A detailed anomaly detection method, device and system based on backpack algorithm

Abstract

The embodiments of the present invention provide a method, device and system for detecting anomalies in details based on a backpack algorithm, which can be used in the field of artificial intelligence technology. The method comprises: standardizing the internal fund details of an internal account to generate standardized detailed information; based on the backpack algorithm, comparing the expenditure funds and income funds of the standardized detailed information according to the acquired blending parameters to generate anomaly detection results, thereby improving the accuracy and timeliness of fund blending, saving labor costs, thereby improving detection efficiency and ensuring the security of funds.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, in particular to the field of artificial intelligence technology, and more particularly to a detailed anomaly detection method, device and system based on a backpack algorithm. Background Art

[0002] A bank's special internal account refers to an account used to calculate internal fund transactions. The bank's internal account management requires that the funds in and out of the internal account must be reconciled and written off. By verifying the correspondence between the details of the funds in and out, the abnormalities in the fund flow process are monitored and the internal fund control is strengthened. In the related technology, bank personnel manually reconcile the funds in and out to detect abnormalities in the fund flow, but manual reconciliation is inaccurate and untimely and has high labor costs, resulting in low detection efficiency and poor fund security. Summary of the invention

[0003] One object of the present invention is to provide a method for detecting anomalies in details based on a backpack algorithm, so as to improve the accuracy and timeliness of fund blending, save labor costs, thereby improving detection efficiency and ensuring the security of funds. Another object of the present invention is to provide a system for detecting anomalies in details based on a backpack algorithm. Another object of the present invention is to provide a device for detecting anomalies in details based on a backpack algorithm. Another object of the present invention is to provide a computer-readable medium. Another object of the present invention is to provide a computer device.

[0004] In order to achieve the above objectives, the present invention discloses a detailed anomaly detection method based on a backpack algorithm, comprising:

[0005] According to the obtained standardization rules, the internal fund details of the internal accounts are standardized to generate standardized detailed information;

[0006] Based on the backpack algorithm, the expenditure funds and income funds of the standardized detailed information are compared according to the obtained blending parameters to generate anomaly detection results.

[0007] Preferably, based on the backpack algorithm, the expenditure funds and income funds of the standardized detailed information are compared according to the obtained blending parameters to generate anomaly detection results, including:

[0008] Determine the base fund flow direction according to the blending parameters;

[0009] Filter out the benchmark details that are consistent with the benchmark fund flow from the standardized details information;

[0010] Based on the backpack algorithm, the expenditure funds and income funds of the benchmark details are compared according to the standardized detailed information to generate anomaly detection results.

[0011] Preferably, the blending parameters include the fund detail blending type, and the fund detail blending type includes one in and multiple out, multiple in and one out, or one in and one out;

[0012] According to the blending parameters, the benchmark fund flow is determined, including:

[0013] If the fund details blending type is one in and multiple out or one in and one out, the base fund flow direction is determined to be income;

[0014] If the fund details blending type is multiple in and one out, determine that the base fund flow direction is expenditure.

[0015] Preferably, the benchmark details include the benchmark fund amount;

[0016] Based on the backpack algorithm, the expenditure funds and income funds of the benchmark details are compared according to the standardized detailed information to generate anomaly detection results, including:

[0017] Filter out the matching details that meet the set matching conditions from the standardized detail information, and the matching details include the matching fund amount;

[0018] According to the set backpack algorithm, the matching details are combined according to the benchmark fund amount and the matching fund amount to generate the combined details. The total amount of funds in the combined details is the total amount of occurrence.

[0019] Determine whether there is at least one total amount of occurrence that is the same as the benchmark fund occurrence amount;

[0020] If so, generate anomaly detection results with normal fund details;

[0021] If not, an anomaly detection result of abnormal fund details is generated.

[0022] Preferably, the method further comprises:

[0023] If there are multiple occurrence totals that are the same as the benchmark fund occurrence amount, the combination details of the matching details with the smallest occurrence time and the corresponding benchmark details will be marked as normal fund details.

[0024] Preferably, the standardized rules include the type and length of the occurrence date, the type and length of the occurrence time point, the type and length of the funding direction, the type and length of the funding amount, the type and length of the unique serial number, and the type and length of the currency code; the standardized detailed information includes the standardized occurrence date, the standardized occurrence time point, the standardized funding direction, the standardized funding amount, the standardized unique serial number, and the standardized currency code;

[0025] According to the obtained standardization rules, the internal fund details of the internal accounts are standardized to generate standardized detailed information, including:

[0026] According to the type and length of the occurrence date of the standardized rules, the type and length of the occurrence date of the internal fund details are standardized to generate a standardized occurrence date;

[0027] According to the type and length of the occurrence time point of the standardized rules, the type and length of the occurrence time point of the internal fund details are standardized to generate a standardized occurrence time point;

[0028] According to the type and length of the fund direction of the standardized rules, the type and length of the fund direction of the internal fund details are standardized to generate a standardized fund direction;

[0029] According to the type and length of the fund amount in the standardized rules, the type and length of the fund amount in the internal fund details are standardized to generate the standardized fund amount;

[0030] According to the type and length of the unique serial number of the standardized rules, the type and length of the unique serial number of the internal fund details are standardized to generate a standardized unique serial number;

[0031] According to the type and length of the currency code of the standardized rules, the type and length of the currency code of the internal fund details are standardized to generate a standardized currency code.

