Transaction monitoring method, device, equipment, medium and program product

Abstract

The invention provides a transaction monitoring method which can be applied to the field of financial science and technology, and particularly relates to the technical field of monitoring and operation and maintenance in the financial field. The transaction monitoring method comprises the steps of obtaining a business success rate of a target time period according to a ratio of a successful transaction volume to a time period transaction volume of the target time period; triggering an alarm in response to the fact that the deviation between the service success rate and the baseline value of the target time period is greater than a preset alarm threshold value; wherein the baseline value of the target time period is obtained by weighting the business success rates of the continuous N time periods and the weight values of the corresponding time periods, the weight values are obtained according to the ratio of the time period transaction volume of the corresponding time periods to the sum of the time period transaction volumes of the continuous N time periods, and N is a positive integer. The invention further provides a transaction monitoring device, transaction monitoring equipment, a medium and a program product.

Description

Technical Field

[0001] This application relates to the field of financial technology, specifically to monitoring and operation and maintenance technologies in the financial sector, and more specifically to a transaction monitoring method, device, equipment, medium, and program product. Background Technology

[0002] Existing business success rate monitoring technologies typically aggregate transaction data at the minute-by-minute granularity, statistically analyze success rates and transaction volumes, and use time series models to predict the average success rate at each time point of the day as a static baseline. An alarm is triggered when the real-time success rate falls below the baseline. This monitoring method is unsuitable for special scenarios; therefore, transaction monitoring methods need improvement. Summary of the Invention

[0003] In view of the above problems, this application provides transaction monitoring methods, apparatus, devices, media and program products to improve baseline sensitivity.

[0004] According to a first aspect of this application, a transaction monitoring method is provided, comprising: obtaining a business success rate for a target time period based on the ratio of successful transaction volume to the total transaction volume for that time period; and triggering an alarm in response to a deviation of the business success rate from a baseline value for the target time period exceeding a preset alarm threshold; wherein the baseline value for the target time period is obtained by weighting the business success rates of N consecutive time periods with the corresponding weight values, and the weight values ​​are obtained by the ratio of the transaction volume for the corresponding time period to the sum of the transaction volumes for the N consecutive time periods, where N is a positive integer.

[0005] According to an embodiment of this application, the weight value is obtained based on the ratio of the trading volume of a time period to the trading volume of N consecutive time periods, including: using the trading volume of the time period as the base and a preset trading volume decay factor as the exponent to perform a power operation to obtain the decayed trading volume of the time period, wherein the trading volume decay factor is greater than 0; accumulating the decayed trading volumes of N consecutive time periods to obtain the sum of decayed trading volumes of the time period; and calculating the ratio of the decayed trading volume of the time period to the sum of decayed trading volumes of the time period to obtain the weight value.

[0006] According to an embodiment of this application, the baseline value of the target time period is obtained by weighting the business success rate of N consecutive time periods with the weight value of the corresponding time period, including: obtaining the first-level smoothed baseline value of the target time period by weighted summing the business success rate of N consecutive time periods with the weight value of the corresponding time period; calculating the second-level smoothed baseline value of the target time period using the exponential moving average method based on the first-level smoothed baseline value, a preset dynamic smoothing coefficient, and the second-level smoothed baseline value of the previous time period; and using the second-level smoothed baseline value as the baseline value of the target time period.

[0007] According to an embodiment of this application, the method further includes: calculating the deviation between the primary smoothing baseline value of the target time period and the secondary smoothing baseline value of the previous time period to obtain the time period deviation value of the target time period; and increasing the preset dynamic smoothing coefficient in response to the time period deviation value being greater than a preset time period deviation threshold.

[0008] According to an embodiment of this application, the method further includes: calculating the average absolute error of the target time period using the exponential moving average method based on the time period deviation value of the target time period, a preset error smoothing coefficient, and the average absolute error of the previous time period; calculating the error ratio based on the time period deviation value and the average absolute error of the target time period; and increasing the preset dynamic smoothing coefficient if the error ratio is greater than a preset error ratio threshold.

[0009] According to an embodiment of this application, the method further includes: obtaining the minimum value between the dynamic smoothing coefficient and the preset maximum dynamic smoothing coefficient; obtaining the maximum value between the minimum value and the preset minimum dynamic smoothing coefficient; and setting the dynamic smoothing coefficient to the maximum value.

[0010] According to an embodiment of this application, if the deviation between the business success rate and the baseline value of the target time period is greater than a preset alarm threshold, an alarm is triggered, including: obtaining the average value and standard deviation of the baseline values ​​based on the baseline values ​​of N time periods; if the deviation between the business success rate and the average value of the baseline values ​​is greater than twice the standard deviation of the baseline values, an alarm is triggered.

[0011] The second aspect of this application provides a transaction monitoring device, comprising: a business success rate acquisition module, configured to obtain the business success rate of a target time period based on the ratio of the successful transaction volume of the target time period to the transaction volume of the time period; and a business alarm triggering module, configured to trigger an alarm in response to the deviation of the business success rate from the baseline value of the target time period being greater than a preset alarm threshold; wherein, the baseline value of the target time period is obtained by weighting the business success rate of N consecutive time periods with the weight value of the corresponding time period, and the weight value is obtained by the ratio of the transaction volume of the corresponding time period to the sum of the transaction volumes of the N consecutive time periods, where N is a positive integer.

[0012] A third aspect of this application provides an electronic device comprising: one or more processors; and a memory for storing one or more computer programs, wherein the one or more processors execute the one or more computer programs to implement the steps of the method described above.

[0013] A fourth aspect of this application also provides a computer-readable storage medium having a computer program or instructions stored thereon, which, when executed by a processor, implement the steps of the above-described method.

[0014] The fifth aspect of this application also provides a computer program product, including a computer program or instructions that, when executed by a processor, implement the steps of the above-described method. Attached Figure Description

[0015] The above-mentioned contents, other objects, features and advantages of this application will become clearer from the following description of embodiments with reference to the accompanying drawings, in which:

[0016] Figure 1 The illustrations depict application scenarios of transaction monitoring methods, apparatus, devices, media, and program products according to embodiments of this application.

