Convolutional attention-based time series data anomaly early warning method and system

Abstract

The application discloses a time series data abnormal early warning method and system based on convolution attention, and belongs to the technical field of data management. The application carries out time alignment on continuous transaction messages and writes the continuous transaction messages into a ring buffer, forms a state sequence through basic time slice statistics, determines a candidate change point, further constructs a multi-scale candidate window, and then carries out window pre-screening and scale matching in combination with historical abnormal events, selects a target window to input a convolution attention model, dynamically corrects a window range according to a model uncertainty and an attention boundary distribution, and reasons again on the corrected window, generates an abnormal window record when an abnormal score reaches a threshold value, updates an abnormal event state through cross-window event association, and outputs a phased early warning, so that the complete expression capability of abnormal features is improved, and the problem that the actual processing range of time series data and the continuous process of abnormal states are not adapted in the prior art is solved.

Description

Technical Field

[0001] This invention relates to the field of data management technology, and in particular to a method and system for early warning of anomalies in time-series data based on convolutional attention. Background Technology

[0002] With the development of networked and real-time financial transaction processing systems, transaction terminals, payment interfaces, and transaction servers continuously generate time-sequential transaction message streams. These transaction messages exhibit clear temporal correlations in terms of arrival frequency, processing latency, state changes, and numerical fluctuations. Some abnormal states manifest as short-term localized abrupt changes, while others show sustained deviations over longer periods. To promptly detect abnormal states in the transaction message stream, it is necessary to utilize computer equipment to automatically process continuous transaction messages and output corresponding warning information when abnormal data states occur.

[0003] Existing time-series data anomaly early warning technologies typically first perform time alignment, data cleaning, and feature transformation on continuously generated transaction messages. Then, the transaction message stream is segmented according to a pre-set window length and sliding step size, converting the data within each time window into a time-series feature matrix. Subsequently, a convolutional neural network is used to extract local change features between adjacent time positions within the window, and an attention mechanism is used to assign corresponding weights to features at different time positions, thereby calculating the anomaly score corresponding to the window. When the anomaly score reaches a preset condition, the system generates an anomaly window record or sends an early warning message to the early warning terminal.

[0004] However, existing technologies typically use fixed-length time windows when segmenting transaction message streams. The duration of abnormal states in transaction messages is not fixed, and the start and end points of these abnormal states do not necessarily coincide with the time window boundaries. Since existing technologies usually perform independent model inference on each time window after segmentation, the model processing results cannot accurately reflect whether the current window fully covers the abnormal state. When the initial window range does not match the duration of the abnormal state, the system still reads and processes data according to the predetermined window boundaries, which can easily lead to the dilution of short-term abnormal features or the truncation of long-term abnormal features, thus affecting the stability of the abnormal score and the timeliness of abnormal warnings. Summary of the Invention

[0005] To address the technical problem that existing technologies are incompatible with the practical processing range of time-series data and the continuous process of abnormal states, this invention provides a method and system for early warning of anomalies in time-series data based on convolutional attention. The technical solution is as follows:

[0006] On the one hand, a method for anomaly warning of temporal data based on convolutional attention is provided. This method includes: acquiring continuously generated transaction message streams; processing the transaction message streams according to preset alignment rules to obtain transaction messages and writing them into a circular data buffer; statistically analyzing the transaction messages in the circular data buffer according to preset base time slices to generate a transaction message state sequence to determine candidate change points and generate corresponding change point data; extracting the read length from a preset window scale set based on the change point data to construct a multi-scale candidate window; when there are unfinished historical anomaly events in the online event state storage area, pre-screening and scale matching of the multi-scale candidate window is performed in conjunction with the historical anomaly events; otherwise, scale matching is directly performed on the multi-scale candidate window to determine the initial target window, and the data is then extracted from the circular data buffer. The data corresponding to the initial target window is read and converted into a temporal feature matrix. The temporal feature matrix is ​​input into a pre-trained convolutional attention model, which outputs the attention boundary distribution and the initial model output parameters, including the initial anomaly score and model uncertainty. Based on the model uncertainty, it is determined whether to trigger closed-loop correction. When triggered, closed-loop correction is performed on the initial target window based on the attention boundary distribution to obtain the corrected target window. Then, at least one inference is performed on its corresponding temporal feature matrix to obtain the corrected anomaly score. When the corrected anomaly score reaches the preset anomaly candidate threshold, an anomaly window record containing the window feature vector is generated. According to the preset association parameters, the anomaly window record is associated with historical anomaly events across windows, and the anomaly event status is updated to generate a phased early warning instruction.

[0007] On the other hand, a time-series data anomaly early warning system based on convolutional attention is provided. This system includes: a transaction information preprocessing module, used to acquire continuously generated transaction message streams, process the transaction message streams according to preset alignment rules to obtain transaction messages, and write them into a circular data buffer; statistically analyze the transaction messages in the circular data buffer according to preset base time slices, generate a transaction message state sequence to determine candidate change points, and generate corresponding change point data; and a time-series feature processing module, used to extract the reading length from a preset window scale set based on the change point data to construct multi-scale candidate windows. When there are unfinished historical anomaly events in the online event state storage area, the multi-scale candidate windows are pre-screened and scale matched in conjunction with the historical anomaly events; otherwise, scale matching is directly performed on the multi-scale candidate windows to determine the initial target window, and the data is then processed from the circular data buffer. The system reads the data corresponding to the initial target window and converts it into a temporal feature matrix. An anomaly warning and determination module inputs the temporal feature matrix into a pre-trained convolutional attention model, outputting the attention boundary distribution and initial model output parameters, including initial anomaly scores and model uncertainty. Based on the model uncertainty, it determines whether to trigger closed-loop correction. When triggered, it performs closed-loop correction on the initial target window based on the attention boundary distribution to obtain the corrected target window. Then, it performs at least one inference on the corresponding temporal feature matrix to obtain the corrected anomaly score. When the corrected anomaly score reaches a preset anomaly candidate threshold, it generates an anomaly window record containing the window feature vector. The warning result output module associates the anomaly window record with historical anomaly events across windows according to preset association parameters, updates the anomaly event status, and generates phased warning instructions.

[0008] The beneficial effects of the technical solutions provided in the embodiments of the present invention include at least the following:

[0009] This solution provides a convolutional attention-based method for anomaly warning in time-series data. By aligning the execution time of transaction message streams and writing them into a circular data buffer, subsequent window division is based on the actual event occurrence time, avoiding state distortion caused by out-of-order and repetitive events. Furthermore, the continuous message stream is discretized into state sequences according to basic time slices, and structured change point data is generated based on their distribution differences. Multi-scale candidate windows are then constructed, and corrected anomaly scores are obtained through convolutional attention model inference and window closure correction. Finally, scattered anomaly windows are aggregated into continuous, traceable anomaly events through cross-window event association. This solution allows the window scale to adapt to changing patterns, the reliability of the judgment results to gradually converge, and inference resources and cache management to be controlled based on event state and system load. While ensuring coverage of various anomalies such as short-term bursts, moderate persistence, and long-term gradual changes, it helps reduce redundant inference operations, fragmented alarms, and storage overhead.

