slice indicator items.

[0021] Based on the data update time corresponding to the time slice indicator, a data update delay feature is generated, which includes an update delay time and an update delay flag.

[0022] Based on multiple time-slice aligned subsets and the data update delay characteristics corresponding to each time-slice indicator, a time-slice aligned multi-source data set is generated.

[0023] In one possible design, the time-slice aligned multi-source data set includes multiple time-slice aligned subsets, each time-slice aligned subset corresponding to the same target video content identifier and the same analysis time-slice identifier;

[0024] Each time-slice alignment subset includes time-slice metrics within that analysis time-slice. The time-slice metrics include target video content identifier, analysis time-slice identifier, data source identifier, metric type, time-slice metric value, data update time, and data update delay characteristics. The data update delay characteristics include update delay time and update delay flag.

[0025] In one possible design, data update latency features are generated based on the data update time corresponding to the time slice indicator, including:

[0026] When the data source of the time slice indicator is identified as user access log or behavior interaction log, the data update time is compared with the end time of the analysis time slice to which the time slice indicator belongs to obtain the update delay time.

[0027] If the data update time is earlier than or equal to the end time of the analysis time slice, the update delay time is set to zero; if the data update time is later than the end time of the analysis time slice, the time difference between the data update time and the end time of the analysis time slice is determined as the update delay time.

[0028] When the data source of the time slice indicator is identified as a business system statistical record, the data update time is compared with the statistical end time of the corresponding statistical time interval of the time slice indicator to obtain the update delay time.

[0029] If the data update time is earlier than or equal to the statistics end time, the update delay time is set to zero; if the data update time is later than the statistics end time, the time difference between the data update time and the statistics end time is determined as the update delay time.

[0030] An update delay flag is generated based on the update delay time. If the update delay time is less than or equal to a preset delay threshold, the update delay flag is set to a normal update flag; if the update delay time is greater than the preset delay threshold, the update delay flag is set to a delayed update flag.

[0031] In one possible design, the construction of the source-internal variation features includes:

[0032] For time-slice metric items in time-slice aligned multi-source datasets, grouping is performed based on target video content identifier, data source identifier, and metric type to obtain multiple in-source metric sequences;

[0033] Based on the time slice index values ​​of adjacent analysis time slices in each of the source index sequences, change direction features and change magnitude features are generated.

[0034] Based on the directional characteristics of the same source index sequence across multiple consecutive analysis time slices, fluctuation persistence characteristics are generated.

[0035] In each time slice alignment subset, a change concentration feature is generated based on the change magnitude characteristics of multiple indicator types corresponding to the same data source identifier.

[0036] For each target video content, a source-internal change feature set is generated based on time-slice aligned multi-source data sets, change direction features, change amplitude features, fluctuation duration features, and change concentration features. The source-internal change feature set includes target video content identifier, analysis time-slice identifier, data source identifier, indicator type, change direction features, change amplitude features, fluctuation duration features, and change concentration features.

[0037] In one possible design, the cross-source metric correspondence is stored in the form of a cross-source metric mapping table;

[0038] Each mapping record in the cross-source indicator mapping table includes a first data source identifier, a first indicator type, a second data source identifier, a second indicator type, and a corresponding method. The corresponding method includes a single indicator corresponding method and a multi-indicator summary corresponding method.

[0039] The single-indicator correspondence method is used to characterize two indicator types in different data sources that have the same or similar data meanings, while the multi-indicator aggregation correspondence method is used to characterize multiple indicator types in one data source that are aggregated and then corresponded to an indicator type in another data source.

[0040] In one possible design, the cross-source consistency deviation feature is constructed, including:

[0041] Pre-set the cross-source indicator correspondence and store the cross-source indicator correspondence in the form of a cross-source indicator mapping table including multiple mapping records;

[0042] Based on the cross-source index mapping table, in the time slice alignment subset corresponding to the same target video content identifier and the same analysis time slice identifier, find the time slice index item that matches each mapping record in the cross-source index mapping table, and construct the cross-source comparison item.

[0043] For each cross-source comparison item, a consistency comparison is performed based on the time slice index value and the corresponding intra-source change characteristics in the cross-source comparison item. The consistency comparison includes cross-source numerical consistency comparison, cross-source change direction consistency comparison, and cross-source change magnitude consistency comparison. Based on the comparison results, a cross-source consistency deviation feature is generated.

[0044] The update delay time and update delay flag in the time slice index item corresponding to the cross-source comparison item are used as auxiliary fields and associated with the corresponding cross-source consistency deviation feature.

[0045] For each target video content, a set of cross-source consistency deviation features is generated based on the cross-source comparison item, cross-source numerical deviation features, cross-source change direction consistency features, cross-source change magnitude deviation features, update delay time, and update delay flag.

[0046] The cross-source consistency deviation feature set includes target video content identifier, analysis time slice identifier, cross-source comparison item, cross-source numerical deviation feature, cross-source change direction consistency feature, cross-source change magnitude deviation feature, update delay time, and update delay marker.

[0047] This application also provides an anomaly pattern recognition system based on multi-source data fusion, including:

[0048] The multi-source data recording acquisition and standardization module acquires multi-source data records corresponding to the target video content within the target analysis window, and performs standardization processing on the multi-source data records to generate standardized multi-source data records.

[0049] The time granularity alignment and update delay marking module divides the target analysis window into multiple continuous analysis time slices based on a preset basic analysis time window. According to the event occurrence time or statistical time interval in the standardized multi-source data records, the standardized multi-source data records are assigned to the corresponding analysis time slices. Based on the standardized multi-source data records assigned to the same analysis time slice, time slice index items and data update delay characteristics are generated to obtain a time slice aligned multi-source data set.

[0050] The source change feature construction module, based on the time-slice aligned multi-source data set, extracts the changes in time-slice index values ​​within the continuous analysis time slice according to the same target video content identifier, the same data source identifier, and the same index type, and generates a source change feature set;

[0051] The cross-source consistency deviation feature construction module, based on the time-slice aligned multi-source data set and the source-internal change feature set, determines time-slice indicator items with cross-source indicator correspondence between different data sources according to the same target video content identifier and the same analysis time-slice identifier, and performs consistency comparison based on the time-slice indicator values ​​in the time-slice indicator items and the corresponding source-internal change features to generate a cross-source consistency deviation feature set.

