Order risk control method and device based on anomaly detection algorithm, and storage medium
By preprocessing order data and calculating residual data, and training the model using moving average indicators and the isolated forest algorithm, the problem of high false positive and false negative rates in order data anomaly detection is solved, achieving applicability and cost-effectiveness to different data models.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- CHINA MOBILE (SUZHOU) SOFTWARE TECH CO LTD
- Filing Date
- 2021-10-25
- Publication Date
- 2026-06-09
AI Technical Summary
Existing technologies have high false alarm and false negative rates in order data anomaly detection, cannot take into account both the periodic and real-time changes of data, and have difficulty adapting data models to different ordering systems.
By preprocessing historical order data, calculating residual data, and training an anomaly detection model using the isolated forest algorithm, risk prediction is performed in conjunction with multiple moving average indicators.
It effectively balances the periodic and real-time changes in data, improves the universality of the detection model, reduces training costs, and decreases the false positive and false negative rates.
Smart Images
Figure CN116070897B_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of risk control data, and specifically to an order risk control method, apparatus, computing device, and computer storage medium based on anomaly detection algorithms. Background Technology
[0002] With the development of the telecommunications industry, both business volume and the corresponding order volume have grown rapidly, putting pressure on the normal operation of the system due to the large amount of order data. Therefore, it is necessary to implement early warning and risk control for order data and to predict the risks associated with order data.
[0003] Currently, three methods are commonly used: The first is rule-based, comparing the current order volume with the previous timeframe and triggering an alarm if a certain threshold is exceeded; the second is monitoring and alarming based on a baseline alarm model formed using statistical methods; and the third is a predictor-based algorithm that generates a predictor value for the current order data, compares it with the actual value, and uses a threshold method to determine if the current order data is abnormal. Of these methods, the first method has both high false positive and false negative rates. The second method considers the periodicity of the order data time series but ignores the real-time characteristics, resulting in equally high false positive and false negative rates, and frequent alarms prevent timely responses from operations and maintenance. The third method determines an anomaly if the difference between the actual and predicted values exceeds a certain percentage of the predicted value, also resulting in a high false positive rate. Summary of the Invention
[0004] In view of the above problems, the present invention is proposed to provide an order risk control method based on an anomaly detection algorithm and a corresponding order risk control device based on anomaly detection algorithm, computing device and computer storage medium to overcome or at least partially solve the above problems.
[0005] According to one aspect of the present invention, an order risk control method based on an anomaly detection algorithm is provided, the method comprising:
[0006] Obtain the historical order dataset, perform data preprocessing on the historical order dataset, and obtain the sample dataset;
[0007] For each sample data in the sample dataset, multiple residual data corresponding to that sample data are calculated based on multiple moving average indicators;
[0008] The target anomaly detection model is obtained by training the model using multiple residual data corresponding to multiple sample data.
[0009] Based on multiple moving average indicators, multiple residual data corresponding to real-time data are calculated, and the multiple residual data corresponding to real-time data are input into the target anomaly detection model for risk prediction to obtain the corresponding risk prediction results.
[0010] In the above scheme, the step of preprocessing the historical order dataset to obtain a sample dataset further includes:
[0011] Missing values in the historical order dataset are filled in, and each historical order data in the historical order dataset is standardized and normalized to obtain a sample dataset.
[0012] In the above scheme, the process of completing missing values in the historical order dataset further includes:
[0013] Search the historical order dataset for historical order data with missing values;
[0014] For each historical order data with a missing value, the average of a first preset number of historical order data without missing values in the historical order dataset is calculated as the imputation value corresponding to the missing value, and the missing value in the historical order data is imputed using the imputation value.
[0015] In the above scheme, the step of calculating multiple residual data corresponding to each sample data in the sample dataset based on multiple moving average indicators further includes:
[0016] Calculate multiple first moving average data corresponding to the sample data based on multiple moving average indicators;
[0017] Calculate the difference between the sample data and each first moving average data point;
[0018] Based on the difference between the sample data and each first moving average data, multiple residual data corresponding to the sample data are obtained.
