Banking system anomaly detection method, device and equipment based on clustering processing

Abstract

The application provides a bank system anomaly detection method, device and equipment based on clustering processing, the method comprises the following steps: receiving a system detection instruction, wherein the system detection instruction is used for indicating to perform anomaly detection on the bank system; the bank system comprises a plurality of subsystems; the subsystem comprises a plurality of modules corresponding to each split dimension; according to the system detection instruction, the subsystem to be tested is determined from the plurality of subsystems, and the target split dimension of the subsystem to be tested is determined; and the module to be detected in the subsystem to be tested is determined under the target split dimension; the first running data of the module to be detected is acquired; the first running data is subjected to clustering processing to obtain a detection result. The application splits the modules of the bank system in different split dimensions, so as to improve the coverage of anomaly detection and avoid the phenomenon of missed detection. Moreover, the anomaly detection in the application is based on the real-time output data of the modules, which is beneficial to improve the detection accuracy and timeliness.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of data processing, and in particular to an abnormality detection method, device and equipment for a bank system based on clustering processing. BACKGROUND

[0002] At present, after the bank system is put into operation, some system abnormal phenomena usually occur, which causes users to be unable to normally handle business.

[0003] In related technologies, a user actively reports system abnormalities to determine abnormal points in the system. However, the above-mentioned method for detecting abnormalities by using user reporting is affected by subjective factors of users, and is prone to abnormal reporting not in time and inaccurate. Therefore, an abnormality detection method is urgently needed to timely find abnormal problems in the bank system. SUMMARY

[0004] The abnormality detection method, device and equipment for a bank system based on clustering processing provided by the present application solve the problem of untimely abnormality detection in related technologies.

[0005] In a first aspect, the present application provides an abnormality detection method for a bank system based on clustering processing, which comprises the following steps:

[0006] receiving a system detection instruction, wherein the system detection instruction is used to instruct to perform abnormality detection on a bank system; the bank system comprises a plurality of subsystems; the subsystem corresponds to at least one split dimension; the subsystem comprises a plurality of modules corresponding to each split dimension; the module has an identifier, and the identifier is used to indicate the corresponding module and split dimension; and the split dimension represents the split standard of the module in the subsystem;

[0007] According to the system detection instruction, a subsystem to be tested is determined from the plurality of subsystems, and a target split dimension of the subsystem to be tested is determined; and a module to be detected in the subsystem to be tested is determined under the target split dimension;

[0008] obtaining first running data of the module to be detected; wherein the first running data is data output by the module in the running process;

[0009] performing clustering processing on the first running data to obtain a detection result; wherein the detection result represents whether there is abnormal data in the first running data.

[0010] In a possible implementation manner, obtaining the first running data of the module to be detected comprises:

[0011] acquire a data acquisition period corresponding to the module to be detected; the data acquisition period is determined according to an operation frequency of the module to be detected and a data output rate; the operation frequency represents a number of times of calling the module per unit time; and the data output rate represents a data processing efficiency of the module.

[0012] determine the data generated by the module to be detected in the data acquisition period as first running data.

[0013] In a possible implementation manner, acquiring the data acquisition period corresponding to the module to be detected comprises:

[0014] determining a candidate acquisition period according to the operation frequency and the data output rate;

[0015] determining data generated by the module to be detected in the candidate acquisition period as candidate running data;

[0016] determining the data acquisition period according to the candidate running data, a preset clustering model, and the candidate acquisition period; the preset clustering model is used to determine abnormal data.

[0017] In a possible implementation manner, determining the data acquisition period according to the candidate running data, a preset clustering model, and the candidate acquisition period comprises:

[0018] determining an output result of the preset clustering model by taking the candidate running data as input data of the preset clustering model; the output result represents a clustering result of the candidate running data;

[0019] determining a tightness of the output result; the tightness is used to represent a distance from a data point in a clustering cluster to a center of the clustering cluster;

[0020] if the tightness of the candidate running data is less than a preset threshold, increasing the candidate acquisition period, and determining the increased candidate acquisition period as the data acquisition period.

[0021] In a possible implementation manner, performing clustering processing on the first running data to obtain a detection result comprises:

[0022] determining an index set corresponding to the module to be detected; the index set comprises at least one data index; and the data index is used to indicate data to be extracted.

[0023] performing data extraction processing on the first running data according to the index set to obtain second running data.

[0024] performing clustering processing on the second running data to obtain a detection result.

[0025] In a possible implementation, the second running data is subjected to clustering processing to obtain a detection result, including:

[0026] The environment information corresponding to the second running data is determined, and the environment information is used to represent system version information and / or business function scenario information corresponding to a module generating the first running data;

[0027] The second running data and the environment information are taken as input data of a preset clustering model to determine a detection result; wherein the preset clustering model is used to determine abnormal data.

[0028] In a possible implementation, the method further includes:

[0029] If the detection result represents that there is abnormal data in the first running data, a prompt information is sent, and a test case corresponding to the module to be detected is determined in a test case library; wherein the prompt information is used to represent that the module to be detected has a possibility of existing abnormality; and there is at least one test case in the test case library;

[0030] Based on the test case, a secondary detection processing is performed on the module to be detected to obtain a final detection result.

[0031] In a possible implementation, the subsystem is any one of a backend subsystem, a front-end subsystem and a client-side subsystem; wherein the backend subsystem is used to perform background data processing and storage; the front-end subsystem is used to perform processing and display on front-end page interaction data; and the client-side subsystem is used to provide bank services of a bank system for users of a mobile terminal device.

[0032] In a second aspect, the application provides an abnormality detection device of a bank system based on clustering processing, including:

[0033] A receiving unit is configured to receive a system detection instruction, wherein the system detection instruction is used to instruct to perform abnormality detection on a bank system; the bank system includes a plurality of subsystems; the subsystems correspond to at least one split dimension; the subsystems include a plurality of modules corresponding to each split dimension; the modules have an identifier, which is used to indicate the corresponding module and split dimension; and the split dimension represents a split standard of the modules in the subsystems.

