Order data risk monitoring system and method based on cloud computing

Abstract

The invention discloses an order data risk monitoring system and method based on cloud computing, and relates to the technical field of data analysis. The system comprises a data acquisition and processing module, a known risk factor extraction and evaluation module, a feature analysis and threshold calculation module, an unknown risk factor extraction and evaluation module and a real-time data monitoring and alarm module. The data acquisition and processing module collects historical order data and risk judgment records and forms a first feature vector; the known risk factor extraction and evaluation module extracts known risk factors and calculates a first risk evaluation index; the feature analysis and threshold calculation module performs analysis to obtain an evaluation threshold and a second feature vector; an unknown risk factor identification and evaluation module identifies an unknown risk factor, calculates a second risk evaluation index and determines a threshold value of the second risk evaluation index; the real-time data monitoring and alarm module collects order data in real time, calculates a risk assessment index, compares a threshold value and outputs risk prompt information.

Description

Technical Field

[0001] The present invention relates to the technical field of data analysis, and in particular to an order data risk monitoring system and method based on cloud computing. Background Art

[0002] With the rapid development of e-commerce and online payment, the amount of order data has increased dramatically. How to effectively monitor the risks of a large amount of order data has become a major challenge for enterprises. The main purpose of risk monitoring of order data is to identify and prevent various potential frauds, malicious attacks and abnormal behaviors, such as false orders, payment fraud, account theft, etc. If these risk events are not discovered and handled in time, they will directly affect the company's revenue, security and customer trust, and may even lead to legal and reputation risks.

[0003] Although the existing cloud computing-based order data risk monitoring methods can improve monitoring efficiency to a certain extent, they still have shortcomings. For example, in existing methods, risk factors such as abnormal order frequency, abnormal transaction amount, abnormal IP address, and sudden changes in user behavior are often extracted from order data through machine learning, statistical analysis and other technologies. These features are used to train risk assessment models to further classify and evaluate orders. However, the feature extraction process usually relies on the knowledge of domain experts, and the selection and construction of risk factors are highly subjective. Due to the wide variety of potential risk factors in order data, existing methods often lack the exploration and discovery of unknown risk factors, resulting in models that are overly dependent on existing known risk patterns and are difficult to deal with new fraudulent behaviors or attack scenarios. Summary of the invention

[0004] The purpose of the present invention is to provide an order data risk monitoring system and method based on cloud computing to solve the problems raised in the above background technology.

[0005] In order to solve the above technical problems, the present invention provides the following technical solutions:

[0006] A method for monitoring order data risk based on cloud computing, characterized in that the method comprises the following steps:

[0007] Step S100. Collect historical order data and corresponding risk judgment records through the cloud computing platform, and pre-process the historical order data, including removing noise data, filling missing values, and standardizing data formats; perform corresponding statistical analysis on the pre-processed historical order data, extract basic features of the historical order data, and form a first feature vector;

[0008] Step S200. According to the risk judgment records corresponding to the historical order data, the historical order data is divided accordingly; the known risk factors are extracted by combining the division result and the first feature vector; based on the known risk factors, the historical order data is risk assessed to obtain a first risk assessment index;

[0009] Step S300. Obtain a first risk assessment index threshold value based on the first risk assessment index and risk judgment record of the historical order data; analyze the first feature vector based on the known risk factor to obtain a second feature vector; identify unknown risk factors by combining the risk judgment record of the historical order data and the second feature vector;

[0010] Step S400. According to the unknown risk factor, the corresponding historical order data is risk assessed to obtain a second risk assessment index; according to the second risk assessment index of the historical order data and the risk judgment record, a second risk assessment index threshold is obtained;

[0011] Step S500. Acquire real-time order data of the cloud computing platform, identify unknown risk factors of the real-time order data, calculate the corresponding risk assessment index based on the identification result, compare it with the corresponding risk assessment index threshold, and output corresponding prompt information based on the comparison result.

[0012] Furthermore, step S100 includes:

[0013] S101. The risk judgment record refers to the final risk judgment result of the historical order data, wherein the risk judgment record includes normal events and abnormal events; the normal event refers to the normal risk judgment result of the historical order data, and the abnormal event refers to the abnormal risk judgment result of the historical order data; wherein the abnormal event includes false positive events and missed positive events, wherein the false positive event refers to the historical order data reporting the existence of risk when there is no risk, and the missed positive event refers to the historical order data not reporting the risk when there is risk;

[0014] S102. Collect historical order data from the cloud computing platform to form a historical order data set D, and D = {d1, d2, ..., dn}, where d1 represents the first historical order data, d2 represents the second historical order data, and so on, dn represents the nth historical order data, and n represents the historical order data number; for each historical order data, perform data preprocessing, perform corresponding statistical analysis on the preprocessed historical order data, and extract basic features; the basic features refer to data features extracted from the historical order data after statistical analysis, such as amount, customer historical behavior (such as the number of past purchases), order frequency, order time, etc.; construct a first feature vector A based on the extracted basic features, and A = [a1, a2, ..., am], where a1 represents the first feature of the historical order data, a2 represents the second feature of the historical order data, and so on, am represents the mth feature of the historical order data, and m represents the feature dimension.