[0019] In the above scheme, the step of using multiple residual data corresponding to multiple sample data to train the model and obtain the target anomaly detection model further includes:
[0020] An initial anomaly detection model was constructed using the isolated forest algorithm;
[0021] The sample dataset is divided into a first subset and a second subset;
[0022] The initial anomaly detection model is trained using multiple residual data corresponding to multiple sample data in the first subset to obtain a trained anomaly detection model.
[0023] In the above scheme, the step of using multiple residual data corresponding to multiple sample data to train the model and obtain the target anomaly detection model further includes:
[0024] The trained anomaly detection model is evaluated using multiple residual data corresponding to multiple sample data in the second subset to obtain evaluation parameters;
[0025] Determine whether the evaluation parameter exceeds a preset threshold;
[0026] If so, the trained anomaly detection model will be used as the target anomaly detection model.
[0027] If not, the model will be retrained until the evaluation parameters exceed the preset threshold to obtain the target anomaly detection model.
[0028] In the above scheme, the step of calculating multiple residual data corresponding to real-time data based on multiple moving average indicators further includes:
[0029] Calculate multiple second moving average data corresponding to the real-time data based on multiple moving average indicators;
[0030] Calculate the difference between the real-time data and each second moving average data;
[0031] Based on the difference between the real-time data and each second moving average data, multiple residual data corresponding to the real-time data are obtained.
[0032] According to another aspect of the present invention, an order risk control device based on an anomaly detection algorithm is provided, comprising: a preprocessing module, a calculation module, a training module, and a risk prediction module; wherein,
[0033] The preprocessing module is used to acquire historical order datasets, perform data preprocessing on the historical order datasets, and obtain sample datasets.
[0034] The calculation module is used to calculate multiple residual data corresponding to each sample data in the sample dataset based on multiple moving average indicators.
[0035] The training module is used to train the model using multiple residual data corresponding to multiple sample data to obtain the target anomaly detection model.
[0036] The risk prediction module is used to calculate multiple residual data corresponding to real-time data based on multiple moving average indicators, input the multiple residual data corresponding to real-time data into the target anomaly detection model for risk prediction, and obtain the corresponding risk prediction result.
[0037] According to another aspect of the present invention, a computing device is provided, comprising: a processor, a memory, a communication interface, and a communication bus, wherein the processor, the memory, and the communication interface communicate with each other via the communication bus;
[0038] The memory is used to store at least one executable instruction, which causes the processor to perform operations corresponding to the order risk control method based on the anomaly detection algorithm described above.
[0039] According to another aspect of the present invention, a computer storage medium is provided, wherein at least one executable instruction is stored in the storage medium, the executable instruction causing a processor to perform the operation corresponding to the order risk control method based on the above-described anomaly detection algorithm.
[0040] According to the technical solution provided by this invention, a historical order dataset is obtained, and the historical order dataset is preprocessed to obtain a sample dataset. For each sample data in the sample dataset, multiple residual data corresponding to the sample data are calculated based on multiple moving average indicators. The multiple residual data corresponding to the multiple sample data are used to train the model to obtain a target anomaly detection model. Based on multiple moving average indicators, multiple residual data corresponding to real-time data are calculated, and the multiple residual data corresponding to the real-time data are input into the target anomaly detection model for risk prediction to obtain the corresponding risk prediction result. This solves the problems in the prior art, such as the relatively simple processing of order data, the inability to consider the periodic and real-time changes of data, resulting in a relatively high false positive and false negative rate, and the inability of existing prediction algorithm-based methods to efficiently adapt to different data models of different ordering systems. The technical solution provided by this invention, by preprocessing order data and using moving averages to calculate residual data, effectively takes into account both the periodic and real-time changes of data. At the same time, it makes the anomaly detection model trained based on the processed data applicable to anomaly detection of different data models, greatly improving the universality of the detection model based on the anomaly detection algorithm and significantly reducing the training cost required for detection of different data models.