[0034] A first determining unit is configured to determine a subsystem to be tested from the plurality of subsystems according to the system detection instruction, and determine a target split dimension of the subsystem to be tested.

[0035] A second determining unit is configured to determine a module to be detected in the subsystem to be tested under the target splitting dimension;

[0036] An obtaining unit is configured to obtain first running data of the module to be detected, wherein the first running data is data output by the module during running.

[0037] A processing unit is configured to perform clustering processing on the first running data to obtain a detection result, wherein the detection result represents whether there is abnormal data in the first running data.

[0038] In a possible implementation, the obtaining unit comprises:

[0039] An obtaining module is configured to obtain a data collection period corresponding to the module to be detected, wherein the data collection period is determined according to an operation frequency of the module to be detected and a data output rate; the operation frequency represents the number of times the module is called per unit time; and the data output rate represents the data processing efficiency of the module.

[0040] A first determining module is configured to determine that data generated by the module to be detected within the data collection period is first running data.

[0041] In a possible implementation, the obtaining module is specifically configured to:

[0042] determine a candidate collection period according to the operation frequency and the data output rate;

[0043] determine that data generated by the module to be detected within the candidate collection period is candidate running data;

[0044] determine a data collection period according to the candidate running data, a preset clustering model, and the candidate collection period, wherein the preset clustering model is used to determine abnormal data.

[0045] In a possible implementation, the obtaining module is specifically configured to:

[0046] use the candidate running data as input data of the preset clustering model to determine an output result of the preset clustering model, wherein the output result represents a clustering result of the candidate running data.

[0047] determine the compactness of the output result, wherein the compactness is used to represent the distance between data points in a clustering cluster and the center of the clustering cluster.

[0048] If the compactness of the candidate running data is less than a preset threshold, the candidate collection period is increased, and the increased candidate collection period is determined as the data collection period.

[0049] In a possible implementation, the processing unit comprises:

[0050] The second determining module is configured to determine an index set corresponding to the module to be detected; the index set comprises at least one data index; the data index is used to indicate data to be extracted;

[0051] The extracting module is configured to perform data extraction processing on the first running data according to the index set, to obtain second running data;

[0052] The processing module is configured to perform clustering processing on the second running data, to obtain a detection result.

[0053] In a possible implementation, the processing module is specifically configured to:

[0054] determine environment information corresponding to the second running data; the environment information is used to represent system version information and / or business function scenario information corresponding to a module generating the first running data;

[0055] use the second running data and the environment information as input data of a preset clustering model, to determine a detection result; the preset clustering model is used to determine abnormal data.

[0056] In a possible implementation, the apparatus further comprises:

[0057] The sending unit is configured to send prompt information if the detection result indicates that there is abnormal data in the first running data.

[0058] The third determining unit is configured to determine a test case corresponding to the module to be detected in a test case library; the prompt information is used to indicate that the module to be detected has a possibility of being abnormal; the test case library comprises at least one test case.

[0059] The detecting unit is configured to perform secondary detection processing on the module to be detected based on the test case, to obtain a final detection result.

[0060] In a possible implementation, the subsystem is any one of a backend subsystem, a front-end subsystem, and a client-side subsystem; the backend subsystem is used to perform background data processing and storage; the front-end subsystem is used to perform processing and display on front-end page interaction data; and the client-side subsystem is used to provide bank services of a bank system for users of a mobile terminal device.

[0061] In a third aspect, the present application provides an electronic device, comprising a processor and a memory connected with the processor in communication;

[0062] the memory stores computer-executable instructions;

[0063] the processor executes the computer-executable instructions stored in the memory to implement the method according to any one of the first aspect.

[0064] In a fourth aspect, the present application provides a computer-readable storage medium, which stores computer-executable instructions, and the computer-executable instructions are executed by a processor to implement the method according to any one of the first aspect.

[0065] In a fifth aspect, the present application provides a computer program product, which comprises a computer program, and the computer program is executed by a processor to implement the method according to any one of the first aspect.

[0066] The method, device and equipment for detecting abnormality of a bank system based on clustering processing provided by the present application comprise the following steps: receiving a system detection instruction, wherein the system detection instruction is used to instruct to detect abnormality of a bank system; the bank system comprises a plurality of subsystems; the subsystem corresponds to at least one split dimension; the subsystem comprises a plurality of modules corresponding to each split dimension; the module has an identifier, and the identifier is used to indicate the corresponding module and split dimension; the split dimension represents the split standard of the module in the subsystem; according to the system detection instruction, a to-be-tested subsystem is determined from the plurality of subsystems, and a target split dimension of the to-be-tested subsystem is determined; and a to-be-detected module in the to-be-tested subsystem is determined under the target split dimension; first running data of the to-be-detected module is acquired; wherein the first running data is the data output by the module in the running process; the first running data is subjected to clustering processing to obtain a detection result; wherein the detection result represents whether there is abnormal data in the first running data. Further, the subsystems included in the bank system are subjected to module split in different split dimensions, so that the bank system can be subjected to abnormality detection from multiple different dimensions in the subsequent abnormality detection process, which is beneficial to improve the coverage of the abnormality detection of the bank system and avoid the phenomenon of missed detection. Moreover, the detection result obtained by the abnormality detection in the embodiment by clustering processing of the real-time output data of the module is abnormality analysis starting from the actual running result of the module in the system, which is beneficial to improve the accuracy and timeliness of the system abnormality detection. BRIEF DESCRIPTION OF DRAWINGS

[0067] The accompanying drawings, which are incorporated herein and form part of the specification, illustrate embodiments consistent with the present application and, together with the description, further serve to explain the principles of the application.

