RPA business data anomaly detection method and detection system integrating AI model

Abstract

The present invention discloses an RPA business data anomaly detection method and detection system integrating an AI model, and belongs to the field of data processing technology. Aiming at the abnormal challenges in the RPA business data processing of enterprises, the present invention constructs a set of efficient and collaborative anomaly detection mechanisms. After receiving the anomaly detection request, the mechanism can quickly extract data from the securely connected target database, thanks to the pre-cross-certification processing to ensure data security. Advanced algorithms are used to deeply analyze data, accurately generate abnormal labels, provide intuitive instructions for operation and maintenance, and drive the automatic troubleshooting and updating of processes, significantly shortening the fault response time, reducing the risk of business interruption, and ensuring the continuous and stable operation of enterprises. Automated and intelligent processing methods reduce the manual burden, improve the operation and maintenance efficiency, provide technical support for the digital transformation of enterprises, effectively solve the problems of complex data processing, slow abnormal response, and heavy manual troubleshooting in RPA applications, and improve the safety and efficiency of enterprise operations.

Description

Technical Field

[0001] The present invention belongs to the field of data processing technology, and specifically relates to an RPA business data anomaly detection method and detection system integrating an AI model. Background Art

[0002] In today's wave of digital transformation, enterprises have an increasing demand for automated processes, and Robotic Process Automation (RPA) technology has emerged. It aims to automate highly repetitive and regular business processes through software robots, thereby improving work efficiency and accuracy. However, with the deepening of RPA applications, the complexity and scale of its business data have also increased, resulting in an increase in the frequency of abnormal situations, posing severe challenges to the stability and security of the system. Traditional manual monitoring and troubleshooting methods are not only time-consuming and labor-intensive, but also difficult to respond in a timely manner, often causing business interruptions and unnecessary losses to the company. At the same time, if there is a lack of an effective security authentication mechanism during the data interaction process of RPA business data, it is very easy to cause data leakage risks, further exacerbating the operational risks of the company. Summary of the invention

[0003] The present invention provides an RPA business data anomaly detection method and detection system integrating an AI model, which can solve or partially solve the technical problems involved in the above-mentioned background technology.

[0004] The present invention provides an RPA business data anomaly detection method integrating an AI model, which is applied to a detection system. The method comprises: in response to an anomaly detection request reported by a target enterprise server, obtaining RPA business data to be processed from a target database that is communicatively connected to the target enterprise server; wherein cross-certification processing has been completed between the detection system, the target enterprise server and the target database; inputting the RPA business data to be processed into a target anomaly detection algorithm to obtain an anomaly detection opinion label output by the target anomaly detection algorithm; and using the anomaly detection opinion label to check and update the automation process corresponding to the RPA business data to be processed.

[0005] The present invention provides a detection system, comprising at least one processor and a memory; the memory stores computer-executable instructions; the at least one processor executes the computer-executable instructions stored in the memory, so that the at least one processor executes the above method.

[0006] The present invention provides a readable storage medium, on which a program or instruction is stored, and the program or instruction implements the steps of the above method when executed by a processor.

[0007] In the present invention, a set of efficient and collaborative anomaly detection mechanisms is constructed to address the abnormal challenges in the RPA business data processing of enterprises. After receiving the anomaly detection request, the mechanism can quickly extract data from the securely connected target database, thanks to the pre-cross-certification processing to ensure data security. Advanced algorithms are used to deeply analyze data, accurately generate abnormal labels, provide intuitive instructions for operation and maintenance, and drive automatic troubleshooting and updating of processes, significantly shortening fault response time, reducing the risk of business interruption, and ensuring continuous and stable enterprise operations. At the same time, automated and intelligent processing methods reduce the manual burden, improve operation and maintenance efficiency, and provide technical support for the digital transformation of enterprises. The present invention effectively solves the problems of complex data processing, slow abnormal response, and heavy manual troubleshooting in RPA applications, and improves the safety and efficiency of enterprise operations. BRIEF DESCRIPTION OF THE DRAWINGS

[0008] Figure 1 This is a flow chart of an RPA business data anomaly detection method integrating an AI model provided by the present invention.

[0009] Figure 2 This is a schematic diagram of the structure of a detection system provided by the present invention. DETAILED DESCRIPTION

[0010] The technical solution of the present invention will be described clearly and completely below in conjunction with the accompanying drawings of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0011] The terms "first", "second", etc. in the present invention are used to distinguish similar objects, and are not used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged under appropriate circumstances, so that the embodiments of the present invention can be implemented in an order other than those illustrated or described herein, and the objects distinguished by "first", "second", etc. are generally of the same type, and the number of objects is not limited. For example, the first object can be one or more. In addition, in the present invention, "and / or" means at least one of the connected objects, and the character " / " generally indicates that the objects associated with each other are in an "or" relationship.

[0012] Figure 1 An RPA business data anomaly detection method integrating an AI model is shown and applied to a detection system. The method includes the following S101-S103.

[0013] S101. In response to an anomaly detection request reported by a target enterprise server, a detection system obtains RPA business data to be processed from a target database that is communicatively connected to the target enterprise server; wherein cross-certification processing has been completed between the detection system, the target enterprise server, and the target database.

[0014] The core of the present invention is a highly intelligent detection system, which forms a closely connected digital ecosystem with the target enterprise server and the target database. In this digital ecosystem, the detection system plays a core role in anomaly detection and processing, while the target enterprise server is responsible for reporting anomaly detection requests, and the target database stores the RPA business data to be processed. It is worth noting that before the official operation, strict cross-certification processing has been completed between the three to ensure the security and reliability of data transmission.

[0015] Cross-authentication is an important technology in the field of information security. It ensures the authenticity of communication entities and the integrity of data through an identity authentication mechanism between two or more parties. In the present invention, the cross-authentication process between the detection system, the target enterprise server and the target database not only enhances the security of the system, but also lays a solid foundation for subsequent anomaly detection and processing.

[0016] When the target enterprise server detects an anomaly or suspected anomaly in the RPA process, it will proactively report an anomaly detection request to the detection system. The anomaly detection request contains basic information such as the time, location, and scope of impact of the anomaly, providing the detection system with preliminary anomaly clues.

[0017] After receiving the request, the detection system will immediately obtain the RPA business data to be processed related to the anomaly from the target database that is connected to the target enterprise server. The RPA business data to be processed may include the execution log of the RPA process, the input and output data of the business operation, the system status information, etc., which is an important basis for the detection system to perform anomaly analysis.

[0018] During the data acquisition process, the detection system fully utilizes the communication connection with the target database to ensure the efficiency and accuracy of data transmission. At the same time, since the cross-certification process has been completed before, the detection system can safely access the data in the target database without worrying about the risk of data leakage or tampering.

[0019] S102: The detection system inputs the RPA business data to be processed into a target anomaly detection algorithm to obtain an anomaly detection opinion label output by the target anomaly detection algorithm.

[0020] After obtaining the RPA business data to be processed, the detection system will input this data into the pre-designed target anomaly detection algorithm. The target anomaly detection algorithm is one of the core components of the present invention. It is based on advanced technologies such as machine learning and deep learning. It can automatically analyze abnormal patterns in the data and give corresponding anomaly detection opinion labels.

[0021] The design of the target anomaly detection algorithm takes into account the characteristics of RPA business data and the accuracy requirements of anomaly detection. It builds a model of normal business data by learning and training historical data, and uses this as a benchmark to identify anomalies in current data. When certain features in the data to be processed deviate from the normal model, the algorithm will mark it as an anomaly and generate a corresponding anomaly detection opinion label. The anomaly detection opinion label not only contains the type and degree of the anomaly, but also provides the cause of the anomaly and possible solutions, providing strong support for subsequent troubleshooting and update processing.

[0022] S103. The detection system uses the anomaly detection viewpoint label to check and update the automation process corresponding to the RPA business data to be processed.

[0023] After obtaining the anomaly detection opinion label, the detection system will check and update the automation process corresponding to the RPA business data to be processed based on the information in the label. This process aims to locate and repair anomalies to ensure the smooth operation of the RPA process.

[0024] In detail, the specific steps for troubleshooting update processing include:

[0025] Locating anomalies: Based on the anomaly detection viewpoint label, the detection system can accurately locate the link and specific data item where the anomaly occurs. This helps to quickly narrow down the scope of the problem and reduce the workload of troubleshooting;

[0026] Analyze the cause: Based on the location of the anomaly, the detection system will further analyze the cause of the anomaly. This may involve logical errors in the business process, abnormal data input, insufficient system resources, etc. Through in-depth analysis, the detection system can find the root cause of the anomaly and provide guidance for subsequent repair work;

[0027] Repair anomalies: Based on the analysis results, the detection system will take appropriate repair measures to eliminate the anomalies. This may include modifying the business process logic, adjusting data input rules, optimizing system resource configuration, etc. During the repair process, the detection system will make full use of its intelligent and automated features to reduce manual intervention and improve repair efficiency;

[0028] Update process: After the anomaly is fixed, the detection system will update the RPA process. This includes saving the repaired process configuration information to the target database for subsequent use; at the same time, the process will be tested and verified to ensure that it can run normally and process business data;

[0029] Feedback results: Finally, the detection system will feedback the results of the troubleshooting and update processing to the target enterprise server. This includes information such as the type of anomaly, the repair process and results. Through this feedback mechanism, the target enterprise server can timely understand the status of the RPA process and the handling of anomalies, providing decision support for subsequent business operations.

[0030] To facilitate understanding of the technical solutions described in S101-S103 above, taking customer service as an example, an e-commerce company is using RPA technology to process customer orders, and has introduced the detection system of the present invention into the customer service process to monitor and handle anomalies.

[0031] 1. Obtaining RPA business data to be processed (S101)

[0032] Time: 10:00 am, September 9, 2023

[0033] Exception type: Order processing delay

[0034] Impact: Orders in specific product categories (e.g. electronics)

[0035] When an e-commerce company's order processing system detects that the order processing time of a specific product category exceeds a preset threshold (for example, the average processing time exceeds 24 hours), it will report an anomaly detection request to the detection system. This request contains specific information such as the time when the anomaly occurred, the anomaly type (order processing delay), and the scope of impact (orders of a specific product category).

[0036] Before acquiring data, the detection system will use a preset cross-authentication algorithm to communicate with the target enterprise server and target database for authentication. This usually involves steps such as key exchange and certificate verification to ensure communication security. However, the specific details of the cross-authentication algorithm are not described here, as they usually rely on industry standards (such as TLS / SSL protocols) and the specific implementation of the enterprise.

[0037] 2. Input Target Anomaly Detection Algorithm (S102)

[0038] RPA business data to be processed

[0039] Order processing log: contains information such as the processing time and status of orders of a specific product category within the last 24 hours.

[0040] Input and output data: including order details, payment information, logistics information, etc.

[0041] The detection system inputs the above RPA business data to be processed into the target anomaly detection algorithm. A random forest-based anomaly detection algorithm is used, which has learned the characteristic patterns of the normal order processing process during the training phase.

[0042] Random Forest Anomaly Detection:

[0043] Feature extraction: Extract key features from order processing logs and input and output data, such as order processing time, payment success time, logistics response time, etc.

[0044] Model prediction: The extracted features are input into the trained random forest model, and the model outputs the probability that each order belongs to the abnormal category;

[0045] Abnormality determination: Determine whether the order is abnormal based on the preset threshold (such as probability greater than 0.5).

[0046] Anomaly Detection Viewpoint Tags:

[0047] Exception type: Order processing delay;

[0048] Abnormality level: Moderate (based on comparison of delay time with preset threshold);

[0049] Possible reasons: insufficient inventory, logistics system failure;

[0050] Suggested solution: Check inventory status and contact the logistics company to confirm transportation status.

[0051] 3. Troubleshooting and updating (S103)

[0052] Troubleshooting process:

[0053] Number of abnormal orders: 50;

[0054] Inventory check result: insufficient stock of the specific item.