[0032] Preferably, before the internal fund details of the internal account are standardized according to the obtained standardization rules to generate standardized detailed information, the method further includes:

[0033] Get the scheduling parameters, including the blending time corresponding to the internal account;

[0034] If the blending time is the same as the current time, the internal fund details will be written into the set standardization processing thread pool for standardization processing.

[0035] The present invention also discloses a detailed anomaly detection system based on a backpack algorithm, comprising: a scheduling component, a parameter configuration component, a data source standardization processing component and a blending processing component;

[0036] The parameter configuration component is used to send the standardization rules and blending parameters to the scheduling component;

[0037] The scheduling component is used to send the standardization rules to the data source standardization processing component, and schedule the data source standardization processing component to perform standardization processing on the internal fund details of the internal account according to the standardization rules to generate standardized detail information;

[0038] The data source standardization processing component is also used to send the standardized detailed information to the blending processing component;

[0039] The scheduling component is also used to send the blending parameters to the blending processing component, and schedule the blending processing component to compare the expenditure funds and income funds of the standardized detailed information according to the acquired blending parameters based on the backpack algorithm to generate anomaly detection results.

[0040] The present invention also discloses a detailed anomaly detection device based on a backpack algorithm, comprising:

[0041] A standardization processing unit, used to perform standardization processing on the internal fund details of the internal account according to the obtained standardization rules, and generate standardized detailed information;

[0042] The anomaly detection unit is used to compare the expenditure funds and income funds of the standardized detailed information according to the obtained blending parameters based on the backpack algorithm to generate anomaly detection results.

[0043] The present invention also discloses a computer-readable medium on which a computer program is stored. When the program is executed by a processor, the method described above is implemented.

[0044] The present invention also discloses a computer device, including a memory and a processor, wherein the memory is used to store information including program instructions, the processor is used to control the execution of program instructions, and the processor implements the above method when executing the program.

[0045] The present invention standardizes the internal fund details of internal accounts according to the obtained standardization rules to generate standardized detailed information; based on the backpack algorithm, the expenditure funds and income funds of the standardized detailed information are compared according to the obtained blending parameters to generate abnormal detection results, improve the accuracy and timeliness of fund blending, save labor costs, thereby improving detection efficiency and ensuring the security of funds. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0047] Figure 1 A schematic diagram of the structure of a detailed anomaly detection system based on a backpack algorithm provided in an embodiment of the present invention;

[0048] Figure 2 A flow chart of performing parameter maintenance on a parameter configuration component provided by an embodiment of the present invention;

[0049] Figure 3A flowchart of a detailed anomaly detection method based on a backpack algorithm provided in an embodiment of the present invention;

[0050] Figure 4 A flowchart of another detailed anomaly detection method based on a backpack algorithm provided in an embodiment of the present invention;

[0051] Figure 5 A flow chart of a standardized process provided by an embodiment of the present invention;

[0052] Figure 6 A flow chart for detecting abnormality of funds in and out of a benchmark detail provided by an embodiment of the present invention;

[0053] Figure 7 A schematic diagram of the structure of a detailed anomaly detection device based on a backpack algorithm provided by an embodiment of the present invention;

[0054] Figure 8 A schematic diagram of the structure of a computer device provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0055] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0056] It should be noted that the detailed anomaly detection method, device and system based on the backpack algorithm disclosed in the present application can be used in the field of artificial intelligence technology, and can also be used in any field outside the field of artificial intelligence technology. The application field of the detailed anomaly detection method, device and system based on the backpack algorithm disclosed in the present application is not limited.

[0057] In order to facilitate the understanding of the technical solution provided by the present application, the relevant contents of the technical solution of the present application are first described below. The application scenario involved in the present invention is the scenario of blending the details of the inflow and outflow of the bank's special internal account. The details of the inflow and outflow of the bank's special internal account are used as the data source, and the details of the inflow and outflow of the special internal account are regularly blended in accordance with the bank's business management system. The bank's special internal account is the basis of commercial bank business accounting, the starting point and source of bank accounting, and the key object of bank internal management and governance. By verifying the corresponding relationship of the details of inflow and outflow, monitoring the abnormal problems in the process of fund flow, and strengthening internal fund control. However, due to the large number of source data and transaction scenarios, the details of inflow and outflow funds do not have transaction event identification, which makes it difficult to blend the details of inflow and outflow funds. The details of inflow and outflow funds are designed for fund flow, and generally use custom fields such as detailed summaries or notes to represent specific transaction events, but the funds entering the special internal account and the funds leaving the special internal account belong to two clearing tasks, and the occurrence time is different. The summary or note elements cannot match, and the corresponding relationship of the inflow and outflow funds cannot be determined through this information, so it is impossible to achieve correct blending. In addition, there are many corresponding relationships in the details of inflow and outflow of funds, such as one-to-one, one-to-many, many-to-one and many-to-many, and the time and sequence of occurrence are different. It is necessary to verify the reason for the inflow and outflow of each fund during blending. The traditional manual blending has a large business volume and the risk of blending errors, and the manpower cost is high, which leads to low detection efficiency, inadequate internal account supervision, and inability to guarantee the security of funds.

[0058] In order to solve the above technical problems, the present invention realizes automatic blending of different corresponding relationships such as one-to-one, one-to-many, many-to-one and many-to-many of inflow and outflow fund details based on the knapsack algorithm.