[0068] Figure 1A flowchart of an abnormality detection method of a bank system based on clustering processing provided in an embodiment of the present application is shown in FIG. 1.

[0069] Figure 2 A flowchart of another abnormality detection method of a bank system based on clustering processing provided in an embodiment of the present application is shown in FIG. 2.

[0070] Figure 3 A flowchart of an abnormality detection method of a bank system provided in an embodiment of the present application is shown in FIG. 3.

[0071] Figure 4 A structural diagram of an abnormality detection device of a bank system based on clustering processing provided in an embodiment of the present application is shown in FIG. 4.

[0072] Figure 5 A structural diagram of another abnormality detection device of a bank system based on clustering processing provided in an embodiment of the present application is shown in FIG. 5.

[0073] Figure 6 A structural diagram of an electronic device provided in an embodiment of the present application is shown in FIG. 6.

[0074] The specific embodiments of the present application have been shown and described in the above-described drawings and text. Further, more detailed descriptions will be given in the following. These drawings and text are not intended to limit the scope of the concept of the present application in any way, but to illustrate the concept of the present application to those skilled in the art by referring to specific embodiments. DETAILED DESCRIPTION

[0075] The exemplary embodiments will be described in detail herein with reference to the attached drawings. The same reference numbers in different drawings represent the same or similar elements. The embodiments described in the following exemplary embodiments are not representative of all embodiments consistent with the present application. Rather, they are merely examples of devices and methods consistent with some aspects of the present application.

[0076] Currently, some abnormal problems usually occur in the process of online operation of a bank system, which affects the normal operation of the system. Currently, in order to find abnormal problems existing in the bank system, the following methods can be used for abnormality detection of the system.

[0077] In one example, when performing system abnormality detection, the system can be actively inspected periodically according to pre-set test cases, so as to determine abnormal problems in the bank system. However, the above abnormality detection algorithm mainly depends on the setting of test cases, and is prone to the phenomenon that the test cases are not completely covered, which leads to incomplete testing of the bank system, and further prone to missed detection and other problems.

[0078] In one example, when performing anomaly detection in a banking system, the system could provide users with a channel to report issues, allowing them to do so promptly. However, this user feedback method alone cannot accurately identify problems within the system in a timely manner.

[0079] To address the aforementioned issues, this application proposes the following technical concept: The subsystems within the banking system are broken down into different dimensions. During the actual operation of the banking system, based on received system detection instructions, the module to be detected and its output operational data can be identified. This operational data is then clustered to determine if any anomalies exist, i.e., whether the module to be detected exhibits anomalies. This anomaly detection method based on module output data can provide timely anomaly detection results and avoids the problem of incomplete anomaly detection due to insufficient test case coverage.

[0080] The present application provides an anomaly detection method, apparatus, and equipment for banking systems based on clustering processing, which are used to solve the above-mentioned technical problems.

[0081] The collection, storage, use, processing, transmission, provision, and disclosure of financial data or user data involved in the technical solution of this application all comply with the provisions of relevant laws and regulations and do not violate public order and good morals.

[0082] The technical solution of this application and how the technical solution of this application solves the above-mentioned technical problems are described in detail below with specific embodiments. These specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments. The embodiments of this application will now be described with reference to the accompanying drawings.

[0083] Figure 1 A flowchart illustrating an anomaly detection method for a banking system based on clustering processing, as provided in this application embodiment, is shown below. Figure 1 As shown, the method includes:

[0084] S101. Receive system detection instructions, wherein the system detection instructions are used to instruct the bank system to perform anomaly detection; the bank system includes multiple subsystems; each subsystem corresponds to at least one split dimension; each subsystem includes multiple modules corresponding to each split dimension; each module has an identifier, which is used to indicate the module and split dimension corresponding to the identifier; the split dimension represents the splitting criteria of the modules in the subsystem.

[0085] Exemplarily, in this embodiment, the system detection instruction can be understood as an instruction for instructing to perform anomaly detection on the bank system. It should be noted that the system detection instruction in this embodiment can be a detection instruction triggered periodically, and the system detection instruction can be determined according to the number of times of calling of a module in the system. For a module with a high number of times of calling, for example, a transfer module frequently used by a user in the bank system, the interval period of the system detection instruction corresponding to the module can be smaller, so as to discover abnormal phenomena in time.

[0086] In addition, in this embodiment, the bank system includes a plurality of subsystems. For example, the bank system can be divided into a first subsystem and a second subsystem. The first subsystem is a customer system used by a customer who needs to conduct a business in the bank. The second subsystem is a system used by an internal staff of the bank.

[0087] In each subsystem, the subsystem can also be split into a plurality of modules according to different split dimensions. For example, for the customer system used by the customer, in one split dimension, the customer system can be split according to a display page corresponding to the customer system. The execution code of a plurality of display components included in a page can be used as a module, that is, one page corresponds to one module. Alternatively, in one split dimension, the customer system can be split according to operation steps performed by the user in the display interface. For example, when the user accesses a component function, the user needs to sequentially operate a component 1 in a page 1, a component 2 in a page 2, and a component 3 in a page 3 to complete the component function call of the component 3 to be accessed. In this case, the execution code of the three components can be used as a module.

[0088] In addition, each module after splitting has its own identifier, which can not only uniquely indicate the module corresponding thereto, but also indicate the split dimension corresponding to the module. For example, when the split dimension is a transfer dimension, the subsystem can be divided into two modules (for example, a module for same-row transfer and a module for cross-row transfer). The identifier of one of the modules can be the first module in the transfer dimension.

[0089] S102, according to the system detection instruction, determining a subsystem to be tested from the plurality of subsystems, and determining a target split dimension of the subsystem to be tested; and determining a module to be detected in the subsystem to be tested in the target split dimension.

