Index transaction monitoring method and device, electronic equipment and storage medium

Abstract

The invention discloses an index transaction monitoring method and device, electronic equipment and a storage medium, and relates to the technical field of transaction monitoring. The threshold range is dynamically generated based on the historical business data to adapt to the change of data distribution, the adaptive statistical test algorithm is selected in combination with the data sample size and the distribution characteristics to improve the accuracy of anomaly judgment, and personalized early warning output is performed according to the region and the business type of the auditing point. According to the technical scheme, data dynamic change and business scene diversity can be flexibly coped with, so that the technical problem that the reliability of an early warning result is reduced in the face of missing data, abnormal values and complex seasonal fluctuation, and then the real-time control and decision-making efficiency of an operator on a business operation state is influenced can be solved; the technical effects of improving the accuracy and reliability of business development index abnormity identification, reducing the false report and missing report rate, and enhancing the real-time control capability and decision-making efficiency of the operator for the business operation state are achieved.

Description

Technical Field

[0001] This disclosure relates to the field of anomaly monitoring technology, and in particular to a method and apparatus, electronic device and storage medium for monitoring anomalies in indicators. Background Technology

[0002] With the continuous expansion of communication services and the increasing complexity of data, the identification and early warning of anomalies in business development indicators have become core technologies in network operation and maintenance and business management for operators.

[0003] In related technologies, traditional early warning methods mainly rely on manual experience to set fixed thresholds, and anomaly detection is achieved through key steps such as data collection, threshold comparison, and result output. Specifically, this method typically covers the entire process from data acquisition to anomaly judgment, including data cleaning, threshold setting, indicator comparison, and early warning triggering. Among these, threshold setting is the core step, directly affecting the accuracy and adaptability of the early warning system. However, existing fixed threshold early warning methods directly use static thresholds for anomaly judgment without considering the dynamic changes in data distribution and the diversity of business scenarios. This may lead to an increased false alarm or false negative rate. When faced with missing data, outliers, and complex seasonal fluctuations, the reliability of the early warning results decreases significantly, thereby affecting the operator's real-time control and decision-making efficiency regarding business operation status. Summary of the Invention

[0004] This disclosure provides a method, apparatus, electronic device, and storage medium for monitoring indicator anomalies. Its main purpose is to address the problem that dynamic changes in data distribution and the diversity of business scenarios may lead to increased false alarm or false negative rates.

[0005] According to a first aspect of this disclosure, a method for monitoring indicator anomalies is provided, comprising:

[0006] Obtain historical business data of the target audit point, and calculate the mean and standard deviation based on the historical business data to generate a dynamic threshold range;

[0007] Based on the data sample size and distribution characteristics of the target audit points, a statistical testing algorithm is determined to identify anomalies in the data of the target audit points.

[0008] Based on the anomaly detection results, corresponding early warning information is generated, and personalized early warning output is provided according to the region and business type of the audit point.

[0009] Optionally, after acquiring historical business data of the target audit point and calculating the mean and standard deviation based on the historical business data to generate a dynamic threshold range, the method further includes:

[0010] The audit point data collected in real time is preprocessed; wherein the preprocessing includes at least one of missing value imputation and outlier cleaning.

[0011] Optionally, the step of acquiring historical business data of the target audit point and calculating the mean and standard deviation based on the historical business data to generate a dynamic threshold range includes:

[0012] The historical business data is segmented based on a sliding window mechanism, and the mean and standard deviation of each segment are calculated.

[0013] Optionally, the preprocessing of the real-time collected audit point data includes:

[0014] Missing values ​​are filled using time series interpolation, which includes at least one of linear interpolation and predictive interpolation based on historical trends.

[0015] Outlier cleaning was performed on the initially collected data using a box plot method.

[0016] Optionally, determining a statistical testing algorithm based on the data sample size and distribution characteristics of the target audit point, and performing anomaly detection on the data of the target audit point, includes:

[0017] In response to a sample size greater than a preset number and data conforming to a normal distribution, the statistical test algorithm is determined to be the Z-test algorithm.

[0018] The statistical test algorithm is determined to be the T-test algorithm when the sample size is less than or equal to a preset number and the data conforms to a normal distribution.

[0019] Optionally, the method further includes:

[0020] The system compares and analyzes early warning information with historical early warning records to identify early warning patterns and generate early warning trend reports.

[0021] According to a second aspect of this disclosure, a monitoring device for indicator anomalies is provided, comprising:

[0022] The acquisition unit is used to acquire historical business data of the target audit point, and calculate the mean and standard deviation based on the historical business data to generate a dynamic threshold range;

[0023] The determining unit is used to determine a statistical testing algorithm based on the data sample size and distribution characteristics of the target audit point, and to make anomaly judgments on the data of the target audit point;

[0024] The output unit is used to generate corresponding early warning information based on the anomaly determination results, and to provide personalized early warning output according to the region and business type of the audit point.

[0025] Optionally, the device further includes:

[0026] The preprocessing unit is used to preprocess the real-time collected audit point data after the acquisition unit acquires the historical business data of the target audit point and calculates the mean and standard deviation based on the historical business data to generate a dynamic threshold range; wherein the preprocessing includes at least one of missing value imputation and outlier cleaning.

[0027] Optionally, the acquisition unit is further configured to:

[0028] The historical business data is segmented based on a sliding window mechanism, and the mean and standard deviation of each segment are calculated.

[0029] Optionally, the preprocessing unit is further configured to:

[0030] Missing values ​​are filled using time series interpolation, which includes at least one of linear interpolation and predictive interpolation based on historical trends.