[0010] This scheme differs from the conventional approach of symmetrical windowing centered on the point of change. Instead, it determines the forward read length based on the location error range of candidate change points and the backward read length based on the speed and direction of state change, ensuring that the coverage areas before and after the window are determined by the statistical attributes of the change. Therefore, when the location of the change's starting point is unreliable, it automatically supplements the data with historical baseline data; while the change continues, it extends the coverage area backward. This prioritizes the allocation of limited data reads to the time side where the change process is concentrated, ensuring complete coverage of the change process while avoiding redundant data from other sides diluting the model input. This effectively improves the detection adaptability and computational economy for different anomalies.

[0011] On the other hand, this scheme statistically analyzes the attention ratio of the front, middle, and back regions of the target window, and determines whether to trigger correction based on model uncertainty. It also determines four correction actions—expanding backward, expanding forward, contracting, or maintaining—based on attention ratio and boundary continuity. This allows the model's internal output to control the actual reading range of the circular data buffer, thereby transforming the model from a simple data consumer into a feedback source that participates in determining subsequent data readings. This enables the target window to converge to a scale that fully covers the change process within bounded iterations, improving both the reliability of the judgment and the completeness of the coverage without excessively increasing the average computational cost. Attached Figure Description

[0012] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0013] Figure 1 A flowchart of a time-series data anomaly warning method based on convolutional attention provided in an embodiment of this application;

[0014] Figure 2 A flowchart illustrating the generation of change point data provided in this application embodiment;

[0015] Figure 3 A schematic diagram illustrating the construction of asymmetric multi-scale candidate windows provided in an embodiment of this application;

[0016] Figure 4 This is a schematic diagram of the structure of a time-series data anomaly warning system based on convolutional attention provided in an embodiment of this application. Detailed Implementation

[0017] Embodiments of the present disclosure will now be described in more detail with reference to the accompanying drawings. While some embodiments of the present disclosure are shown in the drawings, it should be understood that embodiments of the present disclosure may be implemented in various forms and should not be construed as limited to the embodiments set forth herein. Rather, these embodiments are provided to provide a more thorough and complete understanding of the present disclosure.

[0018] It should be understood that the accompanying drawings and embodiments of this disclosure are for illustrative purposes only and are not intended to limit the scope of protection of this disclosure. In the description of the embodiments of this disclosure, the term "comprising" and similar terms should be understood as open-ended inclusion, i.e., "including but not limited to". The term "based on" should be understood as "at least partially based on". The term "one embodiment" or "this embodiment" should be understood as "at least one embodiment". The terms "first", "second", etc., may refer to different or the same objects.

[0019] This embodiment takes the real-time transaction monitoring scenario of a large payment clearing platform as an example. The platform processes tens of thousands of transactions per second. The transaction processing equipment continuously generates transaction messages and imports them into the processing system via the transaction access server. The abnormal patterns include various modes such as sudden increases in short-term concurrency, gradual changes in channel response latency, and the spread of abnormal transaction characteristics across terminals. This places high demands on the multi-scale adaptive capability and real-time performance of the detection algorithm.

[0020] Before performing the following steps, the following initialization work must be completed in advance. The convolutional attention model is trained offline using the platform's historical transaction message stream over the past year as training data and manually reviewed and labeled abnormal time intervals as supervision signals. The convolutional layers inside the model are responsible for extracting local change features between adjacent time positions. The attention calculation layer outputs the weights of each time position and aggregates them accordingly. Different convolutional kernel sizes and dilation rates are configured for short, medium, and long window scales, and an uncertainty estimation branch based on Monte Carlo random deactivation is integrated. The output layer of the convolutional attention model outputs the probability distribution of the current window in a preset state category. The preset state category includes at least the normal state and several abnormal states. The initial abnormal score is derived from the weighted sum of the probabilities of each abnormal state in the probability distribution. The model uncertainty is estimated by the entropy of the average distribution of the probability distribution obtained by multiple random forward inferences under the Monte Carlo random deactivation method.

[0021] It should be noted that the preset change point threshold Preset uncertainty threshold Preset matching threshold Preset separation threshold All other preset thresholds involved in each step are calibrated offline using historical data statistics. The preset expansion step size, preset consecutive count, preset continuous confirmation threshold, as well as the preset upper limits for maximum window length, maximum expansion count, maximum closed-loop iteration count, maximum allowed inference waiting time, and maximum event recording time, are all pre-configured based on the transaction message generation frequency, the maximum allowed input length of the model, and system real-time requirements, or dynamically adjusted according to system load. The preset basic time slice length and preset window scale set are pre-configured based on the platform's transaction message generation frequency and the maximum allowed input length of the model. System load is generated as a single scalar indicator by comprehensively considering the processor utilization rate of the model inference server, available memory, message queue backlog, and average inference latency, for subsequent resource scheduling. The circular data buffer, online event state storage area, historical event storage area, and compressed storage area are pre-set during system initialization. The circular data buffer cyclically overwrites the earliest data with a fixed capacity, storing at least the transaction messages from the most recent maximum analysis period to support random reading of historical data for subsequent windows or for expanding newly added data backward.

[0022] To make the technical problems, technical solutions and advantages of the present invention clearer, a detailed description will be given below in conjunction with the accompanying drawings and specific embodiments.

[0023] See Figure 1 , Figure 1 A flowchart of a time-series data anomaly warning method based on convolutional attention provided in this application embodiment is shown. The method includes the following steps:

[0024] Step 1: Obtain the continuously generated transaction message stream, process the transaction message stream according to the preset alignment rules to obtain transaction messages, and write them into the circular data buffer.

[0025] In the aforementioned payment clearing platform scenario, transaction messages generated concurrently by various terminal devices, gateway nodes, and third-party channel systems commonly suffer from out-of-order arrival, duplicate pushes, and discrepancies between arrival times and actual occurrence times due to network transmission jitter, device clock deviations, and concurrent processing. Directly using the message arrival order for subsequent statistics would distort the state sequence, thus affecting the accuracy of change point detection. Therefore, the preset alignment rules include at least duplicate message deletion, out-of-order message rearrangement, and time alignment based on message sequence number and event timestamp, ensuring that transaction messages written to the circular data buffer are strictly arranged according to event time order. Each transaction message includes at least an event timestamp, message sequence number, tagged transaction source identifier, terminal identifier, channel identifier, transaction value field, transaction status code, and processing response latency. The tagged transaction source identifier is used to associate consecutive transaction messages generated from the same data source without reading the original identity information, thus meeting data privacy protection requirements. A circular data buffer is used instead of unbounded storage because it cyclically overwrites the oldest data with a fixed capacity. While storing transaction messages from the most recent maximum analysis period, it allows direct control over the range of data actually involved in the calculation by specifying the start and end addresses and the amount of data read, providing an efficient data interface for subsequent random reads within asymmetric windows. Alternatively, the circular data buffer can also be implemented using a memory-mapped file with fixed-length rolling over or a key-value cache with an expiration policy.

[0026] Step 2: Statistically analyze the transaction messages in the circular data buffer according to the preset base time slice, generate a transaction message state sequence to determine candidate change points, and generate the corresponding change point data.

[0027] This step completes the end-to-end transformation from the raw message stream to structured change point data, serving as the information source driving the subsequent construction of asymmetric multi-scale windows. Using a preset base time slice as the statistical granularity, a set of state parameters is calculated for each transaction message falling into that base time slice. These state parameters include the number of transaction messages per unit time, the average time interval between adjacent transaction messages, the transaction message interval variance, processing response latency and its rate of change, the proportion of different transaction status codes, the number of terminal identifier changes, the number of channel identifier changes, the local change rate of transaction value fields, the data missing rate and out-of-order correction amount, and the message queue backlog. The state parameters corresponding to each base time slice are arranged according to event time to obtain the transaction message state sequence.