[0090] Exemplarily, in the embodiment, the system detects the subsystem to be tested in the instruction, and the selected target split dimension currently required to be tested. After determining the target split dimension and the subsystem to be tested, since the identification of the module in the subsystem can indicate the split dimension corresponding to the module, the sub-module to be detected can be found in the subsystem according to the target split dimension.

[0091] S103, acquire first running data of the module to be detected; wherein the first running data is the data output by the module in the running process.

[0092] Exemplarily, in the embodiment, after determining the sub-module to be detected, the first running data corresponding to the sub-module to be detected can be acquired.

[0093] It should be noted that when acquiring the first running data corresponding to the sub-module to be detected, if the sub-module to be detected is not detected for the first time, all output data of the module within the interval between two detections can be acquired as the first running data, so as to realize complete data detection of the module to be detected and improve the detection accuracy. Alternatively, data sampling can be performed during the two detections, so as to avoid the phenomenon that the detection efficiency is reduced and the system resources are consumed when there is too much data.

[0094] S104, perform clustering processing on the first running data to obtain a detection result; wherein the detection result represents whether there is abnormal data in the first running data.

[0095] Exemplarily, in the embodiment, after acquiring the first running data, the first running data can be subjected to clustering processing, so as to identify whether there is abnormal data in the first running data. In actual application, the clustering processing usually divides the input first running data into multiple clusters, and the isolated point data not divided into the clusters is determined as abnormal data.

[0096] Moreover, when there is no abnormal data in the first running data, it can be considered that the module to be detected does not have abnormality, and then new running data generated by the module to be detected can be continuously acquired, so as to continuously perform abnormality detection. When there is abnormal data in the first running data, it can be considered that the module to be detected may have abnormality, and the module can be further detected subsequently. For example, when the results of multiple clustering processing all represent that there is abnormality, the developer can be notified to maintain the module in the system.

[0097] It should be noted that the type of model used for clustering processing is not limited in the embodiment, for example, the K-means clustering model and the isolated forest model provided in related technologies can be used.

[0098] It can be understood that, in the embodiment, the subsystems included in the bank system are split into modules in different split dimensions, so that the bank system can be detected for abnormalities from multiple different dimensions in the subsequent abnormality detection process, which is beneficial to improve the coverage of bank system abnormality detection and avoid missed detection. In addition, the detection result obtained by clustering the data output by the modules in real time in the abnormality detection is abnormality analysis starting from the actual operation result of the modules in the system, which is beneficial to improve the accuracy of system abnormality detection.

[0099] Figure 2 Another flowchart of an abnormality detection method of a bank system based on clustering processing provided by the embodiment is shown in FIG. 6. The method includes the following steps: Figure 2

[0100] S201, receiving a system detection instruction, wherein the system detection instruction is used to instruct to detect the bank system for abnormality; the bank system includes a plurality of subsystems; the subsystem corresponds to at least one split dimension; the subsystem includes a plurality of modules corresponding to each split dimension; the module has an identifier, the identifier is used to indicate the module and the split dimension corresponding to the identifier; the split dimension represents the split standard of the module in the subsystem.

[0101] The specific principle of step S201 can be referred to step S101 for example, which will not be repeated here.

[0102] In practical application, the subsystem is any one of a backend subsystem, a front-end subsystem and a client subsystem; wherein the backend subsystem is used for background data processing and storage; the front-end subsystem is used for processing and displaying front-end page interaction data; the client subsystem is used for providing bank services of the bank system for users of mobile devices.

[0103] For example, in the embodiment, when the bank system is split into subsystems, it can be divided into a backend subsystem, a front-end subsystem and a client subsystem.

[0104] The backend subsystem can be understood as a system for background data processing and storage, etc., which can process the data feedback from the front-end or client subsystem and then feedback to the front-end or client subsystem for data display based on the front-end or client subsystem.

[0105] The client subsystem can be understood as an application program set on a client of different system versions, a business handling system on a bank robot, etc.; and the front-end subsystem is a system for information interaction with users based on a front-end page, for example, a web page in a browser for data display and an interactive interface provided to users based on the web page.​

[0106] Further, through the division manner of the above subsystem, subsequent different dimensions can be divided for different subsystems, improving the coverage accuracy of anomaly detection.

[0107] And in actual application, the backend subsystem can be split based on the services that the backend subsystem can provide, such as financial product ordering, settlement services, account freezing, and other service dimensions. It can also be split only according to function, such as modules that interact with the front end or client, modules that perform data processing, modules that interact with the database, and the like.

[0108] And the client subsystem can be split from different system versions. In the client subsystem corresponding to different system versions, it can be further split according to the modules that need to be called in different business scenarios. That is, the modules are split in combination with version and business scenario.

[0109] And the front-end subsystem can also be split according to different dimensions such as specific business scenarios and provided front-end pages.

[0110] S202, according to the system detection instruction, determine the subsystem to be tested from the plurality of subsystems, and determine the target split dimension of the subsystem to be tested; and under the target split dimension, determine the module to be detected in the subsystem to be tested.

[0111] For example, the specific principle of step S202 can refer to step S201, which will not be repeated here.

[0112] S203, obtain the data collection period corresponding to the module to be detected; wherein the data collection period is determined according to the operation frequency and data output rate of the module to be detected; the operation frequency represents the number of times the module is called per unit time; the data output rate represents the data processing efficiency of the module.

[0113] For example, in this embodiment, when obtaining the first running data corresponding to the module to be detected, the data collection period corresponding to the module to be detected can be determined first. The data collection period is determined according to the operation frequency and data output rate corresponding to the module.

[0114] The operation frequency corresponding to the module can be understood as the number of times the module is called per unit time, and the data output rate corresponding to the module can be understood as the processing efficiency of the module for data processing. For example, the data output efficiency of the module can be determined according to the input data amount, the time for the module to obtain the output data corresponding to the input data.

