A method, apparatus, equipment, storage medium, and program product for identifying risk points.

Abstract

This application provides a method, apparatus, device, storage medium, and program product for determining risk points. It relates to the field of big data processing technology, including: acquiring alarm information generated within the current period; classifying each alarm information according to attribute information to obtain multiple alarm information sets; calculating the hash value of each feature value in the matched alarm information set using each sketch processor, and statistically analyzing the acquired hash values ​​to obtain a processor matrix; comparing each processor matrix with its corresponding threshold matrix to obtain the spatial location of abnormal targets, and determining risk points based on the spatial location of abnormal targets. By using sketch processors to perform hash calculations on the alarm information feature set and statistically analyzing the acquired hash values, sudden increases in feature values ​​can be indirectly identified through hash value statistics while saving space, thereby filtering out risk points with sudden increases in alarms. This effectively saves time for manual alarm screening and improves the accuracy of alarm analysis.

Description

Technical Field

[0001] This application relates to the field of big data processing technology, and in particular to a method, apparatus, equipment, storage medium, and program product for identifying risk points. Background Technology

[0002] Risk control personnel design corresponding risk control rules for different types of risk scenarios and deploy them in the anti-fraud system to monitor the behavior of users and merchants on the platform. If risky behavior that violates the rules occurs, a risk alert will be generated in the system.

[0003] These risk control alerts typically require further analysis and screening by risk control personnel to identify the main risk points. When the number of risk alerts surges, relying solely on manual post-event analysis is impractical due to its large workload, low timeliness, and difficulty in promptly identifying the platform's current main risks. Summary of the Invention

[0004] This application provides a method, apparatus, device, storage medium, and program product for determining risk points, which can automatically identify risk points from alarm information.

[0005] Firstly, this application provides a method for identifying risk points, including:

[0006] Obtain alarm information generated within the current period, wherein the alarm information includes attribute information and feature values;

[0007] Based on the attribute information, the alarm information is classified to obtain multiple alarm information sets, wherein each alarm information set is matched with a sketch processor.

[0008] Each of the sketch processors calculates the hash value of each feature value in the matched alarm information set, and performs statistical analysis on the obtained hash values ​​to obtain a processor matrix, wherein the processor matrix includes the spatial location and statistical count of each hash value;

[0009] Each processor matrix is ​​compared with its corresponding threshold matrix to obtain the spatial location of the abnormal target, and the risk point is determined based on the spatial location of the abnormal target. The threshold matrix includes the statistical threshold of each spatial location in the current period.

[0010] Secondly, this application provides a risk point determination device, comprising:

[0011] The alarm information acquisition module is used to acquire alarm information generated within the current period, wherein the alarm information includes attribute information and feature values;

[0012] The alarm information set acquisition module is used to classify each alarm information according to the attribute information to obtain multiple alarm information sets, wherein each alarm information set is matched with a sketch processor.

[0013] The processor matrix acquisition module is used to calculate the hash value of each feature value in the matched alarm information set through each of the sketch processors, and to statistically obtain the processor matrix by statistically analyzing the obtained hash values. The processor matrix includes the spatial position and statistical count of each hash value.

[0014] The risk point determination module is used to compare each of the processor matrices with the corresponding threshold matrix to obtain the spatial location of the abnormal target, and to determine the risk point based on the spatial location of the abnormal target. The threshold matrix includes the statistical threshold of each spatial location in the current period.

[0015] Thirdly, this application provides an electronic device, including: a processor, and a memory communicatively connected to the processor;

[0016] The memory stores computer-executed instructions;

[0017] The processor executes computer execution instructions stored in the memory to implement the method described in this application.

[0018] Fourthly, this application provides a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, are used to implement the methods described in this application.

[0019] Fifthly, this application provides a computer program product, including a computer program that, when executed by a processor, implements the method described in this application.

[0020] After acquiring a large amount of alarm information, this application uses a sketch processor to perform hash calculations on the alarm information feature set and statistically analyzes the acquired hash values. This allows for the indirect identification of sudden increases in feature values ​​through hash value statistics while saving space, thereby filtering out risk points of sudden alarm increases. This effectively saves time for manual alarm screening and improves the accuracy of alarm analysis. Attached Figure Description

[0021] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0022] Figure 1 A flowchart illustrating the risk point determination method provided in this application embodiment;

[0023] Figure 2 A flowchart illustrating the risk point determination method provided in this application embodiment;

[0024] Figure 3 This is a schematic diagram of the risk point determination device provided in the embodiments of this application;

[0025] Figure 4 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application.

