Data checking method and device, and electronic device

Abstract

The application discloses a data checking method and device, and belongs to the technical field of data processing. The method comprises the following steps: in response to a target data checking instruction sent by a central server, a data checking model is acquired through the central server; target data associated with the target data checking instruction of a current local object is acquired; the target data is subjected to aggregation processing, so that a characteristic value of a preset monitoring index corresponding to the target data is obtained; according to the data checking model and the characteristic value of the preset monitoring index, a checking result of whether the target data is abnormal is obtained; and the checking result is sent to the central server. In the method, the data checking model is trained by the central server according to historical data, the data checking model is acquired from the central server by a local server, and the target data of the local object is checked based on the data checking model, and the checking result is uploaded to the central server, so that the data checking efficiency is greatly improved, and the data privacy of the local object is protected.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data processing, in particular to a data checking method and device, an electronic device and a computer readable storage medium. BACKGROUND

[0002] For a group enterprise, it is usually necessary to check the project data of subordinate organizations such as local or subordinate departments, so as to find data abnormality in time. Taking financial data as an example, financial expenditure is the annual revenue and expenditure record of funds approved through a certain procedure, and financial expenditure will be reconciled at the end of each year. Therefore, financial management is an important means to record funds well. Monitoring of financial data and strengthening of checking management of abnormal financial data are beneficial to optimizing expenditure structure and strengthening expenditure management. In the prior art, many aspects of financial management system rely on manual financial data analysis, which is not only low in efficiency, but also prone to errors. SUMMARY

[0003] Embodiments of the present application provide a data checking method and device, which can solve the problem of low efficiency when manually checking data abnormality.

[0004] In a first aspect, the embodiments of the present application disclose a data checking method, comprising:

[0005] In response to a target data checking instruction sent by a central server, a data checking model is acquired through the central server;

[0006] Target data associated with the target data checking instruction of a current local object is acquired;

[0007] The target data is aggregated to obtain a characteristic value of a preset monitoring index corresponding to the target data;

[0008] According to the data checking model and the characteristic value of the preset monitoring index, a checking result indicating whether the target data is abnormal is obtained;

[0009] The checking result is sent to the central server.

[0010] Optionally, after the checking result indicating whether the target data is abnormal is obtained according to the data checking model and the characteristic value of the preset monitoring index, the method further comprises:

[0011] Each group of simulation data corresponding to each preset monitoring index is respectively taken as an input of a preset missing data simulation model to obtain a simulation fitting value corresponding to the preset monitoring index;

[0012] real fitting values corresponding to each of the preset monitoring indicators are obtained by taking each set of real data corresponding to each of the preset monitoring indicators as input of the preset missing data simulation model;

[0013] According to the difference between the simulation fitting value and the real fitting value, the accuracy prediction result of the inspection result is obtained.

[0014] Optionally, the accuracy prediction result of the inspection result is obtained according to the difference between the simulation fitting value and the real fitting value, comprising:

[0015] In the case that the difference between the simulation fitting value and the real fitting value is greater than or equal to a preset difference threshold, a first accuracy prediction result of the inspection result is obtained.

[0016] In the case that the difference between the simulation fitting value and the real fitting value corresponding to each of the preset monitoring indicators is less than the preset difference threshold, a second accuracy prediction result of the inspection result is obtained.

[0017] Optionally, the preset missing data simulation model is constructed based on a ridge regression method.

[0018] Optionally, the data inspection model is a naive Bayes model trained according to historical data, and the inspection result indicating whether the target data is abnormal is obtained according to the data inspection model and the feature value of the preset monitoring indicator, comprising:

[0019] Based on the known abnormal probability in the data inspection model, the known normal probability, the probability of the target feature value of the preset monitoring indicator in the abnormal subset, and the probability of the target feature value of the preset monitoring indicator in the normal subset, a first probability that the target data suspected to be abnormal is judged to be abnormal and a second probability that the target data suspected to be normal is judged to be normal are predicted under the condition that the feature value of the preset monitoring indicator is met.

[0020] According to the first probability and the second probability, the inspection result indicating whether the target data is abnormal is obtained.

[0021] Optionally, the inspection result indicating whether the target data is abnormal is obtained according to the first probability and the second probability, comprising:

[0022] In the case that the first probability is greater than the second probability, the inspection result indicating that the target data is abnormal is obtained.

[0023] In the case that the first probability is less than or equal to the second probability, the inspection result indicating that the target data is normal is obtained.

[0024] Optionally, the obtaining the target data of the current local object associated with the target data checking instruction comprises:

[0025] obtaining local target data associated with the target data checking instruction stored locally by the current local object;

[0026] summarizing the local target data according to a type;

[0027] accessing an association database stored by the central server based on the type, and obtaining a target local object associated with the current local object based on the target data;

[0028] obtaining, through the target local object, associated target data associated with the local target data and stored locally by the target local object;

[0029] merging the local target data and the associated target data according to the type to obtain the target data of the current local object associated with the target data checking instruction.

[0030] In a second aspect, an embodiment of the present application discloses a data checking device, comprising:

[0031] a data checking model obtaining module configured to obtain a data checking model through a central server in response to a target data checking instruction sent by the central server;

[0032] a target data obtaining module configured to obtain target data of a current local object associated with the target data checking instruction;

[0033] a feature value obtaining module configured to perform aggregation processing on the target data to obtain a feature value of a preset monitoring index corresponding to the target data;

[0034] a data checking module configured to obtain a checking result indicating whether the target data is abnormal according to the data checking model and the feature value of the preset monitoring index;

[0035] a checking result uploading module configured to send the checking result to the central server.