[0052] The anomaly pattern recognition result generation module inputs the source intra-source change feature set, cross-source consistency deviation feature set, and data update delay features from the time-slice aligned multi-source data set into the anomaly pattern recognition model to generate anomaly pattern recognition results corresponding to the target video content.

[0053] Compared with the prior art, this application has the following beneficial effects:

[0054] This application provides a method and system for anomaly pattern recognition based on multi-source data fusion. The method standardizes the multi-source data records of the target video content within the target analysis window and assigns the standardized multi-source data records to continuous analysis time slices. It further constructs a set of intra-source change features and a set of cross-source consistency deviation features, enabling the anomaly pattern recognition model to comprehensively utilize intra-source changes, cross-source deviations, and data update delays to generate anomaly pattern recognition results, thereby improving the accuracy and reliability of identifying the change status of target video content data.

[0055] Furthermore, this application unifies the data structure of user access logs, behavioral interaction logs, and business system statistical records by configuring data source identifiers, indicator types, indicator values, event occurrence times, statistical time intervals, and data update times; it solves the problem of inconsistent time granularity and update times of multi-source data by using time slice alignment subsets, time slice indicator items, update delay times, and update delay markers; and it characterizes the numerical deviations, direction deviations, and magnitude deviations between different data sources through cross-source indicator mapping tables, cross-source comparison items, and consistency comparisons, providing a more complete fusion feature foundation for abnormal pattern recognition. Attached Figure Description

[0056] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0057] Figure 1 This is a flowchart illustrating an abnormal pattern recognition method for multi-source data fusion according to an example embodiment of this application;

[0058] Figure 2 This is a schematic diagram of the structure of an anomaly pattern recognition system based on multi-source data fusion according to an example embodiment of this application.

[0059] The accompanying drawings illustrate specific embodiments of this application, which will be described in more detail below. These drawings and descriptions are not intended to limit the scope of the concept in any way, but rather to illustrate the concept of this application to those skilled in the art through reference to particular embodiments. Detailed Implementation

[0060] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numbers in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this application. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this application as detailed in the appended claims.

[0061] This embodiment proposes a method and system for anomaly pattern recognition based on multi-source data fusion, applicable to multi-source data monitoring and anomaly identification scenarios in video platforms or content distribution platforms. Specifically, when a platform needs to comprehensively analyze user access logs, behavioral interaction logs, and business system statistical records generated within the target video content's analysis window, the method of this embodiment can be used to standardize, align temporal granularity, construct intra-source change features, and construct cross-source consistency deviation features of the aforementioned multi-source data records, and generate anomaly pattern recognition results corresponding to the target video content based on an anomaly pattern recognition model.

[0062] This embodiment can comprehensively identify intra-source change anomalies, cross-source change inconsistencies, and data update delay anomalies under a unified time scale, thereby improving the accuracy and reliability of judging the change status of target video content data.

[0063] Figure 1 This is a flowchart illustrating an abnormal pattern recognition method based on multi-source data fusion according to an example embodiment of this application. Figure 1 As shown, the multi-source data fusion-based abnormal pattern recognition method provided in this embodiment includes:

[0064] Step S101: Multi-source data recording acquisition and standardization. Acquire multi-source data records corresponding to the target video content within the target analysis window, and perform standardization processing on the multi-source data records to generate standardized multi-source data records.

[0065] In this step, the target video content refers to the video content object on the video platform or content distribution platform that needs to undergo abnormal pattern recognition. The target video content identifier is a unified, standardized, and unique identifier created by the video platform or content distribution platform for each target video content. It is used to uniquely identify the corresponding video content, enabling data records from different data sources to be attributed to the same video content.

[0066] The target analysis window refers to the data collection time range for anomaly pattern recognition of target video content. It can be determined according to the platform's data monitoring cycle, business statistics cycle, or anomaly identification cycle. For example, the target analysis window can be set to 30 minutes, 1 hour, 1 day, or other time ranges pre-configured by the platform.

[0067] In this implementation, firstly, within each target analysis window, multi-source data records carrying the same target video content identifier are acquired, serving as the multi-source data records corresponding to the target video content. These multi-source data records include user access log records, behavioral interaction log records, and business system statistical records.

[0068] User access logs are used to represent access-side data generated during the display, access, or playback of target video content. User access logs include target video content identifier, access-side raw metric fields, access-side time fields, and access log writing time. Among them, the access-side raw metric fields include display count, access count, playback request count, valid access count, and valid playback count. The access-side time field is used to represent the time when the display, access, or playback request occurred.

[0069] The behavioral interaction log records are used to characterize the interactive behavior data generated by users in response to the target video content. The behavioral interaction log records include the target video content identifier, the original interaction indicator field, the interaction time field, and the interaction log writing time. Among them, the original interaction indicator field includes the number of likes, comments, favorites, shares, and follow triggers. The interaction time field is used to characterize the occurrence time of the like, comment, favorite, share, or follow trigger.

[0070] The business system statistical records are used to characterize the statistical results generated by the platform's business system for the target video content. The business system statistical records include the target video content identifier, the original indicator fields of the business statistics side, the statistical time interval, and the statistical result update time. Among them, the original indicator fields of the business statistics include the business statistics playback volume, business statistics exposure volume, business statistics interaction volume, recommendation distribution statistics volume, and content status statistics volume. The statistical time interval includes the statistical start time and statistical end time, which are used to characterize the time range covered by the business system statistical results. The statistical result update time is used to characterize the time when the business system statistical results are generated or written.

[0071] After acquiring multi-source data records, the records are standardized to generate standardized multi-source data records. These standardized records include the target video content identifier, data source identifier, indicator type, indicator value, event occurrence time, statistical time interval, and data update time.

[0072] Standardization of multi-source data records includes:

[0073] Configure a data source identifier for each multi-source data record to distinguish whether the multi-source data record originates from user access log records, behavior interaction log records, or business system statistical records;

[0074] The raw indicator fields in user access logs, behavioral interaction logs, and business system statistical records are converted into indicator types and indicator values ​​in standardized multi-source data records. The indicator type represents the data meaning of the original indicator field, and the indicator value represents the value of the original indicator field within a corresponding time range.