[0059] Figure 1 A schematic diagram of the structure of a detailed anomaly detection system based on a backpack algorithm provided by an embodiment of the present invention is shown in FIG. Figure 1 As shown, the system includes a scheduling component 100, a parameter configuration component 200, a data source standardization processing component 300, and a blending processing component 400. Among them, the parameter configuration component 200 is connected to the scheduling component 100, the scheduling funds 100 are respectively connected to the data source standardization processing component 300 and the blending processing component 400, and the data source standardization processing component 300 and the blending processing component 400 are connected.

[0060] The parameter configuration component 200 is used to send the standardization rules and blending parameters to the scheduling component 100 .

[0061] The scheduling component 100 is used to send the standardization rules to the data source standardization processing component 300, and schedule the data source standardization processing component 300 to perform standardization processing on the internal fund details of the internal account according to the standardization rules to generate standardized detail information.

[0062] The data source standardization processing component 300 is also used to send the standardized detailed information to the blending processing component 400.

[0063] The scheduling component 100 is also used to send the blending parameters to the blending processing component 400, and schedule the blending processing component 400 to compare the expenditure funds and income funds of the standardized detailed information according to the acquired blending parameters based on the backpack algorithm to generate anomaly detection results.

[0064] In the embodiment of the present invention, the scheduling component 100 is mainly used for the scheduling implementation of automatic blending of inflow and outflow details. It adopts a multi-threaded method to independently arrange threads for each internal account, and adopts an asynchronous, high-throughput processing mechanism to achieve efficient automatic blending of inflow and outflow details; the parameter configuration component 200 is mainly used to configure the account information, scheduling parameters, standardization rules and blending parameters of the internal account; the data source standardization processing component 300 performs standardization processing on different forms of internal fund details according to standardization rules, extracts key information required for blending processing from the internal fund details, shields useless information, and forms general standardized information, which is convenient for the blending processing component 400 to directly perform blending processing and improve blending efficiency; the blending processing component 400 is the core component of the system, which compares the expenditure funds and income funds of the standardized detail information according to the blending parameters to generate anomaly detection results.

[0065] Furthermore, parameter maintenance may be performed on the parameter configuration component 200 . Figure 2 A flow chart of performing parameter maintenance on a parameter configuration component is provided in an embodiment of the present invention, such as Figure 2 As shown, the parameters in the parameter configuration component 200 are displayed, including the display of configuration parameters of account information for configuring internal accounts, the display of scheduling parameters, the display of standardization rules, and the display of blending parameters; on the display interface, the staff can manually maintain the displayed parameters according to the actual needs of the business; after the parameter maintenance is completed, the maintained parameters are saved so that the new parameters after maintenance can be used in the subsequent automatic blending of the inflow and outflow details, which is more in line with the actual needs of the business and improves the detection accuracy and blending efficiency.

[0066] In the technical solution provided by the embodiment of the present invention, the internal fund details of the internal account are standardized to generate standardized detailed information; based on the backpack algorithm, the expenditure funds and income funds of the standardized detailed information are compared according to the acquired blending parameters to generate anomaly detection results, thereby improving the accuracy and timeliness of fund blending, saving labor costs, thereby improving detection efficiency and ensuring the security of funds.

[0067] It is worth mentioning that Figure 1The detailed anomaly detection system based on the backpack algorithm shown is also applicable to Figure 3 or Figure 4 The detailed anomaly detection method based on the backpack algorithm will not be described here.

[0068] The following takes the detailed anomaly detection device based on the backpack algorithm as an example of the execution subject to illustrate the implementation process of the detailed anomaly detection method based on the backpack algorithm provided by the embodiment of the present invention. It can be understood that the execution subject of the detailed anomaly detection method based on the backpack algorithm provided by the embodiment of the present invention includes but is not limited to the detailed anomaly detection device based on the backpack algorithm.

[0069] Figure 3 A flowchart of a detailed anomaly detection method based on a backpack algorithm provided by an embodiment of the present invention is shown in FIG. Figure 3 As shown, the method includes:

[0070] Step 101: Standardize the internal fund details of the internal account according to the obtained standardization rules to generate standardized detailed information.

[0071] Step 102: Based on the backpack algorithm, the expenditure funds and income funds of the standardized detailed information are compared according to the obtained blending parameters to generate anomaly detection results.

[0072] In the technical solution provided by the embodiment of the present invention, the internal fund details of the internal account are standardized to generate standardized detailed information; based on the backpack algorithm, the expenditure funds and income funds of the standardized detailed information are compared according to the acquired blending parameters to generate anomaly detection results, thereby improving the accuracy and timeliness of fund blending, saving labor costs, thereby improving detection efficiency and ensuring the security of funds.

[0073] Figure 4 A flowchart of another detailed anomaly detection method based on a backpack algorithm provided in an embodiment of the present invention is shown in FIG. Figure 4 As shown, the method includes:

[0074] Step 201: Obtain scheduling parameters, where the scheduling parameters include the blending time corresponding to the internal account.

[0075] In the embodiment of the present invention, each step is performed by a detailed anomaly detection device based on a backpack algorithm.

[0076] In an embodiment of the present invention, an internal account is an account used by a bank to calculate internal fund transactions, and its internal fund details can be obtained from a database. Scheduling parameters are set corresponding to each internal account, and the scheduling parameters include but are not limited to blending time and blending frequency. Among them, the blending time is the time point that triggers the internal account to be automatically blended, and the blending frequency is the frequency that indicates that the internal account is periodically automatically blended. It is worth noting that the blending time and blending frequency can be set according to actual needs, and the embodiment of the present invention does not limit this. As an option, the blending time is set to 22:00 on May 10, 2021, and the blending frequency is set to 1 day.

