Method and device for troubleshooting abnormal causes of transaction messages

Abstract

The purpose of this application is to provide a method and device for troubleshooting the causes of abnormalities in transaction messages. Compared to the prior art, this application screens multiple fields from various fields in the transaction message as abnormality dimensions; determines an abnormality troubleshooting combination based on the abnormality dimensions and the transaction message, wherein the abnormality troubleshooting combination includes several abnormality dimensions; and troubleshoots the transaction message based on the abnormality troubleshooting combination to determine the cause of the abnormality. This method of filtering transaction message fields and combining abnormality dimensions can achieve a high abnormality troubleshooting speed while meeting the quality requirements of abnormality troubleshooting.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a technology for troubleshooting abnormal causes of transaction messages. Background Art

[0002] During the payment and clearing process, UnionPay or clearing companies perform clearing services based on transaction messages provided by banks. For failed transactions, they need to investigate and determine the abnormal reasons for the failure. Specifically, they investigate the transaction messages from different dimensions to determine the abnormal reasons for the failure. Identifying the abnormal reasons facilitates targeted guidance in the payment and clearing process, thereby improving the transaction acceptance rate.

[0003] Existing troubleshooting methods mainly include: 1. Dimension-by-dimensional troubleshooting, checking whether the content or format of each single dimension is abnormal. This method cannot solve the situation where the cause of the anomaly is a combination of multiple dimensions; 2. Manual troubleshooting, determining the one or more dimensions where the anomaly occurs through manual verification. This method is inefficient and highly dependent on the original anomaly. It may not be able to accurately identify the cause of the anomaly that has not occurred; 3. Exhaustive troubleshooting of dimension combinations, that is, checking transaction messages based on each dimension and dimension combination. This method is extremely computationally intensive, resulting in low troubleshooting efficiency. Summary of the Invention

[0004] The purpose of this application is to provide a method and device for troubleshooting abnormal causes of transaction messages.

[0005] According to one aspect of the present application, a method for troubleshooting abnormal causes of transaction messages is provided, wherein the method includes:

[0006] Filtering multiple fields from various fields of the transaction message as abnormal dimensions;

[0007] Determining an abnormality troubleshooting combination according to the abnormality dimension and the transaction message, wherein the abnormality troubleshooting combination includes a plurality of abnormality dimensions;

[0008] The transaction message is checked according to the abnormality checking combination to determine the cause of the abnormality.

[0009] Furthermore, a single-dimensional quantitative index and a corresponding threshold are preset, and the screening of multiple fields from various fields of the transaction message as abnormal dimensions includes:

[0010] Filtering multiple fields of the transaction message as abnormal dimensions based on the single-dimensional quantitative index and the corresponding threshold;

[0011] The single-dimensional quantitative index includes at least one of missing rate, dispersion and information content;

[0012] The missing rate is the proportion of transaction messages with empty field content in all transaction messages;

[0013] The degree of dispersion is the proportion of the total number of characteristic values of the field in all transaction messages, wherein the characteristic values are different contents of the field;

[0014] The amount of information is the difference between 1 and the normalized information entropy of the field.

[0015] Furthermore, a combination quantitative index and a combination threshold are preset, and the abnormality troubleshooting combination is determined based on the abnormality dimension and the transaction message, wherein the abnormality troubleshooting combination includes several abnormality dimensions including:

[0016] Performing dimension-raising combinations on a plurality of basic dimensions according to the abnormal dimension to generate an abnormal dimension combination including the basic dimension, wherein the basic dimension is initially the abnormal dimension;

[0017] Calculate the combined quantitative index value of the abnormal dimension combination according to the transaction message and the combined quantitative index;

[0018] According to the combined quantitative index value, it is determined whether the abnormal dimension combination meets the preset evaluation rules. If it does, the abnormal dimension combination is updated to the basic dimension and the above operation is repeated; otherwise,

[0019] If the evaluation result does not meet the combination threshold, the basic dimension is used as an abnormality troubleshooting combination.

[0020] Furthermore, wherein the sliding window size is preset, after screening out multiple fields from various fields of the transaction message as abnormal dimensions, the method further includes:

[0021] All the abnormal dimensions are combined into an abnormal dimension sequence;

[0022] The step of performing dimension-raising combination on several basic dimensions according to the abnormal dimension includes:

[0023] The abnormal dimension that is last sorted in the abnormal latitude sequence among the abnormal dimensions of the basic dimension is used as the ascending dimension mark of the basic dimension;

[0024] The abnormal dimensions within the sliding window size range located after the dimension-raising mark in the abnormal dimension sequence are respectively added to the basic dimension to generate a plurality of abnormal dimension combinations corresponding to the basic dimension.

[0025] Furthermore, the step of forming all the abnormal dimensions into an abnormal dimension sequence includes:

[0026] All the abnormal dimensions are sorted in descending order of the single-dimensional quantitative index to form an abnormal dimension sequence.

[0027] Furthermore, the calculating of the combined quantitative index value of the abnormal dimension combination according to the transaction message and the combined quantitative index includes:

[0028] Determining, based on the transaction message, all characteristic values and occurrence counts of each abnormal dimension in the abnormal dimension combination, wherein the characteristic value is the different content of the field corresponding to the abnormal dimension in the transaction message;

[0029] Performing data division on the transaction message according to the characteristic value and the number of occurrences of each abnormal dimension in the abnormal dimension combination;

[0030] The combined quantitative index value is calculated based on the combined quantitative index and the data division result.