[0115] Afterwards, the output data in how long data acquisition period needs to be acquired as the first running data can be determined in combination with the operation frequency and the data output rate of the module to be detected.

[0116] It can be understood that when the operation frequency of the module is higher and the data output rate is higher, the output data amount corresponding to the module to be detected is also larger. In order to ensure that there is enough first running data for abnormality detection processing, ensure the accuracy of the detection result, and not cause the phenomenon of slow running efficiency due to large data amount, in an example, the data acquisition period in which enough first running data can be acquired can be determined according to the corresponding relationship among the operation frequency, the data output efficiency and the data acquisition period. The data acquisition period indicates the time period in which the output data of the module needs to be acquired.

[0117] It should be noted that in the actual processing process,

[0118] In an example, when step S203 is performed, the following steps can be implemented:

[0119] First step: determining the candidate acquisition period according to the operation frequency and the data output rate;

[0120] For example, in the actual application in this embodiment, first, the candidate acquisition period can be screened in combination with the operation frequency and the data output rate. For example, the corresponding relationship among the operation frequency, the data output rate and the data acquisition period is pre-set. Then, the data acquisition period can be determined according to the above corresponding relationship, the current operation frequency and the data output rate of the module to be detected. The data acquisition period obtained based on the corresponding relationship is taken as the candidate acquisition period, and whether the candidate acquisition period needs to be adjusted is determined through the subsequent steps.

[0121] Second step: determining the data generated by the module to be detected in the candidate acquisition period as the candidate running data.

[0122] For example, after the candidate acquisition period is obtained, the data generated by the module to be detected in the candidate acquisition period can be further acquired as the candidate running data.

[0123] Third step: determining the data acquisition period according to the candidate running data, the preset clustering model and the candidate acquisition period, and the preset clustering model is used to determine the abnormal data.

[0124] For example, after the candidate running data is determined, the candidate running data can be clustered according to the preset clustering model. Then, the candidate acquisition period is adjusted in combination with the clustering processing result, and finally the data acquisition period is obtained.

[0125] For example, in actual application, whether the candidate collection period needs to be adjusted is determined according to the quality evaluation result of the model output result obtained according to the candidate running data and the preset clustering model. The quality evaluation result can represent the clustering effect. If the quality evaluation result of the model output result represents a poor clustering effect, the candidate collection period can be adjusted, and the adjusted candidate collection period is used as the data collection period to avoid the influence of too large or too small data quantity on the clustering result.

[0126] It can be understood that in the embodiment, the candidate collection period can be continuously adjusted according to the running result corresponding to the candidate running data under the preset clustering model, so as to determine a reasonable data collection period to avoid the influence of too large or too small data quantity on the quality of data clustering.

[0127] In one example, the third step can be implemented by the following steps: inputting the candidate running data as input data of the preset clustering model to determine the output result of the preset clustering model; the output result represents the clustering result of the candidate running data; determining the tightness of the output result; the tightness is used to represent the average distance between the sample points in the clustering cluster and the cluster center; if the sparsity of the candidate running data is greater than the first threshold, the candidate collection period is increased, and the increased candidate collection period is determined as the data collection period.

[0128] For example, when determining the data collection period, the candidate running data can be first input into the preset clustering model to obtain the output result of the model. The output result can be used to represent how the candidate running data is divided, that is, how many clustering clusters the candidate running data is divided into, the data points contained in each clustering cluster, and the center point corresponding to each clustering cluster, that is, the clustering result of the candidate running data. Then, according to the output result of the model, the distance between each data point in each clustering cluster and the center point of the clustering cluster, that is, the tightness of the output result, can be determined. It can be understood that the higher the tightness, the greater the correlation of the data in the same clustering cluster, and the higher the accuracy (that is, the quality) of the clustering result. If the tightness of the output result is less than a preset threshold, it represents that the data in the same clustering cluster in the output result is sparse. Therefore, the candidate collection period is increased to increase the data quantity of the input data of the model to avoid the phenomenon that the output result is inaccurate due to too small data quantity.

[0129] It can be understood that in the embodiment, the candidate collection period is adjusted by the tightness of the output result. The method of determining the quality result of the output result is simple and easy to implement, and a suitable data collection period can be determined by the method.

[0130] S204, determine that the data generated by the module to be detected in the data collection period is first running data; wherein the first running data is the data output by the module in the running process.

[0131] Exemplarily, after determining the data collection period, the data generated by the module in the data collection period can be obtained as the first running data according to the data collection period.

[0132] It can be understood that, in the embodiment, in order to avoid the phenomenon of insufficient or excessive data quantity for clustering processing, a suitable data collection period can be determined according to the operation frequency and the data output rate of the module in the embodiment, so as to ensure that sufficient input data can be obtained, and the phenomenon of low detection efficiency caused by excessive data quantity can be avoided.

[0133] S205, determine the index set corresponding to the module to be detected; wherein the index set includes at least one data index; the data index is used to indicate the data to be extracted.

[0134] S206, performing data extraction processing on the first running data according to the index set to obtain second running data.

[0135] Exemplarily, in the embodiment, when the first running data is clustered, the data of interest (i.e. the second running data) can be extracted from the first running data. Specifically, the first running data can be extracted according to the data index in the index set corresponding to the module to be detected.

[0136] In one example, the index set corresponding to each module to be detected is obtained by screening a plurality of index sets according to the identifier corresponding to the module to be detected.

[0137] In one example, the data index in the index set not only indicates the data to be extracted, but also provides a data processing rule for extracting the data indicated by the data index, so that the second running data desired to be obtained can be directly obtained from the first running data according to the data processing rule.

[0138] In actual application, the data index can be the click rate of the component, the access chain, the error rate, the display rate and the like, which is not limited specifically herein.

[0139] S207, performing clustering processing on the second running data to obtain a detection result; wherein the detection result represents whether there is abnormal data in the first running data.