[0026] The accompanying drawings illustrate specific embodiments of this application, which will be described in more detail below. These drawings and descriptions are not intended to limit the scope of the concept in any way, but rather to illustrate the concept of this application to those skilled in the art through reference to particular embodiments. Detailed Implementation

[0027] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numbers in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this application. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this application as detailed in the appended claims.

[0028] The technical solution of this application and how it solves the above-mentioned technical problems are described in detail below with specific embodiments. These specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments. The embodiments of this application will be described below with reference to the accompanying drawings. The acquisition, storage, use, and processing of data in the technical solution of this application all comply with the relevant provisions of national laws and regulations.

[0029] Figure 1 The flowchart of the risk point determination method provided in the embodiments of this application is as follows. Figure 1 As shown, the method includes the following steps:

[0030] Step S101: Obtain the alarm information generated in the current period.

[0031] Specifically, in this embodiment, alarm information generated by the risk monitoring system will be acquired within a specified period, which can be 1 minute. This embodiment does not limit the specific value of the specified period. Risk control personnel will design corresponding risk control rules for different types of risk scenarios and deploy them in the risk monitoring system to monitor the behavior of operating users. If a risky behavior that triggers the rules occurs, alarm information will be generated in the system.

[0032] The alarm information includes attribute information and feature values. The attribute information includes risk scenarios and feature variables. For example, alarm information 1 contains the risk scenario of cash withdrawal and the feature variable of IP address, where the feature value of the IP address could be 00a. This embodiment only illustrates the case of one feature variable in one alarm message; an alarm message can contain multiple feature variables simultaneously. For example, alarm information 2 contains the risk scenario of deposit and the feature variables are a combination of longitude, latitude, and IP address. Therefore, this embodiment does not limit the specific type of feature variables contained in an alarm message. Furthermore, the number of alarm messages generated within a period is usually large. This embodiment is merely illustrative and does not limit the specific content of the attribute information and feature values ​​contained in each alarm message.

[0033] Step S102: Classify the alarm information according to the attribute information to obtain multiple alarm information sets.

[0034] Optionally, multiple alarm information sets are obtained by classifying each alarm information according to the attribute information, including: identifying each alarm information to obtain the risk scenarios and feature variables contained in the attribute information; classifying alarm information with the same risk scenarios and feature variables into the same alarm information set; and distributing each alarm information set to a matching sketch processor, wherein each sketch processor corresponds to a type of feature variable.

[0035] Specifically, after acquiring a large number of alarm messages, in order to quickly identify the current sudden risk, each alarm message is identified to obtain the risk scenario and characteristic variables contained in its attribute information. Alarm messages with the same risk scenario and characteristic variables are grouped into the same alarm message set. For example, if alarm message 1 and alarm message 2 both contain the risk scenario of cash withdrawal and the characteristic variable IP address, then alarm message 1 and alarm message 2 are grouped into the same alarm message set. Similarly, the method for obtaining other alarm message sets is roughly the same, and will not be elaborated upon in this embodiment. Furthermore, this embodiment does not limit the specific number of alarm message sets.

[0036] In this embodiment, after obtaining each alarm information set, the alarm information set will be distributed to the matched sketch processor. Therefore, each sketch processor corresponds to a set of feature variables. Each set of feature variables corresponding to each sketch processor can be a single feature variable or a combination of multiple feature variables.

[0037] Step S103: Calculate the hash value of each feature value in the matched alarm information set through each sketch processor, and statistically analyze the obtained hash values ​​to obtain the processor matrix.

[0038] Optionally, each sketch processor calculates the hash value of the feature value in the matched alarm information set, and calculates the obtained hash value to obtain the processor matrix, including: calculating the hash value of each feature value by each sketch processor using a specified number of hash functions; determining the mapping space corresponding to the specified number of hash functions, and counting the occurrences of each hash value to obtain the statistical count; determining the spatial position of each hash value in the mapping space, and determining the processor matrix based on the spatial position and the statistical count.

[0039] Optionally, the method also includes: determining the feature value corresponding to the hash value at each spatial location; and associating each feature value with the spatial location in the form of a linked list.

[0040] Specifically, in this embodiment, when the feature variable included in the feature information is IP, since the feature values ​​corresponding to IP are not exhaustive, storing each occurrence of a feature value and counting the number of occurrences of each feature value would be time-consuming and space-consuming. Therefore, by using a sketch summary data structure for each sketch processor, storage space can be saved and the statistical time reduced. Specifically, the feature values ​​appearing in each alarm message in the alarm message set corresponding to the sketch processor are mapped to a finite value space using a hash function, for example, the value space is M, and the number of occurrences of the mapped values ​​is counted. In this way, a finite space can be used to count various feature values. However, a single hash function mapping will inevitably have hash collision problems. Therefore, N independent hash functions can be set, and the value space mapped by each hash function is M. By performing N hash mapping calculations on the same feature value, the probability of hash collisions can be effectively reduced. Therefore, the sketch processor needs to use an N*M processor matrix, denoted by U, to indirectly realize the storage and statistics of feature values.