[0036] Optionally, the device further comprises:

[0037] a simulation fitting value obtaining module configured to take each group of simulation data corresponding to each preset monitoring index as an input of a preset missing data simulation model to obtain a simulation fitting value corresponding to the corresponding preset monitoring index;

[0038] a real fitting value acquisition module, configured to obtain a real fitting value corresponding to each of the preset monitoring indicators by taking each set of real data corresponding to each of the preset monitoring indicators as an input of the preset missing data simulation model;

[0039] a prediction result acquisition module, configured to obtain an accuracy prediction result of the inspection result according to a difference between the simulation fitting value and the real fitting value.

[0040] Optionally, the prediction result acquisition module is further configured to:

[0041] obtain a first accuracy prediction result of the inspection result in a case where the difference between the simulation fitting value and the real fitting value is greater than or equal to a preset difference threshold value;

[0042] obtain a second accuracy prediction result of the inspection result in a case where the difference between the simulation fitting value and the real fitting value corresponding to each of the preset monitoring indicators is less than the preset difference threshold value.

[0043] Optionally, the preset missing data simulation model is constructed based on a ridge regression method.

[0044] Optionally, the data inspection model is a naive Bayes model trained according to historical data, and the data inspection module is further configured to:

[0045] predict, based on a known abnormal probability, a known normal probability, a probability of a target feature value of the preset monitoring indicator being in an abnormal subset, and a probability of the target feature value of the preset monitoring indicator being in a normal subset in the data inspection model, a first probability that the target data suspected to be abnormal is judged to be abnormal and a second probability that the target data suspected to be normal is judged to be normal under a condition that the feature value of the preset monitoring indicator is satisfied;

[0046] obtain an inspection result indicating whether the target data is abnormal according to the first probability and the second probability.

[0047] Optionally, the obtaining of the inspection result indicating whether the target data is abnormal according to the first probability and the second probability comprises:

[0048] obtaining the inspection result indicating that the target data is abnormal in a case where the first probability is greater than the second probability;

[0049] obtaining the inspection result indicating that the target data is normal in a case where the first probability is less than or equal to the second probability.

[0050] Optionally, the target data acquisition module is further configured to:

[0051] acquire local target data associated with the target data checking instruction and locally stored by a current local object;

[0052] aggregate the local target data according to a type;

[0053] access an association database stored by the central server based on the type, and acquire a target local object associated with the target data based on the target data and the current local object;

[0054] acquire, through the target local object, association target data associated with the local target data and locally stored by the target local object;

[0055] merge the local target data and the association target data according to the type, to obtain target data associated with the target data checking instruction and of the current local object.

[0056] In a third aspect, an electronic device is disclosed, which includes a memory, a processor, and a computer program stored in the memory and executable on the processor, and the processor implements the data checking method disclosed in the embodiments of the present application when executing the computer program.

[0057] In a fourth aspect, a computer readable storage medium is disclosed, which stores a computer program, and the program implements the steps of the data checking method disclosed in the embodiments of the present application when executed by a processor.

[0058] The data checking method disclosed in the embodiments of the present application acquires a data checking model through the central server in response to a target data checking instruction sent by the central server, acquires target data associated with the target data checking instruction and of a current local object, performs aggregation processing on the target data to obtain a characteristic value of a preset monitoring index corresponding to the target data, obtains a checking result indicating whether the target data is abnormal according to the data checking model and the characteristic value of the preset monitoring index, and sends the checking result to the central server, thereby sufficiently improving the data checking efficiency.

[0059] The above description is only a summary of the technical solutions of the present application. In order to more clearly understand the technical means of the present application, the embodiments of the present application can be implemented according to the content of the description, and in order to make the above and other purposes, features and advantages of the present application more obvious and easy to understand, the following specific embodiments of the present application are described. BRIEF DESCRIPTION OF DRAWINGS

[0060] In order to make the purposes, technical solutions, and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are some but not all of the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by a person of ordinary skill in the art without creative work fall within the protection scope of the present application.

[0061] Figure 1 is one of flowcharts of the data checking method disclosed by the embodiments of the present application;

[0062] Figure 2 is a schematic diagram of an application scenario of the data checking method disclosed by the embodiments of the present application;

[0063] Figure 3 is the second flowchart of the data checking method disclosed by the embodiments of the present application;

[0064] Figure 4 is one of structural schematic diagrams of the data checking device disclosed by the embodiments of the present application;

[0065] Figure 5 is the second structural schematic diagram of the data checking device disclosed by the embodiments of the present application;

[0066] Figure 6 a block diagram of an electronic device for performing the method according to the present application is schematically shown; and

[0067] Figure 7 a storage unit for holding or carrying program code for implementing the method according to the present application is schematically shown. DETAILED DESCRIPTION

[0068] The technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are some but not all of the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by a person of ordinary skill in the art without creative work fall within the protection scope of the present application.

[0069] The data checking method described in the embodiments of the present application adds an artificial intelligence link on the basis of the original data service architecture, maintains the stability of the original mature service without affecting the original architecture, and has a simple structure. The method can be flexibly applied to various central system management services for local systems, solves the problem that many links of the current data service management system are managed by manpower, and has low efficiency and data analysis errors caused by insufficient manpower experience.

[0070] The data checking method disclosed in the embodiments of the present application is particularly suitable for checking private data, for example, financial data. Specifically, the target data in the embodiments of the present application can be expenditure data, income data, etc. By using the data checking method disclosed in the embodiments of the present application to check abnormal data, the target data of the local object can be stored in the local server, and the data checking is performed locally by executing the data checking model issued by the central server, thereby fully guaranteeing the data privacy. Moreover, the central server provides the data checking model and issues the data checking instruction to the local object, and the local object checks its own data based on the data checking model provided by the central server, and then uploads the checking result to the central server, thereby realizing the timely checking of the data of the local object by the central system, reducing the computing pressure of the central server by issuing the checking task to each local object, and guaranteeing the data privacy of the local object.

[0071] In order to facilitate the understanding of the present application, the specific scheme of the data checking method disclosed in the embodiments of the present application is exemplified and described below.