[0075] The time field in multi-source data records is processed uniformly to generate the event occurrence time, statistical time interval, and data update time. Specifically, the event occurrence time of user access log records is determined based on the access-side time field, and the data update time is determined based on the access log write time; the event occurrence time of behavioral interaction log records is determined based on the interaction-side time field, and the data update time is determined based on the interaction log write time; the statistical time interval of business system statistical records is determined based on the statistical start time and statistical end time in the business system statistical records, and the data update time is determined based on the statistical result update time.

[0076] This step transforms multi-source data from user access logs, behavioral interaction logs, and business system statistical records into standardized multi-source data records with a consistent field structure. This enables data from different data sources to be aligned at the time granularity, construct intra-source variation features, and construct cross-source consistency deviation features around the same target video content.

[0077] Step S102: Time granularity alignment and update delay marking. Based on the preset basic analysis time window, the target analysis window is divided into multiple continuous analysis time slices. According to the event occurrence time or statistical time interval in the standardized multi-source data records, the standardized multi-source data records are assigned to the corresponding analysis time slices. Based on the standardized multi-source data records assigned to the same analysis time slice, time slice index items and data update delay features are generated to obtain the time slice aligned multi-source data set.

[0078] In this step, due to the different generation methods of user access logs, behavioral interaction logs, and business system statistical records, the three types of data differ in their time representation and update times. User access logs and behavioral interaction logs typically correspond to specific behaviors such as display, access, playback, likes, comments, collections, and sharing, and their event occurrence time reflects the actual time of the corresponding behavior. Business system statistical records are usually generated by the platform's business system according to statistical tasks, and their statistical time interval reflects the time range covered by the statistical results, while the statistical result update time reflects the time when the statistical results are generated or written. If the above multi-source data records are directly integrated for analysis, it is easy to encounter the problem that the access-side data, interaction-side data, and business statistical-side data of the same target video content within the same actual time range cannot be accurately matched. Therefore, this step maps the data from different sources to continuous analysis time slices and generates data update delay features at the time slice dimension.

[0079] In this embodiment, the preset basic analysis time window refers to the basic time unit used to divide the target analysis window. It can be pre-configured by the video platform or content distribution platform based on the anomaly identification cycle, data monitoring frequency, and business statistics cycle. For example, the preset basic analysis time window can be 1 minute, 5 minutes, 10 minutes, 30 minutes, or 1 hour. Based on the preset basic analysis time window, the target analysis window is divided into multiple consecutive analysis time slices. Each analysis time slice has an analysis time slice identifier, an analysis time slice start time, and an analysis time slice end time. The analysis time slice identifier is used to uniquely identify the corresponding analysis time slice.

[0080] First, based on the target video content identifier, standardized multi-source data records are grouped to obtain a standardized multi-source data record set corresponding to the same target video content. Each standardized multi-source data record set consists of standardized multi-source data records with the same target video content identifier, and this standardized multi-source data record set includes data records from user access log records, behavior interaction log records, and business system statistical records.

[0081] Furthermore, time-slice attribution is performed on the standardized multi-source data records in each standardized multi-source data record set, and time-slice aligned subsets are generated. Each time-slice aligned subset corresponds to the same target video content identifier and the same analysis time-slice identifier, and is used to store access-side data, interaction-side data, and business statistics-side data of the same target video content within the same analysis time-slice.

[0082] For standardized multi-source data records whose data source is identified as user access logs, their corresponding analysis time slice is determined based on the event occurrence time. When the event occurrence time of the standardized multi-source data record is greater than or equal to the start time of an analysis time slice, and less than the end time of that analysis time slice, the analysis time slice identifier of that analysis time slice is added to the standardized multi-source data record, and the standardized multi-source data record is assigned to the time slice alignment subset corresponding to that analysis time slice identifier. Thus, data on access-side metrics such as display, access, playback requests, valid access, and valid playback of the target video content can be entered into the corresponding analysis time slice according to the actual occurrence time.

[0083] For standardized multi-source data records identified as behavioral interaction logs, their corresponding analysis time slices are determined based on the event occurrence time. When the event occurrence time of a standardized multi-source data record is greater than or equal to the start time of an analysis time slice, but less than the end time of that analysis time slice, the analysis time slice identifier of that time slice is added to the standardized multi-source data record, and the standardized multi-source data record is assigned to the time slice alignment subset corresponding to that analysis time slice identifier. Thus, data on interactive metrics such as likes, comments, favorites, shares, and follow triggers for the target video content can be entered into the corresponding analysis time slice according to their actual occurrence time.

[0084] For standardized multi-source data records whose data source is identified as business system statistical records, the corresponding analysis time slice is determined based on the statistical time interval. When the statistical time interval of the business system statistical record coincides with the time range of an analysis time slice, or when the statistical time interval falls within the time range of an analysis time slice, the analysis time slice identifier of that analysis time slice is added to the standardized multi-source data record, and the standardized multi-source data record is assigned to the time slice alignment subset corresponding to that analysis time slice identifier. When the statistical time interval of the business system statistical record covers multiple consecutive analysis time slices, the set of analysis time slice identifiers covered by the business system statistical record is recorded, and the business system statistical record is treated as a cross-time slice statistical record and associated with the covered set of analysis time slice identifiers. For cross-time slice statistical records, during subsequent cross-source consistency deviation analysis, the cumulative values ​​of access-side indicators and interaction-side indicators within the statistical time interval are compared with the business statistical values ​​in the business system statistical record.

[0085] Furthermore, within each time-slice alignment subset, standardized multi-source data records belonging to that time-slice alignment subset are aggregated based on the same data source identifier and the same indicator type to generate time-slice indicator items. The time-slice indicator item includes a target video content identifier, an analysis time-slice identifier, a data source identifier, an indicator type, a time-slice indicator value, a data update time, and a data update delay characteristic. The data update delay characteristic includes an update delay time and an update delay flag.

[0086] For data sources identified as user access logs and behavioral interaction logs, when multiple standardized multi-source data records with the same data source identifier and the same indicator type exist in the same time slice's aligned subset, the corresponding indicator values ​​are accumulated to generate the time slice indicator value corresponding to that indicator type within the analysis time slice. For example, within the same analysis time slice, multiple playback request records or multiple like records corresponding to the target video content are accumulated to obtain the number of playback requests or likes corresponding to that analysis time slice.