[0031] Furthermore, dividing the transaction message into data according to the characteristic value and the number of occurrences of each abnormal dimension in the abnormal dimension combination includes:

[0032] The feature value of each abnormal dimension whose occurrence frequency exceeds the preset threshold is used as the division mark of the abnormal dimension;

[0033] Sequentially traverse each abnormal dimension in the abnormal dimension combination, and divide the transaction message into one or more first data sets and a second data set according to the division mark of the traversed abnormal dimension, wherein the first data set is a set of transaction messages containing a certain division mark, and the second data set is a set of transaction messages not containing any division mark;

[0034] Repeat the above operation on the first data set and the second data set according to the partition mark of the next abnormal dimension traversed, so that each first data set and second data set is divided into one or more first data sets and one second data set;

[0035] Repeat the above division operation until the abnormal dimension combination is traversed.

[0036] Furthermore, the combined quantitative index includes high-frequency coverage and combined information volume, and calculating the combined quantitative index value according to the combined quantitative index and the data division result includes:

[0037] The high-frequency coverage rate is the ratio of the number of transaction messages of all first data sets corresponding to the last abnormal dimension in the abnormal dimension combination to all transaction messages;

[0038] The combined information amount is generated according to information entropy determined by the first data set and the second data set corresponding to the last two abnormal dimensions in the abnormal dimension combination.

[0039] Furthermore, generating the combined information amount according to the information entropy determined by the first data set and the second data set corresponding to the last two abnormal dimensions in the abnormal dimension combination includes:

[0040] Calculate the proportion of the number of transaction messages in all first and second data sets corresponding to the second-to-last abnormal dimension in the abnormal dimension combination to all transaction messages, and use the proportion as the first coverage rate;

[0041] For each first data set and second data set corresponding to the second-to-last abnormal dimension, calculate the proportion of the number of transaction messages in all first data sets and second data sets generated by dividing the data set by the last abnormal dimension in the transaction messages of the data set, and use this proportion as the second coverage rate;

[0042] Calculating the information entropy of each of the first data set and the second data set corresponding to the penultimate abnormal dimension according to the second coverage rate and normalizing the information entropy;

[0043] The difference between 1 and the normalized information entropy is taken as the information content of each first data set and second data set corresponding to the penultimate abnormal dimension;

[0044] The information amount of each first data set and second data set corresponding to the penultimate abnormal dimension is summed up with the product of the first coverage rate thereof to obtain the combined information amount of the abnormal dimension combination.

[0045] Furthermore, a multi-branch tree can be used for data partitioning, that is, all transaction messages are used as root nodes, the first data set and the second data set divided according to the first abnormal dimension in the abnormal dimension combination are used as first-level child nodes, and so on, the first data set and the second data set divided according to the last abnormal dimension are used as leaf nodes.

[0046] Furthermore, the preset evaluation rule includes a lifting threshold, and judging whether the abnormal dimension combination meets the preset evaluation rule according to the combined quantitative index value includes:

[0047] Determine the high-frequency coverage rate and the improvement ratio of the combined information volume of the abnormal dimension combination compared with its corresponding basic dimension;

[0048] It is determined whether the improvement ratio exceeds the improvement threshold.

[0049] Furthermore, before screening out multiple fields of the transaction message as abnormal dimensions based on the single-dimensional quantitative index and the corresponding threshold, the method further includes:

[0050] If the single-dimensional quantitative index includes the discrete degree and / or the information amount, and the content of the field is a random number in a certain value range, the value range of the field content is divided into a number of limited characteristic intervals;

[0051] Using the characteristic interval as a characteristic value of the abnormal dimension, and determining the degree of dispersion and / or the amount of information according to the characteristic value;

[0052] Among them, the filtering out multiple fields of the transaction message as abnormal dimensions based on the single-dimensional quantitative index and the corresponding threshold includes: filtering out multiple fields of the transaction message as abnormal dimensions based on the single-dimensional quantitative index including the discrete degree and / or the information amount and its corresponding threshold.

[0053] According to another aspect of the present application, a computer-readable medium is provided, on which computer-readable instructions are stored. The computer-readable instructions can be executed by a processor to implement the operations of the aforementioned method.

[0054] According to another aspect of the present application, a device for troubleshooting abnormal causes of transaction messages is provided, wherein the device includes:

[0055] one or more processors; and

[0056] A memory storing computer-readable instructions that, when executed, cause the processor to perform the operations of the above-described method.

[0057] Compared to existing technologies, this application selects multiple fields from various fields of the transaction message as anomaly dimensions; determines an anomaly investigation combination based on the anomaly dimensions and the transaction message, wherein the anomaly investigation combination includes several anomaly dimensions; and investigates the transaction message based on the anomaly investigation combination to determine the cause of the anomaly. This method of filtering transaction message fields and combining anomaly dimensions achieves a high anomaly investigation speed while meeting the quality requirements of anomaly investigation. BRIEF DESCRIPTION OF THE DRAWINGS

[0058] Other features, objects and advantages of the present invention will become more apparent upon reading the detailed description of non-limiting embodiments made with reference to the following drawings:

[0059] Figure 1 A flow chart showing a method for troubleshooting abnormal causes of transaction messages according to one aspect of the present application is shown;

[0060] Figure 2 A flow chart of a method for troubleshooting abnormal causes of transaction messages according to a preferred embodiment of the present application is shown.