[0140] Exemplarily, in the embodiment, when the second running data is obtained, clustering processing can be performed on the second running data to determine whether there is abnormal data in the first running data.

[0141] It can be understood that in the embodiment, by extracting the data of real interest in the first running data for clustering analysis processing, the influence of the accuracy of the clustering processing result when the first running data carries more redundant data can be avoided.

[0142] In one example, when performing the above step S207, the following steps can be implemented: “determining environment information corresponding to the second running data, the environment information being used to represent system version information and / or business function scenario information corresponding to the module when the second running data is generated; taking the second running data and the environment information as input data of a preset clustering model to determine a detection result; wherein the preset clustering model is used to determine abnormal data.”

[0143] Exemplarily, in the embodiment, when the second running data is clustered, the environment information corresponding to the second running data can be further combined. The environment information corresponding to the second running data can be understood as system version information and / or business function scenario information corresponding to the module when the first running data is generated. For example, when a to-be-detected module is called in multiple business scenarios, the data included in the second running data can be marked in the second running data to indicate which business scenario the data is generated in. Similarly, when a to-be-detected module is located in multiple different systems, the data included in the second running data can be marked in the second running data to indicate which system version information the data is generated in, which is conducive to subsequent problem positioning.

[0144] Further, the second running data and the obtained environment information are taken as input data of a preset clustering model, so as to obtain a detection result output by the model.

[0145] It can be understood that in the embodiment, by combining the second running data and the environment information corresponding to the second running data, the accuracy of the detection result can be improved, and the subsequent positioning of the abnormal problem in the system can also be facilitated. For example, the abnormal phenomenon in which environment information appears can be determined through the environment information.

[0146] In one example, after step S207, the following steps can be further included:

[0147] If the detection result indicates that there is abnormal data in the first running data, a prompt information is sent, and a test case corresponding to the to-be-detected module in the test case library is determined; wherein the prompt information is used to represent that the module has the possibility of existing abnormality; there is at least one test case in the test case library; based on the test case, the to-be-detected module is detected again to obtain a final detection result.

[0148] Exemplarily, in this embodiment, when it is determined that there is abnormal data in the first running data through steps S201-S206, prompt information can be sent at this time so as to timely remind the user that the to-be-detected module corresponding to the first running data has abnormal data and the module can be abnormal. Moreover, the test case associated with the to-be-detected module can be searched in the test case library storing the test case while the prompt information is sent. The to-be-detected module is subjected to automatic secondary detection processing based on the obtained test case, and it is determined whether the to-be-detected module can pass the detection of the test case and the final detection result is obtained. So that the user can analyze and determine whether the to-be-detected module is abnormal based on the detection results obtained through two detections. For example, if the to-be-detected module cannot pass the detection of the test case that has passed the test originally, it is possible that the system code is maliciously tampered with, causing system abnormality.

[0149] It can be understood that in this embodiment, when it is determined that there is abnormal data in the first running data, the user is not only timely notified, but also the secondary detection is automatically and timely performed, so that the user can timely determine the abnormal problem in the system based on the detection results of two times.

[0150] In this embodiment, when the operation frequency of the module is higher and the data output rate is higher, the output data amount corresponding to the to-be-detected module is also larger. In order to ensure that there is enough first running data for abnormal detection processing, ensure the accuracy of the detection result, and avoid the phenomenon that the running efficiency is slow due to the large amount of data, in an example, the data collection period in which enough first running data can be collected can be determined according to the corresponding relationship among the operation frequency, the data output efficiency, and the data collection period. The data collection period indicates the time period in which the output data of the module needs to be collected. In addition, in this embodiment, the candidate collection period can be continuously adjusted according to the running result of the candidate running data under the preset clustering model, so as to determine a reasonable data collection period, so as to avoid the influence of the amount of data obtained on the quality of data clustering when the amount of data is too large or too small. Moreover, the candidate collection period can be adjusted by the tightness of the output result. The above-mentioned method of determining the quality of the output result is simple and easy to implement, and the appropriate data collection period can be determined through the above-mentioned method. In addition, by extracting the data that is truly interesting in the first running data for clustering analysis processing, the influence of the accuracy of the clustering processing result caused by the first running data carrying more redundant data can be avoided.

[0151] Figure 3 A flowchart of a bank system abnormality detection provided by the embodiment of the present application is shown in FIG. 1. Figure 5As shown, first, the bank system can be subjected to system splitting processing, and then a plurality of subsystems and modules corresponding to each subsystem are obtained. Subsequently, each module is labeled, i.e., the label of each module is determined, so as to facilitate subsequent problem backtracking. Subsequently, for the module to be detected, the running data (also referred to as posterior data) generated by the module can be collected. After the posterior data is collected, the collected data is subjected to clustering analysis processing, so as to determine whether there is an isolated point (i.e., abnormal data) in the data. When there is an isolated point, the module generating the isolated point can be subjected to backtracking processing, so as to determine whether the module is abnormal. When there is no isolated point, the step of obtaining posterior data can be returned to, and the detection can be continued.

[0152] Figure 4 A structure diagram of an abnormality detection device for a bank system based on clustering processing provided by an embodiment of the present application is shown. The device comprises:

[0153] A receiving unit 401 is configured to receive a system detection instruction, wherein the system detection instruction is used to instruct to perform abnormality detection on a bank system. The bank system comprises a plurality of subsystems. Each subsystem corresponds to at least one splitting dimension. Each subsystem comprises a plurality of modules corresponding to each splitting dimension. Each module has an identifier, which is used to indicate the module and the splitting dimension corresponding to the identifier. The splitting dimension represents the splitting standard of the module in the subsystem.

[0154] A first determining unit 402 is configured to determine a subsystem to be tested from the plurality of subsystems according to the system detection instruction, and determine a target splitting dimension of the subsystem to be tested.