[0028] During peak platform business hours, the correlation between message queue backlog and response latency is often an early signal of system pressure, while abnormal fluctuations in the number of terminal identifier changes and channel identifier changes may indicate abnormal access behavior. Parallel statistics of multi-dimensional state parameters enable the above different types of anomalies to be characterized by the same state sequence.

[0029] like Figure 2 The diagram shown is a flowchart of the change point data generation process provided in an embodiment of this application. The specific process is as follows:

[0030] The first step is to obtain the reference state sequence before the current base time slice and the state sequence to be detected containing the current base time slice, and calculate the state distribution difference between the two.

[0031] The reference state sequence is taken from several consecutive base time slices preceding the current base time slice, representing the baseline state distribution during normal operation; the state sequence to be detected is taken from several consecutive base time slices including the current base time slice, representing the state distribution that may have changed. The state distribution differences are calculated using a multi-state parameter weighted fusion method.

[0032] ;

[0033] In the formula, To account for the differences in the overall state distribution, For state parameter index, For the first The weights of each state parameter, The distance metric selected for this parameter. and The first The empirical distribution of each state parameter in the reference state sequence and the state sequence to be detected. Parameters that are more sensitive to the current detection target should be given higher weights. For example, message queue backlog and response latency change rate are more sensitive to system overload changes, and the number of terminal identifier and channel identifier changes is more sensitive to abnormal access changes. Each weight... Calibration can be performed offline using historical data or pre-configured based on the detection target. For continuous parameters, the Wasserstein distance can be used, and for discrete parameters, the Jensen-Shannon divergence can be used, thus enabling parameters with different statistical properties to be reasonably expressed within a unified framework.

[0034] The second step is to determine the time position corresponding to the current base time slice as a candidate change point when the state distribution difference reaches the preset change point condition.

[0035] The basic form of the preset change point condition is: , The lower the threshold, the easier it is to trigger noise and the more candidate noise points there are; the higher the threshold, the more likely it is to miss early, slow changes. To suppress short-term noise caused by natural fluctuations in trading volume, a constraint on the number of consecutive threshold exceedances can be added, i.e., requiring... Continuously exceeding within N consecutive base time slices Candidate change points were only identified afterward; alternatively, An adaptive threshold method can also be used. ,in The sensitivity coefficient is greater than zero. The larger the value, the stricter the triggering, in order to adapt to scenarios where the platform's transaction volume changes cyclically with business hours.

[0036] The third step is to generate change point data for candidate change points. The change point data includes the time location of the candidate change point, the confidence level of the change point, the rate of state change, the direction of state change, the identifier of the state parameter that has changed significantly, and the location error range of the candidate change point. Among them, the confidence level of the change point is used to indicate the degree of credibility of the starting point of the data state change.

[0037] The time position of the candidate change point is directly taken from Exceed The event time. The confidence level at the point of change is expressed as:

[0038] ;

[0039] In the formula, For the recent The maximum value or the preset normalized upper bound; Normalize to the [0,1] interval. Exceeding The more data available, the more reliable the location of the starting point of change. (State change rate) The vector of mean differences between the sequence to be detected and the reference sequence at each state parameter. Divide by the time span of the reference sequence A larger amplitude indicates a more rapid change, such as in scenarios with a sudden increase in concurrency. The response latency is significantly greater than in scenarios with gradual changes. The direction of state change is... The sign vector for each component, with each component taking the values ​​+1, -1, or 0, corresponding to an increase, a decrease, and no significant change, respectively. State parameters exhibiting significant changes are identified as follows: The set of parameter indices whose absolute values ​​exceed the preset significant change thresholds for each state parameter. These preset significant change thresholds are calibrated offline using historical data for each state parameter and are used to locate the key state dimensions driving the current change in subsequent alerts. The candidate change point location error range is expressed as:

[0040] ;

[0041] In the formula, The preset base time slice length; the higher the confidence level, the... The smaller the value, the more precise the time and location of the change; the lower the confidence level, the more accurate the result. The larger the value, the more historical data needs to be read to cover the uncertain range of the starting point of the change, thus affecting the error range of candidate change point localization. Determined by the detection hysteresis characteristics, from the candidate change point Expanding in the direction of time prior to the change, i.e., the actual point of change falls within the interval. Inside, The higher the value, the narrower the range, and the more accurate the positioning. The aforementioned change point data will pass the statistical attributes of change detection to the subsequent window construction step, forming a quantitative linkage between the detection results and the window shape.

[0042] Step 3: Based on the change point data, extract the reading length from the preset window scale set to construct a multi-scale candidate window. When there are unfinished historical abnormal events in the online event status storage area, combine the historical abnormal events to pre-screen and scale match the multi-scale candidate windows. Otherwise, directly perform scale matching on the multi-scale candidate windows to determine the initial target window, and read the data corresponding to the initial target window from the circular data buffer to convert it into a time series feature matrix.

[0043] In the aforementioned platform scenarios, short-term surges in concurrency typically occur within seconds to tens of seconds, while gradual changes in channel response latency can last from minutes to tens of minutes. Fixed windows cannot simultaneously adapt to both scenarios. This step addresses this by constructing an asymmetric multi-scale window driven by change point data. This allows the coverage area of ​​each candidate window to be directly determined by the changing statistical attributes, and transforms the window selection result into actual read range control for the circular data buffer.

[0044] like Figure 3 The diagram shown is a schematic of the asymmetric multi-scale candidate window construction provided in an embodiment of this application. The specific process is as follows:

[0045] The first step is to select at least two candidate window scales from the preset window scale set based on the confidence level of the change point, the rate of state change, and the positioning error range of the candidate change point.

[0046] The preset window scale set includes at least three scale levels: short, medium, and long. When the first velocity threshold is reached, short-scale changes are included in the candidates to ensure that short-term sudden changes are not masked by the smoothing effect of a longer window; when When the scale is large, mesoscale or longscale scales are included in the candidates to find the true starting point of change over a wider time frame; when When the value is high, the number of candidate scales can be appropriately reduced to decrease the subsequent computational load. At lower values, more candidate scales are retained to improve coverage.

[0047] The second step is to determine the forward read length before the candidate change point based on the candidate change point positioning error range.

[0048] ;

[0049] In the formula, Forward read length, The minimum historical length required to cover the baseline state before the change at the current candidate window scale is configured by each scale in the preset window scale set. Approaching 1 Approaching zero Degenerate into This reduces the amount of historical data that needs to be read. At lower The scope has been significantly expanded to compensate for positioning uncertainties with more historical benchmark data. Ultimately, it is converted into the starting address for reading from the circular data buffer.

[0050] The third step is to determine the backward read length after the candidate change point based on the speed and direction of the state change.

[0051] ;

[0052] In the formula, For backward read length, This is the minimum subsequent length required to cover the changed state at the current candidate window scale, configured according to each scale in the preset window scale set. The amplitude of the state change rate is the normalized value of the maximum amplitude of the state change rate within the recent historical window. To control the configurable coefficient of the backward propagation magnitude, and to take a positive value, To prevent smooth positive small quantities with a denominator of zero, in scenarios with a sudden increase in concurrency. Larger near In scenarios where response latency increases slowly Smaller Significantly increase the size to cover the complete gradual transition process. When the direction of state change remains consistent across multiple consecutive base time slices, it can be... Further expand to the range of medium or long candidate windows. The end address of the read operation is converted into a circular data buffer.