[0041] The above description is merely an overview of the technical solution of the present invention. In order to better understand the technical means of the present invention and to implement it in accordance with the contents of the specification, and in order to make the above and other objects, features and advantages of the present invention more apparent and understandable, specific embodiments of the present invention are described below. Attached Figure Description
[0042] Various other advantages and benefits will become apparent to those skilled in the art upon reading the following detailed description of preferred embodiments. The accompanying drawings are for illustrative purposes only and are not intended to limit the invention. Furthermore, the same reference numerals denote the same parts throughout the drawings. In the drawings:
[0043] Figure 1A A flowchart illustrating an order risk control method based on an anomaly detection algorithm according to an embodiment of the present invention is shown.
[0044] Figure 1B A schematic diagram of an order risk control method based on an anomaly detection algorithm according to an embodiment of the present invention is shown.
[0045] Figure 2 A schematic diagram of the training process of a target anomaly detection model according to an embodiment of the present invention is shown;
[0046] Figure 3 A structural block diagram of an order risk control device based on an anomaly detection algorithm according to an embodiment of the present invention is shown;
[0047] Figure 4 A schematic diagram of the structure of a computing device according to an embodiment of the present invention is shown. Detailed Implementation
[0048] Exemplary embodiments of the present disclosure will now be described in more detail with reference to the accompanying drawings. While exemplary embodiments of the present disclosure are shown in the drawings, it should be understood that the present disclosure may be implemented in various forms and should not be limited to the embodiments set forth herein. Rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the scope of the disclosure to those skilled in the art.
[0049] Figure 1A A flowchart illustrating an order risk control method based on an anomaly detection algorithm according to an embodiment of the present invention is shown, as follows: Figure 1A As shown, the method includes the following steps:
[0050] Step S101: Obtain the historical order dataset, perform data preprocessing on the historical order dataset, and obtain the sample dataset.
[0051] Specifically, missing values in the historical order dataset are filled in, and each historical order data in the historical order dataset is standardized and normalized to obtain a sample dataset.
[0052] The step of completing the missing values in the historical order dataset further includes: searching for historical order data with missing values in the historical order dataset; for each historical order data with missing values, calculating the average of a first preset number of historical order data without missing values in the historical order dataset that precedes the historical order data as the completion value corresponding to the missing value, and using the completion value to complete the missing value in the historical order data.
[0053] Specifically, missing values in historical order data can be spaces, NaNs, or other placeholders. The average of the first preset number of normal historical order data before the current time point where the historical order data with missing values is located is calculated and used as the missing value.
[0054] Specifically, standardizing and normalizing the historical order data in the historical order dataset means unifying the order of magnitude of each historical order data, eliminating the influence of different dimensions between them, and making the historical order data, as well as the corresponding moving average indicators and residual data derived thereafter, comparable, so as to facilitate comprehensive comparison and evaluation.
[0055] Step S102: For each sample data in the sample dataset, calculate multiple residual data corresponding to that sample data based on multiple moving average indicators.
[0056] Specifically, based on multiple moving average indicators, multiple first moving average data corresponding to the sample data are calculated; the difference between the sample data and each first moving average data is calculated; and based on the difference between the sample data and each first moving average data, multiple residual data corresponding to the sample data are obtained.
[0057] The multiple moving average indicators are selected by using moving data selection windows of different lengths to select different numbers of sample data, and their average values are calculated respectively. Each average value is a first moving average data.
[0058] The moving average (MA), also known as the moving average line indicator, reflects the trend characteristics of data. Its calculation formula is generally as follows:
[0059] MA = (C1 + C2 + C3 + ... + Cn) / n
[0060] Where C represents the data at each time point; n represents the number of data points selected, or the number of moving average periods.
[0061] Preferably, the moving average indicator can include, for example, 5, 10, or 30 data points to reflect the data change trends of the sample data in the short, medium, and long term.
[0062] Specifically, calculating the multiple residual data corresponding to the sample data based on multiple moving average indicators means taking the absolute value (i.e., absolute value residual) of the residual between the sample data and the first moving average data corresponding to the sample data under the moving average indicator to obtain the multiple residual data corresponding to each sample data.
[0063] The formula for calculating the residual data, i.e., the absolute value residual, is generally as follows:
[0064] e = |y - MAn|
[0065] Where e represents the residual data; y represents the sample data; and MAn represents the first moving average data corresponding to the sample data under the moving average index.
