Business data decision method, device, electronic device and storage medium

Abstract

The present invention provides a business data decision-making method, apparatus, electronic device, and storage medium, comprising: obtaining business expense data; inputting the business expense data into a pre-trained multi-stage cascade anomaly indicator detection model to obtain anomaly data detection results. By cascading traditional machine learning and deep learning models for detection, the present invention determines whether current expenses are abnormal from a coarse-grained to a fine-grained level, ensuring that both obvious anomalies can be quickly located and minor anomalies can be captured.

Description

Technical Field

[0001] The present invention relates to the field of data processing technology, and in particular to a business data decision method, device, electronic device and storage medium. Background Art

[0002] With the continuous development of the data service market, the customer base of enterprises in many application areas has continued to mature over time, and the business models serving these customers have also shown a trend of continuous development with logic sedimentation, version fragmentation, and increasing logical complexity. Although telecommunications companies' customer-facing pricing policies are being continuously simplified at the individual user level, the diverse and continuously overlapping business logic of their customer base of hundreds of millions of people makes it difficult to accurately verify the correctness of business calculation results.

[0003] Most existing solutions use trend comparisons based on result data across multiple consecutive periods, then review anomalies and large fluctuations in the trends to confirm the accuracy of the results. However, due to the huge amount of data and complex logical relationships, trend-based verification methods can only focus on large-scale, large-scale differences in the data, and small-scale, subtle differences are easily overlooked. Among them, there is a method that provides trend change results of data indicators at multiple time points for manual analysis and decision-making. The main shortcomings are:

[0004] 1. It is impossible to quickly filter normal data, and all data must be tested tediously, which takes too much time.

[0005] 2 The predictions of existing data indicators are only made by comparing with historical data. The conclusions drawn are relatively rough and the results may have large deviations.

[0006] 3 Subtle, small-scale abnormal fluctuations usually cannot cause obvious changes in the result data and are easily ignored. Summary of the Invention

[0007] The present invention provides a business data decision method, device, electronic device and storage medium to solve the defects in the prior art.

[0008] In a first aspect, the present invention provides a business data decision method, comprising:

[0009] Obtain business expense data;

[0010] The business expense data is input into a pre-trained multi-stage cascade anomaly indicator detection model to obtain an abnormal data detection result; wherein, the multi-stage cascade anomaly indicator detection model is based on business expense historical data, and is constructed by cascading a dynamic anomaly detection model, a first XGBOOST anomaly detection model constructed based on its own time series information, a non-time series feature screening function model, a second XGBOOST anomaly prediction model constructed based on external self-time series information and external non-time series features, an LSTM indicator prediction model constructed based on external self-time series information and external non-time series features, and a proportion anomaly discrimination model constructed based on the nature of the business.

[0011] In one embodiment, the dynamic anomaly detection model is obtained by the following steps:

[0012] Determining a preset time window, intercepting the business cost history data based on the preset time window, and obtaining a historical business cost vector having a preset time window length;

[0013] Calculating a first mean value, a first median value, a maximum value, and a minimum value of the historical business expense vector respectively;

[0014] Calculating a dynamic threshold based on the first mean, the first median, the maximum, and the minimum;

[0015] Sequentially calculating the absolute differences of all adjacent data in the historical service cost vector;

[0016] The dynamic anomaly detection model is constructed based on the absolute difference and the dynamic threshold.

[0017] In one embodiment, the first XGBOOST anomaly detection model is obtained by the following steps:

[0018] Obtaining time series information of the historical service cost vector;

[0019] Convert the historical business expense vector into a supervision model format based on its own time series information to obtain feature data, and assign the current expense data as a label;

[0020] The first XGBOOST anomaly detection model is constructed based on the XGBOOST algorithm using the feature data and the label.

[0021] In one embodiment, the non-time series feature screening function model is obtained by the following steps:

[0022] determining external features of the business expense history data, and converting the external features into external feature vectors;

[0023] respectively calculating a second mean, a second median value, and a standard deviation of the external eigenvector;

[0024] constructing a variable dispersion index based on the second mean, the second median value, and the standard deviation;

[0025] A first variable discrete threshold is determined, and the non-time series feature screening function model is constructed based on the variable discreteness index and the first variable discrete threshold.

[0026] In one embodiment, the second XGBOOST anomaly prediction model constructed based on external self-time series information and external non-time series features is obtained by the following steps:

[0027] Filter the external features based on business characteristics to obtain user-level features, product-level features, and traffic-level features;

[0028] Combining the user-level features, the product-level features, and the traffic-level features into a derived feature vector;

[0029] splicing the external feature vector, the derived feature vector and the feature data to form a spliced ​​vector;

[0030] The second XGBOOST anomaly detection model is constructed based on the XGBOOST algorithm using the concatenated vector and the label.