[0015] Further, step S200 includes:

[0016] S201. According to the risk judgment record of the historical order data, the historical order data is divided into two categories, normal and abnormal, which are represented as D_normal and D_abnormal respectively, and the historical order data is associated with the corresponding first eigenvectors, and each historical order data corresponds to a first eigenvector; according to the neighborhood knowledge, the known risk factors are extracted, and combined with the first eigenvector A, a known risk factor vector F is formed, and F = [f1, f2, ..., fu], where f1 represents the first eigenvalue of the known risk factor vector, f2 represents the second eigenvalue of the known risk factor vector, and so on, fu represents the uth eigenvalue of the known risk factor vector; u represents the number of eigenvalues ​​of the known risk factor vector, u<m, and each eigenvalue of the known risk factor vector F exists in the first eigenvector;

[0017] S202. Calculate the first risk assessment index R1 of all historical order data based on the known risk factor vector F, and the specific calculation formula is:

[0018] R1=Σj∈[1,u],wj·fj,

[0019] Among them, wj represents the weight of the j-th known risk factor, fj represents the eigenvalue of the j-th known risk factor; and the first risk assessment index R1 is associated with the first eigenvector of the historical order data to obtain the correspondence between the normal and abnormal categories of historical order data, the first eigenvector, the known risk factor vector and the first risk assessment index.

[0020] Furthermore, step S300 includes:

[0021] S301. Summarize the first risk assessment index R1 of historical order data of normal category, and arrange the first risk assessment index R1 in ascending order; according to the risk judgment record, take the first historical order data with risk as the first risk assessment index threshold R0; for the first eigenvector A of historical order data of normal and abnormal categories, combine the known risk factor vector F, filter out the eigenvalue of the known risk factor vector F from the first eigenvector A, so as to obtain the second eigenvector B, and B = [b1, b2, ..., bm-u], similarly, b1 represents the first eigenvalue of the second eigenvector, b2 represents the second eigenvalue of the second eigenvector, bm-u represents the muth eigenvalue of the second eigenvector, and the second eigenvector B has u fewer eigenvalues ​​than the first eigenvector A;

[0022] S302. For the second eigenvector B of the historical order data of the normal category, calculate the average value μ(bk) and standard deviation σ(bk) of all eigenvalues, where bk represents the kth eigenvalue of the second eigenvector B of the normal category, and k ranges from 1 to mu; according to the average value μ(bk) and standard deviation σ(bk) of bk, the corresponding threshold interval Q(bk) is obtained, and Q(bk) = [μ(bk)-c×σ(bk), μ(bk)+c×σ(bk)], where c represents a constant; for the second eigenvector B of the historical order data of the abnormal category, compare all the corresponding eigenvalues ​​bl with the threshold interval Q(bk) Compared, where bl represents the lth eigenvalue of the second eigenvector B of the abnormal category, and l ranges from 1 to mu; if there is an eigenvalue bl in the second eigenvector B of the abnormal category that does not belong to the threshold interval Q(bk), the corresponding eigenvalue bl is identified as an unknown risk factor, and all unknown risk factors are summarized. The corresponding unknown risk factor vector Z is constructed for the historical order data of the abnormal category, and Z=[z1,z2,...,zv], where z1 represents the first eigenvalue of the unknown risk factor vector, z2 represents the second eigenvalue of the unknown risk factor vector, and so on, zv represents the vth eigenvalue of the unknown risk factor vector, and v<m.

[0023] Furthermore, step S400 includes:

[0024] For the historical order data of the abnormal category, the second risk assessment index R2 is calculated according to the corresponding unknown risk factor vector Z, and the specific calculation formula is:

[0025] R2=Σh∈[1,v],gh·zh,

[0026] Wherein, gh represents the weight of the hth unknown risk factor, zh represents the characteristic value of the hth unknown risk factor; the second risk assessment index R2 of all abnormal categories of historical order data is summarized, and the second risk assessment index R2 is arranged in ascending order; according to the risk judgment record, the first historical order data that actually has risks is used as the second risk assessment index threshold R3.

[0027] Furthermore, step S500 includes:

[0028] S501. Obtain the real-time order data of the cloud computing platform, perform preprocessing and statistical analysis on the real-time order data, thereby obtaining a first eigenvector A', find the eigenvalue a's corresponding to the second eigenvector B of the historical order data of the normal category in the first eigenvector A', and a's represents the sth eigenvalue in the first eigenvector A'; compare a's with the corresponding threshold interval Q(bk); if each eigenvalue a's in the first eigenvector A' belongs to the threshold interval Q(bk), calculate the first risk assessment index R1' of the real-time order data, and compare the first risk assessment index R1' with the corresponding first risk assessment index threshold R0; if the first risk assessment index R1' is less than the first risk assessment index threshold R0, no prompt information is output; if the first risk assessment index R1' is greater than or equal to the first risk assessment index threshold R0, output a prompt information indicating the existence of risk, and output the number of the real-time order data to relevant personnel;

[0029] S502. Compare a's with the corresponding threshold interval Q(bk). If there are eigenvalues ​​a's that do not belong to the threshold interval Q(bk) in the first eigenvector A', then all eigenvalues ​​a's that do not belong to the threshold interval Q(bk) are summarized and marked as unknown risk factors; based on the unknown risk factor, calculate the corresponding second risk assessment index R2'; compare the second risk assessment index R2' with the corresponding second risk assessment index threshold R3. If the second risk assessment index R2' is less than the second risk assessment index threshold R3, no prompt information is output; if the second risk assessment index R2' is greater than or equal to the second risk assessment index threshold R3, a prompt information indicating the existence of risks is output, and the number of the real-time order data is output to the relevant personnel.