[0055] Based on the anomaly detection opinion tags, the detection system guides the customer service team to conduct specific troubleshooting work. For example, checking the inventory status of a specific product and finding that insufficient inventory is the main reason for delayed order processing.

[0056] Update Processing:

[0057] Stock replenishment: Immediately arrange for stock replenishment to meet order demand.

[0058] Customer Notification: Send a notification to affected customers explaining the delay and promising to process their orders as quickly as possible.

[0059] Process optimization: Analyze the cause of this anomaly and optimize the inventory management system and order processing process to prevent similar problems from happening in the future.

[0060] Feedback results:

[0061] The detection system will feed back the results of the investigation and update processing to the e-commerce company's order processing system and customer service team. The feedback content includes specific measures for exception handling, processing results, and suggestions for future work. In this way, the company can timely understand the status of the customer service process and the exception handling situation, and continuously improve and optimize the service process.

[0062] The present invention significantly improves the processing efficiency and security of RPA (Robotic Process Automation) business data in the enterprise server environment by constructing a set of efficient and collaborative anomaly detection mechanisms. After receiving the anomaly detection request issued by the target enterprise server, the detection system can quickly extract the RPA business data to be processed from the target database with a secure communication connection established. This process benefits from the cross-certification processing completed in advance between the detection system, the enterprise server and the database, ensuring the security of data transmission. Subsequently, the data are deeply analyzed using advanced target anomaly detection algorithms to accurately generate anomaly detection viewpoint labels. The anomaly detection viewpoint labels not only provide intuitive problem indications for operation and maintenance personnel, but also directly drive the troubleshooting and update processing of the corresponding automated processes, thereby greatly shortening the fault response time, reducing the risk of business interruption, and ensuring the continuity and stability of enterprise operations. In addition, the present invention effectively reduces the burden of manual troubleshooting and improves the overall operation and maintenance efficiency through automated and intelligent means, providing solid technical support for the digital transformation of enterprises.

[0063] In some preferred embodiments, S103 describes using the anomaly detection opinion label to check and process the automated process corresponding to the RPA business data to be processed, including: parsing the anomaly detection opinion label to obtain multidimensional label attribute characteristics; obtaining the process description vector corresponding to the automated process; matching the multidimensional label attribute characteristics with the process description vector to obtain an abnormal process matching vector; and optimizing and adjusting the automated process in combination with a priori process optimization strategies and the abnormal process matching vector.

[0064] It can be understood that the present invention focuses on the field of RPA (Robotic Process Automation) business data anomaly detection and processing, aiming to improve the stability and efficiency of automated processes through intelligent means.

[0065] Among them, the "anomaly detection opinion label" is the result of the output of the core algorithm of the present invention, which contains a multi-dimensional and fine-grained characterization of potential anomalies in RPA business data; the "multi-dimensional label attribute characteristics" are obtained after in-depth analysis of these labels, and are a set of attributes that can reflect the specific nature, severity and possible impact range of the anomaly; the "process description vector" is a mathematical tool for abstractly representing the automated process, which captures the key features of the process and facilitates subsequent analysis and processing; the "abnormal process matching vector" is obtained by matching the multi-dimensional label attribute characteristics with the process description vector, which indicates the degree of correlation between the anomaly and the process and the possible abnormal points; the "prior process optimization strategy" is a series of rules or methods pre-formulated based on historical experience, domain knowledge or machine learning models to guide the optimization and adjustment of automated processes.

[0066] Based on this, the step S103 described in "using the anomaly detection opinion label to check and process the automated process corresponding to the RPA business data to be processed" involves the collaborative work of multiple technical modules, aiming to achieve efficient and accurate optimization of the automated process.

[0067] First, the detection system needs to parse the anomaly detection opinion labels to extract the multi-dimensional label attribute features. This step is the basis for all subsequent processing, and its accuracy directly affects the effect of subsequent process optimization. Anomaly detection opinion labels are usually generated by advanced anomaly detection algorithms based on the real-time status of RPA business data. They contain multi-dimensional information about anomalies, such as anomaly type, occurrence time, impact range, possible causes, etc. Through a dedicated parsing module, the detection system can convert these labels into structured multi-dimensional label attribute features to facilitate subsequent matching processing. In this process, the design of the parsing module is crucial. It needs to be highly flexible and robust to cope with anomaly detection opinion labels of different types and formats.

[0068] Secondly, the detection system needs to obtain the process description vector corresponding to the automated process. The process description vector is an abstract representation of the automated process, which captures the key features of the process, such as process steps, logical conditions, data flow, etc. Through the process description vector, the system can have a global grasp of the automated process and provide a basis for subsequent exception matching and optimization. The process of obtaining the process description vector usually involves calling automated process modeling tools, which can generate corresponding description vectors based on the process definition file or runtime log. It should be noted that the construction of the process description vector should be as concise and comprehensive as possible, avoiding information redundancy while ensuring the complete retention of key features.

[0069] Next, the detection system matches the multi-dimensional label attribute features with the process description vector to obtain the abnormal process matching vector. This step is the key to connecting anomaly detection and process optimization. It requires the system to accurately identify the association between anomalies and processes and locate specific abnormal points. Matching processing usually involves a series of complex algorithms and models, such as rule-based matching, similarity-based calculations, and machine learning-based predictions. Through these algorithms and models, the detection system can compare the multi-dimensional label attribute features with the process description vector item by item, calculate the similarity or correlation between them, and then generate an abnormal process matching vector. The abnormal process matching vector not only indicates the degree of association between the anomaly and the process, but also provides specific information about the location of the abnormal point, the scope of influence, etc., providing strong support for subsequent optimization and adjustment.

[0070] After obtaining the abnormal process matching vector, the detection system needs to optimize and adjust the automated process in combination with the prior process optimization strategy and the abnormal process matching vector. The prior process optimization strategy is pre-formulated based on historical experience, domain knowledge or machine learning models, and it contains a deep understanding and wisdom of the optimization and adjustment of automated processes. By combining the prior process optimization strategy, the system can formulate more accurate and effective optimization plans for specific abnormal types and situations. The optimization and adjustment process usually involves reordering process steps, modifying logical conditions, adjusting data flow, etc., in order to eliminate abnormalities and improve the stability and efficiency of the process. It should be noted that the optimization and adjustment should follow the principle of minimum change, that is, while ensuring that the abnormalities are effectively handled, the impact and interference on the original process should be minimized.

[0071] In terms of specific implementation, the detection system can design an optimization and adjustment module, which can automatically generate an optimization and adjustment plan based on the abnormal process matching vector and the prior process optimization strategy. The optimization and adjustment plan can be presented in the form of a script or configuration file to facilitate subsequent deployment and implementation. In addition, the system can also provide a visual interface that allows operation and maintenance personnel to view key information such as abnormal detection viewpoint labels, process description vectors, abnormal process matching vectors, and optimization and adjustment plans, so that they can make necessary confirmations and adjustments. In this way, the detection system not only achieves efficient optimization of the automated process, but also ensures the controllability and traceability of the optimization process by operation and maintenance personnel.

[0072] Furthermore, in order to improve the accuracy and efficiency of optimization and adjustment, the detection system can also introduce a feedback mechanism. After the optimization and adjustment plan is implemented, the system can collect real-time feedback of RPA business data, such as process execution time, error rate, resource consumption, etc., to evaluate the optimization effect. By comparing the data before and after optimization, the system can determine whether the optimization and adjustment has achieved the expected effect, and make further adjustments and optimizations as needed. This closed-loop feedback mechanism not only improves the system's adaptive ability, but also ensures the continuity and effectiveness of optimization and adjustment.

[0073] It can be seen that by parsing the anomaly detection viewpoint label to obtain the multi-dimensional label attribute characteristics, obtain the process description vector corresponding to the automated process, match the multi-dimensional label attribute characteristics with the process description vector to obtain the abnormal process matching vector, and combine the prior process optimization strategy and the abnormal process matching vector to optimize and adjust the automated process, achieving efficient and accurate processing of RPA business data anomalies. In this way, not only the stability and efficiency of the automated process are improved, but also the burden on operation and maintenance personnel is reduced, providing solid technical support for the digital transformation of enterprises.

[0074] In some optional embodiments, the debugging step of the target anomaly detection algorithm includes:

[0075] (1) obtaining an initial anomaly detection algorithm and a historical RPA business log, wherein the historical RPA business data in the historical RPA business log includes first historical RPA business data and second historical RPA business data, wherein the first historical RPA business data is configured with its corresponding detection viewpoint training annotation;

[0076] (2) For each piece of historical RPA business data, discrete binning is performed on the historical RPA business data to obtain multiple business data subsets of the historical RPA business data;

[0077] (3) performing abnormal state knowledge mining on the historical RPA business data and each business data subset of the historical RPA business data by using the initial anomaly detection algorithm, and obtaining an abnormal state knowledge graph of the historical RPA business data and an abnormal state knowledge subgraph corresponding to each business data subset;

[0078] (4) Based on the detection viewpoint training annotations of the first historical RPA business data, the detection viewpoints are summarized on the abnormal state knowledge graphs of each historical RPA business data in the historical RPA business log to obtain the detection viewpoint training annotations corresponding to the second historical RPA business data;

[0079] (5) for each business data subset of the historical RPA business data, based on the abnormal state knowledge subgraph corresponding to the business data subset and the abnormal state knowledge graph of the historical RPA business data to which the business data subset belongs, calculating the correlation feature between the business data subset and the historical RPA business data to which it belongs;

[0080] (6) Based on the correlation features and the detection viewpoint training annotations corresponding to the second historical RPA business data, the algorithm module weights of the initial anomaly detection algorithm are improved to obtain the target anomaly detection algorithm.

[0081] It can be understood that this embodiment focuses on the debugging and training process of the target anomaly detection algorithm, which aims to improve the algorithm's recognition accuracy and generalization ability for abnormal states in RPA (Robotic Process Automation) business data through a series of rigorous and innovative technical means.

[0082] First, the starting point of the entire debugging process is to obtain the initial anomaly detection algorithm and rich historical RPA business logs. As a valuable training resource, the historical RPA business logs contain a large amount of first historical RPA business data and second historical RPA business data, which provide a solid foundation for algorithm training and tuning. More importantly, the first historical RPA business data has been carefully annotated with corresponding detection viewpoint training annotations, which provide direct and clear guidance for the algorithm to learn how to accurately identify and interpret abnormal states.

[0083] Subsequently, in order to more deeply mine the abnormal patterns in the data, the system performed discrete binning processing on each historical RPA business data. The key to this step is that it can divide complex and continuous business data into multiple representative business data subsets, each of which reflects the distribution characteristics of the data in a specific interval. Through such processing, not only the complexity of the data is reduced, but also the algorithm can focus more on the key abnormal features in the data, creating favorable conditions for subsequent knowledge mining.

[0084] Next, the initial anomaly detection algorithm is used to mine abnormal state knowledge on these carefully preprocessed business data. This process is not only for the overall historical RPA business data, but also extends to each business data subset in detail, thereby generating a comprehensive and detailed abnormal state knowledge graph and abnormal state knowledge subgraphs corresponding to each subset. These graphs and subgraphs clearly depict the distribution, association, and evolution of abnormal states in the data, providing a rich knowledge base for algorithm learning and tuning.

[0085] On this basis, the system further uses the detection viewpoint training annotations of the first historical RPA business data to conduct in-depth detection viewpoint induction on the abnormal state knowledge graph in the entire historical RPA business log. This process aims to incorporate the expert knowledge in the annotations into the algorithm so that it can understand and interpret abnormal states more accurately. Through this step, the originally unlabeled second historical RPA business data also obtains the corresponding detection viewpoint training annotations, which greatly enriches the training set and improves the generalization ability of the algorithm.

[0086] In order to more accurately capture the intrinsic connection between the data subset and the overall data to which it belongs, the system then calculates the correlation features between each business data subset and the historical RPA business data to which it belongs. This step quantifies the similarities and differences between the subset and the overall abnormal state knowledge subgraph and graph by comparing them, providing the algorithm with a deep understanding of the local and global relationships of the data. These correlation features connect the micro and macro levels of the data, allowing the algorithm to more comprehensively grasp the abnormal characteristics of the data.