[0031] In one embodiment, the LSTM indicator prediction model constructed based on external time series information and external non-time series features is obtained by the following steps:

[0032] The external feature is constructed as a categorical external feature based on the consistency of the external information time, and the external feature is constructed as a numerical external feature based on the growth rate of the external information time;

[0033] The categorical external features and the numerical external features are merged into the derived feature vector, and based on the LSTM algorithm, the LSTM indicator prediction model is constructed.

[0034] In one embodiment, the abnormal proportion discrimination model is obtained by the following steps:

[0035] Obtaining actual values ​​and forecast values ​​of current business expenses, and obtaining error ratios of actual values ​​and error values ​​based on the actual values ​​and the forecast values;

[0036] Determine a second variable discrete threshold, and construct the proportion abnormality discrimination model based on the error proportion and the second variable discrete threshold.

[0037] In a second aspect, the present invention further provides a service data decision device, comprising:

[0038] Acquisition module, used to obtain business expense data;

[0039] The detection module is used to input the business expense data into a pre-trained multi-stage cascade anomaly indicator detection model to obtain an abnormal data detection result; wherein, the multi-stage cascade anomaly indicator detection model is based on business expense historical data, and is constructed in cascade sequence by a dynamic anomaly detection model, a first XGBOOST anomaly detection model constructed based on its own time series information, a non-time series feature screening function model, a second XGBOOST anomaly prediction model constructed based on external self-time series information and external non-time series features, an LSTM indicator prediction model constructed based on external self-time series information and external non-time series features, and a proportion anomaly discrimination model constructed based on the nature of the business.

[0040] In a third aspect, the present invention also provides an electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the steps of any of the above-described business data decision methods are implemented.

[0041] In a fourth aspect, the present invention further provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of any of the above-described business data decision methods.

[0042] The business data decision-making method, device, electronic device and storage medium provided by the present invention cascade detection of traditional machine learning and deep learning models, and judge whether there are abnormalities in current expenses from coarse granularity to fine granularity, layer by layer, ensuring that obvious abnormalities can be quickly located and minor abnormalities can be captured. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] In order to more clearly illustrate the technical solutions in the present invention or the prior art, a brief introduction is given below to the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0044] Figure 1 It is a flowchart of the business data decision-making method provided by the present invention;

[0045] Figure 2 This is a schematic diagram of the process of building a dynamic anomaly detection model provided by the present invention;

[0046] Figure 3It is a schematic diagram of the sample construction and model building process provided by the present invention;

[0047] Figure 4 It is a structural diagram of the business data decision device provided by the present invention;

[0048] Figure 5 It is a structural schematic diagram of the electronic device provided by the present invention. DETAILED DESCRIPTION

[0049] To make the objectives, technical solutions, and advantages of the present invention more clear, the technical solutions of the present invention will be clearly and completely described below in conjunction with the accompanying drawings. Obviously, the embodiments described are only some of the embodiments of the present invention, not all of them. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts shall fall within the scope of protection of the present invention.

[0050] In response to the problems of low accuracy in detecting abnormal indicators in the existing technology, the business data decision-making method proposed in the present invention constructs a multi-stage abnormal indicator detection model based on the cascade idea. By eliminating a large number of normal samples, the detection time is reduced, and by constructing an external non-time series feature screening function, the feature dimension is reduced and important features are screened, which can be more in line with business needs.

[0051] Figure 1 It is a flowchart of the business data decision method provided by the present invention, such as Figure 1 As shown, including:

[0052] 101, obtain business expense data;

[0053] 102. Input the business expense data into a pre-trained multi-stage cascade anomaly indicator detection model to obtain an abnormal data detection result; wherein, the multi-stage cascade anomaly indicator detection model is based on business expense historical data, and is constructed by cascading a dynamic anomaly detection model, a first XGBOOST anomaly detection model constructed based on its own time series information, a non-time series feature screening function model, a second XGBOOST anomaly prediction model constructed based on external self-time series information and external non-time series features, an LSTM indicator prediction model constructed based on external self-time series information and external non-time series features, and a proportion anomaly discrimination model constructed based on the nature of the business.

[0054] It should be noted that the present invention discriminates and makes decisions on abnormal data in business expense data by constructing a multi-stage cascade abnormal indicator detection model. The model is trained by cascading multiple sub-models and performing detection and decision-making at each stage. Specifically, it includes:

[0055] A dynamic anomaly detection model is constructed to quickly screen large amounts of normal data, exempting them from detection and reducing detection time; a first XGBOOST anomaly detection model is constructed based on its own time series information; a non-time series feature screening function model is constructed to reduce feature dimensions and select important features; a second XGBOOST anomaly detection model is constructed based on external time series information and external non-time series features; an LSTM indicator prediction model is further constructed based on external time series information and external non-time series features; finally, a proportion anomaly discrimination model is constructed based on the nature of the business; the business expense data to be detected is input into the multi-stage cascade anomaly indicator detection model to obtain the final anomaly data detection results.

