Business system anomaly detection method, device, equipment, medium and program product

Abstract

This disclosure provides anomaly detection methods, apparatus, devices, media, and program products for business systems. It collects business processing information generated by the target business system through its system service interface. When data change logs are collected from the database corresponding to the target business system, a consistency determination is made between the business processing information and the data change logs. If the determination result indicates inconsistency between the business processing information and the data change logs, the target business system is identified as an abnormal system. This method automatically identifies abnormal systems by determining the consistency between business processing information and data change logs, improving the efficiency and accuracy of locating abnormal target business systems. It solves the problem of not being able to automatically detect abnormal business systems, and by detecting anomalies in business systems, it better ensures the accuracy of business processing, thereby improving the user experience of the business processing platform.

Description

Technical Field

[0001] This disclosure relates to the field of computer application technology, and in particular to methods, apparatus, devices, media, and program products for detecting anomalies in business systems. Background Technology

[0002] During the business processing on the platform, numerous internal systems are involved. These systems work together to complete the business request or operation instruction. Typically, in actual business processing, input information is received from the client. This input information is processed by multiple internal systems, resulting in data that needs to be stored in different internal systems.

[0003] If a system within the platform malfunctions, the corresponding stored data will also be corrupted. This will result in clients seeing incorrect information, impacting the accuracy of business processing and the user experience of the platform. Therefore, only by promptly identifying and fixing system problems can the normal operation of the business platform be guaranteed.

[0004] However, because a single business process involves many system links, and many of these links involve data storage systems, the existing business processing methods cannot effectively detect and quickly locate the problematic system, thus hindering timely problem repair. Summary of the Invention

[0005] This disclosure provides a method, apparatus, equipment, medium, and program product for detecting anomalies in business systems, in order to solve the problem of not being able to effectively detect and quickly locate abnormal business systems.

[0006] In a first aspect, embodiments of this disclosure provide an anomaly detection method for a business system, the method comprising:

[0007] The system service interface of the target business system is used to collect business processing information generated by the target business system. The target business system is at least one business system on the business processing platform. The business processing information is generated by the target business system after receiving a business request.

[0008] When data change logs are collected from the database corresponding to the target business system, a consistency determination is made between the business processing information and the data change logs.

[0009] If the determination result is that the business processing information and the data change log are inconsistent, the target business system will be identified as an abnormal system.

[0010] Secondly, this disclosure also provides an anomaly detection device for a business system, configured on an anomaly detection terminal. The anomaly detection terminal is connected to multiple business systems included on a business processing platform through system service interfaces. The device includes:

[0011] The information collection module is used to collect business processing information generated by the target business system through the system service interface of the target business system. The target business system is at least one business system on the business processing platform. The business processing information is generated by the target business system after receiving a business request.

[0012] The information determination module is used to determine the consistency between the business processing information and the data change log when data change logs are collected from the database corresponding to the target business system.

[0013] The anomaly detection module is used to determine the target business system as an abnormal system if the determination result is that the business processing information and the data change log are inconsistent.

[0014] Thirdly, embodiments of this disclosure also provide an electronic device, the electronic device comprising:

[0015] One or more processors;

[0016] Storage device for storing one or more programs.

[0017] When the one or more programs are executed by the one or more processors, the one or more processors implement the anomaly detection method for the business system as described in any of the embodiments of this disclosure.

[0018] Fourthly, embodiments of this disclosure also provide a storage medium containing computer-executable instructions, which, when executed by a computer processor, are used to perform the anomaly detection method of the business system described in any embodiment of this disclosure.

[0019] Fifthly, embodiments of this disclosure also provide a computer program product, the computer program product including a computer program, which, when executed by a processor, implements the anomaly detection method of the business system described in any embodiment of this disclosure.

[0020] This disclosure provides an anomaly detection method for a business system. It collects business processing information generated by the target business system (at least one business system on a business processing platform) through the system service interface of the target business system. The business processing information is generated after the target business system receives a business request. When data change logs are collected from the database corresponding to the target business system, a consistency judgment is performed between the business processing information and the data change logs. If the judgment result indicates inconsistency between the business processing information and the data change logs, the target business system is identified as an abnormal system. This technical solution, independent of a business processing platform containing multiple business systems, additionally introduces an anomaly detection terminal. This allows the business system to establish a connection with the anomaly detection terminal through the system service interface. Therefore, this embodiment's technical solution can be used to collect the business processing information and data change information of the business system to be detected through the system service interface, and finally, detect whether the business system is an abnormal system through consistency comparison. The detection method provided in this embodiment can automatically and quickly locate abnormal business systems. Unlike existing methods that rely on manual reconciliation after discovering problems in business processing, this technical solution eliminates the need for human intervention in data comparison, significantly saving labor costs. It also achieves automatic, timely, efficient, and accurate location detection of abnormal business systems, providing effective support for timely repairs. Furthermore, by collecting business processing information throughout the entire process, it solves the problem of inaccurate troubleshooting of abnormal business systems caused by the inability to obtain input data from business requests. By detecting anomalies in business systems, it better ensures the accuracy of business processing, thereby improving the user experience of the business processing platform. Attached Figure Description

[0021] The above and other features, advantages, and aspects of the embodiments of this disclosure will become more apparent from the accompanying drawings and the following detailed description. Throughout the drawings, the same or similar reference numerals denote the same or similar elements. It should be understood that the drawings are schematic, and the originals and elements are not necessarily drawn to scale.

[0022] Figure 1 A flowchart illustrating an anomaly detection method for a business system provided in this embodiment of the disclosure;

[0023] Figure 2 A schematic diagram illustrating the execution logic of an anomaly detection method for a business system provided in this embodiment of the disclosure;

[0024] Figure 3 This is a schematic diagram of the structure of an anomaly detection device for a business system provided in an embodiment of the present disclosure;

[0025] Figure 4This is a schematic diagram of the structure of an electronic device provided in an embodiment of this disclosure. Detailed Implementation

[0026] Embodiments of this disclosure will now be described in more detail with reference to the accompanying drawings. While some embodiments of this disclosure are shown in the drawings, it should be understood that this disclosure can be implemented in various forms and should not be construed as limited to the embodiments set forth herein. Rather, these embodiments are provided to provide a more thorough and complete understanding of this disclosure. It should be understood that the accompanying drawings and embodiments of this disclosure are for illustrative purposes only and are not intended to limit the scope of protection of this disclosure.

[0027] It should be understood that the steps described in the method embodiments of this disclosure may be performed in different orders and / or in parallel. Furthermore, the method embodiments may include additional steps and / or omit the steps shown. The scope of this disclosure is not limited in this respect.