[0087] Finally, based on the carefully calculated relevance features and the detection viewpoint training annotations corresponding to the second historical RPA business data, the system made detailed improvements to the algorithm module weights of the initial anomaly detection algorithm. This step is the key to algorithm tuning. It adjusts the weight distribution of each module within the algorithm so that the algorithm can more accurately identify and respond to abnormal states in the data. After this round of tuning, the initial anomaly detection algorithm has been transformed into a target anomaly detection algorithm with excellent performance, providing strong technical support for anomaly detection of RPA business data.

[0088] It is worth mentioning that the entire debugging and training process is not static, but an iterative and optimized process. In actual applications, the system will continuously adjust and optimize the parameters and strategies of each step based on the actual performance and feedback of the algorithm to ensure that the algorithm can continue to adapt to the ever-changing business scenarios and data characteristics. In addition, the system also introduces advanced machine learning technologies, such as deep learning and reinforcement learning, to further enhance the intelligence level and adaptive ability of the algorithm.

[0089] In order to explain the above embodiment in more detail, relevant examples will be introduced below to more intuitively demonstrate the debugging and training process of the target anomaly detection algorithm.

[0090] First, the historical RPA business log contains 1,000 first historical RPA business data and 2,000 second historical RPA business data. Each piece of data consists of multiple features, such as processing time, resource consumption, error rate, etc. Each piece of data in the first historical RPA business data has been annotated by experts with detection viewpoint training annotations, such as "processing time is too long" and "abnormal resource consumption".

[0091] In the discrete binning processing stage, a reasonable interval range is set for each feature, and the data is divided into corresponding subsets. Taking processing time as an example, it may be divided into intervals such as "0-1 seconds", "1-5 seconds", and "5-10 seconds". In this way, each historical RPA business data will be divided into one or more subsets, forming multiple business data subsets.

[0092] Next, an initial anomaly detection algorithm (such as an anomaly detection model based on the isolation forest or LOF algorithm) is used to mine abnormal state knowledge on this data. For the overall historical RPA business data, the algorithm generates an abnormal state knowledge graph, which contains various abnormal states and their relationships. For each business data subset, the algorithm generates a corresponding abnormal state knowledge subgraph, which reflects the abnormal characteristics of the data in the subset.

[0093] In the detection viewpoint induction stage, the detection viewpoint training annotations of the first historical RPA business data are used to summarize the abnormal state knowledge graph. For example, if a certain abnormal state frequently appears in multiple data marked as "processing time is too long", then the abnormal state can be associated with the detection viewpoint of "processing time is too long". Through such induction, corresponding detection viewpoint training annotations can be generated for the second historical RPA business data.

[0094] In the correlation feature calculation stage, a measurement method based on graph similarity is adopted. Specifically, the Jaccard similarity between the node set of each business data subgraph and the node set of the overall graph is calculated, as well as the degree of overlap between their edges. These similarity values ​​are used as correlation features to describe the relationship between the subset and the whole.

[0095] Finally, in the algorithm module weight improvement stage, an optimization method based on gradient descent is adopted. Specifically, a loss function that combines the information of relevance features and detection viewpoint training annotations can be used to measure the difference between the algorithm output and the actual situation. Then, by calculating the gradient of the loss function to the algorithm module weight and updating the weight in the opposite direction of the gradient, the value of the loss function is gradually reduced, thereby improving the performance of the algorithm.

[0096] In summary, through a series of innovative and rigorous technical means, the fine debugging and efficient training of the target anomaly detection algorithm have been achieved. This process not only improves the recognition accuracy and generalization ability of the algorithm, but also lays a solid foundation for its wide application in actual business scenarios.

[0097] In some preferred technical solutions, the detection viewpoint training annotations of the first historical RPA business data are used to summarize the detection viewpoints of the abnormal state knowledge graphs of each historical RPA business data in the historical RPA business log to obtain the detection viewpoint training annotations (detection viewpoint annotation data) corresponding to the second historical RPA business data, including: pre-determining a target number of benchmark detection viewpoints, and calculating the commonality evaluation coefficients between the abnormal state knowledge graphs of each historical RPA business data in the historical RPA business log and each benchmark detection viewpoint; for each historical RPA business data, determining the target benchmark detection viewpoint that matches the historical RPA business data from each benchmark detection viewpoint based on the commonality evaluation coefficient and the detection viewpoint training annotations of the first historical RPA business data. Accurate detection viewpoint, move the historical RPA business data to the data group corresponding to the target benchmark detection viewpoint; for the data group corresponding to each benchmark detection viewpoint, filter the historical RPA business data that meets the preset benchmark viewpoint requirements from the data group as a new benchmark detection viewpoint; jump to the step of calculating the commonality evaluation coefficient of the abnormal state knowledge graph of each historical RPA business data in the historical RPA business log and each benchmark detection viewpoint, until the obtained benchmark detection viewpoint meets the inductive termination requirement; based on the detection viewpoint training annotation of the first historical RPA business data in the RPA business data set to be processed corresponding to the benchmark detection viewpoint that meets the inductive termination requirement, determine the detection viewpoint training annotation of the second historical RPA business data in the RPA business data set to be processed.

[0098] In detail, regarding how to effectively summarize the detection viewpoints of the abnormal state knowledge graph of each historical RPA business data in the historical RPA business log based on the detection viewpoint training annotations of the first historical RPA business data, and then obtain the detection viewpoint training annotations (that is, detection viewpoint annotation data) corresponding to the second historical RPA business data, this embodiment aims to achieve accurate annotation of the data to be tested through a series of carefully designed steps, thereby improving the accuracy and practicality of the anomaly detection algorithm.

[0099] First, the abnormal state knowledge graph is a structured data representation method that captures and presents the complex associations and distribution characteristics of abnormal states in RPA business data. The detection viewpoint training annotations are explanatory annotations given by experts for specific abnormal states based on business knowledge and experience. These annotations provide valuable learning signals for the algorithm.

[0100] In order to start the process of summarizing the detection viewpoints, a target number of benchmark detection viewpoints was determined in advance. These benchmark detection viewpoints, like a ruler, provide a benchmark for measuring and comparing the abnormal states of different historical RPA business data. Subsequently, the commonality evaluation coefficients of the abnormal state knowledge graphs of each historical RPA business data in the historical RPA business log and each benchmark detection viewpoint were calculated. The key to this step is to provide an objective basis for the subsequent summary of detection viewpoints by quantifying the similarity or matching degree between the graph and the benchmark.

[0101] When calculating the commonality evaluation coefficient, multiple dimensions such as the number of nodes in the graph, the connectivity of the edges, and the distribution of abnormal states are comprehensively considered to ensure the comprehensiveness and accuracy of the evaluation. Through this step, one or more benchmark detection viewpoints that are most similar to its abnormal state can be found for each historical RPA business data.

[0102] Next, for each historical RPA business data, the target benchmark detection viewpoint that matches it is determined from each benchmark detection viewpoint based on the commonality evaluation coefficient and the detection viewpoint training annotation of the first historical RPA business data. This process is actually a classification or clustering process, which merges historical RPA business data with similar abnormal states into the same benchmark detection viewpoint. To achieve this goal, classification algorithms in machine learning, such as support vector machines, decision trees, etc., or clustering algorithms, such as K-means, DBSCAN, etc., can be used. These algorithms can automatically learn and identify the target benchmark detection viewpoint that best matches each historical RPA business data based on the commonality evaluation coefficient and training annotations.

[0103] Once the target benchmark detection viewpoint is determined, the corresponding historical RPA business data is moved to the data group corresponding to the benchmark detection viewpoint. In this way, each data group contains a group of historical RPA business data with similar abnormal states, which share the same detection viewpoint.

[0104] However, the goal is not just to group the data, but more importantly to extract new benchmarking viewpoints from the data. Therefore, in the next step, for the data groupings corresponding to each benchmarking viewpoint, the historical RPA business data that meets the requirements of the preset benchmark viewpoints is selected from the data groupings as new benchmarking viewpoints. The purpose of this step is to obtain more representative and generalizable benchmarking viewpoints through further optimization and refinement. To achieve this goal, machine learning techniques such as feature selection and dimensionality reduction can be used to extract the most critical and valuable features in the data.

[0105] After completing the above steps, the process does not stop, but jumps back to the step of calculating the common evaluation coefficients of the abnormal state knowledge graph of each historical RPA business data in the historical RPA business log and each benchmark detection viewpoint. This iterative process will continue until the obtained benchmark detection viewpoint meets the inductive termination requirements. The inductive termination requirements may include the stability, coverage, accuracy and other aspects of the benchmark detection viewpoint to ensure that the final benchmark detection viewpoint can fully and accurately reflect the abnormal state in the historical RPA business data.

[0106] Finally, based on the detection viewpoint training annotations of the first historical RPA business data in the RPA business data set to be processed corresponding to the benchmark detection viewpoint that meets the inductive termination requirements, the detection viewpoint training annotations of the second historical RPA business data in the RPA business data set to be processed are determined. This step actually transfers expert knowledge to unlabeled data, thereby realizing automatic labeling of the data to be tested. Through this process, high-quality detection viewpoint training annotations can be generated for the second historical RPA business data, providing valuable training resources for subsequent anomaly detection algorithms.

[0107] In this way, the above embodiment realizes the induction of detection viewpoints for the abnormal state knowledge graph of each historical RPA business data in the historical RPA business log. This process not only improves the accuracy and practicality of the anomaly detection algorithm, but also provides strong technical support for the stable operation and efficient management of the RPA business.

[0108] In the next step, based on the detection viewpoint training annotations of the first historical RPA business data, the abnormal state knowledge graph of each historical RPA business data in the historical RPA business log is used to summarize the detection viewpoints to obtain the detection viewpoint training annotations corresponding to the second historical RPA business data, including: based on the abnormal state knowledge graph of each two historical RPA business data, determining the historical commonality evaluation coefficient between each two historical RPA business data; based on the historical commonality evaluation coefficient, generating a data topology network, the data topology network characterizing the involvement between each historical RPA business data; based on the data topology network, performing training annotation walks on the detection viewpoint training annotations of the first historical RPA business data to obtain the detection viewpoint training annotations corresponding to the second historical RPA business data.

[0109] In detail, the data topology network includes data topology units corresponding to each historical RPA business data, and involvement pointers between data topology units, wherein the involvement pointers represent the involvement between two connected data topology units; then, based on the data topology network, the detection viewpoint training annotations of the first historical RPA business data are trained and annotated to obtain the detection viewpoint training annotations corresponding to the second historical RPA business data, including: in the data topology network, the detection viewpoint training annotations of the first historical RPA business data are trained and annotated to determine the original detection viewpoint training annotations of the second historical RPA business data through the involvement pointers between the data topology units to determine the original detection viewpoint training annotations of the second historical RPA business data; for each second historical RPA business data, based on the neighbor topology units of the second historical RPA business data in the data topology network, the original detection viewpoint training annotations of the second historical RPA business data are trained and annotated cyclically walked and proofread until the training annotations of the data topology units in the data topology network are in a stable state, thereby obtaining the detection viewpoint training annotations corresponding to the second historical RPA business data.

[0110] The above two embodiments will elaborate on how to efficiently and accurately summarize the abnormal state knowledge graph of each historical RPA business data in the historical RPA business log based on the detection viewpoint training annotation of the first historical RPA business data, so as to derive the detection viewpoint training annotation corresponding to the second historical RPA business data. And introduce how to perform training annotation walking on the detection viewpoint training annotation of the first historical RPA business data based on the constructed data topology network, so as to further obtain the detection viewpoint training annotation of the second historical RPA business data.