[0056] The present invention cascades traditional machine learning and deep learning models to determine whether there are abnormalities in current expenses from coarse-grained to fine-grained, layer by layer, ensuring that obvious abnormalities can be quickly located and minor abnormalities can be captured.

[0057] Based on the above embodiment, the dynamic anomaly detection model is obtained by the following steps:

[0058] Determining a preset time window, intercepting the business cost history data based on the preset time window, and obtaining a historical business cost vector having a preset time window length;

[0059] Calculating a first mean value, a first median value, a maximum value, and a minimum value of the historical business expense vector respectively;

[0060] Calculating a dynamic threshold based on the first mean, the first median, the maximum, and the minimum;

[0061] Sequentially calculating the absolute differences of all adjacent data in the historical service cost vector;

[0062] The dynamic anomaly detection model is constructed based on the absolute difference and the dynamic threshold.

[0063] Specifically, we first conduct preliminary screening by building a dynamic anomaly detection model based on historical business expense data. The fluctuations in historical data contain information about whether the data is abnormal. Values ​​within a reasonable data fluctuation range are normal data, while values ​​otherwise are suspected anomalies. Therefore, through cross-validation, we design different time windows and build a dynamic anomaly detection model. The model building process is as follows:

[0064] 1) Set the time window k and use X k =(x t-1 ,x t-2 ,…x t-k ) represents the historical business cost vector lagged k periods, x t Represents the operating expenses for the current period;

[0065] 2) Calculate X separately k The mean Medianx mid , maximum value x max and the minimum value x min :

[0066]

[0067] x mid =median{X k}

[0068] x max =max{X k}

[0069] x min =min{X k}

[0070] 3) From the above mean Medianx mid , maximum value x max and the minimum value x min Calculate the dynamic threshold λ1:

[0071]

[0072] 4) Calculate the absolute difference abs value =|x t -x t-1 |;

[0073] 5) Build a dynamic anomaly detection model 0 means that there is no anomaly in the data, and 1 means that the data is anomaly.

[0074] The flow chart of building a dynamic anomaly detection model is as follows: Figure 2 As shown in the figure, a large number of normal samples can be eliminated through the dynamic anomaly detection model, leaving only a few suspected anomalies to enter the second stage of evaluation, which can reduce the detection time and improve the detection efficiency.

[0075] The present invention constructs a dynamic anomaly detection model to quickly screen a large amount of normal data, thereby exempting a large amount of normal data from detection and reducing detection time.

[0076] Based on any of the above embodiments, the first XGBOOST anomaly detection model is obtained by the following steps:

[0077] Obtaining time series information of the historical service cost vector;

[0078] Convert the historical business expense vector into a supervision model format based on its own time series information to obtain feature data, and assign the current expense data as a label;

[0079] The first XGBOOST anomaly detection model is constructed based on the XGBOOST algorithm using the feature data and the label.

[0080] Specifically, based on the above embodiment, the present invention constructs a first XGBOOST anomaly detection model based on the time series information of the business expense itself. Since the business expense data is time series data, it is impossible to build a classification model in the traditional sense. Therefore, it is necessary to convert the data format. The existing business expense data k+1 period original data X k+1 =(x t , x t-1 ,x t-2 ,…x t-k ), transform the data vector into the supervised model format as follows:

[0081] X=(x t-1 ,x t-2 ,…x t-k )

[0082] Y=x t

[0083] Because Y represents a numerical value, it needs to be reassigned. Based on historical cost indicators, abnormal Y values ​​are relabeled as 1 and normal data is labeled as 0. By reformatting the cost data format, using the previous k periods of data as features, and reassigning the current period's data as labels, a supervised learning sample is constructed. After the supervised learning sample is constructed, the XGBOOST algorithm is selected to build the classification model model_XGB.

[0084] The process of sample construction and model building is as follows Figure 3 As shown in the figure, the constructed model_XGB outperforms the first-stage dynamic anomaly detection model in terms of accuracy. Model_XGB predicts normal expenses as 0 and suspected abnormal expenses as 1. Suspected abnormalities enter the second stage of evaluation, where the suspected abnormal data is further tested. This step generates less abnormal data, improving the model's efficiency.

[0085] The present invention constructs a classification model based on its own time series information and external features through machine learning, and obtains better classification features through feature screening and feature construction, which can accurately eliminate normal data and prevent false alarms.

