Multi-dimensional feature cleaning and desensitization method and system for massive heterogeneous time-series data

Abstract

The application relates to the technical field of data processing, and discloses a multi-dimensional feature cleaning and desensitization method and system for massive heterogeneous time sequence data, which comprises the following steps: performing data source type determination on a business data set to obtain a structured baseline key-value pair and a dynamic log paragraph set; performing multi-granularity named entity recognition, cross-document entity alignment and irreversible hash transformation to generate an implicit co-reference mapping table, and performing in-situ entity replacement to generate a desensitized heterogeneous corpus; constructing a static feature baseline tree and a key intervention event sequence for the desensitized heterogeneous corpus respectively; positioning a candidate anchor node in the baseline tree based on the sequence, constructing an anchor candidate score matrix and performing weight distribution; and finally generating a time sequence self-consistent fusion feature set and outputting a structured report document according to the distribution result; while eliminating privacy entities, the application maintains the self-consistency of cross-document context reference relationships and long time sequence topology logic.

Description

Technical Field

[0001] This invention relates to the field of data processing technology, and more specifically, to a method and system for cleaning and desensitizing multidimensional features of massive heterogeneous time-series data. Background Technology

[0002] In the processing and analysis of massive heterogeneous time-series data, the data source often contains both structured static records and unstructured dynamic logs. To meet the requirements of privacy protection and data compliance, strict de-identification processing must be performed before feature cleaning and aggregation of this multi-source heterogeneous data to prevent the leakage of sensitive information.

[0003] Document CN120893070A discloses a method and system for de-identifying sensitive information in network security to address data leakage. This method extracts multi-dimensional contextual features and uses a pre-trained model to locate sensitive information, generating a de-identification scheme that includes replacement rules and masking strategies. This scheme can identify sensitive information while preserving the semantic integrity of the data, improving network security protection levels. Document CN121302410A discloses a method, device, medium, and product for de-identifying log information. This method clusters log samples to generate a general log pattern and extracts specific entity sub-patterns based on highly variable sensitive entities to achieve online real-time de-identification. This scheme improves the accuracy and efficiency of log de-identification processing, realizing the identification and protection of sensitive information.

[0004] However, in real-world business scenarios where structured archives (such as static forms) from the early stages of a system are merged and cleaned with unstructured guidance records (such as dynamic logs) spanning several months to generate a standard case closure report, the generation engine often fails to distinguish which specific object was targeted by the intervention actions recorded at different time points when tracing historical features after the system uses conventional anonymization methods to replace all privacy entities such as names, place names, and specific organization names with uniform masks. This homogenized anonymization process severs the entity correspondence between dynamic intervention text and static baseline forms, resulting in misalignment of object attribution and confusion of timelines in the final structured report. This logical inconsistency in the report leads to business personnel being unable to accurately trace the causal relationship of historical intervention events. In scenarios requiring strict verification of historical trajectories, such as medical and health tracking or long-term equipment maintenance, this break in temporal logic can cause the system to output incorrect follow-up decision-making criteria, leading staff to perform incorrect intervention operations and consequently resulting in unpredictable business risks or security vulnerabilities. Summary of the Invention

[0005] The lack of logical coherence in heterogeneous long texts after anonymization stems from the incompatibility between document-level temporal topological logical anchoring and entity privacy erasure mechanisms in natural language processing. When processing multi-source heterogeneous data, the logical coherence of long temporal texts highly relies on coreference resolution chains to maintain cross-document contextual reference consistency. Conventional masking operations assign the same anonymized characters to all sensitive entities, which physically severs the entity anchor points between unstructured dynamic logs and structured static baseline forms. Due to the lack of distinguishable identifiers, attention mechanisms lose specific key values ​​for tracing back to historical nodes when processing long temporal features. Under this homogeneous erasure condition, entity-level privacy purging and the logical attachment of temporal events directly conflict, making it impossible for the system to accurately match and attach dynamic text with large time spans and loose semantics to the structured nodes determined by the static baseline when faced with such text, ultimately compromising the causal rigor of long-cycle data fusion output.

[0006] To overcome the shortcomings of existing technologies in entity desensitization, such as broken cross-document temporal coreference chains and baseline anchor point drift, this invention provides a multi-dimensional feature cleaning and desensitization method and system for massive heterogeneous temporal data. It generates unique, irreversible hash topological tags through multi-granularity named entity recognition and cross-document entity alignment, eliminating privacy-sensitive entities while retaining the entity referential network across heterogeneous data contexts using an implicit mapping table. Based on these hash topological tags, a dual-track feature processing mechanism is constructed, utilizing a cross-attention mechanism to calculate semantic distance and temporal span. Discrete dynamic intervention logs are reduced and mounted into logical nodes of a structured static feature baseline tree, ensuring the temporal consistency and causal logic rigor of the final output document after long-term, multi-source heterogeneous text aggregation and merging.

[0007] To achieve the above objectives, the present invention provides the following technical solution: Multidimensional feature cleaning and desensitization methods for massive heterogeneous time-series data include: Obtain the set of business data to be processed, perform data source type determination on the set of business data to be processed, and obtain the set of structured baseline key-value pairs and the set of dynamic log paragraphs; perform multi-granularity named entity recognition, cross-document entity alignment and irreversible hash transformation on the set of structured baseline key-value pairs and the set of dynamic log paragraphs to generate an implicit coreference mapping table; perform in-situ entity replacement on the set of structured baseline key-value pairs and the set of dynamic log paragraphs according to the implicit coreference mapping table to generate a de-identified heterogeneous corpus; A static feature baseline tree is constructed for the portion of the anonymized heterogeneous corpus whose data source type is marked as structured baseline data; a key intervention event sequence is constructed for the portion of the anonymized heterogeneous corpus whose data source type is marked as unstructured dynamic logs; candidate anchor nodes are located in the static feature baseline tree based on the key intervention event sequence, and an anchor candidate score matrix is ​​constructed; weights are assigned to the anchor candidate score matrix to obtain the anchor weight assignment result; a time-series self-consistent fusion feature set is generated based on the anchor weight assignment result, and a structured report document is output.

[0008] A multi-dimensional feature cleaning and desensitization system for massive heterogeneous time-series data, used to implement the aforementioned multi-dimensional feature cleaning and desensitization method for massive heterogeneous time-series data, the system comprising: Heterogeneous data desensitization module: Obtains the set of business data to be processed, performs data source type determination on the set of business data to be processed, and obtains a set of structured baseline key-value pairs and a set of dynamic log paragraphs; performs multi-granularity named entity recognition, cross-document entity alignment and irreversible hash transformation on the set of structured baseline key-value pairs and the set of dynamic log paragraphs to generate an implicit coreference mapping table; performs in-situ entity replacement on the set of structured baseline key-value pairs and the set of dynamic log paragraphs according to the implicit coreference mapping table to generate a desensitized heterogeneous corpus; Baseline event construction module: Constructs a static feature baseline tree for the portion of the data source type marked as structured baseline data in the anonymized heterogeneous corpus; constructs a key intervention event sequence for the portion of the data source type marked as unstructured dynamic logs in the anonymized heterogeneous corpus; Anchoring fusion output module: Based on the key intervention event sequence, candidate anchoring nodes are located in the static feature baseline tree, and an anchoring candidate score matrix is ​​constructed; weight allocation is performed on the anchoring candidate score matrix to obtain the anchoring weight allocation result; a time-consistent fusion feature set is generated based on the anchoring weight allocation result and a structured report document is output.

[0009] Compared with the prior art, the beneficial effects of the present invention are as follows: This invention employs multi-granularity named entity recognition and cross-document entity alignment to perform irreversible hash transformations on privacy entities in the structured baseline key-value pair set and the dynamic log paragraph set, generating an implicit coreference mapping table for in-situ entity replacement. This operation avoids the coreference chain breakage problem caused by conventional homogeneous desensitization masks, preserving the entity referencing network across heterogeneous data contexts with unique hash topological tags while removing privacy information. Based on this desensitized corpus, this invention constructs a static feature baseline tree and a key intervention event sequence according to the data source type. Based on the key intervention event sequence, candidate anchoring nodes are located in the static feature baseline tree, and weight allocation is performed by constructing an anchoring candidate score matrix. This dual-track feature processing process reduces discrete dynamic intervention logs and mounts them to logical nodes in the structured baseline, overcoming the incompatibility between privacy entity erasure and document-level temporal topological anchoring in heterogeneous text cleaning. Under the condition of entity anonymization, this solution achieves accurate anchoring and fusion of unstructured dynamic logs to structured static baselines, ensuring the temporal consistency and causal logic rigor of the final output document after long-term, multi-source heterogeneous text aggregation and merging. Attached Figure Description

[0010] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0011] Figure 1 This is a flowchart of the multi-dimensional feature cleaning and desensitization method for massive heterogeneous time-series data in this invention; Figure 2 This is a flowchart illustrating the three-dimensional progressive determination process for data source types in this invention. Figure 3 This is a schematic diagram of the dynamic log segmentation by timestamp in this invention; Figure 4 This is a schematic diagram of multi-granularity named entity recognition in this invention; Figure 5 This is a schematic diagram of the static feature baseline tree structure in this invention; Figure 6 This is a schematic diagram of the anchored candidate score calculation in this invention; Figure 7 This is a flowchart of the anchor weight allocation decision process in this invention; Figure 8 This is a functional block diagram of the multidimensional feature cleaning and desensitization system for massive heterogeneous time-series data in this invention. Detailed Implementation

[0012] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0013] Example 1: Please see Figure 1 As shown, this embodiment provides a multi-dimensional feature cleaning and desensitization method for massive heterogeneous time-series data, including: Step S10: Obtain the set of business data to be processed; perform data source type determination on the set of business data to be processed to obtain the set of structured baseline key-value pairs and the set of dynamic log paragraphs; perform multi-granularity named entity recognition, cross-document entity alignment and irreversible hash transformation on the set of structured baseline key-value pairs and the set of dynamic log paragraphs to generate an implicit coreference mapping table; perform in-situ entity replacement on the set of structured baseline key-value pairs and the set of dynamic log paragraphs according to the implicit coreference mapping table to generate a desensitized heterogeneous corpus.

