Anomaly detection method and related device

Abstract

Provided are an anomaly detection method and related devices, relating to the financial field. The method comprises: performing dimensionality reduction processing on data from a first time period to obtain reduced-dimensionality data; the data from the first time period is related to the transaction volume within the first time period, the data from the first time period including the true values of N indicators in the first time period, and the reduced-dimensionality data including the true values of M indicators in the first time period, where M < N, N ≥ 3, and N and M are positive integers; analyzing the reduced-dimensionality data using wavelet analysis to determine high-frequency data; determining a predicted value for each of the M indicators in a second time period based on the high-frequency data, where the second time period is subsequent to the first time period; and determining that the data in the second time period is abnormal when the difference between the true value and the predicted value of at least one indicator in the second time period is greater than or equal to a preset threshold. The data in the second time period includes the true values of the M indicators. The method can automatically detect whether transactions are abnormal, thereby improving the accuracy of anomaly detection.

Description

Technical Field

[0001] The present application relates to the financial field, and in particular to an anomaly detection method and related devices. Background Art

[0002] With the rapid development of the internet, financial transactions can be categorized into various types, such as aggregated transactions, reimbursement transactions, contract transactions, and non-cash transactions. Currently, determining whether a transaction is abnormal depends primarily on operations personnel relying on their personal experience. This approach can sometimes be influenced by various factors, leading to inaccurate detection.

[0003] Therefore, it is hoped to provide a method that can improve the accuracy of anomaly detection. Summary of the Invention

[0004] The present application provides an anomaly detection method and related devices to improve the accuracy of anomaly detection.

[0005] In a first aspect, the present application provides an anomaly detection method, which includes: performing dimensionality reduction processing on data of a first time period to obtain reduced-dimensionality data; wherein the data of the first time period is related to the trading volume in the first time period, the data of the first time period includes the true values of N indicators in the first time period, and the reduced-dimensionality data includes the true values of M indicators of the N indicators in the first time period, M<N, N≥3, N and M are positive integers; using wavelet analysis to analyze the reduced-dimensionality data to determine high-frequency data; based on the high-frequency data, determining the predicted value of each indicator of the M indicators in the second time period, the second time period is after the first time period; when the difference between the true value and the predicted value of at least one indicator in the second time period is greater than or equal to a preset threshold, determining that the data of the second time period is abnormal, and the data of the second time period includes the true values of the M indicators.

[0006] Based on the above scheme, the data related to the trading volume of the first period is used to predict the trading volume data of the second period. When the difference between the actual value and the predicted value of the second period is significant, the data of the second period is determined to be an anomaly. This allows for automated transaction anomaly detection, reduces labor costs, and prevents the impact of external factors on operations and maintenance personnel, thereby improving detection accuracy. Furthermore, by performing dimensionality reduction on the data of the first period, superior feature data is extracted, and high-frequency data is then extracted. The predicted value for the second period is determined based on this high-frequency data. This high-frequency data extracted after dimensionality reduction eliminates the influence of random jitter factors such as sudden changes and sudden changes in the data of some complex indicators, effectively reflecting data trends and becoming superior feature data. Making predictions based on superior feature data not only improves prediction accuracy but also reduces the amount of data processing required during the prediction process.

[0007] Optionally, performing dimensionality reduction processing on the data of the first time period to obtain the reduced-dimensional data includes: performing dimensionality reduction processing on the data of the first time period using a principal component analysis (PCA) method and a random forest algorithm to obtain the reduced-dimensional data.

[0008] Optionally, determining a predicted value of each of the M indicators in the second time period based on the high-frequency data includes: using a long-short term memory (LSTM) neural network to determine a predicted trading volume of each of the M indicators in the second time period based on the high-frequency data.

[0009] Optionally, the preset threshold includes a statistical value corresponding to each of the M indicators, and the statistical value corresponding to each indicator is determined by the actual value and the predicted value of each indicator in the second time period.

[0010] Optionally, the statistical value is an integer multiple of the standard deviation σ; wherein, N represents the number of statistical cycles included in the second time period, x i represents the real-time trading volume of the i-th statistical period in N statistical periods, y i Represents the predicted trading volume of the i-th statistical period.

[0011] Optionally, the statistical period is related to an indicator, and each indicator corresponds to a type of statistical period.

[0012] Optionally, the N indicators include one or more of the following: week-on-week trading volume, week-on-week trading volume, day-on-day trading volume, day-on-day trading volume, peak trading volume within 1 minute, average trading volume within 1 minute, peak trading volume within 1 second, average trading volume within 1 second.

[0013] Optionally, the transaction volume is: the transaction volume of aggregated transactions, the transaction volume of collection transactions, the transaction volume of contracted transactions, or the transaction volume of non-cash transactions.