[0077] Step 202: If the blending time is the same as the current time, the internal fund details are written into the set standardization processing thread pool for standardization processing.

[0078] In the embodiment of the present invention, after obtaining the blending time, the blending time is compared with the current time. If the blending time is the same as the current time, it indicates that there is an internal account that needs to be blended, and the internal fund details of the internal account are written into the set standardized processing thread pool; if the blending time is different from the current time, it indicates that there is no internal account that needs to be blended, and the blending time and the current time are re-judged according to the set waiting time interval. Among them, the waiting time interval can be set according to the actual situation. As an optional solution, the waiting time interval is set to 1 minute.

[0079] In the embodiment of the present invention, a standardized processing thread pool is pre-set, and the thread pool is used for standardized processing of written internal fund details. For standardized processing tasks in the thread pool, the thread can automatically perform standardized processing. The internal fund details include but are not limited to the fund details blending date range, the account information of the internal account and the details of the inflow and outflow of funds, wherein the fund details blending date range can be customized according to the actual situation; the account information is the information of the internal account that needs to be automatically blended, including but not limited to the account number, the bank of opening the account and the nationality.

[0080] In the embodiment of the present invention, based on the setting of scheduling parameters and blending parameters, it supports automatic timed blending of internal fund details according to the blending date range, blending time and blending frequency of the fund details, which can meet the blending requirements of large batches and real-time.

[0081] Step 203: Standardize the internal fund details of the internal account according to the obtained standardization rules to generate standardized detailed information.

[0082] Figure 5 A flowchart of a standardized process provided by an embodiment of the present invention is as follows: Figure 5 As shown, step 203 specifically includes:

[0083] Step 2031, filter out the internal fund details within the fund detail blending date range.

[0084] In the embodiment of the present invention, the fund details blending date range can be customized according to actual conditions.

[0085] Step 2032: According to the standardization rules, the internal fund details of the internal account are standardized to generate standardized detailed information.

[0086] The standardization rules can be set according to actual conditions, and the embodiments of the present invention do not limit this. For example, the standardization rules are shown in Table 1:

[0087] Table 1

[0088] Standardized attributes type length Remark Date of occurrence date 10 YYYY-MM-DD format Time of occurrence text 8 HH24:MI:SS format Funding direction text 1 0 represents income and 1 represents expenditure Amount of funds Numeric (20,8) - Unique serial number text 64 - Currency Code text 3 -

[0089] As shown in Table 1, the standardization rules include standardization attributes and the type, length, and remarks corresponding to the standardization attributes.

[0090] Specifically, the standardization rules include the type and length of the occurrence date, the type and length of the occurrence time, the type and length of the funds direction, the type and length of the funds amount, the type and length of the unique serial number, and the type and length of the currency code; the standardized detailed information includes the standardized occurrence date, the standardized occurrence time, the standardized funds direction, the standardized funds amount, the standardized unique serial number, and the standardized currency code. According to the type and length of the occurrence date of the standardized rules, the type and length of the occurrence date of the internal funds details are standardized to generate a standardized occurrence date, and the format of the standardized occurrence date is YYYY-MM-DD format; according to the type and length of the occurrence time point of the standardized rules, the type and length of the occurrence time point of the internal funds details are standardized to generate a standardized occurrence time point, and the standardized occurrence time point The format is HH24:MI:SS format; according to the type and length of the funds direction of the standardized rules, the type and length of the funds direction of the internal funds details are standardized to generate a standardized funds direction. If the standardized funds direction is 0, it means that the funds direction is income. If the standardized funds direction is 1, it means that the funds direction is expenditure; according to the type and length of the funds amount of the standardized rules, the type and length of the funds amount of the internal funds details are standardized to generate a standardized funds amount; according to the type and length of the unique serial number of the standardized rules, the type and length of the unique serial number of the internal funds details are standardized to generate a standardized unique serial number; according to the type and length of the currency code of the standardized rules, the type and length of the currency code of the internal funds details are standardized to generate a standardized currency code.

[0091] Furthermore, if no exception occurs in the standardization processing, step 204 is continued to be executed; if an exception occurs in the standardization processing, the process ends, and a standardization exception reminder message is generated and sent to remind the staff to handle it.

[0092] In the embodiment of the present invention, by setting standardization rules, it is possible to support automatic blending of internal fund details in different formats, generate standardized detail information, and provide a basis for efficient blending of subsequent inflow and outflow fund details.

[0093] Step 204: Determine the base fund flow direction according to the blending parameters.

[0094] In the embodiment of the present invention, the blending parameters can be set according to actual conditions, and the embodiment of the present invention does not limit this. For example, the blending parameters are shown in Table 2:

[0095] Table 2

[0096]

[0097] As shown in Table 2, the blending parameters include the parameter name and the optional range and remarks corresponding to the parameter name. The blending parameters include the blending algorithm, which is a fixed 01 backpack algorithm; the blending parameters also include the fund detail blending type, which includes one-in-multiple-out, multiple-in-one-out or one-in-one-out, and the fund detail blending type can be selected according to business needs; the blending parameters also include the fund detail blending order, which is a fixed first-in-first-out order; the blending parameters also include the fund detail blending date range, and the fund detail blending order is a fixed frequency or a custom range. If it is a fixed frequency, you need to select one of the quarter, month, week, and day. If it is a custom range, you need to define a specific date range. Among them, one-in-multiple-out means that one fund income corresponds to multiple fund expenditures, one-in-one-out means that one fund income corresponds to one fund expenditure, and multiple-in-one-out means that multiple fund income corresponds to one fund expenditure.