[0014] Further, step S10 includes: Step S11: Obtain the set of business data to be processed; perform data source type determination on each record in the set of business data to be processed to obtain the data source type label; perform field-level decomposition on the records marked as structured baseline data to obtain a set of structured baseline key-value pairs with hierarchical field identifiers and original creation timestamps; perform text segmentation on the records marked as unstructured dynamic logs to obtain a set of dynamic log segments with timestamps.

[0015] Specifically, the business data set to be processed refers to the total amount of raw data from one or more business systems that has not yet undergone anonymization. Each record in the business data set may appear as a table row with a fixed field structure or as a free text segment without a fixed format. Data source type determination refers to classifying and identifying the data organization format of each record in the business data set to be processed, dividing the records into one of two categories: structured baseline data or unstructured dynamic logs. See also Figure 2When performing data source type determination, the metadata attributes of each record in the business data set to be processed are read. The metadata attributes include three dimensions: the record's file format identifier, the frequency of field separator occurrences, and the variance of text line lengths. When the record's file format identifier belongs to the preset structured format list (the structured format list includes file type identifiers with clearly defined fields, such as comma-separated value format, tab-separated format, and JavaScript object notation format), the data source type is set to structured baseline data. When the file format identifier of a record does not belong to the preset list of structured formats, the variance of the length of all text lines in the record is further calculated: if the variance of the text line length is greater than or equal to the preset unstructured determination variance threshold, it indicates that the length of each line in the record fluctuates greatly and does not have regular column alignment characteristics, and the data source type is marked as unstructured dynamic log; if the variance of the text line length is less than the preset unstructured determination variance threshold, the judgment is backed to the frequency of field separator occurrence. When the frequency of field separator occurrence is greater than or equal to the preset lower limit of separator frequency, the data source type is marked as structured baseline data; otherwise, the data source type is marked as unstructured dynamic log. The method for determining the preset unstructured data discrimination variance threshold is as follows: Randomly select a batch of sample records of known types from the business data set to be processed. The number of sample records selected should be no less than 5% of the total number of each type, and no less than 50 records per type, to ensure that the variance statistics of the samples are sufficiently representative. Calculate the text line length variance of sample records known as structured baseline data and the text line length variance of sample records known as unstructured dynamic logs, respectively. Statistically analyze the frequency distribution of the text line length variance values ​​for the two types of sample records. The intersection point refers to the position where the frequency distribution curves of the two types intersect on the variance value coordinate axis. That is, at this variance value, the probability of being judged as structured baseline data is equal to the probability of being judged as unstructured dynamic logs. The variance value corresponding to the intersection of the variance distributions of text line lengths of the two types of sample records is used as the unstructured decision variance threshold. When determining the unstructured decision variance threshold, two factors need to be considered: the uniformity of field value lengths in the structured baseline data and the dispersion of paragraph lengths in the unstructured dynamic logs. If the unstructured decision variance threshold is too large, some unstructured dynamic logs with significant fluctuations in text line lengths will be incorrectly classified into the structured baseline data, causing subsequent field-level decomposition processes to fail due to the lack of effective field separation. If the unstructured decision variance threshold is too small, some structured baseline data with large differences in field value lengths will be incorrectly classified into the unstructured dynamic logs, causing subsequent text segmentation processing to lose field-level information.For example, when the mean variance of text line length of structured baseline data samples is V1 and the mean variance of text line length of unstructured dynamic log samples is V2, the unstructured decision variance threshold can be set as the arithmetic mean of V1 and V2. The reason for using the arithmetic mean as an approximation is that when the frequency distribution of the variance of text line length of the two types of sample records is approximately symmetrical, the intersection of the two distribution curves falls approximately in the middle of the two means, and the arithmetic mean is a reasonable approximation of this middle position. In practical applications, if it is known that the number of records of the two types of samples differs greatly or that the distribution of variance values ​​is obviously skewed, the calculation result of the actual intersection point should be used, and the arithmetic mean should not be used directly. The method for determining the preset lower limit of delimiter frequency is as follows: Statistically count the average number of times field delimiters appear in each row of sample records known as structured baseline data. Field delimiters are specific characters used to separate adjacent fields in structured data, including common delimiters such as commas, tabs, vertical bars, and semicolons. Take half of the average frequency as the lower limit of delimiter frequency. The reason for taking half is that the record with the fewest fields in the structured baseline data usually contains at least two fields, and the corresponding delimiter appears approximately half the average number of times field delimiters appear. Therefore, using half as the lower limit can cover structured baseline data records with fewer fields, while excluding unstructured dynamic logs that only occasionally contain a few delimiter characters. If the lower limit of delimiter frequency is too high, structured baseline data with fewer fields will be misjudged as unstructured dynamic logs; if the lower limit of delimiter frequency is too low, unstructured dynamic logs containing occasional delimiter characters will be misjudged as structured baseline data. By progressively determining the data type of each record through three dimensions—file format identifier, text line length variance, and field separator frequency—a deterministic data source type label is obtained. This provides a reliable basis for subsequent processing of the two types of data, avoiding parsing errors caused by format incompatibility when mixing two types of data with vastly different formats.

[0016] Records marked as structured baseline data from data sources undergo field-level decomposition. Field-level decomposition involves splitting a complete record into several independent key-value pairs based on field delimiters or key-value pair syntax rules. Each key-value pair consists of a field name and a field value. During decomposition, each key-value pair is assigned a hierarchical field identifier. This identifier uses a multi-segment encoding connected by dots, with each segment corresponding to a hierarchical name on the path from the root node to the current field in the data structure. Simultaneously, the original creation timestamp is extracted from the metadata of each structured baseline data record and appended to each key-value pair, ensuring that each key-value pair carries three attributes: the hierarchical field identifier, the field value, and the original creation timestamp. After completing the field-level decomposition of all structured baseline data records, a set of structured baseline key-value pairs is obtained. The introduction of hierarchical field identifiers enables subsequent step S21 to reconstruct the hierarchical relationships between fields and construct a static feature baseline tree based on the dot-separated hierarchical path. Without hierarchical field identifiers, key-value pairs from different levels would lose their attribution information, and the construction of the static feature baseline tree would be unable to determine the parent-child node relationship. The preservation of the original creation timestamps allows subsequent step S23 to obtain the temporal attributes of candidate anchor nodes when calculating the time-series span score, thereby measuring the temporal proximity between effective intervention paragraphs and candidate anchor nodes.

[0017] For records whose data source type is marked as unstructured dynamic log, text segmentation is performed. Text segmentation refers to dividing a complete unstructured dynamic log record into several segments according to semantic or format boundaries. The segmentation rules are based on the position of the timestamp in the log record: see [link to relevant documentation]. Figure 3 This is a schematic diagram of dynamic log segmentation by timestamp provided in the embodiments of this application. Figure 3The diagram illustrates an unstructured dynamic log original record containing multiple embedded timestamps, namely 2025-01-15 08:30:00, 2025-01-15 09:15:00, and 2025-01-15 10:42:00. After performing a timestamp-based segmentation operation on this original record, three independent dynamic log segments with timestamps are obtained, with timestamps corresponding to each segment being 2025-01-15 08:30, 2025-01-15 09:15, and 2025-01-15 10:42. The system scans the entire log record and identifies text segments that match a preset timestamp format template. The preset timestamp format template is a predefined set of regular expression patterns used to match time information in log records. It covers common time representation formats in business systems, including but not limited to the "year-month-day hour:minute:second" format, the ISO 8601 standard format, and the Unix epoch timestamp format. Each timestamp mark is used as the starting position of a new paragraph. All text content between two adjacent timestamp marks is grouped into the same paragraph, and the timestamp mark at the beginning of the paragraph is used as the paragraph's timestamp attribute. When no identifiable timestamp is found in the log record, a paragraph boundary detection method based on semantic coherence is adopted: For each sentence in the log record, a semantic coherence score is calculated between it and the previous sentence. The semantic coherence score is calculated by using a pre-trained text encoding model to encode the current sentence and the previous sentence into fixed-dimensional sentence vectors. The pre-trained text encoding model refers to a deep semantic encoding model that has pre-learned language representations on a large-scale general corpus. This model uses a Transformer architecture as the basic encoder, encoding the word sequence of the input text into a global semantic representation through multiple layers of self-attention operations. The output convergence vector serves as a fixed-dimensional dense vector representation of the input text. This pre-trained text encoding model is the same as the pre-trained text encoding model used for vectorization encoding in step S23. The cosine similarity value of the two sentence vectors is calculated as the semantic coherence score. The semantic coherence score ranges from -1 to 1. The larger the value, the stronger the semantic coherence between the two adjacent sentences. When the semantic coherence score of the two adjacent sentences is lower than the preset paragraph segmentation semantic coherence threshold, the latter sentence is taken as the starting position of the new paragraph, and the file-level modification timestamp is assigned to the paragraph without an embedded timestamp as the paragraph's timestamp attribute.The preset method for determining the semantic coherence threshold for paragraph segmentation is as follows: The average semantic coherence score of adjacent sentences within a paragraph and the average semantic coherence score of adjacent sentences across paragraphs are statistically analyzed from the annotated corpus with known paragraph boundaries. The midpoint between these two scores is taken as the semantic coherence threshold for paragraph segmentation. If the semantic coherence threshold is too high, the number of adjacent sentence pairs with semantic coherence scores higher than this threshold decreases, and a large number of semantically related consecutive sentences are frequently segmented into multiple short paragraphs. This leads to a decrease in the confidence score when performing text classification on paragraphs that are too short and lack complete event semantics in subsequent step S22. If the semantic coherence threshold is too low, content whose semantics have already been transformed is still merged into the same paragraph, making it difficult for subsequent step S22 to assign accurate event categories to paragraphs containing multiple events. After completing the text segmentation processing of all unstructured dynamic log records, a set of dynamic log paragraphs with timestamps is obtained. Text segmentation transforms continuous log text into discrete sequences of paragraphs, enabling subsequent step S22 to perform text classification and calculate confidence scores paragraph by paragraph. Without text segmentation, unstructured dynamic logs would enter the subsequent process as complete documents, and the text classification model would be unable to focus on the semantic features of a single event due to the excessive length of the input text, resulting in a significant drop in classification accuracy.