[0041] In a specific implementation, for the sketch processor corresponding to the IP feature variable, assuming the corresponding value space M=4, that is, regardless of which feature value is hashed, the resulting hash value will always be one of the four values. To avoid hash collisions, three hash mapping calculations can be used, i.e., N=3. For example, when the IP feature values ​​are IP1=00a, IP2=00b, IP3=00c, IP4=00d, and IP5=00c, the sketch processor performs three hash calculations on IP1=00a. Let hn be the nth hash function, and mn=hn(00a) be the mapping value of the nth hash calculation. The mapping value is any one of the four set hash values. Then, the statistical value at position U[n][mn] in the matrix is ​​incremented by 1, i.e., U[n][mn]+=1. At the same time, the feature value 00a is stored in a linked list at this position. After completing the above three calculations, the sketch processor can process the next alarm. Therefore, the obtained processor matrix U contains the spatial position and statistical count of each hash value. Of course, this embodiment only uses the method of obtaining the processor matrix by the sketch processor corresponding to the IP feature variable as an example. The method of determining the processor matrix by the sketch processor corresponding to other feature variables is roughly the same, and will not be described in detail in this embodiment.

[0042] It should be noted that the reason for using multiple hash functions to perform hash calculations on the feature values ​​in this embodiment is to avoid hash collisions. For example, if only one hash calculation is used, when the number of times corresponding to the spatial position U[1][1] is obtained by calculation is 3, but the feature values ​​associated with this spatial position are determined by querying the linked list to be IP3=00c, IP4=00d and IP5=00c, when it is determined that the number of times the corresponding hash value under this spatial position exceeds the preset threshold, it is impossible to distinguish whether the feature value causing the anomaly is 00c or 00d. However, if multiple hash calculations are used, when 00c and 00d are hashed in the second hash calculation, the two feature values ​​will get different hash values. Thus, the next row in the U matrix can count the number of times each hash value appears, thereby distinguishing whether the feature value causing the anomaly is 00c or 00d.

[0043] Step S104: Compare each processor matrix with the corresponding threshold matrix to obtain the spatial location of the abnormal target, and determine the risk point based on the spatial location of the abnormal target.

[0044] Optionally, before comparing each processor matrix with its corresponding threshold matrix to obtain the spatial location of the abnormal target, the method further includes: obtaining a first predicted value, a first actual statistical value, and a first predicted offset for the number of statistical occurrences in each processor matrix in the adjacent previous period; obtaining a second predicted value for the number of statistical occurrences in the current period based on the first predicted value and the first actual statistical value; obtaining a second predicted offset for the current period based on the first predicted value, the first actual statistical value, and the first predicted offset; obtaining a statistical threshold corresponding to the number of statistical occurrences at each spatial location in the current period based on the second predicted value and the second predicted offset; and combining the statistical thresholds according to their spatial locations to obtain a threshold matrix corresponding to each processor matrix, wherein the threshold matrix has the same dimension as the corresponding processor matrix.

[0045] Specifically, in this embodiment, before obtaining the spatial location of the abnormal target, a threshold matrix is ​​generated for each processor. Each position in the threshold matrix stores the statistical threshold of the corresponding position in the processor matrix, and the threshold matrix is ​​required to have the same dimension as the corresponding processor matrix, which can be represented by W. To quickly and accurately identify anomalies, an exponentially weighted moving average model can be used. For the i-th spatial location in the processor matrix, the second preset value of the statistical frequency in the processor matrix within the current period can be calculated using the following formula (1):

[0046] Ai=β ×ai-1 + (1-β)×Ai-1 (1)

[0047] Where Ai represents the second predicted value of the current period, Ai-1 represents the first predicted value of the adjacent previous period, ai-1 represents the first actual statistical value of the adjacent previous period, and β is a weighting coefficient that is constant.

[0048] After calculating the second prediction value for the current period, the second prediction offset within the current period can be calculated using the following formula (2):

[0049] Di=θ×|Ai-1-ai-1|+(1-θ)×Di-1 (2)

[0050] Where Di is the second prediction offset of the current period, Di-1 is the first offset of the adjacent previous period, and θ is a weighting coefficient that is constant.