[0098] Specifically, if the fund details blending type is one in and multiple outs or one in and one out, the benchmark fund flow direction is determined to be income; if the fund details blending type is multiple in and one out, the benchmark fund flow direction is determined to be expenditure.

[0099] Step 205: Filter out the benchmark details that are consistent with the benchmark fund flow from the standardized detailed information.

[0100] Specifically, if the benchmark fund flow direction is income, all fund details with fund direction as income are screened out from the standardized details, and the screened out fund details are determined as the benchmark details; if the benchmark fund flow direction is expenditure, all fund details with fund direction as expenditure are screened out from the standardized details, and the screened out fund details are determined as the benchmark details.

[0101] Furthermore, the benchmark details are sorted in ascending order according to the occurrence time, so as to facilitate the subsequent blending of the fund details according to the first-in-first-out principle of funds. The occurrence time includes the date of occurrence and the time of occurrence.

[0102] Step 206: Based on the knapsack algorithm, the expenditure funds and income funds of the benchmark details are compared according to the standardized detail information to generate anomaly detection results.

[0103] In the embodiment of the present invention, the benchmark details include a benchmark capital occurrence amount, and the benchmark capital occurrence amount is the capital occurrence amount in the benchmark details.

[0104] The knapsack algorithm is a computational method for the knapsack problem. The knapsack problem is a non-deterministic (NP) complete problem of combinatorial optimization with polynomial complexity, that is, given a set of items, each with its own weight and price, within the total weight of the backpacker's carrying items, the items are combined to maximize the total value of the items in the backpack. It can be expressed as follows:

[0105] f[i][v]=max{f[i-1][v],f[i-1][vc[i]]+w[i]},v>c[i]

[0106] Where v represents the total size of the backpack, c[i] represents the weight of the i-th item, w[i] represents the value of the i-th item, and f[i][v] represents the total value of the backpack after the i-th item is placed in the backpack with a total size of v.

[0107] The backpack algorithm includes the 01 backpack algorithm, the complete backpack algorithm and the multiple backpack algorithm. Among them, the 01 backpack algorithm specifies that there is only one of each item; the complete backpack algorithm specifies that the number of each item can be infinite; the multiple backpack algorithm specifies that the number of each item is a fixed value. In the embodiment of the present invention, the 01 backpack algorithm is used to detect abnormal fund details.

[0108] Figure 6 A flowchart of an abnormal detection of funds in and out of a benchmark detail is provided in an embodiment of the present invention, such as Figure 6 As shown, step 206 specifically includes:

[0109] Step 2061: Filter out matching details that meet the set matching conditions from the standardized detail information, where the matching details include the matching fund amount.

[0110] In the embodiment of the present invention, the matching condition can be set according to the actual situation, and the embodiment of the present invention does not limit this. As an optional solution, the matching condition is set to the following four:

[0111] A. The direction of funds is opposite to the base fund flow direction. Specifically, if the base detail direction is income, the matching detail direction is expenditure; if the base detail direction is expenditure, the matching detail direction is income.

[0112] B. The amount of funds generated is less than or equal to the benchmark amount of funds generated.

[0113] C. Not successfully redeemed, that is, all the fund details in the standardized detailed information that are not marked as normal fund details.

[0114] D. The occurrence time is less than the occurrence time of the benchmark details, where the occurrence time includes the date and time of occurrence.

[0115] The matching details need to meet the above four matching conditions A, B, C and D at the same time, and the matching funds amount is the funds amount of the matching details.

[0116] Step 2062: According to the set backpack algorithm, the matching details are combined according to the benchmark fund amount and the matching fund amount to generate a combined detail, and the total amount of funds in the combined details is the total amount.

[0117] The base fund amount is set as the backpack weight, the value of each item is 1, and the matching fund amount of each matching detail is the item weight. The 01 backpack algorithm is used to combine the matching details according to the base fund amount and the matching fund amount to generate a combination detail. For example: the base fund amount is 100 yuan, and the matching details include matching detail a with a matching fund amount of 50 yuan, matching detail b with a matching fund amount of 10 yuan, and matching detail c with a matching fund amount of 40 yuan. The generated combination details include: matching detail a, with a total amount of 50 yuan; matching detail a and matching detail b, with a total amount of 60 yuan; matching detail a, matching detail b, and matching detail c, with a total amount of 100 yuan; matching detail a and matching detail c, with a total amount of 90 yuan; matching detail b and matching detail c, with a total amount of 50 yuan; matching detail b, with a total amount of 10 yuan; matching detail c, with a total amount of 40 yuan.

[0118] Step 2063, determine whether there is at least one total amount that is the same as the benchmark fund amount. If so, execute step 2064; if not, execute step 2065.

[0119] In an embodiment of the present invention, if it is determined that there is at least one total amount of occurrence that is the same as the benchmark fund occurrence amount, it indicates that the benchmark details and the matching details are successfully matched, and step 2064 is continued to be executed; if it is determined that all total amounts of occurrence are different from the benchmark fund occurrence amount, it indicates that the benchmark details and the matching details have failed to match, and step 2065 is executed.