[0066] Preferably, MAn is MA5, MA10, or MA30.
[0067] Step S103: Use multiple residual data corresponding to multiple sample data to train the model and obtain the target anomaly detection model.
[0068] Specifically, the residual data e corresponding to the sample data in the sample dataset obtained in step S102 is used as the training data for the anomaly detection model, and the target anomaly detection model is obtained after training.
[0069] Step S104: Calculate multiple residual data corresponding to the real-time data based on multiple moving average indicators, and input the multiple residual data corresponding to the real-time data into the target anomaly detection model for risk prediction to obtain the corresponding risk prediction result.
[0070] Specifically, based on multiple moving average indicators, multiple second moving average data corresponding to the real-time data are calculated; the difference between the real-time data and each second moving average data is calculated; and based on the difference between the real-time data and each second moving average data, multiple residual data corresponding to the real-time data are obtained.
[0071] Preferably, the method for calculating the second moving average data and the multiple residual data corresponding to the real-time data is the same as the calculation method in step S102, and will not be repeated here;
[0072] Preferably, the process involves inputting multiple residual data corresponding to the real-time data into the target anomaly detection model for risk prediction, thereby obtaining a corresponding risk prediction result. For example, if the obtained risk prediction result is 1, it indicates that the data is normal; if the obtained risk prediction result is -1, it indicates that the data is abnormal. When the prediction result shows an anomaly, there is an ordering risk, and corresponding measures can be taken.
[0073] Preferably, when the first moving average data are MA5, MA10, and MA30, the specific process from model training to anomaly detection is as follows: Figure 1B As shown; Figure 1B A schematic diagram of an order risk control method based on an anomaly detection algorithm according to an embodiment of the present invention is shown. Figure 1B Specifically, it demonstrates how to train an anomaly detection model based on moving average data, and how to use the trained target anomaly detection model for risk prediction.
[0074] According to the order risk control method based on anomaly detection algorithm provided in this embodiment, a historical order dataset is obtained, and the historical order dataset is preprocessed to obtain a sample dataset. For each sample data in the sample dataset, multiple residual data corresponding to the sample data are calculated based on multiple moving average indicators. The multiple residual data corresponding to the multiple sample data are used to train the model to obtain a target anomaly detection model. Based on multiple moving average indicators, multiple residual data corresponding to real-time data are calculated, and the multiple residual data corresponding to the real-time data are input into the target anomaly detection model for risk prediction to obtain the corresponding risk prediction result. Using the technical solution provided by this invention, by preprocessing order data and training the anomaly detection model based on moving average indicators and residual data, the final target anomaly detection model effectively takes into account both the periodicity and real-time changes of the data. It also allows the anomaly detection model trained based on the processed data to be applicable to anomaly detection for different data models, greatly improving the universality of the detection model based on the anomaly detection algorithm and significantly reducing the training cost required for detection for different data models.
[0075] Figure 2 A schematic diagram of the training process of a target anomaly detection model according to an embodiment of the present invention is shown, such as... Figure 2 As shown, where:
[0076] Step S201: Construct an initial anomaly detection model using the isolated forest algorithm.
[0077] Specifically, this embodiment uses the Isolation Forest algorithm of the scikit-learn machine learning framework to build the initial anomaly detection model. The Isolation Forest algorithm is a fast anomaly detection method based on Ensemble, which has linear time complexity and high accuracy, and meets the requirements of big data processing.
[0078] Step S202: Divide the sample dataset into a first subset and a second subset.
[0079] Specifically, after dividing the sample dataset into a first subset and a second subset, the first subset is used for training the anomaly detection model; the second subset is used for evaluating and testing the anomaly detection model.
[0080] Preferably, the ratio of the first subset to the second subset can be 7:3.
[0081] Step S203: Train the initial anomaly detection model using multiple residual data corresponding to multiple sample data in the first subset to obtain a trained anomaly detection model.
[0082] Specifically, based on the method described above, multiple residual data corresponding to multiple sample data in the first subset are determined and used as training data for the anomaly detection model.