[0028] The term "comprising" and its variations as used herein are open-ended inclusions, meaning "including but not limited to". The term "based on" means "at least partially based on". The term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one additional embodiment"; the term "some embodiments" means "at least some embodiments". Definitions of other terms will be given in the description below.

[0029] It should be noted that the concepts of "first" and "second" mentioned in this disclosure are used only to distinguish different devices, modules or units, and are not used to limit the order of functions performed by these devices, modules or units or their interdependencies.

[0030] It should be noted that the terms "a" and "a plurality of" used in this disclosure are illustrative rather than restrictive, and those skilled in the art should understand that, unless otherwise expressly indicated in the context, they should be understood as "one or more".

[0031] The names of messages or information exchanged between multiple devices in the embodiments of this disclosure are for illustrative purposes only and are not intended to limit the scope of such messages or information.

[0032] It is understood that before using the technical solutions disclosed in the various embodiments of this disclosure, users should be informed of the types, scope of use, and usage scenarios of the personal information involved in this disclosure in an appropriate manner in accordance with relevant laws and regulations, and user authorization should be obtained.

[0033] For example, upon receiving a user's active request, a prompt message is sent to the user to explicitly inform them that the requested operation will require the acquisition and use of the user's personal information. This allows the user to independently choose whether to provide personal information to the software or hardware, such as the electronic device, application, server, or storage medium performing the operations of this disclosed technical solution, based on the prompt message.

[0034] As an optional but non-limiting implementation, in response to a user's active request, sending a prompt message to the user can be done via a pop-up window, where the prompt message can be presented in text format. Furthermore, the pop-up window can also include a selection control allowing the user to choose "agree" or "disagree" to provide personal information to the electronic device.

[0035] It is understood that the above notification and user authorization process are merely illustrative and do not constitute a limitation on the implementation of this disclosure. Other methods that comply with relevant laws and regulations may also be applied to the implementation of this disclosure.

[0036] It is understood that the data involved in this technical solution (including but not limited to the data itself, the acquisition or use of the data) shall comply with the requirements of relevant laws, regulations and related provisions.

[0037] Figure 1 This is a flowchart illustrating an anomaly detection method for a business system provided in an embodiment of this disclosure. This embodiment is applicable to the scenario of anomaly detection in a business system on a business processing platform. The method can be executed by an anomaly detection device for the business system. This device can be implemented in the form of software and / or hardware, or optionally, by an electronic device, such as a mobile terminal, a PC, or a server.

[0038] It should be noted that the application scenario involved in this embodiment can be described as follows: In a real business platform, taking an e-commerce platform as an example, the platform contains multiple business systems involved in business processing. Each business system can participate in processing any e-commerce business request on the e-commerce platform. For example, an e-commerce business request might involve storing information entered by a merchant or modifying / adjusting product information. The initial e-commerce business request can be sent by the e-commerce client, carrying the valid information related to the business processing within the request. This e-commerce business request can then be processed by one or more business systems within the business processing platform. In practical applications, the business systems involved in processing business requests may experience anomalies, leading to errors in the final business processing results returned to the e-commerce client, thereby affecting the accuracy of e-commerce business processing and the user experience of the e-commerce platform.

[0039] For example, when a merchant on an e-commerce platform modifies product information, such as changing the price from 129 yuan to 128 yuan, the e-commerce client will generate a price modification request. This request will also include the changed price entered by the client as valid data. This request can be processed by one or more business systems. If the business systems are functioning correctly, the final result returned to the e-commerce client will be the expected price of 128 yuan displayed on the product page. However, if an abnormal business system exists, the returned result may be different, such as 1.28 yuan. Existing anomaly detection methods cannot effectively and promptly detect abnormal business systems.

[0040] Based on this, this embodiment provides an anomaly detection method for a business system, applied to an anomaly detection terminal. The anomaly detection terminal establishes connections with multiple business systems included on the business processing platform through system service interfaces, effectively solving the aforementioned technical problems. Specifically, as shown... Figure 1 As shown in the figure, the anomaly detection method for a business system provided in this embodiment may include the following steps:

[0041] S101. Collect business processing information generated by the target business system through the system service interface of the target business system. The target business system is at least one business system on the business processing platform. The business processing information is generated by the target business system after receiving a business request.

[0042] In this context, a business request can be understood as request information generated based on business operations. A business request includes input business information, request methods (such as GET, POST, PUT, DELETE, etc.), a unique identifier for the business request (trace_id), and a request address. Business requests received by the business system can be triggered by business operations such as client input of business information, or they can be generated by a previous business system. A target business system can be understood as one or more business systems on the business processing platform that have anomaly detection requirements and are used to handle specific business requests. System service interfaces can be considered as interfaces provided by the target business system, such as application programming interfaces (APIs), web services, and database connections, used for interaction with external systems, platforms, or terminals, such as data input, output, and querying. Business processing information can be understood as information obtained by the target business system after receiving a business request through system service interfaces, through parsing, field updates, and other operations. This information is used to transform the business request into information that the target business system can easily process and manage. Business processing information may include operation logs, behavioral data (such as business data input by the client or a previous business system), and relevant attribute information of the target business system.

[0043] In this embodiment, the anomaly detection terminal collects business processing information generated by the target business system after receiving a business request through the system service interface provided by the target business system.

[0044] S102. When data change logs are collected from the database corresponding to the target business system, the consistency between business processing information and data change logs is determined.

[0045] The data change log can be understood as a log that records data changes in the database due to operations such as insertion, update, and deletion. It is used to track the history of data changes and to recover data. The data change log can include the change time, the changed fields, and the changed content.

[0046] In this embodiment, when the target business system generates business processing information based on the received business request, it executes corresponding business logic based on the business processing information. During execution, the corresponding data is stored in the database corresponding to the target business system. If the executed business logic causes changes to the data stored in the database, a data change log is generated. When the anomaly detection terminal collects the data change log from the database corresponding to the target business system, it considers that the received business request has a need to modify data. At this time, a consistency judgment is made between the business processing information and the data change log to determine whether the data change log has been correctly processed according to the business processing information.

[0047] For example, if the business processing information generated by the target business system based on the received business request includes changing the price of a certain product from 129 yuan to 128 yuan, then the corresponding business logic is to execute the operation of changing the data from 129 to 128. During the execution process, when the price of the product stored in the database corresponding to the target business system changes, a data change log is generated.

[0048] It should be noted that when the price stored in the database changes according to the execution logic, a unique identifier field for the associated business request is added to the database, and the corresponding unique identifier field content is entered.