[0031] Outlier cleaning was performed on the initially collected data using a box plot method.

[0032] Optionally, the determining unit is further configured to:

[0033] In response to a sample size greater than a preset number and data conforming to a normal distribution, the statistical test algorithm is determined to be the Z-test algorithm.

[0034] The statistical test algorithm is determined to be the T-test algorithm when the sample size is less than or equal to a preset number and the data conforms to a normal distribution.

[0035] Optionally, the device further includes:

[0036] The generation unit is used to compare and analyze early warning information with historical early warning records, identify early warning patterns, and generate early warning trend reports.

[0037] According to a third aspect of this disclosure, an electronic device is provided, comprising:

[0038] At least one processor; and

[0039] A memory communicatively connected to the at least one processor; wherein,

[0040] The memory stores instructions that can be executed by the at least one processor to enable the at least one processor to perform the method described in the first aspect above.

[0041] According to a fourth aspect of this disclosure, a non-transitory computer-readable storage medium is provided storing computer instructions, wherein the computer instructions are configured to cause the computer to perform the method described in the first aspect above.

[0042] According to a fifth aspect of this disclosure, a computer program product is provided, comprising a computer program that, when executed by a processor, implements the method described in the first aspect above.

[0043] The monitoring method, device, electronic equipment, and storage medium for indicator anomalies provided in this disclosure mainly include: acquiring historical business data of the target audit point, and calculating the mean and standard deviation based on the historical business data to generate a dynamic threshold range; determining a statistical test algorithm based on the data sample size and distribution characteristics of the target audit point to determine anomalies in the data of the target audit point; generating corresponding early warning information based on the anomaly determination results, and providing personalized early warning output according to the region and business type of the audit point. Compared with related technologies, this application, by dynamically generating threshold ranges based on historical business data to adapt to changes in data distribution, selecting appropriate statistical testing algorithms based on data sample size and distribution characteristics to improve the accuracy of anomaly detection, and providing personalized early warning outputs based on the region and business type of the audit point, can flexibly respond to dynamic changes in data and the diversity of business scenarios. Therefore, it can solve the technical problems of existing fixed threshold early warning methods, which suffer from increased false alarm or missed alarm rates due to the use of static thresholds and failure to consider dynamic changes in data and the diversity of business scenarios. Furthermore, it addresses the decreased reliability of early warning results when faced with missing data, outliers, and complex seasonal fluctuations, thereby affecting the operator's real-time control and decision-making efficiency regarding business operation status. The application achieves the technical effect of improving the accuracy and reliability of anomaly identification of business development indicators, reducing false alarm and missed alarm rates, and enhancing the operator's real-time control and decision-making efficiency regarding business operation status.

[0044] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of this application, nor is it intended to limit the scope of this application. Other features of this application will become readily apparent from the following description. Attached Figure Description

[0045] The accompanying drawings are provided to better understand this solution and do not constitute a limitation of this disclosure. Wherein:

[0046] Figure 1 A flowchart illustrating a method for monitoring index anomalies provided in an embodiment of this disclosure;

[0047] Figure 2 A flowchart illustrating a method for detecting index anomalies provided in an embodiment of this disclosure;

[0048] Figure 3This is a schematic diagram of a Z-test distribution probability provided in an embodiment of the present disclosure;

[0049] Figure 4 This is a schematic diagram of the T-test distribution probability provided in an embodiment of the present disclosure;

[0050] Figure 5 This is a schematic diagram of a box plot test provided in an embodiment of the present disclosure;

[0051] Figure 6 A schematic diagram of the structure of a monitoring device for indicator anomalies provided in this embodiment of the present disclosure.

[0052] Figure 7 A schematic diagram of the structure of another indicator anomaly monitoring device provided in an embodiment of this disclosure;

[0053] Figure 8 A schematic block diagram of an example electronic device provided for embodiments of this disclosure. Detailed Implementation

[0054] The exemplary embodiments of this disclosure are described below with reference to the accompanying drawings, including various details of the embodiments to aid understanding, and should be considered merely exemplary. Therefore, those skilled in the art will recognize that various changes and modifications can be made to the embodiments described herein without departing from the scope and spirit of this disclosure. Similarly, for clarity and brevity, descriptions of well-known functions and structures are omitted in the following description.

[0055] The following description, with reference to the accompanying drawings, describes a method, apparatus, electronic device, and storage medium for monitoring index anomalies according to embodiments of the present disclosure.

[0056] Figure 1 This is a flowchart illustrating a method for monitoring index anomalies provided in an embodiment of this disclosure.

[0057] like Figure 1 As shown, the method includes the following steps:

[0058] Step 101: Obtain historical business data of the target audit point, and calculate the mean and standard deviation based on the historical business data to generate a dynamic threshold range;

[0059] The system's data acquisition module extracts historical business data of target audit points from the operator's business database. These target audit points can be categorized by different regions, channels, or business types based on actual business needs, ensuring that the acquired data comprehensively reflects the business development characteristics of the audit point within a historical period, such as core indicators of communication business development like user growth, business processing volume, and revenue. After acquiring the historical business data, the data preprocessing module cleans the raw data, removing invalid and duplicate data. Missing values ​​are handled using appropriate interpolation methods or imputation strategies. Identified outliers are preliminarily screened and corrected to ensure the accuracy and reliability of subsequent statistical calculations and avoid threshold calculation deviations due to data quality issues.