[0111] First, in order to achieve the detection viewpoint induction of abnormal state knowledge graphs in historical RPA business data, it is necessary to measure the similarity or correlation between each two historical RPA business data. This is achieved by determining the historical commonality evaluation coefficient between them based on the abnormal state knowledge graphs of each two historical RPA business data. The historical commonality evaluation coefficient is a quantitative indicator that reflects the degree of similarity between two knowledge graphs in terms of structure, node distribution, abnormal state pattern, etc. By calculating this coefficient, it is possible to identify which historical RPA business data have high similarity in abnormal state, providing a basis for the subsequent data topology network construction and detection viewpoint induction.

[0112] Next, based on the calculated historical commonality evaluation coefficient, a data topology network was generated. This data topology network is a graph structure, in which each node represents a data topology unit corresponding to a historical RPA business data, and the edge between the nodes (i.e., the involvement pointer) represents the involvement or similarity between the two connected data topology units. The construction of the data topology network makes it possible to intuitively see the correlation and involvement relationship between each historical RPA business data, which facilitates the subsequent detection viewpoint wandering and annotation.

[0113] After the data topology network is constructed, the training annotation walking process of the detection viewpoint training annotation of the first historical RPA business data begins. The goal of this process is to propagate the detection viewpoint training annotation of the first historical RPA business data to the second historical RPA business data, thereby realizing the automatic annotation of the second historical RPA business data. Specifically, the detection viewpoint training annotation of the first historical RPA business data is walked through the reference pointers between the data topology units in the data topology network. The walking process can be regarded as a process of information transmission or diffusion, in which each data topology unit transmits the detection viewpoint training annotation it receives to its adjacent data topology unit.

[0114] Through this walking process, the original detection viewpoint training annotations of the second historical RPA business data can be preliminarily determined. However, due to the complexity of the data topology network and the diversity of the pointers involved, the preliminarily determined detection viewpoint training annotations may have certain errors or uncertainties. In order to solve this problem, for each second historical RPA business data, based on its neighbor topology unit in the data topology network, its original detection viewpoint training annotations are subjected to training annotation cyclic walking proofreading. This process can be regarded as an iterative optimization process, in which each iteration corrects and updates the detection viewpoint training annotations of the current second historical RPA business data according to the detection viewpoint training annotations of the neighbor topology unit.

[0115] Through multiple iterations and proofreading, the training annotations of the data topology unit in the data topology network gradually tend to a stable state. At this point, it can be considered that the detection viewpoint training annotations of the second historical RPA business data have achieved a high degree of accuracy and reliability. Finally, the detection viewpoint training annotations corresponding to the second historical RPA business data are obtained, which can be directly used in the subsequent anomaly detection algorithm to improve the performance and accuracy of the algorithm.

[0116] It is worth noting that there is a close subordinate and progressive relationship between the two specific implementation methods in this embodiment. First, a data topology network is constructed based on the historical commonality evaluation coefficient. This step provides the basis and support for the subsequent training annotation walk. Then, training annotation walks and loop walk proofreading are performed on the data topology network. This process realizes the automatic labeling and annotation of the second historical RPA business data. The two implementation methods cooperate and support each other, and together constitute the complete technical solution of this embodiment.

[0117] In this way, the detection viewpoints of the abnormal state knowledge graph of each historical RPA business data in the historical RPA business log are summarized, as well as the training annotation roaming and proofreading based on the data topology network. This technical solution not only improves the accuracy and performance of the anomaly detection algorithm, but also provides strong technical support for the stable operation and efficient management of RPA business.

[0118] In some alternative embodiments, for each business data subset of the historical RPA business data, based on the abnormal state knowledge subgraph corresponding to the business data subset and the abnormal state knowledge graph of the historical RPA business data to which the business data subset belongs, the correlation feature between the business data subset and the historical RPA business data to which it belongs is calculated, including: generating a scene state knowledge vector cluster based on the abnormal state knowledge graph of each historical RPA business data, generating a link state knowledge vector cluster based on the abnormal state knowledge subgraph of the business data subset of each historical RPA business data; for each historical RPA business data, querying at least one associated state knowledge vector cluster that matches the abnormal state knowledge graph of the historical RPA business data in the scene state knowledge vector cluster. According to the detection viewpoint training annotations of the historical RPA business data to which the associated state knowledge graph belongs, a preliminary screening training annotation cluster of the historical RPA business data is determined; for each business data subset of the historical RPA business data, at least one associated state knowledge subgraph matching the abnormal state knowledge subgraph of the business data subset is queried in the link state knowledge vector cluster, and the preliminary screening training annotation cluster of the business data subset is determined according to the detection viewpoint training annotations of the historical RPA business data to which the associated state knowledge subgraph belongs; according to the preliminary screening training annotation cluster of the business data subset and the preliminary screening training annotation cluster of the historical RPA business data to which the business data subset belongs, the correlation feature between the business data subset and the historical RPA business data to which it belongs is calculated.

[0119] It can be understood that for each business data subset of historical RPA (Robotic Process Automation) business data, an innovative method is proposed to calculate the correlation characteristics between the business data subset and the historical RPA business data to which it belongs. This method not only deeply explores the intrinsic connection between the business data subset and the overall historical RPA business data, but also ensures the accuracy and reliability of the calculation results through a series of carefully designed steps.

[0120] First, in order to fully understand the abnormal state of historical RPA business data, scenario state knowledge vector clusters were generated based on the abnormal state knowledge graphs of each historical RPA business data. These vector clusters can be regarded as mathematical representations of the abnormal state knowledge graph, which capture the complex information of nodes, edges and their relationships in the graph. Similarly, for each business data subset of historical RPA business data, corresponding link state knowledge vector clusters were also generated. These link state knowledge vector clusters reflect the local characteristics of the business data subset in terms of abnormal state, providing a basis for subsequent matching and calculation.

[0121] Next, for each historical RPA business data, query at least one associated state knowledge graph that matches its abnormal state knowledge graph in the scenario state knowledge vector cluster. The purpose of this step is to find other business data that are similar to the historical RPA business data in abnormal state, so as to use the detection viewpoint training annotations of these similar data to assist in calculating the relevance features. After querying the associated state knowledge graph, the initial screening training annotation clusters of the historical RPA business data are determined based on the detection viewpoint training annotations of the historical RPA business data to which these graphs belong. These initial screening training annotation clusters are a preliminary judgment of the abnormal state of the historical RPA business data, and they provide important reference information for subsequent calculations.

[0122] Then, we turn to the processing of business data subsets. For each business data subset of historical RPA business data, query at least one associated state knowledge subgraph that matches its abnormal state knowledge subgraph in the link state knowledge vector cluster. This step is similar to the previous step, but focuses on the similarity at the business data subset level. After querying the associated state knowledge subgraph, the initial screening training annotation clusters of the business data subsets are determined based on the detection viewpoint training annotations of the historical RPA business data to which these subgraphs belong. These initial screening training annotation clusters reflect the preliminary characteristics of the business data subset in terms of abnormal states, and provide the necessary basis for calculating the relevance characteristics.

[0123] After obtaining the business data subset and the preliminary screening training annotation clusters of the historical RPA business data to which it belongs, we start to calculate the correlation characteristics between them. This step is the core of the entire method, which comprehensively considers the similarities and differences between the business data subset and the overall historical RPA business data in terms of abnormal status. By comparing the annotation content, quantity, and distribution in the preliminary screening training annotation clusters, the correlation between the business data subset and the historical RPA business data to which it belongs can be quantitatively evaluated. This evaluation not only considers their direct connection in abnormal status, but also reveals the deep relationship between them by mining potential patterns and laws.

[0124] It is worth noting that when calculating the correlation features, a variety of advanced algorithms and technologies are also used to ensure the accuracy and reliability of the results. For example, a vector space model can be used to calculate the similarity between the initial screening training annotation clusters, or a machine learning algorithm can be used to mine the features and rules hidden in the annotation clusters. The application of these algorithms and technologies enables a more accurate portrayal of the relationship between the business data subset and the historical RPA business data to which it belongs, thus providing a strong basis for subsequent anomaly detection, early warning, and decision support.

[0125] In addition, this embodiment is highly flexible and scalable. It can be applied not only to current historical RPA business data and business data subsets, but can also be easily extended to future data and subsets. By continuously updating and improving the scene state knowledge vector cluster and link state knowledge vector cluster, the calculation accuracy and efficiency of the correlation feature can be continuously improved to meet the ever-changing business needs and technical challenges.

[0126] In this way, the correlation characteristics between each business data subset of historical RPA business data and its historical RPA business data are successfully calculated. This method not only deeply explores the internal connections and rules between data, but also provides strong technical support and guarantee for subsequent anomaly detection, early warning and decision support.

[0127] It is worth mentioning that in order to ensure that the above embodiments can be implemented clearly and completely, some examples may be introduced to further illustrate their functions and implementation processes.

[0128] 1) Generation of scene state knowledge vector clusters and link state knowledge vector clusters

[0129] First, assume that there is a historical RPA business data set, which contains multiple business data subsets. For each historical RPA business data, there is an abnormal state knowledge graph, which can be represented by an adjacency matrix, where nodes represent different abnormal states and edges represent the transition relationship between states.

[0130] Vector cluster generation:

[0131] For each abnormal state knowledge graph, a graph embedding algorithm (such as Node2Vec, DeepWalk, etc.) can be used to generate the corresponding scene state knowledge vector. These vectors capture the structure and relationship information between nodes in the graph.

[0132] Similarly, for the abnormal state knowledge subgraph of each business data subset, the same graph embedding algorithm is used to generate the link state knowledge vector.

[0133] Numerical example:

[0134] Assume that there is an abnormal state knowledge graph containing 3 nodes, and its adjacency matrix is: [

[0136] [0, 1, 0],

[0137] [1, 0, 1],

[0138] [0, 1, 0] ]

[0140] Through the graph embedding algorithm, we can obtain the following scene state knowledge vector cluster (the vector dimension is set to 2): [

[0142] [0.5, 0.3], #vector of node 1

[0143] [0.2, 0.8], #vector of node 2

[0144] [0.7, 0.4] # vector of node 3 ]

[0146] For the abnormal state knowledge subgraph of the business data subset, assuming that it only contains nodes 1 and 2, then its link state knowledge vector cluster may be: [

[0148] [0.5, 0.3], #vector of node 1 (same as in the scene state knowledge vector cluster)

[0149] [0.2, 0.8] # Node 2 vector (same as in the scene state knowledge vector cluster) ]

[0151] 2) Query of the association state knowledge graph and the association state knowledge subgraph

[0152] Next, we need to query the associated graph or subgraph that matches the given abnormal state knowledge graph or abnormal state knowledge subgraph. This can be achieved by calculating the similarity between vector clusters.

[0153] Similarity calculation:

[0154] The similarity between two vectors can be calculated using metrics such as cosine similarity and Euclidean distance.

[0155] For two vector clusters, we can calculate the average similarity of all corresponding vectors in them, or just calculate the similarity of the most similar pairs of vectors.

[0156] Query process:

[0157] For each historical RPA business data, search for several associated state knowledge graphs that are most similar to its abnormal state knowledge graph in the scenario state knowledge vector cluster.

[0158] For each business data subset, several associated state knowledge subgraphs that are most similar to its abnormal state knowledge subgraph are found in the link state knowledge vector cluster.

[0159] It is assumed that there are two scenario state knowledge vector clusters: A and B, which represent the abnormal state knowledge graphs of two historical RPA business data respectively.

[0160] Calculate the cosine similarity of all corresponding vectors in A and B, and find the most similar pairs of vectors.

[0161] Based on these similarity pairs, it can be determined which associated state knowledge graphs match the given abnormal state knowledge graph.

[0162] 3) Determination of initial screening training annotation clusters and calculation of correlation features

[0163] Finally, it is necessary to determine the initial screening training annotation clusters based on the queried association state knowledge graph and association state knowledge subgraph, and calculate the relevance features.

[0164] Determination of initial screening training annotation clusters:

[0165] For each queried association state knowledge graph or association state knowledge subgraph, view the detection viewpoint training annotations of the historical RPA business data to which it belongs.

[0166] These annotations are aggregated to form initial screening training annotation clusters.