[0051] After calculating the second preset value and the second predicted value for the current period, the statistical threshold corresponding to the number of statistical occurrences at the i-th spatial position in the current period can be calculated using the following formula (3). After obtaining the statistical thresholds corresponding to each spatial position, the statistical thresholds can be combined according to the spatial position to obtain the threshold matrix corresponding to each processor matrix, and the dimension of the threshold matrix W is also N*M.

[0052] Optionally, each processor matrix is ​​compared with its corresponding threshold matrix to obtain the spatial location of the abnormal target, including: comparing the statistical count in each processor matrix with the statistical threshold under the spatial location of the corresponding threshold matrix to obtain the comparison result; obtaining the target spatial location with a statistical count greater than the statistical threshold from the comparison result, wherein the number of target spatial locations is at least one; and locating the target spatial location as the abnormal target spatial location.

[0053] Optionally, risk points are determined based on the spatial location of abnormal targets, including: when each row of the processor matrix contains the spatial location of an abnormal target, a sudden increase in risk is determined; based on the sudden increase risk, feature values ​​are collected from the linked list associated with the spatial location of the abnormal target, using the rows of the processor matrix as the collection unit, to obtain multiple feature value sets, where each feature value set corresponds to a row; the same feature values ​​present in each feature value set are taken as sudden increase feature values; the target alarm information to which the sudden increase feature value belongs is obtained, and the risk point is determined based on the target alarm information.

[0054] Specifically, in this embodiment, after obtaining each processor matrix and the threshold matrix corresponding to the processor matrix, the statistical counts in each processor matrix are compared with the statistical thresholds at the corresponding spatial positions of the threshold matrix. For example, for the sketch processor corresponding to the IP feature variable, the statistical counts x1 at the spatial position of the processor matrix U[1][1] are compared with the statistical thresholds X at the spatial position of the threshold matrix W[1][1]. When x1 is greater than X, the spatial position of U[1][1] is taken as the target spatial position, and the target spatial position U[1][1] is positioned as the abnormal target spatial position.

[0055] It should be noted that when multiple abnormal target spatial locations are obtained through comparison, if an abnormal target spatial location appears in every row of the processor matrix, it is considered that a sudden increase risk has occurred. For example, if the processor matrix is ​​determined to be a 3*4 matrix, i.e., a matrix with three rows and four columns, and the determined abnormal target spatial locations are U[1][1], U[2][1], and U[3][2], then a sudden increase risk is determined to have occurred. For each row in the processor matrix, extract the feature values ​​of all abnormal target spatial locations. For example, the feature value set collected from the linked list associated with the abnormal target spatial location U[1][1] in the first row is {00a00b00c}, the feature value set collected from the linked list associated with the abnormal target spatial location U[2][1] in the second row is {00a00b}, and the feature value set collected from the linked list associated with the abnormal target spatial location U[3][2] in the third row is {00a}. Since the same feature value 00a is contained in all three feature value sets, 00a is taken as the sudden increase feature value. The feature value to which 00a belongs is alarm information 1. Alarm information 1 is taken as the target alarm information, and the risk point is determined according to alarm information 1. Of course, this embodiment is only an example of obtaining one abnormal target spatial location in one row. In actual application, multiple abnormal target spatial locations can be determined in each row of the processor matrix. As long as the number of abnormal target spatial locations determined in each row is less than the number of columns in the processor matrix, they are all within the protection scope of this application. This embodiment does not limit them.

[0056] This embodiment uses a sketch processor to perform hash calculations on the alarm information feature set and statistically analyzes the obtained hash values. This allows for the indirect identification of sudden increases in feature values ​​by statistically analyzing hash values ​​while saving space. This helps to filter out risk points of sudden alarm increases, effectively saving time for manual alarm screening and improving the accuracy of alarm analysis.

[0057] Figure 2 The flowchart of the risk point determination method provided in this application embodiment is based on the above embodiment. Specifically, after locating the risk point in the lake area, the associated users and notification methods of the risk point are determined, and the risk point is sent to the associated users using the determined notification method. Figure 2 As shown, it includes the following steps:

[0058] Step S201: Obtain the alarm information generated within the current period.

[0059] Step S202: Classify the alarm information according to the attribute information to obtain multiple alarm information sets.

[0060] Optionally, multiple alarm information sets are obtained by classifying each alarm information according to the attribute information, including: identifying each alarm information to obtain the risk scenarios and feature variables contained in the attribute information; classifying alarm information with the same risk scenarios and feature variables into the same alarm information set; and distributing each alarm information set to a matching sketch processor, wherein each sketch processor corresponds to a type of feature variable.

[0061] Step S203: Calculate the hash value of each feature value in the matched alarm information set through each sketch processor, and statistically analyze the obtained hash values ​​to obtain the processor matrix.

