A business lead anomaly detection and real-time early warning method and system based on time series prediction

Abstract

The embodiment of the application discloses a business lead abnormality detection and real-time early warning method and system based on time series prediction, the embodiment of the application collects lead data of each channel and carries out pretreatment, and forms independent time series according to channel dimension grouping; a Holt-Winters cubic exponential smoothing model is constructed for each channel respectively, a sliding window mechanism is adopted to train and dynamically update model parameters, and a prediction value and a confidence interval are output; the residual between the actual value and the prediction value is calculated in real time, multi-dimensional abnormality judgment is carried out in combination with residual significance, continuous abnormal duration, channel weight and historical fluctuation interval, and an abnormality grade is output; when it is judged that an abnormality occurs, the abnormality information is pushed to the specified user or group in real time through the WeChat robot of the enterprise. The application realizes the advance prediction and dynamic abnormality identification of the lead quantity change, effectively reduces the false positive rate and the false negative rate, reduces the manual intervention, and improves the real-time performance and accuracy of the business early warning.

Description

Technical Field

[0001] This invention relates to the field of data processing and early warning technology, specifically to a method and system for anomaly detection and real-time early warning of business leads based on time series prediction. Background Technology

[0002] With the rapid development of internet platform businesses, user intent data (such as car purchase leads) from various channels has become a core resource driving business decisions. Taking used car business platforms as an example, these platforms typically acquire user car purchase intent leads through multiple key channels such as Yiche APP, Quote Daquan APP, and Dongchedi. A stable increase in the number of leads is a crucial indicator of healthy business operation, and effectively monitoring and issuing early warnings about its changing trends is of great significance.

[0003] Currently, the business platform mainly relies on the following two known methods to monitor the number of leads:

[0004] (I) Manual statistics and manual early warning methods

[0005] The platform periodically tallies the number of leads from each channel, which is then manually compared by operations staff with data from the previous day or the same period last week. If a significant drop is observed, relevant personnel are notified manually via message or email. This method relies entirely on manual operation and lacks automated data collection, analysis, and notification mechanisms.

[0006] (ii) Fixed threshold alarm method

[0007] Some platforms use a simple threshold alarm mechanism, which pre-sets a fixed lower limit for the number of leads. When the actual number of leads falls below this threshold, an alarm is triggered. While this method achieves a certain degree of automation, the fixed threshold cannot adapt to the natural fluctuations in different time periods and channels.

[0008] Furthermore, in the field of time series forecasting and anomaly detection, various technical solutions are known. For example, some solutions use the Holt-Winters model to predict time series data and detect anomalies through the prediction residuals; others use dynamic threshold functions to determine the anomaly threshold range to detect alarm events; still others combine sliding window statistics with methods such as isolated forests to achieve anomaly early warning for industrial time series data. Regarding early warning notifications, techniques for pushing alarm information through instant messaging tools such as WeChat for Enterprise are known.

[0009] The aforementioned existing technical solutions have the following drawbacks:

[0010] (i) Lack of predictive ability, only able to detect anomalies after the fact.

[0011] Existing methods, such as manual statistics and fixed thresholds, are retrospective analysis approaches. They can only detect anomalies after a significant decline in the number of leads has occurred, failing to identify potential risks of a decline in leads in advance. This results in business departments often only being notified after the problem has worsened, missing the opportunity for early intervention.

[0012] (ii) The threshold is static and cannot adapt to periodic changes.

[0013] The fixed threshold method does not consider the trend and seasonal characteristics of time series data. The number of leads is affected by factors such as holidays, promotional activities, and the weekend effect, showing a clear periodic fluctuation pattern. The fixed threshold cannot distinguish between normal periodic fluctuations and genuine business anomalies, resulting in frequent false alarms during peak periods and missed false alarms during off-peak periods.

[0014] (iii) Lack of automated linkage and serious response delay.

[0015] The existing anomaly detection and notification process is not effectively integrated, requiring manual intervention to complete the entire process from anomaly detection to notification delivery. This manual intermediary mode significantly extends the early warning response time and makes real-time early warning impossible.

[0016] (iv) False alarms and false alarms coexist, resulting in insufficient accuracy of early warnings.