[0018] After step S11 is completed, each record in the business data set to be processed has been diverted to either a structured baseline key-value pair set or a dynamic log segment set according to the data source type. Both sets retain their respective required metadata attributes, providing uniformly formatted and clearly defined input data for multi-granularity named entity recognition in step S12. Without the data source type determination and diversion process in step S11, structured baseline data and unstructured dynamic logs would be mixed in the same data stream. Step S12 would face difficulties with inconsistent input formats when performing sequence labeling: for structured baseline data, the character offset of privacy entities should be located in key-value pairs, while for unstructured dynamic logs, the character offset of privacy entities should be located in segments. These two positioning coordinate systems are incompatible in the same processing logic, leading to ambiguity in the location records of privacy entities.

[0019] Step S12: Perform sequence labeling on the structured baseline key-value pair set, extract text fragments belonging to the preset privacy entity category, and record the key-value pair number and the character offset within the key-value pair to obtain a structured privacy entity sublist; perform the same sequence labeling on the dynamic log paragraph set, extract text fragments belonging to the preset privacy entity category, and record the paragraph number and the character offset within the paragraph to obtain a dynamic privacy entity sublist; merge the structured privacy entity sublist and the dynamic privacy entity sublist to obtain the original privacy entity list.

[0020] Step S12 implements multi-granularity named entity recognition. Multi-granularity refers to performing named entity recognition separately for the structured baseline key-value pair set at the key-value pair recognition granularity and for the dynamic log paragraph set at the paragraph recognition granularity. Sequence labeling is performed on the structured baseline key-value pair set. Sequence labeling refers to using a pre-trained named entity recognition model to predict labels for each character or word in the input text. The pre-trained named entity recognition model is a deep sequence labeling model that has pre-learned language representations on a large-scale general corpus and fine-tuned on domain corpora containing privacy entity category labels. This model uses a Transformer architecture as its basic encoder, encoding the word sequence of the input text into a context-aware hidden state vector sequence. After passing through a linear classification layer, it outputs the BIO label probability distribution for each word in the hidden state vector. The label system follows the BIO encoding specification: B labels mark the start position of an entity, I labels mark the continuation position of an entity, and O labels mark non-entity parts. See also... Figure 4 This is a schematic diagram of multi-granularity named entity recognition provided in the embodiments of this application. Figure 4The input text displayed includes name, ID number, phone number, and mailing address. Preset privacy entity categories include, but are not limited to, natural person names, ID card numbers, mailing addresses, mobile phone numbers, email addresses, and medical diagnosis names. For each key-value pair in the structured baseline key-value pair set, the text of the field values ​​in the key-value pair is used as input to the named entity recognition model. The model outputs a tag sequence corresponding to each lexical unit. From the tag sequence, all text fragments starting with the 'B' tag and extending with consecutive 'I' tags are extracted as candidate privacy entities. The key-value pair number of the candidate privacy entity and the start and end character offsets of the candidate privacy entity in the field value text are recorded, resulting in a structured privacy entity sublist. The same sequence labeling process is performed on each timestamped paragraph in the dynamic log paragraph set. The text content of the paragraph is used as input to the named entity recognition model to extract candidate privacy entities and record the paragraph number and the start and end character offsets of the candidate privacy entity in the paragraph text, resulting in a dynamic privacy entity sublist. The structured privacy entity sublist and the dynamic privacy entity sublist are merged to obtain the original privacy entity list. Each record in the original privacy entity list includes the text content of the privacy entity, the privacy entity category label, the data source type marker, the key-value pair number or paragraph number, and the start and end character offsets. Sequence labeling uses character offsets to accurately locate the position of the privacy entity in the source text, so that in the subsequent step S14, when performing in-situ entity replacement, the target text segment can be directly located and replaced based on the character offsets without affecting the non-privacy text content in the same key-value pair or paragraph, thus maintaining the semantic integrity of the data while achieving desensitization. Step S12 performs sequence labeling on the two types of data sets respectively and finally merges them into a unified original privacy entity list. This allows privacy entities from the structured baseline data and the unstructured dynamic log that point to the same real-world object to be included in the same round of text similarity comparison in step S13, which is a prerequisite for cross-document entity alignment. Real-world objects refer to entities that actually exist in the objective environment recorded by the business system and have independent identities, including but not limited to natural persons, corporate entities, physical equipment or geographical locations. The same real-world object may be mentioned in different text forms in different data sources or different records. For example, the same natural person may appear in different fields of structured baseline data and different paragraphs of unstructured dynamic logs in the form of full name, abbreviation, alias or name with input differences.

[0021] Step S13: Calculate the text similarity score for every two privacy entities in the original privacy entity list. When the text similarity score is greater than or equal to the preset entity alignment threshold, the two privacy entities are grouped into the same entity cluster. After traversal, multiple entity clusters are obtained, and each entity cluster corresponds to a unique real-world object. Select the text form with the highest frequency of occurrence for each entity cluster as the normalized representation to obtain a unique set of deduplicated privacy entities. Each element in the unique set of deduplicated privacy entities is associated with all positional information in the structured baseline key-value pair set and the dynamic log segment set.

[0022] For every two privacy entities in the original privacy entity list, a text similarity score is calculated using an edit distance normalization method: the edit distance value between the text content of the two privacy entities is calculated, representing the minimum number of single-character editing operations (inserting, deleting, or replacing a character) required to convert one text content into another. The edit distance value is divided by the larger of the two text content lengths to obtain the normalized edit distance value. Subtracting the normalized edit distance value from 1 yields the text similarity score, which ranges from 0 to 1. A higher value indicates that the text content of the two privacy entities is more similar. When the text similarity score is greater than or equal to a preset entity alignment threshold, the two privacy entities are grouped into the same entity cluster. An entity cluster is a set of privacy entities that are determined to point to the same real-world object. The method for determining the entity alignment threshold is as follows: Select a batch of validation samples containing known coreference annotations. Validation samples refer to the annotated data set extracted from the business data set to be processed, in which domain experts have annotated each pair of privacy entities to determine whether they point to the same real-world object. The validation samples should contain no less than two hundred pairs of privacy entity pairs and cover common text variations such as initials, aliases, and typos. Iterate through different candidate thresholds, and for each candidate threshold, calculate the proportion of truly coreference privacy entity pairs correctly assigned to the same entity cluster (i.e., recall) and the proportion of privacy entity pairs in the entity cluster that actually point to the same real-world object (i.e., precision). Take the candidate threshold corresponding to the peak value of the harmonic mean of the recall and precision metrics as the entity alignment threshold. The harmonic mean is the reciprocal of the arithmetic mean of the reciprocals of two values. The characteristic of the harmonic mean is that when the recall metric reaches its peak value... When either the precision or recall metric is low, the harmonic mean will be significantly lowered. Therefore, a peak in the harmonic mean indicates that both recall and precision are at a relatively high and balanced level at the candidate threshold. When determining the entity alignment threshold, the degree of variation in the textual form of privacy entities needs to be considered: if the entity alignment threshold is too high, only highly similar privacy entity pairs will be grouped into the same entity cluster, and core-referenced entity pairs containing abbreviations, aliases, or input differences will be missed. This will cause the same real-world object to be replaced with multiple different hash topological tags in subsequent step S14, and the records of the same object in the desensitized corpus will be broken into unrelated entries, destroying the data's association and integrity. If the entity alignment threshold is too low, privacy entity pairs with accidentally similar textual forms but pointing to different real-world objects will be incorrectly merged, causing different objects to share the same hash topological tag after desensitization, resulting in a loss of individual distinguishability.

[0023] After traversing all privacy entity pairs in the original privacy entity list and performing clustering, multiple entity clusters are obtained, each corresponding to a unique real-world object. For each entity cluster, the frequency of each text form within the cluster in the original privacy entity list is counted, and the text form with the highest frequency is selected as the normalized representation of the entity cluster, resulting in a deduplicated unique privacy entity set. Each element in the deduplicated unique privacy entity set is associated with all positional information in the structured baseline key-value pair set and the dynamic log segment set through the membership relationship of the entity cluster. The positional information includes the data source type marker, key-value pair number or segment number, start character offset, and end character offset. Cross-document entity alignment converges multiple representations of the same real-world object distributed across different data sources and records into a unique normalized representation. This allows step S14 to generate only one hash topology tag for each unique real-world object to cover all occurrences, ensuring that the same real-world object always corresponds to the same hash topology tag in the desensitized corpus. This lays a consistent foundation for subsequent steps S21, which uses hash topology tags as node identifiers in the static feature baseline tree, and S23, which uses hash topology tags to locate candidate anchor nodes in the static feature baseline tree.

[0024] Step S14: For each unique privacy entity in the deduplicated set of unique privacy entities, the normalized representation is concatenated with a system-level fixed salt string. The concatenated string is hashed and truncated to a preset length to obtain a hash topology tag set. A bidirectional index is established between each hash topology tag and the key-value pair number and character offset within the key-value pair, and the paragraph number and character offset within the paragraph of the corresponding unique privacy entity to obtain an implicit coreference mapping table. Each record in the implicit coreference mapping table contains a hash topology tag, a data source type marker, and a list of location information. Based on the implicit coreference mapping table, in-situ entity replacement is performed on the structured baseline key-value pair set and the dynamic log paragraph set to generate a desensitized heterogeneous corpus.