[0017] Figure 2 A flowchart illustrating a transaction monitoring method according to an embodiment of this application is shown schematically;

[0018] Figure 3 A flowchart illustrating a second transaction monitoring method according to an embodiment of this application is shown schematically;

[0019] Figure 4 A flowchart illustrating a third transaction monitoring method according to an embodiment of this application is shown schematically.

[0020] Figure 5 A flowchart illustrating a fourth transaction monitoring method according to an embodiment of this application is shown schematically;

[0021] Figure 6 This schematically illustrates a structural block diagram of a transaction monitoring device according to an embodiment of this application; and

[0022] Figure 7 A block diagram schematically illustrates an electronic device suitable for implementing a transaction monitoring method according to an embodiment of this application. Detailed Implementation

[0023] The embodiments of this application will now be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of this application. In the following detailed description, numerous specific details are set forth to provide a thorough understanding of the embodiments of this application for ease of explanation. However, it will be apparent that one or more embodiments may be implemented without these specific details. Furthermore, descriptions of well-known structures and technologies are omitted in the following description to avoid unnecessarily obscuring the concepts of this application.

[0024] The terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit the scope of this application. The terms “comprising,” “including,” etc., as used herein indicate the presence of features, steps, operations, and / or components, but do not exclude the presence or addition of one or more other features, steps, operations, or components.

[0025] All terms used herein (including technical and scientific terms) have the meanings commonly understood by those skilled in the art, unless otherwise defined. It should be noted that the terms used herein are to be interpreted in a manner consistent with the context of this specification, and not in an idealized or overly rigid way.

[0026] When using expressions such as "at least one of A, B and C", they should generally be interpreted in accordance with the meaning that is commonly understood by those skilled in the art (e.g., "a system having at least one of A, B and C" should include, but is not limited to, a system having A alone, a system having B alone, a system having C alone, a system having A and B, a system having A and C, a system having B and C, and / or a system having A, B and C, etc.).

[0027] It should be noted that the transaction monitoring method and device of this application can be used for monitoring and maintenance in the financial field, as well as in any field other than the financial field. The application field of the transaction monitoring method and device of this application is not limited.

[0028] In the technical solution of this application, the user information (including but not limited to user personal information, user image information, user device information, such as location information) and data (including but not limited to data used for analysis, stored data, and displayed data) involved are all information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, storage, use, processing, transmission, provision, disclosure, and application of related data all comply with relevant laws, regulations, and standards, take necessary confidentiality measures, do not violate public order and good morals, and provide corresponding operation entry points for users to choose to authorize or refuse.

[0029] In scenarios involving automated decision-making using personal information, the methods, devices, and systems provided in this application all offer users corresponding entry points for choosing to agree to or reject the automated decision-making results. If the user chooses to reject, the process proceeds to the expert decision-making stage. Here, "automated decision-making" refers to the activity of automatically analyzing and evaluating an individual's behavioral habits, interests, or economic, health, and credit status through computer programs, and then making a decision. Here, "expert decision-making" refers to the activity of making decisions by personnel who specialize in a particular field, possess specialized experience, knowledge, and skills, and have reached a certain level of professional expertise.

[0030] Existing transaction monitoring technologies often rely on static baselines that fail to differentiate between high and low transaction volumes. Even a small number of failed transactions can trigger alarms, resulting in a high false alarm rate under low transaction volumes. For example, during the early morning hours, a service might only handle 3-5 transactions per minute. However, because the static baseline uses historical averages (e.g., 99.5%), a single failed transaction can cause the success rate to plummet to 80%, triggering a false alarm. Furthermore, machine learning models, dependent on historical data, struggle to handle sudden surges in traffic or changes in transaction patterns during holidays, leading to baseline rigidity. This further necessitates that operations personnel handle hundreds of false alarms daily, increasing operational costs.

[0031] The embodiments of this application provide a transaction monitoring method that optimizes the alarm scheme by setting a dynamic baseline, thereby solving the problems of high false alarm rate and insufficient baseline sensitivity in the prior art.

[0032] Figure 1 The illustration shows an application scenario of the transaction monitoring method, apparatus, device, medium, and program product according to embodiments of this application.

[0033] like Figure 1 As shown, application scenario 100 according to this embodiment may include a first terminal device 101, a second terminal device 102, a third terminal device 103, a network 104, and a server 105. The network 104 serves as a medium for providing a communication link between the first terminal device 101, the second terminal device 102, the third terminal device 103, and the server 105. The network 104 may include various connection types, such as wired or wireless communication links, or fiber optic cables, etc.

[0034] Users can use the first terminal device 101, the second terminal device 102, and the third terminal device 103 to interact with the server 105 via the network 104 to receive or send messages, etc. Various communication client applications can be installed on the first terminal device 101, the second terminal device 102, and the third terminal device 103, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social media platform software, etc. (for example only).

[0035] The first terminal device 101, the second terminal device 102, and the third terminal device 103 can be various electronic devices with displays and support web browsing, including but not limited to smartphones, tablets, laptops, and desktop computers.

[0036] Server 105 can be a server that provides various services, such as a backend management server that supports websites browsed by users using the first terminal device 101, the second terminal device 102, and the third terminal device 103 (this is just an example). The backend management server can analyze and process data such as received user requests, and feed back the processing results (such as web pages, information, or data obtained or generated according to user requests) to the terminal devices.

[0037] It should be noted that the transaction monitoring method provided in this application embodiment can generally be executed by server 105. Correspondingly, the transaction monitoring device provided in this application embodiment can generally be located in server 105. The transaction monitoring method provided in this application embodiment can also be executed by a server or server cluster that is different from server 105 and capable of communicating with the first terminal device 101, the second terminal device 102, the third terminal device 103, and / or server 105. Correspondingly, the transaction monitoring device provided in this application embodiment can also be located in a server or server cluster that is different from server 105 and capable of communicating with the first terminal device 101, the second terminal device 102, the third terminal device 103, and / or server 105.

