Data monitoring method, device, electronic device and readable storage medium

Abstract

The present disclosure provides a data monitoring method, device, electronic device and readable storage medium, which can be applied to the financial field or other fields. The data monitoring method includes: obtaining transaction data of a data interface in a first time period, processing the transaction data, and generating a first value; obtaining transaction data of a data interface in a second time period, processing the transaction data, and generating a second value; scoring the second value by a preset function and the first value, and obtaining a score corresponding to the second value; comparing the score with a first threshold, controlling the data transmission of the data interface based on the comparison result, and / or updating the first value based on the comparison result; wherein the length of the first time period is equal to the length of the second time period, and the first time period and the second time period move synchronously on the time axis.

Description

Technical Field

[0001] The present disclosure relates to the field of big data technology, and more specifically, to a data monitoring method, device, electronic device, and readable storage medium. Background Art

[0002] Each bank is equipped with an open API payment data interface that does not require authentication for use by third-party payment institutions. During the use of third-party payment institutions, some payment institutions have opened the payment data interface to other merchants who have not been reviewed and registered without permission, and other merchants have transferred the payment interface again, resulting in the inability to effectively manage the data and business of the payment business, while also squeezing the bank's payment resources and causing resource waste. Summary of the invention

[0003] In view of this, the present disclosure provides a data monitoring method, device, electronic device and readable storage medium.

[0004] A first aspect of the present disclosure provides a data monitoring method, including: obtaining transaction data of a data interface in a first time period, processing the transaction data, and generating a first value; obtaining transaction data of the data interface in a second time period, processing the transaction data, and generating a second value; scoring the second value by a preset function and the first value, and obtaining a score corresponding to the second value; comparing the score with a first threshold, controlling data transmission of the data interface based on the comparison result, and / or updating the first value based on the comparison result; wherein the length of the first time period is equal to the length of the second time period, and the first time period and the second time period move synchronously on the time axis.

[0005] According to an embodiment of the present disclosure, the second time period includes multiple second sub-time periods, and the second numerical value includes a second sub-numerical value; obtaining the transaction data of the data interface in the second time period, processing the transaction data, and generating the second numerical value includes: obtaining the transaction data of the data interface in one of the second sub-time periods, processing the transaction data, and generating a second sub-numerical value.

[0006] According to an embodiment of the present disclosure, the data monitoring method includes: scoring the second sub-value by using the preset function and the first value to obtain a sub-score corresponding to the second sub-value; comparing the sub-score with the first threshold, and marking the second sub-time period based on the comparison result.

[0007] According to an embodiment of the present disclosure, if the sub-score exceeds the first threshold, the second sub-period is marked as an abnormal sub-period.

[0008] According to an embodiment of the present disclosure, the total number of the second sub-periods marked as the abnormal sub-periods is counted, and if the total number exceeds a second threshold, the second period is marked as an abnormal period, and abnormal information is generated.

[0009] According to an embodiment of the present disclosure, comparing the score with a first threshold and controlling the data transmission of the data interface based on the comparison result includes: if the score exceeds the first threshold, generating a reminder instruction based on the abnormal information, and the reminder instruction includes whether to add the data interface to a blacklist.

[0010] According to an embodiment of the present disclosure, comparing the score with a first threshold and controlling the data transmission of the data interface based on the comparison result includes: if the score exceeds the first threshold, generating a control instruction based on the abnormal information, the control instruction including changing the protocol of the data interface and restricting data calls of the data interface to adjust the data interface calling rules.

[0011] According to an embodiment of the present disclosure, the first time period includes a first sub-time period, and the first value includes a first sub-value; the comparing the score with the first threshold and updating the first value based on the comparison result includes: if the score exceeds the first threshold, generating prediction data based on the second sub-value of the abnormal sub-time period; updating the first sub-value of the first sub-time period based on the prediction data; wherein the first sub-time period is equal to the abnormal sub-time period in length, and the first sub-time period and the abnormal sub-time period move synchronously on the time axis.

[0012] According to an embodiment of the present disclosure, updating the first value based on the comparison result includes: if the score exceeds the first threshold, reviewing the second value of the abnormal period; and updating the reviewed second value to the first value.

[0013] According to an embodiment of the present disclosure, scoring the second value by using a preset function and the first value to obtain a score corresponding to the second value includes: obtaining the standard deviation σ of the first value in the first time period by using a standard deviation function and the first value. 0 ; Through the scoring function Z score =(Z 1 -Z 0 ) / σ 0 Get the score, where Z 0 Represents the first value, Z 1 Indicates the second value.

[0014] According to an embodiment of the present disclosure, the transaction data includes at least one of a transaction amount, a number of transactions, and a transaction time.

[0015] A second aspect of the present disclosure provides a data monitoring device, including: a first acquisition module, configured to acquire transaction data of a data interface in a first time period, process the transaction data, and generate a first value; a second acquisition module, configured to acquire transaction data of the data interface in a second time period, process the transaction data, and generate a second value; a scoring module, configured to score the second value through a preset function and the first value, and acquire a score corresponding to the second value; a comparison and control module, configured to compare the score with a first threshold, control the data transmission of the data interface based on the comparison result, and / or update the first value based on the comparison result, wherein the length of the first time period is equal to the length of the second time period, and the first time period and the second time period move synchronously on the time axis.