[0086] Based on any of the above embodiments, the non-time series feature screening function model is obtained by the following steps:

[0087] determining external features of the business expense history data, and converting the external features into external feature vectors;

[0088] respectively calculating a second mean, a second median value, and a standard deviation of the external eigenvector;

[0089] constructing a variable dispersion index based on the second mean, the second median value, and the standard deviation;

[0090] A first variable discrete threshold is determined, and the non-time series feature screening function model is constructed based on the variable discreteness index and the first variable discrete threshold.

[0091] Specifically, since the construction of supervised learning samples in the aforementioned embodiments is based on the time series data of the expenses themselves, and considering that the expense data is also affected by external indicators, these indicators need to be included in the features when constructing the samples, as shown in Table 1:

[0092] Table 1

[0093]

[0094]

[0095] The external information shown in the preceding table primarily includes user information, order information, group information, and parameter attributes. While it's feasible to include all of these external variables in the features, too many features increase model building time and reduce performance. Therefore, it's necessary to screen these external features and select effective ones for model construction.

[0096] The present invention starts from the feature discreteness and constructs an unsupervised feature screening function. The external feature is represented by z, and Z=(z1,z2,…z m ) represents the external feature vector, for each feature z in vector Z i , do the following:

[0097] 1) Calculate z separately i The mean, median, and standard deviation of z mid 、z sd ;

[0098] 2) Construct variable dispersion index:

[0099] 3) Setting the first variable discrete threshold λ2;

[0100] 4) Constructing a non-time series feature screening function model: 0 means feature deletion, and 1 means feature retention.

[0101] The present invention constructs a non-time series feature screening function model to reduce feature dimensions, select important features, reduce subsequent model training time and improve model performance.

[0102] Based on any of the above embodiments, the second XGBOOST anomaly prediction model constructed based on external self-time series information and external non-time series features is obtained by the following steps:

[0103] Filter the external features based on business characteristics to obtain user-level features, product-level features, and traffic-level features;

[0104] Combining the user-level features, the product-level features, and the traffic-level features into a derived feature vector;

[0105] splicing the external feature vector, the derived feature vector and the feature data to form a spliced ​​vector;

[0106] The second XGBOOST anomaly detection model is constructed based on the XGBOOST algorithm using the concatenated vector and the label.

[0107] Specifically, in the third stage of evaluation, the present invention constructs a second XGBOOST anomaly detection model based on the filtered external features and the time series information of the business expenses themselves.

[0108] Here, the filtered external features can be used to derive effective features for classification based on business characteristics. The effective features after screening include user age, user gender, user level, number of users, product order quantity, product category, product segmentation, average product discount rate, average product discount amount, number of group members, group group gender ratio, daily total traffic, monthly total, etc. Due to the large number of features, they are not listed here one by one. Based on the existing business features, new business features are derived. The idea of ​​deriving features proposed in this invention is as follows:

[0109] 1. User Level

[0110] Because total costs are the sum of user costs, and users have both differences and commonalities, different users contribute differently to the total costs, so users can be clustered. Based on actual business scenarios, this paper clusters users into three categories: low-value users, medium-value users, and high-value users. Based on the number of users in each category and the total costs, three derived variables are derived: the proportion of users in each category, the proportion of user costs in each category, and the average cost proportion of each category.

[0111] The calculation method for deriving the proportion of each type of user is as follows:

[0112] 1) Clustering based on user characteristics, with 3 categories;

[0113] 2) Calculate the user ratio of each column where num i Represents the number of each category, num whole Represents the total amount of data, rate i Represents the proportion of each type of users;

[0114] 3) Calculate the total cost ratio of each type of user where m i Represents the cost of category i user, m whole Represents the total cost, m_rate i Represents the proportion of user fees for each category;

[0115] 4) Calculate the ratio of the cost to the number of users in each category, and find the average cost. Based on this, calculate the average cost percentage for each user category as follows:

[0116]

[0117]

[0118] Where i=1,2,3.

[0119] The characteristics derived from this include rate i 、m_rate i 、m_avg i and rate_avg i Four characteristics.

[0120] 2. Product Level

[0121] The product features mainly include product order quantity, product category, product segmentation, product discount rate, product discount amount, etc. The derivative solutions based on these features are as follows:

[0122] 1) Based on the product categories, calculate the proportion of order quantities in each category and the coefficient of variation of order quantities in each category. The calculation method is as follows:

[0123]

[0124] where num_c i is the number of products in each category, num_c whole is the total amount of product, rate_c i is the proportion of each major category. The coefficient of variation is Where σ is the standard deviation of the order quantity of the major category, and μ is the standard deviation;

[0125] 2) Calculate the order ratio rate_c_x under product segmentation in the same way iand coefficient of variation c_x;

[0126] 3) Calculate the ratio of c and c_x It is mainly used to reflect the changes of products from subdivision to merger of major categories;

[0127] 4) Calculate the ranking of the product's discount amount among all product discount amounts. Assuming it is ranked j, calculate the ranking of the product's discount rate among all product discount rates. Assuming it is i, calculate It can reflect the gap between one’s own discount and its proportion in the overall discount.