[0060] After data preprocessing, the mean μ and standard deviation σ of the data sequence are calculated based on the cleaned historical business data. The mean μ, a measure of central tendency, is obtained by averaging all valid historical business data values, reflecting the general level of the audit point's business indicators within the historical period. The standard deviation σ, a measure of data dispersion, is obtained by calculating the square root of the average of the squares of the deviations of each historical business data value from the mean, reflecting the fluctuations of the historical business data around the mean. Based on the 3-sigma principle, assuming the data follows a normal distribution, the probability of the data falling within the (μ-3σ, μ+3σ) interval is approximately 99.74%. Therefore, this interval is determined as the core basis for determining the dynamic threshold range; that is, the lower bound of the generated dynamic threshold range is μ-3σ, and the upper bound is μ+3σ.

[0061] The generation process of this dynamic threshold range has significant adaptive characteristics. Unlike traditional fixed threshold methods, its upper and lower bounds are automatically adjusted as historical business data is updated. When new historical business data is included in the statistical range, the system recalculates the mean and standard deviation, and then updates the threshold range. This ensures that the threshold can adapt to the dynamic changes in data distribution in real time. For example, when business enters the peak season and the overall historical business data increases, the mean (μ) will rise accordingly, and the standard deviation (σ) may also change due to increased volatility. The dynamic threshold range will then be adjusted upward. Conversely, during the off-season, the threshold range will be adjusted downward accordingly. This effectively ensures the adaptability of the threshold range to different business scenarios and changes in data distribution, providing accurate and reliable judgment basis for subsequent anomaly monitoring.

[0062] Step 102: Based on the data sample size and distribution characteristics of the target audit point, determine the statistical test algorithm and perform anomaly judgment on the data of the target audit point;

[0063] Distribution characteristics analysis is performed on the preprocessed historical and real-time data of the target audit points. Normality tests (such as the Shapiro-Wilk test and QQ plot analysis) are used to determine whether the data conforms to a normal distribution, clarifying the overall distribution pattern of the data. Simultaneously, the sample size of the statistical data (i.e., the number of valid data points involved in the analysis) provides a quantitative basis for algorithm selection.

[0064] Based on the analysis results of data distribution characteristics and sample size, the statistical test algorithm is determined according to the following rules: If the data conforms to a normal distribution after testing, and the sample size N≥30, the Z-test algorithm is selected. The Z-test is suitable for large-sample normally distributed data, and it determines anomalies by calculating the degree of deviation of the current data value from the historical mean (i.e., the Z-value). Its calculation formula is:

[0065]

[0066] in, Z is the sample mean, μ0 is the known population mean (historical mean), σ is the known population standard deviation, and n is the sample size. When the calculated Z value exceeds ±3 (i.e., the 3-sigma critical value), the current data is determined to be an outlier.

[0067] If the data conforms to a normal distribution, but the sample size is in the range of 10 ≤ N < 30, the T-test algorithm is chosen. Because the standard deviation estimation error is relatively large for small sample normally distributed data, the T-test uses the sample standard deviation *s* to replace the population standard deviation. The calculation formula is:

[0068]

[0069] in, Here, μ0 is the known population mean (historical mean), s is the known sample standard deviation, n is the sample size, and df = n-1 degrees of freedom. By querying the critical value of the t-distribution at the corresponding degrees of freedom (e.g., the two-tailed critical value corresponding to a significance level of 0.05), if the calculated t-value exceeds the critical range, the data is considered abnormal.

[0070] If the data does not conform to a normal distribution, or the sample size N < 10, the box plot method is chosen. The box plot method does not rely on data distribution assumptions; it determines the outlier threshold using the interquartile range (IQR = Q3 - Q1, where Q1 is the lower quartile and Q3 is the upper quartile): the lower bound is Q1 - 1.5 × IQR, and the upper bound is Q3 + 1.5 × IQR. A data value below the lower bound or above the upper bound is considered an outlier.

[0071] After determining the statistical testing algorithm, real-time data from the target audit point is substituted into the selected algorithm for calculation, and the anomaly detection result is output based on the anomaly detection rules corresponding to the algorithm. This process, by dynamically matching data characteristics with statistical algorithms, fully leverages the advantages of different algorithms in different scenarios, effectively avoiding the problem of insufficient adaptability of traditional fixed algorithms to complex data, and improving the accuracy and robustness of anomaly detection.

[0072] Step 103: Based on the anomaly determination results, generate corresponding early warning information and output personalized early warnings according to the region and business type of the audit point.

[0073] In the early warning information generation phase, the system performs structured parsing of the anomaly judgment results, extracting key anomaly information, including but not limited to the unique identifier of the anomaly audit point, the name of the anomaly indicator (such as the number of new users, business revenue, and other core indicators of communication business development), the specific value of the anomaly data, the timestamp of the anomaly occurrence, the anomaly type (such as the "upper" label for exceeding the upper limit or the "lower" label for falling below the lower limit), and the corresponding early warning threshold range (such as the μ±3σ interval calculated based on the 3-sigma principle, or the Q1-1.5×IQR to Q3+1.5×IQR interval determined by the box plot method). Simultaneously, the system automatically correlates the anomaly data with the fluctuation trend over historical periods, generating a brief preliminary analysis of the anomaly cause (such as "the current value deviates from the historical average by 3.2σ, which is the largest deviation in the past 90 days"), providing a basic reference for subsequent processing.