[0083] Step S204: Use multiple residual data corresponding to multiple sample data in the second subset to evaluate the trained anomaly detection model and obtain evaluation parameters.
[0084] Specifically, based on the method described above, multiple residual data corresponding to multiple sample data in the second subset are determined and used as test data for the trained anomaly detection model;
[0085] The trained anomaly detection model is used to predict test data, with a predicted value of 1 indicating normal data and -1 indicating abnormal data. The trained anomaly detection model is then evaluated based on the prediction results and the original test data.
[0086] Preferably, the model evaluation method is the F1 score evaluation method, and the calculation process is as follows:
[0087]
[0088] Where precision is the accuracy rate; TP (True Positive) means the predicted answer is correct; FP (False Positive) means that other classes were incorrectly predicted as this class.
[0089]
[0090] Here, recall is the recall rate or the number of searches; TP (True Positive) means the predicted answer is correct; and FN (False Negative) means the label of this class is predicted to be another class.
[0091]
[0092] Here, F1 is the evaluation result F1 score, which can be regarded as a harmonic mean of the precision and recall of the anomaly detection model. Its maximum value is 1 and its minimum value is 0. The closer F1 is to 1, the better the detection effect of the anomaly detection model.
[0093] Step S205: Determine whether the evaluation parameter exceeds a preset threshold.
[0094] Specifically, if yes, proceed to step S206; otherwise, proceed to step S207.
[0095] Preferably, the evaluation parameter may specifically be the F1 score in step S204.
[0096] Step S206: Use the trained anomaly detection model as the target anomaly detection model.
[0097] Step S207: Retrain the model until the evaluation parameters exceed the preset threshold to obtain the target anomaly detection model.
[0098] Preferably, when retraining the model, the following hyperparameters can be tuned:
[0099] n_estimators: int, the number of base estimators in the set (i.e., the number of trees in the isolated forest), the default value is 100;
[0100] contamination: float(0,0.5), is the contamination amount of the dataset, i.e., the proportion of outliers in the dataset, with a default value of 0.1; it is used to define the threshold of the decision function during fitting, which refers to the expected proportion of outliers in the dataset, and is used when fitting the threshold based on the sample scores;
[0101] max_samples: The number of data points to train each base estimator; if max_samples is larger than the sample size, all base estimators (trees) will be trained using all samples; the default value is [auto], and if the value is [auto], then max_samples = min(256, n_samples);
[0102] max_features: The number of features used to train each base estimator (tree); the default value is 1; in this embodiment, three moving average metrics, MA5, MA10 and MA30, are used. If the training effect of the anomaly detection model is not good after evaluation, other moving average metrics of MAn can be selected for retraining.
[0103] Figure 3 A structural block diagram of an order risk control device based on an anomaly detection algorithm according to an embodiment of the present invention is shown, as follows: Figure 3 As shown, the device includes: a preprocessing module 301, a calculation module 302, a training module 303, and a risk prediction module 304; wherein,
[0104] The preprocessing module 301 is used to acquire historical order datasets, perform data preprocessing on the historical order datasets, and obtain sample datasets.
[0105] Specifically, the preprocessing module 301 is further used to: complete the missing values in the historical order dataset, and standardize and normalize each historical order data in the historical order dataset to obtain a sample dataset.
[0106] The preprocessing module 301 is further configured to: search for historical order data with missing values in the historical order dataset; for each historical order data with missing values, calculate the average of a first preset number of historical order data without missing values in the historical order dataset that precedes the historical order data as the imputation value corresponding to the missing value, and use the imputation value to imput the missing value in the historical order data.
[0107] The calculation module 302 is used to calculate multiple residual data corresponding to each sample data in the sample dataset based on multiple moving average indicators.
[0108] Specifically, the calculation module 302 is further configured to: calculate multiple first moving average data corresponding to the sample data based on multiple moving average indicators; calculate the difference between the sample data and each first moving average data; and obtain multiple residual data corresponding to the sample data based on the difference between the sample data and each first moving average data.
[0109] The training module 303 is used to train the model using multiple residual data corresponding to multiple sample data to obtain the target anomaly detection model.