[0053] The fourth step involves reading the corresponding transaction messages from the circular data buffer according to the forward and backward read lengths, and constructing an asymmetric multi-scale candidate window based on the candidate change points.

[0054] For each selected candidate window scale, the candidate change point time location is used. Based on this, the starting address for reading is... The end address is This results in multiple candidate windows with varying lengths. This asymmetric design abandons the symmetric assumption that the point of change always lies at the center of the window, allowing the limited amount of data to be preferentially allocated to the time side of the change process.

[0055] The fifth step is to query the online event status storage area. If there are unresolved historical abnormal events, obtain the cumulative duration and the most recently used window scale of the historical abnormal event, and perform priority pre-screening on the multi-scale candidate windows. If there are no unresolved historical abnormal events, retain all scales of the multi-scale candidate windows for subsequent scale matching.

[0056] Specifically, the online event state storage area stores the start time, cumulative duration, most recently used window scale, event feature center vector, anomaly score change sequence, and current change direction of unresolved historical anomaly events. When the cumulative duration of a historical anomaly event exceeds the length of the short candidate window, the priority of the short candidate window is reduced; when the anomaly score of a historical anomaly event continues to increase, the priority of the long candidate window is increased; when a historical anomaly event has entered the recovery phase, the short candidate window is retained to identify the recovery location; when the current change direction is inconsistent with the historical anomaly event, all candidate window scales are retained. When there are no unresolved historical anomaly events, all scales are retained, covering situations such as system cold starts and the first change of the data source.

[0057] The sixth step is to calculate and extract feature values ​​from the multi-scale candidate windows after priority pre-screening. The feature values ​​include the concentration of abnormal features, the continuity of the front boundary, the continuity of the back boundary, the state recovery degree, and the data integrity.

[0058] Specifically, the aforementioned feature values ​​are all window-level statistics that do not rely on full model inference. Their computational cost is lower than that of subsequent model inference, and they are used to quickly evaluate the data quality and change coverage characteristics of each candidate window before entering the model.

[0059] Concentration of abnormal features Used to reflect the compactness of the window. Expressed as:

[0060] ;

[0061] In the formula The difference in state distribution for the t-th base time slice within the window. To preset a threshold for significant changes, its value is consistent with the threshold used to identify state parameters that have undergone significant changes. For indicator functions, Take 1 if the time is high, otherwise take 0; the more concentrated the time slices with high changes, The higher.

[0062] Front boundary continuity With the continuity of the back boundary The state distribution differences relative to the baseline difference level are respectively based on the window start or end positions immediately adjacent to the base time slice. The normalized excess quantity represents the baseline difference level. This serves as the difference benchmark corresponding to the reference state sequence during the candidate change point detection stage. or A value significantly greater than zero indicates that changes are still ongoing outside the boundary. The state recoverability is expressed as:

[0063] ;

[0064] In the formula, This is the mean vector of the state parameters at the back of the window. As the baseline mean vector, The state vector at the moment when the deviation from the baseline is maximum within the window; A value close to 1 indicates that the entire baseline-change-recovery process has been covered. Data completeness This represents the proportion of valid base time slices within the window to the total number of time slices. Missing, invalid, or out-of-order unreliable time slices are all counted as defects. If the data integrity level is below the preset threshold, the candidate window is directly excluded.

[0065] The seventh step is to weight the feature values ​​with the confidence scores of the candidate change points to obtain the candidate window matching values.

[0066] ;

[0067] In the formula, For the candidate window matching value, each For the corresponding weight coefficients, each weight is non-negative and sums to 1; the boundary continuity participates in the form of (1−B), and the matching value is reduced when the boundary still has continuous changes, thereby automatically suppressing candidate windows with incomplete coverage; alternatively, each weight coefficient can be selected online for hit rate learning based on historical windows.

[0068] Step 8: Select the window whose matching value meets the preset selection conditions and can cover the baseline segment before change, the changed segment, and the state segment after change from the pre-screened candidate window as the initial target window.

[0069] The basic form of preset selection conditions is: When multiple candidate windows meet the conditions, the one that is selected first is chosen. The largest one, When the values ​​are similar, priority is given to candidate windows that can satisfy the three-segment coverage and have a lower expected computational cost. The start and end times of the initial target window are used to control the start and end addresses of reading from the circular data buffer. The read transaction messages are converted into a time-series feature matrix. One dimension of the time-series feature matrix corresponds to the event time position, and the other dimension corresponds to the state parameters, which are directly used as the input for the model inference in the next step.

[0070] Step 4: Input the temporal feature matrix into the pre-trained convolutional attention model, and output the attention boundary distribution and initial model output parameters. The initial model output parameters include the initial anomaly score and model uncertainty.

[0071] In the payment clearing platform scenario, the temporal feature matrix uses the transaction messages covered by the initial target window as the data source. One dimension corresponds to the event time position, and the other dimension corresponds to each state parameter, completely recording the state evolution process from the baseline segment before the change to the current detection segment. Convolutional layers use convolutional kernels with different receptive fields to extract local change features between adjacent time positions. Short windows correspond to smaller receptive fields to retain sharp features of short-term abrupt changes such as sudden increases in concurrency, while long windows correspond to larger receptive fields or dilated convolutions to capture continuous trends spanning multiple base time slices, such as gradual changes in response latency. The attention calculation layer outputs attention weights for each time position based on this. The attention boundary distribution is the distribution of these weights along the window time axis, reflecting the time positions that the model focuses on when making judgments, and is the core driving signal for subsequent window closed-loop correction. The initial anomaly score characterizes the degree to which the current window deviates from the normal state, and the model uncertainty... The confidence level of the representation model in this judgment is estimated by the average distribution of the probability distributions obtained from multiple random forward inferences in the form of prediction entropy:

[0072] ;

[0073] In the formula, After multiple random forward inferences, the first The average predicted probability of each state category Retrieves all preset state categories; When concentrated in a certain category When the size is small, the judgment is reliable, and the distribution is across multiple categories Large and unreliable. When the window scale and the change pattern are mismatched, the model often exhibits high uncertainty. The quantization output allows this internal signal to be directly used in subsequent steps.

[0074] Step 5: Determine whether to trigger closed-loop correction based on model uncertainty. When triggered, perform closed-loop correction on the initial target window based on the attention boundary distribution to obtain the corrected target window. Then, perform at least one inference on its corresponding temporal feature matrix to obtain the correction anomaly score. When the correction anomaly score reaches the preset anomaly candidate threshold, generate an anomaly window record containing the window feature vector.

[0075] It should be added that the model uncertainty used as the trigger criterion here is the initial model uncertainty of the first inference output, while the holding branch and the loop closure termination conditions are based on the corrected model uncertainty updated after each round of corrected inference. The two are used to determine whether to enter the loop closure and whether to exit the loop closure, respectively.

[0076] In this embodiment, a closed-loop feedback mechanism between the window and the model is constructed by transforming the attention boundary distribution and uncertainty output within the model into actual control instructions for the reading range of the circular data buffer. Higher than When this occurs, it indicates that the current judgment is unreliable, possibly due to a mismatch between the window scale and the actual change pattern, triggering closed-loop correction; when Not higher than If the judgment is sufficiently reliable, no correction is triggered. The initial target window is directly used as the corrected target window to ensure that subsequent inference under the branch is still clear in terms of the object to be processed.