[0087] For data sources identified as business system statistical records, when the statistical time interval of the business system statistical record corresponds to a single analysis time slice, the business statistical value in the business system statistical record is used as the time slice indicator value in the corresponding time slice alignment subset; when the business system statistical record is a cross-time slice statistical record, its business statistical value is associated with the set of analysis time slice identifiers it covers and saved as a cross-time slice statistical indicator value, which is used for subsequent comparison with the cumulative value of access-side indicators or cumulative value of interaction-side indicators within the same statistical time interval.

[0088] Furthermore, based on the data update time corresponding to the time slice indicator, a data update delay feature is generated, which includes the update delay time and the update delay flag.

[0089] Specifically, when the data source for a time-slice metric is identified as a user access log or behavioral interaction log, the data update time is compared with the end time of the analysis time slice to which the metric belongs to obtain the update delay time. If the data update time is earlier than or equal to the end time of the analysis time slice, the update delay time is set to zero; if the data update time is later than the end time of the analysis time slice, the time difference between the data update time and the end time of the analysis time slice is determined as the update delay time.

[0090] When the data source for a time-slice metric is identified as a statistical record from a business system, the data update time is compared with the end time of the statistical period corresponding to that time-slice metric to obtain the update delay time. If the data update time is earlier than or equal to the end time of the statistical period, the update delay time is set to zero; if the data update time is later than the end time of the statistical period, the time difference between the data update time and the end time of the statistical period is determined as the update delay time.

[0091] An update delay flag is generated based on the update delay time. Specifically, if the update delay time is less than or equal to a preset delay threshold, the update delay flag is set to a normal update flag; if the update delay time is greater than the preset delay threshold, the update delay flag is set to a delayed update flag. The preset delay threshold is determined based on the normal data update cycle corresponding to the data source identifier. The normal data update cycle includes the normal write cycle of user access log records, the normal write cycle of behavioral interaction log records, and the normal statistical update cycle of business system statistical records.

[0092] In this embodiment, the data update delay feature is used to characterize whether the corresponding time slice indicator is lagging behind its time range in terms of data update; wherein, the time range of the time slice indicator derived from user access log records or behavior interaction log records is the corresponding analysis time slice; and the time slice indicator derived from business system statistical records is the corresponding statistical time interval.

[0093] Furthermore, a time-slice aligned multi-source dataset is generated based on multiple time-slice aligned subsets and the data update delay characteristics corresponding to each time-slice indicator. The time-slice aligned multi-source dataset includes multiple time-slice aligned subsets, each corresponding to the same target video content identifier and the same analysis time-slice identifier. Each time-slice aligned subset includes time-slice indicator items within that analysis time-slice. These time-slice indicator items include the target video content identifier, analysis time-slice identifier, data source identifier, indicator type, time-slice indicator value, data update time, and data update delay characteristics. The data update delay characteristics include update delay time and update delay flag.

[0094] This step maps user access logs, behavioral interaction logs, and business system statistics to continuous analysis time slices within the same target analysis window. This allows data from different data sources to be compared on the same time scale around the same target video content. Simultaneously, by characterizing the data update delay features of different data sources relative to the end time of the corresponding analysis time slice or the end time of statistics, this provides a time-aligned data foundation for subsequently identifying abnormal patterns such as abnormal fluctuations in access volume, abnormal concentration of behavioral data, inconsistent cross-source changes, and abnormal data update delays.

[0095] Step S103: Constructing Intra-Source Change Features. Based on the time-slice aligned multi-source data set, according to the same target video content identifier, the same data source identifier, and the same indicator type, extract the changes in time-slice indicator values ​​within the continuous analysis time slice to generate an intra-source change feature set.

[0096] In this step, the time-slice aligned multi-source dataset has unified user access logs, behavioral interaction logs, and business system statistical records into continuous analysis time slices. However, the metrics from different data sources still only represent static values ​​within each analysis time slice. To facilitate subsequent assessment of consistency between changes across different data sources, it is necessary to first extract the characteristics of metric changes over time within each data source. Therefore, this step uses time-slice metric items as the processing object, constructing intra-source change characteristics within the same data source.

[0097] Specifically, for time-slice metric items in the time-slice aligned multi-source dataset, they are grouped based on the target video content identifier, data source identifier, and metric type to obtain multiple intra-source metric sequences. Each intra-source metric sequence consists of multiple time-slice metric items with the same target video content identifier, the same data source identifier, and the same metric type, arranged in the order of the analyzed time slices.

[0098] For example, for a time-slice metric item whose data source is identified as user access log records and whose metric type is valid play count, a sequence of valid play counts for the target video content within a continuous analysis time slice is constructed; for a time-slice metric item whose data source is identified as behavioral interaction log records and whose metric type is like count, a sequence of like counts for the target video content within a continuous analysis time slice is constructed; for a time-slice metric item whose data source is identified as business system statistical records and whose metric type is business statistical play count, a sequence of business statistical play counts for the target video content within a continuous analysis time slice is constructed.

[0099] Furthermore, based on the time-slice index values ​​of adjacent analysis time slices in each source index sequence, change direction features and change magnitude features are generated. The change direction feature characterizes the direction of index change in the current analysis time slice relative to the previous analysis time slice, and the direction of index change includes rising, falling, or remaining stable. The change magnitude feature characterizes the degree of index change in the current analysis time slice relative to the previous analysis time slice, and the degree of index change can be determined based on the difference in time-slice index values ​​between adjacent analysis time slices or the relative change ratio. For the first analysis time slice without a preceding analysis time slice, its change direction feature can be set to the initial state.

[0100] Furthermore, based on the directional characteristics of the same source indicator sequence across multiple consecutive analysis time slices, a volatility persistence feature is generated. This volatility persistence feature characterizes whether the same indicator continuously rises, continuously falls, or fluctuates repeatedly within consecutive analysis time slices. For example, when the same source indicator sequence shows an increase across N consecutive analysis time slices, a continuous rise feature is generated; when the same source indicator sequence shows a decrease across N consecutive analysis time slices, a continuous fall feature is generated; and when the same source indicator sequence alternates between rises and falls across N consecutive analysis time slices, a fluctuating feature is generated. Here, N is a positive integer greater than 1.