[0128] The features derived from this include rate_c i 、rate z and rate p Three characteristics.

[0129] 3. Traffic Level

[0130] Traffic characteristics include daily traffic, weekly traffic, monthly traffic, daytime traffic, nighttime traffic, and traffic consumption by various software. The main idea behind deriving traffic characteristics is to construct statistics based on indicators and the ratios between the corresponding statistics.

[0131] Here, taking daily flow as an example, the standard deviation, mean, and coefficient of variation of daily flow are calculated, which can be expressed as: sd d ,mean d , c d Similarly, the standard deviation, mean and coefficient of variation sd of weekly flow can be calculated w ,mean w , c w ; Standard deviation, mean and coefficient of variation sd of monthly flow m ,mean m , c m ; Standard deviation, mean and coefficient of variation sd of daytime flow a ,mean a , c a ; Standard deviation, mean and coefficient of variation sd of night traffic n ,mean n , c n ;

[0132] Based on the idea of ​​permutation and combination, the standard deviation, mean and coefficient of variation of daily flow, weekly flow, monthly flow, daytime flow and nighttime flow are calculated respectively, and the changes of these statistics in different time ranges are calculated. Taking the standard deviation of daily flow and weekly flow as an example, the ratio of the difference and sum of the two is calculated as an indicator of the difference between the two. The remaining indicators are also constructed in this way.

[0133] In summary, the features derived from the user level, product level, and traffic level are combined into feature E.

[0134] Next, the filtered feature vector Z, the derived feature E and the business cost time series feature X are spliced ​​together to form a new feature vector B = (z1, z2, ... z j ,e1,e2,…e h , x t-1 ,x t-2 ,…x t-k ) and the original label Y, re-building model_XGB02 based on the XGBOOST algorithm. Model_XGB02 predicts normal expenses as 0 and suspected abnormal expenses as 1. Suspected abnormalities enter the fourth evaluation stage, where the suspected abnormal data is further tested. This step further reduces the abnormal data generated and improves the efficiency of the model.

[0135] The present invention further improves the detection performance by constructing an XGBOOST anomaly detection model based on external self-time series information and external non-time series features.

[0136] Based on any of the above embodiments, the LSTM indicator prediction model constructed based on external time series information and external non-time series features is obtained by the following steps:

[0137] The external feature is constructed as a categorical external feature based on the consistency of the external information time, and the external feature is constructed as a numerical external feature based on the growth rate of the external information time;

[0138] The categorical external features and the numerical external features are merged into the derived feature vector, and based on the LSTM algorithm, the LSTM indicator prediction model is constructed.

[0139] Specifically, in the fourth evaluation stage, the present invention further constructs an LSTM indicator prediction model based on the screened external features and the business cost's own timing information.

[0140] Before building the LSTM model, we first consider the temporality of external information and whether the previous and current attributes have changed. For numerical external features, we examine their growth rate, and for categorical external features, we examine their consistency. We construct the following function:

[0141] Category-type external feature construction:

[0142]

[0143] Numerical external feature construction:

[0144]

[0145] The newly constructed features are incorporated into the feature vector B again. Based on the LSTM algorithm, the model_LSTM model is constructed to predict the current business expenses. The predicted values ​​enter the next evaluation stage.

[0146] The present invention makes the prediction value more accurate by constructing an LSTM indicator prediction model based on the filtered external self-time series information and external non-time series features.

[0147] Based on any of the above embodiments, the abnormal proportion discrimination model is obtained by the following steps:

[0148] Obtaining actual values ​​and forecast values ​​of current business expenses, and obtaining error ratios of actual values ​​and error values ​​based on the actual values ​​and the forecast values;

[0149] Determine a second variable discrete threshold, and construct the proportion abnormality discrimination model based on the error proportion and the second variable discrete threshold.

[0150] Specifically, in the final evaluation phase, based on business information, thresholds are set and an anomaly ratio discrimination model is constructed. The anomaly ratio discrimination model construction process is as follows:

[0151] 1) Calculate the error ratio between actual and predicted values:

[0152]

[0153] 2) Setting the second variable discrete threshold λ3;

[0154] 3) Build an abnormality ratio discrimination model:

[0155]

[0156] Since LSTM can well capture the relationship between time series and the predicted values ​​are relatively accurate, the predicted values ​​can be considered a good estimate of the actual values. When the error ratio between the predicted value and the actual value exceeds the set threshold, it can be considered that there may be a problem with the calculation of the actual value.