[0110] Specifically, the training module 303 is further used to: construct an initial anomaly detection model using the isolated forest algorithm; divide the sample dataset into a first subset and a second subset; and train the initial anomaly detection model using multiple residual data corresponding to multiple sample data in the first subset to obtain a trained anomaly detection model.
[0111] The training module 303 is further configured to: evaluate the trained anomaly detection model using multiple residual data corresponding to multiple sample data in the second subset to obtain evaluation parameters; determine whether the evaluation parameters exceed a preset threshold; if so, use the trained anomaly detection model as the target anomaly detection model; if not, retrain the model until the evaluation parameters exceed the preset threshold to obtain the target anomaly detection model.
[0112] The risk prediction module 304 is used to calculate multiple residual data corresponding to real-time data based on multiple moving average indicators, input the multiple residual data corresponding to real-time data into the target anomaly detection model for risk prediction, and obtain the corresponding risk prediction result.
[0113] Specifically, the risk prediction module 304 is further configured to: calculate multiple second moving average data corresponding to the real-time data based on multiple moving average indicators; calculate the difference between the real-time data and each second moving average data; and obtain multiple residual data corresponding to the real-time data based on the difference between the real-time data and each second moving average data.
[0114] According to the order risk control device based on anomaly detection algorithm provided in this embodiment, a historical order dataset is acquired, and the historical order dataset is preprocessed to obtain a sample dataset. For each sample data in the sample dataset, multiple residual data corresponding to the sample data are calculated based on multiple moving average indicators. The multiple residual data corresponding to the multiple sample data are used to train the model to obtain a target anomaly detection model. Based on multiple moving average indicators, multiple residual data corresponding to real-time data are calculated, and the multiple residual data corresponding to the real-time data are input into the target anomaly detection model for risk prediction to obtain the corresponding risk prediction result. Using the technical solution provided by this invention, by preprocessing order data and training the anomaly detection model based on moving average indicators and residual data, the final target anomaly detection model effectively takes into account both the periodicity and real-time changes of the data. It also allows the anomaly detection model trained based on the processed data to be applicable to anomaly detection for different data models, greatly improving the universality of the detection model based on the anomaly detection algorithm and significantly reducing the training cost required for detection for different data models.
[0115] The present invention also provides a non-volatile computer storage medium storing at least one executable instruction that can execute the order risk control method based on the anomaly detection algorithm in any of the above method embodiments.
[0116] Figure 4 The diagram illustrates the structure of a computing device according to an embodiment of the present invention. The specific embodiments of the present invention do not limit the specific implementation of the computing device.
[0117] like Figure 4 As shown, the computing device may include: a processor 402, a communications interface 404, a memory 406, and a communications bus 408.
[0118] in:
[0119] The processor 402, communication interface 404, and memory 406 communicate with each other via communication bus 408.
[0120] Communication interface 404 is used to communicate with other network elements such as clients or other servers.
[0121] The processor 402 is used to execute program 410, specifically to execute the relevant steps in the above-described example of the order risk control method based on the anomaly detection algorithm.
[0122] Specifically, program 410 may include program code that includes computer operation instructions.
[0123] Processor 402 may be a central processing unit (CPU), an application-specific integrated circuit (ASIC), or one or more integrated circuits configured to implement embodiments of the present invention. The computing device includes one or more processors, which may be processors of the same type, such as one or more CPUs; or processors of different types, such as one or more CPUs and one or more ASICs.
[0124] Memory 406 is used to store program 410. Memory 406 may include high-speed RAM memory, and may also include non-volatile memory, such as at least one disk storage device.
[0125] Specifically, program 410 can be used to cause processor 402 to execute the order risk control method based on the anomaly detection algorithm in any of the above method embodiments. The specific implementation of each step in program 410 can be found in the corresponding descriptions of the steps and units in the above-described order risk control method embodiments based on the anomaly detection algorithm, and will not be repeated here. Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working process of the devices and modules described above can be referred to the corresponding process descriptions in the foregoing method embodiments, and will not be repeated here.