[0061] The same or similar reference numerals in the drawings represent the same or similar components. DETAILED DESCRIPTION

[0062] The present invention is further described in detail below with reference to the accompanying drawings.

[0063] In a typical configuration of the present application, the terminal, the device of the service network and the trusted party all include one or more processors (CPUs), input / output interfaces, network interfaces and memories.

[0064] Memory may include non-permanent storage in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. Memory is an example of a computer-readable medium.

[0065] Computer-readable media includes permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. The information can be computer-readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassettes, magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer-readable media does not include non-transitory media such as modulated data signals and carrier waves.

[0066] In order to further illustrate the technical means adopted by this application and the effects achieved, the technical solution of this application is clearly and completely described below in combination with the accompanying drawings and preferred embodiments.

[0067] Figure 1 A method for troubleshooting abnormal causes of transaction messages provided in one aspect of the present application is shown, wherein the method includes:

[0068] S11: screening multiple fields from various fields of the transaction message as abnormal dimensions;

[0069] S12 determines an abnormality troubleshooting combination based on the abnormality dimension and the transaction message, wherein the abnormality troubleshooting combination includes a plurality of abnormality dimensions;

[0070] S13 checks the transaction message according to the abnormality checking combination to determine the cause of the abnormality.

[0071] In this embodiment, in step S11, multiple fields are screened out from various fields of the transaction message as abnormal dimensions.

[0072] Here, each field of the transaction message is used as a possible troubleshooting dimension. For example, the transaction message has fields such as transaction channel, payment method, payment amount, and transaction time. Errors in the content of each field may cause transaction failure. Therefore, valuable fields are screened out from all transaction messages with failed transactions as abnormal dimensions, rather than treating all fields as abnormal dimensions, to reduce the amount of data that needs to be processed during the abnormality troubleshooting process.

[0073] In a preferred embodiment, see Figure 2 ,in, Figure 2 Steps S22 and S23 in Figure 1 Steps S12 and S13 in the embodiment are identical or substantially identical and are therefore not further described herein but are incorporated herein by reference. Step S21 includes presetting a single-dimensional quantitative index and a corresponding threshold, and screening multiple fields of the transaction message as abnormal dimensions based on the single-dimensional quantitative index and the corresponding threshold.

[0074] Specifically, the one-dimensional quantitative indicators include at least any one of missing rate, discreteness and information volume; wherein, the missing rate is the proportion of transaction messages with empty field content in all transaction messages; the discreteness is the proportion of the total number of characteristic values of the field in all transaction messages, wherein the characteristic value is the different content of the field; the information volume is the difference between 1 and the normalized information entropy of the field.

[0075] Here, valuable fields should have the following characteristics: first, the vast majority of transaction messages should have valid content of this field, so that when this field is used as an abnormal dimension for investigation, as many transaction messages as possible can be covered, that is, the missing rate of this field should be lower than the threshold set according to the actual application scenario; second, the content of this field should be characteristic and generalized, that is, the discrete degree of this field should be lower than the threshold set according to the actual application scenario. For example, if the field is the payment method, the content of this field (that is, the characteristic value) includes Alipay, WeChat, POS machine and bank card transfer. Since the characteristic value is highly generalized, it has As an abnormality investigation dimension, the value of investigating and analyzing each characteristic value is low. On the contrary, if the field is a transaction code, since the characteristic values of the field are non-repetitive and the degree of discreteness is extremely high, the effectiveness of investigating the cause of the abnormality through the characteristic values of the transaction code field is extremely low, so it should not be used as an abnormality dimension. Finally, the content of the field as an abnormality dimension should be valuable content. The value of information is represented by the amount of information. The amount of information is calculated based on the information entropy. The lower the information entropy, the higher the amount of information, indicating that the value of the information is higher. Therefore, the amount of information of the field as an abnormality dimension should be higher than the threshold set according to the actual application scenario. In a preferred embodiment, each field should be screened according to these three single-dimensional quantitative indicators, so as to select fields with higher comprehensive value as the dimension of abnormality investigation. However, it should be clear that the single-dimensional quantitative indicators can be freely combined according to the actual application scenario. This application does not limit the number and type of single-dimensional quantitative indicators used.

[0076] Specifically, the calculation formula of information entropy is: In the process of calculating the information content of a field in a transaction message, n is the total number of characteristic values of the field, p(x i ) is the ratio of the total number of eigenvalues of the field i to the total number of non-null values in the field. The calculated information entropy is first normalized. Because the total number of non-null values and the total number of eigenvalues vary across fields, normalization is necessary to make the information entropies of different fields comparable. The difference between 1 and the normalized information entropy is then used as the information content of the field. This ensures that the calculated information content is proportional to the field value, which conforms to the naive understanding of the relationship between information content and information value.

[0077] Furthermore, if the single-dimensional quantitative index includes the degree of discreteness and / or the amount of information, and the content of the field is a random number in a certain value range, the value range of the field content is divided into several limited characteristic intervals; the characteristic interval is used as the characteristic value of the abnormal dimension, and the degree of discreteness and / or the amount of information is determined based on the characteristic value; based on the single-dimensional quantitative index containing the degree of discreteness and / or the amount of information and its corresponding threshold value, multiple fields in the transaction message are screened out as abnormal dimensions.