[0016] According to an embodiment of the present disclosure, the scoring module includes a scoring submodule, wherein the scoring submodule is configured to obtain the standard deviation σ of the first value in the first time period through a standard deviation function and the first value. 0 ; and through the scoring function Z score =(Z 1 -Z 0 ) / σ 0 Get the score, where Z 0 Represents the first value, Z 1 Indicates the second value.

[0017] According to an embodiment of the present disclosure, the comparison and regulation module includes a comparison module and a regulation module, wherein the comparison module is configured to compare the score with the first threshold and generate a comparison result. The regulation module is configured to control the data transmission of the data interface based on the comparison result, and / or update the first value based on the comparison result.

[0018] According to an embodiment of the present disclosure, if the score exceeds the first threshold, the control module is configured to generate a reminder instruction based on the abnormal information, and the reminder instruction includes whether to add the data interface to the blacklist.

[0019] According to an embodiment of the present disclosure, if the score exceeds the first threshold, the regulation module is configured to generate a control instruction based on the abnormal information, and the control instruction includes changing the protocol of the data interface, or restricting the data call of the data interface to adjust the data interface calling rules.

[0020] According to an embodiment of the present disclosure, the first time period includes a first sub-time period, and the first value includes a first sub-value. If the score exceeds the first threshold, the control module is configured to generate prediction data based on the second sub-value of the abnormal sub-time period; and update the first sub-value of the first sub-time period based on the prediction data; wherein the first sub-time period is equal to the abnormal sub-time period in length, and the first sub-time period and the abnormal sub-time period move synchronously on the time axis.

[0021] According to an embodiment of the present disclosure, if the score exceeds the first threshold, the control module is configured to review the second value of the abnormal period; and update the second value that passes the review to the first value.

[0022] A third aspect of the present disclosure provides an electronic device, comprising: one or more processors; a storage device for storing executable instructions, wherein when the executable instructions are executed by the processors, the data monitoring method described above is implemented.

[0023] A fourth aspect of the present disclosure provides a computer-readable storage medium having executable instructions stored thereon, which, when executed by a processor, implements the data monitoring method described above.

[0024] According to the embodiments of the present disclosure, one or more of the above embodiments have the following advantages or beneficial effects: when a transaction is conducted on a data interface, by obtaining the transaction data of the data interface in a first period (historical period) and the transaction data of the data interface in a second period (current period), and scoring the transaction data of the second period according to the transaction data of the first period to obtain a corresponding score, the data interface is controlled based on the comparison result of the score with the first threshold. At least partially solves the problem of resource occupation and inconvenience in management caused by the data interface being accessed by a third party. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] The above and other objects, features and advantages of the present disclosure will become more apparent through the following description of the embodiments of the present disclosure with reference to the accompanying drawings, in which:

[0026] Figure 1A The application scenarios of the data monitoring method and device according to the embodiments of the present disclosure are schematically shown;

[0027] Figure 1B The exemplary system architecture of the data monitoring method according to the embodiment of the present disclosure is schematically shown;

[0028] Figure 2A A flowchart of a data monitoring method according to an embodiment of the present disclosure is schematically shown;

[0029] Figure 2BThe flowchart of scoring the second value in operation S203 of the data monitoring method according to the embodiment of the present disclosure is schematically shown;

[0030] Figure 3A A block diagram of a data monitoring device according to an embodiment of the present disclosure is schematically shown;

[0031] Figure 3B A block diagram of a comparison and control module of a data monitoring device according to an embodiment of the present disclosure is schematically shown;

[0032] Figure 4 A block diagram of an electronic device according to an embodiment of the present disclosure is schematically shown. DETAILED DESCRIPTION

[0033] Hereinafter, embodiments of the present disclosure will be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of the present disclosure. In the following detailed description, for ease of explanation, many specific details are set forth to provide a comprehensive understanding of the embodiments of the present disclosure. However, it is apparent that one or more embodiments may also be implemented without these specific details. In addition, in the following description, descriptions of known structures and technologies are omitted to avoid unnecessary confusion of the concepts of the present disclosure.

[0034] The terms used herein are only for describing specific embodiments and are not intended to limit the present disclosure. The terms "comprise", "include", etc. used herein indicate the existence of the features, steps, operations and / or components, but do not exclude the existence or addition of one or more other features, steps, operations or components.

[0035] All terms (including technical and scientific terms) used herein have the meanings commonly understood by those skilled in the art, unless otherwise defined. It should be noted that the terms used herein should be interpreted as having a meaning consistent with the context of this specification, and should not be interpreted in an idealized or overly rigid manner.

[0036] When using expressions such as "at least one of A, B, and C, etc.", it should generally be interpreted according to the meaning of the expression generally understood by those skilled in the art (for example, "a system having at least one of A, B, and C" should include but is not limited to a system having A alone, B alone, C alone, A and B, A and C, B and C, and / or A, B, C, etc.). Those skilled in the art should also understand that any transitional conjunctions and / or phrases that essentially represent two or more optional items, whether in the specification, claims, or drawings, should be understood to give the possibility of including one of these items, either of these items, or both of these items. For example, the phrase "A or B" should be understood to include the possibility of "A" or "B", or "A and B".

[0037] It should be noted that, in this article, the expression "moving synchronously on the time axis" can mean that two time periods are synchronously rolling and changing on the time axis or in the same cycle. For example, if the duration of time period A is 1 month, and the duration of time period B is also 1 month, then the synchronous movement of time period A and time period B on the time axis can be expressed as the time interval between time period A and time period B remains unchanged, which can be half a year, one year, or five years, etc. For example, if the time interval between time period A and time period B is one year, then if time period A represents January 2018, time period B represents January 2019, and when time period A changes on the time axis, time period B also changes synchronously on the time axis.