[0101] Furthermore, within each time-slice alignment subset, a concentration of change feature is generated based on the change magnitude characteristics of multiple indicator types corresponding to the same data source identifier. Specifically, the change magnitude characteristics corresponding to each indicator type under the same data source identifier within the same time-slice alignment subset are determined, and the number of indicator types whose change magnitude characteristics satisfy a preset magnitude condition is counted. A concentration of change feature is generated based on the number of indicator types. The concentration of change feature is used to characterize whether multiple indicator types in the same data source undergo concentrated changes within the same analysis time slice for the same target video content. For example, in the data source corresponding to behavioral interaction log records, if multiple interaction-side indicators such as the number of likes, comments, and shares all show an increase within the same analysis time slice and the change magnitude meets a preset magnitude condition, then the corresponding concentration of change feature can characterize that there is a concentrated change in the behavioral interaction data within that analysis time slice.

[0102] Therefore, for each target video content, a source-specific change feature set is generated based on time-slice alignment with multi-source data sets, change direction characteristics, change amplitude characteristics, fluctuation duration characteristics, and change concentration characteristics. The source-specific change feature set includes the target video content identifier, analysis time-slice identifier, data source identifier, indicator type, change direction characteristics, change amplitude characteristics, fluctuation duration characteristics, and change concentration characteristics.

[0103] This step allows for the creation of metric change descriptions within user access logs, behavioral interaction logs, and business system statistical records. This enables the subsequent construction of cross-source consistency deviation characteristics based on the intra-source change characteristics of different data sources.

[0104] Step S104: Constructing cross-source consistency deviation features. Based on the time-slice aligned multi-source data set and the source-internal change feature set, according to the same target video content identifier and the same analysis time-slice identifier, determine the time-slice indicator items with cross-source indicator correspondence between different data sources, and perform consistency comparison based on the time-slice indicator values ​​in the time-slice indicator items and the corresponding source-internal change features to generate a cross-source consistency deviation feature set.

[0105] In this step, the set of changes within the source data source is sufficient to characterize the changes in metrics within user access logs, behavioral interaction logs, and business system statistics. However, based solely on changes within a single data source, it's difficult to determine whether those changes match those within other data sources. For example, when the number of effective plays of a target video content increases significantly, the business statistics for play count should typically show a corresponding change within the same analysis time slice; similarly, when the number of likes, comments, and shares of a target video content increases intensively, the business statistics for interaction volume should typically show a corresponding change. If the metric values, directions of change, or magnitudes of change are significantly inconsistent across different data sources, it may indicate an anomaly in the data change status corresponding to the target video content. Therefore, this step, based on time slice alignment, constructs cross-source consistency deviation features. Specifically:

[0106] First, cross-source indicator mapping relationships are pre-defined. In this embodiment, the cross-source indicator mapping relationships are stored in the form of a cross-source indicator mapping table, which includes multiple mapping records. Each mapping record includes a first data source identifier, a first indicator type, a second data source identifier, a second indicator type, and a mapping method. The mapping method includes a single indicator mapping method and a multi-indicator summary mapping method.

[0107] The single-metric correspondence method is used to characterize two metric types from different data sources that have the same or similar data meanings. For example, a single-metric correspondence is established between the number of valid plays in user access logs and the number of plays in business statistics records in the business system; similarly, a single-metric correspondence is established between the number of impressions in user access logs and the number of exposures in business statistics records in the business system.

[0108] The multi-indicator aggregation mapping method is used to represent multiple indicator types in one data source that need to be aggregated and mapped to an indicator type in another data source. For example, the number of likes, comments, favorites, shares, and follow triggers in behavioral interaction logs can be used to generate an interactive aggregated interaction volume according to preset aggregation rules, and a multi-indicator aggregation mapping relationship can be established with the business statistical interaction volume in the business system's statistical records. The preset aggregation rules are used to convert multiple interactive indicators under the same target video content, the same analysis time slice, and the same data source identifier into an interactive aggregated interaction volume. Specifically, the number of likes, comments, favorites, shares, and follow triggers in the behavioral interaction logs are summed to obtain the interactive aggregated interaction volume, which is then used as the indicator value for cross-source comparison with the business statistical interaction volume.

[0109] Furthermore, based on the cross-source indicator mapping table, within the time-slice alignment subset corresponding to the same target video content identifier and the same analysis time-slice identifier, the time-slice indicator item matching each mapping record is searched, and a cross-source comparison item is constructed. Specifically:

[0110] When the mapping record is a single-indicator correspondence, the time-slice indicator items corresponding to the first data source identifier and the first indicator type, as well as the time-slice indicator items corresponding to the second data source identifier and the second indicator type, are extracted to construct a cross-source comparison item. When the mapping record is a multi-indicator summary correspondence, the time-slice indicator items corresponding to multiple first indicator types under the first data source identifier are extracted first, and a summary time-slice indicator value is generated according to a preset summary rule. Then, the summary time-slice indicator value is used as the first time-slice indicator value in the cross-source comparison item, and the time-slice indicator values ​​in the time-slice indicator items corresponding to the second data source identifier and the second indicator type are used as the second time-slice indicator values ​​in the cross-source comparison item to construct a cross-source comparison item. The preset summary rule is a summation summary rule, used to extract the time-slice indicator values ​​corresponding to the number of likes, comments, favorites, shares, and follow triggers in the behavior interaction log records under the same target video content identifier, the same analysis time-slice identifier, and the same data source identifier, and to sum the extracted time-slice indicator values ​​to obtain the summary interaction volume on the interaction side. The summary interaction volume on the interaction side is used as the time-slice indicator value for cross-source comparison with the business statistical interaction volume in the business system statistical records.

[0111] Furthermore, for each cross-source comparison item, a consistency comparison is performed based on the time slice index value and the corresponding intra-source change characteristics in the cross-source comparison item. The consistency comparison includes cross-source numerical consistency comparison, cross-source change direction consistency comparison, and cross-source change magnitude consistency comparison, and a cross-source consistency deviation feature is generated based on the comparison results.

[0112] The cross-source numerical consistency comparison is used to compare whether the values ​​of time-slice indicators with cross-source indicator correspondences from different data sources match within the same analysis time slice, and to generate cross-source numerical deviation features. Specifically, when the cross-source comparison item is a single indicator correspondence, the cross-source numerical deviation feature is generated based on the difference or relative deviation between the indicator value of the first time slice and the indicator value of the second time slice; when the cross-source comparison item is a multi-indicator summary correspondence, the cross-source numerical deviation feature is generated based on the difference or relative deviation between the indicator value of the summary time slice and the indicator value of the second time slice.