[0077] The first step is to calculate the sum of attention weights in the front, middle, and back boundary regions of the initial target window, and obtain the front boundary attention ratio, middle boundary attention ratio, and back boundary attention ratio, respectively.

[0078] The initial target window's base time slices are divided into three regions in chronological order: the front boundary, the middle boundary, and the back boundary. The attention weights within each region are summed and then normalized.

[0079] ;

[0080] In the formula, For the first Attention weights at each time location, The total number of window time positions, the sum of the three is 1. This represents the set of time location indices contained within the front boundary region, that is, the set of indices for a time slice at the beginning of the window. This represents the set of time location indices contained in the central region, that is, the set of indices for a time slice in the middle of the window. This represents the set of time location indices contained within the back boundary region, i.e., the set of indices for the time slice at the end of the window. The three-segment division ratio can be pre-configured, or it can be divided non-proportionally based on the relative position of candidate change points within the window, ensuring that the time slice of the candidate change point always falls within the middle region. In scenarios with gradually changing channel response latency, if the change has not yet ended, A high value usually indicates that the key information relied upon by the model for its decisions is located at the end of the window; in cases of a sudden increase in concurrency but the use of an excessively long window, The value is usually already high, and there is redundant stable data at both ends. Attention ratio is the core intermediate quantity that transforms the internal calculation results of the model into data reading control signals.

[0081] The second step is to control the circular data buffer to continue reading data from the end position of the current target window and splicing it together when the proportion of attention at the back boundary reaches the first preset boundary threshold and the continuity of the back boundary reaches the preset continuity threshold, so as to form an extended target window that extends backward.

[0082] This branch identifies situations where "the change has not ended and the back end of the window has been truncated," which is most common in scenarios where response latency continues to rise or cross-terminal diffusion is still in progress. Reaching the first preset boundary threshold With the continuity of the back boundary Reaching a preset continuity threshold constitutes dual verification, with both mutually reinforcing each other to suppress erroneous expansion caused by fluctuations in a single indicator. When the condition is met, the end address of the read is updated, and transaction messages within a preset expansion step after the end position are concatenated to the current window. The preset expansion step can be set to several basic time slice lengths or a fixed number of messages, and the amount of expansion in a single instance is determined by this step to control the data increment in each closed-loop iteration. The backward expansion of the window is subject to hard upper limits on the maximum window length, the maximum number of expansions, and the maximum allowed inference waiting time to prevent the data volume of a single inference from growing unbounded.

[0083] The third step is to control the circular data buffer to read historical data from before the starting position of the current target window when the current boundary attention ratio reaches the second preset boundary threshold and the candidate change point positioning error range exceeds the preset positioning error threshold, so as to form an extended target window that expands forward.

[0084] This branch addresses the scenario where "the root cause of the change predates the current window start point and there is insufficient baseline data." It is often triggered in scenarios where the starting point of change is not accurately located due to low values. Reaching the second preset boundary threshold This indicates that the key information relied upon by the model for its decision is located in the initial region of the window. Exceeding the preset positioning error threshold serves as prior verification from the change point data. The combined triggering of these two factors ensures that the forward expansion has sufficient basis. Upon triggering, the read start address is updated and historical transaction messages within a preset expansion step are added forward. If the required historical data has already been overwritten by the circular data buffer, the earliest readable time position is used as the forward read boundary, and it is recorded in the window data integrity field.

[0085] The fourth step is to delete redundant data that exceeds the stable length before and after the window when the central attention ratio reaches the preset concentration threshold and the state of the front and back of the window is stable, thus forming a shrinking target window.

[0086] when Reaching the preset concentration threshold Furthermore, the difference in the state distribution at the front of the window is lower than the baseline difference level. , the back of the window When the preset recovery threshold is reached, the two ends of the window are confirmed to be truly stable data. The middle change segment with the candidate change point as a reference, as well as the minimum stable length before and after the change, are retained. The minimum stable length is determined by the minimum stable coverage configuration before and after the current scale in the preset window scale set. Redundant data exceeding the minimum stable length before and after the window is deleted, and the start and end addresses of the read are updated. This branch is more common when using medium and long candidate windows to cover short-term sudden changes. Shrinking can reduce the dimension of the temporal feature matrix, reduce the computational cost of a single inference, and make the receptive field of the convolutional kernel more concentrated on the time interval where the change actually occurs.

[0087] Fifth step: When the central attention ratio reaches the preset concentration threshold, the uncertainty of the corrected model is lower than the preset uncertainty threshold, and the state recovery reaches the preset recovery threshold, keep the initial target window unchanged and use the initial target window as the corrected target window.

[0088] This branch is the internal termination path for closed-loop correction: achieve This indicates that there is no leakage at the window boundaries, and the uncertainty of the model after this round of correction is lower than [previous value]. This indicates that the judgment has become credible. Reaching the preset recovery threshold indicates that the change lifecycle has been fully covered. When all three conditions are met, there is no need to adjust the window; the initial target window is directly output as the corrected target window. This branch, together with the early termination path based on H that skips all closed-loop corrections, constitutes a two-level computational protection mechanism, avoiding meaningless iterations in scenarios where the initial window selection is already sufficiently appropriate.

[0089] The sixth step is to convert the expanded or shrunken target window back into a temporal feature matrix and input it into the convolutional attention model again to update the anomaly correction score, the model uncertainty correction score, and the attention correction score.

[0090] Specifically, the window data is reread based on the updated read address, and the temporal feature matrix is ​​reconstructed according to the consistency rules, with only the data range changing. When the window length changes due to expansion or contraction, it may trigger a model branch switch, causing the receptive field to rematch with the adjusted window scale. The updated corrected attention weights are fed back to the three-region proportion statistics logic for recalculation. , , This supports the selection of the next correction branch or the determination of the end of the closed loop.

[0091] Step 7: Repeat the closed-loop correction and inference until the preset closed-loop termination condition is met. The preset closed-loop termination condition includes at least one of the following: the attention weight is concentrated in the middle of the target window, the state at the back of the target window returns to stability, the uncertainty of the correction model is lower than the preset uncertainty threshold, the maximum window length is reached, the maximum number of closed-loop iterations is reached, or the maximum allowed inference waiting time is reached.

[0092] In this embodiment, the preset closed-loop termination conditions are divided into two categories: convergence and constraint. Convergence conditions are triggered naturally when the window converges to a suitable scale, and iteration can be safely stopped if any one of them is met. Constraint conditions force termination before the window has naturally converged to protect system resources. In real-time transaction monitoring scenarios, the maximum allowable inference waiting time is particularly critical, ensuring that the processing latency of a single candidate change point is controllable and that the real-time processing of subsequent messages is not blocked by the repeated expansion of individual windows. When the iteration terminates due to constraint conditions and If the score remains above the threshold, the current target window is marked as a persistently anomalous window and transferred to subsequent cross-window event association processing. The event-level association mechanism continues to track this continuous change process. After any termination condition is met, final inference is performed on the current corrected target window. When the corrected anomaly score reaches the preset anomaly candidate threshold, an anomaly window record containing the window feature vector is generated. The window feature vector is aggregated and output by the model for similarity comparison during subsequent cross-window event association.