[0038] The embodiment of the present disclosure provides a data monitoring method, including: obtaining transaction data of a data interface in a first period, processing the transaction data, and generating a first value; obtaining transaction data of a data interface in a second period, processing the transaction data, and generating a second value; scoring the second value by a preset function and the first value, and obtaining a score corresponding to the second value; comparing the score with a first threshold, and controlling the data transmission of the data interface based on the comparison result, and / or updating the first value based on the comparison result; wherein the length of the first period is equal to the length of the second period, and the first period and the second period move synchronously on the time axis. According to the embodiment of the present disclosure, when the data interface conducts a transaction, by obtaining the transaction data of the data interface in the first period and the transaction data of the data interface in the second period, and scoring the transaction data of the second period according to the transaction data of the first period to obtain a corresponding score, the data interface is controlled based on the comparison result of the score and the first threshold, at least partially solving the problem of resource occupation and inconvenience in management caused by the access of the data interface by a third party.

[0039] Figure 1A The application scenarios of the data monitoring method and device according to the embodiments of the present disclosure are schematically illustrated. Figure 1B The exemplary system architecture of the data monitoring method according to the embodiment of the present disclosure is schematically shown. It should be noted that: Figure 1A and Figure 1B What is shown are only examples of application scenarios and system architectures to which the embodiments of the present disclosure can be applied, in order to help those skilled in the art understand the technical content of the present disclosure, but it does not mean that the embodiments of the present disclosure cannot be used in other devices, systems, environments or scenarios. It should be noted that the data monitoring method, device, electronic device and computer-readable storage medium provided by the embodiments of the present disclosure can be used in the field of big data technology and related aspects of the financial field, and can also be used in other fields outside the financial field. The data monitoring method, device, electronic device and storage medium provided by the embodiments of the present disclosure do not limit the application field.

[0040] like Figure 1A As shown, the data monitoring method of the embodiment of the present disclosure can be applied to the scenario 100, which includes a banking institution 101 and third-party payment institutions 103, 104, 105, and 106, wherein the banking institution 101 opens an open payment data interface 102 so that the third-party payment institution can call the payment service for payment. The third-party payment institution calls the payment data interface 102 by wired or wireless means. The banking institution 101 manages the authority of the payment data interface 102, thereby realizing the control of the payment data interface. The third-party payment institution can be, for example, a retailer, an online store, a vending machine, a supermarket, etc., which needs to call the payment data interface 102 of the banking institution 101 for business settlement and other work. Among them, the payment data interface 102 in the figure can, for example, monitor the transaction data of the payment data interface 102 by the data monitoring method of the embodiment of the present disclosure. This application scenario is to help those skilled in the art understand the technical content of the present disclosure, but it does not mean that the embodiment of the present disclosure cannot be used in other scenarios.

[0041] like Figure 1B As shown, an exemplary system architecture 110 of the data monitoring method according to an embodiment of the present disclosure is shown, and the system architecture 110 may include terminal devices 111, 112, 113, a network 114, and a server 115. The network 114 is used to provide a medium for a communication link between the terminal devices 111, 112, 113 and the server 115. The network 114 may include various connection types, such as wired, wireless communication links, or optical fiber cables, etc.

[0042] The user can use the terminal devices 111, 112, 113 to interact with the server 115 through the network 114 to receive or send messages, etc. Various communication client applications can be installed on the terminal devices 111, 112, 113, such as program control applications, shopping applications, web browser applications, search applications, instant messaging tools, email clients, social platform software, etc. (only as examples).

[0043] The terminal devices 111, 112, 113 can be various electronic devices with display screens and supporting web browsing, including but not limited to smart phones, tablet computers, laptop computers, desktop computers, etc. The terminal devices can implement the data monitoring method of the embodiment of the present disclosure by sending or receiving control instructions.

[0044] The server 115 may be a server that provides various services, such as a background management server (only as an example) that provides support for control instructions or operations generated by users using the terminal devices 111, 112, and 113. The background management server may analyze and process the received data such as user requests, and feed back the processing results (such as control instructions, information or data sent by the user) to the terminal device to implement the data monitoring method of the embodiment of the present disclosure.

[0045] It should be noted that the data monitoring method provided in the embodiment of the present disclosure can generally be executed by the server 115. Accordingly, the data monitoring device provided in the embodiment of the present disclosure can generally be set in the server 115. The data monitoring method provided in the embodiment of the present disclosure can also be executed by a server or server cluster that is different from the server 115 and can communicate with the terminal devices 111, 112, 113 and / or the server 115. Accordingly, the data monitoring device provided in the embodiment of the present disclosure can also be set in a server or server cluster that is different from the server 115 and can communicate with the terminal devices 111, 112, 113 and / or the server 115.

[0046] It should be understood that Figure 1B The number of terminal devices, networks and servers in the embodiment is only for illustration. Any number of terminal devices, networks and servers may be provided according to implementation requirements.

[0047] Figure 2A The flowchart of the data monitoring method according to the embodiment of the present disclosure is schematically shown.

[0048] like Figure 2A As shown, the process of the data monitoring method 200 of the embodiment of the present disclosure includes operations S201 to S204.

[0049] In operation S201, transaction data of a data interface in a first period is obtained, and the transaction data is processed to generate a first value.

[0050] For example, the data interface may be an open payment data interface opened by a bank that does not require authentication, and the payment institution may exchange payment service data with the bank through the payment interface.