[0167] Calculation of correlation features:

[0168] Evaluation indicators in information retrieval (such as TF-IDF, BM25, etc.) can be used to calculate the correlation between the business data subset and the historical RPA business data to which it belongs in the initial screening training annotation cluster.

[0169] In addition, machine learning algorithms (such as support vector machines, random forests, etc.) can also be used to train a model that can predict the correlation between a business data subset and its historical RPA business data based on the initial screening training annotation clusters.

[0170] There are two initial screening training annotation clusters: C1 (from the business data subset) and C2 (from the historical RPA business data to which it belongs).

[0171] Calculate the TF-IDF value of each annotation in C1 and C2, and calculate the cosine similarity between them as the relevance feature.

[0172] Alternatively, C1 and C2 can be input as feature vectors into a trained machine learning model, which will output a numerical value representing the degree of relevance.

[0173] In other preferred embodiments, the correlation characteristics between the business data subset and the historical RPA business data to which the business data subset belongs are calculated based on the preliminary screening training annotation cluster of the business data subset and the preliminary screening training annotation cluster of the historical RPA business data to which the business data subset belongs, including: performing thermal characteristic calculation on the detection viewpoint training annotations in the preliminary screening training annotation cluster of the business data subset to determine the training annotation thermal relationship network of the business data subset; performing thermal characteristic calculation on the detection viewpoint training annotations in the preliminary screening training annotation cluster of the historical RPA business data to which the business data subset belongs to determine the training annotation thermal relationship network of the historical RPA business data to which the business data subset belongs; calculating the correlation characteristics between the business data subset and the historical RPA business data to which it belongs based on the training annotation thermal relationship network of the business data subset and the training annotation thermal relationship network of the historical RPA business data to which the business data subset belongs.

[0174] In actual application, this embodiment proposes an innovative and efficient method for calculating the correlation characteristics between a business data subset and its historical RPA business data based on the initial screening training annotation cluster of the business data subset and the initial screening training annotation cluster of the historical RPA (Robotic Process Automation) business data to which the business data subset belongs. This method comprehensively evaluates the correlation between the business data subset and the historical RPA business data by deeply mining the information in the initial screening training annotation cluster and constructing a training annotation thermal relationship network.

[0175] First, in order to understand the characteristics of the business data subset in terms of abnormal state, it is necessary to calculate the thermal characteristics of the detection viewpoint training annotations in the initial screening training annotation cluster of the business data subset. The purpose of this step is to convert the information in the annotations into quantifiable thermal characteristics, which is convenient for subsequent analysis and comparison. In the process of thermal characteristic calculation, the frequency, importance and correlation between annotations are considered. By combining these factors, it is possible to determine which annotations in the business data subset are critical, which annotations are secondary, and how they interact with each other. In this way, a thermal relationship network of training annotations reflecting the abnormal state characteristics of the business data subset is constructed.

[0176] Secondly, in order to understand the overall characteristics of the abnormal state of the historical RPA business data to which the business data subset belongs, it is necessary to perform thermal feature calculations on the detection viewpoint training annotations in the initial screening training annotation cluster of the historical RPA business data. This step is similar to the previous step, but focuses on the annotation features at the level of historical RPA business data. Through calculation, a training annotation thermal relationship network that reflects the overall characteristics of the abnormal state of the historical RPA business data is obtained. This relationship network not only contains all the important annotation information in the historical RPA business data, but also reveals the internal connections and rules between these annotations.

[0177] After obtaining the training annotation thermal network of the business data subset and the historical RPA business data, we start to calculate the correlation features between them. This step is the core of the entire method, which comprehensively considers the similarities and differences between the business data subset and the historical RPA business data in terms of abnormal states. In order to calculate the correlation features, a variety of advanced algorithms and technologies are used.

[0178] One possible approach is to use a vector space model. The training annotation thermal network of the business data subset and the historical RPA business data is represented as two vectors, where each dimension of the vector corresponds to a thermal feature of an annotation. Then, the cosine similarity or Euclidean distance between the two vectors is calculated as the correlation feature between the business data subset and the historical RPA business data. Cosine similarity measures the degree of similarity between two vectors in direction, while Euclidean distance measures their distance in space. By choosing an appropriate measurement method, the correlation between the business data subset and the historical RPA business data can be accurately evaluated.

[0179] Another possible approach is to use a machine learning algorithm. The training annotation thermal network of the business data subset and the historical RPA business data can be input as feature vectors into a trained machine learning model, which will predict the correlation between the business data subset and the historical RPA business data based on these features. The machine learning algorithm can automatically learn the features and patterns in the data and give accurate prediction results. By selecting appropriate algorithms and model parameters, the accuracy and efficiency of correlation calculation can be further improved.

[0180] In addition to the above methods, you can also consider using relevant algorithms in graph theory to calculate the correlation features between the business data subset and the historical RPA business data. For example, the training annotation thermal relationship network can be represented as a graph structure, where nodes represent annotations and edges represent the association relationship between annotations. Then, you can use a graph matching algorithm or a graph kernel algorithm to calculate the similarity or distance between the two graph structures as the correlation feature between the business data subset and the historical RPA business data.

[0181] When calculating the relevance features, you also need to pay attention to some details and special cases. For example, if there are missing values ​​or outliers in the training annotation thermal network of the business data subset or historical RPA business data, corresponding processing and correction are required. In addition, if the business data subset and historical RPA business data are large in scale or highly complex, it may be necessary to use distributed computing or parallel computing methods to improve efficiency.

[0182] For example, the initial screening training annotation cluster of the business data subset is set to include the following annotations and their occurrence frequencies: Annotation A: 5 times; Annotation B: 3 times; Annotation C: 2 times.

[0183] The detection system uses an exemplary thermal feature calculation method, which assigns corresponding weights to annotations according to their frequency of occurrence. In this example, annotation A has the highest weight of 5, annotation B is second, 3, and annotation C is the lowest, 2. Based on these weights, the detection system can construct a training annotation thermal network of a subset of business data, where nodes represent annotations and weights represent the importance or frequency of annotations.

[0184] Next, the detection system performs the same thermal feature calculation on the initial screening training annotation cluster of the historical RPA business data to which the business data subset belongs. The initial screening training annotation cluster of the historical RPA business data is set to contain the following annotations and their frequencies of occurrence: Annotation A: 10 times; Annotation B: 4 times; Annotation D: 6 times.

[0185] Similarly, the detection system assigns weights to annotations according to their frequency of occurrence, with annotation A having a weight of 10, annotation B having a weight of 4, and annotation D having a weight of 6. It also constructs a thermal relationship network of training annotations that reflects the overall characteristics of the abnormal state of historical RPA business data.

[0186] With these two thermal relationship networks, the detection system starts to calculate the correlation features between the business data subset and the historical RPA business data. In the present invention, the detection system uses the cosine similarity in the vector space model as an example algorithm.

[0187] The detection system represents the training annotation thermal network of the business data subset and the historical RPA business data as two vectors respectively. For the business data subset, vector A can be represented as [5, 3, 2], where each element corresponds to the weight of an annotation. For the historical RPA business data, since annotation D does not exist in the business data subset, the detection system can set its weight to 0, so vector B can be represented as [10, 4, 0, 6], where the fourth element corresponds to the weight of annotation D.

[0188] Then, the detection system calculates the cosine similarity between the two vectors. The formula for calculating cosine similarity is as follows: cosine_similarity=(A·B) / (||A||*||B||);

[0189] Where A and B represent the vectors of the business data subset and historical RPA business data, respectively. "·" represents the dot product of the vectors. ||A|| and ||B|| represent the modulus or size of the vectors, respectively.

[0190] Substituting the specific values ​​into the formula, the detection system can obtain:

[0191] cosine_similarity=(510+34+2*0) / (sqrt(5^2+3^2+2^2)*sqrt(10^2+4^2+0^2+6^2))=(50+12+0) / (sqrt(38)*sqrt(148))≈0.83;

[0192] This cosine similarity value is close to 1, indicating that the business data subset and the historical RPA business data have a high correlation in terms of abnormal status.

[0193] In addition to the vector space model, the detection system can also consider using other algorithms to calculate the relevance features, such as machine learning algorithms or graph theory algorithms. Machine learning algorithms can train models based on the annotation features in the initial screening training annotation clusters and predict the relevance between new business data subsets and historical RPA business data. Graph theory algorithms can consider the association relationship between annotations and compare the similarity or distance between two graph structures.

[0194] It should be noted that in practical applications, the detection system may need to process the annotations more finely, such as considering the semantic information and contextual relationships of the annotations. In addition, for large-scale data sets and complex annotation relationship networks, the detection system may need to adopt distributed computing or parallel computing methods to improve efficiency.

[0195] In summary, by introducing specific numerical examples and related specific algorithm examples, we elaborated in detail how to calculate the relevance feature based on the initial screening training annotation cluster of the business data subset and the initial screening training annotation cluster of the historical RPA business data to which the business data subset belongs. This method can accurately evaluate the correlation between the business data subset and the historical RPA business data, providing strong technical support for subsequent anomaly detection, early warning, and decision support.

[0196] In some replaceable embodiments, the algorithm module weights of the initial anomaly detection algorithm are improved based on the relevance features and the detection viewpoint training annotations corresponding to the second historical RPA business data to obtain a target anomaly detection algorithm, including: performing anomaly discrimination processing on the historical RPA business data based on the abnormal state knowledge graph of the historical RPA business data to obtain a first anomaly discrimination viewpoint heat map corresponding to the historical RPA business data; performing anomaly discrimination processing on the business data subset based on the abnormal state knowledge subgraph corresponding to the business data subset to obtain a second anomaly discrimination viewpoint heat map corresponding to the business data subset; based on the first anomaly discrimination viewpoint heat map, the second anomaly discrimination viewpoint heat map, the relevance features and the detection viewpoint training annotations corresponding to the second historical RPA business data, the algorithm module weights of the initial anomaly detection algorithm are improved to obtain a target anomaly detection algorithm.

[0197] Furthermore, based on the first anomaly discrimination opinion heat map, the second anomaly discrimination opinion heat map, the relevance feature and the detection opinion training annotations corresponding to the second historical RPA business data, the algorithm module weights of the initial anomaly detection algorithm are improved to obtain a target anomaly detection algorithm, including: for each historical RPA business data, according to the second anomaly discrimination opinion heat map of each business data subset in the historical RPA business data and the relevance features corresponding to each business data subset, the detection opinion training annotations of the historical RPA business data are proofread to obtain the proofread detection opinion training annotations of the historical RPA business data; based on the first anomaly discrimination opinion heat map corresponding to each historical RPA business data, the proofread detection opinion training annotations of each historical RPA business data are integrated to obtain a target training error; based on the target training error, the algorithm module weights of the initial anomaly detection algorithm are improved to obtain a target anomaly detection algorithm.

[0198] Furthermore, the algorithm module weights of the initial anomaly detection algorithm are improved based on the target training error to obtain a target anomaly detection algorithm, including: calculating the stage discrimination training error of the business data subset based on the second anomaly discrimination viewpoint heat map of the business data subset and the detection viewpoint training annotations of the historical RPA business data to which the business data subset belongs; and improving the algorithm module weights of the initial anomaly detection algorithm based on the target training error and the stage discrimination training error to obtain a target anomaly detection algorithm.

[0199] Furthermore, based on the target training error and the stage discrimination training error, the algorithm module weights of the initial anomaly detection algorithm are improved to obtain a target anomaly detection algorithm, including: comparing and analyzing the second anomaly discrimination viewpoint heat map of the business data subset with the preset heat map to obtain the offset features corresponding to the business data subset; based on the correlation features corresponding to the business data subset, the stage discrimination training error and the offset features are integrated to obtain the offset error of the business data subset; based on the target training error and the offset errors corresponding to each business data subset of the historical RPA business data, the algorithm module weights of the initial anomaly detection algorithm are improved to obtain the target anomaly detection algorithm.