[0062] Optionally, each sketch processor calculates the hash value of the feature value in the matched alarm information set, and performs statistical analysis on the obtained hash values ​​to obtain the processor matrix. This includes: calculating the hash value of each feature value using a specified number of hash functions in each sketch processor; determining the mapping space corresponding to the specified number of hash functions, and statistically analyzing the occurrence frequency of each hash value; determining the spatial position of each hash value in the mapping space, and determining the processor matrix based on the spatial position and the statistical frequency.

[0063] Optionally, the method also includes: determining the feature value corresponding to the hash value at each spatial location; and associating each feature value with the spatial location in the form of a linked list.

[0064] Step S204: Compare each processor matrix with the corresponding threshold matrix to obtain the spatial location of the abnormal target, and determine the risk point based on the spatial location of the abnormal target.

[0065] Optionally, before comparing each processor matrix with its corresponding threshold matrix to obtain the spatial location of the abnormal target, the method further includes: obtaining a first predicted value, a first actual statistical value, and a first predicted offset for the number of statistical occurrences in each processor matrix in the adjacent previous period; obtaining a second predicted value for the number of statistical occurrences in the current period based on the first predicted value and the first actual statistical value; obtaining a second predicted offset for the current period based on the first predicted value, the first actual statistical value, and the first predicted offset; obtaining a statistical threshold corresponding to the number of statistical occurrences at each spatial location in the current period based on the second predicted value and the second predicted offset; and combining the statistical thresholds according to their spatial locations to obtain a threshold matrix corresponding to each processor matrix, wherein the threshold matrix has the same dimension as the corresponding processor matrix.

[0066] Step S205: Determine the associated users and notification methods for the risk points, and send the risk points to the associated users using the notification method.

[0067] Specifically, in this implementation, after acquiring the risk, the associated users and notification methods for the risk point can be determined. The risk point specifically includes the risk scenario where the warning has appeared, characteristic variables, characteristic values, and user actions. The associated users can be pre-specified. For example, for the characteristic variable IP in the risk scenario, the associated user f is determined to need to receive an alert, and the notification method is SMS. Thus, after identifying the risk point, the risk point is sent to the associated user f via SMS. Based on the warning information, it is possible to know in which risk scenario the sudden risk has occurred, and based on the characteristic values, risk tracking and analysis can be performed quickly and accurately to locate the risk user, enabling more timely understanding and response to the platform's current major risks.

[0068] This embodiment utilizes a sketch processor to perform hash calculations on the alarm information feature set and statistically analyzes the obtained hash values. This allows for indirect identification of sudden increases in feature values ​​while saving space, thereby filtering out risk points of alarm surges. This effectively saves time compared to manual alarm screening and improves the accuracy of alarm analysis. By sending notifications to relevant users about these risk points, users can promptly learn in which risk scenario a sudden risk has occurred, enabling them to timely grasp and respond to the platform's main risks.

[0069] Example 3

[0070] Figure 3 This is a schematic diagram of the risk point determination device provided in an embodiment of this application. Figure 3 As shown, the risk point determination device includes: an alarm information acquisition module 310, an alarm information set acquisition module 320, a processor matrix acquisition module 330, and a risk point determination module 340.

[0071] The alarm information acquisition module 310 is used to acquire alarm information generated in the current period, wherein the alarm information includes attribute information and feature values;

[0072] The alarm information set acquisition module 320 is used to classify each alarm information according to attribute information and acquire multiple alarm information sets, wherein each alarm information set is matched with a sketch processor.

[0073] The processor matrix acquisition module 330 is used to calculate the hash value of each feature value in the matched alarm information set through each sketch processor, and to statistically obtain the processor matrix by statistically analyzing the acquired hash values. The processor matrix includes the spatial position and statistical count of each hash value.

[0074] The risk point determination module 340 is used to compare each processor matrix with the corresponding threshold matrix to obtain the spatial location of the abnormal target, and determine the risk point based on the spatial location of the abnormal target. The threshold matrix includes the statistical threshold of each spatial location in the current period.

[0075] Optionally, an alarm information set acquisition module is used to identify the risk scenarios and feature variables contained in the attribute information of each alarm information.

[0076] Alarm messages with the same risk scenarios and characteristic variables are grouped into the same alarm message set, and each alarm message set is distributed to a matching sketch processor, where each sketch processor corresponds to a type of characteristic variable.

[0077] Optionally, a processor matrix acquisition module is used to calculate hash values ​​for each feature value by using a specified number of hash functions on each sketch processor;

[0078] Determine the mapping space corresponding to a specified number of hash functions, and count the occurrences of each hash value to obtain the statistical count;

[0079] Determine the spatial location of each hash value in the mapping space, and determine the processor matrix based on the spatial location and the number of statistical occurrences.