[0093] Step 6: Based on the preset association parameters, associate the abnormal window records with historical abnormal events across windows, update the abnormal event status to generate phased early warning instructions.

[0094] This step aggregates the independent anomaly windows generated in the previous steps at the event level, preventing the same continuous anomaly process from being broken into a large number of isolated alarms. Based on this, it generates phased warning instructions and differentiated cache management instructions, completing a full closed loop from data processing to resource management. In actual platform operation, a cross-channel system stress event may last for several minutes, generating dozens of adjacent anomaly windows. If these are not correlated, they will generate a large number of duplicate alarms and consume too much of the monitoring personnel's time. This step is designed to address this problem.

[0095] The first step is to obtain preset association parameters when there are unfinished historical abnormal events in the online event state storage area. These preset association parameters include the time interval between the current abnormal window and the most recent window of the historical abnormal event, the similarity between the feature vector of the current window and the feature center vector of the historical event, the consistency of the direction of change, the overlap of the identifier data, and the continuity of the boundary state. When there are no unfinished historical abnormal events in the online event state storage area, a new abnormal event identifier is directly generated for the current abnormal window.

[0096] The time interval is the difference between the start time of the current anomaly window and the end time of the most recently associated window of a historical anomaly event, reflecting temporal proximity. Cosine similarity is used to measure the directional consistency between the feature vector of the current window and the feature center vector of historical events.

[0097] ;

[0098] In the formula, This is the window feature vector of the current abnormal window. The feature center vector of historical events; A value close to 1 indicates that the two events are highly similar in the feature space and are likely to originate from the same abnormal process. The consistency of the direction of change is determined by the degree of sign consistency of the state change direction vector on the dominant state parameter. The dominant state parameter is the parameter indicated by the state parameter identifier that has undergone a significant change. When the proportion of the current abnormal window and historical abnormal events having the same sign of change direction on the aforementioned dominant state parameter reaches a preset direction consistency threshold, they are considered to be in directional consistency. The overlap of identifier data is the proportion of overlap between the set of tokenized transaction source identifiers, terminal identifiers, and channel identifiers. A higher overlap indicates that the two events are more likely to involve the same set of access entities. Boundary state continuity indicates whether the front boundary state of the current abnormal window connects with the back boundary state of the most recent window of a historical abnormal event. This is determined by comparing the continuity of the front boundary of the current abnormal window with the attention distribution of the most recent boundary saved in historical abnormal events. When the state change trend outside the front boundary of the current abnormal window connects with the state change trend outside the back boundary of a historical abnormal event, the boundary state is considered continuous. When there are no unfinished historical abnormal events, it indicates that the system is in a cold start state or that the data source is experiencing an anomaly for the first time. No association determination is needed; a new abnormal event state is directly established to eliminate gaps in the process logic.

[0099] The second step is to merge the current abnormal window into the corresponding historical abnormal event when the preset association parameters meet the preset event association conditions, and update the cumulative duration, number of associated windows, event feature center vector and nearest boundary attention distribution of the abnormal event; when the preset association parameters do not meet the preset event association conditions, generate a new abnormal event identifier for the current abnormal window and establish a new abnormal event state.

[0100] The preset event association conditions require at least two of the aforementioned association parameters to simultaneously reach their respective thresholds. This multi-dimensional joint judgment significantly reduces the risk of erroneous associations caused by accidental fulfillment of a single dimension. When a judgment is valid, the current abnormal window is merged, and the event feature center vector is updated using a moving average.

[0101] ;

[0102] In the formula, To update the step size coefficient and ; The larger the value, the more the center vector is biased towards the latest window. The smaller the value, the more stable and noise-resistant the event. Simultaneously, the nearest boundary attention distribution is updated to the current window's boundary attention distribution for pre-filtering of subsequent windows. No new independent event identifiers are generated after successful association. When the association parameters do not meet the conditions, a new abnormal event state is established using the current abnormal window as the initial window. The initial content includes the event start time, the initial event feature center vector, the number of associated windows initialized to one, the current direction of change, and the set of involved identifiers, and is written to the online event state storage area.

[0103] The third step is to directly reuse the intermediate convolutional features saved in the historical abnormal events for inference if the difference between the current window feature vector and the feature center vector of the historical events is lower than the preset separation threshold and the system load reaches the preset load threshold. If the difference between the current window feature vector and the historical event features exceeds the preset separation threshold, the reuse of the intermediate convolutional features is stopped and the complete model inference is re-executed for subsequent data.

[0104] The characteristic differences are expressed as follows:

[0105] ;

[0106] In the formula, To prevent smoothing terms with a denominator of zero, intermediate features of the convolution are the intermediate activation values ​​of the model's convolutional layer output before entering the attention calculation; when Below Furthermore, when the system load reaches a preset load threshold, the local temporal patterns of the current window and historical events are highly consistent, and the convolution operation results tend to be the same. This allows intermediate features from historical convolutions to be directly passed to the attention calculation module, skipping repeated calculations in the convolutional layers, significantly alleviating inference queue backlog during peak platform business periods. Exceed If the abnormal pattern has significantly deviated, continued reuse will lead to distorted judgment. Reuse should be stopped immediately, and the window feature vector output from this complete inference should be used for recalibration. , restore the baseline for monitoring feature differences.

[0107] The fourth step involves dividing abnormal events into candidate alert stage, pending confirmation stage, continuous confirmation stage, warning escalation stage, and recovery stage based on changes in abnormal event scores, cumulative duration, and model uncertainty. Then, a phased warning instruction carrying the event start and end times and the corresponding warning stage code is generated and sent to the warning terminal for status merging and display.

[0108] In the candidate alert stage, the anomaly score of a single anomaly window reaches the preset anomaly candidate threshold for the first time. At this stage, H may still be relatively high, serving only as an initial alert. In the pending confirmation stage, the anomaly score has reached the threshold, but H is still higher than [the threshold value]. or The level remains high, and the change process is not yet fully observable; in the continuous confirmation phase, multiple abnormal windows have been merged into the same abnormal event, and the cumulative number of associated windows or the cumulative duration has reached the preset continuous confirmation threshold. The preset continuous confirmation threshold includes one or a combination of the lower limit of the number of associated windows and the lower limit of the cumulative duration, thereby improving the reliability of the warning; the judgment condition for the warning escalation phase is that any of the following conditions are met:

[0109] For continuous A related window is established or or For continuous A linked window is established;

[0110] In the formula, The anomaly score for the nth associated window is the corrected score. The cumulative duration of the event. To upgrade the time threshold, The magnitude of the state change rate corresponding to the nth associated window. The number of consecutive conditions required to trigger an upgrade; three sub-conditions cover three types of upgrade scenarios: continuous deterioration of score, exceeding the duration limit, and continuous increase in the rate of change, taking into account both rapidly erupting and slowly accumulating severe anomalies. During the recovery phase, the state parameters of multiple consecutive base time slices have recovered to the baseline range and the corrected anomaly score is lower than the preset recovery threshold, allowing for direct upgrade. Reaching a preset recovery threshold is used as the entry criterion. Phased warning commands carry the event start and end times and warning phase codes. Warning terminals merge and display statuses based on the same abnormal event identifier. Multiple commands with the same event identifier update the display status of the same abnormal event instead of generating multiple independent alarm entries. Warning commands do not directly output business decision results such as abnormal transaction nature determination, specific fund activity nature determination, account restriction processing, or transaction interception processing; instead, the output boundaries are limited to the data status description of the transaction message stream, abnormal event identifiers, and warning phase identifiers.