[0157] The present invention can be closer to actual business needs by constructing a proportion abnormality discrimination model based on business information.

[0158] The business data decision device provided by the present invention is described below. The business data decision device described below and the business data decision method described above can be referenced to each other.

[0159] Figure 4 This is a schematic diagram of the structure of the business data decision device provided by the present invention. Figure 4 As shown, it includes: an acquisition module 41 and a detection module 42, wherein:

[0160] The acquisition module 41 is used to obtain business expense data; the detection module 42 is used to input the business expense data into a pre-trained multi-stage cascade anomaly indicator detection model to obtain an abnormal data detection result; wherein, the multi-stage cascade anomaly indicator detection model is based on business expense historical data, and is constructed in cascade sequence by a dynamic anomaly detection model, a first XGBOOST anomaly detection model constructed based on its own time series information, a non-time series feature screening function model, a second XGBOOST anomaly prediction model constructed based on external self-time series information and external non-time series features, an LSTM indicator prediction model constructed based on external self-time series information and external non-time series features, and a proportion anomaly discrimination model constructed based on the nature of the business.

[0161] The present invention cascades traditional machine learning and deep learning models to determine whether there are abnormalities in current expenses from coarse-grained to fine-grained, layer by layer, ensuring that obvious abnormalities can be quickly located and minor abnormalities can be captured.

[0162] Based on the above embodiment, the detection module 42 includes a first detection submodule 421, and the first detection submodule 421 is specifically configured to:

[0163] Determine a preset time window, intercept the business expense historical data based on the preset time window, and obtain a historical business expense vector with a preset time window length; calculate the first mean, first median, maximum and minimum values ​​of the historical business expense vector respectively; calculate a dynamic threshold based on the first mean, the first median, the maximum and the minimum; calculate the absolute difference of all adjacent data in the historical business expense vector in sequence; and construct the dynamic anomaly detection model based on the absolute difference and the dynamic threshold.

[0164] Based on any of the above embodiments, the detection module 42 includes a second detection submodule 422, and the second detection submodule 422 is specifically configured to:

[0165] Obtaining the inherent time series information of the historical business expense vector; converting the historical business expense vector into a supervision model format based on the inherent time series information, obtaining feature data, and assigning the current expense data as a label; and constructing the first XGBOOST anomaly detection model based on the XGBOOST algorithm using the feature data and the label.

[0166] Based on any of the above embodiments, the detection module 42 includes a third detection submodule 423, and the third detection submodule 423 is specifically configured to:

[0167] Determine the external characteristics of the business expense historical data and convert the external characteristics into external characteristic vectors; calculate the second mean, second median value and standard deviation of the external characteristic vectors respectively; construct a variable dispersion index based on the second mean, second median value and standard deviation; determine the first variable dispersion threshold, and construct the non-time series feature screening function model based on the variable dispersion index and the first variable dispersion threshold.

[0168] Based on any of the above embodiments, the detection module 42 includes a fourth detection submodule 424, and the fourth detection submodule 424 is specifically configured to:

[0169] The external features are filtered based on business characteristics to obtain user-level features, product-level features, and traffic-level features respectively; the user-level features, the product-level features, and the traffic-level features are merged into a derived feature vector; the external feature vector, the derived feature vector, and the feature data are spliced ​​to form a spliced ​​vector; and the second XGBOOST anomaly detection model is constructed based on the XGBOOST algorithm using the spliced ​​vector and the label.

[0170] Based on any of the above embodiments, the detection module 42 includes a fifth detection submodule 425, and the fifth detection submodule 425 is specifically configured to:

[0171] The external features are constructed as categorical external features based on the consistency of external information time, and are constructed as numerical external features based on the growth rate of external information time; the categorical external features and the numerical external features are merged into the derived feature vector, and based on the LSTM algorithm, the LSTM indicator prediction model is constructed.

[0172] Based on any of the above embodiments, the detection module 42 includes a sixth detection submodule 426, and the sixth detection submodule 426 is specifically configured to:

[0173] Obtain the actual value and predicted value of the current business expenses, and obtain the error ratio of the actual value and the error value based on the actual value and the predicted value; determine the discrete threshold of the second variable, and construct the abnormality discrimination model of the ratio based on the error ratio and the discrete threshold of the second variable.