[0113] Cross-source change direction consistency comparison is used to compare whether the change direction characteristics of time-slice indicators with cross-source indicator correspondences from different data sources are consistent within the same analysis time slice, and to generate cross-source change direction consistency characteristics. Specifically, based on the set of change characteristics within the source, the change direction characteristics corresponding to two time-slice indicators in the cross-source comparison item are determined within the same analysis time slice; when the change direction characteristics corresponding to the two time-slice indicators are both increasing, both decreasing, or both remaining stable, the cross-source change direction consistency characteristic is set as a change direction consistency characteristic; when the change direction characteristic corresponding to one time-slice indicator is increasing while that of the other time-slice indicator is decreasing, or when the change direction characteristic corresponding to one time-slice indicator is increasing or decreasing while that of the other time-slice indicator is remaining stable, the cross-source change direction consistency characteristic is set as a change direction inconsistency characteristic.

[0114] Cross-source variation amplitude consistency comparison is used to compare whether the variation amplitude characteristics of time-slice indicator items with cross-source indicator correspondence in different data sources match within the same analysis time slice, and to generate cross-source variation amplitude deviation characteristics. Specifically, based on the first variation amplitude characteristic corresponding to the first time-slice indicator item and the second variation amplitude characteristic corresponding to the second time-slice indicator item in the cross-source comparison item, the amplitude difference between the first variation amplitude characteristic and the second variation amplitude characteristic is calculated; when the amplitude difference is less than or equal to a preset amplitude deviation threshold, the cross-source variation amplitude deviation characteristic is set as an amplitude matching characteristic; when the amplitude difference is greater than the preset amplitude deviation threshold, the cross-source variation amplitude deviation characteristic is set as an amplitude deviation characteristic. The preset amplitude deviation threshold is a pre-configured allowable amplitude deviation range for the cross-source comparison item, used to determine whether the variation amplitude difference between time-slice indicator items with cross-source indicator correspondence in different data sources exceeds the allowable range; the preset amplitude deviation threshold is determined based on the historical normal variation amplitude difference of the corresponding cross-source comparison item, the difference in indicator statistical caliber, and the platform's allowable error range.

[0115] Furthermore, the update delay time and update delay flag in the time slice index item corresponding to the cross-source comparison item are used as auxiliary fields and associated with the corresponding cross-source consistency deviation feature, so that the subsequent abnormal pattern recognition model can distinguish whether the cross-source deviation may be related to the data update delay.

[0116] Furthermore, for each target video content, a cross-source consistency deviation feature set is generated based on cross-source comparison items, cross-source numerical deviation features, cross-source change direction consistency features, cross-source change magnitude deviation features, update delay time, and update delay marker. The cross-source consistency deviation feature set includes the target video content identifier, the analysis time slice identifier, the cross-source comparison items, the cross-source numerical deviation features, the cross-source change direction consistency features, the cross-source change magnitude deviation features, the update delay time, and the update delay marker.

[0117] This step allows us to characterize the numerical deviations, direction deviations, and magnitude deviations among user access logs, behavioral interaction logs, and business system statistical records, based on time slice alignment and source-specific change characteristics. This enables subsequent anomaly pattern recognition to comprehensively determine whether changes across different data sources are consistent.

[0118] Step S105: Anomaly pattern recognition result generation. The source intra-source change feature set, cross-source consistency deviation feature set, and data update delay feature in the time-slice aligned multi-source data set are input into the anomaly pattern recognition model to generate anomaly pattern recognition result corresponding to the target video content.

[0119] In this step, the anomaly pattern recognition model is used to comprehensively analyze the intra-source changes, cross-source consistency deviations, and data update delays of the same target video content within continuous analysis time slices, in order to determine whether there are any anomalies in the data change status corresponding to the target video content.

[0120] In one implementation, the anomaly pattern recognition model is implemented using a backpropagation (BP) neural network classification model. This BP neural network classification model is a feedforward neural network model including an input layer, hidden layers, and an output layer, used to classify and identify structured anomaly recognition feature vectors and output probability values ​​corresponding to different anomaly pattern types.

[0121] Specifically, for the same target video content and the same analysis time slice, the change direction features, change amplitude features, fluctuation duration features, and change concentration features from the intra-source change feature set are concatenated with the cross-source numerical deviation features, cross-source change direction consistency features, and cross-source change amplitude deviation features from the cross-source consistency deviation feature set. This concatenation is then combined with the update delay time and update delay marker in the multi-source data set aligned with the time slice to generate an anomaly identification feature vector. This anomaly identification feature vector serves as the input to the anomaly pattern recognition model.

[0122] In one implementation, the anomaly pattern recognition model includes an input layer, at least one hidden layer, and an output layer. The number of nodes in the input layer corresponds to the feature dimension of the anomaly recognition feature vector, and it is used to receive the anomaly recognition feature vector. The hidden layer is used to perform nonlinear mapping on the intra-source variation features, cross-source consistency deviation features, and data update delay features in the anomaly recognition feature vector. The number of nodes in the output layer corresponds to the number of preset anomaly pattern types, and it is used to output the probability value corresponding to each anomaly pattern type. The hidden layer may use the ReLU activation function, and the output layer may use the Softmax function to output the classification probability.

[0123] During model training, training samples are constructed based on historical multi-source data records from video platforms or content distribution platforms. Specifically, the historical multi-source data records are processed according to steps S101 to S104 to obtain historical anomaly identification feature vectors. Based on historical manual review results, historical anomaly handling records, or preset anomaly labeling rules, anomaly pattern labels are configured for the historical anomaly identification feature vectors, forming a training sample set. The anomaly pattern recognition model is trained using this training sample set, and the connection weights between the input layer and the hidden layer, and between the hidden layer and the output layer, are updated using the backpropagation algorithm, enabling the anomaly pattern recognition model to learn the correspondence between anomaly identification feature vectors and anomaly pattern types.

[0124] When training samples are insufficient, pre-training samples can be constructed based on publicly available temporal anomaly samples or simulated multi-source anomaly samples to initially train the anomaly pattern recognition model. Then, fine-tuning can be performed using a small amount of historical multi-source data records from video platforms or content distribution platforms. During fine-tuning, some parameters of the input and hidden layers are kept unchanged, and only the parameters between the hidden and output layers are adjusted. Alternatively, all parameters can be updated on a small scale based on the business scenario of the target video content to reduce model training costs.