[0017] Existing schemes do not fully consider the trend and seasonal characteristics of time series data, leading to normal fluctuations being misjudged as anomalies (false alarms) or genuine anomalies being ignored (false negatives). Furthermore, existing schemes typically rely on thresholds of only one dimension to determine anomalies, lacking a mechanism for comprehensive multi-dimensional judgment, which further reduces the accuracy of early warnings.

[0018] (v) Lack of refined monitoring capabilities across different channels

[0019] Existing solutions typically use a uniform monitoring standard for all channels, without considering the differences in business characteristics and fluctuation patterns of different channels, thus failing to achieve refined prediction and early warning for each channel. Summary of the Invention

[0020] To address this, embodiments of the present invention provide a business lead anomaly detection and real-time early warning method and system based on time series prediction, in order to solve the technical problems of existing technologies that lack dynamic prediction and adaptive anomaly judgment mechanisms based on time series, resulting in the inability to identify risks in advance, high false alarm rates, and delayed response.

[0021] To achieve the above objectives, the embodiments of the present invention provide the following technical solutions:

[0022] According to a first aspect of the present invention, a method for anomaly detection and real-time early warning of business leads based on time series prediction is provided, the method comprising:

[0023] Lead data from various channels is collected from the business database. The collected lead data is cleaned and standardized, and the data is grouped according to the channel dimension to form independent time series data for each channel.

[0024] For the time series data of each channel, a Holt-Winters triple exponential smoothing model is constructed. The model includes three smoothing parameters: horizontal smoothing coefficient α, trend smoothing coefficient β, and seasonal smoothing coefficient γ. The sliding window mechanism is used to train the model based on historical data, automatically search for the optimal parameter combination for each channel, and dynamically retrain and update the model daily based on the latest data.

[0025] The trained Holt-Winters model is used to predict the number of leads from each channel at future time points in real time, and the predicted values ​​and corresponding confidence intervals are output.

[0026] The residual between the actual value of the number of leads from each channel and the model prediction value is calculated in real time. Based on the residual, a multi-dimensional anomaly determination is performed. The multi-dimensional anomaly determination includes at least residual significance determination, continuous anomaly duration determination, channel weight determination, and historical fluctuation range determination. The anomaly level is output through a multi-dimensional weighted algorithm.

[0027] When an abnormal number of leads from a certain channel is detected, an alert notification is triggered, and the abnormal information is pushed to designated users or groups in real time via the WeChat Work robot.

[0028] Furthermore, the collected clue data is hourly data, with fields including time, channel, and number of clues; the cleaning and standardization process includes: imputing and smoothing missing values ​​and abnormal peaks, uniformly converting the time field into an hourly timestamp format, and normalizing the number of clues to adapt to the Holt-Winters model input.

[0029] Furthermore, the Holt-Winters triple exponential smoothing model adopts an additive model form, and the calculation formulas for its horizontal term Lt, trend term Tt, and seasonal term St are as follows:

[0030] Lt=α×(Yt / S(tL))+(1-α)×(L(t-1)+T(t-1))

[0031] Tt=β×(Lt-L(t-1))+(1-β)×T(t-1)

[0032] St = γ × (Yt / Lt) + (1 - γ) × S(tL)

[0033] The formula for calculating the predicted value Ft+m at the m-th time point in the future is:

[0034] Ft+m=(Lt+m×Tt)×S(t-L+m)

[0035] Where Yt is the actual value at time t, and L is the period length.

[0036] Furthermore, the sliding window mechanism used in the model training specifically involves: performing sliding window prediction based on historical data from the past 30 days, and automatically searching for the optimal combination of smoothing parameters (α, β, γ) that minimizes the prediction error.

[0037] Furthermore, when performing anomaly detection, the 3σ principle is used to set the residual threshold. When the calculated residual exceeds 3 times the standard deviation, it is initially judged as an abnormal fluctuation.

[0038] Furthermore, the anomaly levels include three levels: ordinary anomaly, severe anomaly, and emergency anomaly; different anomaly levels correspond to different early warning strategies and notification priorities.

[0039] Furthermore, the abnormal information pushed by the WeChat Work robot should include at least the following: time of occurrence of the abnormality, abnormal channel identifier, predicted value, actual value, deviation percentage, and abnormality level.