[0038] It should be understood that Figure 1 The number of terminal devices, networks, and servers shown is merely illustrative. Depending on implementation needs, any number of terminal devices, networks, and servers can be included.

[0039] The following will be based on Figure 1 The described scene, through Figures 2-5 The transaction monitoring method according to the embodiments of this application will be described in detail.

[0040] Figure 2 A flowchart illustrating a transaction monitoring method according to an embodiment of this application is shown.

[0041] like Figure 2 As shown, the transaction monitoring method in this embodiment includes operations S210 to S220.

[0042] In operation S210, the business success rate for the target time period is obtained based on the ratio of the successful transaction volume to the total transaction volume for that time period.

[0043] This embodiment obtains transaction information by inputting real-time transaction logs, which may include transaction response time, return code, transaction type, etc. In some embodiments, transaction volume can be statistically analyzed at the granularity of "minutes," "hours," or "days" to obtain the successful transaction volume and time period transaction volume for a target time period. By calculating the ratio of successful transaction volume to time period transaction volume for the target time period, the business success rate for the target time period can be obtained. For example, if there are 5 time period transactions in a certain minute, of which 4 are successful, then the business success rate for that minute (target time period) is 80%.

[0044] In this embodiment, the obtained transaction data can also be cleaned. Cleaning rules include removing timed-out transactions (e.g., transactions lasting > 8 seconds) and abnormal accounts (blacklist). Removing timed-out transactions and abnormal accounts (blacklist) ensures the accuracy of business success rate statistics and avoids invalid data interfering with baseline value calculation and alarm judgment. Timed-out transactions cannot determine whether a business has truly failed. Furthermore, the causes of timed-out transactions are often network fluctuations, slow responses from third-party systems, and instantaneous high system load, which have weak relevance to the purpose of transaction monitoring. The output data in this operation can be a structured data table, including timestamps, transaction volume, and business success rate.

[0045] In operation S220, an alarm is triggered in response to the deviation of the business success rate from the baseline value of the target time period exceeding a preset alarm threshold. The baseline value of the target time period is obtained by weighting the business success rate of N consecutive time periods with the corresponding weight value. The weight value is obtained by the ratio of the transaction volume of the corresponding time period to the sum of the transaction volumes of the N consecutive time periods, where N is a positive integer.

[0046] In this embodiment, the time period can be defined as a uniformly divided period, with each time point corresponding to a time period. A series of N consecutive time periods can be set to include the target time period. For example, if the target time period is time t, the N consecutive time periods could be t-3, t-2, t-1, and t. Alternatively, the N consecutive time periods can exclude the target time period. For example, if the target time period is t, the N consecutive time periods could be t-4, t-3, t-2, and t-1. In some embodiments, when the N consecutive time periods include the target time period, the monitoring results can be processed at the end of time t. When the N consecutive time periods do not include the target time period, it is not necessary to calculate the baseline value of the target time period using the business success rate and transaction volume data of the target time period. Therefore, it is possible to determine whether the alarm conditions are met at any time within the target time period. The N consecutive time periods can be adjacent to the target time period or separated by a few time periods. For example, if the target time period is t, the N consecutive time periods could be t-6, t-5, t-4, and t-3. Preferably, the N consecutive time periods precede and are adjacent to the target time period. For example, if the target time period is the 15th minute of 13:00, the target time period can be the data at 13:15, and the consecutive N time periods are the data at 13:10, 13:11, 13:12, 13:13, and 13:14.

[0047] In this embodiment, the ratio of the trading volume of a given time period to the sum of the trading volumes of N consecutive time periods can be directly used as the weight value. Alternatively, the weight value can be obtained by further weighting based on the ratio of the trading volume of the corresponding time period to the sum of the trading volumes of N consecutive time periods, such as non-linear weighting or exponential weighting. Non-linear weighting, for example, can assign greater weight to ratios closer to the target time period.

[0048] When the ratio of the trading volume of a time period to the trading volume of N consecutive time periods is used as the weight value, the baseline value of the target time period can be expressed as follows.

[0049]

[0050] in, This represents the baseline value at time t, where N is the number of time intervals. It is the success rate of the i-th time period (time window). It represents the transaction volume for the i-th time period.

[0051] The triggering condition can be expressed as the following formula.

[0052] |Target period business success rate - L t |>Δ

[0053] Here, Δ is the preset alarm threshold, for example, Δ=2%, which can be adjusted according to the business scenario.

[0054] In one embodiment, N=3. The success rates for three consecutive time periods are 99.5%, 98.9%, and 99.3%, respectively. The transaction volumes for the three consecutive time periods are 14, 16, and 15 transactions, respectively. The weight value for the first time period is calculated as 14 / (14+16+15)=0.311. Similarly, the weight value for the second time period is calculated as 0.356, and the weight value for the third time period (the target time period) is calculated as 0.333.

[0055] The baseline value for the third time period (target time period) is L. t=3 ,but =99.5%×0.311+98.9%×0.356+99.3%×0.333. ≈99.22%. The actual business success rate during the target time period was 99.3%, with a deviation of 0.08% from the baseline value. The preset alarm threshold Δ=0.5. Since 0.08%<0.5%, the alarm condition was not met, and no alarm was triggered.

[0056] In the example above, if the business success rate in the third time period becomes 98.4%, after calculation... The value is approximately 98.92%, which is 0.52% different from the baseline value. If the preset threshold Δ=0.5 is set, an alarm will be triggered.

[0057] This embodiment calculates the baseline value for the target time period by weighting the business success rates of N consecutive time periods. The weights are determined based on the ratio of the transaction volume of each time period to the sum of the transaction volumes of the N consecutive time periods. This approach fully utilizes historical data to ensure the rationality of the baseline while giving higher weight to historical data from high-transaction-volume periods. This allows the baseline to align with the fluctuation patterns of business transaction volume, overcoming the limitations of rigid static baselines. Combined with an alarm triggering mechanism, this ultimately improves the accuracy, dynamic adaptability, and effectiveness of business monitoring and reduces the cost of manual intervention in operations and maintenance.