[0014] In a second aspect, the present application provides an anomaly detection device, which includes: a dimensionality reduction module, an analysis module, a prediction module and a determination module, wherein the dimensionality reduction module is used to perform dimensionality reduction processing on data of a first time period to obtain data after dimensionality reduction; wherein the data of the first time period is related to the trading volume in the first time period, the data of the first time period includes the true values of N indicators in the first time period, and the data after dimensionality reduction includes the true values of M indicators of the N indicators in the first time period, M<N, N≥3, N and M are positive integers; the analysis module is used to analyze the data after dimensionality reduction using wavelet analysis to determine high-frequency data; the prediction module is used to determine the predicted value of each indicator of the M indicators in a second time period based on the high-frequency data, and the second time period is after the first time period; the determination module is used to determine that the data of the second time period is abnormal when the difference between the true value and the predicted value of at least one indicator in the second time period is greater than or equal to a preset threshold, and the data of the second time period includes the true values of the M indicators.

[0015] In a third aspect, the present application provides an anomaly detection device, which includes a processor coupled to a memory and configured to execute a computer program (also referred to as code or instructions) in the memory to implement the method in the first aspect and any possible implementation of the first aspect.

[0016] Optionally, the anomaly detection device may also include a memory for storing a computer program (also referred to as code or instruction), and the processor reads the computer program so that the anomaly detection device can implement the method described in the above-mentioned first aspect and any possible implementation of the first aspect.

[0017] Optionally, the abnormality detection device may further include a communication interface, which is used for the abnormality detection device to communicate with other devices. Exemplarily, the communication interface may be a transceiver, circuit, bus, module or other type of communication interface.

[0018] In a fourth aspect, the present application provides a chip system comprising at least one processor for supporting the implementation of the functions involved in the above-mentioned first aspect and any possible implementation of the first aspect, for example, processing the data involved in the above-mentioned method.

[0019] In one possible design, the chip system further includes a memory, which is used to store program instructions and data, and the memory is located inside or outside the processor.

[0020] The chip system may be composed of chips, or may include chips and other discrete devices.

[0021] In a fifth aspect, the present application provides a computer-readable storage medium, which stores a computer program (also referred to as code or instructions). When the computer program is executed by a computer, the computer implements the method in the first aspect and any possible implementation of the first aspect.

[0022] In a sixth aspect, the present application provides a computer program product, comprising: a computer program (also referred to as code or instructions), which, when run, enables the method in the above-mentioned first aspect and any possible implementation of the first aspect to be executed.

[0023] It should be understood that the second to sixth aspects of the present application correspond to the technical solutions of the first aspect of the present application, and the beneficial effects achieved by each aspect and the corresponding feasible implementation methods are similar and will not be repeated here.

[0024] It should also be understood that the anomaly detection method and related devices provided in this application can be applied to the financial field as well as other fields, and this application does not limit this. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0026] Figure 1 A schematic diagram of an application scenario of the anomaly detection method provided in an embodiment of the present application;

[0027] Figure 2 A schematic flow chart of an anomaly detection method provided in an embodiment of the present application;

[0028] Figure 3 A schematic block diagram of an anomaly detection device provided in an embodiment of the present application;

[0029] Figure 4 A schematic block diagram of another anomaly detection device provided in an embodiment of the present application.

[0030] The above drawings illustrate specific embodiments of the present application, which will be described in more detail below. These drawings and the textual description are not intended to limit the scope of the present application in any way, but rather to illustrate the concepts of the present application to those skilled in the art by reference to specific embodiments. DETAILED DESCRIPTION

[0031] Exemplary embodiments will be described in detail herein, with examples illustrated in the accompanying drawings. In the following description, when referring to the drawings, identical numerals in different figures represent identical or similar elements, unless otherwise indicated. The embodiments described in the following exemplary embodiments are not intended to represent all embodiments consistent with the present application. Rather, they are merely examples of apparatus and methods consistent with certain aspects of the present application, as detailed in the appended claims.

[0032] First, let’s explain the terms involved in this application:

[0033] 1. Principal Component Analysis (PCA): This statistical method uses an orthogonal transformation to transform a set of potentially correlated variables into a set of linearly uncorrelated variables. This set of variables is called principal components. The core idea of this algorithm is dimensionality reduction. Through this algorithm, a small number of independent principal components can be extracted from multiple correlated variables. These independent principal components contain most of the information of the original signal.

[0034] 2. Random Forest Algorithm: This is a classifier that uses multiple trees to train and predict samples. Random forests are composed of decision trees, which are a method of partitioning space using hyperplanes. Each partition divides the current space into two.

[0035] 3. Wavelet analysis: It is a localized analysis method of time (space) frequency. It gradually refines the signal (function) at multiple scales through scaling and translation operations, ultimately achieving time subdivision at high frequencies and frequency subdivision at low frequencies. It can automatically adapt to the requirements of time-frequency signal analysis, thereby focusing on any details of the signal.