[0051] The transaction data of the data interface in different time periods are different. By obtaining the transaction data of the data interface, the specific transaction situation of the data interface can be understood, and the control of the transaction data interface can be further realized according to the transaction situation. In the embodiment of the present disclosure, the first time period can be a certain historical time period. The transaction data can be the data of the payment business conducted by the third-party payment institution through the data interface. Specifically, it includes transaction data every month, every day, every hour or every minute.

[0052] In the embodiments of the present disclosure, the transaction data may be at least one of the transaction amount, the number of transactions, and the transaction time. For example, the transaction data may include the above three and other transaction data.

[0053] Processing the transaction data may be to find the sample mean of the first period. The first period may be a historical transaction period, and the first value may be the sample mean of the transaction data of the historical period. For example, there are n days in the historical transaction period, and the transaction amount in a certain historical transaction period is X=(X 1 , X 2 , X 3 …X i …X n ), calculate the sample mean Z of the transaction amount during the historical trading period 0 Specifically, the sample mean is the total transaction amount of the days in the trading period divided by the number of days in the historical trading period.

[0054] In an optional implementation, the transaction data may also be the number of transactions and / or transaction amount, etc.

[0055] In other embodiments of the present disclosure, the first time period may also be a time period of a certain day in the historical trading period. The transaction amount per hour within the day may be calculated, and the sample mean per hour at different times within the day may be calculated. The calculation method adopts the method described above and will not be repeated here.

[0056] In operation S202, transaction data of the data interface in a second period is obtained, and the transaction data is processed to generate a second value.

[0057] For example, the second period may be the current period, i.e., the period during which transactions are being made, and the second value may be the sample mean of transaction data in the current period. The current trading period has m days, and the transaction amount Y in the entire current trading period is (Y 1 , Y 2 , Y 3 …Y i …Y m ), and then calculate the sample mean Z of the transaction amount in the current trading period 1 , the sample mean is calculated as described above.

[0058] Figure 2B The flowchart of scoring the second value in operation S203 of the data monitoring method according to the embodiment of the present disclosure is schematically shown.

[0059] In operation S203, the second value is scored using a preset function and the first value to obtain a score corresponding to the second value.

[0060] According to the embodiments of the present disclosure, Figure 2B As shown, the process of operation S203 of scoring the second value includes operation S2031 to operation S2032.

[0061] In operation S2031, the standard deviation σ of the first value in the first time period is obtained by using the standard deviation function and the first value. 0 .

[0062] For example, get the first value Z of the first period 0 (i.e. sample mean), and based on the sample mean and the transaction data X of the first period i Calculate the sample standard deviation σ for the first period 0 .

[0063] Sample standard deviation σ 0 Calculated by the standard deviation function, as follows:

[0064]

[0065] Among them, X i represents the transaction data of the first period, and n represents the duration of the first period, such as the number of days.

[0066] In operation S2032, the scoring function Z score =(Z 1 -Z 0 ) / σ 0 Get the score corresponding to the second value, where Z 0 Represents the first value, Z 1 Indicates the second value.

[0067] For example, after calculating the standard deviation, the second value is scored by a scoring function to obtain a score corresponding to the second value. The score can reflect whether the transaction data of the second period is normal, so that the staff or the system can feedback the transaction status of the data interface according to the transaction situation, that is, whether there is an abnormal transaction situation in the data interface.

[0068] In operation S204, the score is compared with the first threshold, data transmission of the data interface is controlled based on the comparison result, and / or the first value is updated based on the comparison result. The length of the first time period is equal to the length of the second time period, and the first time period and the second time period move synchronously on the time axis.

[0069] In the embodiments of the present disclosure, the first threshold is a set threshold, which can be adjusted according to specific circumstances, and a comparison result is generated by comparing the score corresponding to the second value with the first threshold. For example, if the comparison result is that the score exceeds the first threshold, it indicates that the transaction data of the second period is abnormal, and if the comparison result is that the score does not exceed the first threshold, it indicates that the transaction data of the second period is normal.

[0070] When it is detected that the transaction data in the second time period is abnormal, the data transmission of the data interface is controlled, and / or the first value is updated.

[0071] For example, when the transaction data in the second period is abnormal, it means that there is a risk of unauthorized third-party access to the data interface, so a method of controlling the data transmission of the data interface can be adopted. For example, the data interface is added to the blacklist, or the protocol of the data interface is modified. In addition, since the abnormality of transaction data is not necessarily caused by abnormal access by a third party, it may also be due to seasonal sales increases or product quality. Therefore, in the case of abnormal transaction data in the second period, it can be determined by manual or machine reasoning whether the transaction data is caused by abnormal access by a third party. After confirming that the transaction data in the second period is correct, the first value is updated to exclude other reasonable fluctuations in transaction data. The fluctuation of transaction data may also be caused by reasonable data fluctuations and abnormalities caused by the removal of third-party anomalies. At this time, you can choose to restrict the data interface or update the first value at the same time.

[0072] In an embodiment of the present disclosure, the second time period includes a plurality of second sub-time periods, and the second value includes a second sub-value. Obtaining transaction data of the data interface in the second time period, processing the transaction data, and generating the second value includes: obtaining transaction data of the data interface in one of the second sub-time periods, processing the transaction data, and generating the second sub-value.

[0073] For example, the second period may be a trading month, the second sub-period may be a trading day in the trading month, and a trading month includes multiple trading days. The second value may be a trading month sample mean, and the second sub-value may be a trading day sample mean.