[0078] Here, the determination of the degree of dispersion and the amount of information must be based on the characteristic value of the field. When the value range of a field content is a random number within a certain value interval, for example, the transaction time is any time point within a certain time span, and the transaction amount is any amount within the transaction amount range, directly using the random number as the characteristic value to analyze the degree of dispersion and the amount of information in this case cannot accurately reflect the effectiveness of the field as an anomaly dimension. Therefore, based on the actual application scenario, the value range of the field content is divided into several characteristic intervals, and the characteristic intervals are used as the characteristic values of the field. It can be understood that transaction messages with field content belonging to the same characteristic interval have the same characteristic value for this field. In this way, the discretely distributed field content is classified and aggregated according to the data distribution characteristics, thereby effectively evaluating such fields based on the classified and aggregated characteristic values. Taking the transaction amount field as an example, the transaction amount can be divided into several amount intervals, and the amount intervals are used as the characteristic values of the transaction amount field. The transaction amount field content of the transaction messages is classified according to the amount intervals, and the number of transaction messages falling in each amount interval is counted. The single-dimensional quantitative index value is calculated based on the statistical results.

[0079] Continuing with this embodiment, in step S12, an abnormality troubleshooting combination is determined according to the abnormality dimension and the transaction message, wherein the abnormality troubleshooting combination includes several abnormality dimensions.

[0080] Here, after filtering out the abnormal dimensions that are valuable for abnormality investigation, if only a single abnormal dimension is used for investigation, it is only possible to find out whether the field content corresponding to the abnormal dimension is incorrect and / or whether the format is correct, etc. However, in actual application scenarios, there are often abnormal combinations of multiple fields. For example, the payment amount exceeds the upper limit of the transaction amount of a certain payment method. In this case, the combination of the transaction amount field and the payment method field is incorrect. If the transaction amount field or the payment method field is used alone as an abnormal dimension for abnormality investigation, the cause of the abnormality cannot be correctly determined. Based on this situation, the abnormal dimensions that have been filtered out are combined, and the transaction message is divided according to the combination, so as to determine whether the combination has the possibility of being used as an abnormality investigation combination based on the effect of the data division. In this way, the abnormal combination of fields can be correctly captured, which improves the effectiveness and accuracy of abnormality investigation.

[0081] Furthermore, a combination quantitative index and a combination threshold are preset, and the abnormality troubleshooting combination is determined based on the abnormal dimension and the transaction message, wherein the abnormality troubleshooting combination contains several abnormal dimensions, including: performing dimensionality-upgrading combination on several basic dimensions according to the abnormal dimension to generate an abnormal dimension combination containing the basic dimension, wherein the basic dimension is initially the abnormal dimension; calculating the combination quantitative index value of the abnormal dimension combination according to the transaction message and the combination quantitative index; judging whether the abnormal dimension combination meets the preset evaluation rules according to the combination quantitative index value, if so, updating the abnormal dimension combination to the basic dimension and repeating the above operation; otherwise, if the evaluation result does not meet the combination threshold, using the basic dimension as the abnormality troubleshooting combination.

[0082] Here, each of the selected anomaly dimensions is used as the initial base dimension for a dimensionality-increasing combination. Here, dimensionality-increasing combination means that the number of anomaly dimensions in the generated anomaly dimension combination gradually increases. Specifically, one or more anomaly dimensions are combined with the base dimension using a specific strategy to generate the anomaly dimension combination. In this way, the anomaly dimension combination is composed entirely of the selected anomaly dimensions, ensuring the effectiveness of the anomaly dimension combination in anomaly detection. At the same time, by performing multiple dimensionality-increasing combinations on the base dimension, we maximize coverage of possible combinations and ensure multi-angle anomaly detection.

[0083] Furthermore, a sliding window size is preset, and after the screening out of multiple fields from each field of the transaction message as abnormal dimensions, the method further includes: grouping all the abnormal dimensions into an abnormal dimension sequence; wherein, the dimensionality-raising combination of several basic dimensions according to the abnormal dimensions includes: taking the abnormal dimension that is last sorted in the abnormal dimension sequence among the various abnormal dimensions of the basic dimension as the dimensionality-raising mark of the basic dimension; and adding the abnormal dimensions within the sliding window size range located after the dimensionality-raising mark in the abnormal dimension sequence to the basic dimension, respectively, to generate several abnormal dimension combinations corresponding to the basic dimension.

[0084] Here, the idea of the sliding window algorithm is adopted to perform a dimensionality-raising combination on each basic dimension by adding one abnormal dimension each time. The size of the sliding window is the number of abnormal dimension combinations generated by one dimensionality-raising combination. Specifically, the abnormal dimension ranked last in the basic dimension is used as the dimensionality-raising mark, and the sliding window is set after the dimensionality-raising mark. Several abnormal dimensions within the sliding window range are combined with the basic dimension to generate multiple abnormal dimension combinations, wherein the number of abnormal dimensions generated by a single dimensionality-raising combination is equal to the size of the sliding window. The magnitude of each dimensionality-raising is 1, so that a high coverage of the combination depth is achieved, and the depth is the number of abnormal dimensions of the abnormal dimension combination. Since in the scenario where a field combination causes transaction anomalies, the number of fields in the field combination is an important factor in anomaly investigation, the high coverage of the abnormal dimension combination depth ensures that the transaction anomalies caused by the field combination can be fully investigated. For example, a transaction message indicates that a transaction was conducted at 2 a.m. on a certain trading platform using a bank card payment method. However, the trading platform stipulates that bank card payment can only be made after 8 a.m. on the same day. In this case, the abnormal cause of the transaction message is an error in the combination of the three fields: transaction time, transaction channel, and payment method. Consequently, the abnormal cause of the transaction message can only be correctly identified when there is an abnormal dimension combination with a dimension number of 3 (i.e., the number of abnormal dimensions in the abnormal dimension combination is 3).