[0058] Figure 3 A flowchart illustrating a second transaction monitoring method according to an embodiment of this application is shown.

[0059] like Figure 3 As shown, in some embodiments of this application, the weight value is obtained based on the ratio of the transaction volume of a time period to the transaction volume of N consecutive time periods, including: operation S310 to operation S330.

[0060] In operation S310, the trading volume of the time period is used as the base, and the trading volume decay factor is used as the exponent to perform a power operation to obtain the decayed trading volume of the time period, wherein the trading volume decay factor is greater than 0.

[0061] In this embodiment, a trading volume decay factor is used as an index of trading volume over a period. By setting an appropriate decay factor, the weighted influence of high trading volume data can be amplified, indirectly achieving a weighting bias towards recent data. Through the exponential amplification of trading volume over a period, combined with the business pattern that recent windows are typically accompanied by high trading volumes, the effect of higher weighting for recent data is indirectly achieved. This solves the problem of existing static baselines not changing with recent events, and allows for dynamic adjustment of the preset trading volume decay factor to adapt to different business fluctuation scenarios, making the baseline value more sensitive and more closely aligned with actual trading conditions.

[0062] In operation S320, the trading volume of each time period after decaying over N consecutive time periods is accumulated to obtain the sum of the decayed trading volume of each time period.

[0063] In operation S330, the ratio of the trading volume of the time period after time decay to the sum of the trading volumes of the time period after decay is calculated to obtain the weight value.

[0064] In this embodiment, the baseline value of the target time period can be expressed as the following formula.

[0065]

[0066] in, As a trading volume decay factor, The value is positive. Preferably, the trading volume decay factor is greater than 1; for example, the trading volume decay factor can be preset to 1.2. A trading volume decay factor greater than 1 has the effect of attenuating the impact of trading volume in the longer term.

[0067] In real-world business scenarios, there is a natural positive correlation between recent time periods and high transaction volumes. For example, during weekday morning and evening peak hours, transaction volumes increase over time, with more recent windows showing higher transaction volumes. The amplification effect of the transaction volume decay factor precisely targets this correlation. By amplifying the weighting value of high-transaction-volume windows, it indirectly gives more weight to recent windows in baseline calculations, ultimately resulting in a greater impact from recent data.

[0068] In one embodiment, N is set to 5, and the transaction volume decay factor is 1.2. The transaction volumes for five consecutive time periods are 12, 15, 18, 25, and 30 transactions, respectively. The business success rates for the five consecutive time periods are 99.2%, 99.1%, 99.3%, 99.0%, and 98.9%, respectively. Calculations show that the decayed transaction volumes for the five time periods are approximately 19.72, 25.78, 32.09, 47.59, and 59.23, respectively. According to operation S330, the weight values ​​are calculated to be 10.69%, 13.98%, 17.40%, 25.81%, and 32.11%, respectively. The final calculated baseline value is approximately 99.05%. The baseline value in this embodiment comprehensively reflects the business success rate level of the five time periods, and is more significantly affected by the high transaction volume periods (i=4 and 5). It can be seen that the larger the transaction volume period, the higher the proportion of decayed transaction volume.

[0069] This embodiment uses the trading volume of a time period as the base and the positive trading volume decay factor as the exponent to calculate the decayed trading volume. Setting an appropriate trading volume decay factor can amplify the decayed trading volume of recent high trading volume periods, allowing high trading volume periods to account for a higher proportion in the weight allocation. This can highlight the reference value of data during periods of business activity and reduce the interference of low trading volume period data on the baseline value.

[0070] Figure 4 A flowchart illustrating a third transaction monitoring method according to an embodiment of this application is shown.

[0071] like Figure 4 As shown, in some embodiments of this application, the baseline value of the target time period is obtained by weighting the business success rate of N consecutive time periods with the weight value of the corresponding time period, including: operation S410 to operation S430.

[0072] When operating S410, the first-level smoothed baseline value of the target time period is obtained by weighted summing of the business success rate of N time periods and the corresponding weight values ​​of the time periods.

[0073] In this embodiment, the first-level smoothing baseline value can be expressed as the following formula.

[0074]

[0075] Among them, L t,1 This represents the first-order smoothed baseline value in the time period t.

[0076] In operation S420, based on the primary smoothing baseline value, the preset dynamic smoothing coefficient, and the secondary smoothing baseline value of the previous time period, the secondary smoothing baseline value of the target time period is calculated using the exponential moving average method.

[0077] In this embodiment, after obtaining the baseline value calculated by the weighted sliding window, baseline smoothing is performed on the baseline value, and the exponential moving average method is used to eliminate short-term fluctuations. Combining the exponential moving average technique achieves a more sensitive dynamic baseline. The secondary smoothed baseline value for time period t is shown. It can be expressed as the following formula.

[0078]

[0079] in, This represents the dynamic smoothing coefficient for time period t. This represents the secondary smoothed baseline value for the time period t-1.

[0080] In operation S430, the secondary smoothed baseline value is used as the baseline value for the target time period.

[0081] In this embodiment, It can be preset to 0.8. For example, if N=3, the business success rates for a certain consecutive time period are 98.5%, 99.2%, 99.0%, 98.8%, and 99.5%, respectively. The corresponding transaction volumes for the time periods are 15, 14, 16, 15, and 14 transactions, respectively.

[0082] Calculated L 3,1 =98.89%, let L 3,2 =L 3,1 =98.89% (The secondary smoothing baseline value can be initialized to the primary smoothing baseline value).

[0083] Further calculations: L 4,1 =98.99%, =98.97%.

[0084] Similarly, L 5,1 =98.99%, = =98.99%.

[0085]

[0086] In the fourth time period, the primary smoothing baseline value was slightly modified and used as the final baseline value to avoid noise interference. In the fifth time period, the primary smoothing baseline value was not significantly adjusted.