[0074] For example, the transaction data of each trading day is obtained through a data interface, and the transaction data is processed to generate a sample mean of the trading day.

[0075] In an embodiment of the present disclosure, the data monitoring method of the present disclosure includes scoring the second sub-value by using a preset function and a first value to obtain a sub-score corresponding to the second sub-value, comparing the sub-score with a first threshold, and marking the second sub-period based on the comparison result.

[0076] For example, the preset function includes the standard deviation function described above, and the first value may be a sample mean calculated based on a historical period. After obtaining the second sub-value, the second sub-value is scored using the standard deviation function to obtain a sub-score. By comparing the sub-score with the first threshold, a comparison result is generated, and the second sub-period is marked based on the comparison result. That is, if the sub-score in a trading day is found to exceed the first threshold, the trading day is marked.

[0077] In an embodiment of the present disclosure, if the sub-score exceeds the first threshold, the second sub-period is marked as an abnormal sub-period.

[0078] For example, if the sub-score exceeds the first threshold, it indicates that the trading data of that day is abnormal, and therefore, the trading day is marked as an abnormal trading day.

[0079] In an optional embodiment, the transaction time in a transaction day may be screened, and if the transaction data in a transaction time is abnormal, the transaction time may be marked as an abnormal transaction time.

[0080] In an embodiment of the present disclosure, the total number of the second sub-periods marked as abnormal sub-periods is counted, and if the total number exceeds a second threshold, the second period is marked as an abnormal period, and abnormal information is generated.

[0081] For example, the second period is a trading month, the second sub-period may be a trading day in the trading month, the number of trading days marked as abnormal trading days is counted, and when the number of abnormal trading days exceeds a second threshold (e.g., 10 days), the trading month is marked as an abnormal trading month, and abnormal information is generated. The abnormal information may remind the data interface management unit to manage or control the data interface.

[0082] For another example, the duration of transactions marked as abnormal transactions on a trading day may be counted. When the duration of abnormal transactions exceeds a second threshold, the trading day is marked as an abnormal trading day and abnormal information is generated.

[0083] In an embodiment of the present disclosure, the score is compared with a first threshold, and data transmission of the data interface is controlled based on the comparison result, including: if the score exceeds the first threshold, a reminder instruction is generated based on the abnormal information, and the reminder instruction includes whether to add the data interface to the blacklist.

[0084] For example, the data interface is managed and controlled based on the comparison results. Specifically, a reminder instruction is generated based on the abnormal information. The instruction can remind the manager of the data interface whether to add the data interface with abnormal information to the blacklist. After the data interface is added to the blacklist, the data interface can no longer perform payment services, thereby achieving management and control of the data interface.

[0085] In an embodiment of the present disclosure, the score is compared with a first threshold, and data transmission of the data interface is controlled based on the comparison result, including: if the score exceeds the first threshold, a control instruction is generated based on the abnormal information, and the control instruction includes changing the protocol of the data interface, or restricting data calls of the data interface to adjust the data interface calling rules.

[0086] For example, a control instruction is generated based on the abnormal information, and the control instruction includes changing the protocol of the data interface, that is, the administrator modifies the protocol of the data interface according to the abnormal information, so that the data interface can allow fluctuations in transaction values ​​within a certain range.

[0087] For another example, a control instruction is generated based on the abnormal information, and the control instruction includes limiting the data call of the data interface. For example, after the abnormal information is generated, the system triggers the interface call rule based on the abnormal information to limit the data call of the data interface. At the same time, the administrator can view the restricted data interface according to the abnormal information.

[0088] In an embodiment of the present disclosure, a first time period includes a first sub-time period, and a first value includes a first sub-value; comparing the score with a first threshold, and updating the first value based on the comparison result includes: if the score exceeds the first threshold, generating prediction data based on a second sub-value of the abnormal sub-time period; updating the first sub-value of the first sub-time period based on the prediction data; wherein the first sub-time period is equal to the abnormal sub-time period in length, and the first sub-time period and the abnormal sub-time period move synchronously on the time axis.

[0089] For example, the first period is a trading month in the historical period, and the first sub-period is a trading day in the trading month of the historical period. The second value is scored to obtain a score corresponding to the second value. If the score exceeds the first threshold, forecast data is generated based on the abnormal sub-period in the second sub-period. The abnormal transaction data in the abnormal sub-period may be caused by normal transaction data fluctuations. Therefore, these transaction data are calculated according to the model to generate forecast data, and the first sub-value of the first sub-period is updated based on the forecast data, that is, the transaction data of certain trading days in the trading month of the historical period is updated. Thereby, the current transaction data becomes normal relative to the transaction data in the updated historical period trading month. The management personnel can also modify the protocol of the data interface according to the forecast data, so that the transaction data of the abnormal sub-period in the second sub-period becomes normal relative to the modified protocol, so as to realize pre-forecast control.

[0090] In the embodiment of the present disclosure, the length of the first sub-period is equal to that of the abnormal sub-period, which can be represented by the number of trading days in the historical trading month being equal to the number of abnormal trading days. The synchronous movement of the first sub-period and the abnormal sub-period on the time axis can be represented by a certain trading day in the historical trading month (e.g., the 15th day of the historical trading month) corresponding to a certain trading day in the current trading month (the 15th day of the current trading month).

[0091] In an embodiment of the present disclosure, updating the first value based on the comparison result includes: if the score exceeds the first threshold, reviewing the second value of the abnormal time period; and updating the reviewed second value to the first value.