[0040] Furthermore, the method also includes:

[0041] Abnormal events are recorded in the monitoring database and displayed in real time on the visualization dashboard, including channel information, time information, predicted value, actual value, deviation percentage, and abnormality level.

[0042] According to a second aspect of the present invention, a business lead anomaly detection and real-time early warning system based on time series prediction is provided, the system comprising:

[0043] The data acquisition and preprocessing module is used to collect lead data from various channels from the business database, clean and standardize the collected lead data, and group the data according to the channel dimension to form independent time series data for each channel.

[0044] The time series forecasting model module is used to construct a Holt-Winters triple exponential smoothing model for time series data of each channel. The model includes three smoothing parameters: horizontal smoothing coefficient α, trend smoothing coefficient β, and seasonal smoothing coefficient γ. The model is trained based on historical data using a sliding window mechanism, automatically searches for the optimal parameter combination for each channel, dynamically retrains and updates the model daily based on the latest data, and uses the trained model to predict the number of leads for each channel at future time points in real time, outputting the predicted value and the corresponding confidence interval.

[0045] The anomaly detection module is used to calculate the residual between the actual value and the model prediction value of the number of leads in each channel in real time, and to perform multi-dimensional anomaly judgment based on the residual. The multi-dimensional anomaly judgment includes at least residual significance judgment, continuous anomaly duration judgment, channel weight judgment and historical fluctuation range judgment, and outputs the anomaly level through a multi-dimensional weighted algorithm.

[0046] The early warning notification module is used to trigger an early warning notification when the anomaly detection module determines that the number of leads from a certain channel is abnormal. The abnormal information is pushed to the designated user or group in real time through the WeChat Work robot.

[0047] Furthermore, the system also includes:

[0048] The model service deployment unit is used to encapsulate the Holt-Winters model as an independent microservice, supporting RESTful interface calls;

[0049] An asynchronous scheduling unit is used to trigger prediction tasks via scheduled tasks or message queues and update prediction results at an hourly frequency.

[0050] The caching and batch processing unit is used to cache prediction results and historical data in Redis, and to perform real-time monitoring of multiple channels using batch prediction and parallel multi-threading mechanisms.

[0051] The embodiments of the present invention have the following advantages:

[0052] This invention collects and preprocesses lead data from various channels, grouping it by channel dimension to form independent time series. For each channel, a Holt-Winters cubic exponential smoothing model is constructed, trained using a sliding window mechanism and dynamically updated with model parameters, outputting predicted values ​​and confidence intervals. The residual between actual and predicted values ​​is calculated in real time, and multi-dimensional anomaly determination is performed based on residual significance, duration of continuous anomalies, channel weights, and historical fluctuation ranges, outputting the anomaly level. When an anomaly is detected, the anomaly information is pushed to designated users or groups in real time via a WeChat Work robot. This invention achieves advance prediction of lead quantity changes and dynamic anomaly identification, effectively reducing false positive and false negative rates, minimizing manual intervention, and improving the real-time performance and accuracy of business early warnings. Attached Figure Description

[0053] To more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are merely exemplary, and those skilled in the art can derive other embodiments based on the provided drawings without creative effort.

[0054] The structures, proportions, sizes, etc. illustrated in this specification are only for the purpose of assisting those skilled in the art in understanding and reading the content disclosed herein, and are not intended to limit the conditions under which the present invention can be implemented. Therefore, they have no substantial technical significance. Any modifications to the structure, changes in the proportions, or adjustments to the size, without affecting the effects and objectives that the present invention can produce, should still fall within the scope of the technical content disclosed in the present invention.

[0055] Figure 1 This is a schematic diagram of the logical structure of a business clue anomaly detection and real-time early warning system based on time series prediction provided by an embodiment of the present invention;

[0056] Figure 2 This is a flowchart illustrating a business lead anomaly detection and real-time early warning method based on time series prediction, provided in an embodiment of the present invention. Detailed Implementation

[0057] The following specific embodiments illustrate the implementation of the present invention. Those skilled in the art can easily understand other advantages and effects of the present invention from the content disclosed in this specification. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0058] refer to Figure 1 This invention discloses a business clue anomaly detection and real-time early warning system based on time series prediction. The system includes: a data acquisition and preprocessing module 1; a time series prediction model module 2; anomaly detection module 3; and early warning notification module 4.