[0126] The algorithms and displays provided herein are not inherently related to any particular computer, virtual system, or other device. Various general-purpose systems can also be used in conjunction with the teachings herein. The required structure for constructing such systems is apparent from the above description. Furthermore, this invention is not directed to any particular programming language. It should be understood that the contents of the invention described herein can be implemented using various programming languages, and the above description of specific languages is for the purpose of disclosing the best mode of implementation of the invention.
[0127] Numerous specific details are set forth in the specification provided herein. However, it will be understood that embodiments of the invention may be practiced without these specific details. In some instances, well-known methods, structures, and techniques have not been shown in detail so as not to obscure the understanding of this specification.
[0128] Similarly, it should be understood that, in order to streamline this disclosure and aid in understanding one or more of the various inventive aspects, in the above description of exemplary embodiments of the invention, various features of the invention are sometimes grouped together in a single embodiment, figure, or description thereof. However, this method of disclosure should not be interpreted as reflecting an intention that the claimed invention requires more features than are expressly recited in each claim. Rather, as reflected in the claims, inventive aspects lie in fewer than all features of a single foregoing disclosed embodiment. Therefore, the claims following the detailed description are hereby expressly incorporated into that detailed description, wherein each claim itself is a separate embodiment of the invention.
[0129] Those skilled in the art will understand that modules in the device of the embodiments can be adaptively changed and placed in one or more devices different from that embodiment. Modules, units, or components in the embodiments can be combined into a single module, unit, or component, and further, they can be divided into multiple sub-modules, sub-units, or sub-components. Except where at least some of such features and / or processes or units are mutually exclusive, any combination can be used to combine all features disclosed in this specification (including the accompanying claims, abstract, and drawings) and all processes or units of any method or device so disclosed. Unless expressly stated otherwise, each feature disclosed in this specification (including the accompanying claims, abstract, and drawings) may be replaced by an alternative feature that serves the same, equivalent, or similar purpose.
[0130] Furthermore, those skilled in the art will understand that although some embodiments described herein include certain features but not others included in other embodiments, combinations of features from different embodiments are intended to be within the scope of the invention and form different embodiments. For example, in the claims, any of the claimed embodiments can be used in any combination.
[0131] The various component embodiments of the present invention can be implemented in hardware, or as software modules running on one or more processors, or a combination thereof. Those skilled in the art will understand that microprocessors or digital signal processors (DSPs) can be used in practice to implement some or all of the functions of some or all of the components according to the embodiments of the present invention. The present invention can also be implemented as a device or apparatus program (e.g., a computer program and computer program product) for performing part or all of the methods described herein. Such programs implementing the present invention can be stored on a computer-readable medium, or can be in the form of one or more signals. Such signals can be downloaded from an Internet website, provided on a carrier signal, or provided in any other form.
[0132] It should be noted that the above embodiments are illustrative of the invention and not restrictive, and that those skilled in the art can devise alternative embodiments without departing from the scope of the appended claims. In the claims, any reference signs placed between parentheses should not be construed as limiting the claims. The word "comprising" does not exclude the presence of elements or steps not listed in the claims. The word "a" or "an" preceding an element does not exclude the presence of a plurality of such elements. The invention can be implemented by means of hardware comprising several different elements and by means of a suitably programmed computer. In the unit claims enumerating several means, several of these means may be embodied by the same item of hardware. The use of the words first, second, and third, etc., does not indicate any order. These words can be interpreted as names.
Claims
1. An order risk control method based on anomaly detection algorithm, comprising: Obtain the historical order dataset, and perform data preprocessing on the historical order dataset to obtain the sample dataset; For each sample data in the sample dataset, multiple residual data corresponding to that sample data are calculated based on multiple moving average indicators; The target anomaly detection model is obtained by training the model using multiple residual data corresponding to multiple sample data. Based on multiple moving average indicators, multiple residual data corresponding to real-time data are calculated, and the multiple residual data corresponding to real-time data are input into the target anomaly detection model for risk prediction to obtain the corresponding risk prediction results. The step of calculating multiple residual data corresponding to each sample data in the sample dataset based on multiple moving average indicators further includes: Based on multiple moving average indicators, calculate multiple first moving average data points corresponding to the sample data. These multiple moving average indicators are selected by using moving data selection windows of varying lengths to choose different numbers of sample data points, and their averages are calculated separately. Each average value is considered a first moving average data point. The formula for calculating the moving average indicator is: MA = (C1 + C2 + C3 + ... +Cn) / n, where MA is the moving average indicator, C is the data at each time point, and n is the number of data points selected; Calculate the difference between the sample data and each first moving average data point; Based on the difference between the sample data and each first moving average data, multiple residual data corresponding to the sample data are obtained.