[0049] S103. If the determination result is that the business processing information and the data change log are inconsistent, the target business system will be identified as an abnormal system.

[0050] In this embodiment, if the determination result after information consistency assessment is that the business processing information and the data change log are inconsistent, i.e., there is a data synchronization problem, system error, or other problem, resulting in inconsistencies between the business processing information and the content of one or more fields in the data change log, then the target business system is identified as an abnormal system in order to participate in subsequent repairs of the abnormal system.

[0051] This disclosure provides an anomaly detection method for a business system. It collects business processing information generated by the target business system (at least one business system on a business processing platform) through the system service interface of the target business system. The business processing information is generated after the target business system receives a business request. When data change logs are collected from the database corresponding to the target business system, a consistency judgment is performed between the business processing information and the data change logs. If the judgment result indicates inconsistency between the business processing information and the data change logs, the target business system is identified as an abnormal system. This technical solution, independent of a business processing platform containing multiple business systems, additionally introduces an anomaly detection terminal. This allows the business system to establish a connection with the anomaly detection terminal through the system service interface. Therefore, this embodiment's technical solution can be used to collect the business processing information and data change information of the business system to be detected through the system service interface, and finally, detect whether the business system is an abnormal system through consistency comparison. The detection method provided in this embodiment can automatically and quickly locate abnormal business systems. Unlike existing methods that rely on manual reconciliation after discovering problems in business processing, this technical solution eliminates the need for human intervention in data comparison, significantly saving labor costs. It also achieves automatic, timely, efficient, and accurate location detection of abnormal business systems, providing effective support for timely repairs. Furthermore, by collecting business processing information throughout the entire process, it solves the problem of inaccurate troubleshooting of abnormal business systems caused by the inability to obtain input data from business requests. By detecting anomalies in business systems, it better ensures the accuracy of business processing, thereby improving the user experience of the business processing platform.

[0052] As a first optional embodiment of this example, based on the above embodiment, the business processing information and the data change log can be specifically optimized as follows:

[0053] The business processing information includes: system attribute information of the target business system, interface input parameter information of the corresponding system service interface when the business request is received, and the first unique identifier of the business request; the data change log includes: the second unique identifier of the business request associated with the data change, the data before the change, and the data after the change.

[0054] Among them, system attribute information can be understood as the basic attributes of the target business system, including the system name of the target business system and the interface name of the system service interface provided by the target business system, which is used to identify and distinguish different target business systems.

[0055] In this embodiment, the interface input parameter information can be understood as the valid data information carried in the business request received by the target business system through the corresponding system service interface. For example, this execution entity can collect the business request transmitted to the target business system through the system service result, and obtain the valid data information participating in the business processing by parsing the business request. The valid data information can be the parameter information involved in the business processing, or the transmitted data information, such as a specific numerical value or a piece of text content.

[0056] In this embodiment, the first request unique identifier can be understood as a unique identifier containing the business processing information that identifies a specific business request, used to associate specific business operations in the target business system with corresponding database changes. The second request unique identifier can be understood as a unique identifier containing the data change log that identifies a specific business request, used to associate specific business operations in the data change log. It can be understood that the first and second request unique identifiers are equivalent to the unique identifiers randomly generated for the corresponding business request when the business processing platform initially receives the business request; they can serve as tracking identifiers, flowing throughout the entire processing chain of the business request.

[0057] In this embodiment, "pre-change data" can be understood as the data state before the change occurred in the database, including the field name of the data change field and the pre-change data content stored in the data change field; "post-change data" can be understood as the data state after the database change, including the field name of the data change field and the post-change data content stored in the data change field. It should be noted that, considering the business processing platform can achieve parallel processing of different business requests, for the same target business system, it may participate in the processing of multiple different business requests at the same time. Correspondingly, the database associated with this target business system may also generate changed data for relatively different business requests at the same time. In this embodiment, all data changes can be recorded in the data change log. Therefore, the data change log can contain pre-change data and post-change data corresponding to multiple different business requests.

[0058] Accordingly, the consistency determination of the business processing information and the data change log can be specified as the following steps:

[0059] a1) If the first request unique identifier is the same as the second request unique identifier, then according to the system attribute information, search for information consistency comparison conditions that match the target business system from the preset configuration information.

[0060] Among them, the information consistency comparison condition can be understood as the comparison condition set relative to different target business systems, which is used to verify whether the information stored in the corresponding database after the execution of the corresponding business logic by different target business systems is consistent with the business processing information generated by the target business system.

[0061] In this embodiment, the information consistency comparison conditions may include the field information to be compared, the relationship conditions between the data contents of the corresponding fields (such as identical, reciprocals, opposites, having a certain mapping relationship, etc.), and the output rules for the comparison results, such as using the symbol "=" for complete consistency. Meanwhile, the preset configuration information can be understood as information consistency comparison conditions pre-configured for multiple target business systems, and information that stores the matching information consistency comparison conditions for each target business system.

[0062] In this embodiment, since a target business system can process multiple business requests simultaneously and generate multiple business processing information and data change logs based on these requests, it is necessary to determine whether the first request unique identifier and the second request unique identifier are the same. If they are the same, it indicates that the business processing information corresponding to the first request unique identifier in the target business system and the changed data corresponding to the second request unique identifier in the data change log are associated with the same business request, and the next step of information consistency determination can be performed. Next, a unique target business system is determined based on the system attribute information, and information consistency comparison conditions matching the target business system are searched from the preset configuration information.

[0063] b1) Based on the information consistency comparison conditions, the interface input parameters and the changed data, determine the consistency between the business processing information and the data change log.

[0064] In this embodiment, according to the found information consistency comparison conditions, the data that needs to be compared in the interface input parameter information and the changed data is selected. The consistency between the business processing information and the data change log can be determined by judging whether the data to be compared is the same. That is, if the data to be compared is the same, the business processing information and the data change log are determined to be consistent. If the data to be compared is different, the business processing information and the data change log are determined to be inconsistent.

[0065] The above-described technical solution in this embodiment, by finding information consistency comparison conditions that match the target business system, and based on the information consistency comparison conditions, the interface input parameter information, and the changed data, performs consistency determination on the business processing information and data change log, ensuring the accuracy and efficiency of anomaly detection of the target business system. At the same time, it can identify inconsistent comparison information, providing effective support for subsequent analysis of the causes of anomalies in the target business system and for data consistency repair.