[0120] For example: the benchmark fund amount is 100 yuan, and the total amounts include: 10 yuan, 40 yuan, 50 yuan, 60 yuan, 90 yuan, 100 yuan and 100 yuan. There are two total amounts of 100 yuan, which are the same as the benchmark fund amount. The benchmark details and the matching details are matched successfully, and step 2064 is continued.

[0121] Step 2064: Generate an abnormal detection result with normal fund details.

[0122] In the embodiment of the present invention, if the base details and the matching details are matched successfully, it indicates that the base details and the matching details are successfully blended, and an abnormal detection result of normal fund details is generated.

[0123] In an embodiment of the present invention, if there is a total amount of occurrence that is the same as the benchmark fund occurrence amount, both the matching details and the benchmark details will be marked as normal fund details; if there are multiple total amounts of occurrence that are the same as the benchmark fund occurrence amount, the combined details of the matching details with the smallest occurrence time and the corresponding benchmark details will be marked as normal fund details to meet the requirement that the fund detail blending order parameter in the blending parameter is set to first-in-first-out.

[0124] Step 2065: Generate anomaly detection results of abnormal fund details.

[0125] In the embodiment of the present invention, if the base details fail to match the matching details, it indicates that the base details fail to match the matching details, and an abnormality detection result of abnormal fund details is generated. Further, the corresponding base details are marked as abnormal fund details.

[0126] If there are still unblended benchmark details, repeat steps 2061 to 2065 until the benchmark details are blended, that is, each benchmark detail is marked with normal funds details or abnormal funds details, and the abnormality detection result is output, and the abnormality detection result includes normal funds details or abnormal funds details.

[0127] In the embodiment of the present invention, aiming at the characteristics of first-in-first-out and special accounts in general fund business, the 01 backpack algorithm is used to realize the automatic and efficient blending of inflow and outflow fund details. The method for detecting abnormal details based on the backpack algorithm provided by the present invention can realize the filtering and standardization of internal fund details in different formats, shield the useless information in the internal fund details, and can be applied to the processing of other fund details except for the internal bank accounts. In addition, through the 01 backpack algorithm, combined with the standardized detail information, according to the characteristics of first-in-first-out of funds, without relying on other information outside the fund details, the matching relationship of inflow and outflow fund details can be quickly realized, solving the pain points of inaccurate blending caused by large manual blending volume and complex matching of inflow and outflow funds, thereby realizing automatic blending.

[0128] In the technical solution of the detailed anomaly detection method based on the backpack algorithm provided in the embodiment of the present invention, the internal fund details of the internal account are standardized to generate standardized detailed information; based on the backpack algorithm, the expenditure funds and income funds of the standardized detailed information are compared according to the acquired blending parameters to generate anomaly detection results, thereby improving the accuracy and timeliness of fund blending, saving labor costs, thereby improving detection efficiency and ensuring the security of funds.

[0129] Figure 7 A schematic diagram of the structure of a detailed anomaly detection device based on a backpack algorithm provided by an embodiment of the present invention, the device is used to execute the detailed anomaly detection method based on the backpack algorithm, such as Figure 7 As shown, the device includes: a standardization processing unit 11 and an abnormality detection unit 12.

[0130] The standardization processing unit 11 is used to perform standardization processing on the internal fund details of the internal account according to the obtained standardization rules to generate standardized detailed information.

[0131] The anomaly detection unit 12 is used to compare the expenditure funds and income funds of the standardized detailed information according to the acquired blending parameters based on the backpack algorithm to generate an anomaly detection result.

[0132] In the embodiment of the present invention, the abnormality detection unit 12 includes a determination subunit 121 , a screening subunit 122 and a comparison subunit 123 .

[0133] The determination subunit 121 is used to determine the base fund flow direction according to the blending parameters.

[0134] The screening subunit 122 is used to screen out the benchmark details that are consistent with the benchmark fund flow from the standardized detail information.

[0135] The comparison subunit 123 is used to compare the expenditure funds and income funds of the benchmark details according to the standardized detail information based on the backpack algorithm to generate an abnormality detection result.

[0136] In the embodiment of the present invention, the determination subunit 121 is specifically used to determine that the base fund flow direction is income if the fund detail blending type is one in and multiple out or one in and one out; if the fund detail blending type is multiple in and one out, determine that the base fund flow direction is expenditure.

[0137] In an embodiment of the present invention, the comparison subunit 123 is specifically used to filter out matching details that meet the set matching conditions from the standardized detail information, the matching details including the matching fund amount; according to the set backpack algorithm, the matching details are combined according to the benchmark fund amount and the matching fund amount to generate a combined detail, and the total amount of funds in the combined details is the total amount; determine whether there is at least one total amount that is the same as the benchmark fund amount; if so, generate an abnormality detection result that the fund details are normal; if not, generate an abnormality detection result that the fund details are abnormal.

[0138] In the embodiment of the present invention, the abnormality detection unit 12 further includes a marking subunit 124 .

[0139] The marking subunit 124 is used to mark the combined details of the matching details with the smallest occurrence time and the corresponding benchmark details as normal fund details if there are multiple occurrence totals that are the same as the benchmark fund occurrence amount.