[0030] An order data risk monitoring system based on cloud computing, comprising: a data collection and processing module, a known risk factor extraction and evaluation module, a feature analysis and threshold calculation module, an unknown risk factor extraction and evaluation module, and a real-time data monitoring and alarm module;

[0031] The data collection and processing module collects historical order data and corresponding risk judgment records, and preprocesses the historical order data, including removing noise data, filling missing values, and standardizing data formats; performs corresponding statistical analysis on the preprocessed historical order data, extracts the basic features of the historical order data, and forms the first feature vector;

[0032] The known risk factor extraction and assessment module divides the historical order data accordingly according to the risk judgment records corresponding to the historical order data; extracts the known risk factors by combining the division result and the first eigenvector; and performs risk assessment on the historical order data based on the known risk factors, thereby obtaining a first risk assessment index;

[0033] The feature analysis and threshold calculation module obtains a first risk assessment index threshold according to the first risk assessment index and risk judgment record of the historical order data; analyzes the first feature vector according to the known risk factors, thereby obtaining a second feature vector;

[0034] The unknown risk factor identification and assessment module combines the risk judgment record of the historical order data and the second eigenvector to identify the unknown risk factor; performs risk assessment on the corresponding historical order data according to the unknown risk factor, thereby obtaining a second risk assessment index; obtains a second risk assessment index threshold according to the second risk assessment index of the historical order data and the risk judgment record;

[0035] The real-time data monitoring and alarm module obtains the real-time order data of the cloud computing platform, identifies unknown risk factors of the real-time order data, calculates the corresponding risk assessment index based on the identification results, compares it with the corresponding risk assessment index threshold, and outputs corresponding prompt information based on the comparison results.

[0036] Further, the data acquisition and processing module includes a data acquisition unit and a data processing unit;

[0037] The data collection unit is responsible for collecting historical order data and corresponding risk judgment records from the cloud computing platform and forming a historical order data set; the data processing unit preprocesses the historical order data, including removing noise data, filling missing values ​​and standardizing data formats; the preprocessed historical order data is statistically analyzed accordingly, the basic features of the historical order data are extracted, and the first feature vector is formed;

[0038] The known risk factor extraction and assessment module includes a known risk factor extraction unit and a first risk assessment index calculation unit;

[0039] The known risk factor extraction unit extracts the known risk factors according to the risk judgment records and the first feature vector of the historical order data in combination with domain knowledge; the first risk assessment index calculation unit calculates the first risk assessment index of the historical order data based on the known risk factors.

[0040] Further, the feature analysis and threshold calculation module includes a feature vector screening unit and a threshold calculation unit;

[0041] The feature vector screening unit screens out features that do not contain known risk factors based on the known risk factors and the first feature vector, and generates a second feature vector; the threshold calculation unit analyzes the historical order data of the normal category, calculates the average value and standard deviation of each feature, and generates a corresponding threshold interval;

[0042] The unknown risk factor identification and assessment module includes an unknown risk factor identification unit and a second risk assessment index calculation unit;

[0043] The unknown risk factor identification unit analyzes the historical order data of the abnormal category according to the second feature vector and the corresponding threshold interval, identifies the abnormal feature value not included in the known risk factor, and thus identifies the unknown risk factor;

[0044] The second risk assessment index calculation unit calculates a second risk assessment index based on the identified unknown risk factors; and obtains a second risk assessment index threshold according to the second risk assessment index of the historical order data and the risk judgment record.

[0045] Furthermore, the real-time data monitoring and alarm module includes a real-time data acquisition and preprocessing unit, a real-time risk assessment unit, and a prompt information generation unit;

[0046] The real-time data collection and preprocessing unit collects order data from the cloud computing platform in real time, preprocesses and statistically analyzes the real-time order data, and generates a first eigenvector of the real-time order; the real-time risk assessment unit determines whether there is an unknown risk factor by comparing it with the second eigenvector of the normal category; if there is no unknown risk factor, the first risk assessment index of the real-time order is calculated; if there is an unknown risk factor in the real-time order data, the second risk assessment index of the real-time order is calculated; the prompt information generation unit compares the first risk assessment index or the second risk assessment index of the real-time order with the corresponding assessment index threshold value, and if the first risk assessment index or the second risk assessment index is greater than or equal to the corresponding assessment index threshold value, a prompt information of risk is generated, and the corresponding real-time order data number is output to relevant personnel.

[0047] Compared with the prior art, the present invention has the following beneficial effects:

[0048] This method first collects and processes historical order data through a cloud computing platform, performs preprocessing steps such as noise data removal, missing value filling, and data format standardization to ensure the accuracy and consistency of the data; through these steps, the anomalies and irregularities in the data can be effectively eliminated, providing a clearer data basis for subsequent analysis. Through statistical analysis of historical order data, basic features are extracted and the first feature vector is constructed. According to the relationship between the first feature vector and the risk judgment record, known risk factors can be further identified; risk assessment is performed through these known risk factors, and the first risk assessment index obtained can effectively quantify the risk level of the order, thereby improving the accuracy of risk identification. In traditional methods, risk assessment mainly relies on known risk factors, while the present invention can identify unknown risk factors through the construction of the second feature vector and the setting of the threshold interval; by analyzing the feature values ​​in the historical order data of normal and abnormal categories, feature values ​​that do not meet the threshold interval are extracted and marked as unknown risk factors. This approach significantly improves the system's ability to identify new or unknown risks. The present invention further combines risk assessment with real-time order monitoring, processes real-time order data on a cloud computing platform, and timely identifies potential risk factors by analyzing the first eigenvector and the second eigenvector of the real-time data; once the risk assessment index of a real-time order exceeds a preset threshold, the system can automatically issue an alarm to ensure that relevant personnel can respond in a timely manner to avoid potential risks. This method makes risk judgment more accurate and flexible by sorting the risk assessment index of historical order data and setting corresponding thresholds; over time, the risk threshold can be adjusted according to actual conditions to achieve dynamic monitoring; in addition, the method can achieve personalized monitoring for different risk factors, further improving the adaptability and accuracy of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0049] The accompanying drawings are used to provide a further understanding of the present invention and constitute a part of the specification. Together with the embodiments of the present invention, they are used to explain the present invention and do not constitute a limitation of the present invention. In the accompanying drawings:

[0050] Figure 1 It is a schematic diagram of a module of an order data risk monitoring system based on cloud computing of the present invention. DETAILED DESCRIPTION

[0051] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0052] See also Figure 1 , the present invention provides a technical solution:

[0053] An order data risk monitoring system based on cloud computing, comprising: a data collection and processing module, a known risk factor extraction and evaluation module, a feature analysis and threshold calculation module, an unknown risk factor extraction and evaluation module, and a real-time data monitoring and alarm module;

[0054] The data collection and processing module collects historical order data and corresponding risk judgment records, and preprocesses the historical order data, including removing noise data, filling missing values, and standardizing data formats; performs corresponding statistical analysis on the preprocessed historical order data, extracts the basic features of the historical order data, and forms the first feature vector;

[0055] The known risk factor extraction and assessment module divides the historical order data accordingly according to the risk judgment records corresponding to the historical order data; extracts the known risk factors by combining the division result and the first eigenvector; and performs risk assessment on the historical order data based on the known risk factors, thereby obtaining a first risk assessment index;

[0056] The feature analysis and threshold calculation module obtains a first risk assessment index threshold according to the first risk assessment index and risk judgment record of the historical order data; analyzes the first feature vector according to the known risk factors, thereby obtaining a second feature vector;

[0057] The unknown risk factor identification and assessment module combines the risk judgment record of the historical order data and the second eigenvector to identify the unknown risk factor; performs risk assessment on the corresponding historical order data according to the unknown risk factor, thereby obtaining a second risk assessment index; obtains a second risk assessment index threshold according to the second risk assessment index of the historical order data and the risk judgment record;

[0058] The real-time data monitoring and alarm module obtains the real-time order data of the cloud computing platform, identifies unknown risk factors of the real-time order data, calculates the corresponding risk assessment index based on the identification results, compares it with the corresponding risk assessment index threshold, and outputs corresponding prompt information based on the comparison results.

[0059] The data acquisition and processing module includes a data acquisition unit and a data processing unit;

[0060] The data collection unit is responsible for collecting historical order data and corresponding risk judgment records from the cloud computing platform and forming a historical order data set; the data processing unit preprocesses the historical order data, including removing noise data, filling missing values ​​and standardizing data formats; the preprocessed historical order data is statistically analyzed accordingly, the basic features of the historical order data are extracted, and the first feature vector is formed;

[0061] The known risk factor extraction and assessment module includes a known risk factor extraction unit and a first risk assessment index calculation unit;

[0062] The known risk factor extraction unit extracts the known risk factors according to the risk judgment records and the first feature vector of the historical order data in combination with domain knowledge; the first risk assessment index calculation unit calculates the first risk assessment index of the historical order data based on the known risk factors.

[0063] The feature analysis and threshold calculation module includes a feature vector screening unit and a threshold calculation unit;

[0064] The feature vector screening unit screens out features that do not contain known risk factors based on the known risk factors and the first feature vector, and generates a second feature vector; the threshold calculation unit analyzes the historical order data of the normal category, calculates the average value and standard deviation of each feature, and generates a corresponding threshold interval;

[0065] The unknown risk factor identification and assessment module includes an unknown risk factor identification unit and a second risk assessment index calculation unit;

[0066] The unknown risk factor identification unit analyzes the historical order data of the abnormal category according to the second feature vector and the corresponding threshold interval, identifies the abnormal feature value not included in the known risk factor, and thus identifies the unknown risk factor;

[0067] The second risk assessment index calculation unit calculates a second risk assessment index based on the identified unknown risk factors; and obtains a second risk assessment index threshold according to the second risk assessment index of the historical order data and the risk judgment record.

[0068] The real-time data monitoring and alarm module includes a real-time data acquisition and preprocessing unit, a real-time risk assessment unit, and a prompt information generation unit;

[0069] The real-time data collection and preprocessing unit collects order data from the cloud computing platform in real time, preprocesses and statistically analyzes the real-time order data, and generates a first eigenvector of the real-time order; the real-time risk assessment unit determines whether there is an unknown risk factor by comparing it with the second eigenvector of the normal category; if there is no unknown risk factor, the first risk assessment index of the real-time order is calculated; if there is an unknown risk factor in the real-time order data, the second risk assessment index of the real-time order is calculated; the prompt information generation unit compares the first risk assessment index or the second risk assessment index of the real-time order with the corresponding assessment index threshold value, and if the first risk assessment index or the second risk assessment index is greater than or equal to the corresponding assessment index threshold value, a prompt information of risk is generated, and the corresponding real-time order data number is output to relevant personnel.