[0074] The system calls a pre-defined audit point attribute tag library to obtain the corresponding geographic information (such as the city, district, etc.) and business type information (such as the channel type, business category, etc.) for the abnormal audit point. Based on these attributes, the system will match the corresponding personalized output rules from the early warning strategy library: For the geographic dimension, the business monitoring needs of different cities vary. For example, abnormal early warnings for audit points in first-tier cities may need to be pushed to the provincial monitoring center first, while abnormal early warnings for audit points in counties will be pushed to the special team of the municipal branch simultaneously; For the business type dimension, abnormal early warnings for core businesses (such as 5G package subscriptions) will use a higher priority push method (such as real-time SMS + system pop-up), while abnormal early warnings for peripheral businesses can be output in the form of periodic summary reports. In addition, the system will also add recommended processing flow guidance (such as "For abnormal broadband services in this city, it is recommended to first check the local network coverage data") to the early warning information based on historical processing experience of geographic region and business type, thereby improving the efficiency of early warning response.

[0075] The results output module distributes personalized early warning information to corresponding terminals or platforms, including anomaly indicators on the web monitoring interface, push notifications from mobile apps, and email or SMS reminders. This ensures that relevant personnel in different regions and business types can obtain early warning content tailored to their needs in a timely manner. This effectively solves the problem of insufficient targeting caused by the "one-size-fits-all" output in traditional early warning methods, and significantly improves the practicality and processing efficiency of early warning information.

[0076] In some embodiments, after acquiring historical business data of the target audit point and calculating the mean and standard deviation based on the historical business data to generate a dynamic threshold range, the method further includes:

[0077] The audit point data collected in real time is preprocessed; wherein the preprocessing includes at least one of missing value imputation and outlier cleaning.

[0078] For audit point data collected in real time, missing value imputation is performed first. Since communication service data may be missing during real-time transmission or collection due to equipment failures, network fluctuations, etc., an appropriate imputation strategy must be adopted to avoid the missing data affecting the accuracy of subsequent anomaly detection: For business indicators with obvious time-series characteristics (such as hourly business processing volume), linear interpolation or the mean of adjacent time points can be used for imputation, making reasonable estimates based on the effective data trend before and after the missing data; for discrete business indicators (such as channel type identification data), the mode imputation method can be used, filling in the missing data with the most frequent value from the historical business data of the audit point to ensure the integrity of the data sequence.

[0079] Simultaneously, outlier cleaning is performed on real-time data. Real-time data may contain extreme or unreasonable values ​​(such as negative business processing volumes) due to acquisition errors, equipment malfunctions, etc. Directly using such data for subsequent anomaly detection would interfere with the reliability of the results. Therefore, it is necessary to initially identify obvious outliers in real-time data based on the distribution characteristics of historical business data. For example, extreme values ​​exceeding the dynamic threshold range of historical business data can be marked as anomalies, or invalid data can be filtered out using simple statistical rules (such as whether the value is within the reasonable range of business logic). Appropriate methods should be used to process these outliers, such as replacing or removing them with the historical average for that period and recording missing identifiers, to ensure that the data entering the subsequent anomaly detection stage has basic accuracy and reasonableness.

[0080] The preprocessing operations of missing value imputation and outlier cleaning described above can effectively improve the quality of real-time audit point data, providing a reliable data foundation for subsequent anomaly detection based on statistical testing algorithms, and avoiding a decrease in the accuracy of early warnings due to data quality issues.

[0081] In some embodiments, obtaining historical business data of the target audit point and calculating the mean and standard deviation based on the historical business data to generate a dynamic threshold range includes:

[0082] The historical business data is segmented based on a sliding window mechanism, and the mean and standard deviation of each segment are calculated.

[0083] First, set the sliding window parameters, including window size and sliding step, based on the business cycle characteristics of the target audit point (such as daily, weekly, or monthly business fluctuation patterns). The window size should be set in conjunction with the time granularity of the business scenario. For example, for communication business indicators with obvious daily cycle fluctuations (such as daily average user activity), the window size can be set to 30 days to cover a complete business fluctuation cycle. The sliding step is set according to real-time requirements, such as sliding the window once a day to ensure that the threshold can respond promptly to recent changes in data trends.

[0084] Subsequently, a sliding window mechanism is used to segment the preprocessed historical business data. Using the time series as the axis, starting from the beginning of the historical business data, a first segment of data is extracted according to a set window size as the initial window sample. Then, the window is moved forward sequentially according to the sliding step size, extracting subsequent continuous historical business data segments, forming multiple continuous and partially overlapping window data segments. For example, if the historical business data consists of 100 consecutive days of business volume data, with a window size of 30 days and a sliding step size of 1 day, 71 window data segments can be generated (days 1-30, 2-31... 71-100), each window containing 30 days of continuous data.

[0085] For each window of data, calculate its corresponding mean μ. k and standard deviation σ k , where k is the window number. Mean μ k The standard deviation σ is obtained by taking the arithmetic mean of all data values ​​within the window, reflecting the central tendency of business indicators during that window period; k By calculating the values ​​of each data point within the window and the mean μ k The square root of the mean of the squared deviations is used to determine the dispersion of the data within that window period. Based on the 3-sigma principle, the dynamic threshold range corresponding to each window data segment is (μ k -3σ k μ k +3σ k The lower bound of the window is μ. k -3σ k The upper bound is μk+3σ k .

[0086] As the sliding window moves continuously, the system constantly incorporates new historical business data and removes the earliest data, updating the mean and standard deviation of the window data segment in real time, thereby dynamically adjusting the threshold range. This segmented processing method can accurately capture the recent distribution characteristics of historical business data, making the dynamic threshold range more closely match the short-term fluctuation trends of business indicators. It effectively solves the problem that traditional fixed-period threshold calculations are difficult to adapt to seasonal changes and sudden trend adjustments in data, further improving the adaptability of the threshold range to dynamic changes in business scenarios and the accuracy of early warning.