[0125] During model deployment, the trained anomaly pattern recognition model is deployed on the data analysis server of the video platform or content distribution platform. When a new target analysis window is generated, the data analysis server generates anomaly recognition feature vectors corresponding to the current target video content based on steps S101 to S104, and inputs these anomaly recognition feature vectors into the trained anomaly pattern recognition model to obtain the anomaly pattern recognition result.

[0126] The anomaly pattern recognition results include target video content identifiers, anomaly analysis time slices, anomaly pattern types, anomaly data sources, anomaly indicators, anomaly levels, and anomaly confidence scores. Anomaly pattern types include abnormal fluctuations in visitor traffic, abnormal concentration of behavioral data, inconsistent cross-source changes, abnormal data update delays, and anomalies in business statistics backfilling. Anomaly confidence scores are determined based on the probability values ​​of the corresponding anomaly pattern types in the output layer, while the anomaly level is determined based on the anomaly confidence scores and the degree of deviation of the cross-source consistency deviation features.

[0127] This step allows for the identification of data change states in target video content based on the multi-source data change characteristics and cross-source deviation characteristics after time-slice alignment, resulting in structured abnormal pattern recognition results. This improves the accuracy and reliability of data change trend analysis for video platforms or content distribution platforms.

[0128] Figure 2 This is a schematic diagram illustrating the structure of an anomaly pattern recognition system based on multi-source data fusion according to an example embodiment of this application. For example... Figure 2 As shown, the multi-source data fusion anomaly pattern recognition system 200 provided in this embodiment includes: a multi-source data recording acquisition and standardization module 210, a time granularity alignment and update delay marking module 220, an intra-source change feature construction module 230, a cross-source consistency deviation feature construction module 240, and an anomaly pattern recognition result generation module 250.

[0129] The multi-source data recording acquisition and standardization module 210 acquires the multi-source data records corresponding to the target video content within the target analysis window, and performs standardization processing on the multi-source data records to generate standardized multi-source data records.

[0130] The time granularity alignment and update delay marking module 220 divides the target analysis window into multiple continuous analysis time slices based on a preset basic analysis time window. According to the event occurrence time or statistical time interval in the standardized multi-source data records, the standardized multi-source data records are assigned to the corresponding analysis time slices. Based on the standardized multi-source data records assigned to the same analysis time slice, time slice index items and data update delay features are generated to obtain a time slice aligned multi-source data set.

[0131] The source change feature construction module 230, based on the time-slice aligned multi-source data set, extracts the changes in time-slice index values ​​within the continuous analysis time slice according to the same target video content identifier, the same data source identifier, and the same index type, and generates a source change feature set.

[0132] The cross-source consistency deviation feature construction module 240, based on the time-slice aligned multi-source data set and the source change feature set, determines time-slice indicator items with cross-source indicator correspondence between different data sources according to the same target video content identifier and the same analysis time-slice identifier, and performs consistency comparison based on the time-slice indicator values ​​in the time-slice indicator items and the corresponding source change features to generate a cross-source consistency deviation feature set.

[0133] The anomaly pattern recognition result generation module 250 inputs the source intra-source change feature set, cross-source consistency deviation feature set, and data update delay features in the time-slice aligned multi-source data set into the anomaly pattern recognition model to generate anomaly pattern recognition results corresponding to the target video content.

[0134] Other embodiments of this application will readily occur to those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of this application that follow the general principles of this application and include common knowledge or customary techniques in the art not disclosed herein. The specification and examples are to be considered exemplary only, and the true scope and spirit of this application are indicated by the foregoing claims.

[0135] It should be understood that this application is not limited to the precise structure described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope.

Claims

1. A multi-source data fusion abnormal pattern recognition method, characterized in that, include: Multi-source data recording acquisition and standardization: acquire multi-source data records corresponding to the target video content within the target analysis window, and perform standardization processing on the multi-source data records to generate standardized multi-source data records; Time granularity alignment and update delay marking: Based on a preset basic analysis time window, the target analysis window is divided into multiple continuous analysis time slices. According to the event occurrence time or statistical time interval in the standardized multi-source data records, the standardized multi-source data records are assigned to the corresponding analysis time slices. Based on the standardized multi-source data records assigned to the same analysis time slice, time slice index items and data update delay characteristics are generated to obtain a time slice aligned multi-source data set. Intra-source variation feature construction: Based on the time-slice aligned multi-source data set, according to the same target video content identifier, the same data source identifier, and the same indicator type, extract the changes in time-slice indicator values ​​within the continuous analysis time slice to generate an intra-source variation feature set; Cross-source consistency deviation feature construction: Based on the time-slice aligned multi-source data set and the source-internal change feature set, according to the same target video content identifier and the same analysis time-slice identifier, time-slice indicator items with cross-source indicator correspondence between different data sources are determined, and consistency comparison is performed based on the time-slice indicator values ​​in the time-slice indicator items and the corresponding source-internal change features to generate a cross-source consistency deviation feature set. The abnormal pattern recognition result is generated by inputting the source intra-source change feature set, cross-source consistency deviation feature set, and data update delay feature from the time-slice aligned multi-source data set into the abnormal pattern recognition model to generate the abnormal pattern recognition result corresponding to the target video content.

2. The method of claim 1, wherein, The multi-source data records are standardized to generate standardized multi-source data records, including: Configure a data source identifier for each of the multi-source data records to distinguish whether the multi-source data records originate from user access log records, behavior interaction log records, or business system statistical records; The original indicator fields in user access logs, behavior interaction logs, and business system statistical records are converted into indicator types and indicator values ​​in standardized multi-source data records. The indicator type is used to characterize the data meaning corresponding to the original indicator field, and the indicator value is used to characterize the value of the original indicator field within the corresponding time range. The time field in multi-source data records is processed uniformly to generate event occurrence time, statistical time interval, and data update time. The standardized multi-source data record includes target video content identifier, data source identifier, indicator type, indicator value, event occurrence time, statistical time interval, and data update time.

3. The method of claim 1, wherein, Time granularity alignment and update delay flags include: Based on the target video content identifier, the standardized multi-source data records are grouped to obtain a set of standardized multi-source data records corresponding to the same target video content; Time slice attribution is performed on each standardized multi-source data record in the standardized multi-source data record set, and a time slice aligned subset is generated. In each time-slice alignment subset, based on the same data source identifier and the same indicator type, the standardized multi-source data records belonging to the time-slice alignment subset are aggregated to generate time-slice indicator items. Based on the data update time corresponding to the time slice indicator, a data update delay feature is generated, which includes an update delay time and an update delay flag. Based on multiple time-slice aligned subsets and the data update delay characteristics corresponding to each time-slice indicator, a time-slice aligned multi-source data set is generated.