[0036] 4. Long Short-Term Memory (LSTM) Neural Network: A time-recurrent neural network that can predict future data based on past arrays. It is suitable for time series with obvious cycles in autocorrelation.

[0037] With the rapid development of the internet, financial transactions can be categorized into various payment types, such as mobile payments, third-party payments, and payments from other institutions. Each payment type can include aggregated transactions, reimbursement transactions, contract transactions, and non-cash transactions. Currently, determining whether transactions of various types are abnormal relies primarily on manual judgment by operations personnel based on their personal experience. This approach can sometimes be influenced by various factors, leading to inaccurate detection.

[0038] Therefore, this application provides an anomaly detection method and related apparatus. Based on data related to transaction volume in a first period, this method predicts transaction volume data for a second period. When the difference between the actual value and the predicted value for the second period is significant, the data for the second period is determined to be an anomaly. This allows for automated transaction anomaly detection, reduces labor costs, prevents the impact of external factors on operations and maintenance personnel, and improves detection accuracy.

[0039] It should be noted that the anomaly detection method and related devices provided in the embodiments of the present application can be applied to the financial field, and can also be applied to any field other than the financial field, and the present application does not limit this.

[0040] Figure 1 Schematic diagram of an application scenario applicable to the anomaly detection method provided in the embodiment of the present application.

[0041] The application scenarios of the anomaly detection method provided in the embodiments of the present application may include an anomaly detection device, such as Figure 1 As shown in FIG, a user and a computer 110 are shown. The computer 110 can be an example of an anomaly detection device. The computer 110 can respond to user operations to implement automated transaction anomaly detection.

[0042] It should be understood that in actual application scenarios, the anomaly detection device includes but is not limited to a computer. For example, a server can also be an example of an anomaly detection device. As long as the equipment or device can implement the anomaly detection method provided in the embodiment of the present application by running a program, it can be an example of an anomaly detection device. This application does not limit this.

[0043] Figure 2 This is a schematic flow chart of an anomaly detection method provided in an embodiment of the present application. The method can be performed by an anomaly detection device, which can be, for example, Figure 1 The computer 110 shown may also be a component configured inside the computer 110, such as a chip, a chip system, etc., or a logic module or software having some or all of the functions of the abnormality detection device, etc. This application does not limit this.

[0044] like Figure 2 As shown, the abnormality detection method 200 includes steps 210 to 240. The method 200 can be executed by an abnormality detection device, and steps 210 to 240 are described in detail below.

[0045] In step 210, dimensionality reduction processing is performed on the data of the first period to obtain dimensionality-reduced data.

[0046] The data for the first period is related to the trading volume during the first period. The data for the first period may include the true values of N indicators during the first period, and the dimensionality-reduced data includes the true values of M indicators in the first period out of the N indicators, where M<N, N≥3, and N and M are positive integers.

[0047] The first period may be a period in the past, so the true value of the period can be obtained. In the embodiment of the present application, the data of the first period may include the true values of N indicators in the first period, which can be understood as obtaining the true values of M indicators in the first period by performing dimensionality reduction processing on them.

[0048] Here, the N indicators may be indicators corresponding to preset statistical periods, and each indicator corresponds to a type of statistical period.

[0049] By way of example and not limitation, the N indicators may include one or more of the following: week-over-week trading volume, week-over-week trading volume, day-over-day trading volume, day-over-day trading volume, peak trading volume within a minute, average trading volume within a minute, peak trading volume within a second, and average trading volume within a second. Accordingly, the statistical period for week-over-week trading volume and week-over-week trading volume is one week; the statistical period for day-over-day trading volume and day-over-day trading volume is one day; the statistical period for peak trading volume within a minute and average trading volume within a minute is one minute; and the statistical period for peak trading volume within a second and average trading volume within a second is one second.

[0050] For example, if the statistical period is one week, the indicators may include week-over-week and / or week-over-week comparisons of trading volume, such as the week-over-week comparison of last week's total trading volume compared to the week before, or the week-over-week comparison of the total trading volume of the first week of April 2022 compared to the week before, respectively. If the statistical period is one day, the indicators may include day-over-day and / or day-over-day comparisons, such as the day-over-day comparison of yesterday's total trading volume compared to the day before, the day-over-day comparison of the total trading volume on April 1, 2022 compared to the day before, respectively, or the day-over-day comparison of the total trading volume on the first day of last week compared to the day before. Other indicators may include the peak trading volume within each hour, the average trading volume within each hour, the peak trading volume within each minute, the average trading volume within each minute, the peak trading volume within each second, or the average trading volume within each second, etc., within the first period. The data included in the indicator can be determined based on the statistical period, and this application does not impose any restrictions on this.