[0087] In some embodiments, the preprocessing of the real-time collected audit point data includes:

[0088] Missing values ​​are filled using time series interpolation, which includes at least one of linear interpolation and predictive interpolation based on historical trends.

[0089] Outlier cleaning was performed on the initially collected data using a box plot method.

[0090] For missing value imputation, time series interpolation is used, including at least one of linear interpolation and historical trend-based predictive interpolation. Linear interpolation is suitable for scenarios where real-time data has short-term, continuous missing values ​​and the overall data shows a linear trend: when a missing data point is detected within a certain time period, the estimated value of the missing point is calculated using a linear function based on valid data points before and after the missing period (e.g., the measured value before and after the missing value), ensuring the continuity of the data sequence. Historical trend-based predictive interpolation is suitable for business indicators with obvious periodicity or trends (e.g., peak business data at fixed times each week): by analyzing the changing trends of historical data for the same period at the audit point (e.g., the growth pattern of business volume in the same period over the past four weeks), a simple trend prediction model, such as a moving average model, is constructed, and the missing value is predicted using historical trend parameters.

[0091] For outlier cleaning, the initially collected data is processed using a box plot method. First, the raw real-time data is quartile-calculated: after sorting the data in ascending order, the first quartile Q1 (value at the 25th percentile) and the third quartile Q3 (value at the 75th percentile) are determined, and the interquartile range (IQR) is calculated as IQR = Q3 - Q1. Then, outlier thresholds are determined, with a lower bound of Q1 - 1.5 × IQR and an upper bound of Q3 + 1.5 × IQR. Values ​​exceeding these upper and lower bounds in the real-time data are marked as outliers. For these marked outliers, an appropriate cleaning method is selected based on the business scenario: for extreme outliers caused by collection errors (such as values ​​significantly exceeding the business logic range), the historical average for that period or the interpolation result of adjacent valid data is used as a replacement; for values ​​that may reflect real business fluctuations but deviate significantly, the data is retained and an anomaly label is recorded for further verification in subsequent anomaly detection stages.

[0092] By using the time series interpolation method for missing value imputation and the box plot method for outlier cleaning, the integrity and accuracy issues in real-time data are effectively repaired. This avoids analysis interruptions caused by missing data and interference from outliers with subsequent statistical testing algorithms, providing high-quality data input for anomaly detection within the dynamic threshold range.

[0093] In some embodiments, determining a statistical testing algorithm based on the data sample size and distribution characteristics of the target audit point, and performing anomaly detection on the data of the target audit point, includes:

[0094] In response to a sample size greater than a preset number and data conforming to a normal distribution, the statistical test algorithm is determined to be the Z-test algorithm.

[0095] The statistical test algorithm is determined to be the T-test algorithm when the sample size is less than or equal to a preset number and the data conforms to a normal distribution.

[0096] The preprocessed data for the target audit points undergoes sample size statistics and distribution characteristic analysis. Data statistical tools are used to obtain the effective sample size (i.e., the actual number of data entries included in the analysis). Simultaneously, normality tests (such as the Shapiro-Wilk test and QQ plot analysis) are employed to determine whether the data conforms to a normal distribution, ensuring accurate identification of the data distribution pattern. The preset sample size is typically set to 30, a value based on the statistical distinction between large and small samples, and suitable for the fluctuation patterns of most communication service data.

[0097] If the statistical results show that the sample size is greater than the preset number (i.e., sample size > 30) and the data conforms to a normal distribution after testing, then the statistical test algorithm is determined to be the Z-test algorithm. The Z-test algorithm is suitable for anomaly detection of large sample normally distributed data. Its core is to identify anomalies by calculating the standardized deviation (Z-score) of the current data from the historical mean.

[0098] If the statistical results show that the sample size is less than or equal to the preset number (i.e., sample size ≤ 30) and the data conforms to a normal distribution, then the statistical test algorithm is determined to be the T-test algorithm. The T-test algorithm is suitable for small sample normally distributed data (especially in scenarios where the population standard deviation is unknown), and reduces the impact of small sample error by substituting the population standard deviation with the sample standard deviation.

[0099] Through the aforementioned dynamic selection mechanism based on sample size and normal distribution characteristics, statistical testing algorithms can be precisely matched with data features: the stability advantage of the Z test in large sample scenarios can be brought into play, and the adaptability advantage of the T test to standard deviation estimation error in small sample scenarios can be effectively utilized, thereby improving the accuracy and reliability of anomaly detection under different data scales.

[0100] In some embodiments, the method further includes:

[0101] The system compares and analyzes early warning information with historical early warning records to identify early warning patterns and generate early warning trend reports.

[0102] The system uses the result output module to link with the historical early warning record database, extracting historical early warning data for the target audit point and similar audit points (such as the same region or the same business type), including key information such as the time of occurrence of historical early warnings, abnormal indicator type, abnormal value size, early warning threshold range, abnormal judgment algorithm and subsequent processing results, to construct a complete historical early warning feature dataset.

[0103] Subsequently, a multi-dimensional comparative analysis was conducted between the currently generated early warning information and historical early warning records. From a time perspective, the correlation between current and historical early warnings was analyzed in terms of occurrence time (e.g., whether they are concentrated at the beginning of the month, holidays, or other specific periods) and interval (e.g., whether there is a periodic pattern of early warnings). From an indicator perspective, the consistency of the types of abnormal indicators (e.g., new user growth, business revenue, etc.) and the degree of abnormality (e.g., the extent of deviation from thresholds) with similar historical anomalies was compared. From a geographical and business type perspective, the frequency characteristics of early warnings in the same region or business type were statistically analyzed to identify whether there are regional or business-wide common abnormal patterns.