2. The method according to claim 1, wherein, The step of preprocessing the historical order dataset to obtain the sample dataset further includes: Missing values in the historical order dataset are filled in, and each historical order data in the historical order dataset is standardized and normalized to obtain a sample dataset.
3. The method according to claim 2, wherein, The process of completing missing values in the historical order dataset further includes: Search the historical order dataset for historical order data with missing values; For each historical order data with a missing value, the average of a first preset number of historical order data without missing values in the historical order dataset is calculated as the imputation value corresponding to the missing value, and the missing value in the historical order data is imputed using the imputation value.
4. The method according to claim 1, wherein, The step of training the model using multiple residual data corresponding to multiple sample data to obtain the target anomaly detection model further includes: An initial anomaly detection model was constructed using the isolated forest algorithm; The sample dataset is divided into a first subset and a second subset; The initial anomaly detection model is trained using multiple residual data corresponding to multiple sample data in the first subset to obtain a trained anomaly detection model.
5. The method according to claim 4, wherein, The step of training the model using multiple residual data corresponding to multiple sample data to obtain the target anomaly detection model further includes: The trained anomaly detection model is evaluated using multiple residual data corresponding to multiple sample data in the second subset to obtain evaluation parameters; Determine whether the evaluation parameter exceeds a preset threshold; If so, the trained anomaly detection model will be used as the target anomaly detection model. If not, the model will be retrained until the evaluation parameters exceed the preset threshold to obtain the target anomaly detection model.
6. The method according to any one of claims 1-5, wherein, The step of calculating multiple residual data corresponding to real-time data based on multiple moving average indicators further includes: Calculate multiple second moving average data corresponding to the real-time data based on multiple moving average indicators; Calculate the difference between the real-time data and each second moving average data; Based on the difference between the real-time data and each second moving average data, multiple residual data corresponding to the real-time data are obtained.
7. An order risk control device based on anomaly detection algorithm, comprising: The module comprises a preprocessing module, a computation module, a training module, and a risk prediction module; among which, The preprocessing module is used to acquire historical order datasets, perform data preprocessing on the historical order datasets, and obtain sample datasets; The calculation module is used to calculate multiple residual data corresponding to each sample data in the sample dataset based on multiple moving average indicators. The training module is used to train the model using multiple residual data corresponding to multiple sample data to obtain the target anomaly detection model. The risk prediction module is used to calculate multiple residual data corresponding to real-time data based on multiple moving average indicators, input the multiple residual data corresponding to real-time data into the target anomaly detection model for risk prediction, and obtain the corresponding risk prediction result. The calculation module is further used for: Based on multiple moving average indicators, calculate multiple first moving average data points corresponding to the sample data. These multiple moving average indicators are selected by using moving data selection windows of varying lengths to choose different numbers of sample data points, and their averages are calculated separately. Each average value is considered a first moving average data point. The formula for calculating the moving average indicator is: MA = (C1 + C2 + C3 + ... +Cn) / n, where MA is the moving average indicator, C is the data at each time point, and n is the number of data points selected; Calculate the difference between the sample data and each first moving average data point; Based on the difference between the sample data and each first moving average data, multiple residual data corresponding to the sample data are obtained.
8. A computing device, comprising: The processor, memory, communication interface, and communication bus are provided, wherein the processor, memory, and communication interface communicate with each other via the communication bus. The memory is used to store at least one executable instruction, which causes the processor to perform the operation corresponding to the order risk control method based on the anomaly detection algorithm as described in any one of claims 1-6.
9. A computer storage medium storing at least one executable instruction that causes a processor to perform an operation corresponding to the order risk control method based on an anomaly detection algorithm as described in any one of claims 1-6.