[0092] For example, if the second value is scored and the score obtained exceeds the first threshold, it indicates that the transaction data of the second time period is abnormal. At this time, the second value of the abnormal time period in the second time period is reviewed, for example, it can be manually reviewed, or the machine reviews the second value according to the model calculation. The data anomaly caused by non-third-party abnormal access in the second value is excluded, for example, the data anomaly may be a normal transaction fluctuation. The second value that has passed the review is updated to the first value, thereby completing the correction of the transaction data of the historical period. And based on the corrected transaction data, the data interface that is added to the blacklist or restricted by the system is removed from the blacklist, or the disabled data interface is re-enabled.

[0093] According to an embodiment of the present disclosure, when a transaction is conducted on a data interface, transaction data of the data interface in a first time period and transaction data of the data interface in a second time period are obtained, and the transaction data of the second time period is scored according to the transaction data of the first time period to obtain a corresponding score. Based on a comparison result of the score with a first threshold, the data interface is managed and controlled, which at least partially solves the problem of resource occupation and inconvenience in management caused by access to the data interface by a third party.

[0094] Figure 3A A block diagram of a data monitoring device according to an embodiment of the present disclosure is schematically shown. Figure 3B A block diagram of a comparison and control module of a data monitoring device according to an embodiment of the present disclosure is schematically shown.

[0095] like Figure 3A As shown, the data monitoring device 300 of the embodiment of the present disclosure includes a first acquisition module 310 , a second acquisition module 320 , a scoring module 330 and a comparison and regulation module 340 .

[0096] The first acquisition module 310 is used to execute operation S201 in the data monitoring method. The first acquisition module 310 is configured to acquire transaction data of the data interface in a first period, process the transaction data, and generate a first value.

[0097] The second acquisition module 320 is used to execute the operation S202 in the data monitoring method. The second acquisition module 320 is configured to acquire transaction data of the data interface in a second period, process the transaction data, and generate a second value.

[0098] The scoring module 330 is used to perform operation S203 in the data monitoring method. The scoring module 330 is configured to score the second value by using a preset function and the first value to obtain a score corresponding to the second value.

[0099] The comparison and control module 340 is used to execute operation S204 in the data monitoring method. The comparison and control module 340 is configured to compare the score with the first threshold, control the data transmission of the data interface based on the comparison result, and / or update the first value based on the comparison result, wherein the length of the first time period is equal to the length of the second time period, and the first time period and the second time period move synchronously on the time axis.

[0100] In the embodiment of the present disclosure, the scoring module 330 includes a scoring submodule, which is configured to obtain the standard deviation σ of the first value in the first time period through the standard deviation function and the first value. 0 ; and through the scoring function Z score =(Z 1 -Z 0 ) / σ 0 Get the score, where Z 0 Represents the first value, Z 1 Indicates the second value.

[0101] In an embodiment of the present disclosure, the comparison and regulation module 340 includes a comparison module 341 and a regulation module 342. The comparison module 341 is configured to compare the score with the first threshold and generate a comparison result. The regulation module 342 is configured to control the data transmission of the data interface based on the comparison result, and / or update the first value based on the comparison result.

[0102] In an embodiment of the present disclosure, if the score exceeds the first threshold, the control module 342 is configured to generate a reminder instruction based on the abnormal information, and the reminder instruction includes whether to add the data interface to the blacklist.

[0103] In an embodiment of the present disclosure, if the score exceeds the first threshold, the control module 342 is configured to generate control instructions based on the abnormal information, and the control instructions include changing the protocol of the data interface and restricting the data call of the data interface to adjust the data interface call rules.

[0104] In an embodiment of the present disclosure, the first time period includes a first sub-period, and the first value includes a first sub-value. If the score exceeds a first threshold, the control module 342 is configured to generate prediction data based on the second sub-value of the abnormal sub-period; and update the first sub-value of the first sub-period based on the prediction data; wherein the first sub-period is equal to the abnormal sub-period in length, and the first sub-period and the abnormal sub-period move synchronously on the time axis.

[0105] In an embodiment of the present disclosure, if the score exceeds the first threshold, the control module 342 is configured to review the second value of the abnormal time period; and update the second value that passes the review to the first value.

[0106] According to the embodiments of the present invention, any one or more of the modules, submodules, units, and subunits, or at least part of the functions of any one of them can be implemented in one module. According to the embodiments of the present invention, any one or more of the modules, submodules, units, and subunits can be split into multiple modules for implementation. According to the embodiments of the present invention, any one or more of the modules, submodules, units, and subunits can be at least partially implemented as hardware circuits, such as field programmable gate arrays (FPGAs), programmable logic arrays (PLAs), systems on chips, systems on substrates, systems on packages, application specific integrated circuits (ASICs), or can be implemented by hardware or firmware in any other reasonable way of integrating or packaging the circuit, or implemented in any one of the three implementation methods of software, hardware, and firmware, or in any appropriate combination of any of them. Alternatively, according to the embodiments of the present invention, one or more of the modules, submodules, units, and subunits can be at least partially implemented as computer program modules, and when the computer program modules are run, the corresponding functions can be performed.