[0111] Fifth, when the event is in an unfinished state, extend the retention time of the corresponding original transaction message in the circular data buffer; when the event enters the recovery phase, release the duplicate original data that has completed feature extraction, and retain only the transaction messages before and after the recovery time point in the circular data buffer; when the event state ends, generate an event summary and transfer the corresponding high-frequency original data to the compressed storage area.

[0112] Specifically, when an abnormal event is in the candidate prompt, pending confirmation, continuous confirmation, or warning escalation stage, the original transaction messages within the corresponding time range of the event are marked for extended retention, so that they are not affected by the normal coverage strategy of the circular data buffer. The extended retention range covers at least one maximum analysis cycle prior to the event start time to support subsequent forward expansion reading needs. When the event enters the recovery stage, the semantic information of the original transaction messages within the historical time interval that were repeatedly read and fully processed by multiple associated windows during the event duration has been encoded into the event feature center vector and historical window records, and can be released to reclaim buffer space; the recovery time point corresponds to The initial time slice that reaches the preset recovery threshold retains the original transaction messages within a preset length range before and after that time point to support precise location and audit traceability of the event end boundary. When the event state ends, the abnormal event state is migrated from the online event state storage area to the historical event storage area, and an event summary is generated before migration. The event summary includes at least the event identifier, event start and end time, cumulative number of associated windows, cumulative duration, start and end timestamps of each warning stage, initial and final values ​​of the event feature center vector, maximum corrected abnormal score and corresponding time position, set of involved tagged transaction source identifiers, set of terminal identifiers and set of channel identifiers, and model version identifier. The extended retention of high-frequency original transaction messages is transferred to the compressed storage area for compression and archiving after the event ends, while the space occupied by the extended retention markers in the circular data buffer is released, restoring its normal cyclic coverage capability.

[0113] Therefore, this method forms a differentiated cache management strategy driven by the life cycle stages of abnormal events: the retention period is extended before the event ends to ensure data integrity, redundancy is released selectively to reclaim space when the event enters the recovery phase, and the archive is compressed when the event ends to balance long-term storage economy and audit traceability. This directly links storage resource allocation with the event processing stage and data value, completing the entire closed-loop process from message collection, change detection, window construction, closed-loop reasoning, event correlation to early warning output and resource management.

[0114] See Figure 4 The diagram below illustrates the structure of a time-series data anomaly warning system based on convolutional attention, as provided in this embodiment of the application, including:

[0115] The transaction information preprocessing module is used to acquire continuously generated transaction message streams, process the transaction message streams according to preset alignment rules to obtain transaction messages and write them into a circular data buffer; and perform statistics on the transaction messages in the circular data buffer according to preset base time slices to generate a transaction message state sequence to determine candidate change points and generate corresponding change point data.

[0116] The time-series feature processing module is used to extract the reading length from the preset window scale set based on the change point data to construct a multi-scale candidate window. When there are unfinished historical abnormal events in the online event status storage area, the multi-scale candidate window is pre-screened and scale matched in combination with the historical abnormal events. Otherwise, the scale matching is directly performed on the multi-scale candidate window to determine the initial target window. The data corresponding to the initial target window is read from the circular data buffer and converted into a time-series feature matrix.

[0117] The anomaly warning and judgment module is used to input the temporal feature matrix into a pre-trained convolutional attention model, output the attention boundary distribution and the initial model output parameters, which include the initial anomaly score and the model uncertainty. Based on the model uncertainty, it determines whether to trigger closed-loop correction. When triggered, closed-loop correction is performed on the initial target window based on the attention boundary distribution to obtain the corrected target window. Then, at least one inference is performed on the corresponding temporal feature matrix to obtain the corrected anomaly score. When the corrected anomaly score reaches the preset anomaly candidate threshold, an anomaly window record containing the window feature vector is generated.

[0118] The early warning result output module is used to associate abnormal window records with historical abnormal events across windows according to preset association parameters, and update the abnormal event status to generate phased early warning instructions.

[0119] Through the above description of the implementation methods, those skilled in the art can clearly understand that, for the sake of convenience and brevity, only the division of the above functional modules is used as an example. In actual applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the above functions can be divided into different functional modules to complete all or part of the functions described above.

[0120] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any changes or substitutions within the technical scope disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A method for early warning of anomalies in temporal data based on convolutional attention, characterized in that, Includes the following steps: A continuously generated transaction message stream is obtained. The transaction message stream includes multiple continuously generated transaction messages. Each transaction message includes at least an event timestamp, a message sequence number, a tokenized transaction source identifier, a terminal identifier, a channel identifier, a transaction value field, a transaction status code, and a processing response delay. The transaction message stream is processed according to a preset alignment rule to obtain transaction messages and write them into a circular data buffer. The transaction messages in the circular data buffer are statistically analyzed according to the preset basic time slice, a transaction message state sequence is generated to determine candidate change points, and corresponding change point data is generated. Based on the change point data, the reading length is extracted from the preset window scale set to construct a multi-scale candidate window. When there are unfinished historical abnormal events in the online event status storage area, the multi-scale candidate window is pre-screened and scale matched in combination with the historical abnormal events. Otherwise, the scale matching is directly performed on the multi-scale candidate window to determine the initial target window. The data corresponding to the initial target window is read from the circular data buffer and converted into a time series feature matrix. The temporal feature matrix is ​​input into a pre-trained convolutional attention model, which outputs attention boundary distribution and initial model output parameters. The attention boundary distribution is the distribution of attention weights at each time position output by the attention calculation layer of the convolutional attention model along the time axis of the initial target window. The initial model output parameters include initial anomaly scores and model uncertainty. Based on the model uncertainty, determine whether to trigger closed-loop correction. When triggered, perform closed-loop correction on the initial target window based on the attention boundary distribution to obtain the corrected target window. Then, perform at least one inference on its corresponding temporal feature matrix to obtain the correction anomaly score. When the correction anomaly score reaches the preset anomaly candidate threshold, generate an anomaly window record containing the window feature vector. The abnormal window records are associated with the historical abnormal events across windows according to the preset association parameters, and the abnormal event status is updated to generate phased early warning instructions.

2. The method for early warning of temporal data anomalies based on convolutional attention as described in claim 1, characterized in that: The generation of corresponding change point data includes: Obtain the reference state sequence before the current base time slice and the state sequence to be detected containing the current base time slice, respectively, and calculate the state distribution difference between the two; When the state distribution difference reaches the preset change point condition, the time position corresponding to the current basic time slice is determined as the candidate change point; The change point data is generated for the candidate change points. The change point data includes the time location of the candidate change point, the change point confidence level, the state change rate, the state change direction, and the candidate change point positioning error range. The change point confidence level is used to indicate the credibility of the starting point of the data state change.

3. The method for early warning of temporal data anomalies based on convolutional attention as described in claim 2, characterized in that: The step of extracting the reading length from a preset window scale set based on the change point data to construct a multi-scale candidate window includes: Based on the confidence level of the change point, the rate of state change, and the positioning error range of the candidate change point, at least two candidate window scales are selected from the preset window scale set. Based on the candidate change point positioning error range, determine the forward read length before the candidate change point; Based on the state change rate and the state change direction, determine the backward read length after the candidate change point; According to the forward read length and the backward read length, the corresponding transaction message is read from the circular data buffer, and an asymmetric multi-scale candidate window based on the candidate change point is constructed.