[0066] As one implementation method, this optional embodiment can further specify the consistency determination of the business processing information and data change log based on the information consistency comparison conditions, the interface input parameter information and the changed data as follows:

[0067] b11) Extract the input parameter fields to be compared, the database fields to be compared, and the comparison conditions from the information consistency comparison conditions.

[0068] The input parameter fields to be compared can be understood as the fields in the interface input parameter information that require comparison. The database fields to be compared can be understood as the fields in the changed data stored in the data change log that require comparison. It can be understood that the input parameter fields to be compared and the database fields to be compared should have a corresponding relationship.

[0069] In this embodiment, the input parameter fields to be compared, the database fields to be compared, and the comparison conditions are extracted from the information consistency comparison conditions through string manipulation, regular expressions, or JSON parsing. The comparison conditions can be that the content is completely consistent, or that there is a mapping relationship, etc.

[0070] b12) Obtain the first field content of the input parameter field to be compared from the interface input parameter information, and obtain the second field content of the database field to be compared from the modified data.

[0071] The first field can be understood as the actual content stored under the input parameter field to be compared. The second field can be understood as the actual content stored under the database field to be compared.

[0072] In this embodiment, based on the extracted input parameter fields to be compared, the input parameter fields to be compared are searched from the interface input parameter information, and the first field content of the input parameter fields to be compared is obtained. At the same time, based on the extracted database fields to be compared, the database fields to be compared are searched from the modified data, and the second field content of the database fields to be compared is obtained.

[0073] b13) If the content of the first field and the content of the second field meet the comparison conditions, then the determination result is that the business processing information and the data change log are consistent.

[0074] In this embodiment, the obtained first field content and second field content are compared. If the first field content and the second field content meet the comparison conditions, the determination result is that the business processing information and the data change log are consistent, that is, the target business system is normal.

[0075] b14) If the content of the first field and the content of the second field do not meet the comparison conditions, the determination result is that the business processing information and the data change log are inconsistent.

[0076] In this embodiment, the obtained first field content and second field content are compared. If the first field content and the second field content do not meet the comparison conditions, the determination result is that the business processing information and the data change log are inconsistent, that is, the target business system has made an error in the business processing or data recording process, and the target business system is determined to be an abnormal system.

[0077] The above-described technical solution in this embodiment improves the timeliness, accuracy, and efficiency of detecting anomalies in the target business system by extracting the input parameter fields to be compared and the database fields to be compared from the information consistency comparison conditions, and comparing the content of the first field of the input parameter fields to be compared with the content of the second field of the database fields to be compared, and determining the judgment result based on the relationship between the field contents. This effectively ensures the accuracy and stability of business data processing.

[0078] To better understand this embodiment, a specific example is given here.

[0079] When the target business system processes a data input, the corresponding information consistency comparison condition can be that the input parameter field to be compared is field one (i.e., the first field), and the corresponding database field to be compared is field two (i.e., the second field). The comparison condition is configured to be content consistent, that is, the data under field one (i.e., the content of the first field) must be completely consistent with the data under field two (i.e., the content of the second field).

[0080] In addition to setting the comparison condition to content consistency as mentioned above, when the business processed by the target business system is to determine whether a certain matter is true or false, the information consistency comparison condition can also be that the input parameter field to be compared is field three (i.e., the first field), and the corresponding database field to be compared is field four (i.e., the second field). The comparison condition is configured with the corresponding mapping relationship. For example, when the field content under field three (i.e., the content of the first field) is true, the field content under field four (i.e., the content of the second field) is data one. When the field content under field three is false, the field content under field four is data two, that is, there is a certain mapping relationship.

[0081] Following the above description, a specific example could be that when the target business system is handling a free shipping transaction, if the content of field three is true (i.e., free shipping), then the content of field four should be 0 (data one), meaning the shipping fee is 0 yuan.

[0082] As a second optional embodiment of this example, based on the above optimizations, the anomaly detection method for a business system provided in this example may further include, after determining the target business system as an abnormal system:

[0083] a2) Store the anomaly detection results and provide a notification of the anomaly detection results when the anomaly alarm conditions are met.

[0084] In this embodiment, when the target business system is determined to be an abnormal system, the abnormality of the target business system can be used as an anomaly detection result. This step can store the anomaly detection result and can prompt the anomaly detection result when the preset anomaly alarm conditions are met.

[0085] For example, the anomaly alarm conditions can be preset alarm rules, such as real-time alarms, which provide an alarm notification as soon as the target business system is determined to be an abnormal system, or periodic alarms, which trigger an alarm after a certain period of time or frequency of occurrence. Following the above description, the anomaly alarm conditions can also be preset alarm thresholds, such as the number of times a system is identified as an abnormal system within a short period, or the frequency of anomalies.

[0086] As another implementation method, the notification can be made by playing a notification sound, or by sending a message notification to the operation and maintenance personnel or relevant personnel through SMS, application notification, console pop-up, etc. The message notification can allow users to customize the field content to be included. The message notification can include text, charts, etc. to display information such as the anomaly detection results and the frequency of anomalies corresponding to the abnormal system.

[0087] In this embodiment, after identifying the target business system as an abnormal system, the above-described technical solution stores the anomaly detection results and provides timely alerts based on preset anomaly alarm conditions, so as to quickly respond to and handle abnormal situations, thereby ensuring the stable operation of the target business system and the accuracy of business processing.

[0088] As a third optional embodiment of this example, after determining that the target business system is an abnormal system, the method further includes:

[0089] a3) Based on the business processing information, perform anomaly repair on the data stored in the database.

[0090] In this embodiment, when the target business system is identified as an abnormal system, the data corresponding to the business request stored in the database of the target business system is repaired according to the business processing information generated by the target business system after receiving the business request, so as to correct the inconsistent data, and the business request data sent to the next business system is modified accordingly to ensure the normal progress of subsequent processing.

[0091] As one implementation method, this optional embodiment can further specify the abnormal repair of the data stored in the database based on the business processing information as follows:

[0092] a31) Based on the first unique identifier of the first request included in the business processing information, determine the first storage location corresponding to the business request in the database, and obtain the first storage data under the first storage location.

[0093] The first storage location can be understood as the storage location in the database of the data generated by the business request corresponding to the first request unique identifier through the target business processing system. The first storage location can be a specific field that contains data related to the business request. The first storage data can be understood as the specific content stored in the first storage location, that is, the latest state after the business request has been processed.

[0094] In this embodiment, based on the first unique identifier of the first request included in the business processing information, the first storage location corresponding to the first unique identifier of the first request is found in the database, and the first storage data under the first storage location is obtained through parsing or other methods.