[0070] A method for monitoring order data risk based on cloud computing, characterized in that the method comprises the following steps:

[0071] Step S100. Collect historical order data and corresponding risk judgment records through the cloud computing platform, and pre-process the historical order data, including removing noise data, filling missing values, and standardizing data formats; perform corresponding statistical analysis on the pre-processed historical order data, extract basic features of the historical order data, and form a first feature vector;

[0072] Step S200. According to the risk judgment records corresponding to the historical order data, the historical order data is divided accordingly; the known risk factors are extracted by combining the division result and the first feature vector; based on the known risk factors, the historical order data is risk assessed to obtain a first risk assessment index;

[0073] Step S300. Obtain a first risk assessment index threshold value based on the first risk assessment index and risk judgment record of the historical order data; analyze the first feature vector based on the known risk factor to obtain a second feature vector; identify unknown risk factors by combining the risk judgment record of the historical order data and the second feature vector;

[0074] Step S400. According to the unknown risk factor, the corresponding historical order data is risk assessed to obtain a second risk assessment index; according to the second risk assessment index of the historical order data and the risk judgment record, a second risk assessment index threshold is obtained;

[0075] Step S500. Acquire real-time order data of the cloud computing platform, identify unknown risk factors of the real-time order data, calculate the corresponding risk assessment index based on the identification result, compare it with the corresponding risk assessment index threshold, and output corresponding prompt information based on the comparison result.

[0076] Step S100 includes:

[0077] S101. The risk judgment record refers to the final risk judgment result of the historical order data, wherein the risk judgment record includes normal events and abnormal events; the normal event refers to the normal risk judgment result of the historical order data, and the abnormal event refers to the abnormal risk judgment result of the historical order data; wherein the abnormal event includes false positive events and missed positive events, wherein the false positive event refers to the historical order data reporting the existence of risk when there is no risk, and the missed positive event refers to the historical order data not reporting the risk when there is risk;

[0078] S102. Collect historical order data from the cloud computing platform to form a historical order data set D, and D = {d1, d2, ..., dn}, where d1 represents the first historical order data, d2 represents the second historical order data, and so on, dn represents the nth historical order data, and n represents the historical order data number; for each historical order data, perform data preprocessing, perform corresponding statistical analysis on the preprocessed historical order data, and extract basic features; the basic features refer to data features extracted from the historical order data after statistical analysis, such as amount, customer historical behavior (such as the number of past purchases), order frequency, order time, etc.; construct a first feature vector A based on the extracted basic features, and A = [a1, a2, ..., am], where a1 represents the first feature of the historical order data, a2 represents the second feature of the historical order data, and so on, am represents the mth feature of the historical order data, and m represents the feature dimension.

[0079] In this embodiment, data preprocessing is performed for each historical order data; the data preprocessing process is as follows:

[0080] Noise data removal: Use the Z-score standardization method to detect and remove outliers. For the historical order data di, calculate its Z-score value, Zi = (X_di-μ) / σ; where X_di represents the data point of the historical order data di, μ and σ represent the mean and standard deviation of the corresponding data point respectively; assuming |Z_i|>3, the data point is considered to be an outlier and can be removed or corrected;

[0081] Missing value filling: For the processing of missing values, methods such as mean filling, interpolation or nearest neighbor filling can be used;

[0082] Standardization processing: In order to eliminate the dimensional differences between different data points in the historical order data, each data point is standardized. The mean of the standardized data point is 0 and the standard deviation is 1, thus ensuring that each data point is on the same scale.

[0083] Step S200 includes:

[0084] S201. According to the risk judgment record of the historical order data, the historical order data is divided into two categories, normal and abnormal, which are represented as D_normal and D_abnormal respectively, and the historical order data is associated with the corresponding first eigenvectors, and each historical order data corresponds to a first eigenvector; according to the neighborhood knowledge, the known risk factors are extracted, and combined with the first eigenvector A, a known risk factor vector F is formed, and F = [f1, f2, ..., fu], where f1 represents the first eigenvalue of the known risk factor vector, f2 represents the second eigenvalue of the known risk factor vector, and so on, fu represents the uth eigenvalue of the known risk factor vector; u represents the number of eigenvalues ​​of the known risk factor vector, u<m, and each eigenvalue of the known risk factor vector F exists in the first eigenvector;

[0085] S202. Calculate the first risk assessment index R1 of all historical order data based on the known risk factor vector F, and the specific calculation formula is:

[0086] R1=Σj∈[1,u],wj·fj,

[0087] Among them, wj represents the weight of the j-th known risk factor, fj represents the eigenvalue of the j-th known risk factor; and the first risk assessment index R1 is associated with the first eigenvector of the historical order data to obtain the correspondence between the normal and abnormal categories of historical order data, the first eigenvector, the known risk factor vector and the first risk assessment index.

[0088] Step S300 includes:

[0089] S301. Summarize the first risk assessment index R1 of historical order data of normal category, and arrange the first risk assessment index R1 in ascending order; according to the risk judgment record, take the first historical order data with risk as the first risk assessment index threshold R0; for the first eigenvector A of historical order data of normal and abnormal categories, combine the known risk factor vector F, filter out the eigenvalue of the known risk factor vector F from the first eigenvector A, so as to obtain the second eigenvector B, and B = [b1, b2, ..., bm-u], similarly, b1 represents the first eigenvalue of the second eigenvector, b2 represents the second eigenvalue of the second eigenvector, bm-u represents the muth eigenvalue of the second eigenvector, and the second eigenvector B has u fewer eigenvalues ​​than the first eigenvector A;