[0174] Figure 5 An example of a physical structure diagram of an electronic device is shown below. Figure 5As shown, the electronic device may include: a processor 510, a communications interface 520, a memory 530, and a communication bus 540, wherein the processor 510, the communications interface 520, and the memory 530 communicate with each other via the communication bus 540. The processor 510 may call logic instructions in the memory 530 to execute a business data decision method, which includes: obtaining business expense data; inputting the business expense data into a pre-trained multi-stage cascade anomaly indicator detection model to obtain an anomaly data detection result; wherein the multi-stage cascade anomaly indicator detection model is based on business expense historical data and is cascaded by a dynamic anomaly detection model, a first XGBOOST anomaly detection model constructed based on its own time series information, a non-time series feature screening function model, a second XGBOOST anomaly prediction model constructed based on external self-time series information and external non-time series features, an LSTM indicator prediction model constructed based on external self-time series information and external non-time series features, and a proportion anomaly discrimination model constructed based on the nature of the business.

[0175] In addition, the logic instructions in the above-mentioned memory 530 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when sold or used as an independent product. Based on this understanding, the technical solution of the present invention is essentially or the part that contributes to the prior art or the part of the technical solution can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc. Various media that can store program codes.

[0176] On the other hand, the present invention also provides a computer program product, which includes a computer program stored on a non-transitory computer-readable storage medium, and the computer program includes program instructions. When the program instructions are executed by a computer, the computer can execute the business data decision-making method provided by the above methods, the method including: obtaining business expense data; inputting the business expense data into a pre-trained multi-stage cascade anomaly indicator detection model to obtain an abnormal data detection result; wherein, the multi-stage cascade anomaly indicator detection model is based on business expense historical data, and is cascaded in sequence by a dynamic anomaly detection model, a first XGBOOST anomaly detection model constructed based on its own time series information, a non-time series feature screening function model, a second XGBOOST anomaly prediction model constructed based on external self-time series information and external non-time series features, an LSTM indicator prediction model constructed based on external self-time series information and external non-time series features, and a proportion anomaly discrimination model constructed based on the nature of the business.

[0177] On the other hand, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, is implemented to execute the above-mentioned business data decision-making methods, the method comprising: obtaining business expense data; inputting the business expense data into a pre-trained multi-stage cascade anomaly indicator detection model to obtain an abnormal data detection result; wherein the multi-stage cascade anomaly indicator detection model is based on business expense historical data, and is cascaded in sequence by a dynamic anomaly detection model, a first XGBOOST anomaly detection model constructed based on its own time series information, a non-time series feature screening function model, a second XGBOOST anomaly prediction model constructed based on external self-time series information and external non-time series features, an LSTM indicator prediction model constructed based on external self-time series information and external non-time series features, and a proportion anomaly discrimination model constructed based on the nature of the business.

[0178] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, i.e., they may be located in one location or distributed across multiple network units. Some or all of the modules may be selected based on actual needs to achieve the objectives of the present embodiment. Persons of ordinary skill in the art will be able to understand and implement the present invention without inventive effort.

[0179] Through the description of the above embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus a necessary general hardware platform, or of course, by hardware. Based on this understanding, the essence of the above technical solution or the part that contributes to the existing technology can be embodied in the form of a software product. The computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a magnetic disk, an optical disk, etc., and includes a number of instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or certain parts of the embodiments.

[0180] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the various embodiments of the present invention.

Claims

1. A business data decision method, characterized in that: include: Obtain business expense data; The business expense data is input into a pre-trained multi-stage cascade anomaly indicator detection model to obtain an abnormal data detection result; wherein the multi-stage cascade anomaly indicator detection model is based on the business expense historical data and is constructed by sequentially cascading a dynamic anomaly detection model, a first XGBOOST anomaly detection model constructed based on its own time series information, a non-time series feature screening function model, a second XGBOOST anomaly prediction model, an LSTM indicator prediction model constructed based on external time series information and external non-time series features, and a proportion anomaly discrimination model constructed based on the nature of the business; The dynamic anomaly detection model is obtained by the following steps: Determining a preset time window, intercepting the business cost history data based on the preset time window, and obtaining a historical business cost vector having a preset time window length; Calculating a first mean value, a first median value, a maximum value, and a minimum value of the historical business expense vector respectively; Calculating a dynamic threshold based on the first mean, the first median, the maximum, and the minimum; Sequentially calculating the absolute differences of all adjacent data in the historical service cost vector; Constructing the dynamic anomaly detection model based on the absolute difference and the dynamic threshold; The first XGBOOST anomaly detection model is obtained by the following steps: Obtaining time series information of the historical service cost vector; Convert the historical business expense vector into a supervision model format based on its own time series information to obtain feature data, and assign the current expense data as a label; Constructing the first XGBOOST anomaly detection model based on the XGBOOST algorithm using the feature data and the label; The non-time series feature screening function model is obtained by the following steps: determining external features of the business expense history data, and converting the external features into external feature vectors; respectively calculating a second mean, a second median value, and a standard deviation of the external eigenvector; constructing a variable dispersion index based on the second mean, the second median value, and the standard deviation; Determining a first variable discrete threshold, and constructing the non-time series feature screening function model based on the variable discreteness index and the first variable discrete threshold; The second XGBOOST anomaly prediction model is obtained by the following steps: Filter the external features based on business characteristics to obtain user-level features, product-level features, and traffic-level features; Combining the user-level features, the product-level features, and the traffic-level features into a derived feature vector; splicing the external feature vector, the derived feature vector and the feature data to form a spliced ​​vector; Constructing a second XGBOOST anomaly detection model based on the XGBOOST algorithm using the concatenated vector and the label; The LSTM indicator prediction model constructed based on external time series information and external non-time series features is obtained through the following steps: The external feature is constructed as a categorical external feature based on the consistency of the external information time, and the external feature is constructed as a numerical external feature based on the growth rate of the external information time; Merging the categorical external features and the numerical external features into the derived feature vector, and constructing the LSTM indicator prediction model based on the LSTM algorithm; The abnormal proportion discrimination model is obtained by the following steps: Obtaining actual values ​​and forecast values ​​of current business expenses, and obtaining error ratios of actual values ​​and error values ​​based on the actual values ​​and the forecast values; Determine a second variable discrete threshold, and construct the proportion abnormality discrimination model based on the error proportion and the second variable discrete threshold.