[0095] a32) Obtain the interface input parameter information of the corresponding system service interface when the target business system receives the business request from the business processing information, and parse the business processing expectation data of the business request from the interface input parameter information.

[0096] In this context, expected business processing data can be understood as the correct data or correct information that the target business system should generate after performing business processing.

[0097] In this embodiment, the interface input parameter information corresponding to the business request received by the target business system is obtained from the business processing information, and the expected business processing data corresponding to the business request is obtained by parsing the interface input parameter information.

[0098] a33) Update the first stored data according to the business processing expected data, so as to serve as the updated normal data stored in the database.

[0099] In this embodiment, the first stored data is modified according to the expected business processing data to serve as the updated normal data stored in the database. For example, when the comparison condition is content consistency, the anomaly repair solution can replace the first stored data with the expected business processing data; when the comparison condition is that the mapping relationship is satisfied, the anomaly repair solution can modify the first stored data according to the mapping condition and the expected business processing data.

[0100] The above-described technical solution in this embodiment obtains the first stored data of the business request in the first storage location in the database based on the unique identifier of the first request included in the business processing information, and corrects the first stored data according to the obtained expected business processing data to store the updated normal data. This achieves efficient repair of the abnormal system, ensures the stability of the business system operation, and improves the accuracy and reliability of business processing.

[0101] b3) Based on the data update log, perform anomaly repair on the data stored in the database.

[0102] In this embodiment, this step can be used as another anomaly repair method parallel to step a3) above. Specifically, in addition to performing anomaly repair based on the business processing information, this step can also perform anomaly repair on the stored updated data based on the stored pre-update data corresponding to the abnormal business requests in the data update log, to ensure the stability and reliability of the target business system's business processing, and accordingly modify the business request data sent to the next business system to ensure the normal progress of subsequent processing.

[0103] This embodiment presents two solutions for anomaly repair of database stored data based on business processing information or data update logs, to ensure the accuracy, consistency, stability, and reliability of database stored data under different requirements, thereby ensuring the stable operation of the target business system and improving the user experience.

[0104] As one implementation method, this optional embodiment can further specify the anomaly repair of the data stored in the database based on the data update log as follows:

[0105] b31) Based on the second request unique identifier included in the data update log, determine the second storage location corresponding to the business request in the database, and obtain the second storage data under the second storage location;

[0106] The second storage location can be understood as the storage location in the database of the data generated after the business request corresponding to the second request unique identifier has been processed by the target business system; the second storage data can be understood as the specific content stored in the second storage location, that is, the latest state of the business request after it has been processed.

[0107] In this embodiment, based on the second request unique identifier included in the data update log, the second storage location of the business request corresponding to the second request unique identifier in the database is located and determined, and the second storage data under the second storage location is obtained through parsing, extraction and other methods.

[0108] b32) Replace the second stored data with the data before the update corresponding to the unique identifier of the second request in the data update log, so as to roll back the data stored in the database to the state before the target business system processed the business request.

[0109] In this embodiment, the data before the update corresponding to the unique identifier of the second request in the data update log is obtained, and the data before the update is used to replace the second stored data, so that the data stored in the database is rolled back to the state before the target business system processed the business request.

[0110] The above-described technical solution in this embodiment determines the second stored data in the database based on the second request unique identifier included in the data update log, and replaces the second stored data with the data before the update corresponding to the second request unique identifier. This timely data rollback and repair operation reduces the impact on business caused by abnormalities in the target business system, ensures the reliability of business processes, and thus improves the stability of the business system and the user experience.

[0111] To better understand the anomaly detection method for business systems provided in this disclosure, a specific example is given here.

[0112] Figure 2 This is a schematic diagram illustrating the execution logic of an anomaly detection method for a business system provided in an embodiment of this disclosure. For example... Figure 2As shown, the input data can be data information or text information, etc. When the relevant control for submitting input data is triggered, the input data is submitted to business system A in the business processing platform through a business request sent by the front end. The business request includes information such as input data, a unique identifier for the business request, and a request method.

[0113] It should be noted that business systems A, D, and E can all be considered target business systems. Since the business requests output by each system differ, the resulting service calls will also differ. The system to which the business request is passed is determined based on the service call. For example, service call 1 determines that a business request from business system A will be passed to business system D, and service call 2 determines that a business request from business system D will be passed to business system E. Furthermore, a business system may or may not generate data that needs to be stored when processing a business request. It should also be noted that the anomaly detection terminal can link the various target business systems based on the unique identifier of the business request, thereby accurately collecting the required data.

[0114] Next, the anomaly detection terminal collects business processing information A generated by business system A through the system service interface of business system A. This business processing information A includes interface input parameter information, i.e., information from the business request. Then, the anomaly detection terminal collects data change log A stored in database A during the corresponding business processing by business system A. When data change log A is collected, the terminal performs an information consistency check on the business processing information A and the data change log A based on a first unique request identifier contained in business system A and a second unique request identifier contained in data change log A. If the first unique request identifier and the second unique request identifier are the same, then based on the system attribute information, the terminal searches for information consistency comparison conditions matching those of business system A from preset configuration information, which is pre-entered by relevant personnel.

[0115] If the determination result shows that the business processing information A and the data change log A are consistent, then business system A is determined to be normal. Next, the consistency of the business processing information and data change log of the next business system, collected in real time, is determined. It is understood that the unique identifier of the business request sent by the front end is equal to the values ​​of the first unique identifier and the second unique identifier.

[0116] If the consistency determination result of the collected business processing information E and data change log E of business system E is inconsistent, then business system E is identified as an abnormal system, and the abnormal detection result is persistently stored. An alarm is triggered when the abnormal alarm conditions are met. In addition, the abnormal data stored in database E is repaired according to the business processing information or data update log.

[0117] Figure 3 This is a schematic diagram of the structure of an anomaly detection device for a business system provided in an embodiment of this disclosure, as shown below. Figure 3 As shown, the device includes: an information acquisition module 31, an information judgment module 32, and an anomaly detection module 33, wherein,

[0118] The information collection module 31 is used to collect business processing information generated by the target business system through the system service interface of the target business system. The target business system is at least one business system on the business processing platform. The business processing information is generated by the target business system after receiving a business request. The business processing information includes: system attribute information of the target business system, interface input parameter information of the corresponding system service interface when the business request is received, and the first request unique identifier of the business request.

[0119] Information determination module 32 is used to determine the consistency between the business processing information and the data change log when data change log is collected from the database corresponding to the target business system. The data change log includes: the second request unique identifier of the business request associated with the data change, the data before the change, and the data after the change.