[0087] In this embodiment, the primary smoothing baseline is calculated by weighting the business success rates of N time periods with corresponding weights. This highlights the impact of data during periods of high business activity and reduces data interference during periods of low transaction volume, ensuring that the primary baseline closely reflects actual business activity. The secondary smoothing is based on the primary baseline, a dynamic smoothing coefficient, and the secondary baseline from the previous time period. It effectively smooths out occasional fluctuations in the primary baseline using an exponential moving average method, while the dynamic smoothing coefficient flexibly adapts to business fluctuation trends, preventing the baseline from becoming rigid or overly sensitive. Finally, the secondary smoothed baseline is used as the target time period baseline, preserving both sensitive monitoring capabilities for high transaction volume scenarios and ensuring the stability and reliability of the baseline. This two-stage smoothing algorithm enables sensitive monitoring during high transaction volumes and automatic noise reduction during low transaction volumes.

[0088] In some embodiments of this application, the transaction monitoring method further includes: calculating the deviation between the primary smoothing baseline value of the target time period and the secondary smoothing baseline value of the previous time period to obtain the time period deviation value of the target time period; and increasing the preset dynamic smoothing coefficient in response to the time period deviation value being greater than a preset time period deviation threshold.

[0089] In this embodiment, the magnitude of the time period deviation value is used to determine whether the current business fluctuations exceed expectations. If the time period deviation value is too large, it indicates that the current actual business fluctuations are severe, and the dynamic smoothing coefficient needs to be increased to enhance the weight of recent transaction volume data, allowing the baseline to more sensitively keep up with the current actual fluctuations.

[0090] Similarly, if the deviation value over a time period is small, it indicates that the business is stable. The dynamic smoothing coefficient can be reduced to decrease the weight of recent events and avoid excessive fluctuations in the baseline.

[0091] Based on the first-level smoothed baseline value L for the target time period t,1 Compared with the second-order smoothed baseline value L of the previous time period t-1,2 Calculate the time period deviation value e t It can be expressed as the following formula.

[0092] e t =L t,1 -L t-1,2

[0093] For example, in one embodiment, e5 = 0.11% > 0.1% (the preset time period deviation threshold is 0.1%), triggering the operation of increasing the dynamic smoothing coefficient.

[0094] This embodiment calculates the deviation between the primary smoothing baseline value of the target time period and the secondary smoothing baseline value of the previous time period, and increases the dynamic smoothing coefficient when the deviation exceeds a preset threshold. This allows the dynamic baseline to actively perceive business changes, improve its adaptability to the real business trend, and effectively avoid baseline rigidity.

[0095] Figure 5A flowchart illustrating a fourth transaction monitoring method according to an embodiment of this application is shown.

[0096] like Figure 5 As shown, in some embodiments of this application, the transaction monitoring method further includes: operations S510 to S530.

[0097] In operation S510, based on the time period deviation value of the target time period, the preset error smoothing coefficient, and the average absolute error of the previous time period, the average absolute error of the target time period is calculated using the exponential moving average method.

[0098] The mean absolute error for the target time period can be expressed as follows.

[0099] MAD t =β*|e t |+(1-β)*MAD t-1

[0100] Where t>2, MAD t Let MAD2 be the mean absolute error for the target time period t. When t=2, MAD2=|e2|. The initial value of the error smoothing coefficient β can be set to 0.1.

[0101] When operating S520, the error ratio is calculated based on the average absolute error between the time period deviation value and the target time period. The error ratio r is... t It can be expressed as the following formula.

[0102]

[0103] To prevent the denominator from being zero, it can also be expressed as the following formula.

[0104]

[0105] When operating S530, if the error ratio is greater than the preset error ratio threshold, the preset dynamic smoothing coefficient is increased.

[0106] In this embodiment, the preset error ratio threshold can be 1, 0.5, or other values. For example, the preset error ratio threshold can be 1. If r t >1 indicates that the error has increased more than expected, and can be set as follows: = +δ, adjusting the step size δ can be set to 0.05 to increase the impact of the recent time period.

[0107] If r t ≤1 indicates that the error is less than expected, and can be set as follows: = -δ.

[0108] For example, in a transaction monitoring system, the preset time period deviation threshold is 0.1%, the error smoothing coefficient β is 0.1, and the initial dynamic smoothing coefficient α is 0.8. The baseline value L for secondary smoothing in a certain fourth time period... 4,2 =98.95%, the mean absolute error (MAD4) of the 4th time period is 0.08%, and the first-level smoothing baseline value L of the 5th time period (target time period) is... 5,1 =99.1%.

[0109] Calculate the time period deviation: e5=L 5,1 -L 4,2 =99.1% - 98.95% = 0.15%, 0.15% > 0.1% (the preset time period deviation threshold), which initially meets the requirement to increase... conditions.

[0110] The mean absolute error over time period t is calculated using the exponential moving average method: MAD5 = β × |e5| + (1-β) × MAD4 = 0.1 × 0.15% + 0.9 × 0.08% = 0.087%;

[0111] Calculate the error ratio: r5 = e5 / MAD5 = 0.15% / 0.087% ≈ 2 > 1, satisfying the condition of increasing. conditions.

[0112] Ultimately, the dynamic smoothing coefficient will be... The value was increased from 0.8 to 0.85 (adjusting the step size by 0.05) to make the subsequent secondary smoothing baseline closer to the current business reality.

[0113] The transaction volume decay factor can also be further adjusted based on the error ratio of this embodiment in the embodiments of this application.

[0114] This embodiment uses the exponential moving average method to smooth the average absolute error to filter short-term fluctuations. It combines the error ratio to accurately judge the error trend. When the error ratio is greater than the preset error ratio threshold, the dynamic smoothing coefficient is increased. This can balance the stability of error judgment and the rationality of dynamic smoothing coefficient adjustment, thereby improving the accuracy of the dynamic baseline in adapting to the actual fluctuations of the business.

[0115] In some embodiments of this application, the method further includes: obtaining the minimum value between the dynamic smoothing coefficient and the preset maximum dynamic smoothing coefficient; obtaining the maximum value between the minimum value and the preset minimum dynamic smoothing coefficient; and setting the dynamic smoothing coefficient to the maximum value.