[0059] I. Data Acquisition and Preprocessing

[0060] The system collects lead data from various channels from the business database through a data acquisition module. Specifically, the system automatically extracts hourly lead data from key channels daily from the business database, collecting fields including timestamp, channel identifier, and lead count. In this embodiment, the time field uses UTC time format, the channel identifier uses channel code (e.g., "channel_01" represents the first channel, "channel_02" represents the second channel, and "channel_03" represents the third channel), and the lead count is an integer representing the number of user car purchase intention messages from that channel within the corresponding hour.

[0061] The system cleans and standardizes the collected clue data. Specifically, the cleaning and standardization process includes the following sub-steps:

[0062] Missing values ​​are imputed. When a channel lacks clue data at a certain point in time, the system uses linear interpolation to impute the missing value, that is, it uses the average of the clue data at adjacent time points before and after the missing time point. For example, if the first channel lacks clue data at 14:00 on July 28, 2026, it will be imputed using the average of the clue data at 13:00 and 15:00 on July 28, 2026.

[0063] Abnormal peak values ​​are smoothed. When the clue data of a certain channel deviates significantly from the data trend of the time points before and after it at a certain point in time (for example, the deviation exceeds 3 times the standard deviation), the system uses the moving average method to smooth the abnormal peak value, replacing the clue data of that time point with the moving average of the data of several time points before and after it.

[0064] The time fields are uniformly converted to an hourly timestamp format. The system converts all collected time fields into a Unix timestamp format (accurate to the hour) to facilitate subsequent time series modeling.

[0065] The number of leads is normalized to fit the input requirements of the Holt-Winters model. The system uses the Min-Max normalization method to linearly map the number of leads from each channel to the range [0,1].

[0066] The system groups data by channel, creating independent time-series data for each channel. Specifically, the system uses the channel identifier as the grouping key to organize the cleaned and standardized data into independent time series according to different channels. Each time series is arranged in chronological order, with hours as the time unit. For example, the first channel forms one independent time series, the second channel forms another independent time series, the third channel forms yet another independent time series, and so on.

[0067] II. Construction and Training of Time Series Forecasting Models

[0068] The system constructs a Holt-Winters triple exponential smoothing model for the time series data of each channel. The Holt-Winters triple exponential smoothing model is a time series forecasting model based on weighted exponential smoothing, capable of forecasting time series data with trends and periods. The model includes three smoothing parameters: a horizontal smoothing coefficient α, a trend smoothing coefficient β, and a seasonal smoothing coefficient γ.

[0069] In this embodiment, the Holt-Winters triple exponential smoothing model is implemented using an additive model. Additive models are suitable for scenarios where the amplitude of seasonal fluctuations does not change over time. The model comprises three core equations: a level equation, a trend equation, and a seasonal equation.

[0070] The formula for calculating the horizontal equation Lt is:

[0071] Lt=α×(Yt / S(tL))+(1-α)×(L(t-1)+T(t-1))

[0072] Where Lt represents the horizontal term at time t (i.e., the baseline value after removing the trend and seasonal components), Yt represents the actual observed value at time t, S(tL) represents the seasonal term at time (tL), L represents the period length (in this embodiment, since the cue data exhibits a daily periodicity with a period of 24 hours, L is 24), L(t-1) represents the horizontal term at time (t-1), T(t-1) represents the trend term at time (t-1), and α is the horizontal smoothing coefficient, with a value range of (0,1).

[0073] The formula for calculating the trend equation Tt is:

[0074] Tt=β×(Lt-L(t-1))+(1-β)×T(t-1)

[0075] Where Tt represents the trend term (i.e. the trend of the level term) at time t, Lt and L(t-1) represent the level terms at time t and (t-1) respectively, T(t-1) represents the trend term at time (t-1), and β is the trend smoothing coefficient, with a value range of (0,1).

[0076] The formula for calculating the seasonal equation St is:

[0077] St = γ × (Yt / Lt) + (1 - γ) × S(tL)

[0078] Where St represents the seasonal term (i.e., the periodic fluctuation component) at time point t, Yt represents the actual observed value at time point t, Lt represents the horizontal term at time point t, S(tL) represents the seasonal term at time point (tL), L represents the period length, and γ is the seasonal smoothing coefficient, with a value range of (0,1).