[0155] A second determining unit 403 is configured to determine a module to be detected in the subsystem to be tested under the target splitting dimension.

[0156] An obtaining unit 404 is configured to obtain first running data of the module to be detected. The first running data is the data output by the module during the running process.

[0157] A processing unit 405 is configured to perform clustering processing on the first running data, and obtain a detection result. The detection result represents whether there is abnormal data in the first running data.

[0158] The device provided by the embodiment is used to implement the technical solution provided by the above method, and has similar implementation principles and technical effects, which will not be described herein.

[0159] Figure 5 A structure diagram of another abnormality detection device for a bank system based on clustering processing provided by an embodiment of the present application is shown. Based on the device shown above, in the embodiment, the obtaining unit 404 comprises: Figure 4

[0160] ​The acquisition module 4041 is configured to acquire a data acquisition period corresponding to the module to be detected; the data acquisition period is determined according to an operation frequency and a data output rate of the module to be detected; the operation frequency represents a number of times of calling the module in a unit time; and the data output rate represents a data processing efficiency of the module.

[0161] The first determination module 4042 is configured to determine that the data generated by the module to be detected in the data acquisition period is first running data.

[0162] In a possible implementation, the acquisition module 4041 is specifically configured to:

[0163] determine a candidate acquisition period according to the operation frequency and the data output rate;

[0164] determine that the data generated by the module to be detected in the candidate acquisition period is candidate running data;

[0165] determine the data acquisition period according to the candidate running data, a preset clustering model, and the candidate acquisition period; the preset clustering model is used to determine abnormal data.

[0166] In a possible implementation, the acquisition module 4041 is specifically configured to:

[0167] determine an output result of the preset clustering model by taking the candidate running data as input data of the preset clustering model; the output result represents a clustering result of the candidate running data; determine a tightness of the output result; the tightness is used to represent a distance from a data point in a clustering cluster to a center of the clustering cluster; if the tightness of the candidate running data is less than a preset threshold, increase the candidate acquisition period, and determine the increased candidate acquisition period as the data acquisition period.

[0168] In a possible implementation, the processing unit 405 includes:

[0169] The second determination module 4051 is configured to determine a set of indexes corresponding to the module to be detected; the set of indexes includes at least one data index; and the data index is used to indicate data to be extracted.

[0170] The extraction module 4052 is configured to perform data extraction processing on the first running data according to the set of indexes, to obtain second running data.

[0171] The processing module 4053 is configured to perform clustering processing on the second running data, to obtain a detection result.

[0172] In a possible implementation, the processing module 4053 is specifically configured to:

[0173] Determine the environment information corresponding to the second running data, and the environment information is used to represent the system version information and / or business function scene information corresponding to the module generating the first running data.

[0174] Take the second running data and the environment information as input data of a preset clustering model to determine a detection result; wherein the preset clustering model is used to determine the abnormal data.

[0175] In a possible implementation manner, the apparatus further includes:

[0176] The sending unit 406 is configured to send prompt information if the detection result indicates that there is abnormal data in the first running data.

[0177] The third determining unit 407 is configured to determine a test case corresponding to the to-be-detected module in a test case library; wherein the prompt information is used to indicate that the to-be-detected module has a possibility of abnormality; and there is at least one test case in the test case library.

[0178] The detecting unit 408 is configured to perform secondary detection processing on the to-be-detected module based on the test case to obtain a final detection result.

[0179] In a possible implementation manner, the subsystem is any one of a backend subsystem, a front-end subsystem and a client-side subsystem; wherein the backend subsystem is used to perform background data processing and storage; the front-end subsystem is used to perform processing and display on front-end page interaction data; and the client-side subsystem is used to provide bank services of a bank system for users of a mobile terminal device.

[0180] The apparatus provided in the embodiment is used to implement the technical solution provided by the method, and has similar implementation principles and technical effects, which will not be described herein.

[0181] The present application provides an electronic device, comprising: a memory, a processor;

[0182] The memory is used to store processor executable instructions;

[0183] The processor is used to execute the method according to the executable instructions.

[0184] Figure 6 A structural schematic diagram of an electronic device provided in the embodiment of the present application is shown in FIG. 1, which comprises: Figure 6

[0185] ​The electronic device further includes a processor 291 and a memory 292. The electronic device can further include a communication interface 293 and a bus 294. The processor 291, the memory 292, and the communication interface 293 can communicate with each other through the bus 294. The communication interface 293 can be used for information transmission. The processor 291 can invoke the logical instructions in the memory 292 to execute the method of the above-described embodiments.

[0186] In addition, the logical instructions in the memory 292 described above can be implemented in the form of a software functional unit and sold or used as an independent product, which can be stored in a computer readable storage medium.

[0187] The memory 292, as a computer readable storage medium, can be used to store software programs, computer executable programs, such as program instructions / modules corresponding to the method in the embodiments of the present application. The processor 291 executes the functions and data processing by running the software programs, instructions and modules stored in the memory 292, that is, implements the method in the above-described method embodiments.

[0188] The memory 292 can include a program storage area and a data storage area. The program storage area can store an operating system and at least one application required by a function; the data storage area can store data created during use of the terminal device, etc. In addition, the memory 292 can include a high-speed random access memory, and can also include a nonvolatile memory.

[0189] The present application provides a computer readable storage medium, and the computer readable storage medium stores computer execution instructions. The computer execution instructions are executed by a processor to implement any one of the methods.

[0190] The present application provides a computer program product, and the computer program product includes a computer program. The computer program is executed by a processor to implement any one of the methods.

[0191] Other embodiments of the present application will be apparent to those skilled in the art from consideration of the specification and practice of the application disclosed herein. The application is intended to cover any variations, uses or adaptations of the application following, in general, the principles of the application and including such departures from the present disclosure as come within known or customary practice in the art to which the application pertains. The specification and examples are to be regarded as exemplary only, and the true scope and spirit of the application are indicated by the appended claims.