[0080] Optionally, the device also includes a feature value association module for determining the feature value corresponding to the hash value at each spatial location;

[0081] Each feature value is associated with a spatial location in the form of a linked list.

[0082] Optionally, the device further includes a threshold matrix acquisition module, used to acquire the first predicted value, the first actual statistical value and the first predicted offset of the number of times the statistics are recorded in each processor matrix in the adjacent previous period;

[0083] Based on the first predicted value and the first actual statistical value, obtain the second predicted value of the number of statistical occurrences in the current period;

[0084] Based on the first predicted value, the first actual statistical value, and the first predicted offset, obtain the second predicted offset within the current period;

[0085] Based on the second predicted value and the second predicted offset, obtain the statistical threshold corresponding to the number of statistical occurrences at each spatial location in the current period;

[0086] The statistical thresholds are combined according to their spatial location to obtain the threshold matrix corresponding to each processor matrix, wherein the threshold matrix and the corresponding processor matrix have the same dimension.

[0087] Optionally, the risk point determination module includes an abnormal target spatial location determination submodule, which is used to compare the statistical frequency in each processor matrix with the statistical threshold under the corresponding threshold matrix spatial location to obtain the comparison result;

[0088] From the comparison results, obtain the target spatial locations where the number of statistical occurrences exceeds the statistical threshold, wherein the number of target spatial locations is at least one;

[0089] The target spatial location is identified as an abnormal target spatial location.

[0090] Optionally, the risk point determination module includes a risk point determination submodule, used to determine that a sudden increase in risk has occurred when each row of the processor matrix contains the spatial location of the abnormal target.

[0091] Based on the sudden increase in risk, feature values ​​are collected from the linked list associated with the spatial location of the abnormal target, using the behavior of the processor matrix as the collection unit, to obtain multiple feature value sets, wherein each feature value set corresponds to a row.

[0092] The same eigenvalue that exists in all of the aforementioned eigenvalue sets is taken as the burst eigenvalue;

[0093] Obtain the target alarm information to which the sudden increase in feature value belongs, and determine the risk point based on the target alarm information.

[0094] Optionally, the device also includes a wind-limited sending module for determining the associated users and notification methods for risk points;

[0095] Risk points will be sent to associated users via notification.

[0096] It should be noted that the division of the various modules in the above device is merely a logical functional division. In actual implementation, they can be fully or partially integrated into a single physical entity, or they can be physically separated. Furthermore, these modules can be implemented entirely in software through processing element calls; they can be fully implemented in hardware; or some modules can be implemented through processing element calls in software, while others are implemented in hardware. Additionally, these modules can be integrated together or implemented independently. The processing element here can be an integrated circuit with signal processing capabilities. During implementation, each step of the above method or each of the above modules can be completed through the integrated logic circuits in the hardware of the processor element or through software instructions.

[0097] Example 4

[0098] Figure 4A schematic diagram of an electronic device 10 that can be used to implement embodiments of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices (e.g., helmets, glasses, watches, etc.), and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the invention described and / or claimed herein.

[0099] like Figure 4 As shown, the electronic device 10 includes at least one processor 11 and a memory, such as a read-only memory (ROM) 12 or a random access memory (RAM) 13, communicatively connected to the at least one processor 11. The memory stores computer programs executable by the at least one processor. The processor 11 can perform various appropriate actions and processes based on the computer program stored in the ROM 12 or loaded from storage unit 18 into the RAM 13. The RAM 13 may also store various programs and data required for the operation of the electronic device 10. The processor 11, ROM 12, and RAM 13 are interconnected via a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0100] Multiple components in electronic device 10 are connected to I / O interface 15, including: input unit 16, such as keyboard, mouse, etc.; output unit 17, such as various types of displays, speakers, etc.; storage unit 18, such as disk, optical disk, etc.; and communication unit 19, such as network card, modem, wireless transceiver, etc. Communication unit 19 allows electronic device 10 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0101] Processor 11 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. Processor 11 performs the various methods and processes described above, such as risk point determination methods.

[0102] In some embodiments, the risk point determination method may be implemented as a computer program tangibly contained in a computer-readable storage medium, such as storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on electronic device 10 via ROM 12 and / or communication unit 19. When the computer program is loaded into RAM 13 and executed by processor 11, one or more steps of the risk point determination method described above may be performed. Alternatively, in other embodiments, processor 11 may be configured to perform the risk point determination method by any other suitable means (e.g., by means of firmware).