[0107] For example, any multiple of the first acquisition module 310, the second acquisition module 320, the scoring module 330, the comparison and control module 340, the comparison module 341 and the control module 342 can be combined in one module for implementation, or any one of the modules can be split into multiple modules. Alternatively, at least part of the functions of one or more of these modules can be combined with at least part of the functions of other modules and implemented in one module. According to an embodiment of the present disclosure, at least one of the first acquisition module 310, the second acquisition module 320, the scoring module 330, the comparison and control module 340, the comparison module 341 and the control module 342 can be at least partially implemented as a hardware circuit, such as a field programmable gate array (FPGA), a programmable logic array (PLA), a system on a chip, a system on a substrate, a system on a package, an application specific integrated circuit (ASIC), or can be implemented by hardware or firmware such as any other reasonable way of integrating or packaging the circuit, or by any one of the three implementation methods of software, hardware and firmware or by a suitable combination of any of them. Alternatively, at least one of the first acquisition module 310, the second acquisition module 320, the scoring module 330, the comparison and control module 340, the comparison module 341 and the control module 342 can be at least partially implemented as a computer program module, and when the computer program module is executed, the corresponding function can be executed.

[0108] Figure 4 A block diagram of an electronic device suitable for implementing the method described above according to an embodiment of the present disclosure is schematically shown. Figure 4 The electronic device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present disclosure.

[0109] like Figure 4 As shown, the electronic device 400 according to an embodiment of the present disclosure includes a processor 401, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 402 or a program loaded from a storage part 408 into a random access memory (RAM) 403. The processor 401 may include, for example, a general-purpose microprocessor (e.g., a CPU), an instruction set processor and / or a related chipset and / or a special-purpose microprocessor (e.g., an application-specific integrated circuit (ASIC)), etc. The processor 401 may also include an onboard memory for caching purposes. The processor 401 may include a single processing unit or multiple processing units for performing different actions of the method flow according to an embodiment of the present disclosure.

[0110] In RAM 403, various programs and data required for the operation of electronic device 400 are stored. Processor 401, ROM 402 and RAM 403 are connected to each other via bus 404. Processor 401 performs various operations of the method flow according to the embodiment of the present disclosure by executing the program in ROM 402 and / or RAM 403. It should be noted that the program can also be stored in one or more memories other than ROM 402 and RAM 403. Processor 401 can also perform various operations of the method flow according to the embodiment of the present disclosure by executing the program stored in the one or more memories.

[0111] According to an embodiment of the present disclosure, the electronic device 400 may further include an input / output (I / O) interface 405, which is also connected to the bus 404. The electronic device 400 may further include one or more of the following components connected to the I / O interface 405: an input portion 406 including a keyboard, a mouse, etc.; an output portion 407 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage portion 408 including a hard disk, etc.; and a communication portion 409 including a network interface card such as a LAN card, a modem, etc. The communication portion 409 performs communication processing via a network such as the Internet. A drive 410 is also connected to the I / O interface 405 as needed. A removable medium 411, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 410 as needed, so that a computer program read therefrom is installed into the storage portion 408 as needed.

[0112] The present disclosure also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments; or may exist independently without being assembled into the device / apparatus / system. The above computer-readable storage medium carries one or more programs, and when the above one or more programs are executed, the method according to the embodiment of the present disclosure is implemented.

[0113] According to an embodiment of the present disclosure, the computer-readable storage medium may be a non-volatile computer-readable storage medium, for example, may include but is not limited to: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program, which may be used by or in combination with an instruction execution system, an apparatus or a device. For example, according to an embodiment of the present disclosure, a computer-readable storage medium may include the ROM 402 and / or RAM 403 described above and / or one or more memories other than ROM 402 and RAM 403.

[0114] An embodiment of the present disclosure also includes a computer program product, which includes a computer program, and the computer program contains a program code for executing the method provided by the embodiment of the present disclosure. When the computer program product runs on an electronic device, the program code is used to enable the electronic device to implement the data monitoring method provided by the embodiment of the present disclosure.

[0115] When the computer program is executed by the processor 401, the above functions defined in the system / device of the embodiment of the present disclosure are executed. According to the embodiment of the present disclosure, the system, device, module, unit, etc. described above can be implemented by a computer program module.

[0116] In one embodiment, the computer program may rely on tangible storage media such as optical storage devices, magnetic storage devices, etc. In another embodiment, the computer program may also be transmitted and distributed in the form of signals on a network medium, and downloaded and installed through the communication part 409, and / or installed from the removable medium 411. The program code contained in the computer program may be transmitted using any appropriate network medium, including but not limited to: wireless, wired, etc., or any suitable combination of the above.

[0117] According to an embodiment of the present disclosure, the program code for executing the computer program provided by the embodiment of the present disclosure can be written in any combination of one or more programming languages. Specifically, these computing programs can be implemented using high-level process and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages ​​include, but are not limited to, Java, C++, python, "C" language or similar programming languages. The program code can be executed entirely on the user computing device, partially on the user device, partially on the remote computing device, or entirely on the remote computing device or server. In the case of a remote computing device, the remote computing device can be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computing device (for example, using an Internet service provider to connect through the Internet).

[0118] The flow charts and block diagrams in the accompanying drawings illustrate the possible architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each box in the flow chart or block diagram can represent a module, a program segment, or a part of a code, and the above-mentioned module, program segment, or a part of a code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flow chart, and the combination of the boxes in the block diagram or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0119] It will be appreciated by those skilled in the art that the features described in the various embodiments and / or claims of the present disclosure may be combined and / or combined in a variety of ways, even if such combinations and / or combinations are not explicitly described in the present disclosure. In particular, the features described in the various embodiments and / or claims of the present disclosure may be combined and / or combined in a variety of ways without departing from the spirit and teachings of the present disclosure. All of these combinations and / or combinations fall within the scope of the present disclosure.