[0140] In an embodiment of the present invention, the standardization processing unit 11 is specifically used to standardize the type and length of the occurrence date of the internal fund details according to the type and length of the occurrence date of the standardization rules, and generate a standardized occurrence date; standardize the type and length of the occurrence time point of the internal fund details according to the type and length of the occurrence time point of the standardization rules, and generate a standardized occurrence time point; standardize the type and length of the fund direction of the internal fund details according to the type and length of the fund direction of the standardization rules, and generate a standardized fund direction; standardize the type and length of the fund amount of the internal fund details according to the type and length of the fund amount of the standardization rules, and generate a standardized fund amount; standardize the type and length of the unique serial number of the internal fund details according to the type and length of the unique serial number of the standardization rules, and generate a standardized unique serial number; standardize the type and length of the currency code of the internal fund details according to the type and length of the currency code of the standardization rules, and generate a standardized currency code.

[0141] In the embodiment of the present invention, the device further includes: an acquisition unit 13 and an input unit 14 .

[0142] The acquisition unit 13 is used to acquire the scheduling parameters, and the scheduling parameters include the blending time corresponding to the internal account.

[0143] The input unit 14 is used to write the internal fund details into the set standardization processing thread pool for standardization processing if the blending time is the same as the current time.

[0144] In the scheme of the embodiment of the present invention, the internal fund details of the internal account are standardized to generate standardized detailed information; based on the backpack algorithm, the expenditure funds and income funds of the standardized detailed information are compared according to the obtained blending parameters to generate anomaly detection results, thereby improving the accuracy and timeliness of fund blending, saving labor costs, thereby improving detection efficiency and ensuring the security of funds.

[0145] The systems, devices, modules or units described in the above embodiments may be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer device, and specifically, the computer device may be, for example, a personal computer, a laptop computer, a cellular phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or a combination of any of these devices.

[0146] An embodiment of the present invention provides a computer device, including a memory and a processor, the memory is used to store information including program instructions, the processor is used to control the execution of the program instructions, and when the program instructions are loaded and executed by the processor, the steps of the embodiment of the detailed anomaly detection method based on the backpack algorithm are implemented. For a specific description, please refer to the embodiment of the detailed anomaly detection method based on the backpack algorithm.

[0147] Reference below Figure 8 , which shows a schematic diagram of the structure of a computer device 600 suitable for implementing an embodiment of the present application.

[0148] like Figure 8 As shown, the computer device 600 includes a central processing unit (CPU) 601, which can perform various appropriate operations and processes according to a program stored in a read-only memory (ROM) 602 or a program loaded from a storage part 608 to a random access memory (RAM) 603. In the RAM 603, various programs and data required for the operation of the computer device 600 are also stored. The CPU 601, the ROM 602, and the RAM 603 are connected to each other via a bus 604. An input / output (I / O) interface 605 is also connected to the bus 604.

[0149] The following components are connected to the I / O interface 605: an input section 606 including a keyboard, a mouse, etc.; an output section 607 including a cathode ray tube (CRT), a liquid crystal feedback device (LCD), etc., and a speaker, etc.; a storage section 608 including a hard disk, etc.; and a communication section 609 including a network interface card such as a LAN card, a modem, etc. The communication section 609 performs communication processing via a network such as the Internet. A drive 610 is also connected to the I / O interface 606 as needed. A removable medium 611, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 610 as needed, so that a computer program read therefrom is installed as needed as the storage section 608.

[0150] In particular, according to an embodiment of the present invention, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present invention includes a computer program product, which includes a computer program tangibly contained on a machine-readable medium, and the computer program includes program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network through the communication part 609, and / or installed from the removable medium 611.

[0151] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0152] For the convenience of description, the above device is described in various units according to their functions. Of course, when implementing the present application, the functions of each unit can be implemented in the same or multiple software and / or hardware.

[0153] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0154] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0155] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process in the computer or other programmable device. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0156] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0157] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0158] The present application may be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform specific tasks or implement specific abstract data types. The present application may also be practiced in distributed computing environments where tasks are performed by remote processing devices connected through a communication network. In a distributed computing environment, program modules may be located in local and remote computer storage media, including storage devices.

[0159] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0160] The above is only an embodiment of the present application and is not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application should be included in the scope of the claims of the present application.

Claims

1. A detailed anomaly detection method based on a backpack algorithm, characterized in that: The method comprises: According to the obtained standardization rules, the internal fund details of the internal accounts are standardized to generate standardized detailed information; Based on the backpack algorithm, the expenditure funds and income funds of the standardized detailed information are compared according to the obtained blending parameters to generate anomaly detection results; Based on the backpack algorithm, the expenditure funds and income funds of the standardized detailed information are compared according to the obtained blending parameters to generate anomaly detection results, including: According to the blending parameters, determine the base fund flow direction; Filter out the benchmark details that are consistent with the benchmark fund flow from the standardized detailed information; Based on the knapsack algorithm, the expenditure funds and income funds of the benchmark details are compared according to the standardized detail information to generate an anomaly detection result, wherein the benchmark details include the benchmark fund occurrence amount; The blending parameters include the fund detail blending type, and the fund detail blending type includes one in and multiple out, multiple in and one out, or one in and one out; Determining the base funds flow direction according to the blending parameters includes: If the fund details blending type is one in and multiple out or one in and one out, the base fund flow direction is determined to be income; If the fund details blending type is multiple in and one out, determine that the base fund flow direction is expenditure.

2. The detailed anomaly detection method based on the backpack algorithm according to claim 1 is characterized in that: Based on the backpack algorithm, the expenditure funds and income funds of the benchmark details are compared according to the standardized detail information to generate anomaly detection results, including: Filtering out matching details that meet the set matching conditions from the standardized detail information, wherein the matching details include the matching fund amount; According to the set backpack algorithm, the matching details are combined according to the benchmark fund amount and the matching fund amount to generate a combination detail, and the total amount of funds in the combination detail is the total amount of occurrence; Determine whether there is at least one total amount of occurrence that is the same as the benchmark fund occurrence amount; If so, generate anomaly detection results with normal fund details; If not, an anomaly detection result of abnormal fund details is generated.