[0085] Furthermore, forming all the abnormal dimensions into an abnormal dimension sequence includes: sorting all the abnormal dimensions in descending order of the single-dimensional quantitative index to form an abnormal dimension sequence.

[0086] Here, according to the needs of the actual application scenario, one of the single-dimensional quantitative indicators can be used as the sorting standard, or multiple single-dimensional quantitative indicators can be integrated through a certain strategy, and the integrated result can be used as the sorting standard. All the screened abnormal dimensions are sorted in descending order according to the integrated results of one single-dimensional quantitative indicator or multiple single-dimensional quantitative indicators, so that the abnormal dimensions with higher rankings have better evaluation effects. Furthermore, only the several abnormal dimensions that are ranked higher in the abnormal dimension sequence can be used as the initial basic dimensions, and only on the basis of such abnormal dimensions can dimensionality increase combination be performed, and other abnormal dimensions that are ranked lower and are not the initial basic dimensions can be used as the combination objects of dimensionality increase combination when the sliding window is covered. In the process of generating abnormal dimension combinations, this method divides the uses of abnormal dimensions according to the evaluation results of abnormal dimensions, uses a part of abnormal dimensions with better evaluation results as the basis of dimensionality increase combination, and uses the other part as the combination objects, thereby achieving reasonable combination configuration.

[0087] Continuing with the above, after performing a dimensionality-enhancing combination to generate several abnormal dimension combinations, the combined quantitative index value for each abnormal dimension combination is calculated based on the transaction message, i.e., the preset combined quantitative index. This method is used to evaluate the generated abnormal dimension combinations to determine whether they represent an optimal combination for abnormality detection.

[0088] Specifically, all characteristic values and the number of occurrences of each abnormal dimension in the abnormal dimension combination are determined based on the transaction message; data of the transaction message is divided according to the characteristic values and the number of occurrences of each abnormal dimension in the abnormal dimension combination; and the combined quantitative index value is calculated based on the combined quantitative index and the data division result.

[0089] Here, an evaluation method for abnormal dimension combinations is provided, in which the transaction message is divided into data according to the characteristic values of each abnormal dimension in the abnormal dimension combination, and the combined quantitative index is calculated based on the data division result. Since the abnormality screening method provided by this application is to determine several transaction message fields or field combinations with a higher probability of abnormality (i.e., the initial basic dimension and the abnormal dimension combination), it guides the manual or machine screening of the aforementioned fields or field combinations of the transaction message, and the key to determining the probability lies in whether a better data division can be performed based on the field or field combination, including whether the transaction message is reasonably classified (determined by the characteristic values of each abnormal dimension in the abnormal dimension combination), whether the number of transaction messages under each category is reasonable (determined according to the number of occurrences of the characteristic value), if the data division is better, it means that the field or field combination should be used as the abnormal dimension or abnormal dimension combination for abnormal screening.

[0090] Specifically, the data division of the transaction message according to the characteristic values and the number of occurrences of each abnormal dimension in the abnormal dimension combination includes: taking the characteristic value of each abnormal dimension whose number of occurrences exceeds a preset threshold as the division mark of the abnormal dimension; sequentially traversing each abnormal dimension in the abnormal dimension combination, and dividing the transaction message into one or more first data sets and one second data set according to the division mark of the traversed abnormal dimension, wherein the first data set is a set of transaction messages containing a certain division mark, and the second data set is a set of transaction messages that does not contain any division mark; repeating the above operation on the first data set and the second data set according to the division mark of the next abnormal dimension traversed, so that each first data set and second data set are divided into one or more first data sets and one second data set; repeating the above division operation until the abnormal dimension combination is traversed.

[0091] Here, a specific data partitioning method is provided. Since the number of occurrences of the characteristic values of each abnormal dimension is different, some characteristic values appear very rarely in the corresponding fields. If data is partitioned according to such characteristic values, there will be very few transaction message data under this category. There is no need to classify such characteristic values with extremely low transaction message coverage separately. Therefore, the number of occurrences threshold of each abnormal dimension is set according to the actual application scenario. Only when the characteristic value of the abnormal dimension exceeds the threshold, the characteristic value is used as a partition mark, and the transaction message is partitioned. The characteristic values with a number of occurrences below the corresponding threshold are aggregated and merged. This operation reduces unnecessary data partitioning operations.

[0092] Continuing with the above, after determining the partitioning markers for each anomaly dimension, the transaction messages are hierarchically partitioned according to the order of the anomaly dimension combination. First, all transaction messages are partitioned according to the anomaly dimension ranked first in the anomaly dimension combination. For example, if n partitioning markers are determined for the first anomaly dimension, all transaction messages are partitioned into n+1 transaction message sets, where n are first data sets, each corresponding to a partitioning marker, containing all transaction messages with field content equal to the partitioning marker, and one is a second data set, containing all transaction messages except those included in the first data set. These n+1 transaction message sets are further partitioned according to the feature value of the second-ranked anomaly dimension in the dimension combination. This process is repeated until the data partitioning of each data set is completed according to the last anomaly dimension in the anomaly dimension combination. Here, since the anomaly dimension combination is generated from a descending sequence of anomaly dimensions, the evaluation results of anomaly dimensions ranked earlier in the anomaly dimension combination are superior to those ranked later. Consequently, hierarchical data partitioning of the transaction messages according to the original order can achieve more optimal data partitioning.