[0090] S302. For the second eigenvector B of the historical order data of the normal category, calculate the average value μ(bk) and standard deviation σ(bk) of all eigenvalues, where bk represents the kth eigenvalue of the second eigenvector B of the normal category, and k ranges from 1 to mu; according to the average value μ(bk) and standard deviation σ(bk) of bk, the corresponding threshold interval Q(bk) is obtained, and Q(bk) = [μ(bk)-c×σ(bk), μ(bk)+c×σ(bk)], where c represents a constant; for the second eigenvector B of the historical order data of the abnormal category, compare all the corresponding eigenvalues ​​bl with the threshold interval Q(bk) Compared, where bl represents the lth eigenvalue of the second eigenvector B of the abnormal category, and l ranges from 1 to mu; if there is an eigenvalue bl in the second eigenvector B of the abnormal category that does not belong to the threshold interval Q(bk), the corresponding eigenvalue bl is identified as an unknown risk factor, and all unknown risk factors are summarized. The corresponding unknown risk factor vector Z is constructed for the historical order data of the abnormal category, and Z=[z1,z2,...,zv], where z1 represents the first eigenvalue of the unknown risk factor vector, z2 represents the second eigenvalue of the unknown risk factor vector, and so on, zv represents the vth eigenvalue of the unknown risk factor vector, and v<m.

[0091] Step S400 includes:

[0092] For the historical order data of the abnormal category, the second risk assessment index R2 is calculated according to the corresponding unknown risk factor vector Z, and the specific calculation formula is:

[0093] R2=Σh∈[1,v],gh·zh,

[0094] Wherein, gh represents the weight of the hth unknown risk factor, zh represents the characteristic value of the hth unknown risk factor; the second risk assessment index R2 of all abnormal categories of historical order data is summarized, and the second risk assessment index R2 is arranged in ascending order; according to the risk judgment record, the first historical order data that actually has risks is used as the second risk assessment index threshold R3.

[0095] Step S500 includes:

[0096] S501. Obtain the real-time order data of the cloud computing platform, perform preprocessing and statistical analysis on the real-time order data, thereby obtaining a first eigenvector A', find the eigenvalue a's corresponding to the second eigenvector B of the historical order data of the normal category in the first eigenvector A', and a's represents the sth eigenvalue in the first eigenvector A'; compare a's with the corresponding threshold interval Q(bk); if each eigenvalue a's in the first eigenvector A' belongs to the threshold interval Q(bk), calculate the first risk assessment index R1' of the real-time order data, and compare the first risk assessment index R1' with the corresponding first risk assessment index threshold R0; if the first risk assessment index R1' is less than the first risk assessment index threshold R0, no prompt information is output; if the first risk assessment index R1' is greater than or equal to the first risk assessment index threshold R0, output a prompt information indicating the existence of risk, and output the number of the real-time order data to relevant personnel;

[0097] S502. Compare a's with the corresponding threshold interval Q(bk). If there are eigenvalues ​​a's that do not belong to the threshold interval Q(bk) in the first eigenvector A', then all eigenvalues ​​a's that do not belong to the threshold interval Q(bk) are summarized and marked as unknown risk factors; based on the unknown risk factor, calculate the corresponding second risk assessment index R2'; compare the second risk assessment index R2' with the corresponding second risk assessment index threshold R3. If the second risk assessment index R2' is less than the second risk assessment index threshold R3, no prompt information is output; if the second risk assessment index R2' is greater than or equal to the second risk assessment index threshold R3, a prompt information indicating the existence of risks is output, and the number of the real-time order data is output to the relevant personnel.

[0098] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device.

[0099] Finally, it should be noted that the above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art can still modify the technical solutions described in the aforementioned embodiments or replace some of the technical features therein by equivalents. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A method for monitoring order data risk based on cloud computing, characterized in that: The method comprises the following steps: Step S100. Collect historical order data and corresponding risk judgment records through the cloud computing platform, and pre-process the historical order data, including removing noise data, filling missing values, and standardizing data formats; perform corresponding statistical analysis on the pre-processed historical order data, extract basic features of the historical order data, and form a first feature vector; Step S200. According to the risk judgment records corresponding to the historical order data, the historical order data is divided accordingly; the known risk factors are extracted by combining the division result and the first feature vector; based on the known risk factors, the historical order data is risk assessed to obtain a first risk assessment index; Step S300. Obtain a first risk assessment index threshold value based on the first risk assessment index and risk judgment record of the historical order data; analyze the first feature vector based on the known risk factor to obtain a second feature vector; identify unknown risk factors by combining the risk judgment record of the historical order data and the second feature vector; Step S400. According to the unknown risk factor, the corresponding historical order data is risk assessed to obtain a second risk assessment index; according to the second risk assessment index of the historical order data and the risk judgment record, a second risk assessment index threshold is obtained; Step S500. Acquire real-time order data of the cloud computing platform, identify unknown risk factors of the real-time order data, calculate the corresponding risk assessment index based on the identification result, compare it with the corresponding risk assessment index threshold, and output corresponding prompt information based on the comparison result.