[0025] For each unique privacy entity in the deduplicated set of unique privacy entities, an irreversible hash transformation is performed to generate a hash topology tag. The irreversible hash transformation process involves concatenating the normalized representation of the unique privacy entity with a system-level fixed salt string, with the normalized representation first and the system-level fixed salt string last, into a complete string. The system-level fixed salt string is a random character sequence generated once by the administrator during system deployment and remains unchanged throughout the system's lifecycle. The purpose of the system-level fixed salt string is to ensure that even if an attacker knows the algorithm used in the hash operation, they cannot reverse-engineer the original text content of the privacy entity by constructing a rainbow table without knowing the system-level fixed salt string, thus enhancing the hash topology tag's resistance to reverse engineering. A hash operation is then performed on the concatenated complete string using the SHA-256 algorithm. The SHA-256 algorithm is a cryptographically secure one-way hash function that can map inputs of arbitrary length to a fixed-length 256-bit binary digest value. It has collision resistance, meaning that the probability of different inputs producing the same digest value is extremely low. The output of the hash operation is a hexadecimal string representation of a 256-bit binary digest value. A specified number of characters are truncated from the beginning of the hexadecimal string according to a preset truncation length to obtain the hash topology tag. The preset truncation length is determined by estimating the probability of collisions in the truncated hash space based on the size of the deduplicated set of unique privacy entities, ensuring the collision probability is below a preset upper limit. The upper limit of the collision probability refers to the maximum probability value allowed by the system for different unique privacy entities to generate the same hash topology tag. The upper limit is determined based on the business scenario's requirements for entity distinguishability. In scenarios requiring strict entity non-comparison, the upper limit should be set below one in a million; in scenarios where a small number of collisions are tolerable, the upper limit can be appropriately relaxed to one in ten thousand. The estimation basis for the collision probability is that the size of the hash space is determined by the number of truncated hexadecimal characters, with each hexadecimal character corresponding to four binary digits. The larger the truncation length, the stronger the hash topology tag. The larger the hash space, the lower the probability that any two hash topology tags will have the same value when a certain number of hash topology tags are randomly distributed in the hash space. Therefore, the minimum truncation length should be selected so that the collision probability does not exceed the upper limit of the collision probability under a given number of unique privacy entities. When determining the preset truncation length, the relationship between the number of unique privacy entities and the size of the hash space needs to be considered: if the preset truncation length is too small, the truncated hash space will be small, and the collision probability of different unique privacy entities generating the same hash topology tag will increase, making it impossible to distinguish different real-world objects in the desensitized corpus; if the preset truncation length is too large, the number of characters in the hash topology tag will be too large, and the node identifier will be too long when constructing the static feature baseline tree in the subsequent step S21, which will increase storage overhead and reduce index retrieval speed.

[0026] A bidirectional index is created for each hash topology tag and its corresponding unique privacy entity, using the key-value pair number and character offset within the key-value pair in the structured baseline key-value pair set, and the segment number and character offset within the segment in the dynamic log segment set, to obtain an implicit coreference mapping table. Each record in the implicit coreference mapping table contains a hash topology tag, a data source type marker, and a list of location information. Each item in the location information list indicates the specific location where a privacy entity appears. The bidirectional index means that all occurrence positions can be found from the hash topology tag, and the corresponding hash topology tag can also be found in reverse from any occurrence position. The establishment of the bidirectional index enables the in-situ entity replacement process to complete a single lookup in O(1) time complexity, avoiding the performance loss caused by traversing the entire mapping table one by one. In-situ entity replacement is performed on the structured baseline key-value pair set and the dynamic log segment set based on the implicit coreference map: Each record in the implicit coreference map is traversed, and the data source type marker in the location information list determines whether the target to be replaced is located in the structured baseline key-value pair set or the dynamic log segment set. The target record is located based on the key-value pair number or segment number. The target text fragment is extracted based on the start and end character offsets, and the extracted target text fragment is replaced with the corresponding hash topology tag in the implicit coreference map. During the replacement process, when multiple privacy entities to be replaced exist in the same key-value pair or the same segment, the replacement is performed sequentially in descending order of start character offset. This descending replacement order ensures that the replaced areas do not affect the correctness of the character offsets of the unreplaced areas. If the replacement is performed in ascending order, the text length changes after the first privacy entity is replaced by the hash topology tag, and the character offsets of subsequent privacy entities will no longer correspond to the actual positions, resulting in incorrect replacement positions. After completing all in-situ entity replacements, all privacy-related entity text fragments in the structured baseline key-value pair set and all privacy-related entity text fragments in the dynamic log paragraph set have been replaced with corresponding hash topology tags, generating a desensitized heterogeneous corpus. The desensitized heterogeneous corpus retains all non-privacy content, hierarchical field identifiers, original creation timestamps, and paragraph timestamp attributes of the original data, replacing only privacy-related text fragments with irreversible hash topology tags. This allows the desensitized heterogeneous corpus to be used as input for constructing the static feature baseline tree and key intervention event sequences in subsequent step S20, while ensuring that the original text content of privacy-related entities cannot be restored from the hash topology tags.

[0027] In step S10, step S11 determines the data source type and divides the business data set to be processed into a structured baseline key-value pair set and a dynamic log segment set according to their data organization. This provides format-adapted input for subsequent sequence labeling, enabling the named entity recognition model in step S12 to accurately locate the character offsets of privacy entities at both the key-value pair and segment granularities, eliminating ambiguity in offset coordinates caused by mixed format inputs. Step S12 merges the privacy entities identified from the two data sets into a unified original privacy entity list, providing a complete privacy entity candidate pool for cross-document entity alignment in step S13. This allows different textual representations of the same real-world object's privacy entity, scattered across the structured baseline data and unstructured dynamic logs, to be included in the same round of similarity comparison. Step S13 calculates text similarity scores using the edit distance normalization method and performs clustering based on the entity alignment threshold, converging multiple representations pointing to the same real-world object into a unique normalized representation. This allows Step S14 to generate only one hash topological tag for each real-world object, covering all occurrences and ensuring that the same real-world object always corresponds to the same identifier after desensitization. Step S14 generates irreversible hash topological tags by concatenating system-level fixed salt strings and performing SHA-256 hashing. It then uses bidirectional indexing and a replacement order based on descending character offsets to complete in-situ entity replacement, maintaining the integrity of the data's semantic structure, hierarchical relationships, and temporal attributes while eliminating privacy information. In multi-dimensional feature cleaning and desensitization scenarios dealing with massive heterogeneous time-series data, structured baseline data and unstructured dynamic logs coexist. The same real-world object may appear in different text forms in different data sources. Directly performing desensitization will result in the same object being replaced by multiple unrelated desensitized identifiers. The desensitized data loses the entity association relationship across data sources, and the subsequent feature fusion stage cannot correctly match features from different data sources to the same object. Step S10, through progressive processing of data source type determination, multi-granularity named entity recognition, cross-document entity alignment, and irreversible hash transformation, establishes a unified entity identifier system across data sources while completing privacy desensitization. This ensures that the desensitized heterogeneous corpus meets privacy protection requirements while retaining entity association relationships and time-series attributes, providing a directly usable desensitized data foundation for the subsequent static feature baseline tree construction and anchoring fusion of key intervention event sequences in step S20.

[0028] Step S20: Construct a static feature baseline tree for the portion of the anonymized heterogeneous corpus whose data source type is marked as structured baseline data; construct a key intervention event sequence for the portion of the anonymized heterogeneous corpus whose data source type is marked as unstructured dynamic logs; locate candidate anchor nodes in the static feature baseline tree based on the key intervention event sequence and construct an anchor candidate score matrix; perform weight allocation on the anchor candidate score matrix to obtain the anchor weight allocation result; generate a time-series self-consistent fusion feature set based on the anchor weight allocation result and output a structured report document.

[0029] Further, step S20 includes: Step S21: Read all key-value pairs in the desensitized heterogeneous corpus that are marked as structured baseline data. Based on the hierarchical field identifier, key-value pairs with the same parent hierarchical field identifier are grouped into the same hierarchical group to obtain multiple hierarchical groups. For each hierarchical group, a subtree is constructed using a hash topology tag as the node identifier, the value in the key-value pair as the node attribute, and the original creation timestamp as the node time attribute. The subtrees of all hierarchical groups are concatenated according to the hierarchical relationship of the hierarchical field identifier to obtain a static feature baseline tree.

[0030] Specifically, each record in the anonymized heterogeneous corpus carries a data source type tag, indicating whether the record belongs to structured baseline data or unstructured dynamic logs. The static feature baseline tree is a hierarchical representation of the hierarchical affiliation and attribute information of all key-value pairs in the structured baseline data, organized in a tree-like data structure. Each node in the static feature baseline tree corresponds to an anonymized key-value pair. See also... Figure 5 This is a schematic diagram of the static feature baseline tree structure provided in the embodiments of this application. Figure 5The diagram illustrates the complete hierarchical structure of the static feature baseline tree, containing a root node, multiple intermediate nodes, and multiple leaf nodes. Intermediate nodes are labeled with hash topology tags, and leaf nodes are labeled with field values. All key-value pairs from the anonymized heterogeneous corpus, tagged as structured baseline data, are read. Each key-value pair carries three attributes: a hierarchical field identifier, a field value, and an original creation timestamp. The hierarchical field identifier uses a multi-segment encoding connected by dots, with each segment corresponding to a hierarchical name on the path from the root node to the current field. For each key-value pair's hierarchical field identifier, the parent-level hierarchical field identifier is extracted: the last dot and all characters after it are deleted, and the remaining part is the parent-level hierarchical field identifier; key-value pairs with the same parent-level hierarchical field identifier are grouped into the same hierarchical group, resulting in multiple hierarchical groups. For each hierarchical group, construct a subtree: use the hash topology tag of each key-value pair in the hierarchical group as the node identifier. The hash topology tag is an irreversible identifier obtained by concatenating the normalized representation of the unique privacy entity with the system-level fixed salt value string and performing SHA-256 hash operation; when the field value of the key-value pair contains a hash topology tag, if the field value contains only one hash topology tag, use that hash topology tag as the node identifier; if the field value contains multiple hash topology tags, use the hash topology tag that appears first in the field value according to the character position as the primary identifier of the node, and store the remaining hash topology tags as auxiliary identifiers of the node in the node attribute. In step S23, when performing hash topology tag matching in the static feature baseline tree, the primary identifier and auxiliary identifier of the node are compared at the same time; when the field value of the key-value pair does not contain a hash topology tag, use the last segment encoding of the hierarchical field identifier as the node identifier; use the field value in the key-value pair as the node attribute, and the original creation timestamp as the node time attribute to construct the leaf node in the subtree. The group name of a hierarchical group, which is also the identifier of its parent level field, serves as the root node identifier of its subtree. All subtrees of hierarchical groups are concatenated according to the hierarchical relationship of their hierarchical field identifiers: for any two hierarchical groups, if the group name of one hierarchical group is equal to the parent level field identifier of the group name of another hierarchical group, the root node of the former's subtree is used as the direct parent node of the latter's subtree root node. That is, a parent-child connection is established only when there is a direct hierarchical relationship between two hierarchical groups, without crossing intermediate levels. This concatenation continues level by level until all subtrees of all hierarchical groups converge into a complete tree, resulting in the static feature baseline tree. The final static feature baseline tree is compared with... Figure 5The hierarchical structure shown is completely corresponding, with the root node at the top level of the tree, connecting to multiple intermediate nodes downwards, and each intermediate node further connecting to multiple leaf nodes. The root node of the static feature baseline tree corresponds to the top-level field in the structured baseline data where the hierarchical field identifier has one segment separated by dots. The leaf nodes correspond to the end field with the most segments separated by dots in the hierarchical field identifier, and the intermediate nodes correspond to the transitional levels on the hierarchical path. Using hash topology tags as node identifiers allows nodes in the static feature baseline tree to establish a correspondence with privacy entities in the desensitized heterogeneous corpus. After extracting hash topology tags from the effective intervention segments of the key intervention event sequence in step S23, candidate anchor nodes can be directly located in the static feature baseline tree through string matching of hash topology tags, without the need for additional entity mapping transformation. Using the original creation timestamp as the node time attribute allows nodes in the static feature baseline tree to carry time dimension information. When calculating the time span score in step S23, the absolute value of the time difference between the node time attribute of the candidate anchor node and the original timestamp of the effective intervention segment can be read, thereby adding a time dimension anchoring constraint in addition to the semantic dimension. Without the construction of the static feature baseline tree in step S21, step S23 will be unable to determine which structured baseline data node the effective intervention segment should be anchored to, and there will be no structured connection path between the key intervention event sequence and the structured baseline data. The generation of the fusion feature set in step S25 will lose its hierarchical classification basis.