[0120] The anomaly detection module 33 is used to determine the target business system as an abnormal system if the determination result is that the business processing information and the data change log are inconsistent.

[0121] This disclosure provides an anomaly detection device for a business system. It collects business processing information generated by the target business system through the system service interface of the target business system. The target business system is at least one business system on a business processing platform. The business processing information is generated by the target business system after receiving a business request. When data change logs are collected from the database corresponding to the target business system, a consistency determination is made between the business processing information and the data change logs. If the determination result indicates that the business processing information and the data change logs are inconsistent, the target business system is identified as an abnormal system. Compared to existing manual reconciliation methods, the technical solution of this disclosure eliminates the need for human intervention in data comparison. It determines the consistency between the business processing information generated by the target business system and the data change logs collected in the database corresponding to the target business system. If the determination result is that the business processing information and the data change logs are inconsistent, the target business system is identified as an abnormal system. This enables automatic, timely, efficient, and accurate location of the abnormal target business system, while providing effective support for timely repair. Furthermore, by collecting business processing information throughout the entire process, it solves the problem of being unable to troubleshoot abnormal systems due to the inability to obtain client input data, ensuring the accuracy of business processing by the target business system and thus improving the user experience of the business processing platform.

[0122] Furthermore, the information determination module 32 may specifically include:

[0123] The matching condition lookup unit is used to search for information consistency comparison conditions that match the target business system from preset configuration information based on the system attribute information if the first request unique identifier is the same as the second request unique identifier.

[0124] The consistency determination unit is used to determine the consistency of the business processing information and the data change log based on the information consistency comparison conditions, the interface input parameter information, and the changed data.

[0125] Furthermore, the consistency determination unit can specifically be used for:

[0126] Extract the input parameter fields to be compared, the database fields to be compared, and the comparison conditions from the information consistency comparison conditions;

[0127] Obtain the first field content of the input parameter field to be compared from the interface input parameter information, and obtain the second field content of the database field to be compared from the modified data;

[0128] If the content of the first field and the content of the second field meet the comparison conditions, then the determination result is that the business processing information and the data change log are consistent.

[0129] If the content of the first field and the content of the second field do not meet the comparison conditions, the determination result is that the business processing information and the data change log are inconsistent.

[0130] Furthermore, the anomaly detection device for the business system also includes an alarm module, which can be used specifically for:

[0131] After identifying the target business system as an abnormal system, the anomaly detection results are stored, and the anomaly detection results are displayed when the anomaly alarm conditions are met.

[0132] Furthermore, the anomaly detection device for the business system also includes an anomaly repair module, which may specifically include:

[0133] The first repair unit is used to perform anomaly repair on the data stored in the database based on the business processing information.

[0134] The second repair unit is used to perform anomaly repair on the data stored in the database based on the data update log.

[0135] Furthermore, the first repair unit can specifically be used for:

[0136] Based on the unique identifier of the first request included in the business processing information, determine the first storage location corresponding to the business request in the database, and obtain the first storage data under the first storage location;

[0137] The interface input parameter information of the corresponding system service interface when the target business system receives the business request is obtained from the business processing information, and the business processing expectation data of the business request is parsed from the interface input parameter information.

[0138] The first stored data is updated according to the expected data of the business processing, so as to serve as the updated normal data stored in the database.

[0139] Furthermore, the second repair unit can specifically be used for:

[0140] Based on the second request unique identifier included in the data update log, determine the second storage location corresponding to the business request in the database, and obtain the second storage data under the second storage location;

[0141] The second stored data is replaced with the data before the update corresponding to the unique identifier of the second request in the data update log, so as to revert the data stored in the database to the state before the target business system processed the business request.

[0142] The anomaly detection device for a business system provided in this disclosure can execute the anomaly detection method for a business system provided in any embodiment of this disclosure, and has the corresponding functional modules and beneficial effects for executing the method.

[0143] It is worth noting that the various units and modules included in the above-mentioned device are only divided according to functional logic, but are not limited to the above division, as long as the corresponding functions can be realized; in addition, the specific names of each functional unit are only for easy differentiation and are not used to limit the protection scope of the embodiments of this disclosure.

[0144] Figure 4 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this disclosure. Reference is made below. Figure 4 It illustrates an electronic device suitable for implementing embodiments of the present disclosure (e.g., Figure 4 The diagram below shows the structure of the terminal device or server 400. The terminal device in this embodiment may include, but is not limited to, mobile terminals such as mobile phones, laptops, digital broadcast receivers, PDAs (personal digital assistants), PADs (tablet computers), PMPs (portable multimedia players), and vehicle terminals (e.g., vehicle navigation terminals), as well as fixed terminals such as digital TVs and desktop computers. Figure 4 The electronic device shown is merely an example and should not be construed as limiting the functionality and scope of the embodiments disclosed herein.

[0145] like Figure 4 As shown, electronic device 400 may include a processing unit (e.g., central processing unit, graphics processor, etc.) 401, which can perform various appropriate actions and processes according to a program stored in read-only memory (ROM) 402 or a program loaded from storage device 408 into random access memory (RAM) 403. The RAM 403 also stores various programs and data required for the operation of electronic device 400. The processing unit 401, ROM 402, and RAM 403 are interconnected via bus 404. An edit / output (I / O) interface 405 is also connected to bus 404.

[0146] Typically, the following devices can be connected to I / O interface 405: input devices 406 including, for example, touchscreens, touchpads, keyboards, mice, cameras, microphones, accelerometers, gyroscopes, etc.; output devices 407 including, for example, liquid crystal displays (LCDs), speakers, vibrators, etc.; storage devices 408 including, for example, magnetic tapes, hard disks, etc.; and communication devices 409. Communication device 409 allows electronic device 400 to communicate wirelessly or wiredly with other devices to exchange data. Although Figure 4An electronic device 400 with various devices is shown; however, it should be understood that it is not required to implement or possess all of the devices shown. More or fewer devices may be implemented or possessed alternatively.

[0147] In particular, according to embodiments of this disclosure, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments of this disclosure include a computer program product comprising a computer program carried on a non-transitory computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via communication device 409, or installed from storage device 408, or installed from ROM 402. When the computer program is executed by processing device 401, it performs the functions defined in the methods of embodiments of this disclosure.

[0148] The names of messages or information exchanged between multiple devices in the embodiments of this disclosure are for illustrative purposes only and are not intended to limit the scope of such messages or information.

[0149] The electronic device provided in this embodiment and the anomaly detection method of the business system provided in the above embodiments belong to the same inventive concept. Technical details not described in detail in this embodiment can be found in the above embodiments, and this embodiment has the same beneficial effects as the above embodiments.