[0051] It can be understood that since the M indicators are part of the N indicators, the M indicators also correspond to the preset statistical period.

[0052] Optionally, the transaction volume may be: the transaction volume of aggregated transactions, the transaction volume of collection transactions, the transaction volume of contracted transactions, or the transaction volume of non-cash transactions.

[0053] For example, the anomaly detection device may first obtain data for a first time period. For example, data related to the transaction volume of aggregated transactions, payment collection transactions, contract transactions, or non-cash transactions during the first time period may be obtained. In other words, the data related to the transaction volume of a transaction type for which anomalies are to be detected may be obtained first.

[0054] Taking a statistical period of 1 day as an example, the data of the first time period may include the day-on-day year-on-year comparison of trading volume (for example, the day-on-day year-on-year comparison of trading volume between every two days in the previous week), the peak trading volume within 1 hour in the first time period (which can be understood as the peak trading volume within every 1 hour in the first time period), the average trading volume within 1 hour (which can be understood as the average trading volume within every 1 hour in the first time period), the peak trading volume within 1 minute (which can be understood as the peak trading volume within every 1 minute in the first time period), the average trading volume within 1 minute (which can be understood as the average trading volume within every 1 minute in the first time period), the peak trading volume within 1 second (which can be understood as the peak trading volume within every 1 second in the first time period) or the average trading volume within 1 second (which can be understood as the average trading volume within every 1 second in the first time period), etc. The anomaly detection device can perform dimensionality reduction processing on the above data to obtain the reduced-dimensional data.

[0055] In a possible implementation, the anomaly detection device may use the PCA method and the random forest algorithm to reduce the dimension of the data in the first period to obtain the reduced-dimensional data.

[0056] Exemplarily, the anomaly detection device may first use the PCA method to perform dimensionality reduction processing on the data of the first period to obtain data after the first dimensionality reduction processing, and then use the random forest algorithm to perform dimensionality reduction processing on the data after the first dimensionality reduction processing again to obtain data after dimensionality reduction.

[0057] For example, the anomaly detection device can first use the PCA method to perform the first dimensionality reduction processing on the data of the first time period, which may include the day-on-day year-on-year trading volume (for example, the day-on-day year-on-year trading volume between every two days in the previous week), the peak trading volume within every hour in the first time period, the average trading volume within every hour, the peak trading volume within every minute, the average trading volume within every minute, the peak trading volume within every second, or the average trading volume within every second.

[0058] The anomaly detection device performs standardization processing on the above data based on the PCA method, then calculates the correlation coefficient matrix, eigenvalues and eigenvectors of the standardized data, and finally selects P principal components. After principal component analysis, the data after the first dimensionality reduction processing is obtained. For example, the data after the first dimensionality reduction may include the data of the first period, and may include the day-on-day year-on-year trading volume (for example, the day-on-day year-on-year trading volume between every two days in the previous week), the peak trading volume within each hour in the first period, the average trading volume within each hour, the average trading volume within each minute, the peak trading volume within each minute, or the average trading volume within each second.

[0059] The PCA method can remove the correlation between data and project the data in high-dimensional space into low-dimensional space to form the principal component feature components, thereby achieving the effect of dimensionality reduction.

[0060] The anomaly detection device can perform a second dimensionality reduction process on the data obtained after the first dimensionality reduction process by the PCA method based on the random forest algorithm.

[0061] It should be noted that the random forest algorithm requires a pre-trained decision tree model. This model can be trained and evaluated using historical data to obtain a superior decision tree model. The trained decision tree model can then be used to perform a second dimensionality reduction on the data after the initial dimensionality reduction process. It should be understood that the historical data used to train the decision tree model may not be from the first period, but may be from other periods.

[0062] For example, after the random forest algorithm is used for further dimensionality reduction, the reduced data may include the day-on-day year-on-year comparison of trading volume (for example, the day-on-day comparison of trading volume between every two days in the previous week), the peak trading volume within each hour in the first period, the average trading volume within each hour, the average trading volume within each minute, or the average trading volume within each second.

[0063] It should be noted that the anomaly detection device may also first use the random forest algorithm to perform dimensionality reduction processing on the data of the first period to obtain data after the first dimensionality reduction processing, and then use the PCA method to perform dimensionality reduction processing on the data after the first dimensionality reduction processing to obtain data after dimensionality reduction. This application is not limited to this.

[0064] In step 220, the data after dimensionality reduction is analyzed using wavelet analysis to determine high-frequency data.

[0065] The high-frequency data refers to data with an amplitude greater than a preset amplitude, that is, data with large fluctuations or mutations.

[0066] The anomaly detection device can analyze the data after dimensionality reduction to determine data with large fluctuations or mutations, that is, to determine data with amplitudes greater than a preset amplitude.