[0031] Step S22: Perform text classification on each time-stamped paragraph in the desensitized heterogeneous corpus whose data source type is marked as unstructured dynamic log, and calculate the confidence score of the time-stamped paragraph belonging to the preset effective intervention event category; when the confidence score is greater than or equal to the preset noise filtering threshold, the time-stamped paragraph is retained and marked as an effective intervention paragraph; when the confidence score is less than the preset noise filtering threshold, the time-stamped paragraph is removed; arrange all effective intervention paragraphs in the order of their original timestamps to obtain the key intervention event sequence.

[0032] Text classification is performed on each time-stamped paragraph in a de-identified heterogeneous corpus whose data source type is labeled as unstructured dynamic logs. Text classification refers to determining the event category of the input paragraph using a pre-trained text classification model. The pre-trained text classification model is a deep text classification model that has completed language representation learning on a large-scale general corpus and has been fine-tuned on a domain corpus containing effective intervention event category labels. This model uses a Transformer architecture as its basic encoder, encoding the word sequence of the input paragraph into a fixed-dimensional paragraph-level semantic representation vector. After passing through a fully connected classification layer, it outputs the probability value of the input paragraph belonging to each preset effective intervention event category. The input of the text classification model is the text content of the time-stamped paragraph, and the output is the probability value of the time-stamped paragraph belonging to each preset effective intervention event category. Preset effective intervention event categories refer to the set of event types that can substantially affect the state of an object in a business scenario. These categories are predefined by domain experts based on business rules. For example, in a healthcare data processing scenario, preset effective intervention event categories may include drug prescription adjustments, surgical operation records, changes in diagnostic conclusions, and abnormal test result reports; in an equipment maintenance data processing scenario, they may include fault alarms, maintenance operations, parts replacement, and parameter adjustments. The number of preset effective intervention event categories is typically 5 to 30, depending on the granularity of event types in the business scenario. The text classification model encodes the text content of timestamped paragraphs into fixed-dimensional semantic vectors. After classification, the probability value of a timestamped paragraph belonging to each preset effective intervention event category is calculated, and the maximum probability value is taken as the confidence score of the timestamped paragraph. When the confidence score is greater than or equal to the preset noise filtering threshold, the timestamped paragraphs are retained and marked as effective intervention paragraphs. Effective intervention paragraphs refer to paragraphs that are determined by the text classification model to belong to the preset effective intervention event category and whose confidence scores meet the noise filtering threshold requirements. When the confidence score is less than the preset noise filtering threshold, the timestamped paragraphs are removed.The method for determining the preset noise filtering threshold is as follows: A batch of paragraphs labeled with event categories by domain experts is extracted from a desensitized heterogeneous corpus as a validation set. The paragraphs in the validation set are divided into positive samples labeled as effective intervention events and negative samples labeled as ineffective intervention events. All positive and negative samples are input into a text classification model to calculate confidence scores. Different candidate thresholds are iterated through. For each candidate threshold, the proportion of positive samples with confidence scores greater than or equal to the candidate threshold is counted as the positive sample retention rate, and the proportion of negative samples with confidence scores greater than or equal to the candidate threshold is counted as the negative sample false positive rate. The candidate threshold corresponding to the peak value of the sum of the positive sample retention rate and the negative sample false positive rate (1 minus 1) is used as the noise filtering threshold. The reason for using this sum as the evaluation criterion is that the positive sample retention rate measures the degree to which effective intervention events are correctly retained, while the negative sample false positive rate measures the degree to which noisy segments are correctly excluded. The peak value of their sum indicates that the combined effect of retaining effective events and excluding noisy segments is optimal at this candidate threshold. This evaluation criterion is also known as the Youden index in statistics and is a commonly used method for determining the optimal classification cutoff point. All effective intervention segments are arranged in chronological order according to their original timestamps to obtain the key intervention event sequence. The key intervention event sequence is a sequence of effective intervention segments arranged in chronological order. Each element in the key intervention event sequence is a valid intervention segment, carrying text content, the original timestamp, and an event category label. Text classification and noise filtering exclude irrelevant segments from the unstructured dynamic logs, ensuring that subsequent step S23 only constructs the anchoring candidate score matrix for semantically clear and effective intervention segments. This avoids ineffective calculations of semantic distance and temporal span scores across all segments and reduces the proportion of noisy rows in the anchoring candidate score matrix. Step S11 segments the unstructured dynamic logs into discrete sequences based on segments, and step S22 performs text classification and filtering at the segment level, ensuring that the input granularity of the text classification model is consistent with the segmentation granularity of step S11. Without the text classification and noise filtering in step S22, all timestamped segments would enter the anchoring candidate score matrix construction process in step S23. A large number of noisy segments would generate numerous low-confidence anchoring candidate scores, diluting the weights of effective anchoring relationships during normalization in step S24 and reducing the reliability of the anchoring weight allocation results.

[0033] Step S23: Extract all hash topological tags contained in each effective intervention segment in the key intervention event sequence, locate the nodes that match the hash topological tags in the static feature baseline tree, and obtain a set of candidate anchor nodes; perform vectorized encoding on the text content of the effective intervention segment and the node attributes of each candidate anchor node in the set of candidate anchor nodes to obtain the text vector and node attribute vector of the effective intervention segment, and calculate the cosine similarity value of the text vector and node attribute vector of the effective intervention segment as the semantic distance score; read the original timestamp of the effective intervention segment and the node time attribute of the candidate anchor node to calculate the absolute value of the time difference, and obtain the time span score based on the absolute value of the time difference; use the product of the semantic distance score and the time span score as the anchor candidate score, and traverse all combinations of effective intervention segments and candidate anchor nodes to obtain the anchor candidate score matrix.