[0200] It can be understood that this embodiment proposes a comprehensive and refined method for improving the algorithm module weights of the initial anomaly detection algorithm based on the correlation feature and the detection viewpoint training annotation corresponding to the second historical RPA business data to obtain the target anomaly detection algorithm. This method not only considers the abnormal state knowledge graph of the historical RPA business data, but also combines the abnormal state knowledge subgraph of the business data subset, and finally optimizes the initial anomaly detection algorithm through a series of complex processing and analysis steps.

[0201] First, in order to deeply understand the abnormal characteristics of historical RPA business data, the detection system performs abnormal discrimination processing on the historical RPA business data based on the abnormal state knowledge graph. The purpose of this step is to generate a first abnormal discrimination viewpoint heat map corresponding to the historical RPA business data. The abnormal state knowledge graph is a graph structure containing various abnormal states and their associations. By parsing and calculating it, the detection system can obtain the specific performance of each historical RPA business data in an abnormal state, and then form a first abnormal discrimination viewpoint heat map. This heat map reflects the overall characteristics of historical RPA business data in an abnormal state, providing an important basis for subsequent analysis and improvement.

[0202] At the same time, in order to understand the performance of the business data subset under abnormal conditions, the detection system performs abnormal discrimination processing on the business data subset based on the abnormal state knowledge subgraph corresponding to the business data subset. This step generates a second abnormal discrimination viewpoint heat map corresponding to the business data subset. The abnormal state knowledge subgraph is a subset of the abnormal state knowledge graph, which contains abnormal states and their associations related to the business data subset. By parsing and calculating the abnormal state knowledge subgraph, the detection system can obtain the specific performance of the business data subset under abnormal conditions, and then form a second abnormal discrimination viewpoint heat map. This heat map reflects the local characteristics of the business data subset under abnormal conditions, providing strong support for subsequent analysis and improvement.

[0203] Next, the detection system improves the algorithm module weights of the initial anomaly detection algorithm based on the first anomaly discrimination viewpoint heat map, the second anomaly discrimination viewpoint heat map, the relevance features, and the detection viewpoint training annotations corresponding to the second historical RPA business data. This step is the core part of the entire technical solution, which involves multiple complex processing and analysis steps.

[0204] First, for each historical RPA business data, the detection system proofreads the detection viewpoint training annotations of the historical RPA business data based on the second abnormality discrimination viewpoint heat map of each business data subset contained therein and the correlation features corresponding to each business data subset. The purpose of this step is to obtain the proofread detection viewpoint training annotations of the historical RPA business data. By comparing the local features of the business data subset in the abnormal state (i.e., the second abnormality discrimination viewpoint heat map) and its correlation with the historical RPA business data (i.e., the correlation features), the detection system can find possible errors or inconsistencies in the detection viewpoint training annotations, and proofread and correct them.

[0205] Then, the detection system integrates the proofread detection viewpoint training annotations of each historical RPA business data based on the first abnormal discrimination viewpoint heat map corresponding to each historical RPA business data. The purpose of this step is to obtain the target training error. By comparing the overall characteristics of the historical RPA business data in an abnormal state (i.e., the first abnormal discrimination viewpoint heat map) and the proofread detection viewpoint training annotations, the detection system can calculate the training error of the initial anomaly detection algorithm on the historical RPA business data. This training error reflects the accuracy and reliability of the initial anomaly detection algorithm in detecting abnormal states, and provides an important basis for subsequent optimization.

[0206] After obtaining the target training error, the detection system improves the algorithm module weights of the initial anomaly detection algorithm based on the error. The purpose of this step is to obtain the target anomaly detection algorithm. By adjusting the algorithm module weights, the detection system can change the sensitivity and specificity of the initial anomaly detection algorithm in detecting abnormal states, so that it can better adapt to the characteristics of historical RPA business data. Specifically, the detection system can increase or decrease the algorithm module weights according to the size and direction of the target training error to reduce the training error and improve the accuracy of the algorithm.

[0207] Furthermore, in the process of improving the algorithm module weights of the initial anomaly detection algorithm based on the target training error, the detection system may also consider the stage discrimination training error of the business data subset. The purpose of this step is to more finely optimize the algorithm module weights of the initial anomaly detection algorithm. First, the detection system calculates the stage discrimination training error of the business data subset based on the second anomaly discrimination viewpoint heat map of the business data subset and the detection viewpoint training annotations of the historical RPA business data to which the business data subset belongs. This error reflects the accuracy and reliability of the initial anomaly detection algorithm in detecting abnormal states of the business data subset. Then, the detection system further improves the algorithm module weights of the initial anomaly detection algorithm based on the target training error and the stage discrimination training error. By comprehensively considering the overall training error and the local stage discrimination training error, the detection system can adjust the algorithm module weights more accurately, so that the target anomaly detection algorithm has higher accuracy and reliability in detecting abnormal states.

[0208] Furthermore, in the process of improving the algorithm module weights of the initial anomaly detection algorithm based on the target training error and the stage discrimination training error, the detection system can also consider the offset characteristics of the business data subset. The purpose of this step is to more comprehensively optimize the algorithm module weights of the initial anomaly detection algorithm. First, the detection system compares and analyzes the second anomaly discrimination viewpoint heat map of the business data subset with the preset heat map. The preset heat map is a standard heat map set based on prior knowledge or experience, which reflects the characteristics that the business data subset should have under normal circumstances. By comparing the second anomaly discrimination viewpoint heat map of the business data subset with the preset heat map, the detection system can obtain the offset characteristics corresponding to the business data subset. This offset characteristic reflects the degree of deviation of the business data subset under abnormal conditions. Then, the detection system integrates the stage discrimination training error and the offset characteristic based on the correlation characteristics corresponding to the business data subset to obtain the offset error of the business data subset. This offset error comprehensively considers the degree of deviation of the business data subset under abnormal conditions and its correlation with historical RPA business data, providing more comprehensive information for subsequent optimization. Finally, the detection system makes a final improvement on the algorithm module weights of the initial anomaly detection algorithm based on the target training error and the offset error corresponding to each business data subset of the historical RPA business data, and obtains the target anomaly detection algorithm. By comprehensively considering the overall training error, the local stage discriminant training error, and the offset error of the business data subset, the detection system can more comprehensively optimize the algorithm module weights of the initial anomaly detection algorithm, so that the target anomaly detection algorithm has higher accuracy and reliability when detecting abnormal states, and can better adapt to various complex business scenarios.

[0209] In summary, the above three progressive embodiments can improve the algorithm module weights of the initial anomaly detection algorithm based on the correlation features and the detection viewpoint training annotations corresponding to the second historical RPA business data to obtain the target anomaly detection algorithm. By introducing multiple concepts and steps such as abnormal state knowledge graph, abnormal discrimination viewpoint heat map, proofreading detection viewpoint training annotations, target training error, stage discrimination training error and offset features, this embodiment realizes the comprehensive optimization and improvement of the initial anomaly detection algorithm, and improves its accuracy and reliability in detecting abnormal states. This method is not only suitable for various complex business scenarios, but also can provide strong technical support for subsequent anomaly detection, early warning and decision support.

[0210] Of course, in order to explain the above embodiments more specifically, some examples may be introduced for further explanation.

[0211] 1) Abnormal state knowledge graph and abnormal discrimination opinion heat map

[0212] Abnormal state knowledge graph:

[0213] Assume that the detection system has an exemplary abnormal state knowledge graph, which contains three abnormal states: ER-A, ER-B and ER-C, and the associations between them. For example, ER-A may lead to ER-B, and ER-B and ER-C may appear at the same time.

[0214] Historical RPA business data:

[0215] The detection system has 10 historical RPA business data samples, each of which contains multiple business data subsets. For simplicity, the detection system assumes that each sample contains only one business data subset, and this subset can be represented by a two-dimensional vector (for example, representing the value of some key indicators).

[0216] Abnormal identification and processing:

[0217] For each historical RPA business data sample, the detection system uses the abnormal state knowledge graph to perform abnormal discrimination processing. Specifically, the detection system can use a rule-based or machine learning classifier to determine whether the sample belongs to a certain abnormal state. The output of the classifier is a probability distribution, which indicates the probability that the sample belongs to each abnormal state.

[0218] Abnormal discrimination view heat map:

[0219] For each historical RPA business data sample, the detection system represents its anomaly discrimination result as a heat map. Each cell of the heat map corresponds to an abnormal state, and the value of the cell represents the probability that the sample belongs to that abnormal state. For example, for sample 1, the heat map may show that the probability of ER-A is 0.1, the probability of ER-B is 0.7, and the probability of ER-C is 0.2.

[0220] 2) Relevance features and detection viewpoint training annotations

[0221] Relevance characteristics:

[0222] For each subset of business data, the detection system calculates its correlation with the historical RPA business data. This can be achieved by calculating the similarity or correlation coefficient between the subset and the overall data. For example, the detection system can use the Pearson correlation coefficient or cosine similarity to measure this correlation.

[0223] Detecting viewpoints training annotations:

[0224] For each historical RPA business data sample, the detection system has a detection viewpoint training annotation, indicating whether the sample contains an anomaly and the type of anomaly. This can be a label vector, where each element corresponds to an anomaly state, a value of 1 indicates that the anomaly is contained, and a value of 0 indicates that it is not contained.

[0225] 3) Improvement of initial anomaly detection algorithm and algorithm module weights

[0226] Initial anomaly detection algorithm:

[0227] The detection system is assumed to have an initial anomaly detection algorithm, which is a neural network-based classifier. The input of the classifier is the feature vector of the business data subset, and the output is the probability distribution of the abnormal state.

[0228] Algorithm module weight improvement:

[0229] First, the detection system improves the algorithm module weights of the initial anomaly detection algorithm based on the first anomaly discrimination viewpoint heat map of historical RPA business data and the second anomaly discrimination viewpoint heat map of a subset of business data, as well as the relevance features and detection viewpoint training annotations.

[0230] Proofreading Process:

[0231] For each historical RPA business data sample, the detection system compares the second abnormality discrimination view heat map of its business data subset with the detection view training annotation. If the abnormal state displayed by the heat map is inconsistent with the annotation, the detection system proofreads the annotation based on the results of the heat map.

[0232] Target training error calculation:

[0233] The detection system calculates the training error of the initial anomaly detection algorithm on the historical RPA business data. This can be achieved by comparing the output of the algorithm (the probability distribution of anomaly states) with the proofread detection viewpoint training annotations. For example, the detection system can use a cross entropy loss function to calculate the training error.

[0234] Stage discriminant training error and offset features:

[0235] For each subset of business data, the detection system calculates its stage discrimination training error. This can be achieved by comparing the subset's second anomaly discrimination view heat map with the detection view training annotations of the historical RPA business data to which it belongs. At the same time, the detection system calculates the offset feature of the subset, that is, the difference between its second anomaly discrimination view heat map and the preset heat map.

[0236] Weight Improvements:

[0237] The detection system improves the algorithm module weights of the initial anomaly detection algorithm based on the target training error, stage discrimination training error, and offset features. Specifically, the detection system can use a gradient descent algorithm to update the weights to minimize the training error. When updating the weights, the detection system can consider the stage discrimination training error and offset features as additional regularization terms to guide the algorithm to better learn the local features and offset features of the business data subset.

[0238] The detection system is assumed to use an exemplary neural network as the initial anomaly detection algorithm. The network includes an input layer, a hidden layer, and an output layer. The input layer receives the feature vector of the business data subset, the hidden layer extracts and transforms the features, and the output layer outputs the probability distribution of the abnormal state.

[0239] When improving the algorithm module weights, the detection system can use the following steps:

[0240] Initialize Weights: Randomly initialize the weights of the neural network.

[0241] Forward propagation: Input the feature vector of the business data subset into the neural network and calculate the output of the output layer.

[0242] Calculate the training error: Use the cross entropy loss function to calculate the difference between the output of the neural network and the proofread training annotations for detecting opinions.

[0243] Backpropagation: Calculate the gradient based on the training error and use the gradient descent algorithm to update the weights of the neural network. When updating the weights, consider the stage-discriminative training error and offset features as additional regularization terms.