[0104] Based on the comparative analysis results, statistical analysis and pattern recognition methods (such as time series pattern mining and cluster analysis) are used to identify early warning patterns. For example, if a city's broadband service experiences an abnormal increase in user complaints for several consecutive weekends, and the deviation shows a gradually increasing trend, it is identified as a "weekend broadband complaint volume periodic increase pattern"; if abnormal service volume warnings for a certain channel repeatedly coincide with the timing of promotional activities for that channel, it is identified as a "promotional activity-related early warning pattern". Simultaneously, trend statistics are performed on early warning frequency, anomaly severity (such as Z-value / T-value deviation), and early warning type distribution to form quantitative trend indicators (such as monthly early warning frequency growth rate and average anomaly deviation value change curve).

[0105] Finally, an early warning trend report is generated based on the identified early warning patterns and trend indicators. The report includes: a detailed description of the early warning pattern's characteristics (e.g., occurrence patterns, related factors), trend change analysis (e.g., whether the frequency of early warnings is increasing, whether the degree of abnormality is intensifying), potential risk warnings (e.g., predicting possible future abnormal scenarios based on the pattern), and optimization suggestions (e.g., adjusting the time window parameters of dynamic thresholds for periodic patterns, and optimizing business processes for common issues). This report is pushed to relevant business departments through the results output module, providing data support for optimizing business monitoring strategies and predicting risks, further enhancing the early warning system's foresight and decision-making support capabilities.

[0106] The following example illustrates the method for monitoring index anomalies provided in the embodiments of this application.

[0107] Please see Figure 2 , Figure 2 A flowchart of a method for detecting index anomalies provided in an embodiment of this disclosure is shown below. Figure 2 As shown, the thresholdless intelligent early warning system for audit points of the present invention mainly consists of a data acquisition module, a data preprocessing module, a model training module, an early warning generation module, and a result output module. The data acquisition module is responsible for obtaining audit point data from the database; the data preprocessing module cleans the data, handles missing values, and processes outliers; the model training module uses machine learning algorithms to train the preprocessed data to generate an early warning model; the early warning generation module provides real-time early warnings for the audit point data based on the trained model; and the result output module outputs the early warning results to the user.

[0108] This invention employs a distribution-based method to determine whether the current value is consistent with the general level of historical values. If there is a significant difference from the historical level, it is considered an outlier. Specific algorithms include Z-test, T-test, and boxplot methods.

[0109] Please see Figure 3 , Figure 3 This is a schematic diagram of a Z-test distribution probability provided in an embodiment of this disclosure, as shown below. Figure 3 As shown, the Z-test is used to determine whether the difference between the sample mean and the known population mean is significant. When the sample size is large enough (>30), the population mean and population standard deviation can be replaced by the sample mean and sample variance. By calculating the Z-value of the sample data, it is determined whether a certain observation deviates significantly from the population mean. Usually, a significance level (e.g., 0.05) is set, and the corresponding critical value of the Z-value (e.g., ±1.96) can be used to identify outliers.

[0110]

[0111] σ is the sample mean, μ0 is the known population mean (historical mean), σ is the known population standard deviation, and n is the sample size.

[0112] When the Z-value threshold is 3, the commonly used 3-sigma principle applies. Data exhibiting a normal distribution with a probability of 0.9974 within the range (μ-3σ, μ+3σ) represents the mean and σ represents the standard deviation. In other words, approximately 99.7% of the data will fall within three standard deviations of the mean.

[0113] Please see Figure 4 , Figure 4 This is a schematic diagram of a T-test distribution probability provided in an embodiment of the present disclosure, as shown below. Figure 4 As shown, the t-test is used when the data follows a normal distribution, the variance is unknown, and the data volume is small (<=30). It verifies whether the current value is consistent with the historical mean. By calculating the t-value of the sample data, it determines whether a certain observation significantly deviates from the population mean. A significance level (e.g., 0.05) is usually set, and the corresponding critical value of the t-value can be used to identify outliers.

[0114]

[0115] is the sample mean, μ0 is the known population mean (historical mean), s is the known sample standard deviation, n is the sample size, and the degrees of freedom df = n-1.

[0116] Please see Figure 5 , Figure 5 This is a schematic diagram of a box plot test provided in an embodiment of the present disclosure, such as... Figure 5 As shown, in statistics, it is believed that the first quantile (25%) and third quantile (75%) of any distribution of data can relatively stably represent the overall numerical distribution. Therefore, the interquartile range (IQR) is often used to identify outliers. The interquartile range (IQR) is the difference between Q3 and Q1, and the formula is: IQR = Q3 - Q1.

[0117] The interquartile range (IOR) measures the dispersion of the middle 50% of the data. Generally, using IQR requires at least 5-10 samples, and the rules for identifying outliers are as follows:

[0118] Lower bound: Q1 - 1.5 × IQR. Any value below Q1 - 1.5 × IQR is considered an outlier.

[0119] Upper bound: Q3 + 1.5 × IQR. Any value higher than Q3 + 1.5 × IQR is considered an outlier.

[0120] Model training and early warning generation

[0121] The model training module uses historical business data to train machine learning algorithms, generating early warning models applicable to different audit points. The early warning generation module then uses the trained model to issue early warnings based on real-time audit point data. The specific steps are as follows:

[0122] 1. Data Acquisition and Preprocessing: Obtain audit point data from the database and perform cleaning, missing value handling, and outlier handling.