2. The method for monitoring order data risk based on cloud computing according to claim 1, characterized in that: The step S100 includes: S101. The risk judgment record refers to the final risk judgment result of the historical order data, wherein the risk judgment record includes normal events and abnormal events; the normal event refers to the normal risk judgment result of the historical order data, and the abnormal event refers to the abnormal risk judgment result of the historical order data; wherein the abnormal event includes false positive events and missed positive events, wherein the false positive event refers to the historical order data reporting the existence of risk when there is no risk, and the missed positive event refers to the historical order data not reporting the risk when there is risk; S102. Collect historical order data from the cloud computing platform to form a historical order data set D, where D = {d1, d2, ..., dn}, where d1 represents the first historical order data, d2 represents the second historical order data, and so on, dn represents the nth historical order data, and n represents the historical order data number; for each historical order data, perform data preprocessing, perform corresponding statistical analysis on the preprocessed historical order data, and extract basic features; the basic features refer to data features extracted from the historical order data after statistical analysis; construct a first feature vector A based on the extracted basic features, and A = [a1, a2, ..., am], where a1 represents the first feature of the historical order data, a2 represents the second feature of the historical order data, and so on, am represents the mth feature of the historical order data, and m represents the feature dimension.

3. The method for monitoring order data risk based on cloud computing according to claim 2, characterized in that: The step S200 includes: S201. According to the risk judgment record of the historical order data, the historical order data is divided into two categories, normal and abnormal, which are represented as D_normal and D_abnormal respectively, and the historical order data is associated with the corresponding first eigenvectors, and each historical order data corresponds to a first eigenvector; according to the neighborhood knowledge, the known risk factors are extracted, and combined with the first eigenvector A, a known risk factor vector F is formed, and F = [f1, f2, ..., fu], where f1 represents the first eigenvalue of the known risk factor vector, f2 represents the second eigenvalue of the known risk factor vector, and so on, fu represents the uth eigenvalue of the known risk factor vector; u represents the number of eigenvalues ​​of the known risk factor vector, u<m, and each eigenvalue of the known risk factor vector F exists in the first eigenvector; S202. Calculate the first risk assessment index R1 of all historical order data based on the known risk factor vector F, and the specific calculation formula is: R1=Σj∈[1,u],wj·fj, Among them, wj represents the weight of the j-th known risk factor, fj represents the eigenvalue of the j-th known risk factor; and the first risk assessment index R1 is associated with the first eigenvector of the historical order data to obtain the correspondence between the normal and abnormal categories of historical order data, the first eigenvector, the known risk factor vector and the first risk assessment index.

4. The method for monitoring order data risk based on cloud computing according to claim 3 is characterized in that: The step S300 includes: S301. Summarize the first risk assessment index R1 of historical order data of normal category, and arrange the first risk assessment index R1 in ascending order; according to the risk judgment record, take the first historical order data with risk as the first risk assessment index threshold R0; for the first eigenvector A of historical order data of normal and abnormal categories, combine the known risk factor vector F, filter out the eigenvalue of the known risk factor vector F from the first eigenvector A, so as to obtain the second eigenvector B, and B = [b1, b2, ..., bm-u], similarly, b1 represents the first eigenvalue of the second eigenvector, b2 represents the second eigenvalue of the second eigenvector, bm-u represents the muth eigenvalue of the second eigenvector, and the second eigenvector B has u fewer eigenvalues ​​than the first eigenvector A; S302. For the second eigenvector B of the historical order data of the normal category, calculate the average value μ(bk) and standard deviation σ(bk) of all eigenvalues, where bk represents the kth eigenvalue of the second eigenvector B of the normal category, and k ranges from 1 to mu; according to the average value μ(bk) and standard deviation σ(bk) of bk, the corresponding threshold interval Q(bk) is obtained, and Q(bk) = [μ(bk)-c×σ(bk), μ(bk)+c×σ(bk)], where c represents a constant; for the second eigenvector B of the historical order data of the abnormal category, compare all the corresponding eigenvalues ​​bl with the threshold interval Q(bk) Compared, where bl represents the lth eigenvalue of the second eigenvector B of the abnormal category, and l ranges from 1 to mu; if there is an eigenvalue bl in the second eigenvector B of the abnormal category that does not belong to the threshold interval Q(bk), the corresponding eigenvalue bl is identified as an unknown risk factor, and all unknown risk factors are summarized. The corresponding unknown risk factor vector Z is constructed for the historical order data of the abnormal category, and Z=[z1,z2,...,zv], where z1 represents the first eigenvalue of the unknown risk factor vector, z2 represents the second eigenvalue of the unknown risk factor vector, and so on, zv represents the vth eigenvalue of the unknown risk factor vector, and v<m.

5. The method for monitoring order data risk based on cloud computing according to claim 4, characterized in that: The step S400 includes: For the historical order data of the abnormal category, the second risk assessment index R2 is calculated according to the corresponding unknown risk factor vector Z, and the specific calculation formula is: R2=Σh∈[1,v],gh·zh, Wherein, gh represents the weight of the hth unknown risk factor, zh represents the characteristic value of the hth unknown risk factor; the second risk assessment index R2 of all abnormal categories of historical order data is summarized, and the second risk assessment index R2 is arranged in ascending order; according to the risk judgment record, the first historical order data that actually has risks is used as the second risk assessment index threshold R3.