[0079] The formula for calculating the predicted value Ft+m at the m-th time point in the future is:

[0080] Ft+m=(Lt+m×Tt)×S(t-L+m)

[0081] Where Ft+m represents the predicted value at time (t+m), Lt represents the horizontal term at time t, m represents the prediction step size (i.e., the m-th future time point), Tt represents the trend term at time t, and S(t-L+m) represents the seasonal term at time (t-L+m).

[0082] The system employs a sliding window mechanism for model training based on historical data. Specifically, the system performs sliding window predictions based on historical data from the past 30 days. Taking July 28, 2026 as an example, the system selects historical clue data from June 28, 2026 to July 27, 2026 (30 days) as the training set to train the Holt-Winters model. Then, it uses the trained model to predict the number of clues for each hour on July 28, 2026. The next day (July 29, 2026), the system moves the sliding window forward one day, retrains the model using historical data from June 29, 2026 to July 28, 2026, and so on.

[0083] The system automatically searches for the optimal parameter combination for each channel. Specifically, the system employs a grid search method, traversing all possible (α, β, γ) combinations in a preset parameter space, aiming to minimize the prediction error, and automatically searching for the optimal smooth parameter combination that minimizes the prediction error. In this embodiment, the search range for α, β, and γ is (0, 1), the search step size is 0.05, and the prediction error is measured using the root mean square error (RMSE).

[0084] The system dynamically retrains and updates the model daily based on the latest data. Specifically, the system automatically triggers a model retraining task at 00:00 every day, incorporating the latest data from the previous day into the training set, re-executing the model training and parameter search process, and updating the model parameters for each channel. This allows the model to continuously track the latest trends and seasonal changes in clue data, achieving continuous adaptive optimization.

[0085] III. Real-time Prediction

[0086] The system uses a pre-trained Holt-Winters model to predict the number of leads at future time points from each channel in real time, and outputs the predicted value and the corresponding confidence interval. In this embodiment, the system uses hours as the prediction step size and uses the pre-trained Holt-Winters model for each channel to predict the number of leads in the next 1 hour, 2 hours, 3 hours... up to 24 hours.

[0087] The system also outputs the confidence interval of the predicted value. Specifically, based on the distribution of historical prediction residuals, the system calculates the standard deviation σ of the predicted value, and then uses the predicted value ± k×σ as the confidence interval (k is a constant, and in this embodiment, k=3, i.e., a 3σ confidence interval) for subsequent anomaly detection and judgment. For example, for the number of clues in the first channel at 15:00 on July 28, 2026, the system predicts a value of 1500 clues and a prediction standard deviation of 50 clues, then its 3σ confidence interval is [1350, 1650 clues].

[0088] IV. Anomaly Detection

[0089] The system calculates the residual between the actual number of leads from each channel and the model's predicted value in real time. The formula for calculating the residual is: Residual = Actual value - Predicted value. When the actual value is lower than the predicted value, the residual is negative, indicating a decline in the number of leads.

[0090] The system performs multi-dimensional anomaly detection based on the residuals. This multi-dimensional anomaly detection includes at least residual significance determination, duration of continuous anomalies determination, channel weight determination, and historical fluctuation range determination. Specifically:

[0091] In the residual significance determination dimension, the system uses the 3σ principle to set the residual threshold. When the absolute value of the calculated residual exceeds 3 times the standard deviation (i.e., |residual|>3σ), the system initially determines that there is abnormal fluctuation at that time point. For example, if the predicted value for a certain hour in the first channel is 1500, the actual value is 1200, and the residual is -300, while the prediction standard deviation σ for that channel is 50, then 3σ=150, and |residual|=300>150, so the system initially determines that there is abnormal fluctuation at that time point.

[0092] In the continuous anomaly duration determination dimension, the system counts the number of consecutive time points when abnormal fluctuations occur in a certain channel. When the continuous anomaly duration exceeds a preset threshold (in this embodiment, the preset threshold is 2 hours), the system increases the severity of the anomaly by one level. For example, if the first channel experiences abnormal fluctuations with residuals exceeding 3σ for 3 consecutive hours, the system increases the severity of the anomaly from ordinary to severe.