[0116] In one embodiment, the minimum value γ of the dynamic smoothing coefficient can be preset. min =0.5, the maximum value of the dynamic smoothing coefficient γ max =1.5, increase γ when the error is large, decrease γ when the error is small, and the initial weight value γ can be set to 0.8.

[0117] The dynamic smoothing coefficient can be expressed as γ t =max(γ min ,min(γ t ,γ max )).

[0118] In this embodiment, assuming the dynamic smoothing coefficient is adjusted to 0.4, the minimum value between the dynamic smoothing coefficient 0.4 and the preset maximum dynamic smoothing coefficient 1.5 is first obtained, which is 0.4. Then, the maximum value between the minimum value 0.4 and the preset minimum dynamic smoothing coefficient 0.5 is obtained, which is 0.5. Finally, the dynamic smoothing coefficient is set to 0.5.

[0119] This embodiment adapts to different business scenarios by adjusting parameters. For example, small-amount transfer scenarios are characterized by high transaction frequency, small individual transaction amounts, and mild fluctuations, relying more on historical data to smooth fluctuations and avoid short-term noise interfering with the baseline. A smaller dynamic smoothing coefficient can be set; the smaller the dynamic smoothing coefficient, the more the secondary smoothing baseline focuses on the previous baseline, reducing the impact of current small fluctuations on the baseline. At the same time, a lower deviation threshold is set to capture minor deviations. As another example, cross-border payment scenarios are characterized by low transaction frequency, large individual transaction amounts, and drastic fluctuations. A larger dynamic smoothing coefficient can be set; the secondary smoothing baseline focuses more on the current primary baseline, keeping up with business fluctuations caused by exchange rates and policies. At the same time, a higher deviation threshold is set to reduce misjudgments.

[0120] This embodiment determines the final dynamic smoothing coefficient by first taking the minimum value of the dynamic smoothing coefficient and the preset maximum dynamic smoothing coefficient, and then taking the maximum value of the minimum value and the preset minimum dynamic smoothing coefficient. This effectively limits the dynamic smoothing coefficient to a reasonable range, avoiding extreme values ​​that are too large or too small due to adjustment, thereby ensuring the stability of subsequent baseline calculations and adaptability to business scenarios.

[0121] In some embodiments of this application, an alarm is triggered when the deviation between the business success rate and the baseline value of the target time period is greater than a preset alarm threshold. This includes: obtaining the average value and standard deviation of the baseline values ​​based on the baseline values ​​of N time periods; and triggering an alarm if the deviation between the business success rate and the average value of the baseline values ​​is greater than twice the standard deviation of the baseline values.

[0122] This embodiment can statistically analyze and update the mean and standard deviation of the secondary smoothed baseline value for each target time period across N time periods, setting the adaptive baseline as the secondary smoothed baseline value μ±2*σ to achieve efficient anomaly detection. A dynamic baseline value and confidence status are output for each target time period. If the deviation between the business success rate and the average baseline value is greater than twice the standard deviation of the baseline value, an alarm is triggered. In some embodiments, during periods of low transaction volume (e.g., <10 transactions per minute), the upper limit of the 95% confidence interval of historical baseline data can be used as the baseline to reduce sensitivity.

[0123] In this embodiment, an alarm is triggered when the deviation between the service success rate and the average value of the baseline is greater than twice the standard deviation of the baseline. Based on statistical rules, it can accurately distinguish the normal fluctuations and anomalies of the service success rate, effectively reduce false alarms and missed alarms, and ensure the accuracy and reliability of the alarms.

[0124] In some embodiments of the present application, the alarm trigger condition can also be set to require that the transaction volume in a period be greater than or equal to a preset transaction volume threshold. That is, the alarm trigger condition is: |service success rate in the target period - Lt| > Δ, and Volume t ≥ M. Where M is a positive integer.

[0125] In some embodiments, the alarm level can be upgraded when deviating from the baseline continuously for 5 times.

[0126] In some embodiments, a suppression rule can be set: if Volume < M, record the log but do not trigger an alarm; when there is no transaction in a single minute, mark it as "data missing" and skip the detection.

[0127] For example, in a high transaction volume scenario (09:00 - 12:00 on weekdays). The transaction volume is 200 - 300 transactions per minute, and the baseline is calculated in real time by a weighted sliding window. If the success rate drops from 99.2% to 96.5% (the success rate fluctuates by 2.7%), a level 1 alarm is triggered immediately.

[0128] Another example is a low transaction volume scenario (03:00 in the early morning on holidays). The transaction volume: 2 transactions per minute, and the historical confidence interval baseline (97.0%) is enabled. When the success rate fluctuates to 90%, only record the log and do not trigger an alarm.

[0129] Filter low-confidence alarms through the transaction volume threshold, reducing the false alarm rate by more than 50%. Utilize the automated alarm suppression mechanism to reduce the workload of manual intervention.

[0130] Based on the above transaction monitoring method, the present application also provides a transaction monitoring device. The following will be combined with Figure 6 Describe this device in detail.

[0131] Figure 6 Schematically shows the structural block diagram of the transaction device according to an embodiment of the present application.

[0132] As Figure 6 shown, the transaction device ⑥⓪⓪ in this embodiment includes a service success rate acquisition module ⑥①⓪ and a service alarm trigger module ⑥②⓪.

[0133] The service success rate acquisition module ⑥①⓪ is used to obtain the service success rate of the target time period according to the ratio of the successful transaction volume and the transaction volume in the time period.

[0134] The business alarm triggering module 620 is used to trigger an alarm when the deviation between the business success rate and the baseline value of the target time period is greater than a preset alarm threshold. The baseline value of the target time period is obtained by weighting the business success rate of N consecutive time periods with the weight value of the corresponding time period. The weight value is obtained by the ratio of the transaction volume of the corresponding time period to the sum of the transaction volumes of N consecutive time periods, where N is a positive integer.