[0123] 2. Model Selection and Training: Based on the data distribution and business scenario, select appropriate machine learning algorithms (such as Z-test, T-test, box plot method, etc.) to train the preprocessed data and generate an early warning model.

[0124] 3. Early Warning Generation: Using a trained model, early warnings are generated for real-time audit point data. Based on the early warning results output by the model, it is determined whether the data is abnormal.

[0125] 4. Results Output: The warning results are output, including detailed information on abnormal data and warning thresholds.

[0126] Corresponding to the aforementioned method for monitoring indicator anomalies, this invention also proposes a device for monitoring indicator anomalies. Since the device embodiments of this invention correspond to the method embodiments described above, details not disclosed in the device embodiments can be referred to in the method embodiments, and will not be repeated here.

[0127] Figure 6 This is a schematic diagram of the structure of a monitoring device for indicator anomalies provided in an embodiment of this disclosure, as shown below. Figure 6 As shown, it includes:

[0128] The acquisition unit 21 is used to acquire historical business data of the target audit point, and calculate the mean and standard deviation based on the historical business data to generate a dynamic threshold range;

[0129] The determining unit 22 is used to determine a statistical test algorithm based on the data sample size and distribution characteristics of the target audit point, and to make anomaly judgments on the data of the target audit point;

[0130] Output unit 23 is used to generate corresponding early warning information based on the anomaly judgment result, and to provide personalized early warning output according to the region and business type of the audit point.

[0131] Furthermore, in one possible implementation of the embodiments of this disclosure, such as Figure 7 As shown, the device further includes:

[0132] The preprocessing unit 24 is used to preprocess the real-time collected audit point data after the acquisition unit 21 acquires the historical business data of the target audit point and calculates the mean and standard deviation based on the historical business data to generate a dynamic threshold range; wherein, the preprocessing includes at least one of missing value imputation and outlier cleaning.

[0133] Furthermore, in one possible implementation of this disclosure, the acquisition unit 21 is further configured to:

[0134] The historical business data is segmented based on a sliding window mechanism, and the mean and standard deviation of each segment are calculated.

[0135] Furthermore, in one possible implementation of this disclosure, the preprocessing unit 24 is further configured to:

[0136] Missing values ​​are filled using time series interpolation, which includes at least one of linear interpolation and predictive interpolation based on historical trends.

[0137] Outlier cleaning was performed on the initially collected data using a box plot method.

[0138] Furthermore, in one possible implementation of this disclosure, the determining unit 22 is further configured to:

[0139] In response to a sample size greater than a preset number and data conforming to a normal distribution, the statistical test algorithm is determined to be the Z-test algorithm.

[0140] The statistical test algorithm is determined to be the T-test algorithm when the sample size is less than or equal to a preset number and the data conforms to a normal distribution.

[0141] Furthermore, in one possible implementation of the embodiments of this disclosure, such as Figure 7 As shown, the device further includes:

[0142] The generation unit 25 is used to compare and analyze the early warning information with historical early warning records, identify early warning patterns, and generate early warning trend reports.

[0143] It should be noted that the foregoing explanation of the method embodiments also applies to the apparatus of the embodiments of this disclosure, and the principle is the same. Therefore, the embodiments of this disclosure are not limited thereto.

[0144] According to embodiments of this disclosure, this disclosure also provides an electronic device, a readable storage medium, and a computer program product.

[0145] Figure 8 A schematic block diagram of an example electronic device 300 that can be used to implement embodiments of the present disclosure is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device may also represent various forms of mobile devices, such as personal digital assistants, cellular phones, smartphones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the present disclosure described and / or claimed herein.

[0146] like Figure 8 As shown, device 300 includes a computing unit 301, which can perform various appropriate actions and processes based on a computer program stored in ROM (Read-Only Memory) 302 or a computer program loaded from storage unit 308 into RAM (Random Access Memory) 303. RAM 303 can also store various programs and data required for the operation of device 300. The computing unit 301, ROM 302, and RAM 303 are interconnected via bus 304. I / O (Input / Output) interface 305 is also connected to bus 304.

[0147] Multiple components in device 300 are connected to I / O interface 305, including: input unit 306, such as keyboard, mouse, etc.; output unit 307, such as various types of monitors, speakers, etc.; storage unit 308, such as disk, optical disk, etc.; and communication unit 309, such as network card, modem, wireless transceiver, etc. Communication unit 309 allows device 300 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0148] The computing unit 301 can be various general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of the computing unit 301 include, but are not limited to, CPUs (Central Processing Units), GPUs (Graphics Processing Units), various special-purpose AI (Artificial Intelligence) computing chips, various computing units running machine learning model algorithms, DSPs (Digital Signal Processors), and any suitable processor, controller, microcontroller, etc. The computing unit 301 performs the various methods and processes described above, such as methods for monitoring indicator anomalies. For example, in some embodiments, the method for monitoring indicator anomalies may be implemented as a computer software program tangibly contained in a machine-readable medium, such as storage unit 308. In some embodiments, part or all of the computer program may be loaded and / or installed on device 300 via ROM 302 and / or communication unit 309. When the computer program is loaded into RAM 303 and executed by the computing unit 301, one or more steps of the methods described above may be performed. Alternatively, in other embodiments, the computing unit 301 may be configured to perform the aforementioned method for monitoring index anomalies by any other suitable means (e.g., by means of firmware).