[0093] In the channel weighting determination dimension, the system presets different weight values ​​for different channels. The higher the weight value, the more significant the impact of the channel on the business conversion rate, and the higher the priority of its abnormal fluctuations. In this embodiment, the weights of the three key channels are 0.4, 0.3, and 0.3, respectively. When comprehensively determining the anomaly level, the system incorporates the channel weight as a weighting factor into the calculation.

[0094] In the historical fluctuation range determination dimension, the system statistically analyzes the fluctuation range of clue data from each channel at the same point in time over the past 30 days, which is taken as the normal fluctuation range for that point in time. When the current actual value falls within the historical normal fluctuation range, the system will lower the level of the abnormal event even if the residual exceeds the 3σ threshold; conversely, if the current actual value deviates significantly from the historical normal fluctuation range, the system will raise the level of the abnormal event.

[0095] The system outputs the final anomaly level through a multi-dimensional weighted algorithm. Specifically, the system assigns different weight coefficients to the judgment results of the above four dimensions, performs weighted summation to obtain a comprehensive anomaly score, and then outputs the corresponding anomaly level based on the threshold range in which the comprehensive anomaly score falls. In this embodiment, the anomaly levels include three levels: ordinary anomaly, severe anomaly, and emergency anomaly. Different anomaly levels correspond to different warning strategies and notification priorities: ordinary anomalies correspond to a yellow warning, and the system logs and marks it in the dashboard; severe anomalies correspond to an orange warning, and the system pushes a notification through the WeChat Work robot; emergency anomalies correspond to a red warning, and the system pushes a notification through the WeChat Work robot and @ a designated person in charge.

[0096] The system records abnormal events to the monitoring database and displays them in real time on a visualization dashboard. The dashboard displays information including: abnormal channel, time of occurrence, predicted value, actual value, deviation percentage, and abnormality level. For example, when the first channel experiences an abnormality at 15:00 on July 28, 2026, the dashboard displays an abnormal record: "Channel: First Channel; Time: 2026-07-28 15:00; Predicted Value: 1500; Actual Value: 1200; Deviation Percentage: -20%; Abnormality Level: Severe."

[0097] V. Early Warning Notice

[0098] When the system determines that the number of leads from a certain channel is abnormal (i.e., the abnormality level reaches the severe or urgent level), the system triggers an early warning notification. The trigger condition for the early warning notification is that the actual value is lower than the lower bound of the prediction by a certain percentage. In this embodiment, when the actual value is lower than the predicted value minus 3σ (i.e., the lower bound of the prediction) and the deviation percentage exceeds 20%, the system immediately triggers a push notification from the WeChat Work robot. For example, if the predicted value for a certain hour for the first channel is 1500 leads, the lower bound of the prediction is 1350 leads (1500-3×50), the actual value is 1200 leads, and the deviation percentage is (1500-1200) / 1500=20%, which meets the trigger condition, and the system immediately triggers an early warning.

[0099] The system uses a WeChat Work robot to push anomaly information to designated users or groups in real time. The anomaly information pushed by the WeChat Work robot includes at least the following: anomaly occurrence time, anomaly channel identifier, predicted value, actual value, deviation percentage, and anomaly level. In this embodiment, the message format pushed by the WeChat Work robot is as follows:

[0100] "

Warning Notice

[0101] The system will push early warning notifications to pre-set enterprise WeChat groups in real time. Relevant personnel in the group (such as operations staff, business managers, etc.) can view the anomaly details and take appropriate intervention measures after receiving the notification.

[0102] VI. System Deployment and Performance Optimization

[0103] The system is deployed using a microservice architecture. The Holt-Winters model is encapsulated as an independent microservice, supporting RESTful API calls. External systems (such as the data acquisition module and the anomaly detection module) call the prediction interface of the model microservice via HTTP requests, passing in the channel identifier and time parameters. The model microservice returns the corresponding predicted value and confidence interval.

[0104] The system employs an asynchronous scheduling mechanism. Prediction tasks are triggered via scheduled tasks or message queues to ensure hourly update frequency. In this embodiment, the system triggers a prediction task at 0, 15, 30, and 45 minutes past each hour via scheduled tasks to predict the number of leads for each channel in the next hour, ensuring the real-time nature of the prediction results.