[0067] Since random jitter factors such as sudden changes or abrupt changes in the data of complex indicators are mainly reflected in high-frequency data, wavelet analysis can be used to extract high-frequency data of each indicator.

[0068] The anomaly detection device can decompose the data of each indicator after dimensionality reduction into different frequency channels based on the wavelet analysis method, and gradually perform multi-scale refinement on the data through scaling and translation operations, ultimately achieving time subdivision at high frequencies and frequency subdivision at low frequencies. It can automatically adapt to the requirements of time-frequency signal analysis, and can focus on the details of high-frequency data, thereby determining the high-frequency data.

[0069] In step 230 , a predicted value of each of the M indicators in the second time period is determined based on the high-frequency data.

[0070] It should be noted that the second time period is after the first time period. That is, if the second time period is from 0:00 to 24:00 today, then the first time period may be the time period before 0:00 today.

[0071] The anomaly detection device can predict the data of each of the M indicators in the second time period based on the high-frequency data to determine the predicted value of each of the M indicators in the second time period.

[0072] In one possible implementation, determining the predicted value of each indicator in the second time period based on the high-frequency data may include: using an LSTM neural network to determine the predicted trading volume of each indicator in the second time period based on the high-frequency data.

[0073] Exemplarily, the anomaly detection device may input high-frequency data into an LSTM neural network, process the high-frequency data, and predict the predicted trading volume for each indicator in the second time period based on the high-frequency data. For example, if the data corresponding to the indicator average trading volume within an hour is high-frequency data, the data corresponding to the indicator average trading volume within each hour in the first time period may be input into the LSTM neural network as high-frequency data to predict the average trading volume within each hour of the second time period. In other words, 24 predicted trading volumes for the period from 0:00 to 24:00 today are determined.

[0074] It should be noted that the LSTM neural network can also be replaced by other neural networks that can perform time series prediction, and this application does not limit this.

[0075] In step 240 , when the difference between the actual value and the predicted value of at least one indicator in the second period is greater than or equal to a preset threshold, it is determined that the data in the second period is abnormal.

[0076] As long as the difference between the actual value and the predicted value of any indicator in the second period is greater than or equal to the preset threshold, it can be determined that the data in the second period is abnormal, that is, the transaction in the second period is abnormal.

[0077] It should be noted that the preset threshold includes a statistical value corresponding to each indicator of the M indicators, and the statistical value corresponding to each indicator is determined by the actual value and the predicted value of each indicator in the second time period.

[0078] That is to say, the preset threshold is not fixed, and the preset threshold will change as the statistical value corresponding to the indicator changes.

[0079] Optionally, the statistical value is an integer multiple of the standard deviation σ; where, N represents the number of statistical periods included in the second period, x i represents the real-time trading volume of the i-th statistical period in N statistical periods, y i Represents the predicted trading volume of the i-th statistical period.

[0080] The real-time trading volume of the i-th statistical period is the actual value, and the predicted trading volume of the i-th statistical period is the predicted value.

[0081] The statistical period is related to the indicator, and each indicator corresponds to a statistical period. For example, the statistical period for day-on-day month-on-month growth is one day, the statistical period for the peak trading volume within one hour and the average trading volume within one hour in the first period is one hour, the statistical period for the peak trading volume within one minute and the average trading volume within one minute is one minute, and the statistical period for the peak trading volume within one second and the average trading volume within one second is one second.

[0082] For example, the real-time trading volume in the first hour of today is x1, the real-time trading volume in the second hour is x2, and so on. The real-time trading volume in the 24th hour is x 24 The predicted trading volume for the first hour of today is y1, the predicted trading volume for the second hour is y2, and so on. The predicted trading volume for the 24th hour is y 24 ; The difference between the actual value and the predicted value in the first hour of today is (x1-y1), the difference between the actual value and the predicted value in the second hour is (x2-y2), and so on. The difference between the actual value and the predicted value in the 24th hour is (x 24 -y 24 ), then the standard deviation of these 24 true values and predicted values is: If the statistic is 3σ, then (x1-y1), (x2-y2), ..., (x 24 -y 24) exists in any value greater than or equal to 3σ, it can be determined that today's trading volume data is abnormal, that is, the trading in the period from 0:00 to 24:00 today is abnormal.

[0083] Based on the above scheme, the data related to the trading volume of the first period is used to predict the trading volume data of the second period. When the difference between the actual value and the predicted value of the second period is significant, the data of the second period is determined to be an anomaly. This allows for automated transaction anomaly detection, reduces labor costs, and prevents the impact of external factors on operations and maintenance personnel, thereby improving detection accuracy. Furthermore, by performing dimensionality reduction on the data of the first period, superior feature data is extracted, and high-frequency data is then extracted. The predicted value for the second period is determined based on this high-frequency data. This high-frequency data extracted after dimensionality reduction eliminates the influence of random jitter factors such as sudden changes and sudden changes in the data of some complex indicators, effectively reflecting data trends and becoming superior feature data. Making predictions based on superior feature data not only improves prediction accuracy but also reduces the amount of data processing required during the prediction process.