6. The method for monitoring order data risk based on cloud computing according to claim 5, characterized in that: The step S500 includes: S501. Obtain the real-time order data of the cloud computing platform, perform preprocessing and statistical analysis on the real-time order data, thereby obtaining a first eigenvector A', find the eigenvalue a's corresponding to the second eigenvector B of the historical order data of the normal category in the first eigenvector A', and a's represents the sth eigenvalue in the first eigenvector A'; compare a's with the corresponding threshold interval Q(bk); if each eigenvalue a's in the first eigenvector A' belongs to the threshold interval Q(bk), calculate the first risk assessment index R1' of the real-time order data, and compare the first risk assessment index R1' with the corresponding first risk assessment index threshold R0; if the first risk assessment index R1' is less than the first risk assessment index threshold R0, no prompt information is output; if the first risk assessment index R1' is greater than or equal to the first risk assessment index threshold R0, output a prompt information indicating the existence of risk, and output the number of the real-time order data to relevant personnel; S502. Compare a's with the corresponding threshold interval Q(bk). If there are eigenvalues ​​a's that do not belong to the threshold interval Q(bk) in the first eigenvector A', then all eigenvalues ​​a's that do not belong to the threshold interval Q(bk) are summarized and marked as unknown risk factors; based on the unknown risk factor, calculate the corresponding second risk assessment index R2'; compare the second risk assessment index R2' with the corresponding second risk assessment index threshold R3. If the second risk assessment index R2' is less than the second risk assessment index threshold R3, no prompt information is output; if the second risk assessment index R2' is greater than or equal to the second risk assessment index threshold R3, a prompt information indicating the existence of risks is output, and the number of the real-time order data is output to the relevant personnel.

7. A cloud computing-based order data risk monitoring system, applied to a cloud computing-based order data risk monitoring method according to any one of claims 1 to 6, characterized in that: The system includes: a data acquisition and processing module, a known risk factor extraction and evaluation module, a feature analysis and threshold calculation module, an unknown risk factor extraction and evaluation module, and a real-time data monitoring and alarm module; The data collection and processing module collects historical order data and corresponding risk judgment records, and preprocesses the historical order data, including removing noise data, filling missing values, and standardizing data formats; performs corresponding statistical analysis on the preprocessed historical order data, extracts basic features of the historical order data, and forms a first feature vector; The known risk factor extraction and assessment module divides the historical order data accordingly according to the risk judgment records corresponding to the historical order data; extracts the known risk factors based on the division result and the first eigenvector; and performs risk assessment on the historical order data based on the known risk factors, thereby obtaining a first risk assessment index; The feature analysis and threshold calculation module obtains a first risk assessment index threshold according to the first risk assessment index and risk judgment record of the historical order data; analyzes the first feature vector according to the known risk factors, thereby obtaining a second feature vector; The unknown risk factor identification and assessment module identifies the unknown risk factor by combining the risk judgment record of the historical order data and the second feature vector; performs risk assessment on the corresponding historical order data according to the unknown risk factor, thereby obtaining a second risk assessment index; obtains a second risk assessment index threshold according to the second risk assessment index of the historical order data and the risk judgment record; The real-time data monitoring and alarm module obtains real-time order data of the cloud computing platform, identifies unknown risk factors of the real-time order data, calculates a corresponding risk assessment index based on the identification result, compares it with a corresponding risk assessment index threshold, and outputs corresponding prompt information based on the comparison result.

8. The order data risk monitoring system based on cloud computing according to claim 7 is characterized by: The data acquisition and processing module includes a data acquisition unit and a data processing unit; The data collection unit is responsible for collecting historical order data and corresponding risk judgment records from the cloud computing platform and forming a historical order data set; the data processing unit pre-processes the historical order data, including removing noise data, filling missing values ​​and standardizing data formats; Perform corresponding statistical analysis on the preprocessed historical order data, extract the basic features of the historical order data, and form the first feature vector; The known risk factor extraction and assessment module includes a known risk factor extraction unit and a first risk assessment index calculation unit; The known risk factor extraction unit extracts the known risk factors based on the risk judgment records of the historical order data and the first feature vector in combination with the domain knowledge; The first risk assessment index calculation unit calculates a first risk assessment index of the historical order data based on known risk factors.

9. The order data risk monitoring system based on cloud computing according to claim 7 is characterized in that: The feature analysis and threshold calculation module includes a feature vector screening unit and a threshold calculation unit; The feature vector screening unit screens out features that do not contain known risk factors based on the known risk factors and the first feature vector, and generates a second feature vector; the threshold calculation unit analyzes the historical order data of the normal category, calculates the average value and standard deviation of each feature, and generates a corresponding threshold interval; The unknown risk factor identification and assessment module includes an unknown risk factor identification unit and a second risk assessment index calculation unit; The unknown risk factor identification unit analyzes the historical order data of the abnormal category according to the second feature vector and the corresponding threshold interval, identifies the abnormal feature value not included in the known risk factor, and thus identifies the unknown risk factor; The second risk assessment index calculation unit calculates a second risk assessment index based on the identified unknown risk factors; and obtains a second risk assessment index threshold according to the second risk assessment index of the historical order data and the risk judgment record.

10. The order data risk monitoring system based on cloud computing according to claim 7, characterized in that: The real-time data monitoring and alarm module includes a real-time data acquisition and preprocessing unit, a real-time risk assessment unit and a prompt information generation unit; The real-time data collection and preprocessing unit collects order data from the cloud computing platform in real time, performs preprocessing and statistical analysis on the real-time order data, and generates a first feature vector of the real-time order; The real-time risk assessment unit determines whether there is an unknown risk factor by comparing with the second feature vector of the normal category; If there is no unknown risk factor, calculating a first risk assessment index for the real-time order; If there are unknown risk factors in the real-time order data, the second risk assessment index of the real-time order is calculated; the prompt information generation unit compares the first risk assessment index or the second risk assessment index of the real-time order with the corresponding assessment index threshold; if the first risk assessment index or the second risk assessment index is greater than or equal to the corresponding assessment index threshold, a prompt information indicating the existence of risk is generated, and the corresponding real-time order data number is output to relevant personnel.

Images