2. A business data decision device, characterized in that: include: Acquisition module, used to obtain business expense data; A detection module is configured to input the business expense data into a pre-trained multi-stage cascade anomaly indicator detection model to obtain an abnormal data detection result; wherein the multi-stage cascade anomaly indicator detection model is based on business expense historical data and is constructed by sequentially cascading a dynamic anomaly detection model, a first XGBOOST anomaly detection model constructed based on its own time series information, a non-time series feature screening function model, a second XGBOOST anomaly prediction model constructed based on external self-time series information and external non-time series features, an LSTM indicator prediction model constructed based on external self-time series information and external non-time series features, and a proportion anomaly discrimination model constructed based on the nature of the business; Wherein, the detection module includes a first detection submodule, a second detection submodule, a third detection submodule, a fourth detection submodule, a fifth detection submodule and a sixth detection submodule; The first detection submodule is specifically configured to: Determining a preset time window, intercepting the business cost history data based on the preset time window, and obtaining a historical business cost vector having a preset time window length; Calculating a first mean value, a first median value, a maximum value, and a minimum value of the historical business expense vector respectively; Calculating a dynamic threshold based on the first mean, the first median, the maximum, and the minimum; Sequentially calculating the absolute differences of all adjacent data in the historical service cost vector; Constructing the dynamic anomaly detection model based on the absolute difference and the dynamic threshold; The second detection submodule is specifically configured to: Obtaining time series information of the historical service cost vector; Convert the historical business expense vector into a supervision model format based on its own time series information to obtain feature data, and assign the current expense data as a label; Constructing the first XGBOOST anomaly detection model based on the XGBOOST algorithm using the feature data and the label; The third detection submodule is specifically configured to: determining external features of the business expense history data, and converting the external features into external feature vectors; respectively calculating a second mean, a second median value, and a standard deviation of the external eigenvector; constructing a variable dispersion index based on the second mean, the second median value, and the standard deviation; Determining a first variable discrete threshold, and constructing the non-time series feature screening function model based on the variable discreteness index and the first variable discrete threshold; The fourth detection submodule is specifically configured to: Filter the external features based on business characteristics to obtain user-level features, product-level features, and traffic-level features; Combining the user-level features, the product-level features, and the traffic-level features into a derived feature vector; splicing the external feature vector, the derived feature vector and the feature data to form a spliced ​​vector; Constructing a second XGBOOST anomaly detection model based on the XGBOOST algorithm using the concatenated vector and the label; The fifth detection submodule is specifically configured to: The external feature is constructed as a categorical external feature based on the consistency of the external information time, and the external feature is constructed as a numerical external feature based on the growth rate of the external information time; Merging the categorical external features and the numerical external features into the derived feature vector, and constructing the LSTM indicator prediction model based on the LSTM algorithm; The sixth detection submodule is specifically configured to: Obtaining actual values ​​and forecast values ​​of current business expenses, and obtaining error ratios of actual values ​​and error values ​​based on the actual values ​​and the forecast values; Determine a second variable discrete threshold, and construct the proportion abnormality discrimination model based on the error proportion and the second variable discrete threshold.

3. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the computer program, the steps of the business data decision method according to claim 1 are implemented.

4. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the business data decision method according to claim 1 are implemented.

Images