[0072] As shown in FIG. 1, the data checking method disclosed in the embodiments of the present application comprises steps 110 to 150. Figure 1

[0073] In step 110, the data checking model is acquired from the central server in response to the target data checking instruction sent by the central server.

[0074] The central server in the embodiments of the present application is a server of a central object that monitors or manages the data abnormality of the local object. For example, for a group enterprise comprising a plurality of subsidiaries, the central object is the group headquarters, the local object is each subsidiary, and accordingly, the central server is the server of the group headquarters, and the server locally deployed by the local object can be referred to as a local server.

[0075] The data checking model is a model trained by the central server according to the historical data of each local object in a specified data period. For example, the data checking model can be obtained by the central server analyzing the historical expenditure data of each local object, and performing data statistics on the expenditure data according to the dimensions of expenditure type (such as daily expenditure, planned expenditure, unplanned expenditure, other expenditure, etc.), expenditure occurrence period, expenditure amount, expenditure content, expenditure correlation table, etc., to obtain the expenditure scoring index and scoring rule for determining whether the expenditure data of the local object is abnormal or normal.

[0076] In some embodiments of the present application, the data checking model can be a neural network model or a data distribution model, for example, a Bayesian model.

[0077] ​The target data checking instruction is issued by the central server to the local server to trigger the local server to check the target data of the local object. The target data checking instruction in the embodiments of the present application can carry information such as data type and data cycle, so that the local object receiving the target data checking instruction can determine the data type to be checked and the data generation cycle according to the target data checking instruction.

[0078] In the embodiments of the present application, the local server receiving the target data checking instruction is referred to as the "current local server", and the local object to which the current local server belongs is referred to as the "current local object". For example, the current local object can determine whether to check the expenditure data of the last month or check the income data of the last half year according to the received target data checking instruction.

[0079] In the embodiments of the present application, in order to reduce the computing pressure of the central server and protect the privacy of the input of each local object (such as income data and expenditure data), the data checking method is applied to a data management system as shown in Figure 2 .

[0080] As shown in Figure 2 , the data management system includes a central server 210 and a plurality of local servers 220, and the central server 210 and the local servers 220 are connected through a network.

[0081] The central server 210 is configured to train and store a data checking model 2101. The central server 210 also stores a headquarters data analysis result database 2102 and a correlation database 2103. The headquarters data analysis result database 2102 is configured to store data checking results uploaded by each local server 220, and the correlation database 2103 is configured to store the correlation between the target correlation data of the local objects. The central server 210 is responsible for maintaining the data checking model 2101, the headquarters data analysis result database 2102, and the correlation database 2103.

[0082] Each local server 220 belongs to a different local object. The local server 220 is configured to receive a target data checking instruction, execute a data checking task corresponding to the target data checking instruction, and upload a data checking result. The local server 220 is also configured to download the data checking model. In some embodiments of the present application, the local server 220 is also configured to store the data checking model.

[0083] During the operation of the data management system, the central server 210 generates a target data inspection instruction according to the trigger of an inspector or according to a preset period, and sends the target data inspection instruction to a designated local server 220 to trigger the local server 220 to perform a data inspection task of a corresponding local object.

[0084] After receiving the target data inspection instruction sent by the central server, the local server 220 of the local object acquires information of data to be inspected (such as data type and data generation period), and acquires the data inspection model 2101 trained by the central server.

[0085] Step 120: Acquire target data of the current local object associated with the target data inspection instruction.

[0086] The target data can be expenditure data, income data, or other types of data.

[0087] Taking the expenditure data as an example, after the local server receives the target data inspection instruction sent by the central server, the local server first acquires the expenditure data of the local object (referred to as the "current local object" in the embodiments of the present application) to which the local server belongs as target data to be inspected.

[0088] In some embodiments of the present application, there can be associated data between local objects due to business transactions between the local objects. Accordingly, the local server further acquires the expenditure data of other local objects having associated data (such as associated expenditure) with the current local object as associated target data, and acquires the expenditure data of the current local object and the acquired associated target data as target data to be inspected.

[0089] Step 130: Aggregate the target data to obtain a characteristic value of a preset monitoring index corresponding to the target data.

[0090] After acquiring the target data of the current local object associated with the target data inspection instruction, the current local server further aggregates the acquired target data according to a preset type to obtain a characteristic value of a preset monitoring index corresponding to the target data. Taking the target data as expenditure data as an example, the preset type can include daily expenditure, planned expenditure, unplanned expenditure, and other expenditure.

[0091] In the embodiments of the present application, the dimension of the aggregation of the target data is determined according to specific business content and data inspection requirements.

[0092] The preset monitoring indicators are determined according to specific business content and data checking requirements. For example, when the target data is expenditure data, the preset monitoring indicators can include expenditure amounts of various expenditure types, expenditure times, and the like. Correspondingly, the feature values of the preset monitoring indicators corresponding to the target data can be expressed by, for example, a four-dimensional feature table, in which each dimension corresponds to: a total amount of daily expenditure, a total amount of planned expenditure, a total amount of unplanned expenditure, and a total amount of other expenditure; or the feature values of the preset monitoring indicators corresponding to the target data can be expressed by, for example, four features, in which the feature values of each dimension are expressed by a vector with a length of 2, and correspond to: a total amount of daily expenditure and a total number of expenditures, a total amount of planned expenditure and a total number of expenditures, a total amount of unplanned expenditure and a total number of expenditures, and a total amount of other expenditure and a total number of expenditures.

[0093] Those skilled in the art should understand that, for the target data of the above-mentioned categories or other target data, other monitoring indicators and feature value extraction methods can also be used to perform feature expression on the target data. The target data and monitoring indicators listed in the embodiments of the present application are only one or several implementation manners listed for the convenience of readers to understand the present application, and should not be understood as a limitation on the implementation schemes of the present application.

[0094] Step 140: obtaining a checking result indicating whether the target data is abnormal according to the data checking model and the feature values of the preset monitoring indicators.