[0093] Furthermore, a multi-tree format can be used for data partitioning. Specifically, all transaction messages are used as the root node, and the first and second datasets partitioned according to the first anomaly dimension in the anomaly dimension combination are used as first-level child nodes. Similarly, the first and second datasets partitioned according to the last anomaly dimension are used as leaf nodes. Using a multi-tree format for data partitioning provides a clearer hierarchy.

[0094] Furthermore, the combined quantitative index includes high-frequency coverage and combined information volume. The calculation of the combined quantitative index value based on the combined quantitative index and the data division result includes: taking the proportion of the number of transaction messages of all first data sets corresponding to the last abnormal dimension in the abnormal dimension combination in all transaction messages as the high-frequency coverage; and generating the combined information volume based on the information entropy determined by the first data set and the second data set corresponding to the last two abnormal dimensions in the abnormal dimension combination.

[0095] Here, the quality of transaction message data segmentation using anomaly dimension combinations is evaluated using high-frequency coverage and combined information volume. High-frequency coverage measures whether the data segmentation results for this anomaly dimension combination cover as many transaction messages as possible. The more transaction messages covered, the greater the likelihood of anomalies occurring within this anomaly dimension combination. Combined information volume assesses whether the data segmentation for this anomaly dimension combination achieves a reasonable quantitative distribution. In anomaly troubleshooting scenarios, the final datasets generated by data segmentation must be quantitatively diverse. The greater the diversity in the segmentation results, the greater the information content represented by the results, and the more valuable the segmentation. For example, if the segmentation results for a certain anomaly dimension combination show a uniform distribution of transaction messages with no significant quantitative differences, this indicates that the anomaly dimension combination cannot identify a specific field content combination with a high probability of anomaly occurrence. All field combinations have the same probability of anomaly occurrence, and this segmentation cannot effectively guide manual or machine-based troubleshooting. Conversely, if the segmentation results show that a specific field content combination covers the majority of transaction messages, this indicates that the probability of anomalies occurring within this field content combination is high during anomaly troubleshooting for this anomaly dimension combination, and therefore, this field content combination should be prioritized for investigation.

[0096] Specifically, the high-frequency coverage rate considers the coverage degree of all transaction messages by the final data partitioning result, and the data partitioning process is performed only according to the partitioning mark. The transaction messages corresponding to the characteristic values of the non-partitioning mark are summarized in the second data set, and no data partitioning is performed. Therefore, when calculating the high-frequency coverage rate, only the coverage degree of all transaction messages by the first data set in the final partitioning result is considered; and the combined information volume considers the data distribution differences caused by data partitioning. The data partitioning of the last abnormal dimension in the abnormal dimension combination on the corresponding data set of the previous abnormal dimension represents the final data distribution of the abnormal dimension combination. Therefore, the combined information volume is generated based on the information entropy determined based on the first data set and the second data set corresponding to the last two abnormal dimensions in the abnormal dimension combination.

[0097] Furthermore, the generation of the combined information volume according to the information entropy determined for the first data set and the second data set corresponding to the last two abnormal dimensions in the abnormal dimension combination includes: calculating the proportion of the number of transaction messages in all first data sets and second data sets corresponding to the second-to-last abnormal dimension in the abnormal dimension combination in all transaction messages, and using it as the first coverage rate; for each first data set and second data set corresponding to the second-to-last abnormal dimension, calculating the proportion of the number of transaction messages in all first data sets and second data sets generated by dividing the data set by the last abnormal dimension in the transaction messages of the data set, and using the proportion as the second coverage rate; calculating the information entropy of each first data set and second data set corresponding to the second-to-last abnormal dimension according to the second coverage rate and normalizing the information entropy; taking the difference between 1 and the normalized information entropy as the information volume of each first data set and second data set corresponding to the second-to-last abnormal dimension; summing the information volume of each first data set and second data set corresponding to the second-to-last abnormal dimension and the product of its first coverage rate to obtain the combined information volume of the abnormal dimension combination.

[0098] Here, a specific calculation method for the combined information volume is provided. Since the quantity scale of the second data set is also part of the overall data distribution, the second data set needs to participate in the process of determining the combined information volume.

[0099] Furthermore, judging whether the abnormal dimension combination complies with the preset evaluation rules based on the combined quantitative index value includes determining the high-frequency coverage of the abnormal dimension combination and the improvement ratio of the combined information volume compared with its corresponding basic dimension; and judging whether the improvement ratio exceeds the improvement threshold.

[0100] Here, for each abnormal dimension combination generated, first determine whether it has a significant improvement compared to the basic dimension. Specifically, the improvement mainly considers whether the improvement ratio of the high-frequency coverage set combination information volume compared to the previous one exceeds the preset improvement threshold. If it exceeds the improvement threshold, it means that this dimensionality upgrade combination is necessary, and further dimensionality upgrade combination can be performed. Specifically, the abnormal dimension combination is updated to the basic dimension and then the process of determining the dimensionality upgrade combination and the improvement ratio is repeated; otherwise, if the improvement ratio does not exceed the improvement threshold, it means that this dimensionality upgrade operation has no obvious effect, and there is no need to retain the result of this dimensionality upgrade combination. Accordingly, there is no need to perform further dimensionality upgrade operations. Specifically, the basic dimension can be used as an abnormality screening combination. In this way, subsequent operations are performed only when it is determined that there is a need to continue the dimensionality upgrade combination, which avoids unnecessary dimensionality upgrade combination operations and reduces resource waste during implementation. It should be noted that here, only the improvement ratios of abnormal dimension combinations generated from the same initial basic dimension are sequentially compared, and only one abnormal dimension combination generated by the recursive dimension-raising combination of the initial basic dimension is retained. Abnormal dimension combinations generated from different initial basic dimensions are not compared. Therefore, each initial basic dimension should correspond to an abnormal dimension combination, and these abnormal dimension combinations are the basis for abnormality screening. Understandably, if the improvement ratio of the first dimension-raising combination of an initial basic dimension is lower than the improvement threshold, then the initial basic dimension is directly used as one of the bases for abnormality screening.