[0034] Anchored candidate scores are calculated for each valid intervention segment in the sequence of key intervention events. See also Figure 6 This is a schematic diagram of anchor candidate score calculation provided in the embodiments of this application. Figure 6The diagram illustrates the complete calculation logic for effective intervention paragraphs, candidate anchor nodes, hash topology tags, and anchor candidate scores. Effective intervention paragraphs carry text content and original timestamp attributes, candidate anchor nodes carry node attributes and node time attributes, and hash topology tags connect effective intervention paragraphs and candidate anchor nodes. The final anchor candidate score is obtained by calculating semantic distance scores and temporal span scores separately and multiplying the two scores. The text content of effective intervention paragraphs is scanned to extract all hash topology tags contained within the text content. The identification criteria for hash topology tags are: the character length of the hash topology tag is equal to the number of characters specified by the preset truncation length in step S14, and each character of the hash topology tag belongs to the hexadecimal character set. All nodes are traversed in the static feature baseline tree, and the primary and secondary identifiers of each node are compared one by one with the hash topology tags extracted from the effective intervention paragraphs. When the primary identifier or any secondary identifier of a node completely matches a hash topology tag, the matching node is included in the candidate anchor node set. The candidate anchor node set is a subset of nodes in the static feature baseline tree that have entity associations with the effective intervention paragraph. Each candidate anchor node in the candidate anchor node set carries three pieces of information: node identifier, node attribute, and node time attribute. Vectorization encoding is performed on the text content of the effective intervention paragraph and the node attributes of each candidate anchor node in the candidate anchor node set. Vectorization encoding uses a pre-trained text encoding model. The specific value of the fixed dimension is determined by the output specifications of the selected pre-trained text encoding model. Commonly used pre-trained text encoding models typically have an output dimension of 384, 768, or 1024. The effective intervention paragraph text vector and node attribute vector should be encoded using the same pre-trained text encoding model to ensure they are in the same vector space, resulting in the effective intervention paragraph text vector and node attribute vector. This pre-trained text encoding model is the same as the pre-trained text encoding model used in step S11 to calculate the semantic coherence score, ensuring vector space consistency throughout the process. The cosine similarity value between the effective intervention paragraph text vector and the node attribute vector is calculated as the semantic distance score, such as... Figure 6 As shown, the semantic distance score measures the semantic strength of the association between the effective intervention paragraph and the candidate anchor node. Cosine similarity is a measure of the consistency of the direction of two vectors, calculated by dividing the inner product of the two vectors by the product of their magnitudes. The value ranges from -1 to 1; a larger value indicates a more consistent semantic direction. The semantic distance score quantifies the semantic closeness between the effective intervention paragraph and the candidate anchor node. A higher semantic distance score indicates a stronger semantic association between the event content described in the effective intervention paragraph and the structured baseline attributes recorded by the candidate anchor node. The original timestamp of the effective intervention paragraph and the node time attribute of the candidate anchor node are read, and the absolute value of the time difference between them is calculated. The temporal span score is calculated based on the absolute value of the time difference, as shown below. Figure 6As shown, the temporal span score measures the strength of the association between the effective intervention segment and the candidate anchor node in the time dimension. The temporal span score is calculated as follows: first, the absolute value of the time difference is divided by the temporal decay factor; then, this quotient is added to 1 to obtain the denominator; finally, 1 is divided by the denominator. The result is the temporal span score. The value of the temporal span score is greater than 0 and less than or equal to 1. When the absolute value of the time difference is 0, the temporal span score equals 1, indicating that the effective intervention segment and the candidate anchor node completely overlap in time. As the absolute value of the time difference increases, the temporal span score monotonically decreases, reflecting that the temporal association between the effective intervention segment and the candidate anchor node is weaker the further apart they are in time. The time-series decay factor controls the rate at which the time-series span score decays with the absolute value of the time difference. The time-series decay factor is determined based on the typical time window during which an effective intervention event impacts the structured baseline data in a business scenario. The typical time window refers to the common time length experienced in business practice from the occurrence of an effective intervention event until its impact is reflected in observable attribute changes in the structured baseline data. The typical time window is determined either by an estimate provided by domain experts based on business experience, or by using the median of the interval between the occurrence time of the intervention event and the corresponding change time in the structured baseline data attribute, calculated from historical data. The time-series decay factor should cover the period from the occurrence of the effective intervention event to the present. The time span from occurrence to observable impact on structured baseline data is considered. When determining the time-series decay factor, two factors need to be considered: the response latency of the business event and the data update frequency. If the time-series decay factor is too small, the time-series span score decays to an extremely low value when the absolute value of the time difference is slightly large, resulting in an excessively low time-series span score between effective intervention segments with reasonable time intervals and candidate anchor nodes. In step S24, the effective anchoring relationship in the anchor candidate score matrix is ​​excessively suppressed by the time-series dimension. If the time-series decay factor is too large, the time-series span score remains high even with a large absolute value of the time difference, resulting in insufficient decay of the time-series span score between effective intervention segments and candidate anchor nodes that are geographically distant, weakening the discriminative power of the time dimension in step S24. For example, when the typical time window from the occurrence of an effective intervention event to the observable impact in a business scenario is Tw, the time-series decay factor can be set to 2 to 5 times Tw. The product of the semantic distance score and the temporal span score is used as the anchor candidate score that integrates the semantic and temporal dimensions. The anchor candidate score comprehensively reflects the dual correlation strength between the effective intervention paragraph and the candidate anchor node in both semantic and temporal dimensions. Only when the effective intervention paragraph and the candidate anchor node are closely related semantically and adjacent in time will the anchor candidate score obtain a high value. Insufficient correlation in either dimension will lead to a decrease in the anchor candidate score.By traversing all combinations of each effective intervention segment in the key intervention event sequence and each candidate anchor node in the static feature baseline tree, an anchor candidate score matrix is ​​obtained. The row dimension of the anchor candidate score matrix corresponds to the effective intervention segment in the key intervention event sequence, and the column dimension corresponds to the candidate anchor node in the static feature baseline tree. Each element in the matrix is ​​the anchor candidate score between the corresponding effective intervention segment and the candidate anchor node. Hash topology tags appear simultaneously in the text content of the effective intervention segment and the node identifier in the static feature baseline tree, forming an entity-level bridge between the unstructured dynamic log and the structured baseline data. On the basis of the entity-level bridge, the dual constraints of semantic distance score and temporal span score are superimposed, so that the anchor candidate score matrix not only captures the co-occurrence relationship at the entity level, but also incorporates the content association at the semantic level and the chronological logic at the temporal level.

[0035] Step S24, see Figure 7 The original attention score is calculated based on the text vector and node attribute vector of the effective intervention paragraph. The fused attention score is obtained based on the original attention score and the anchoring candidate score matrix. The fused attention score is normalized along the candidate anchoring node dimension to obtain the anchoring weight distribution of each effective intervention paragraph to all candidate anchoring nodes. When the anchoring weight value of the candidate anchoring node is greater than or equal to the preset anchoring confirmation threshold, the effective intervention paragraph is determined to be anchored to the candidate anchoring node. When the anchoring weight values ​​of all candidate anchoring nodes are less than the preset anchoring confirmation threshold, the effective intervention paragraph is marked as a free event, and the anchoring weight allocation result is obtained.

[0036] The raw attention score is calculated using a scaled dot product attention mechanism: the effective intervention paragraph text vector is used as the query vector, and the node attribute vectors of candidate anchor nodes are used as the key vectors. The dot product of the query vector and the key vector is calculated, and the dot product value is divided by the square root of the vector dimension as a scaling factor to obtain the raw attention score. The introduction of the scaling factor prevents the gradient vanishing problem in subsequent normalization processing due to the excessively large range of the dot product value when the vector dimension is large. The fused attention score is obtained based on the raw attention score and the anchor candidate score matrix: the raw attention score is added to the anchor candidate score at the corresponding position in the anchor candidate score matrix to obtain the fused attention score. After scaling by the square root of the vector dimension, the original attention score's numerical range is comparable to that of the anchor candidate score. In practical applications, if the numerical ranges of the two differ significantly due to data characteristics, a balancing coefficient can be multiplied by the anchor candidate score before addition. The balancing coefficient is determined by calculating the standard deviations of the original attention score and the anchor candidate score on the validation set, and then dividing the standard deviation of the original attention score by the standard deviation of the anchor candidate score. This quotient serves as the balancing coefficient, ensuring that the fluctuation ranges of the two scores are more consistent after addition, thus guaranteeing a balanced contribution of the two scores to the fusion result. The original attention score reflects the degree of direct matching between the effective intervention paragraph text vector and the node attribute vector in the feature space. The anchor candidate score incorporates the product constraint of the semantic distance score and the temporal span score. The addition of the two results in the fused attention score being constrained by three dimensions: feature space matching, semantic content association, and temporal proximity. Weak associations in any dimension will lower the fused attention score; only when all three dimensions exhibit strong associations will the fused attention score reach a high level. The fused attention score is normalized along the candidate anchor node dimension using a softmax operation. This softmax operation converts the fused attention score into a probability distribution, ensuring that the sum of the anchor weights of each effective intervention segment to all candidate anchor nodes equals 1, thus obtaining the anchor weight distribution of each effective intervention segment to all candidate anchor nodes. When the anchor weight of a candidate anchor node is greater than or equal to a preset anchor confirmation threshold, the effective intervention segment is determined to be anchored to a candidate anchor node, establishing a deterministic attachment relationship between the effective intervention segment and the candidate anchor node. When the anchor weights of all candidate anchor nodes are less than the preset anchor confirmation threshold, the effective intervention segment is marked as a detached event. A detached event refers to an effective intervention segment that cannot establish an attachment relationship with any node in the static feature baseline tree that meets the anchor confirmation threshold requirement.The method for determining the preset anchor confirmation threshold is as follows: First, count the number of candidate anchor nodes corresponding to each effective intervention segment in the key intervention event sequence, and calculate the average number of these candidate anchor nodes, denoted as M. When the average number of candidate anchor nodes is M, the expected weight of each candidate anchor node under uniform distribution is 1 divided by M. The anchor confirmation threshold should be set to a level greater than the expected weight value under uniform distribution to exclude the weight between effective intervention segments and candidate anchor nodes that is generated by random distribution rather than real association. The anchor confirmation threshold is a fixed value during system operation and does not change dynamically with the actual number of candidate anchor nodes for each effective intervention segment. The reason for using the average number M to calculate the anchor confirmation threshold is: to use the average level as a benchmark. This approach provides a unified judgment standard across effective intervention segments with varying numbers of candidate anchor nodes, avoiding inconsistencies caused by dynamically adjusting thresholds for each segment. When determining the anchor confirmation threshold, two factors need to be considered: the average number of candidate anchor nodes and the strictness of the anchoring relationship. If the anchor confirmation threshold is too high, some effective intervention segments with actual anchoring relationships but moderate anchoring weights will be marked as detached events, causing the fusion feature set in step S25 to miss effective intervention information. If the anchor confirmation threshold is too low, effective intervention segments may simultaneously anchor to multiple loosely related candidate anchor nodes, causing the intervention information for the same effective intervention segment in step S25 to be scattered across multiple nodes, diluting the focus of the intervention features. For example, when the average number of candidate anchor nodes is M, the anchor confirmation threshold can be set to 2 to 3 times the expected weight value of a uniform distribution, i.e., 2 divided by M to 3 divided by M. When the anchor weight value reaches 2 times the expected weight value of a uniform distribution, it indicates that the weight value obtained by the candidate anchor node is twice that in the case of random uniform distribution, and it has a preliminary association significance exceeding the random level. When it reaches 3 times, the association significance is more sufficient. In practical applications, when the business scenario has high requirements for the accuracy of the anchor relationship, a value close to 3 times is selected to improve the anchor strictness. When the business scenario pays more attention to the completeness of event coverage, a value close to 2 times is selected to reduce the risk of omission. The anchor weight allocation result is obtained, which includes the anchor status of each effective intervention segment (anchored to one or more candidate anchor nodes, or marked as a free event) and the anchor weight value corresponding to each anchor relationship. Step S24 transforms the anchoring candidate score matrix generated in step S23 into a probabilistic anchoring weight distribution through a scaling dot product attention mechanism. While retaining the dual constraints of semantic distance score and temporal span score in the anchoring candidate score matrix, a matching metric of the feature space dimension is further introduced, so that the anchoring weight allocation result has discriminative power under three-dimensional constraints.If the attention fusion and normalization process in step S24 is missing, the original scores in the anchor candidate score matrix output in step S23 lack probabilistic normalization, the anchor candidate scores between different effective intervention segments cannot be compared, and step S25 cannot determine the contribution weight ratio of each effective intervention segment to each candidate anchor node when performing feature fusion.

[0037] Step S25: Based on the anchoring weight allocation results, attach the effective intervention segments in the key intervention event sequence to the corresponding nodes of the static feature baseline tree, perform temporal topology sorting and feature dimensionality reduction, generate a temporally consistent fusion feature set, and output a structured report document.