4. The method of claim 3, wherein, The time-slice aligned multi-source data set includes multiple time-slice aligned subsets, each time-slice aligned subset corresponding to the same target video content identifier and the same analysis time-slice identifier; Each time-slice alignment subset includes time-slice metrics within that analysis time-slice. The time-slice metrics include target video content identifier, analysis time-slice identifier, data source identifier, metric type, time-slice metric value, data update time, and data update delay characteristics. The data update delay characteristics include update delay time and update delay flag.

5. The method of claim 3, wherein, Data update latency features are generated based on the data update time corresponding to the time slice indicator, including: When the data source of the time slice indicator is identified as user access log or behavior interaction log, the data update time is compared with the end time of the analysis time slice to which the time slice indicator belongs to obtain the update delay time. If the data update time is earlier than or equal to the end time of the analysis time slice, the update delay time is set to zero; if the data update time is later than the end time of the analysis time slice, the time difference between the data update time and the end time of the analysis time slice is determined as the update delay time. When the data source of the time slice indicator is identified as a business system statistical record, the data update time is compared with the statistical end time of the corresponding statistical time interval of the time slice indicator to obtain the update delay time. If the data update time is earlier than or equal to the statistics end time, the update delay time is set to zero; if the data update time is later than the statistics end time, the time difference between the data update time and the statistics end time is determined as the update delay time. An update delay flag is generated based on the update delay time. If the update delay time is less than or equal to a preset delay threshold, the update delay flag is set to a normal update flag; if the update delay time is greater than the preset delay threshold, the update delay flag is set to a delayed update flag.

6. The method of claim 1, wherein, The construction of the source-internal variation features includes: For time-slice metric items in time-slice aligned multi-source datasets, grouping is performed based on target video content identifier, data source identifier, and metric type to obtain multiple in-source metric sequences; Based on the time slice index values ​​of adjacent analysis time slices in each of the source index sequences, change direction features and change magnitude features are generated. Based on the directional characteristics of the same source index sequence across multiple consecutive analysis time slices, fluctuation persistence characteristics are generated. In each time slice alignment subset, a change concentration feature is generated based on the change magnitude characteristics of multiple indicator types corresponding to the same data source identifier. For each target video content, a source-internal change feature set is generated based on time-slice aligned multi-source data sets, change direction features, change amplitude features, fluctuation duration features, and change concentration features. The source-internal change feature set includes target video content identifier, analysis time-slice identifier, data source identifier, indicator type, change direction features, change amplitude features, fluctuation duration features, and change concentration features.

7. The method of claim 1, wherein, The cross-source indicator correspondence is stored in the form of a cross-source indicator mapping table; Each mapping record in the cross-source indicator mapping table includes a first data source identifier, a first indicator type, a second data source identifier, a second indicator type, and a corresponding method. The corresponding method includes a single indicator corresponding method and a multi-indicator summary corresponding method. The single-indicator correspondence method is used to characterize two indicator types in different data sources that have the same or similar data meanings, while the multi-indicator aggregation correspondence method is used to characterize multiple indicator types in one data source that are aggregated and then corresponded to an indicator type in another data source. 8.The multi-source data fusion based abnormal pattern recognition method of claim 1, wherein, Construction of cross-source consistency deviation features includes: Pre-set the cross-source indicator correspondence and store the cross-source indicator correspondence in the form of a cross-source indicator mapping table including multiple mapping records; Based on the cross-source index mapping table, in the time slice alignment subset corresponding to the same target video content identifier and the same analysis time slice identifier, find the time slice index item that matches each mapping record in the cross-source index mapping table, and construct the cross-source comparison item. For each cross-source comparison item, a consistency comparison is performed based on the time slice index value and the corresponding intra-source change characteristics in the cross-source comparison item. The consistency comparison includes cross-source numerical consistency comparison, cross-source change direction consistency comparison, and cross-source change magnitude consistency comparison. Based on the comparison results, a cross-source consistency deviation feature is generated. The update delay time and update delay flag in the time slice index item corresponding to the cross-source comparison item are used as auxiliary fields and associated with the corresponding cross-source consistency deviation feature. For each target video content, a set of cross-source consistency deviation features is generated based on the cross-source comparison item, cross-source numerical deviation features, cross-source change direction consistency features, cross-source change magnitude deviation features, update delay time, and update delay flag. The cross-source consistency deviation feature set includes target video content identifier, analysis time slice identifier, cross-source comparison item, cross-source numerical deviation feature, cross-source change direction consistency feature, cross-source change magnitude deviation feature, update delay time, and update delay marker.

9. A multi-source data fusion abnormal pattern recognition system, characterized in that, include: The multi-source data recording acquisition and standardization module acquires multi-source data records corresponding to the target video content within the target analysis window, and performs standardization processing on the multi-source data records to generate standardized multi-source data records. The time granularity alignment and update delay marking module divides the target analysis window into multiple continuous analysis time slices based on a preset basic analysis time window. According to the event occurrence time or statistical time interval in the standardized multi-source data records, the standardized multi-source data records are assigned to the corresponding analysis time slices. Based on the standardized multi-source data records assigned to the same analysis time slice, time slice index items and data update delay characteristics are generated to obtain a time slice aligned multi-source data set. The source change feature construction module, based on the time-slice aligned multi-source data set, extracts the changes in time-slice index values ​​within the continuous analysis time slice according to the same target video content identifier, the same data source identifier, and the same index type, and generates a source change feature set; The cross-source consistency deviation feature construction module, based on the time-slice aligned multi-source data set and the source-internal change feature set, determines time-slice indicator items with cross-source indicator correspondence between different data sources according to the same target video content identifier and the same analysis time-slice identifier, and performs consistency comparison based on the time-slice indicator values ​​in the time-slice indicator items and the corresponding source-internal change features to generate a cross-source consistency deviation feature set. The anomaly pattern recognition result generation module inputs the source intra-source change feature set, cross-source consistency deviation feature set, and data update delay features from the time-slice aligned multi-source data set into the anomaly pattern recognition model to generate anomaly pattern recognition results corresponding to the target video content.

Images