[0084] Figure 3 2 is a schematic block diagram of an anomaly detection device provided in an embodiment of the present application. The anomaly detection device can be used to implement the above method 200.

[0085] like Figure 3 As shown, the anomaly detection device 300 may include: a dimensionality reduction module 310, an analysis module 320, a prediction module 330, and a determination module 340. The dimensionality reduction module 310 may be used to perform dimensionality reduction processing on the data of the first time period to obtain reduced-dimensionality data; wherein the data of the first time period is related to the trading volume in the first time period, the data of the first time period includes the true values of N indicators in the first time period, and the reduced-dimensionality data includes the true values of M indicators in the first time period out of the N indicators, where M < N, N ≥ 3, and N and M are positive integers; the analysis module 320 may be used to analyze the reduced-dimensionality data using wavelet analysis to determine high-frequency data; the prediction module 330 may be used to determine, based on the high-frequency data, a predicted value of each indicator in the M indicators in the second time period, where the second time period is after the first time period; and the determination module 340 may be used to determine that the data of the second time period is abnormal when the difference between the true value and the predicted value of at least one indicator in the second time period is greater than or equal to a preset threshold value, and the data of the second time period includes the true values of the M indicators.

[0086] Optionally, the dimensionality reduction module 310 may be specifically configured to perform dimensionality reduction on the data of the first period using a principal component analysis method and a random forest algorithm to obtain dimensionality-reduced data.

[0087] Optionally, the prediction module 330 may be specifically configured to determine the predicted trading volume of each of the M indicators in the second time period based on high-frequency data using a long short-term memory neural network.

[0088] Optionally, the preset threshold includes a statistical value corresponding to each indicator of the M indicators, and the statistical value corresponding to each indicator is determined by the actual value and the predicted value of each indicator in the second time period.

[0089] Optionally, the statistical value is an integer multiple of the standard deviation σ; where, N represents the number of statistical periods included in the second period, x i represents the real-time trading volume of the i-th statistical period in N statistical periods, y i Represents the predicted trading volume of the i-th statistical period.

[0090] Optionally, the statistical period is related to the indicator, and each indicator corresponds to a type of statistical period.

[0091] Optionally, the N indicators include one or more of the following: week-on-week trading volume, week-on-week trading volume, day-on-day trading volume, day-on-day trading volume, peak trading volume within 1 minute, average trading volume within 1 minute, peak trading volume within 1 second, average trading volume within 1 second.

[0092] Optionally, the transaction volume is: the transaction volume of aggregated transactions, the transaction volume of collection transactions, the transaction volume of contracted transactions, or the transaction volume of non-cash transactions.

[0093] It should be understood that Figure 3 The module division of the abnormality detection device in the embodiment is only exemplary. In actual applications, different functional modules can be divided according to different functional requirements. This application does not impose any restrictions on the division form and number of functional modules in actual applications, and Figure 3 This does not limit the present application in any way.

[0094] Figure 4 This is a schematic block diagram of another anomaly detection device provided in an embodiment of the present application. This anomaly detection device can be used to implement the above-mentioned method 200. This anomaly detection device can be a chip system. In the embodiment of the present application, the chip system can be composed of a chip, or it can include a chip and other discrete devices.

[0095] like Figure 4 As shown, the anomaly detection device 400 may include at least one processor 410, which is used to implement the functions of the anomaly detection device in the method 200 provided in the embodiment of the present application.

[0096] Exemplarily, when the anomaly detection device 400 is used to implement the method 200 provided in the embodiment of the present application, the processor 410 can be used to perform dimensionality reduction processing on the data of the first time period to obtain the reduced-dimensional data; wherein the data of the first time period is related to the trading volume in the first time period, and the data of the first time period includes the true values of N indicators in the first time period; the reduced-dimensional data includes the true values of M indicators in the first time period among the N indicators, M<N, N≥3, N and M are positive integers; it can also be used to analyze the reduced-dimensional data using wavelet analysis to determine high-frequency data; it can also be used to determine the predicted value of each indicator of the M indicators in the second time period based on the high-frequency data, and the second time period is after the first time period; it can also be used to determine that the data of the second time period is abnormal when the difference between the true value and the predicted value of at least one indicator in the second time period is greater than or equal to a preset threshold, and the data of the second time period includes the true values of M indicators. Please refer to the detailed description in the method example for details, which will not be repeated here.