[0135] According to an embodiment of this application, the business alarm triggering module 620 is further configured to use the transaction volume of a time period as the base and perform a power operation with a preset transaction volume decay factor as the exponent to obtain the decayed transaction volume of the time period, wherein the transaction volume decay factor is greater than 0; accumulate the decayed transaction volumes of N consecutive time periods to obtain the sum of decayed transaction volumes of the time period; and calculate the ratio of the decayed transaction volume of the time period to the sum of decayed transaction volumes of the time period to obtain a weight value.

[0136] According to an embodiment of this application, the service alarm triggering module 620 is further configured to obtain a first-level smoothed baseline value for a target time period by weighted summation of the service success rate over N consecutive time periods and the weight value of the corresponding time period; calculate a second-level smoothed baseline value for the target time period using the exponential moving average method based on the first-level smoothed baseline value, a preset dynamic smoothing coefficient, and the second-level smoothed baseline value of the previous time period; and use the second-level smoothed baseline value as the baseline value for the target time period.

[0137] According to an embodiment of this application, the service alarm triggering module 620 is further configured to calculate the deviation between the first-level smoothing baseline value of the target time period and the second-level smoothing baseline value of the previous time period, and obtain the time period deviation value of the target time period; in response to the time period deviation value being greater than the preset time period deviation threshold, the preset dynamic smoothing coefficient is increased.

[0138] According to an embodiment of this application, the service alarm triggering module 620 is further configured to calculate the average absolute error of the target time period based on the time period deviation value of the target time period, a preset error smoothing coefficient, and the average absolute error of the previous time period using the exponential moving average method; calculate the error ratio based on the time period deviation value and the average absolute error of the target time period; and increase the preset dynamic smoothing coefficient if the error ratio is greater than a preset error ratio threshold.

[0139] According to an embodiment of this application, the service alarm triggering module 620 is further configured to obtain the minimum value between the dynamic smoothing coefficient and the preset maximum dynamic smoothing coefficient; obtain the maximum value between the minimum value and the preset minimum dynamic smoothing coefficient; and set the dynamic smoothing coefficient to the maximum value.

[0140] According to an embodiment of this application, the service alarm triggering module 620 is further configured to obtain the average value and standard deviation of the baseline value based on the baseline values ​​of N time periods; if the deviation between the service success rate and the average value of the baseline value is greater than twice the standard deviation of the baseline value, an alarm is triggered.

[0141] According to embodiments of this application, any plurality of modules in the service success rate acquisition module 610 and the service alarm triggering module 620 can be combined into one module, or any one of these modules can be split into multiple modules. Alternatively, at least a portion of the functionality of one or more of these modules can be combined with at least a portion of the functionality of other modules and implemented in one module. According to embodiments of this application, at least one of the service success rate acquisition module 610 and the service alarm triggering module 620 can be at least partially implemented as a hardware circuit, such as a field-programmable gate array (FPGA), a programmable logic array (PLA), a system-on-a-chip, a system-on-a-substrate, a system-on-package, an application-specific integrated circuit (ASIC), or any other reasonable means of integrating or packaging the circuit, or implemented in software, hardware, or firmware, or in any appropriate combination of any of these three implementation methods. Alternatively, at least one of the service success rate acquisition module 610 and the service alarm triggering module 620 can be at least partially implemented as a computer program module, which can perform corresponding functions when the computer program module is run.

[0142] The advantages of the method and apparatus in this application include: significantly reduced false alarm rate, enhanced baseline adaptive capability, and accurate identification of abnormal fluctuations; improved operation and maintenance efficiency, with automated rules reducing manual confirmation time. It also supports adapting to different business scenarios by adjusting parameters.

[0143] Figure 7 A block diagram schematically illustrates an electronic device suitable for implementing a transaction monitoring method according to an embodiment of this application.

[0144] like Figure 7 As shown, an electronic device 700 according to an embodiment of this application includes a processor 701, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 702 or a program loaded from a storage portion 708 into a random access memory (RAM) 703. The processor 701 may include, for example, a general-purpose microprocessor (e.g., a CPU), an instruction set processor and / or an associated chipset and / or a special-purpose microprocessor (e.g., an application-specific integrated circuit (ASIC)), etc. The processor 701 may also include onboard memory for caching purposes. The processor 701 may include a single processing unit or multiple processing units for performing different actions of the method flow according to an embodiment of this application.

[0145] RAM 703 stores various programs and data required for the operation of electronic device 700. Processor 701, ROM 702, and RAM 703 are interconnected via bus 704. Processor 701 executes various operations of the method flow according to embodiments of this application by executing programs in ROM 702 and / or RAM 703. It should be noted that programs may also be stored in one or more memories other than ROM 702 and RAM 703. Processor 701 may also execute various operations of the method flow according to embodiments of this application by executing programs stored in one or more memories.

[0146] According to embodiments of this application, the electronic device 700 may further include an input / output (I / O) interface 705, which is also connected to a bus 704. The electronic device 700 may also include one or more of the following components connected to the input / output (I / O) interface 705: an input section 706 including a keyboard, mouse, etc.; an output section 707 including a cathode ray tube (CRT), liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 708 including a hard disk, etc.; and a communication section 709 including a network interface card such as a LAN card, modem, etc. The communication section 709 performs communication processing via a network such as the Internet. A drive 710 is also connected to the input / output (I / O) interface 705 as needed. A removable medium 711, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., is installed on the drive 710 as needed so that computer programs read from it can be installed into the storage section 708 as needed.

[0147] This application also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments; or it may exist independently and not assembled into the device / apparatus / system. The computer-readable storage medium carries one or more programs, which, when executed, implement the method according to the embodiments of this application.

[0148] According to embodiments of this application, the computer-readable storage medium can be a non-volatile computer-readable storage medium, such as including but not limited to: portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof. In this application, the computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. For example, according to embodiments of this application, the computer-readable storage medium may include ROM 702 and / or RAM 703 and / or one or more memories other than ROM 702 and RAM 703 described above.

[0149] Embodiments of this application also include a computer program product comprising a computer program containing program code for performing the methods shown in the flowchart. When the computer program product is run on a computer system, the program code enables the computer system to implement the transaction monitoring method provided in the embodiments of this application.