[0120] The embodiments of the present disclosure are described above. However, these embodiments are only for illustrative purposes and are not intended to limit the scope of the present disclosure. Although the embodiments are described above separately, this does not mean that the measures in the various embodiments cannot be used in combination to advantage. The scope of the present disclosure is defined by the attached claims and their equivalents. Without departing from the scope of the present disclosure, those skilled in the art may make a variety of substitutions and modifications, which should all fall within the scope of the present disclosure.

Claims

1. A data monitoring method, comprising: Acquire transaction data of the data interface in a first period, process the transaction data, and generate a first value; wherein the transaction data includes at least one of a transaction amount, a number of transactions, and a transaction time; Acquire transaction data of the data interface in a second period, process the transaction data, and generate a second value; Scoring the second value by using a preset function and the first value to obtain a score corresponding to the second value; Comparing the score with a first threshold, controlling data transmission of the data interface based on the comparison result, and / or updating the first value based on the comparison result; The comparing the score with the first threshold value, and controlling the data transmission of the data interface based on the comparison result includes: if the score exceeds the first threshold value, generating a control instruction based on abnormal information, the control instruction including changing the protocol of the data interface, or limiting the data call of the data interface, so as to adjust the calling rule of the data interface; The length of the first time period is equal to the length of the second time period, and the first time period and the second time period move synchronously on the time axis; The first time period includes a first sub-time period, and the first value includes a first sub-value; The comparing the score with the first threshold and updating the first value based on the comparison result includes: if the score exceeds the first threshold, generating prediction data based on the second sub-value of the abnormal sub-period; updating the first sub-value of the first sub-period based on the prediction data; wherein the first sub-period is equal to the abnormal sub-period in length, and the first sub-period and the abnormal sub-period move synchronously on the time axis.

2. The data monitoring method according to claim 1, wherein: The second time period includes a plurality of second sub-time periods, and the second value includes a second sub-value; The acquiring the transaction data of the data interface in the second period, processing the transaction data, and generating a second value comprises: Acquire transaction data of the data interface in one of the second sub-periods, process the transaction data, and generate a second sub-value.

3. The data monitoring method according to claim 2, comprising: Scoring the second sub-value by using the preset function and the first value to obtain a sub-score corresponding to the second sub-value; The sub-score is compared with the first threshold, and the second sub-period is marked based on the comparison result.

4. The data monitoring method according to claim 3, wherein: If the sub-score exceeds the first threshold, the second sub-period is marked as an abnormal sub-period.

5. The data monitoring method according to claim 4, wherein: The total number of the second sub-periods marked as the abnormal sub-periods is counted, and if the total number exceeds a second threshold, the second period is marked as an abnormal period, and abnormal information is generated.

6. The data monitoring method according to claim 5, wherein: The comparing the score with the first threshold and controlling the data transmission of the data interface based on the comparison result includes: If the score exceeds the first threshold, a reminder instruction is generated based on the abnormal information, and the reminder instruction includes whether to add the data interface to a blacklist.

7. The data monitoring method according to claim 5, wherein: The updating of the first value based on the comparison result includes: If the score exceeds the first threshold, reviewing the second value of the abnormal period; Update the approved second value to the first value.

8. The data monitoring method according to any one of claims 1 to 7, wherein: Scoring the second value by using a preset function and the first value to obtain a score corresponding to the second value includes: Obtain the standard deviation of the first value in the first time period through the standard deviation function and the first value ;as well as Through the scoring function Get the score, where represents the first value, represents the second value.

9. A data monitoring device, comprising: A first acquisition module is configured to acquire transaction data of the data interface in a first period, process the transaction data, and generate a first value; wherein the transaction data includes at least one of a transaction amount, a number of transactions, and a transaction time; A second acquisition module is configured to acquire transaction data of the data interface in a second period, process the transaction data, and generate a second value; a scoring module, configured to score the second value by using a preset function and the first value, and obtain a score corresponding to the second value; a comparison and regulation module, configured to compare the score with a first threshold, control the data transmission of the data interface based on the comparison result, and / or update the first value based on the comparison result, wherein the length of the first time period is equal to the length of the second time period, and the first time period and the second time period move synchronously on the time axis; The comparison and regulation module includes a comparison module and a regulation module, wherein the comparison module is configured to compare the score with a first threshold and generate a comparison result; the regulation module is configured to control the data transmission of the data interface based on the comparison result, and / or update the first value based on the comparison result; if the score exceeds the first threshold, the regulation module is configured to generate a control instruction based on the abnormal information, and the control instruction includes changing the protocol of the data interface, or limiting the data call of the data interface, so as to adjust the data interface call rule; The first time period includes a first sub-time period, and the first value includes a first sub-value. If the score exceeds the first threshold, the control module is configured to generate prediction data based on the second sub-value of the abnormal sub-time period; and update the first sub-value of the first sub-time period based on the prediction data; wherein the first sub-time period is equal to the abnormal sub-time period in length, and the first sub-time period and the abnormal sub-time period move synchronously on the time axis.

10. An electronic device, comprising: one or more processors; A storage device for storing executable instructions, wherein when the executable instructions are executed by the processor, the data monitoring method according to any one of claims 1 to 8 is implemented.

11. A computer-readable storage medium having executable instructions stored thereon, which, when executed by a processor, implements the data monitoring method according to any one of claims 1 to 8.

Images