[0095] After obtaining the feature values of the preset monitoring indicators of the target data, the current local server then performs prediction based on the feature values of the preset monitoring indicators by using the data checking model, to determine whether the target data is abnormal or normal.

[0096] Step 150: sending the checking result to the central server.

[0097] After obtaining the checking result of the target data, the current local server sends the obtained checking result (i.e., the checking result) to the central server for storage and further analysis. For example, when the central server finds that the checking result of the expenditure data of a certain local object is abnormal, it can further check the reason for the data abnormality, and timely find out whether there is a problem in the business data processing of the local object or whether there is a problem in the operating status. For another example, when the central server finds that the checking result of the expenditure data of too many local objects is abnormal, it can further check the reason for the data abnormality, to determine whether the data of multiple local objects is problematic or whether the accuracy of the data checking model has decreased.

[0098] The data checking method disclosed by the embodiments of the present application fully improves the data checking efficiency.

[0099] The data checking method disclosed by the embodiments of the present application fully improves the data checking efficiency.

[0100] In some other embodiments of the present application, after obtaining the checking result indicating whether the target data is abnormal according to the data checking model and the characteristic value of the preset monitoring index, the method further includes the step of verifying the target data and / or the data checking model.

[0101] For example, referring to FIG. 1, after the checking result is sent to the central server, the method further includes steps 160 to 180. Figure 3

[0102] Step 160: Each group of simulation data corresponding to each preset monitoring index is respectively taken as the input of a preset missing data simulation model to obtain the simulation fitting value corresponding to the preset monitoring index.

[0103] First, each group of simulation data corresponding to each preset monitoring index is obtained.

[0104] ​The simulation data in the embodiments of the present application is standard data with labels. The standard data can be generated according to historical data or simulated according to specific business scenarios. For example, the simulation data can include a data set corresponding to each preset monitoring indicator, and each data is provided with a label indicating that the data is normal or abnormal, used to represent the prediction result of the data. Taking the foregoing target data as an example of expenditure data, if the expenditure data is divided into four types, namely, daily expenditure, planned expenditure, unplanned expenditure, and other expenditure, then four groups of data can be obtained, each group of data corresponding to one type of expenditure, and each group of data being composed of a plurality of expenditure data with labels, the labels being used to indicate that the data is a normal value or an abnormal value.

[0105] Then, each group of simulation data is taken as an input of a preset missing data simulation model to obtain a simulation fitting value corresponding to the corresponding preset monitoring indicator.

[0106] In the embodiments of the present application, in order to verify the accuracy of the data checking model and the correctness of the target data classification, a missing data simulation model is first constructed to fit the prediction result of the data. The preset missing data simulation model is constructed based on a ridge regression method. For example, the missing data simulation model can be represented by the following formula:

[0107] ||Xθ-y|| 2 +||Γθ|| 2 ;

[0108] Wherein, X represents the input, y represents the prediction result of the output (i.e. the label of the data), || represents the regular operation, Γ is a weight constant, the value of which is obtained by training, and θ is a fitting hyperparameter.

[0109] In the foregoing formula, in order to prevent overfitting operation, θ is calculated by the following method:

[0110] θ(a)=(X T X+aI) -1 X T y;

[0111] Wherein, θ(a) represents the value of θ determined at a, I represents a unit matrix, and a represents the weight of the unit matrix.

[0112] By taking each group of simulation data as an input of the foregoing preset missing data simulation model, a simulation fitting value corresponding to each group of standard data can be obtained. For example, fitting values corresponding to daily expenditure standard data, planned expenditure standard data, unplanned expenditure standard data, and other expenditure standard data can be obtained, and the fitting values can be used to express the fitting results of the corresponding category of expenditure data and normal / abnormal classification.

[0113] Step 170, taking each group of real data corresponding to each of the preset monitoring indicators as input of the preset missing data simulation model respectively, to obtain real fitting values corresponding to each of the preset monitoring indicators.

[0114] First, according to the target data, each group of real data corresponding to each of the preset monitoring indicators is obtained.

[0115] In the embodiments of the present application, the prediction result of each target data can be determined according to the checking result of whether the target data obtained in the foregoing step 140 is abnormal. For example, if the checking result indicates that the target data is abnormal data, the prediction result of the real data generated according to the target data is abnormal; if the checking result indicates that the target data is normal data, the prediction result of the real data generated according to the target data is normal. Then, a plurality of groups of data are generated according to the obtained target data according to the prediction result and the type of expenditure. For example, the type of expenditure includes daily expenditure, planned expenditure, unplanned expenditure, and other expenditure, and four groups of data can be obtained, each group of data corresponding to one type of expenditure.

[0116] Then, each group of real data is taken as input of the preset missing data simulation model respectively, to obtain real fitting values corresponding to each of the preset monitoring indicators.

[0117] Next, each group of real data is taken as input of the preset missing data simulation model respectively, to obtain real fitting values corresponding to each group of real data. According to the correspondence between the type of each group of real data and the preset monitoring indicators, real fitting values corresponding to each of the preset monitoring indicators can be obtained.

[0118] Step 180, obtaining an accuracy prediction result of the checking result according to the difference between the simulation fitting value and the real fitting value.

[0119] After obtaining the simulation fitting value of the standard data and the real fitting value corresponding to the real data, it can be further determined whether the checking result is abnormal according to the difference between the simulation fitting value and the real fitting value.

[0120] In some embodiments of the present application, the accuracy prediction result of the checking result obtained according to the difference between the simulation fitting value and the real fitting value includes: in the case that the difference between the simulation fitting value and the real fitting value is greater than or equal to a preset difference threshold, a first accuracy prediction result of the checking result is obtained; in the case that the difference between the simulation fitting value and the real fitting value corresponding to each of the preset monitoring indicators is less than the preset difference threshold, a second accuracy prediction result of the checking result is obtained. The preset difference threshold can be determined according to the test result.