[0101] In this embodiment, in step S13, the transaction message is checked according to the abnormality checking combination to determine the cause of the abnormality.

[0102] Here, specific anomaly troubleshooting tasks, whether manual or machine, are guided based on the identified anomaly troubleshooting combinations and / or initial basic dimensions. For example, the corresponding fields of each transaction message can be extracted based on the identified anomaly dimension combinations and / or initial basic dimensions, and then the presence of errors in each extracted field combination can be determined.

[0103] Compared to existing technologies, this application selects multiple fields from various fields of the transaction message as anomaly dimensions; determines an anomaly investigation combination based on the anomaly dimensions and the transaction message, wherein the anomaly investigation combination includes several anomaly dimensions; and investigates the transaction message based on the anomaly investigation combination to determine the cause of the anomaly. This method of filtering transaction message fields and combining anomaly dimensions achieves a high anomaly investigation speed while meeting the quality requirements of anomaly investigation.

[0104] In addition, an embodiment of the present application further provides a computer-readable medium on which computer-readable instructions are stored. The computer-readable instructions can be executed by a processor to implement the aforementioned method.

[0105] The embodiment of the present application further provides a device for troubleshooting abnormal causes of transaction messages, wherein the device includes:

[0106] one or more processors; and

[0107] A memory storing computer-readable instructions that, when executed, cause the processor to perform the operations of the aforementioned method.

[0108] For example, when executed, the computer-readable instructions cause the one or more processors to: filter out a plurality of fields from various fields of the transaction message as abnormal dimensions;

[0109] Determining an abnormality troubleshooting combination according to the abnormality dimension and the transaction message, wherein the abnormality troubleshooting combination includes a plurality of abnormality dimensions;

[0110] The transaction message is checked according to the abnormality checking combination to determine the cause of the abnormality.

[0111] It will be apparent to those skilled in the art that the present invention is not limited to the details of the exemplary embodiments described above and that the invention can be implemented in other specific forms without departing from the spirit or essential features of the invention. Therefore, from any point of view, the embodiments should be regarded as exemplary and non-restrictive, and the scope of the invention is defined by the appended claims rather than the above description, and it is intended that all changes that fall within the meaning and scope of the equivalents of the claims be encompassed within the present invention. Any figure marks in the claims should not be regarded as limiting the claims involved. In addition, it is clear that the word "comprising" does not exclude other units or steps, and the singular does not exclude the plural. Multiple units or devices stated in the device claim may also be implemented by one unit or device through software or hardware. Words such as first and second are used to indicate names and do not indicate any particular order.

Claims

1. A method for troubleshooting abnormal causes of transaction messages, wherein: The method comprises: According to the preset single-dimensional quantitative index and the corresponding threshold, multiple fields in each field of the transaction message are screened out as abnormal dimensions, wherein the single-dimensional quantitative index includes missing rate, discrete degree and information volume, the missing rate is the proportion of transaction messages with empty field content in all transaction messages, the discrete degree is the proportion of the total number of characteristic values of the field in all transaction messages, the characteristic value is the different content of the field, and the information volume is used to characterize the information value of the field content as the abnormal dimension. The calculation method of the information volume is as follows: for the information volume of a certain field of the transaction message, the information entropy is calculated according to the information entropy calculation formula, the obtained information entropy is normalized, and the difference between 1 and the normalized information entropy is used as the information volume, wherein the information entropy calculation formula is n is the total number of eigenvalues of the field, p(x i ) is the ratio of the total number of the ith eigenvalue of the field to the total number of non-null values of the field; the missing rate and discrete degree of the field of the abnormal dimension are lower than the corresponding threshold, and the information content is higher than the corresponding threshold; Preset a combination quantification index and a combination threshold, and perform dimension-raising combination on a plurality of basic dimensions according to the abnormal dimension to generate an abnormal dimension combination including the basic dimension, wherein the basic dimension is initially the abnormal dimension; Calculating a combined quantitative index value for the abnormal dimension combination based on the transaction message and the combined quantitative index, wherein the combined quantitative index includes a high-frequency coverage rate and a combined information volume. The high-frequency coverage rate is used as the proportion of the number of transaction messages of all first data sets corresponding to the last abnormal dimension in the abnormal dimension combination in all transaction messages. The combined information volume is generated based on information entropy determined for the first and second data sets corresponding to the last two abnormal dimensions in the abnormal dimension combination. According to the combined quantitative index value, it is judged whether the abnormal dimension combination meets the preset evaluation rules. If it does, the abnormal dimension combination is updated to the basic dimension, and the above operation of upgrading the basic dimension according to the abnormal dimension is repeated; otherwise, If the evaluation result does not meet the combination threshold, the basic dimension is used as an abnormality troubleshooting combination, wherein the abnormality troubleshooting combination includes several abnormal dimensions; The transaction message is checked according to the abnormality checking combination to determine the cause of the abnormality.