[0097] The anomaly detection device 400 may also include at least one memory 420, which can be used to store program instructions and data. The memory 420 is coupled to the processor 410. Coupling in the embodiments of the present application is an indirect coupling or communication connection between devices, units, or modules, which can be electrical, mechanical, or other forms, and is used for information exchange between devices, units, or modules. The processor 410 may operate in conjunction with the memory 420. The processor 410 may execute program instructions stored in the memory 420. At least one of the at least one memory may be included in the processor.

[0098] The abnormality detection device 400 may also include a communication interface 430 for communicating with other devices via a transmission medium, so that the abnormality detection device 400 can communicate with other devices. The communication interface 430 may be, for example, a transceiver, an interface, a bus, a circuit, or a device capable of performing transceiver functions. The processor 410 may utilize the communication interface 430 to transmit and receive data and / or information, and to implement Figure 2 The method 200 performed by the abnormality detection device in the corresponding embodiment.

[0099] The specific connection medium between the processor 410, the memory 420 and the communication interface 430 is not limited in the embodiment of the present application. Figure 4 The processor 410, the memory 420 and the communication interface 430 are connected via a bus 440. The bus 440 is connected to the Figure 4 The connections between the other components are shown in bold lines, which are only for illustration and are not intended to be limiting. The bus can be divided into an address bus, a data bus, a control bus, etc. For ease of illustration, Figure 4 Only one thick line is used in the diagram, but this does not mean that there is only one bus or one type of bus.

[0100] The present application also provides a chip system, which includes at least one processor for implementing the above Figure 2 Functions involved in the method performed by the abnormality detection device in the illustrated embodiment.

[0101] In one possible design, the chip system further includes a memory, which is used to store program instructions and data, and the memory is located inside or outside the processor.

[0102] The chip system can be composed of chips, or can include chips and other discrete devices.

[0103] The present application also provides a computer program product, which includes: a computer program (also referred to as code or instruction), which, when executed, causes a computer to execute the following Figure 2 The method of the embodiment shown.

[0104] The present application also provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program (also referred to as code or instruction). When the computer program is executed, the computer executes the following Figure 2 The method of the embodiment shown.

[0105] It should be understood that the processor in the embodiments of the present application can be an integrated circuit chip with signal processing capabilities. During implementation, each step of the above-mentioned method embodiment can be completed by hardware integrated logic circuits in the processor or by software instructions. The above-mentioned processor can be a general-purpose processor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. The various methods, steps, and logic block diagrams disclosed in the embodiments of the present application can be implemented or executed. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the method disclosed in the embodiments of the present application can be directly implemented and executed by a hardware decoding processor, or by a combination of hardware and software modules in the decoding processor. The software module can be located in a storage medium well-known in the art, such as random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, registers, etc. The storage medium is located in the memory, and the processor reads the information in the memory and, in conjunction with its hardware, completes the steps of the above-mentioned method.

[0106] It should also be understood that the memory in the embodiments of the present application may be a volatile memory or a non-volatile memory, or may include both volatile and non-volatile memories. Among them, the non-volatile memory may be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The volatile memory may be a random access memory (RAM), which is used as an external cache. By way of example and not limitation, many forms of RAM are available, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDR SDRAM), enhanced SDRAM (ESDRAM), synchronous link DRAM (SLDRAM), and direct RAM bus RAM (DR RAM). It should be noted that the memory of the systems and methods described herein is intended to include, but is not limited to, these and any other suitable types of memory.

[0107] The terms "unit," "module," and the like used in this specification may be used to refer to a computer-related entity, hardware, firmware, a combination of hardware and software, software, or software in execution.

[0108] Those skilled in the art will appreciate that the various illustrative logical blocks and steps described in conjunction with the embodiments disclosed herein can be implemented using electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application. In the several embodiments provided in this application, it should be understood that the disclosed devices, equipment, and methods can be implemented in other ways. For example, the device embodiments described above are merely illustrative. For example, the module division is only a logical function division. In actual implementation, there may be other division methods, such as multiple modules or components can be combined or integrated into another system, or some features can be ignored or not implemented. In addition, the coupling or direct coupling or communication connection shown or discussed can be through some interface, indirect coupling or communication connection of devices or modules, and can be electrical, mechanical, or other forms.

[0109] The modules described as separate components may or may not be physically separate, and the components shown as modules may or may not be physical modules, that is, they may be located in one place or distributed across multiple network modules. Some or all of the modules may be selected to achieve the purpose of the present embodiment according to actual needs.

[0110] In addition, the functional modules in the various embodiments of the present application may be integrated into one processing module, or each module may exist physically separately, or two or more units may be integrated into one module.

[0111] In the above embodiments, the functions of each functional module can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions (programs). When the computer program instructions (program) are loaded and executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from one website, computer, server or data center to another website, computer, server or data center via a wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) method. The computer-readable storage medium can be any available medium that can be accessed by a computer or a data storage device such as a server or data center that includes one or more available media integrated therein. The available medium may be a magnetic medium (eg, a floppy disk, a hard disk, a magnetic tape), an optical medium (eg, a digital versatile disc (DVD)), or a semiconductor medium (eg, a solid state disk (SSD)).