[0038] Based on the anchoring weight allocation results, effective intervention segments from the key intervention event sequence are attached to the corresponding nodes of the static feature baseline tree. The attachment process is as follows: For each effective intervention segment whose anchoring status is anchored to a candidate anchoring node in the anchoring weight allocation results, the node identifier of the candidate anchoring node to which the effective intervention segment is anchored is read. The node corresponding to the node identifier is located in the static feature baseline tree, and the effective intervention segment is attached to the node as supplementary information. During attachment, the anchoring weight value and the original timestamp of the effective intervention segment are recorded. For effective intervention segments whose anchoring status is detached events in the anchoring weight allocation results, a detached event aggregation node is created under the root node of the static feature baseline tree, and all detached events are attached to the detached event aggregation node. After the attachment is completed, each attached node in the static feature baseline tree carries both the node attributes of the structured baseline data and the effective intervention segment information from the key intervention event sequence. The two types of information are bound together through the node. Temporal topological sorting: Temporal topological sorting refers to the process of linearly arranging sibling nodes at the same level in the static feature baseline tree and the effective intervention segments attached to the nodes according to their time attributes from earliest to latest, while maintaining the hierarchical relationship of the static feature baseline tree. The nodes of the static feature baseline tree are the objects of topological sorting, and the temporal position of the node is determined by the node's time attribute and the original timestamps of the attached effective intervention segments. When a node has multiple effective intervention segments attached, the attachment sequence is arranged in order of the original timestamps of the effective intervention segments from earliest to latest, resulting in a temporally ordered feature sequence on each node. Temporal topological sorting ensures that the temporal order of each feature item in the fused feature set is consistent with the actual temporal order of events in the original data, avoiding temporal inversion in the fused feature set due to the randomness of the node attachment order. Perform feature dimensionality reduction: For each node attached in the static feature baseline tree, the node attribute vector and all attached effective intervention paragraph text vectors are weighted and summed according to the anchor weight value to obtain a weighted fusion vector; perform principal component analysis (PCA) dimensionality reduction on the weighted fusion vector. PCA is a linear dimensionality reduction method that projects high-dimensional data to a low-dimensional space through orthogonal transformation. Principal components whose cumulative variance contribution rate reaches the preset variance retention ratio are retained to obtain the dimensionality-reduced fusion feature vector.The method for determining the preset variance retention ratio is as follows: The performance of the fused feature vectors used for downstream tasks under different variance retention ratios is compared on a validation set. Here, the validation set refers to a portion of retained data from the fused feature set, divided by the time dimension, used to evaluate the quality of the fused feature vectors under different dimensionality reduction levels. Downstream tasks refer to subsequent data analysis or prediction tasks performed using the fused feature vectors. The specific type depends on the goals of the business scenario, such as object state classification, anomaly detection, or trend prediction. The performance of downstream tasks is measured using commonly used accuracy evaluation metrics corresponding to the tasks. The minimum variance retention ratio at which the downstream task performance of the fused feature vectors tends to stabilize is selected as the preset variance retention ratio. The criterion for stabilization is: The variance retention ratio is gradually increased from a low starting point. When the improvement in downstream task performance metrics resulting from each 0.05% increase in the variance retention ratio is less than 1%, the downstream task performance is considered to have stabilized, and this variance retention ratio is taken as the preset variance retention ratio. Determining the preset variance retention ratio requires considering two factors: the degree of information retention and the dimensionality reduction. If the preset variance retention ratio is too high, too many principal components are retained, resulting in insufficient dimensionality reduction and a still high dimensionality of the fused feature vector, failing to effectively reduce the computational complexity of subsequent processing. If the preset variance retention ratio is too low, too few principal components are retained, leading to the loss of feature components contributing to downstream tasks during dimensionality reduction, and a decrease in the information content of the fused feature vector. The dimensionality-reduced fused feature vectors of all nodes in the static feature baseline tree are aggregated in temporal topological sorting order to generate a temporally consistent fused feature set. Temporal consistency means that the timestamp order of each feature entry in the fused feature set strictly matches the occurrence order of the corresponding events and baseline records in the original data, with no temporal contradictions. Output a structured report document: Each feature entry in the fused feature set, along with its corresponding node identifier, node attribute summary, event category label of the attached effective intervention segment, and anchor weight value, is organized into a tree-like report format according to the hierarchical structure of the static feature baseline tree and the temporal topology sorting, generating a structured report document. Step S25 aggregates all intermediate results from steps S21 to S24 into the final output. The static feature baseline tree provides the hierarchical skeleton, the key intervention event sequence provides dynamic information in the time dimension, the anchor weight allocation results provide the correlation strength between the two, and feature dimensionality reduction compresses the multi-dimensional fused information into a dimensional space suitable for downstream use. Without the temporal topology sorting in step S25, the feature entries in the fused feature set will lack an ordered arrangement in the time dimension, and downstream tasks will be unable to reconstruct the chronological logic of events when reading the fused feature set, thus losing the reliability of the time series analysis.

[0039] In step S20, step S21 reconstructs all key-value pairs of the structured baseline data in the anonymized heterogeneous corpus into a static feature baseline tree based on hierarchical field identifiers. Hash topology tags are used as node identifiers to extend the entity identification system established in the anonymization stage to the feature construction stage. This allows the hash topology tags generated in step S10 to directly act as a bridge for entity-level matching in step S23, eliminating the need to re-establish entity correspondences in the feature construction stage. Step S22 uses text classification and noise filtering to exclude noisy segments from the key intervention event sequences in the unstructured dynamic logs. This ensures that step S23 only constructs an anchor candidate score matrix between effective intervention segments and candidate anchor nodes. Each element in the anchor candidate score matrix carries effective semantic and temporal association information, simultaneously improving the sparsity and information density of the matrix. Step S23 multiplies the semantic distance score by the temporal span score to obtain the anchoring candidate score. This superimposes the semantic and temporal constraints on top of the entity-level co-occurrence relationship, giving the anchoring candidate score matrix multi-dimensional discriminative power: if two effective intervention segments and candidate anchoring nodes that have a co-occurrence relationship at the entity level are semantically unrelated or temporally far apart, their anchoring candidate scores will still be low, avoiding false anchoring caused by relying solely on entity co-occurrence. Step S24 fuses the anchoring candidate score matrix with the original attention score through a scaled dot product attention mechanism and normalizes it using softmax. This transforms the comprehensive score with three-dimensional constraints into a probabilistic anchoring weight distribution, giving the contribution ratio of each effective intervention segment to each candidate anchoring node an interpretable probabilistic meaning. Step S25, when performing weighted summation, accurately allocates the fusion contribution of effective intervention segments to each node based on the anchoring weight values. The temporal topological sorting in step S25 ensures that the temporal order of the feature entries in the fused feature set is strictly consistent with the true temporal order of the original data. Feature dimensionality reduction compresses the high-dimensional fused vector into a low-dimensional space that retains the core variance through principal component analysis, achieving a balance between dimensionality reduction and information preservation. In the anonymized heterogeneous corpus, structured baseline data records the baseline attributes of objects in the form of static key-value pairs, while unstructured dynamic logs record intervention events in the form of time-series segments. The two types of data belong to different data modalities and lack natural correlation paths. Directly splicing the features of the two types of data will lose the semantic and temporal correlation logic, resulting in the fused features lacking object-level attribution relationships and temporal consistency. Step S20 establishes a hierarchical skeleton by constructing a static feature baseline tree, eliminates noise interference by screening key intervention event sequences, and establishes an accurate correspondence between effective intervention segments and structured baseline nodes in the three dimensions of semantics, temporality, and feature space by anchoring candidate score matrices and attention mechanisms. Through temporal topological sorting and feature dimensionality reduction, a temporally consistent and dimensionally adapted fused feature set is generated, enabling features from different data modalities to be fused under a unified hierarchical structure and time coordinate.

[0040] Example 2: This embodiment, based on Embodiment 1, provides a multi-dimensional feature cleaning and desensitization system for massive heterogeneous time-series data, such as... Figure 8 As shown, it includes: Heterogeneous data desensitization module: Obtains the set of business data to be processed, performs data source type determination on the set of business data to be processed, and obtains a set of structured baseline key-value pairs and a set of dynamic log paragraphs; performs multi-granularity named entity recognition, cross-document entity alignment and irreversible hash transformation on the set of structured baseline key-value pairs and the set of dynamic log paragraphs to generate an implicit coreference mapping table; performs in-situ entity replacement on the set of structured baseline key-value pairs and the set of dynamic log paragraphs according to the implicit coreference mapping table to generate a desensitized heterogeneous corpus; Baseline event construction module: Constructs a static feature baseline tree for the portion of the data source type marked as structured baseline data in the anonymized heterogeneous corpus; constructs a key intervention event sequence for the portion of the data source type marked as unstructured dynamic logs in the anonymized heterogeneous corpus; Anchoring fusion output module: Based on the key intervention event sequence, candidate anchoring nodes are located in the static feature baseline tree, and an anchoring candidate score matrix is ​​constructed; weight allocation is performed on the anchoring candidate score matrix to obtain the anchoring weight allocation result; a time-consistent fusion feature set is generated based on the anchoring weight allocation result and a structured report document is output.

[0041] Furthermore, in the heterogeneous data anonymization module, the method for determining the data source type includes: The system reads the metadata attributes of each record in the business data set to be processed. The metadata attributes include three dimensions: the record's file format identifier, the frequency of field separator occurrences, and the variance of text line lengths. When the record's file format identifier belongs to a preset list of structured formats, the data source type is marked as structured baseline data. When the record's file format identifier does not belong to the preset list of structured formats, the system calculates the variance of the length of all text lines in the record. If the variance of the text line length is greater than or equal to a preset unstructured decision variance threshold, the data source type is marked as unstructured dynamic log. If the variance of the text line length is less than the preset unstructured decision variance threshold, and the frequency of field separator occurrences is greater than or equal to a preset lower limit for separator frequency, the data source type is marked as structured baseline data; otherwise, the data source type is marked as unstructured dynamic log.