[0149] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, FPGAs (Field Programmable Gate Arrays), ASICs (Application-Specific Integrated Circuits), ASSPs (Application-Specific Standard Products), SOCs (System-on-Chips), CPLDs (Complex Programmable Logic Devices), computer hardware, firmware, software, and / or combinations thereof. These various implementations may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0150] The program code used to implement the methods of this disclosure may be written in any combination of one or more programming languages. This program code may be provided to a processor or controller of a general-purpose computer, special-purpose computer, or other programmable data processing apparatus, such that when executed by the processor or controller, the program code causes the functions / operations specified in the flowcharts and / or block diagrams to be implemented. The program code may be executed entirely on a machine, partially on a machine, as a standalone software package partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0151] In the context of this disclosure, a machine-readable medium can be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, apparatus, or device. A machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium can be, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination of the foregoing. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, RAM, ROM, EPROM (Electrically Programmable Read-Only Memory) or flash memory, optical fiber, CD-ROM (Compact Disc Read-Only Memory), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0152] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device for displaying information to the user (e.g., a CRT (Cathode-Ray Tube) or LCD (Liquid Crystal Display) monitor); and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the computer. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0153] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as data servers), or middleware components (e.g., application servers), or frontend components (e.g., user computers with graphical user interfaces or web browsers through which users can interact with implementations of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication (e.g., communication networks) of any form or medium. Examples of communication networks include LANs (Local Area Networks), WANs (Wide Area Networks), the Internet, and blockchain networks.

[0154] Computer systems can include clients and servers. Clients and servers are generally geographically separated and typically interact via communication networks. The client-server relationship is created by computer programs running on the respective computers and having a client-server relationship with each other. A server can be a cloud server, also known as a cloud computing server or cloud host, a hosting product within the cloud computing service ecosystem, addressing the shortcomings of traditional physical hosts and VPS (Virtual Private Server, or simply "VPS") services, such as high management difficulty and weak business scalability. Servers can also be servers for distributed systems or servers incorporating blockchain technology.

[0155] It's important to note that artificial intelligence (AI) is the study of enabling computers to simulate certain human thought processes and intelligent behaviors (such as learning, reasoning, thinking, and planning). It encompasses both hardware and software technologies. AI hardware technologies generally include sensors, dedicated AI chips, cloud computing, distributed storage, and big data processing. AI software technologies primarily include computer vision, speech recognition, natural language processing, machine learning / deep learning, big data processing, and knowledge graph technologies.

[0156] It should be understood that the various forms of processes shown above can be used to rearrange, add, or delete steps. For example, the steps described in this disclosure can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution disclosed in this disclosure can be achieved, and this is not limited herein.

[0157] The specific embodiments described above do not constitute a limitation on the scope of protection of this disclosure. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this disclosure should be included within the scope of protection of this disclosure.

Claims

1. A method of monitoring for an indicator transaction, the method comprising: The method comprises the following steps: acquiring historical business data of a target audit point, and calculating mean value and standard deviation based on the historical business data to generate a dynamic threshold range; determining a statistical test algorithm according to the data sample size and distribution characteristics of the target audit point, and performing abnormality determination on the data of the target audit point; generating corresponding early warning information based on the abnormality determination result, and performing personalized early warning output according to the region and business type to which the audit point belongs.

2. The method of claim 1, wherein, After acquiring the historical business data of the target audit point and calculating the mean value and standard deviation based on the historical business data to generate the dynamic threshold range, the method further comprises: performing preprocessing on the real-time collected audit point data; wherein the preprocessing comprises at least one of missing value filling and abnormal value cleaning.

3. The method of claim 1, wherein, The acquiring of the historical business data of the target audit point and the calculation of the mean value and standard deviation based on the historical business data to generate the dynamic threshold range comprises: performing segmented processing on the historical business data based on a sliding window mechanism, and calculating the corresponding mean value and standard deviation based on each segment of data.

4. The method of claim 2, wherein, The preprocessing of the real-time collected audit point data comprises: filling the missing values by using a time series interpolation method, the time series interpolation method comprising at least one of linear interpolation and prediction interpolation based on historical trends; cleaning the abnormal values of the initially collected data based on a box plot method.

5. The method of claim 1, wherein, The determination of the statistical test algorithm according to the data sample size and distribution characteristics of the target audit point, and the abnormality determination on the data of the target audit point comprise: in response to the sample size being greater than a preset number and the data conforming to a normal distribution, determining the statistical test algorithm as a Z-test algorithm; in response to the sample size being less than or equal to the preset number and the data conforming to a normal distribution, determining the statistical test algorithm as a T-test algorithm.

6. The method according to any one of claims 1-5, characterized in that, The method further comprises: comparing and analyzing the early warning information with historical early warning records, identifying early warning patterns, and generating an early warning trend report.

7. A monitoring device for monitoring index transactions, characterized in that The method comprises the following steps: an acquiring unit configured to acquire historical business data of a target audit point, and calculate mean value and standard deviation based on the historical business data to generate a dynamic threshold range; a determining unit configured to determine a statistical test algorithm according to the data sample size and distribution characteristics of the target audit point, and perform abnormality determination on the data of the target audit point; an output unit configured to generate corresponding early warning information based on the abnormality determination result, and perform personalized early warning output according to the region and business type to which the audit point belongs.

8. An electronic device, comprising: The method comprises the following steps: at least one processor; and a memory connected in communication with the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the method of any one of claims 1-6.

9. A non-transitory computer-readable storage medium having stored thereon computer instructions, wherein, The computer instructions are used to enable the computer to perform the method of any one of claims 1-6.

10. A computer program product, characterised in that, The computer program, when executed by a processor, implements the method of any one of claims 1-6.

Images