[0244] Repeated iterations: Repeat the steps of forward propagation, calculating training error, and backpropagation until the predetermined number of iterations is reached or the training error converges.

[0245] In an independent embodiment, the initial anomaly detection algorithm is used to perform abnormal state knowledge mining processing on the historical RPA business data and each business data subset of the historical RPA business data, respectively, to obtain an abnormal state knowledge graph of the historical RPA business data and an abnormal state knowledge subgraph corresponding to each business data subset, including:

[0246] (1) Obtaining the business interaction information chain of the historical RPA business data on the business terminal side and the platform operation information chain on the business platform side, and obtaining the business interaction information group of each business data subset of the historical RPA business data on the business terminal side and the platform operation information group on the business platform side;

[0247] (2) Integrate the business interaction information chain and the platform operation information chain of the historical RPA business data to obtain a business element chain corresponding to the historical RPA business data; integrate the business interaction information group and the platform operation information group of the business data subset to obtain a business element chain corresponding to the business data subset;

[0248] (3) Using the initial anomaly detection algorithm, local feature enhancement and embedding are performed on the business element chain of the historical RPA business data to obtain an abnormal state knowledge graph of the historical RPA business data;

[0249] (4) Using the initial anomaly detection algorithm, local feature enhancement embedding is performed on the business element chain of the business data subset to obtain an abnormal state knowledge subgraph of the business data subset.

[0250] It can be understood that this embodiment aims to deeply mine the abnormal state knowledge in historical RPA business data and its business data subsets through an efficient anomaly detection algorithm, and then construct a comprehensive abnormal state knowledge graph and corresponding subgraphs. This embodiment not only improves the accuracy of anomaly detection, but also enhances the ability to identify potential abnormal patterns in business data, providing a solid foundation for subsequent anomaly prevention and processing.

[0251] First, in order to fully capture the abnormal characteristics of historical RPA business data, the system needs to obtain information from two key dimensions: the business interaction information chain on the business terminal side and the platform operation information chain on the business platform side. The information chain on the business terminal side contains detailed records of the user's interaction with the RPA system, such as operation sequence, response time, error prompts, etc., which directly reflect the user's behavior characteristics and system response status. The information chain on the business platform side covers various operational data when the RPA system is running in the background, such as task execution logs, resource usage, system error logs, etc., which provide important clues for understanding the internal status of the system and the root cause of the abnormality. Similarly, for each business data subset of the historical RPA business data, it is also necessary to obtain its business interaction information group on the business terminal side and the platform operation information group on the business platform side to ensure the comprehensiveness and meticulousness of the analysis.

[0252] Next, in order to integrate these scattered information, the system will integrate the business interaction information chain and platform operation information chain of historical RPA business data. This process involves steps such as data cleaning, format unification, and timestamp alignment to ensure the accuracy and consistency of information. The result of the integration is a business element chain that contains the key elements of the entire business process. It not only reflects the interaction process between users and the system, but also integrates the operating status of the system background, providing rich contextual information for subsequent anomaly detection. Similarly, for each subset of business data, its business interaction information group and platform operation information group must also be integrated to generate their corresponding business element chains.

[0253] On this basis, using the initial anomaly detection algorithm to conduct in-depth analysis of the integrated business element chain is a key step in building the abnormal state knowledge graph. The initial anomaly detection algorithm plays a vital role here. It not only needs to have strong data processing capabilities, but also needs to be highly sensitive to abnormal patterns. The algorithm embeds local features of the business element chain, that is, it focuses on identifying and analyzing feature fragments that deviate significantly from normal behavior, thereby revealing potential abnormal states. This process involves multiple links such as feature extraction, pattern recognition, and anomaly scoring. Each link needs to be carefully designed to ensure the accuracy and efficiency of anomaly detection. Through the processing of the algorithm, the abnormal state knowledge graph of historical RPA business data is constructed. The graph clearly shows the correlation, frequency of occurrence, and impact of various abnormal states, providing intuitive and powerful support for subsequent abnormal management.

[0254] The process of constructing the abnormal state knowledge subgraph of the business data subset is similar to the above, but it focuses more on the abnormal characteristics within the subset. Since the business data subset is usually segmented data for a specific business process or business scenario, its subgraph may contain more specific and detailed abnormal state information. By embedding the local features of the business element chain of the subset, the system can capture abnormal patterns that may not be easily detected in the global data, thereby further enriching and improving the abnormal state knowledge graph. These subgraphs not only help to deeply understand the abnormal characteristics of each business link, but also provide valuable references for optimizing the RPA system and improving business efficiency.

[0255] It is worth noting that the selection and optimization of the initial anomaly detection algorithm is the key to the success of this technical solution. The algorithm needs to be highly adaptable and learnable, and be able to continuously adjust and optimize its own parameters according to the characteristics of historical data to improve the accuracy and robustness of anomaly detection. In addition, the algorithm should also take into account the dynamics and complexity of business data to ensure that it can maintain effective detection capabilities when faced with new abnormal patterns. To achieve this goal, machine learning-based algorithms such as deep neural networks, support vector machines, random forests, etc. can be used. They can automatically learn the representation of abnormal features by training a large amount of historical data and perform well in practical applications.

[0256] In the process of building abnormal state knowledge graphs and subgraphs, data visualization and interactive design must also be considered. An intuitive and easy-to-use visualization interface can help business personnel quickly understand the distribution, trends, and impacts of abnormal states, so as to make more accurate decisions. At the same time, by providing interactive query and analysis tools, business personnel can easily explore the deep-seated causes of abnormal states, providing strong support for optimizing business processes and improving system stability.

[0257] In this way, through the initial anomaly detection algorithm, the historical RPA business data and its business data subsets are deeply mined for abnormal state knowledge, and a comprehensive abnormal state knowledge graph and corresponding subgraphs are successfully constructed. This embodiment not only improves the accuracy and efficiency of anomaly detection, but also provides business personnel with a wealth of anomaly analysis tools and decision support, laying a solid foundation for the continuous optimization of the RPA system and the improvement of business efficiency.

[0258] In order to enable those skilled in the art to fully and clearly implement the above technical solution, an exemplary introduction can be made based on the Python production environment.

[0259] 1. Data Acquisition and Preprocessing

[0260] First, the detection system needs to obtain historical RPA business data and its subset data from the business terminal and business platform. Here, it is assumed that the data has been stored locally in the form of CSV files.

[0261] Python

[0262] import pandas as pd

[0263] # Read historical RPA business data

[0264] historical_data=pd.read_csv('historical_rpa_data.csv')

[0265] # Set the data set to have an identification column to distinguish different business data subsets

[0266] subset_ids=historical_data['subset_id'].unique()

[0267] subsets={id:historical_data[historical_data['subset_id']==id]for idin subset_ids}

[0268] 2. Data Integration Processing

[0269] Next, the detection system needs to integrate the business interaction information chain and the platform operation information chain into a business element chain. Here, it is assumed that the historical data already contains all the required information, and the detection system only needs to perform an exemplary merging operation.

[0270] Python

[0271] # Set the business interaction information chain and platform operation information chain to be included in historical_data

[0272] # The detection system can create business element chains by selecting specific columns

[0273] business_elements_chain=historical_data[['interaction_info','operation_info']] # Example column name

[0274] # Perform the same processing on the business data subset

[0275] business_elements_subsets

[0276] ={id:subsets[id][['interaction_info','operation_info']]for id insubset_ids}

[0277] 3. Initial Anomaly Detection Algorithm

[0278] In the present invention, the detection system will select isolation forest, LOF or deep learning based model.

[0279] Python

[0280] from sklearn.ensemble import IsolationForest

[0281] # Define an example anomaly detection function

[0282] def detect_anomalies(data,n_estimators=100,contamination=0.1): model=IsolationForest(n_estimators=n_estimators,contamination=contamination)

[0283] data['anomaly_score']=model.fit_predict(data) # -1 indicates anomaly, 1 indicates normal

[0284] return data

[0285] # Perform anomaly detection on historical RPA business data

[0286] anomalies_historical_data=detect_anomalies(business_elements_chain)

[0287] # Perform anomaly detection on a subset of business data

[0288] anomalies_subsets={id:detect_anomalies(business_elements_subsets[id])for id in subset_ids}

[0289] 4. Constructing abnormal state knowledge graph and subgraph

[0290] To build the graph, the detection system can use a network graph library such as networkx.

[0291] Python

[0292] import networkx as nx

[0293] # Build a knowledge graph of abnormal status of historical RPA business data

[0294] G_historical = nx.Graph()

[0295] for index,row in anomalies_historical_data.iterrows():

[0296] if row['anomaly_score']==-1:# Anomaly point

[0297] G_historical.add_node(index,attributes=row.to_dict())

[0298] # Set the detection system to add edges according to certain rules. This is just an example.

[0299] # If the previous row is also an exception, add an edge

[0300] if index>0 and anomalies_historical_data.at[index - 1,'anomaly_score']==-1:

[0301] G_historical.add_edge(index - 1,index)

[0302] # Build the abnormal state knowledge subgraph of the business data subset

[0303] subgraphs={}

[0304] for id,data in anomalies_subsets.items():

[0305] G_subset = nx.Graph()

[0306] for index,row in data.iterrows():

[0307] if row['anomaly_score']==-1:# Anomaly point

[0308] G_subset.add_node(index,attributes=row.to_dict())

[0309] # Similarly, add example rules for edges

[0310] if index>0 and data.at[index - 1,'anomaly_score']==-1:

[0311] G_subset.add_edge(index - 1,index)

[0312] subgraphs[id]=G_subset

[0313] 5. Results display and subsequent processing

[0314] In practical applications, the graph can be visualized and the associations between the anomalies can be further analyzed. In this example, only the number of nodes in the graph is used as an example.

[0315] Python

[0316] print(f"Number of nodes in the knowledge graph of historical RPA business data abnormal status: {len(G_historical.nodes())}")

[0317] for id,G in subgraphs.items():

[0318] print(f"Business data subset {id} Number of nodes in abnormal state knowledge subgraph: {len(G.nodes())}")

[0319] It should be noted that the above code is only an example and needs to be adjusted according to the specific data format and business requirements in actual implementation. The selection of anomaly detection algorithms and parameter tuning are key and need to be experimented and verified based on actual data. More advanced tools and libraries such as Gephi, Plotly, or Graphviz can be used for graph construction and visualization. In a production environment, real-time data processing and the efficiency of anomaly detection need to be considered.

[0320] Further, Figure 2 FIG. 2 is a schematic diagram of a detection system 200 provided by the present invention. Figure 2 The detection system 200 shown includes a processor 210, which can call and run a computer program from a memory to implement the method of the present invention.

[0321] Alternatively, if Figure 2 As shown, the detection system 200 may further include a memory 230. The processor 210 may call and run a computer program from the memory 230 to implement the method of the present invention.

[0322] The memory 230 may be a separate device independent of the processor 210 , or may be integrated into the processor 210 .

[0323] Alternatively, if Figure 2 As shown, the detection system 200 may further include a transceiver 220, and the processor 210 may control the transceiver 220 to interact with other devices, specifically, may send information or data to other devices, or receive information or data sent by other devices.

[0324] Optionally, the detection system 200 may implement the corresponding processes corresponding to the storage engine or components in the storage engine (such as a processing module) or a device deployed with the storage engine in each method of the present invention, which will not be described in detail here for the sake of brevity.

[0325] It should be understood that the processor of the present invention may be an integrated circuit chip having signal processing capabilities.

[0326] It is understood that the memory in the present invention can be a volatile memory or a non-volatile memory, or can include both volatile and non-volatile memory. It should be noted that the memory of the systems and methods described herein is intended to include but is not limited to suitable types of memory.

[0327] Based on the above, a readable storage medium is provided, on which a program or instruction is stored, and the program or instruction implements the steps of the above method when executed by a processor.