[0042] The method for obtaining the set of structured baseline key-value pairs and the set of dynamic log segments includes: Records with data source type marked as structured baseline data are decomposed at the field level to obtain a set of structured baseline key-value pairs with hierarchical field identifiers and original creation timestamps. Records with data source type marked as unstructured dynamic logs are processed by text segmentation. Each timestamp is used as the starting position of a new segment, and all text content between two adjacent timestamps is grouped into the same segment to obtain a set of dynamic log segments with timestamps.

[0043] The methods and systems of this application may be implemented in many ways. For example, they may be implemented by software, hardware, firmware, or any combination of software, hardware, and firmware. The above-described order of steps for the method is for illustrative purposes only, and the steps of the method of this application are not limited to the order specifically described above, unless otherwise specifically stated.

[0044] In addition, the parts of the technical solutions provided in the embodiments of this application that are consistent with the implementation principles of the corresponding technical solutions in the prior art have not been described in detail, so as to avoid excessive elaboration.

[0045] The specific embodiments described above further illustrate the purpose, technical solution, and beneficial effects of the present invention. It should be understood that the above descriptions are merely specific embodiments of the present invention and are not intended to limit the invention. Any modifications, equivalent substitutions, or improvements made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A multi-dimensional feature cleaning and desensitization method for massive heterogeneous time-series data, characterized in that, The method includes: The system acquires a set of business data to be processed, performs data source type determination on the set, and obtains a set of structured baseline key-value pairs and a set of dynamic log segments. The key-value pairs in the set of structured baseline key-value pairs have hierarchical field identifiers and original creation timestamps, and the segments in the set of dynamic log segments have timestamps. Multi-granularity named entity recognition is performed on the set of structured baseline key-value pairs and the set of dynamic log segments to obtain an original privacy entity list. Cross-document entity alignment is performed on the original privacy entity list to obtain a unique set of deduplicated privacy entities. Irreversible hash transformation is performed on the unique set of deduplicated privacy entities to generate an implicit coreference mapping table. In-situ entity replacement is performed on the set of structured baseline key-value pairs and the set of dynamic log segments based on the implicit coreference mapping table to generate a desensitized heterogeneous corpus. The method of irreversible hash transformation includes: concatenating the normalized representation of each unique privacy entity in the deduplicated set of unique privacy entities with a system-level fixed salt value string; performing a hash operation on the concatenated string and truncating it according to a preset truncation length to obtain a set of hash topological tags; establishing a bidirectional index between each hash topological tag and the key-value pair number and the character offset within the key-value pair, the paragraph number and the character offset within the paragraph of the corresponding unique privacy entity to obtain an implicit coreference mapping table; A static feature baseline tree is constructed for the portion of the anonymized heterogeneous corpus whose data source type is marked as structured baseline data. This static feature baseline tree uses hash topological tags as node identifiers, values ​​in key-value pairs as node attributes, and the original creation timestamp as the node time attribute, and is concatenated according to the hierarchical relationship of the hierarchical field identifiers. For the portion of the anonymized heterogeneous corpus whose data source type is marked as unstructured dynamic logs, a key intervention event sequence consisting of effective intervention paragraphs is constructed. Based on the key intervention event sequence, candidate anchor nodes are located in the static feature baseline tree, and an anchor candidate score matrix is ​​constructed. Weight allocation is performed on the anchor candidate score matrix to obtain the anchor weight allocation result. Based on the anchor weight allocation result, a time-series self-consistent fusion feature set is generated, and a structured report document is output. The process of locating candidate anchor nodes includes: extracting all hash topological tags contained in each effective intervention segment in the key intervention event sequence, locating nodes that match the hash topological tags in the static feature baseline tree, and obtaining a set of candidate anchor nodes; The construction of the anchoring candidate score matrix includes: calculating the semantic distance score and temporal span score between the effective intervention paragraph and the candidate anchoring node. Each element in the anchoring candidate score matrix is ​​the product of the semantic distance score and the temporal span score. The temporal span score is obtained by calculating the absolute value of the time difference between the original timestamp of the effective intervention paragraph and the node time attribute of the candidate anchoring node. The method for generating a time-series self-consistent fusion feature set includes: attaching effective intervention segments in the key intervention event sequence to the corresponding nodes of the static feature baseline tree according to the anchoring weight allocation results, performing time-series topological sorting and feature dimensionality reduction, and generating a time-series self-consistent fusion feature set.

2. The multi-dimensional feature cleaning and desensitization method for massive heterogeneous time-series data according to claim 1, characterized in that, The method for determining the data source type includes: The system reads the metadata attributes of each record in the business data set to be processed. The metadata attributes include three dimensions: the record's file format identifier, the frequency of field separator occurrences, and the variance of text line lengths. When the record's file format identifier belongs to a preset list of structured formats, the data source type is marked as structured baseline data. When the record's file format identifier does not belong to the preset list of structured formats, the system calculates the variance of the length of all text lines in the record. If the variance of the text line length is greater than or equal to a preset unstructured decision variance threshold, the data source type is marked as unstructured dynamic log. If the variance of the text line length is less than the preset unstructured decision variance threshold, and the frequency of field separator occurrences is greater than or equal to a preset lower limit for separator frequency, the data source type is marked as structured baseline data; otherwise, the data source type is marked as unstructured dynamic log.

3. The multi-dimensional feature cleaning and desensitization method for massive heterogeneous time-series data according to claim 2, characterized in that, The method for obtaining the set of structured baseline key-value pairs and the set of dynamic log segments includes: Records with data source type marked as structured baseline data are decomposed at the field level to obtain a set of structured baseline key-value pairs with hierarchical field identifiers and original creation timestamps. Records with data source type marked as unstructured dynamic logs are processed by text segmentation. Each timestamp is used as the starting position of a new segment, and all text content between two adjacent timestamps is grouped into the same segment to obtain a set of dynamic log segments with timestamps.

4. The multi-dimensional feature cleaning and desensitization method for massive heterogeneous time-series data according to claim 1, characterized in that, The method for multi-granularity named entity recognition includes: Sequence labeling is performed on the structured baseline key-value pair set to extract text fragments belonging to the preset privacy entity category and record the key-value pair number and the character offset within the key-value pair, resulting in a structured privacy entity sublist; the same sequence labeling is performed on the dynamic log paragraph set to extract text fragments belonging to the preset privacy entity category and record the paragraph number and the character offset within the paragraph, resulting in a dynamic privacy entity sublist; the structured privacy entity sublist and the dynamic privacy entity sublist are merged to obtain the original privacy entity list.

5. The multi-dimensional feature cleaning and desensitization method for massive heterogeneous time-series data according to claim 4, characterized in that, The method for cross-document entity alignment includes: For each pair of privacy entities in the original privacy entity list, a text similarity score is calculated. When the text similarity score is greater than or equal to the preset entity alignment threshold, the two privacy entities are grouped into the same entity cluster. After traversal, multiple entity clusters are obtained, and each entity cluster corresponds to a unique real-world object. For each entity cluster, the text form with the highest frequency is selected as the normalized representation to obtain a unique set of deduplicated privacy entities.

6. The multi-dimensional feature cleaning and desensitization method for massive heterogeneous time-series data according to claim 5, characterized in that, The method for constructing a static feature baseline tree includes: Read all key-value pairs marked as structured baseline data from the anonymized heterogeneous corpus. Based on the hierarchical field identifier, key-value pairs with the same parent hierarchical field identifier are grouped into the same hierarchical group, resulting in multiple hierarchical groups. For each hierarchical group, construct a subtree using a hash topology tag as the node identifier, the value in the key-value pair as the node attribute, and the original creation timestamp as the node time attribute. Concatenate all the subtrees of the hierarchical groups according to the hierarchical relationship of the hierarchical field identifier to obtain the static feature baseline tree.

7. The multi-dimensional feature cleaning and desensitization method for massive heterogeneous time-series data according to claim 6, characterized in that, For each time-stamped paragraph in the anonymized heterogeneous corpus, which is labeled as an unstructured dynamic log, text classification is performed, and the confidence score of the time-stamped paragraph belonging to the preset effective intervention event category is calculated. When the confidence score is greater than or equal to the preset noise filtering threshold, the time-stamped paragraph is retained and marked as an effective intervention paragraph; when the confidence score is less than the preset noise filtering threshold, the time-stamped paragraph is removed. All effective intervention paragraphs are arranged in chronological order according to their original timestamps to obtain the key intervention event sequence.

8. The multi-dimensional feature cleaning and desensitization method for massive heterogeneous time-series data according to claim 7, characterized in that, The construction of the anchored candidate score matrix specifically includes: Vectorization encoding is performed on the text content of the effective intervention paragraph and the node attributes of each candidate anchor node in the candidate anchor node set. The cosine similarity value between the text vector of the effective intervention paragraph and the node attribute vector is calculated as the semantic distance score. The product of the semantic distance score and the temporal span score is used as the anchor candidate score. All combinations of effective intervention paragraphs and candidate anchor nodes are traversed to obtain the anchor candidate score matrix.

9. A multi-dimensional feature cleaning and desensitization system for massive heterogeneous time-series data, used to implement the multi-dimensional feature cleaning and desensitization method for massive heterogeneous time-series data as described in any one of claims 1-8, characterized in that, The system includes: Heterogeneous data desensitization module: Obtains the set of business data to be processed, performs data source type determination on the set of business data to be processed, and obtains a set of structured baseline key-value pairs and a set of dynamic log paragraphs; performs multi-granularity named entity recognition, cross-document entity alignment and irreversible hash transformation on the set of structured baseline key-value pairs and the set of dynamic log paragraphs to generate an implicit coreference mapping table; performs in-situ entity replacement on the set of structured baseline key-value pairs and the set of dynamic log paragraphs according to the implicit coreference mapping table to generate a desensitized heterogeneous corpus; Baseline event construction module: Constructs a static feature baseline tree for the portion of the data source type marked as structured baseline data in the anonymized heterogeneous corpus; constructs a key intervention event sequence for the portion of the data source type marked as unstructured dynamic logs in the anonymized heterogeneous corpus; Anchoring fusion output module: Based on the key intervention event sequence, candidate anchoring nodes are located in the static feature baseline tree, and an anchoring candidate score matrix is ​​constructed; weight allocation is performed on the anchoring candidate score matrix to obtain the anchoring weight allocation result; a time-consistent fusion feature set is generated based on the anchoring weight allocation result and a structured report document is output.

Images