[0121] The first accuracy prediction result is used to indicate that the accuracy of the inspection result is low, and the second accuracy prediction result is used to indicate that the accuracy of the inspection result is high.

[0122] For example, for a set of data, when the difference between the real fitting value and the simulation fitting value is greater than 10% of the simulation fitting value, it indicates that the prediction result of the real data has a large deviation from the data matching degree; otherwise, it can be considered that the prediction result of the real data has a small deviation from the data matching degree.

[0123] As can be known from the foregoing steps, the prediction result of the real data is obtained according to the inspection result of the target data, and therefore, the deviation of the prediction result of the real data from the data matching degree also reflects the matching degree of the inspection result and the target data. If the deviation of the prediction result of the real data from the data matching degree is large, it can be considered that the matching degree of the inspection result and the target data is low, that is, the accuracy of the inspection result is low for the target data; otherwise, if the deviation of the prediction result of the real data from the data matching degree is small, it can be considered that the matching degree of the inspection result and the target data is high, that is, the accuracy of the inspection result is high for the target data.

[0124] When it is found through the verification that the matching degree of the inspection result and the target data is low, that is, the accuracy of the inspection result is low, the cause can be further analyzed, and the data inspection process can be adjusted in time.

[0125] The low accuracy of the inspection result can include two reasons: first, the target data classification error; and second, the data inspection model accuracy reduction. By checking the target data, the data classification error can be found. If no data classification error occurs, it can be considered that the data inspection model accuracy is reduced, and the problem can be solved by adjusting or increasing the parameters of the data inspection model.

[0126] In some other embodiments of the present application, after obtaining the accuracy prediction result of the inspection result according to the difference between the simulation fitting value and the real fitting value, the prediction result can be further sent to the central server. The central server can store the inspection result and the prediction result in association, for analyzing the cause of the inspection result abnormality.

[0127] The data inspection method disclosed in the embodiments of the present application helps to further improve the accuracy of the target data inspection, by using the ridge regression method to construct a missing data simulation model, putting the standard data into the missing data simulation model to generate a simulation fitting value, putting the real data into the missing data simulation model to generate a real fitting value, and then comparing the deviation between the simulation fitting value and the real fitting value to verify the accuracy of the data inspection model and the correctness of the target data classification.

[0128] The optional implementation of the foregoing steps is further illustrated below.

[0129] In the foregoing step 110, the data checking model can be obtained from the central server after receiving the target data checking instruction sent by the central server each time.

[0130] In some other embodiments of the present application, the data checking model can also be obtained from the central server only after receiving the target data checking instruction sent by the central server for the first time, and then the data checking model is stored locally. For example, the step of obtaining the data checking model from the central server in response to the target data checking instruction sent by the central server comprises: determining whether the target data checking instruction is received for the first time in response to the target data checking instruction sent by the central server; and obtaining the data checking model from the central server in response to the target data checking instruction not being received for the first time.

[0131] In some embodiments of the present application, a flag can be set to record whether the target data checking instruction is received for the first time. In this way, after receiving the target data checking instruction sent by the central server each time, it is determined whether the data checking model needs to be obtained from the central server by judging the flag.

[0132] In the foregoing step 120, the target data of the current local object associated with the target data checking instruction is obtained by: obtaining the local target data associated with the target data checking instruction stored locally by the current local object; aggregating the local target data according to types; accessing the association database stored by the central server based on the types to obtain the target local object having an association relationship with the current local object based on the target data; obtaining the association target data associated with the local target data stored locally by the target local object through the target local object; and merging the local target data and the association target data according to the types to obtain the target data of the current local object associated with the target data checking instruction.

[0133] For example, when the target data is expenditure data, the types can include daily expenditure, planned expenditure, unplanned expenditure, and other expenditure; and when the target data is income data, the types can include daily income, operating income, and group distribution.

[0134] For example, the data collection is performed by a program deployed in the local server of the local object, all the expenditure data of the current local object is obtained from the expenditure database of the current local object, and is classified and summarized according to the expenditure type, then, the expenditure type is taken as a query condition to access the association database of the central server to obtain which local objects have associated expenditures with the current local object, then, the associated expenditure database (i.e. the expenditure database of the other local object having the associated expenditure) of the associated expenditure is accessed to obtain the associated expenditure data, and the data is merged according to the expenditure type to obtain all the associated expenditure data of the current local object.

[0135] In the process of obtaining data in each local object, the expenditure data stored locally by itself and the expenditure data of other local objects associated with itself are obtained, and the private data between the local objects is invisible, which can well protect the private data such as financial data.

[0136] In the embodiment of the application, the data checking model is a naive Bayes model trained according to historical data. In the foregoing step 140, the checking result indicating whether the target data is abnormal is obtained according to the data checking model and the feature value of the preset monitoring index, including: based on the known abnormal probability in the data checking model, the known normal probability, the probability of the target feature value of the preset monitoring index in the abnormal subset, and the probability of the target feature value of the preset monitoring index in the normal subset, predicting the first probability that the target data suspected to be abnormal is judged to be abnormal and the second probability that the target data suspected to be normal is judged to be normal under the condition that the feature value of the preset monitoring index is met; and obtaining the checking result indicating whether the target data is abnormal according to the first probability and the second probability.

[0137] In some embodiments of the application, the checking result indicating whether the target data is abnormal is obtained according to the first probability and the second probability, including: in the case that the first probability is greater than the second probability, obtaining the checking result indicating that the target data is abnormal; and in the case that the first probability is less than or equal to the second probability, obtaining the checking result indicating that the target data is normal.

[0138] For example, the data checking model based on the naive Bayes model models the expenditure data in a certain period (such as one month), the central server can statistically analyze the historical expenditure data of each local object in the corresponding time period (such as one month) to obtain the abnormal probability, the normal probability of the expenditure data in a certain period, the feature value of each preset monitoring index (such as the daily expenditure feature value, the planned expenditure feature value, the unplanned expenditure feature value, and the other expenditure feature value), and the probability of the feature value of each preset monitoring index in the abnormal subset and the normal subset, and the obtained prior probability is taken as the data checking model.