[0105] The system employs a caching and batch processing optimization mechanism. It utilizes Redis to cache prediction results and historical data, reducing database pressure. When multiple modules need to query prediction results for the same channel at the same time, the system prioritizes reading data from the Redis cache; only if the cache is not found will the database be queried.

[0106] The system supports high-concurrency scenarios. It employs batch prediction and parallel multi-threading mechanisms to handle real-time monitoring across multiple channels. When predictions for multiple channels need to be performed simultaneously, the system submits the prediction tasks for each channel to a thread pool for parallel execution, fully utilizing the computing resources of multi-core CPUs and significantly reducing the overall prediction time.

[0107] Corresponding to the aforementioned business lead anomaly detection and real-time early warning system based on time series prediction, this invention also discloses a business lead anomaly detection and real-time early warning method based on time series prediction. The following details the business lead anomaly detection and real-time early warning method based on time series prediction disclosed in this invention, in conjunction with the aforementioned business lead anomaly detection and real-time early warning system based on time series prediction.

[0108] refer to Figure 2 This invention discloses a business lead anomaly detection and real-time early warning method based on time series prediction. It collects lead data from various channels from the business database, cleans and standardizes the collected lead data, and groups the data according to the channel dimension to form independent time series data for each channel.

[0109] For the time series data of each channel, a Holt-Winters triple exponential smoothing model is constructed. The model includes three smoothing parameters: horizontal smoothing coefficient α, trend smoothing coefficient β, and seasonal smoothing coefficient γ. The sliding window mechanism is used to train the model based on historical data, automatically search for the optimal parameter combination for each channel, and dynamically retrain and update the model daily based on the latest data.

[0110] The trained Holt-Winters model is used to predict the number of leads from each channel at future time points in real time, and the predicted values ​​and corresponding confidence intervals are output.

[0111] The residual between the actual value of the number of leads from each channel and the model prediction value is calculated in real time. Based on the residual, a multi-dimensional anomaly determination is performed. The multi-dimensional anomaly determination includes at least residual significance determination, continuous anomaly duration determination, channel weight determination, and historical fluctuation range determination. The anomaly level is output through a multi-dimensional weighted algorithm.

[0112] When an abnormal number of leads from a certain channel is detected, an alert notification is triggered, and the abnormal information is pushed to designated users or groups in real time via the WeChat Work robot.

[0113] Although the present invention has been described in detail above with general descriptions and specific embodiments, modifications or improvements can be made to it, which will be obvious to those skilled in the art. Therefore, all such modifications or improvements made without departing from the spirit of the present invention fall within the scope of protection claimed by the present invention.

Claims

1. A method for anomaly detection and real-time early warning of business leads based on time series prediction, characterized in that, The method includes: Lead data from various channels is collected from the business database. The collected lead data is cleaned and standardized, and the data is grouped according to the channel dimension to form independent time series data for each channel. For the time series data of each channel, a Holt-Winters triple exponential smoothing model is constructed. The model includes three smoothing parameters: horizontal smoothing coefficient α, trend smoothing coefficient β, and seasonal smoothing coefficient γ. The sliding window mechanism is used to train the model based on historical data, automatically search for the optimal parameter combination for each channel, and dynamically retrain and update the model daily based on the latest data. The trained Holt-Winters model is used to predict the number of leads from each channel at future time points in real time, and the predicted values ​​and corresponding confidence intervals are output. The residual between the actual value of the number of leads from each channel and the model prediction value is calculated in real time. Based on the residual, a multi-dimensional anomaly determination is performed. The multi-dimensional anomaly determination includes at least residual significance determination, continuous anomaly duration determination, channel weight determination, and historical fluctuation range determination. The anomaly level is output through a multi-dimensional weighted algorithm. When an abnormal number of leads from a certain channel is detected, an alert notification is triggered, and the abnormal information is pushed to designated users or groups in real time via the WeChat Work robot.

2. The method for anomaly detection and real-time early warning of business leads based on time series prediction as described in claim 1, characterized in that, The collected clue data is hourly data, with fields including time, channel, and number of clues; the cleaning and standardization process includes: imputing and smoothing missing values ​​and abnormal peaks, converting the time field into an hourly timestamp format, and normalizing the number of clues to adapt to the Holt-Winters model input.