2. The method according to claim 1, wherein After presetting the sliding window size and selecting multiple fields from various fields of the transaction message as abnormal dimensions, the following steps are also included: All the abnormal dimensions are combined into an abnormal dimension sequence; The step of performing dimension-raising combination on several basic dimensions according to the abnormal dimension includes: The abnormal dimension that is last sorted in the abnormal dimension sequence among the abnormal dimensions of the basic dimension is used as the dimension-raising mark of the basic dimension; The abnormal dimensions within the sliding window size range located after the dimension-raising mark in the abnormal dimension sequence are respectively added to the basic dimension to generate a plurality of abnormal dimension combinations corresponding to the basic dimension.

3. The method according to claim 2, wherein: The step of assembling all the abnormal dimensions into an abnormal dimension sequence comprises: All the abnormal dimensions are sorted in descending order of the single-dimensional quantitative index to form an abnormal dimension sequence.

4. The method according to claim 1, wherein The calculating of the combined quantitative index value of the abnormal dimension combination according to the transaction message and the combined quantitative index includes: Determining, based on the transaction message, all characteristic values and occurrence counts of each abnormal dimension in the abnormal dimension combination, wherein the characteristic value is the different content of the field corresponding to the abnormal dimension in the transaction message; Performing data division on the transaction message according to the characteristic value and the number of occurrences of each abnormal dimension in the abnormal dimension combination; The combined quantitative index value is calculated based on the combined quantitative index and the data division result.

5. The method according to claim 3, wherein The data segmentation of the transaction message according to the characteristic value and the number of occurrences of each abnormal dimension in the abnormal dimension combination includes: The feature value of each abnormal dimension whose occurrence frequency exceeds the preset threshold is used as the division mark of the abnormal dimension; Sequentially traverse each abnormal dimension in the abnormal dimension combination, and divide the transaction message into one or more first data sets and a second data set according to the division mark of the traversed abnormal dimension, wherein the first data set is a set of transaction messages containing a certain division mark, and the second data set is a set of transaction messages not containing any division mark; Repeat the above operation on the first data set and the second data set according to the partition mark of the next abnormal dimension traversed, so that each first data set and second data set is divided into one or more first data sets and one second data set; Repeat the above division operation until the abnormal dimension combination is traversed.

6. The method according to claim 1, wherein Generating the combined information amount according to the information entropy determined from the first data set and the second data set corresponding to the last two abnormal dimensions in the abnormal dimension combination includes: Calculate the proportion of the number of transaction messages in all first and second data sets corresponding to the second-to-last abnormal dimension in the abnormal dimension combination to all transaction messages, and use the proportion as the first coverage rate; For each first data set and second data set corresponding to the second-to-last abnormal dimension, calculate the proportion of the number of transaction messages in all first data sets and second data sets generated by dividing the data set by the last abnormal dimension in the transaction messages of the data set, and use this proportion as the second coverage rate; Calculating the information entropy of each of the first data set and the second data set corresponding to the penultimate abnormal dimension according to the second coverage rate and normalizing the information entropy; The difference between 1 and the normalized information entropy is taken as the information content of each first data set and second data set corresponding to the penultimate abnormal dimension; The information amount of each first data set and second data set corresponding to the penultimate abnormal dimension is summed up with the product of the first coverage rate thereof to obtain the combined information amount of the abnormal dimension combination.

7. The method according to claim 6, wherein: Data partitioning can be performed in a multi-branch tree format, with all transaction messages as root nodes, the first and second data sets partitioned according to the first abnormal dimension in the abnormal dimension combination as first-layer child nodes, and so on, with the first and second data sets partitioned according to the last abnormal dimension as leaf nodes.

8. The method according to any one of claims 1, 6 and 7, wherein: The preset evaluation rule includes a lifting threshold, and judging whether the abnormal dimension combination meets the preset evaluation rule according to the combined quantitative index value includes: Determine the high-frequency coverage rate and the improvement ratio of the combined information volume of the abnormal dimension combination compared with its corresponding basic dimension; It is determined whether the improvement ratio exceeds the improvement threshold.

9. The method according to claim 8, wherein Before screening out multiple fields of the transaction message as abnormal dimensions based on the single-dimensional quantitative index and the corresponding threshold, the method further includes: If the single-dimensional quantitative index includes the discrete degree and / or the information amount, and the content of the field is a random number in a certain value range, the value range of the field content is divided into a number of limited characteristic intervals; Using the characteristic interval as a characteristic value of the abnormal dimension, and determining the degree of dispersion and / or the amount of information according to the characteristic value; Among them, the filtering out multiple fields of the transaction message as abnormal dimensions based on the single-dimensional quantitative index and the corresponding threshold includes: filtering out multiple fields of the transaction message as abnormal dimensions based on the single-dimensional quantitative index including the discrete degree and / or the information amount and its corresponding threshold.

10. A computer-readable medium having computer-readable instructions stored thereon, wherein the computer-readable instructions can be executed by a processor to implement the method according to any one of claims 1 to 9.

11. A device for troubleshooting abnormal causes of transaction messages, wherein: The device includes: one or more processors; and A memory storing computer readable instructions which, when executed, cause the processor to perform the operations of the method of any one of claims 1 to 9.

Images