[0139] In the method, the data states to be checked include two states of normal and abnormal. In the following, the abnormal state is represented by the symbol R1 and the normal state is represented by the symbol R2.

[0140] Taking a feature value of the target data of the current local object as T as an example, the feature value can be represented as T = {t1, t2, t3, …, tN}. When the expenditure data is checked, if the expenditure data is divided into four types, such as daily expenditure, planned expenditure, unplanned expenditure, and other expenditure, the value of N is 4, and each feature value in the preset monitoring index T corresponds to one type of expenditure. N

[0141] Correspondingly, in the process of obtaining the checking result indicating whether the target data is abnormal according to the data checking model and the feature value of the preset monitoring index, the first probability that the target data suspected to be abnormal is judged to be abnormal and the second probability that the target data suspected to be normal is judged to be normal under the condition that the feature value of the preset monitoring index is met can be predicted by the conditional probability formulas (1) and (2) as follows:

[0142]

[0143] wherein P(R1|T) represents the first probability, P(T|R1) represents the probability of the feature value T appearing in the abnormal subset in the sample set, and P(R1) represents the probability of the abnormal subset in the entire sample set (i.e., the known abnormal probability). Wherein P(T|R1) can be determined by looking up the probability of the target feature value of the preset monitoring index in the abnormal subset.

[0144]

[0145] wherein P(R2|T) represents the second probability, P(T|R2) represents the probability of the feature value T appearing in the normal subset in the sample set, and P(R2) represents the probability of the normal subset in the entire sample set (i.e., the known normal probability). Wherein P(T|R2) can be determined by looking up the probability of the target feature value of the preset monitoring index in the normal subset.

[0146] According to the Bayesian idea, each feature value t i is independent of each other, and the probabilities of the suspected abnormal being judged as abnormal (i.e., R1) and normal (i.e., R2) can be calculated according to the probabilities of the relatively independent events, i.e., P(T|R1) and P(T|R2).

[0147] ​Since the embodiments of the present application do not need to obtain accurate probability values, only the sizes of the first probability and the second probability need to be compared, the value of P(T) does not need to be calculated. That is, if P(R1|T) > P(R2|T), it is indicated that the above preset monitoring index of the target data to be checked is abnormal, and if P(R1|T) ≤ P(R2|T), it is indicated that the above preset monitoring index of the target data to be checked is normal.

[0148] So far, the specific embodiments of the data checking method disclosed in the present application are described in detail in the foregoing.

[0149] Correspondingly, the present application also discloses a data checking device, as shown in Figure 4 The device comprises:

[0150] The data checking model acquisition module 410 is configured to acquire a data checking model from the central server in response to a target data checking instruction sent by the central server.

[0151] The target data acquisition module 420 is configured to acquire target data associated with the target data checking instruction of the current local object.

[0152] The feature value acquisition module 430 is configured to perform aggregation processing on the target data to obtain a feature value of a preset monitoring index corresponding to the target data.

[0153] The data checking module 440 is configured to obtain a checking result indicating whether the target data is abnormal according to the data checking model and the feature value of the preset monitoring index.

[0154] The checking result uploading module 450 is configured to send the checking result to the central server.

[0155] In some embodiments of the present application, as shown in Figure 5 The device further comprises:

[0156] The simulation fitting value acquisition module 460 is configured to take each group of simulation data corresponding to each preset monitoring index as an input of a preset missing data simulation model to obtain a simulation fitting value corresponding to the corresponding preset monitoring index.

[0157] The real fitting value acquisition module 470 is configured to take each group of real data corresponding to each preset monitoring index as an input of the preset missing data simulation model to obtain a real fitting value corresponding to the corresponding preset monitoring index.

[0158] The prediction result acquisition module 480 is configured to obtain an accuracy prediction result of the checking result according to the difference between the simulation fitting value and the real fitting value.

[0159] Optionally, the prediction result obtaining module 480 is further configured to:

[0160] obtain a first accuracy prediction result of the inspection result in a case where a difference between the simulation fitting value and the true fitting value is greater than or equal to a preset difference threshold value.

[0161] obtain a second accuracy prediction result of the inspection result in a case where differences between the simulation fitting value and the true fitting value of each of the preset monitoring indicators are all less than the preset difference threshold value.

[0162] The first accuracy prediction result is used to indicate that the accuracy of the inspection result is low, and the second accuracy prediction result is used to indicate that the accuracy of the inspection result is high.

[0163] Optionally, the preset missing data simulation model is constructed based on a ridge regression method.

[0164] Optionally, the data inspection model is a naive Bayes model trained according to historical data, and the data inspection module 440 is further configured to:

[0165] predict, based on a known abnormal probability, a known normal probability, a probability of a target feature value of the preset monitoring indicator being in an abnormal subset, and a probability of the target feature value of the preset monitoring indicator being in a normal subset in the data inspection model, a first probability that the target data suspected to be abnormal is judged to be abnormal and a second probability that the target data suspected to be normal is judged to be normal under the condition that the feature value of the preset monitoring indicator is met.

[0166] obtain an inspection result indicating whether the target data is abnormal according to the first probability and the second probability.

[0167] Optionally, the obtaining of the inspection result indicating whether the target data is abnormal according to the first probability and the second probability comprises:

[0168] obtaining an inspection result indicating that the target data is abnormal in a case where the first probability is greater than the second probability.

[0169] obtaining an inspection result indicating that the target data is normal in a case where the first probability is less than or equal to the second probability.