[0103] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), systems-on-a-chip (SoCs), payload-programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0104] Computer programs used to implement the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, such that when executed by the processor, the computer programs cause the functions / operations specified in the flowcharts and / or block diagrams to be performed. The computer programs may be executed entirely on a machine, partially on a machine, or as a standalone software package, partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0105] In the context of this invention, a computer-readable storage medium can be a tangible medium that may contain or store a computer program for use by or in conjunction with an instruction execution system, apparatus, or device. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination thereof. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0106] To provide interaction with a user, the systems and techniques described herein can be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the electronic device. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0107] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as data servers), or computing systems that include middleware components (e.g., application servers), or computing systems that include frontend components (e.g., user computers with graphical user interfaces or web browsers through which users can interact with implementations of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., communication networks). Examples of communication networks include local area networks (LANs), wide area networks (WANs), blockchain networks, and the Internet.

[0108] A computing system can include clients and servers. Clients and servers are generally located far apart and typically interact through communication networks. The client-server relationship is created by computer programs running on the respective computers and having a client-server relationship with each other. The server can be a cloud server, also known as a cloud computing server or cloud host, which is a hosting product within the cloud computing service system to address the shortcomings of traditional physical hosts and VPS services, such as high management difficulty and weak business scalability.

[0109] This invention also provides a computer program product, including a computer program that, when executed by a processor, implements the risk point determination method as provided in any embodiment of this application.

[0110] In implementing the computer program product, computer program code for performing the operations of this invention can be written in one or more programming languages ​​or a combination thereof. Programming languages ​​include object-oriented programming languages ​​such as Java, Smalltalk, and C++, as well as conventional procedural programming languages ​​such as C or similar languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including a local area network (LAN) or a wide area network (WAN)—or can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0111] Note that the above description is merely a preferred embodiment of the present invention and the technical principles employed. Those skilled in the art will understand that the present invention is not limited to the specific embodiments described herein, and various obvious changes, readjustments, and substitutions can be made without departing from the scope of protection of the present invention. Therefore, although the present invention has been described in detail through the above embodiments, the present invention is not limited to the above embodiments, and may include many other equivalent embodiments without departing from the concept of the present invention, the scope of which is determined by the scope of the appended claims.

Claims

1. A method for determining risk points, characterized in that, include: Obtain alarm information generated within the current period, wherein the alarm information includes attribute information and feature values; Based on the attribute information, the alarm information is classified to obtain multiple alarm information sets, wherein each alarm information set is matched with a sketch processor. Each of the sketch processors calculates the hash value of each feature value in the matched alarm information set, and performs statistical analysis on the obtained hash values ​​to obtain a processor matrix, wherein the processor matrix includes the spatial location and statistical count of each hash value; Each processor matrix is ​​compared with its corresponding threshold matrix to obtain the spatial location of the abnormal target, and the risk point is determined based on the spatial location of the abnormal target. The threshold matrix includes the statistical threshold of each spatial location in the current period. The step of classifying each alarm information according to the attribute information to obtain multiple alarm information sets includes: identifying each alarm information to obtain the risk scenarios and feature variables contained in the attribute information; Alarm information with the same risk scenario and characteristic variables is grouped into the same alarm information set, and each alarm information set is distributed to the matching sketch processor, wherein each sketch processor corresponds to a type of characteristic variable. Before comparing each processor matrix with its corresponding threshold matrix to obtain the abnormal hash value, the method further includes: obtaining the first predicted value, the first actual statistical value, and the first predicted offset of the number of times the statistics are counted in each processor matrix in the adjacent previous period. Based on the first predicted value and the first actual statistical value, obtain a second predicted value for the number of statistical occurrences within the current period; Based on the first predicted value, the first actual statistical value, and the first predicted offset, obtain the second predicted offset within the current period; Based on the second predicted value and the second predicted offset, obtain the statistical threshold corresponding to the number of times the statistics are counted at each spatial location in the current period; The statistical thresholds are combined according to their spatial locations to obtain a threshold matrix corresponding to each processor matrix, wherein the threshold matrix has the same dimension as the corresponding processor matrix.

2. The method according to claim 1, characterized in that, The step of calculating the hash value of the feature values ​​in the matched alarm information set by each of the sketch processors, and statistically analyzing the obtained hash values ​​to obtain the processor matrix, includes: Each of the sketch processors uses a specified number of hash functions to calculate the hash value of each feature value. Determine the mapping space corresponding to the specified number of hash functions, and count the occurrences of each hash value to obtain the statistical count; Determine the spatial location of each hash value in the mapping space, and determine the processor matrix based on the spatial location and the statistical count.