[0150] This disclosure provides a computer storage medium storing a computer program that, when executed by a processor, implements the anomaly detection method for the business system provided in the above embodiments.

[0151] It should be noted that the computer-readable medium described in this disclosure can be a computer-readable signal medium or a computer-readable storage medium, or any combination thereof. A computer-readable storage medium can be, for example,—but not limited to—an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of a computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In this disclosure, a computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in connection with an instruction execution system, apparatus, or device. In this disclosure, a computer-readable signal medium can include a data signal propagated in baseband or as part of a carrier wave, carrying computer-readable program code. Such propagated data signals can take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A computer-readable signal medium can be any computer-readable medium other than a computer-readable storage medium, which can send, propagate, or transmit a program for use by or in connection with an instruction execution system, apparatus, or device. The program code contained on the computer-readable medium can be transmitted using any suitable medium, including but not limited to: wires, optical fibers, RF (radio frequency), etc., or any suitable combination thereof.

[0152] In some implementations, clients and servers can communicate using any currently known or future-developed network protocol such as HTTP (Hypertext Transfer Protocol) and can interconnect with digital data communication (e.g., communication networks) of any form or medium. Examples of communication networks include local area networks (“LANs”), wide area networks (“WANs”), the Internet (e.g., the Internet of Things), and peer-to-peer networks (e.g., ad hoc peer-to-peer networks), as well as any currently known or future-developed networks.

[0153] The aforementioned computer-readable medium may be included in the aforementioned electronic device; or it may exist independently and not assembled into the electronic device.

[0154] The aforementioned computer-readable medium carries one or more programs that, when executed by the electronic device, cause the electronic device to:

[0155] The system receives a language switching operation, which is used to switch the current first language to a second language; while displaying the interface content in the second language, the system switches the first format of the target number in the interface content to a second format corresponding to the second language.

[0156] Computer program code for performing the operations of this disclosure can be written in one or more programming languages ​​or a combination thereof, including but not limited to object-oriented programming languages ​​such as Java, Smalltalk, and C++, as well as conventional procedural programming languages ​​such as the "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including a local area network (LAN) or a wide area network (WAN)—or can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0157] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this disclosure. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0158] The units described in the embodiments of this disclosure can be implemented in software or hardware. The names of the units are not, in some cases, intended to limit the specific unit.

[0159] The functions described above in this document can be performed, at least in part, by one or more hardware logic components. For example, exemplary types of hardware logic components that can be used, without limitation, include: Field Programmable Gate Arrays (FPGAs), Application-Specific Integrated Circuits (ASICs), Application Standard Products (ASSPs), System-on-Chip (SoCs), Complex Programmable Logic Devices (CPLDs), and so on.

[0160] In the context of this disclosure, a machine-readable medium can be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, apparatus, or device. A machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium can be, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination of the foregoing. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0161] According to one or more embodiments of this disclosure, [Example 1] provides an anomaly detection method for a business system, applied to an anomaly detection terminal. The anomaly detection terminal establishes connections with multiple business systems included on a business processing platform through system service interfaces, including: collecting business processing information generated by the target business system through the system service interface of the target business system. The target business system is at least one business system on the business processing platform, and the business processing information is generated by the target business system after receiving a business request.

[0162] When data change logs are collected from the database corresponding to the target business system, a consistency determination is made between the business processing information and the data change logs.

[0163] If the determination result is that the business processing information and the data change log are inconsistent, the target business system will be identified as an abnormal system.

[0164] According to one or more embodiments of this disclosure, [Example 2] provides the method of Example 1, which further includes: optionally, the business processing information includes: system attribute information of the target business system, interface input parameter information of the corresponding system service interface when the business request is received, and a first request unique identifier of the business request;

[0165] The data change log includes: the second request unique identifier of the business request associated with the data change, the data before the change, and the data after the change;

[0166] Accordingly, the consistency determination of the business processing information and the data change log includes:

[0167] If the first request unique identifier is the same as the second request unique identifier, then based on the system attribute information, search the preset configuration information for information consistency comparison conditions that match the target business system;

[0168] Based on the information consistency comparison conditions, the interface input parameters, and the changed data, the consistency of the business processing information and the data change log is determined.

[0169] According to one or more embodiments of this disclosure, Example 3 provides the method of Example 1, which further includes: Optionally, the step of determining the consistency of the business processing information and the data change log based on the information consistency comparison conditions, the interface input parameter information, and the changed data includes:

[0170] Extract the input parameter fields to be compared, the database fields to be compared, and the comparison conditions from the information consistency comparison conditions;

[0171] Obtain the first field content of the input parameter field to be compared from the interface input parameter information, and obtain the second field content of the database field to be compared from the modified data;

[0172] If the content of the first field and the content of the second field meet the comparison conditions, then the determination result is that the business processing information and the data change log are consistent.

[0173] If the content of the first field and the content of the second field do not meet the comparison conditions, the determination result is that the business processing information and the data change log are inconsistent.

[0174] According to one or more embodiments of this disclosure, Example 4 provides the method of Example 1, which further includes: Optionally, after determining that the target business system is an abnormal system, it further includes:

[0175] The target business system is identified as an anomaly detection result and stored. When the anomaly alarm conditions are met, the anomaly detection result is displayed as a notification.

[0176] According to one or more embodiments of this disclosure, Example 5 provides the method of Example 1, which further includes: Optionally, after determining that the target business system is an abnormal system, it further includes:

[0177] Based on the business processing information, perform anomaly repair on the data stored in the database; or...

[0178] Based on the data update log, perform anomaly repair on the data stored in the database.

[0179] According to one or more embodiments of this disclosure, Example Six provides the method of Example One, which further includes: Optionally, the step of performing anomaly repair on the data stored in the database based on the business processing information includes:

[0180] Based on the unique identifier of the first request included in the business processing information, determine the first storage location corresponding to the business request in the database, and obtain the first storage data under the first storage location;

[0181] The interface input parameter information of the corresponding system service interface when the target business system receives the business request is obtained from the business processing information, and the business processing expectation data of the business request is parsed from the interface input parameter information.

[0182] The first stored data is updated according to the expected data of the business processing, so as to serve as the updated normal data stored in the database.

[0183] According to one or more embodiments of this disclosure, Example 7 provides the method of Example 1, which further includes: Optionally, the step of performing anomaly repair on the data stored in the database based on the data update log includes:

[0184] Based on the second request unique identifier included in the data update log, determine the second storage location corresponding to the business request in the database, and obtain the second storage data under the second storage location;

[0185] The second stored data is replaced with the data before the update corresponding to the unique identifier of the second request in the data update log, so as to revert the data stored in the database to the state before the target business system processed the business request.