4. The method for early warning of temporal data anomalies based on convolutional attention as described in claim 2, characterized in that: The determination of the initial target window includes: The online event status storage area is queried. When there are unfinished historical abnormal events, the cumulative duration and the scale of the most recently used window of the historical abnormal event are obtained. Priority pre-screening is performed on the multi-scale candidate windows. When there are no unfinished historical abnormal events, all scales of the multi-scale candidate windows are retained for subsequent scale matching. The multi-scale candidate windows after priority pre-screening are calculated to extract feature values, which include anomaly feature concentration, front boundary continuity, back boundary continuity, state recovery degree, and data integrity. The feature value is weighted by the confidence level of the candidate change point to obtain the candidate window matching value; From the pre-screened candidate windows, select the window whose matching value meets the preset selection conditions and can cover the baseline segment before change, the changed segment, and the state segment after change as the initial target window.

5. The method for early warning of temporal data anomalies based on convolutional attention as described in claim 4, characterized in that: The step of performing closed-loop correction on the initial target window based on the attention boundary distribution includes: The sum of attention weights in the front boundary region, middle region, and back boundary region of the initial target window is calculated to obtain the front boundary attention ratio, middle region attention ratio, and back boundary attention ratio, respectively. When the proportion of attention at the back boundary reaches the first preset boundary threshold and the continuity of the back boundary reaches the preset continuity threshold, the circular data buffer is controlled to continue reading data from the end position of the current target window and splicing it to form an extended target window that extends backward. When the proportion of the front boundary attention reaches the second preset boundary threshold and the candidate change point positioning error range exceeds the preset positioning error threshold, the ring data buffer is controlled to read historical data from before the current target window start position to form an extended target window that expands forward. When the attention ratio in the middle reaches a preset concentration threshold and the state of the front and back of the window is stable, redundant data exceeding the stable length before and after the window is deleted to form a shrinking target window. When the central attention percentage reaches a preset concentration threshold, the corrected model uncertainty is lower than a preset uncertainty threshold, and the state recovery reaches a preset recovery threshold, the initial target window remains unchanged and is used as the corrected target window.

6. The method for early warning of temporal data anomalies based on convolutional attention as described in claim 5, characterized in that: The corrected target window is then subjected to at least one inference operation on its corresponding temporal feature matrix to obtain the corrected anomaly score, including: The target window that has expanded or shrunk is converted back into a temporal feature matrix and then input into the convolutional attention model to update the anomaly correction score, the model uncertainty correction, and the attention correction weights. Repeat the closed-loop correction and the inference until the preset closed-loop termination condition is met. The preset closed-loop termination condition includes at least one of the following: the attention weight is concentrated in the middle of the target window, the state of the back of the target window returns to stability, the uncertainty of the correction model is lower than the preset uncertainty threshold, the maximum window length is reached, the maximum number of closed-loop iterations is reached, or the maximum allowed inference waiting time is reached.

7. The method for early warning of temporal data anomalies based on convolutional attention as described in claim 1, characterized in that: The step of associating the abnormal window record with the historical abnormal event across windows according to preset association parameters and updating the abnormal event status includes: When there are unfinished historical abnormal events in the online event status storage area, the preset association parameters are obtained. The preset association parameters include the time interval between the current abnormal window and the nearest window of the historical abnormal event, the similarity between the feature vector of the current window and the feature center vector of the historical event, the consistency of the change direction, the overlap of the identification data, and the continuity of the boundary state. When the preset association parameters meet the preset event association conditions, the current abnormal window is merged into the corresponding historical abnormal event, and the cumulative duration, number of associated windows, event feature center vector and nearest boundary attention distribution of the abnormal event are updated. When the preset association parameters do not meet the preset event association conditions, a new abnormal event identifier is generated for the current abnormal window, and a new abnormal event state is established. When there are no unresolved historical exception events in the online event status storage area, a new exception event identifier is directly generated for the current exception window.

8. The method for early warning of temporal data anomalies based on convolutional attention as described in claim 7, characterized in that: The method also includes controlling the model processing path of subsequent time-series feature matrices based on the updated abnormal event state: If the difference between the current window feature vector and the historical event feature center vector is less than a preset separation threshold, and the system load reaches a preset load threshold, then the convolutional intermediate features saved in the historical abnormal events are directly reused for inference. If the difference between the current window feature vector and the historical event features exceeds a preset separation threshold, then the reuse of the intermediate convolution features is stopped, and the complete model inference is re-executed for subsequent data.

9. The method for early warning of temporal data anomalies based on convolutional attention as described in claim 1, characterized in that: The step of updating the abnormal event status to generate phased early warning instructions includes: Based on the changes in abnormal event scores, cumulative duration, and model uncertainty, abnormal events are divided into candidate alert stage, pending confirmation stage, continuous confirmation stage, early warning escalation stage, and recovery stage. The staged early warning instructions carrying the event start and end times and the corresponding early warning stage codes are generated and sent to the early warning terminal for status merging and display. When an event is in an unfinished state, the retention time of the corresponding original transaction message is extended in the circular data buffer; When the event enters the recovery phase, the duplicate raw data that has completed feature extraction is released, and only transaction messages before and after the recovery time point are retained in the circular data buffer. When the event state ends, an event summary is generated and the corresponding high-frequency raw data is transferred to the compressed storage area.

10. A temporal data anomaly early warning system based on convolutional attention, characterized in that, include: A transaction information preprocessing module is used to acquire a continuously generated transaction message stream, which includes multiple continuously generated transaction messages. Each transaction message includes at least an event timestamp, a message sequence number, a tokenized transaction source identifier, a terminal identifier, a channel identifier, a transaction value field, a transaction status code, and a processing response latency. The transaction message stream is processed according to a preset alignment rule to obtain transaction messages, which are then written into a circular data buffer. The transaction messages in the circular data buffer are statistically analyzed according to a preset base time slice to generate a transaction message status sequence to determine candidate change points, and corresponding change point data is generated. The time-series feature processing module is used to extract the reading length from the preset window scale set based on the change point data to construct a multi-scale candidate window. When there are unfinished historical abnormal events in the online event status storage area, the multi-scale candidate window is pre-screened and scale matched in combination with the historical abnormal events. Otherwise, the scale matching is directly performed on the multi-scale candidate window to determine the initial target window, and the data corresponding to the initial target window is read from the circular data buffer and converted into a time-series feature matrix. An anomaly warning and determination module is used to input the temporal feature matrix into a pre-trained convolutional attention model, output attention boundary distribution and initial model output parameters. The attention boundary distribution is the distribution of attention weights at each time position output by the attention calculation layer of the convolutional attention model along the time axis of the initial target window. The initial model output parameters include an initial anomaly score and model uncertainty. Based on the model uncertainty, it determines whether to trigger closed-loop correction. When triggered, closed-loop correction is performed on the initial target window based on the attention boundary distribution to obtain the corrected target window. Then, at least one inference is performed on the corresponding temporal feature matrix to obtain the corrected anomaly score. When the corrected anomaly score reaches a preset anomaly candidate threshold, an anomaly window record containing window feature vectors is generated. The early warning result output module is used to associate the abnormal window record with the historical abnormal event across windows according to the preset association parameters, and update the abnormal event status to generate a phased early warning instruction.

Images