3. The method according to claim 2, characterized in that, The method further includes: Determine the feature value corresponding to the hash value at each of the aforementioned spatial locations; Each feature value is associated with the spatial location in the form of a linked list.

4. The method according to claim 3, characterized in that, The step of comparing each processor matrix with its corresponding threshold matrix to obtain the spatial location of the abnormal target includes: The statistical counts in each processor matrix are compared with the statistical thresholds at the corresponding threshold matrix spatial locations to obtain the comparison results; From the comparison results, obtain the target spatial locations where the number of statistical occurrences is greater than a statistical threshold, wherein the number of the target spatial locations is at least one; The target spatial location is defined as the abnormal target spatial location.

5. The method according to claim 4, characterized in that, The step of determining the risk point based on the spatial location of the abnormal target includes: When each row of the processor matrix contains the spatial location of the abnormal target, a sudden increase in risk is determined to have occurred. Based on the sudden increase in risk, feature values ​​are collected from the linked list associated with the spatial location of the abnormal target, using the behavior of the processor matrix as the collection unit, to obtain multiple feature value sets, wherein each feature value set corresponds to a row. The same eigenvalue that exists in all of the aforementioned eigenvalue sets is taken as the burst eigenvalue; Obtain the target alarm information to which the sudden increase in feature value belongs, and determine the risk point based on the target alarm information.

6. The method according to any one of claims 1 to 5, characterized in that, After determining the risk point based on the spatial location of the abnormal target, the method further includes: Determine the associated users and notification methods for the aforementioned risk points; The risk points will be sent to the associated users using the notification method described above.

7. A risk point determination device, characterized in that, include: The alarm information acquisition module is used to acquire alarm information generated within the current period, wherein the alarm information includes attribute information and feature values; The alarm information set acquisition module is used to classify each alarm information according to the attribute information to obtain multiple alarm information sets, wherein each alarm information set is matched with a sketch processor. The processor matrix acquisition module is used to calculate the hash value of each feature value in the matched alarm information set through each of the sketch processors, and to statistically obtain the processor matrix by statistically analyzing the obtained hash values. The processor matrix includes the spatial position and statistical count of each hash value. The risk point determination module is used to compare each of the processor matrices with the corresponding threshold matrix to obtain the spatial location of the abnormal target, and to determine the risk point based on the spatial location of the abnormal target. The threshold matrix includes the statistical threshold of each spatial location in the current period. The alarm information set acquisition module is used to identify each alarm information and obtain the risk scenarios and feature variables contained in the attribute information; Alarm information with the same risk scenario and characteristic variables is grouped into the same alarm information set, and each alarm information set is distributed to the matching sketch processor, wherein each sketch processor corresponds to a type of characteristic variable. The device further includes a threshold matrix acquisition module, used to acquire the first predicted value, the first actual statistical value and the first predicted offset of the number of times the statistics are counted in each processor matrix in the adjacent previous period; Based on the first predicted value and the first actual statistical value, obtain a second predicted value for the number of statistical occurrences within the current period; Based on the first predicted value, the first actual statistical value, and the first predicted offset, obtain the second predicted offset within the current period; Based on the second predicted value and the second predicted offset, obtain the statistical threshold corresponding to the number of times the statistics are counted at each spatial location in the current period; The statistical thresholds are combined according to their spatial locations to obtain a threshold matrix corresponding to each processor matrix, wherein the threshold matrix has the same dimension as the corresponding processor matrix.

8. The apparatus according to claim 7, characterized in that, The alarm information set acquisition module is used to identify each alarm information and obtain the risk scenarios and feature variables contained in the attribute information; Alarm information with the same risk scenario and characteristic variables is grouped into the same alarm information set, and each alarm information set is distributed to the matching sketch processor, wherein each sketch processor corresponds to a type of characteristic variable.

9. The apparatus according to claim 7, characterized in that, The processor matrix acquisition module is used to calculate the hash value of each feature value by using a specified number of hash functions on each of the sketch processors; Determine the mapping space corresponding to the specified number of hash functions, and count the occurrences of each hash value to obtain the statistical count; Determine the spatial location of each hash value in the mapping space, and determine the processor matrix based on the spatial location and the statistical count.

10. An electronic device, characterized in that, include: A processor, and a memory communicatively connected to the processor; The memory stores computer-executed instructions; The processor executes computer execution instructions stored in the memory to implement the method as described in any one of claims 1-6.

11. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-executable instructions, which, when executed by a processor, are used to implement the method as described in any one of claims 1-6.

12. A computer program product, characterized in that, Includes a computer program that, when executed by a processor, implements the method of any one of claims 1-6.

Images