[0186] According to one or more embodiments of this disclosure, [Example Eight] provides an anomaly detection device for a business system, configured on an anomaly detection terminal. The anomaly detection terminal is connected to multiple business systems included on a business processing platform through system service interfaces. The device includes: an information acquisition module, used to acquire business processing information generated by the target business system through the system service interface of the target business system, wherein the target business system is at least one business system on the business processing platform, and the business processing information is generated by the target business system after receiving a business request; an information determination module, used to determine the consistency between the business processing information and the data change log when a data change log is acquired from the database corresponding to the target business system; and an anomaly detection module, used to determine the target business system as an abnormal system if the determination result is that the business processing information and the data change log are inconsistent.

[0187] The descriptions in this disclosure are merely preferred embodiments and explanations of the technical principles employed. Those skilled in the art should understand that the scope of this disclosure is not limited to specific combinations of the above-described technical features, but also includes other technical solutions formed by arbitrary combinations of the above-described technical features or their equivalents without departing from the disclosed concept. For example, technical solutions formed by substituting the above features with (but not limited to) technical features disclosed in this disclosure that have similar functions.

[0188] Furthermore, while the operations are described in a specific order, this should not be construed as requiring these operations to be performed in the specific order shown or in a sequential order. In certain environments, multitasking and parallel processing may be advantageous. Similarly, while several specific implementation details are included in the above discussion, these should not be construed as limiting the scope of this disclosure. Certain features described in the context of individual embodiments may also be implemented in combination in a single embodiment. Conversely, various features described in the context of a single embodiment may also be implemented individually or in any suitable sub-combination in multiple embodiments.

[0189] Although the subject matter has been described using language specific to structural features and / or methodological logic, it should be understood that the subject matter defined in the appended claims is not necessarily limited to the specific features or actions described above. Rather, the specific features and actions described above are merely illustrative examples of implementing the claims.

Claims

1. An anomaly detection method for a business system, characterized in that, An anomaly detection terminal is applied to a business processing platform, wherein the anomaly detection terminal establishes connections with multiple business systems through system service interfaces. The method includes: The system service interface of the target business system is used to collect business processing information generated by the target business system. The target business system is at least one business system on the business processing platform. The business processing information is generated by the target business system after receiving a business request. When data change logs are collected from the database corresponding to the target business system, a consistency determination is made between the business processing information and the data change logs. If the determination result is that the business processing information and the data change log are inconsistent, the target business system will be identified as an abnormal system.

2. The method according to claim 1, characterized in that, The business processing information includes: system attribute information of the target business system, interface input parameter information of the corresponding system service interface when the business request is received, and the first unique identifier of the business request; The data change log includes: the second request unique identifier of the business request associated with the data change, the data before the change, and the data after the change; Accordingly, the consistency determination of the business processing information and the data change log includes: If the first request unique identifier is the same as the second request unique identifier, then based on the system attribute information, search the preset configuration information for information consistency comparison conditions that match the target business system; Based on the information consistency comparison conditions, the interface input parameters, and the changed data, the consistency of the business processing information and the data change log is determined.

3. The method according to claim 2, characterized in that, The step of determining the consistency between the business processing information and the data change log based on the information consistency comparison conditions, the interface input parameters, and the changed data includes: Extract the input parameter fields to be compared, the database fields to be compared, and the comparison conditions from the information consistency comparison conditions; Obtain the first field content of the input parameter field to be compared from the interface input parameter information, and obtain the second field content of the database field to be compared from the modified data; If the content of the first field and the content of the second field meet the comparison conditions, then the determination result is that the business processing information and the data change log are consistent. If the content of the first field and the content of the second field do not meet the comparison conditions, the determination result is that the business processing information and the data change log are inconsistent.

4. The method according to claim 1, characterized in that, After identifying the target business system as an abnormal system, the process also includes: Store the anomaly detection results and provide a notification of the anomaly detection results when the anomaly alarm conditions are met.

5. The method according to claim 1, characterized in that, After identifying the target business system as an abnormal system, the process also includes: Based on the business processing information, perform anomaly repair on the data stored in the database; or... Based on the data update log, perform anomaly repair on the data stored in the database.

6. The method according to claim 5, characterized in that, The step of performing anomaly repair on the data stored in the database based on the business processing information includes: Based on the unique identifier of the first request included in the business processing information, determine the first storage location corresponding to the business request in the database, and obtain the first storage data under the first storage location; The interface input parameter information of the corresponding system service interface when the target business system receives the business request is obtained from the business processing information, and the business processing expectation data of the business request is parsed from the interface input parameter information. The first stored data is updated according to the expected data of the business process, so as to serve as the updated normal data stored in the database.

7. The method according to claim 5, characterized in that, The step of performing anomaly repair on the data stored in the database based on the data update log includes: Based on the second request unique identifier included in the data update log, determine the second storage location corresponding to the business request in the database, and obtain the second storage data under the second storage location; The second stored data is replaced with the data before the update corresponding to the unique identifier of the second request in the data update log, so as to revert the data stored in the database to the state before the target business system processed the business request.

8. An anomaly detection device for a business system, characterized in that, Configured in an anomaly detection terminal, the anomaly detection terminal establishes connections with multiple business systems included on the business processing platform through system service interfaces, the device comprising: The information collection module is used to collect business processing information generated by the target business system through the system service interface of the target business system. The target business system is at least one business system on the business processing platform. The business processing information is generated by the target business system after receiving a business request. The information determination module is used to determine the consistency between the business processing information and the data change log when data change logs are collected from the database corresponding to the target business system. The anomaly detection module is used to identify the target business system as an abnormal system if the determination result is that the business processing information and the data change log are inconsistent.

9. An electronic device, characterized in that, As an anomaly detection terminal that establishes a connection with the business systems in the business processing platform, it includes: One or more processors; Storage device for storing one or more programs. When the one or more programs are executed by the one or more processors, the one or more processors implement the anomaly detection method for the business system as described in any one of claims 1-7.

10. A storage medium containing computer-executable instructions, characterized in that, The computer-executable instructions, when executed by a computer processor, are used to perform the anomaly detection method of the business system as described in any one of claims 1-7.

11. A computer program product, characterized in that, The computer program product includes a computer program that, when executed by a processor, implements the anomaly detection method for a business system according to any one of claims 1-7.

Images