[0112] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes various media that can store program codes, such as a USB flash drive, a mobile hard disk, a ROM, a RAM, a magnetic disk, or an optical disk.

[0113] The above description is merely a specific embodiment of the present application, but the scope of protection of the present application is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in this application should be included in the scope of protection of this application. Therefore, the scope of protection of this application should be based on the scope of protection of the claims.

Claims

1. A method for detecting anomalies, characterized in that: The method comprises: Performing dimensionality reduction processing on the data of the first period to obtain reduced-dimensionality data; wherein the data of the first period is related to the trading volume in the first period, the data of the first period includes the true values of N indicators in the first period, and the reduced-dimensionality data includes the true values of M indicators of the N indicators in the first period, where M<N, N≥3, and N and M are positive integers; The wavelet analysis method is used to analyze the data after dimensionality reduction, and the data of each indicator after dimensionality reduction is decomposed into different frequency channels. The data is gradually refined at multiple scales through scaling and translation operations to determine high-frequency data; Determine, based on the high-frequency data, a predicted value of each of the M indicators in a second time period, where the second time period is after the first time period; When the difference between the true value and the predicted value of at least one indicator in the second period is greater than or equal to a preset threshold, the data of the second period is determined to be abnormal, and the data of the second period includes the true values of the M indicators; wherein the preset threshold includes a statistical value corresponding to each indicator of the M indicators, and the statistical value corresponding to each indicator is determined by the true value and the predicted value of each indicator in the second period; the statistical value is the standard deviation An integer multiple of ; where , N represents the number of statistical periods included in the second time period, Represents the real-time trading volume of the i-th statistical period in N statistical periods, Represents the predicted trading volume of the i-th statistical period.

2. The method according to claim 1, wherein The performing dimensionality reduction processing on the data of the first period to obtain the reduced-dimensional data includes: The data of the first period are subjected to dimensionality reduction using principal component analysis and random forest algorithm to obtain the dimensionality reduced data.

3. The method according to claim 1, wherein Determining a predicted value of each of the M indicators in the second time period based on the high-frequency data includes: A long short-term memory neural network is used to determine the predicted trading volume of each of the M indicators in the second time period based on the high-frequency data.

4. The method according to claim 1, wherein The duration of the statistical period is related to the indicator, and each indicator corresponds to a type of statistical period.

5. The method according to any one of claims 1 to 4, characterized in that The N indicators include one or more of the following: week-on-week trading volume, week-on-week trading volume, day-on-day trading volume, day-on-day trading volume, peak trading volume within 1 minute, average trading volume within 1 minute, peak trading volume within 1 second, and average trading volume within 1 second.

6. The method according to claim 1, wherein The transaction volume refers to: the transaction volume of aggregated transactions, the transaction volume of collection transactions, the transaction volume of signed transactions or the transaction volume of non-cash transactions.

7. An abnormality detection device, characterized in that: include: a dimensionality reduction module, configured to perform dimensionality reduction processing on the data of the first period to obtain reduced-dimensionality data; wherein the data of the first period is related to the trading volume in the first period, the data of the first period includes the true values of N indicators in the first period, and the reduced-dimensionality data includes the true values of M indicators of the N indicators in the first period, where M<N, N≥3, and N and M are positive integers; An analysis module is used to analyze the data after dimensionality reduction using wavelet analysis, decompose the data of each indicator after dimensionality reduction into different frequency channels, and gradually perform multi-scale refinement on the data through scaling and translation operations to determine high-frequency data; a prediction module, configured to determine a predicted value of each of the M indicators in a second time period based on the high-frequency data, where the second time period is after the first time period; A determination module is configured to determine that the data of the second period is abnormal when the difference between the actual value and the predicted value of at least one indicator in the second period is greater than or equal to a preset threshold, wherein the data of the second period includes the actual values of the M indicators; wherein the preset threshold includes a statistical value corresponding to each indicator of the M indicators, and the statistical value corresponding to each indicator is determined by the actual value and the predicted value of each indicator in the second period; the statistical value is the standard deviation An integer multiple of ; where , N represents the number of statistical periods included in the second time period, Represents the real-time trading volume of the i-th statistical period in N statistical periods, Represents the predicted trading volume of the i-th statistical period.

8. An abnormality detection device, characterized in that: comprising a memory and a processor, wherein, The memory is used to store computer programs; The processor is configured to execute the computer program to implement the method according to any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a computer program, which is used to implement the method according to any one of claims 1 to 6 when executed by a processor.

10. A computer program product comprising a computer program, wherein when the computer program is executed by a computer, the method according to any one of claims 1 to 6 is implemented.

Images