[0170] Optionally, the target data obtaining module 420 is further configured to:

[0171] obtain local target data associated with the target data inspection instruction and locally stored by a current local object;

[0172] aggregate the local target data according to a type;

[0173] access a correlation database stored in the central server based on the type, to obtain a target local object having a correlation with the current local object based on the target data;

[0174] obtain, through the target local object, correlation target data stored locally by the target local object and associated with the local target data;

[0175] merge the local target data and the correlation target data according to the type, to obtain target data of the current local object associated with the target data inspection instruction.

[0176] In another embodiment of the present application, after obtaining the accuracy prediction result of the inspection result according to the difference between the simulation fitting value and the real fitting value, the inspection result uploading module 450 is further configured to send the prediction result to the central server. The central server can store the inspection result and the prediction result in association, for analyzing the cause of the inspection result anomaly.

[0177] The data inspection device disclosed in the embodiments of the present application is used to implement the data inspection method disclosed in the embodiments of the present application. The specific implementation of each module of the device will not be described again, and the specific implementation of the corresponding steps of the method embodiments can be referred to.

[0178] The data inspection device disclosed in the embodiments of the present application obtains a data inspection model through the central server in response to a target data inspection instruction sent by the central server, obtains target data of a current local object associated with the target data inspection instruction, performs aggregation processing on the target data to obtain a feature value of a preset monitoring index corresponding to the target data, obtains an inspection result indicating whether the target data is abnormal according to the data inspection model and the feature value of the preset monitoring index, and sends the inspection result to the central server, thereby fully improving the data inspection efficiency.

[0179] The data inspection device disclosed in the embodiments of the present application is trained by the central server according to historical data, the data inspection model is obtained by the local server from the central server, and the data inspection task is performed. The target data of the local object to which each local server belongs is inspected based on the data inspection model, and the data inspection result of each local object is obtained. Then, the data inspection result is uploaded to the central server. Not only is the automatic inspection of the target data of the local object realized, but also the computing pressure of the central server is reduced and the data privacy of the local object is maintained by performing the data inspection task on the local server.

[0180] Further, the data checking device disclosed by the embodiments of the present application is configured to construct a missing data simulation model by using the ridge regression method, put the standard data into the missing data simulation model to generate simulation fitting values, put the real data into the missing data simulation model to generate real fitting values, then compare the deviation between the simulation fitting values and the real fitting values, and check the accuracy of the data checking model and the correctness of the target data classification according to the deviation, so as to further improve the accuracy of the target data checking.

[0181] Each of the embodiments in the present specification is described in a progressive manner, and each embodiment focuses on the difference from other embodiments, and the same or similar parts between the embodiments can be referred to each other. For the device embodiments, since they are basically similar to the method embodiments, the description is relatively simple, and the relevant parts can be referred to the part of the method embodiments.

[0182] The data checking method and device provided by the present application are described in detail above, and the principles and implementation manners of the present application are described by using specific examples in the present document, and the above embodiment description is only used to help understand the method of the present application and its core idea; meanwhile, for the general technical personnel in the art, according to the idea of the present application, the specific implementation manner and application range can be changed, and the above description should not be understood as the limitation of the present application.

[0183] The device embodiments described above are only schematic, and the units described as separate components can or can not be physically separate, and the components displayed as units can or can not be physical units, that is, they can be located in one place, or can be distributed on multiple network units. According to the actual needs, some or all of the modules can be selected to achieve the purpose of the present embodiment scheme. Those skilled in the art can understand and implement without creative labor.

[0184] The various component embodiments of the present application can be implemented in hardware, or in software modules running on one or more processors, or in a combination thereof. Those skilled in the art should understand that microprocessors or digital signal processors (DSP) can be used in practice to implement some or all of the functions of some or all of the components in the electronic device according to the embodiments of the present application. The present application can also be implemented as a device or apparatus program (for example, computer program and computer program product) for executing part or all of the methods described herein. Such program implementing the present application can be stored on a computer readable medium, or can have the form of one or more signals. Such signals can be downloaded from an Internet website, or provided on a carrier signal, or provided in any other form.

[0185] For example, Figure 6 An electronic device is shown, which can implement the method according to the present application. The electronic device can be a PC, a mobile terminal, a personal digital assistant, a tablet computer, etc. The electronic device traditionally comprises a processor 610 and a memory 620 and program code 630 stored on the memory 620 and executable on the processor 610, which, when executed by the processor 610, implements the method described in the above embodiments. The memory 620 can be a computer program product or a computer readable medium. The memory 620 can be an electronic memory such as a flash memory, an EEPROM (electrically erasable programmable read-only memory), an EPROM, a hard disk or a ROM. The memory 620 has a storage space 6201 for the program code 630 of the computer program for executing any of the method steps described above. For example, the storage space 6201 for the program code 630 can comprise individual computer programs for implementing the various steps in the above methods, respectively. The program code 630 is computer readable code. The computer programs can be read from or written to one or more computer program products. The computer program products comprise program code carriers such as a hard disk, a compact disk (CD), a memory card or a floppy disk. The computer programs comprise computer readable code which, when executed on the electronic device, causes the electronic device to perform the method according to the above embodiments.

[0186] The embodiments of the present application further disclose a computer readable storage medium, having stored thereon a computer program, which, when executed by a processor, implements the steps of the data checking method according to the embodiment one of the present application.

[0187] Such a computer program product can be a computer readable storage medium having stored thereon the computer program. A computer readable storage medium can be a Figure 6 storage section, storage space, etc. arranged similarly to the memory 620 in the electronic device shown. The program code can be stored in the computer readable storage medium, for example, in a compressed form. The computer readable storage medium is typically a portable or stationary storage unit as described with reference to Figure 7 The computer readable storage medium typically comprises computer readable code 630' which is code that is read by the processor, which, when executed by the processor, implements the various steps in the above described methods.

[0188] The terms "one embodiment", "an embodiment” or "one or more embodiments” as used herein mean that a particular feature, structure, or characteristic described in connection with the embodiment is included in at least one embodiment of the application. The appearances of the phrase "in one embodiment” in various places in this specification are not necessarily all referring to the same embodiment.