3. The detailed anomaly detection method based on the backpack algorithm according to claim 2 is characterized in that: The method further comprises: If there are multiple occurrence totals that are the same as the benchmark fund occurrence amount, the combination details of the matching details with the smallest occurrence time and the corresponding benchmark details will be marked as normal fund details.

4. The detailed anomaly detection method based on the backpack algorithm according to claim 1 is characterized in that: The standardized rules include the type and length of the occurrence date, the type and length of the occurrence time, the type and length of the funding direction, the type and length of the funding amount, the type and length of the unique serial number, and the type and length of the currency code; the standardized detailed information includes the standardized occurrence date, the standardized occurrence time, the standardized funding direction, the standardized funding amount, the standardized unique serial number, and the standardized currency code; The internal fund details of the internal account are standardized according to the obtained standardization rules to generate standardized detailed information, including: According to the type and length of the occurrence date of the standardization rule, the type and length of the occurrence date of the internal fund details are standardized to generate a standardized occurrence date; According to the type and length of the occurrence time point of the standardization rule, the type and length of the occurrence time point of the internal fund details are standardized to generate a standardized occurrence time point; According to the type and length of the fund direction of the standardization rule, the type and length of the fund direction of the internal fund details are standardized to generate a standardized fund direction; According to the type and length of the fund amount in the standardization rule, the type and length of the fund amount in the internal fund details are standardized to generate a standardized fund amount; According to the type and length of the unique serial number of the standardization rule, the type and length of the unique serial number of the internal fund details are standardized to generate a standardized unique serial number; According to the type and length of the currency code of the standardization rule, the type and length of the currency code of the internal fund details are standardized to generate a standardized currency code.

5. The detailed anomaly detection method based on the backpack algorithm according to claim 1 is characterized in that: Before the internal fund details of the internal account are standardized according to the obtained standardization rules to generate standardized detailed information, the method further includes: Obtaining scheduling parameters, wherein the scheduling parameters include the blending time corresponding to the internal account; If the blending time is the same as the current time, the internal fund details are written into the set standardization processing thread pool for standardization processing.

6. A detailed anomaly detection system based on a backpack algorithm, characterized in that: The system includes a scheduling component, a parameter configuration component, a data source standardization processing component and a blending processing component; The parameter configuration component is used to send the standardization rules and blending parameters to the scheduling component; The scheduling component is used to send the standardization rules to the data source standardization processing component, and schedule the data source standardization processing component to perform standardization processing on the internal fund details of the internal account according to the standardization rules to generate standardized detail information; The data source standardization processing component is also used to send the standardized detailed information to the blending processing component; The scheduling component is also used to send the blending parameters to the blending processing component, and schedule the blending processing component to compare the expenditure funds and income funds of the standardized detailed information according to the acquired blending parameters based on the backpack algorithm to generate an anomaly detection result; The blending processing component is specifically used to determine the benchmark fund flow direction according to the blending parameters; filter out the benchmark details consistent with the benchmark fund flow direction from the standardized detail information; compare the expenditure funds and income funds of the benchmark details according to the standardized detail information based on the backpack algorithm to generate an abnormality detection result, wherein the benchmark details include the benchmark fund amount; The blending parameters include the fund detail blending type, and the fund detail blending type includes one in and multiple out, multiple in and one out, or one in and one out; The blending processing component is specifically used to determine the baseline fund flow direction as income if the fund detail blending type is one in and multiple out or one in and one out; if the fund detail blending type is multiple in and one out, determine the baseline fund flow direction as expenditure.

7. A detailed anomaly detection device based on a backpack algorithm, characterized in that: The device comprises: A standardization processing unit, used to perform standardization processing on the internal fund details of the internal account according to the obtained standardization rules, and generate standardized detailed information; An anomaly detection unit, used to compare the expenditure funds and income funds of the standardized detailed information according to the obtained blending parameters based on a backpack algorithm, and generate an anomaly detection result; The anomaly detection unit includes a determination subunit, a screening subunit and a comparison subunit; The determination subunit is used to determine the base fund flow direction according to the blending parameters; The screening subunit is used to screen out the benchmark details that are consistent with the benchmark fund flow from the standardized detail information; The comparison subunit is used to compare the expenditure funds and income funds of the benchmark details according to the standardized detail information based on the backpack algorithm to generate an abnormality detection result, wherein the benchmark details include the benchmark fund occurrence amount; The blending parameters include the fund detail blending type, and the fund detail blending type includes one in and multiple out, multiple in and one out, or one in and one out; The determination subunit is specifically used to determine the base fund flow direction as income if the fund detail blending type is one in and multiple out or one in and one out; if the fund detail blending type is multiple in and one out, determine the base fund flow direction as expenditure.

8. A computer readable medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the detailed anomaly detection method based on the backpack algorithm as described in any one of claims 1 to 5 is implemented.

9. A computer device comprising a memory and a processor, wherein the memory is used to store information including program instructions, and the processor is used to control the execution of the program instructions, characterized in that: When the program instructions are loaded and executed by the processor, the detailed anomaly detection method based on the backpack algorithm described in any one of claims 1 to 5 is implemented.

Images