3. The method for anomaly detection and real-time early warning of business leads based on time series prediction as described in claim 1, characterized in that, The Holt-Winters triple exponential smoothing model adopts an additive model form, and the calculation formulas for its horizontal term Lt, trend term Tt, and seasonal term St are as follows: Lt=α×(Yt / S(tL))+(1-α)×(L(t-1)+T(t-1)) Tt=β×(Lt-L(t-1))+(1-β)×T(t-1) St = γ × (Yt / Lt) + (1 - γ) × S(tL) The formula for calculating the predicted value Ft+m at the m-th time point in the future is: Ft+m=(Lt+m×Tt)×S(t-L+m) Where Yt is the actual value at time t, and L is the period length.

4. The method for anomaly detection and real-time early warning of business leads based on time series prediction as described in claim 1, characterized in that, The sliding window mechanism used in the model training is as follows: based on historical data from the past 30 days, a sliding window prediction is performed, and the optimal combination of smoothing parameters (α, β, γ) that minimizes the prediction error is automatically searched.

5. The method for anomaly detection and real-time early warning of business leads based on time series prediction as described in claim 1, characterized in that, When performing anomaly detection, the 3σ principle is used to set the residual threshold. When the calculated residual exceeds 3 times the standard deviation, it is initially judged as an abnormal fluctuation.

6. The method for anomaly detection and real-time early warning of business leads based on time series prediction as described in claim 1, characterized in that, The anomaly levels include three categories: ordinary anomaly, severe anomaly, and emergency anomaly; different anomaly levels correspond to different early warning strategies and notification priorities.

7. The method for anomaly detection and real-time early warning of business leads based on time series prediction as described in claim 1, characterized in that, The abnormal information pushed by the WeChat Work robot should include at least the following: time of occurrence of abnormality, abnormal channel identifier, predicted value, actual value, deviation percentage and abnormality level.

8. The method for anomaly detection and real-time early warning of business leads based on time series prediction as described in claim 1, characterized in that, The method further includes: Abnormal events are recorded in the monitoring database and displayed in real time on the visualization dashboard, including channel information, time information, predicted value, actual value, deviation percentage, and abnormality level.

9. A business lead anomaly detection and real-time early warning system based on time series prediction, characterized in that, The system includes: The data acquisition and preprocessing module is used to collect lead data from various channels from the business database, clean and standardize the collected lead data, and group the data according to the channel dimension to form independent time series data for each channel. The time series forecasting model module is used to construct a Holt-Winters triple exponential smoothing model for time series data of each channel. The model includes three smoothing parameters: horizontal smoothing coefficient α, trend smoothing coefficient β, and seasonal smoothing coefficient γ. The model is trained based on historical data using a sliding window mechanism, automatically searches for the optimal parameter combination for each channel, dynamically retrains and updates the model daily based on the latest data, and uses the trained model to predict the number of leads for each channel at future time points in real time, outputting the predicted value and the corresponding confidence interval. The anomaly detection module is used to calculate the residual between the actual value and the model prediction value of the number of leads in each channel in real time, and to perform multi-dimensional anomaly judgment based on the residual. The multi-dimensional anomaly judgment includes at least residual significance judgment, continuous anomaly duration judgment, channel weight judgment and historical fluctuation range judgment, and outputs the anomaly level through a multi-dimensional weighted algorithm. The early warning notification module is used to trigger an early warning notification when the anomaly detection module determines that the number of leads from a certain channel is abnormal. The abnormal information is pushed to the designated user or group in real time through the WeChat Work robot.

10. The business lead anomaly detection and real-time early warning system based on time series prediction as described in claim 9, characterized in that, The system also includes: The model service deployment unit is used to encapsulate the Holt-Winters model as an independent microservice, supporting RESTful interface calls; An asynchronous scheduling unit is used to trigger prediction tasks via scheduled tasks or message queues and update prediction results at an hourly frequency. The caching and batch processing unit is used to cache prediction results and historical data in Redis, and to perform real-time monitoring of multiple channels using batch prediction and parallel multi-threading mechanisms.

Images