[0189] In the description provided herein, numerous specific details are set forth. However, it is understood that embodiments of the application can be practiced without these specific details. In some instances, well-known methods, structures and techniques have not been shown in detail in order not to obscure an understanding of this description.

[0190] In the claims, any reference signs placed between parentheses shall not be construed as limiting the claim. The word comprising" does not exclude the presence of elements or steps other than those listed in a claim. The word "a" or "an" preceding an element does not exclude the presence of a plurality of such elements. The application can be implemented by means of both hardware and software, and any combination thereof. In a unitary claim, several devices or sub-claims can be joined by means of the word "or". The word "first", "second", "third", etc. do not imply any order. The terms "first", "second", "third", etc. are to be interpreted according to their meaning in the context and not numerically.

[0191] Finally, it should be noted that the above-mentioned embodiments illustrate rather than limit the application, since the scope of the application is determined by the appended claims.

Claims

1. A data checking method, characterized by, The method comprises the following steps: in response to a target data inspection instruction sent by a central server, obtaining a data inspection model through the central server; obtaining target data associated with the target data inspection instruction of a current local object, the target data including expenditure data, income data, and other types of data; performing aggregation processing on the target data to obtain characteristic values of preset monitoring indicators corresponding to the target data, the characteristic values including total amount and total times of expenditure data; obtaining an inspection result indicating whether the target data is abnormal according to the data inspection model and the characteristic values of the preset monitoring indicators; sending the inspection result to the central server; taking each group of simulation data corresponding to each of the preset monitoring indicators as input of a preset missing data simulation model respectively to obtain simulation fitting values corresponding to the respective preset monitoring indicators, the simulation data being generated according to historical data and being labeled, and the preset missing data simulation model being constructed based on a ridge regression method; taking each group of real data corresponding to each of the preset monitoring indicators as input of the preset missing data simulation model respectively to obtain real fitting values corresponding to the respective preset monitoring indicators, the real data being generated according to the target data; obtaining an accuracy prediction result of the inspection result according to a difference between the simulation fitting values and the real fitting values.

2. The method of claim 1, wherein, The accuracy prediction result of the inspection result obtained according to the difference between the simulation fitting values and the real fitting values comprises: in a case where the difference between the simulation fitting values and the real fitting values is greater than or equal to a preset difference threshold, obtaining a first accuracy prediction result of the inspection result; in a case where the difference between the simulation fitting values and the real fitting values of each of the preset monitoring indicators is less than the preset difference threshold, obtaining a second accuracy prediction result of the inspection result.

3. The method according to any one of claims 1 to 2, characterized in that, The data inspection model is a naive Bayes model trained according to historical data, and the inspection result indicating whether the target data is abnormal is obtained according to the data inspection model and the characteristic values of the preset monitoring indicators, which comprises: based on a known abnormal probability, a known normal probability, a probability of a target characteristic value of the preset monitoring indicator being in an abnormal subset, and a probability of the target characteristic value of the preset monitoring indicator being in a normal subset in the data inspection model, predicting a first probability that the target data suspected to be abnormal is judged to be abnormal and a second probability that the target data suspected to be normal is judged to be normal under the condition that the characteristic value of the preset monitoring indicator is satisfied; obtaining the inspection result indicating whether the target data is abnormal according to the first probability and the second probability.

4. The method of claim 3, wherein, The inspection result indicating whether the target data is abnormal is obtained according to the first probability and the second probability, which comprises: in a case where the first probability is greater than the second probability, obtaining the inspection result indicating that the target data is abnormal; in a case where the first probability is less than or equal to the second probability, obtaining the inspection result indicating that the target data is normal.

5. The method according to any one of claims 1 to 2, characterized in that, The target data associated with the target data checking instruction of the current local object is obtained, including: Obtaining local target data associated with the target data checking instruction stored locally by the current local object; Summarizing the local target data according to types; Accessing a correlation database stored by the central server based on the types to obtain target local objects having a correlation relationship with the current local object based on the target data; Obtaining correlation target data associated with the local target data stored locally by the target local objects through the target local objects; Merging the local target data and the correlation target data according to the types to obtain the target data associated with the target data checking instruction of the current local object.

6. A data checking apparatus characterized by comprising: Comprise: The data checking model acquisition module is used for obtaining the data checking model through the central server in response to the target data checking instruction sent by the central server; The target data acquisition module is used for obtaining the target data associated with the target data checking instruction of the current local object, and the target data includes expenditure data, income data and other types of data; The characteristic value acquisition module is used for performing aggregation processing on the target data to obtain characteristic values of preset monitoring indicators corresponding to the target data, and the characteristic values include total amount and total times of expenditure data; The data checking module is used for obtaining a checking result indicating whether the target data is abnormal according to the data checking model and the characteristic values of the preset monitoring indicators; The checking result uploading module is used for sending the checking result to the central server; The simulation fitting value acquisition module is used for taking each set of simulation data corresponding to each preset monitoring indicator as input of a preset missing data simulation model to obtain simulation fitting values corresponding to the preset monitoring indicators, the simulation data is generated according to historical data and has labels, and the preset missing data simulation model is constructed based on a ridge regression method; The real fitting value acquisition module is used for taking each set of real data corresponding to each preset monitoring indicator as input of the preset missing data simulation model to obtain real fitting values corresponding to the preset monitoring indicators, and the real data is generated according to the target data; The prediction result acquisition module is used for obtaining an accuracy prediction result of the checking result according to a difference size between the simulation fitting values and the real fitting values.

7. An electronic device comprising a memory, a processor, and program code stored on the memory and executable on the processor, wherein, The processor executes the program code to realize the data checking method of any one of claims 1 to 5.

8. A computer-readable storage medium having stored thereon a program code, characterized in that, The program code is executed by the processor to realize the steps of the data checking method of any one of claims 1 to 5.

Images