[0192] It is to be understood that the application is not limited to the precise construction already described above and shown in the drawings, and that various modifications and changes can be made by those skilled in the art without departing from the scope of the application. The scope of the application should only be limited by the claims appended hereto.

Claims

1. An anomaly detection method for a banking system based on clustering, characterized in that, The method includes: The system receives a system detection instruction, wherein the system detection instruction is used to instruct anomaly detection of the banking system; the banking system includes multiple subsystems; each subsystem corresponds to at least one splitting dimension; each subsystem includes multiple modules corresponding to each splitting dimension; each module has an identifier, which is used to indicate the module and splitting dimension corresponding to the identifier; the splitting dimension characterizes the splitting criteria of the module in the subsystem. According to the system detection instructions, the subsystem to be tested is determined from the plurality of subsystems, and the target split dimension of the subsystem to be tested is determined; and under the target split dimension, the module to be tested in the subsystem to be tested is determined. Obtain the first operating data of the module to be detected; wherein, the first operating data is the data output by the module during operation; Clustering is performed on the first running data to obtain detection results; wherein, the detection results indicate whether there is abnormal data in the first running data; Clustering is performed on the first running data to obtain the detection results, including: Determine the set of indicators corresponding to the module to be detected; wherein the set of indicators includes at least one data indicator; the data indicator is used to indicate the data to be extracted; Based on the set of indicators, the first operating data is processed to obtain the second operating data; Determine the environmental information corresponding to the second running data, wherein the environmental information is used to characterize the system version information and / or business function scenario information corresponding to the module that generated the first running data; The second running data and the environmental information are used as input data for a preset clustering model to determine the detection result; wherein, the preset clustering model is used to identify abnormal data.

2. The method according to claim 1, characterized in that, Obtaining the first operational data of the module to be detected includes: Obtain the data acquisition cycle corresponding to the module to be tested; wherein, the data acquisition cycle is determined based on the operation frequency of the module to be tested and the data output rate; the operation frequency represents the number of times the module is called per unit time; the data output rate represents the data processing efficiency of the module; The data generated by the module to be tested within the data acquisition cycle is determined to be the first running data.

3. The method according to claim 2, characterized in that, Obtaining the data acquisition period corresponding to the module to be detected includes: Based on the operating frequency and the data output rate, a candidate acquisition period is determined; The data generated by the module to be detected within the candidate acquisition period is determined as candidate running data; Based on the candidate running data, the preset clustering model, and the candidate collection period, the data collection period is determined, and the preset clustering model is used to identify abnormal data.

4. The method according to claim 3, characterized in that, Based on the candidate running data, the preset clustering model, and the candidate collection period, the data collection period is determined, including: The candidate running data is used as input data for the preset clustering model to determine the output result of the preset clustering model; wherein the output result represents the clustering result of the candidate running data; Determine the density of the output results; wherein the density is used to characterize the distance from the data points in the cluster to the center of the cluster; If the density of the candidate running data is less than a preset threshold, the candidate acquisition period is increased, and the increased candidate acquisition period is determined as the data acquisition period.

5. The method according to any one of claims 1-4, characterized in that, The method further includes: If the detection result indicates that there is abnormal data in the first running data, a prompt message is sent, and the test case corresponding to the module to be detected is determined in the test case library; wherein, the prompt message is used to indicate that the module to be detected has the possibility of having an anomaly; the test case library contains at least one test case; Based on the test cases, the module to be tested is subjected to secondary testing to obtain the final test results.

6. The method according to any one of claims 1-4, characterized in that, The subsystem can be any one of a backend subsystem, a frontend subsystem, and a client subsystem; wherein, the backend subsystem is used for backend data processing and storage; the frontend subsystem is used for processing and displaying interactive data on the frontend page; and the client subsystem is used to provide banking services of the banking system to users of mobile devices.

7. An anomaly detection device for a banking system based on clustering processing, characterized in that, The device includes: A receiving unit is configured to receive a system detection instruction, wherein the system detection instruction is used to instruct anomaly detection of the banking system; the banking system includes multiple subsystems; each subsystem corresponds to at least one splitting dimension; each subsystem includes multiple modules corresponding to each splitting dimension; each module has an identifier, the identifier being used to indicate the module and splitting dimension corresponding to the identifier; the splitting dimension characterizes the splitting criteria of the module in the subsystem; The first determining unit is configured to determine the subsystem to be tested from the plurality of subsystems according to the system detection instructions, and to determine the target splitting dimension of the subsystem to be tested; The second determining unit is used to determine the module to be detected in the subsystem to be tested under the target split dimension; An acquisition unit is used to acquire the first operating data of the module to be detected; wherein the first operating data is the data output by the module during operation; The processing unit is used to perform clustering processing on the first running data to obtain detection results; wherein, the detection results indicate whether there is abnormal data in the first running data; The processing unit is specifically used for: Determine the set of indicators corresponding to the module to be detected; wherein the set of indicators includes at least one data indicator; the data indicator is used to indicate the data to be extracted; Based on the set of indicators, the first operating data is processed to obtain the second operating data; Determine the environmental information corresponding to the second running data, wherein the environmental information is used to characterize the system version information and / or business function scenario information corresponding to the module that generated the first running data; The second running data and the environmental information are used as input data for a preset clustering model to determine the detection result; wherein, the preset clustering model is used to identify abnormal data.

8. An electronic device, characterized in that, include: A processor, and a memory communicatively connected to the processor; The memory stores computer-executed instructions; The processor executes computer execution instructions stored in the memory to implement the method as described in any one of claims 1-6.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-executable instructions, which, when executed by a processor, are used to implement the method as described in any one of claims 1-6.

10. A computer program product, characterized in that, Includes a computer program that, when executed by a processor, implements the method of any one of claims 1-6.

Images