[0150] When the computer program is executed by the processor 701, it performs the functions defined in the system / apparatus of this application embodiment. According to the embodiments of this application, the systems, apparatuses, modules, units, etc., described above can be implemented by computer program modules.

[0151] In one embodiment, the computer program may rely on a tangible storage medium such as an optical storage device or a magnetic storage device. In another embodiment, the computer program may also be transmitted and distributed in the form of signals over a network medium, and may be downloaded and installed via the communication section 709, and / or installed from a removable medium 711. The program code contained in the computer program can be transmitted using any suitable network medium, including but not limited to: wireless, wired, etc., or any suitable combination thereof.

[0152] In such an embodiment, the computer program can be downloaded and installed from a network via the communication section 709, and / or installed from the removable medium 711. When the computer program is executed by the processor 701, it performs the functions defined in the system of this application embodiment. According to the embodiments of this application, the systems, devices, apparatuses, modules, units, etc., described above can be implemented by computer program modules.

[0153] According to embodiments of this application, program code for executing the computer programs provided in the embodiments of this application can be written in any combination of one or more programming languages. Specifically, these computational programs can be implemented using high-level procedural and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages ​​include, but are not limited to, languages ​​such as Java, C++, Python, "C", or similar programming languages. The program code can be executed entirely on the user's computing device, partially on the user's device, partially on a remote computing device, or entirely on a remote computing device or server. In cases involving remote computing devices, the remote computing device can be connected to the user's computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0154] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram or flowchart, and combinations of blocks in a block diagram or flowchart, may be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0155] Those skilled in the art will understand that the features described in the various embodiments of this application can be combined and / or combined in various ways, even if such combinations or combinations are not explicitly described in this application. In particular, the features described in the various embodiments of this application can be combined and / or combined in various ways without departing from the spirit and teachings of this application. All such combinations and / or combinations fall within the scope of this application.

Claims

1. A transaction monitoring method, characterized in that, include: The business success rate for the target time period is obtained by the ratio of the successful transaction volume to the total transaction volume for that time period. An alarm is triggered when the deviation between the service success rate and the baseline value of the target time period exceeds a preset alarm threshold. The baseline value of the target time period is obtained by weighting the business success rate of N consecutive time periods with the weight value of the corresponding time period. The weight value is obtained by the ratio of the transaction volume of the corresponding time period to the sum of the transaction volumes of the N consecutive time periods, where N is a positive integer.

2. The method according to claim 1, characterized in that, The weight value is obtained based on the ratio of the trading volume of the specified time period to the trading volume of the N consecutive time periods, including: Using the trading volume of the time period as the base and a preset trading volume decay factor as the exponent, the decayed trading volume of the time period is obtained by exponentiation, wherein the trading volume decay factor is greater than 0. Summing up the decayed trading volume of the N consecutive time periods yields the sum of the decayed trading volume of the time periods. The weight value is obtained by calculating the ratio of the transaction volume of the time period after attenuation to the sum of the transaction volumes of the attenuated time periods.

3. The method according to claim 1, characterized in that, The baseline value for the target time period is obtained by weighting the business success rate of N consecutive time periods with the corresponding weight values ​​of those time periods, including: The first-level smoothed baseline value of the target time period is obtained by weighted summing of the business success rate of the N consecutive time periods and the weight value of the corresponding time period. Based on the primary smoothing baseline value, the preset dynamic smoothing coefficient, and the secondary smoothing baseline value of the previous time period, the secondary smoothing baseline value of the target time period is calculated using the exponential moving average method. The secondary smoothing baseline value is used as the baseline value for the target time period.

4. The method according to claim 3, characterized in that, Also includes: The deviation between the first-level smoothed baseline value of the target time period and the second-level smoothed baseline value of the previous time period is calculated to obtain the time period deviation value of the target time period. In response to the time period deviation value being greater than a preset time period deviation threshold, the preset dynamic smoothing coefficient is increased.

5. The method according to claim 4, characterized in that, Also includes: Based on the time period deviation value of the target time period, the preset error smoothing coefficient, and the average absolute error of the previous time period, the average absolute error of the target time period is calculated using the exponential moving average method. Calculate the error ratio based on the average absolute error between the time period deviation value and the target time period; If the error ratio is greater than a preset error ratio threshold, the preset dynamic smoothing coefficient is increased.

6. The method according to claim 5, characterized in that, Also includes: Obtain the minimum value between the dynamic smoothing coefficient and the preset maximum dynamic smoothing coefficient; Obtain the maximum value between the minimum value and the preset minimum dynamic smoothing coefficient; The dynamic smoothing coefficient is set to its maximum value.

7. The method according to claim 1, characterized in that, If the deviation between the business success rate and the baseline value of the target time period is greater than a preset alarm threshold, an alarm is triggered, including: The mean and standard deviation of the baseline values ​​are obtained based on the baseline values ​​over the N time periods; If the deviation between the business success rate and the average value of the baseline value is greater than twice the standard deviation of the baseline value, an alarm will be triggered.

8. A transaction monitoring device, characterized in that, The device includes: The business success rate acquisition module is used to obtain the business success rate for the target time period based on the ratio of the successful transaction volume to the total transaction volume for that time period; and The service alarm triggering module is used to trigger an alarm when the deviation between the service success rate and the baseline value of the target time period is greater than a preset alarm threshold. The baseline value of the target time period is obtained by weighting the business success rate of N consecutive time periods with the weight value of the corresponding time period. The weight value is obtained by the ratio of the transaction volume of the corresponding time period to the sum of the transaction volumes of the N consecutive time periods, where N is a positive integer.

9. An electronic device, comprising: One or more processors; Memory, used to store one or more computer programs. The characteristic feature is that the one or more processors execute the one or more computer programs to implement the steps of the method according to any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program or instructions stored thereon, characterized in that, When the computer program or instructions are executed by a processor, they implement the steps of the method according to any one of claims 1 to 7.

11. A computer program product, comprising a computer program or instructions, characterized in that, When the computer program or instructions are executed by a processor, they implement the steps of the method according to any one of claims 1 to 7.

Images