[0328] It should be noted that, in this article, the terms "comprise", "include" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the presence of other identical elements in the process, method, article or device including the element. In addition, it should be pointed out that the scope of the method and device in the embodiment of the present invention is not limited to performing functions in the order shown or discussed, and may also include performing functions in a substantially simultaneous manner or in reverse order according to the functions involved, for example, the described method may be performed in an order different from that described, and various steps may also be added, omitted, or combined. In addition, the features described with reference to certain examples may be combined in other examples.

[0329] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present invention, or the part that contributes to the prior art, can be embodied in the form of a computer software product, which is stored in a storage medium (such as ROM / RAM, a magnetic disk, or an optical disk), and includes a number of instructions for enabling a terminal (which can be a mobile phone, a computer, a server, or a network device, etc.) to execute the methods described in each embodiment of the present invention.

[0330] The embodiments of the present invention are described above in conjunction with the accompanying drawings, but the present invention is not limited to the above-mentioned specific implementation methods. The above-mentioned specific implementation methods are merely illustrative and not restrictive. Under the guidance of the present invention, ordinary technicians in this field can also make many forms without departing from the purpose of the present invention and the scope of protection of the present invention, all of which are within the protection of the present invention.

Claims

1. A method for detecting anomaly in RPA business data by integrating an AI model, characterized in that: The method is implemented by a detection system, and the method comprises: In response to an anomaly detection request reported by a target enterprise server, obtaining RPA business data to be processed from a target database that is in communication with the target enterprise server; wherein cross-certification processing has been completed between the detection system, the target enterprise server, and the target database; Inputting the RPA business data to be processed into a target anomaly detection algorithm to obtain an anomaly detection opinion label output by the target anomaly detection algorithm; Using the anomaly detection viewpoint label, the automation process corresponding to the RPA business data to be processed is checked and updated; The debugging steps of the target anomaly detection algorithm include: Obtaining an initial anomaly detection algorithm and a historical RPA business log, wherein the historical RPA business data in the historical RPA business log includes first historical RPA business data and second historical RPA business data, and the first historical RPA business data is configured with its corresponding detection viewpoint training annotation; For each piece of historical RPA business data, discrete binning is performed on the historical RPA business data to obtain multiple business data subsets of the historical RPA business data; By using the initial anomaly detection algorithm, abnormal state knowledge mining is performed on the historical RPA business data and each business data subset of the historical RPA business data to obtain an abnormal state knowledge graph of the historical RPA business data and an abnormal state knowledge subgraph corresponding to each business data subset; According to the detection viewpoint training annotation of the first historical RPA business data, the detection viewpoint is summarized on the abnormal state knowledge graph of each historical RPA business data in the historical RPA business log to obtain the detection viewpoint training annotation corresponding to the second historical RPA business data; For each business data subset of the historical RPA business data, based on the abnormal state knowledge subgraph corresponding to the business data subset and the abnormal state knowledge graph of the historical RPA business data to which the business data subset belongs, calculate the correlation feature between the business data subset and the historical RPA business data to which it belongs; According to the correlation feature and the detection viewpoint training annotation corresponding to the second historical RPA business data, the algorithm module weights of the initial anomaly detection algorithm are improved to obtain the target anomaly detection algorithm.

2. The method according to claim 1, characterized in that The using of the anomaly detection viewpoint label to troubleshoot the automated process corresponding to the RPA business data to be processed includes: Parsing the anomaly detection opinion label to obtain multi-dimensional label attribute features; Obtaining a process description vector corresponding to the automated process; Matching the multi-dimensional label attribute feature with the process description vector to obtain an abnormal process matching vector; The automated process is optimized and adjusted by combining the prior process optimization strategy and the abnormal process matching vector.

3. The method according to claim 1, characterized in that The detection viewpoint training annotation of the first historical RPA business data is used to summarize the abnormal state knowledge graph of each historical RPA business data in the historical RPA business log, and the detection viewpoint training annotation corresponding to the second historical RPA business data is obtained, including: Predetermine the target number of benchmark detection viewpoints, and calculate the commonality evaluation coefficients between the abnormal state knowledge graph of each historical RPA business data in the historical RPA business log and each benchmark detection viewpoint; For each historical RPA business data, according to the commonality evaluation coefficient and the detection viewpoint training annotation of the first historical RPA business data, a target benchmark detection viewpoint matching the historical RPA business data is determined from the various benchmark detection viewpoints, and the historical RPA business data is moved to a data group corresponding to the target benchmark detection viewpoint; For each data group corresponding to each benchmark detection viewpoint, historical RPA business data that meets the requirements of a preset benchmark viewpoint is selected from the data group as a new benchmark detection viewpoint; Jump to the step of calculating the commonality evaluation coefficients of the abnormal state knowledge graph of each historical RPA business data in the historical RPA business log and each benchmark detection viewpoint until the obtained benchmark detection viewpoint meets the inductive termination requirements; based on the detection viewpoint training annotations of the first historical RPA business data in the RPA business data set to be processed corresponding to the benchmark detection viewpoint that meets the inductive termination requirements, determine the detection viewpoint training annotations of the second historical RPA business data in the RPA business data set to be processed.

4. The method according to claim 1, characterized in that: The detection viewpoint training annotation of the first historical RPA business data is used to summarize the abnormal state knowledge graph of each historical RPA business data in the historical RPA business log, and the detection viewpoint training annotation corresponding to the second historical RPA business data is obtained, including: Based on the abnormal state knowledge graph of every two historical RPA business data, determine the historical commonality evaluation coefficient between every two historical RPA business data; Based on the historical commonality evaluation coefficient, a data topology network is generated, where the data topology network represents the involvement between various historical RPA business data; Based on the data topology network, the detection viewpoint training annotations of the first historical RPA business data are walked through to obtain the detection viewpoint training annotations corresponding to the second historical RPA business data.

5. The method according to claim 4, characterized in that The data topology network includes data topology units corresponding to each historical RPA business data, and reference pointers between data topology units, wherein the reference pointers represent reference conditions between two connected data topology units; The step of performing a training annotation walk on the detection viewpoint training annotation of the first historical RPA business data based on the data topology network to obtain the detection viewpoint training annotation corresponding to the second historical RPA business data includes: Performing a training annotation walk on the detection viewpoint training annotation of the first historical RPA business data through the involvement pointers between the data topology units in the data topology network to determine the original detection viewpoint training annotation of the second historical RPA business data; For each second historical RPA business data, based on the neighbor topology unit of the second historical RPA business data in the data topology network, the original detection viewpoint training annotations of the second historical RPA business data are subjected to training annotation cyclic walking proofreading until the training annotations of the data topology unit in the data topology network are in a stable state, thereby obtaining the detection viewpoint training annotations corresponding to the second historical RPA business data.

6. The method according to claim 1, characterized in that For each business data subset of the historical RPA business data, based on the abnormal state knowledge subgraph corresponding to the business data subset and the abnormal state knowledge graph of the historical RPA business data to which the business data subset belongs, calculating the correlation feature between the business data subset and the historical RPA business data to which it belongs, includes: Generate scenario state knowledge vector clusters based on the abnormal state knowledge graph of each historical RPA business data, and generate link state knowledge vector clusters based on the abnormal state knowledge subgraph of the business data subset of each historical RPA business data; For each historical RPA business data, query at least one associated state knowledge graph that matches the abnormal state knowledge graph of the historical RPA business data in the scenario state knowledge vector cluster, and determine the initial screening training annotation cluster of the historical RPA business data based on the detection viewpoint training annotation of the historical RPA business data to which the associated state knowledge graph belongs; For each business data subset of the historical RPA business data, query at least one associated state knowledge subgraph matching the abnormal state knowledge subgraph of the business data subset in the link state knowledge vector cluster, and determine the initial screening training annotation cluster of the business data subset based on the detection viewpoint training annotation of the historical RPA business data to which the associated state knowledge subgraph belongs; Based on the initial screening training annotation cluster of the business data subset and the initial screening training annotation cluster of the historical RPA business data to which the business data subset belongs, the correlation feature between the business data subset and the historical RPA business data to which it belongs is calculated.

7. The method according to claim 6, characterized in that The calculating, based on the preliminary screening training annotation cluster of the business data subset and the preliminary screening training annotation cluster of the historical RPA business data to which the business data subset belongs, the correlation feature between the business data subset and the historical RPA business data to which it belongs includes: Performing thermal feature calculation on the detection viewpoint training annotations in the initial screening training annotation cluster of the business data subset to determine the thermal relationship network of the training annotations of the business data subset; Performing thermal feature calculation on the detection viewpoint training annotations in the initial screening training annotation cluster of the historical RPA business data to which the business data subset belongs, and determining a thermal relationship network of the training annotations of the historical RPA business data to which the business data subset belongs; Based on the training annotation thermal relationship network of the business data subset and the training annotation thermal relationship network of the historical RPA business data to which the business data subset belongs, the correlation characteristics between the business data subset and the historical RPA business data to which it belongs are calculated.

8. The method according to claim 1, characterized in that The method of improving the algorithm module weights of the initial anomaly detection algorithm based on the correlation feature and the detection viewpoint training annotations corresponding to the second historical RPA business data to obtain a target anomaly detection algorithm includes: According to the abnormal state knowledge graph of the historical RPA business data, abnormality discrimination processing is performed on the historical RPA business data to obtain a first abnormality discrimination viewpoint heat map corresponding to the historical RPA business data; According to the abnormal state knowledge subgraph corresponding to the business data subset, the business data subset is subjected to abnormality discrimination processing to obtain a second abnormality discrimination viewpoint heat map corresponding to the business data subset; Based on the first anomaly discrimination viewpoint heat map, the second anomaly discrimination viewpoint heat map, the relevance feature, and the detection viewpoint training annotations corresponding to the second historical RPA business data, the algorithm module weights of the initial anomaly detection algorithm are improved to obtain a target anomaly detection algorithm; The method of improving the algorithm module weights of the initial anomaly detection algorithm based on the first anomaly discrimination viewpoint heat map, the second anomaly discrimination viewpoint heat map, the relevance feature, and the detection viewpoint training annotations corresponding to the second historical RPA business data to obtain a target anomaly detection algorithm includes: For each historical RPA business data, based on the second abnormal discrimination viewpoint heat map of each business data subset in the historical RPA business data and the correlation features corresponding to each business data subset, the detection viewpoint training annotation of the historical RPA business data is proofread to obtain the proofread detection viewpoint training annotation of the historical RPA business data; Based on the first abnormal discrimination viewpoint heat map corresponding to each historical RPA business data, the proofread detection viewpoint training annotations of each historical RPA business data are integrated to obtain the target training error; According to the target training error, the algorithm module weights of the initial anomaly detection algorithm are improved to obtain a target anomaly detection algorithm; The algorithm module weights of the initial anomaly detection algorithm are improved according to the target training error to obtain a target anomaly detection algorithm, including: Calculate the stage discrimination training error of the business data subset according to the second abnormal discrimination viewpoint heat map of the business data subset and the detection viewpoint training annotation of the historical RPA business data to which the business data subset belongs; According to the target training error and the stage discrimination training error, the algorithm module weights of the initial anomaly detection algorithm are improved to obtain a target anomaly detection algorithm; The algorithm module weights of the initial anomaly detection algorithm are improved according to the target training error and the stage discrimination training error to obtain a target anomaly detection algorithm, including: Comparing and analyzing the second abnormal discrimination viewpoint heat map of the business data subset with the preset heat map to obtain the offset feature corresponding to the business data subset; According to the correlation feature corresponding to the service data subset, the stage discrimination training error and the offset feature are integrated to obtain the offset error of the service data subset; Based on the target training error and the offset errors corresponding to each business data subset of the historical RPA business data, the algorithm module weights of the initial anomaly detection algorithm are improved to obtain a target anomaly detection algorithm.

9. A detection system, characterized in that: The method comprises at least one processor and a memory; the memory stores computer-executable instructions; the at least one processor executes the computer-executable instructions stored in the memory, so that the at least one processor executes the method according to any one of claims 1 to 8.

Images