Data processing method and device, computer equipment and storage medium

Abstract

The invention discloses a data processing method and device, computer equipment and a storage medium. The method comprises the steps of determining reference index data corresponding to monitoring index data of a service; extracting associated index data of the reference index data from the generated index data, wherein a time interval between the associated index data and the reference index data meets a preset time interval; weighting the reference index data according to the associated index data to obtain weighted reference index data; and determining a risk identification result of the business according to the monitoring index data and the weighted reference index data. According to the method and the device, the reference index data is properly weighted by using the plurality of associated index data, so that a more accurate exception identification threshold can be generated by integrating the plurality of index data generated by the service; the risk that the identification result is inaccurate due to the fact that the index data is abnormal when the single reference index data is used as the anomaly identification threshold value is avoided, and the anomaly identification accuracy is improved.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a data processing method, apparatus, computer device and storage medium. Background Art

[0002] Identifying and detecting business risks is an effective way to maintain the stable operation of a company's business. The identification of business risks is usually achieved by relying on some business indicators associated with the business, such as customer service indicator data.

[0003] Normally, business indicators usually show a certain periodic variability. Therefore, the identification of relevant business risks is mainly determined by comparing the current business indicators with the business indicators of the same period in history. However, since the business indicators of the same period in history themselves have abnormal risks, using abnormal data for comparison will lead to inaccurate identification results in the relevant business risk identification method. Summary of the invention

[0004] In response to the above technical problems, the embodiments of the present application provide a data processing method, apparatus, computer device and storage medium, which aim to solve the problem of inaccurate identification results in related business risk identification methods.

[0005] In a first aspect, an embodiment of the present application provides a data processing method, the method comprising:

[0006] Determine the reference indicator data corresponding to the monitoring indicator data of the business;

[0007] Extracting associated indicator data of the reference indicator data from the indicator data generated by the business, wherein the time interval between the associated indicator data and the reference indicator data satisfies a preset time interval;

[0008] Weighting the reference indicator data according to the associated indicator data to obtain weighted reference indicator data;

[0009] A risk identification result of the business is determined according to the monitoring indicator data and the weighted reference indicator data.

[0010] In a second aspect, an embodiment of the present application provides a data display method, including:

[0011] Displaying a business analysis page, wherein the business analysis page includes a first area and a second area;

[0012] Displaying monitoring indicator data of the business in the first area;

[0013] The risk identification result of the business is displayed in the second area, and the risk identification result is determined according to the monitoring indicator data and the reference indicator data of the monitoring indicator data.

[0014] In a third aspect, an embodiment of the present application provides a data processing device, the device comprising:

[0015] A determination module, used to determine reference indicator data corresponding to the monitoring indicator data of the business;

[0016] An extraction module, configured to extract associated indicator data of the reference indicator data from the indicator data generated by the business, wherein a time interval between the associated indicator data and the reference indicator data satisfies a preset time interval;

[0017] An adjustment module, configured to weight the reference indicator data according to the associated indicator data to obtain weighted reference indicator data;

[0018] An identification module is used to determine a risk identification result of the business based on the monitoring indicator data and the weighted reference indicator data.

[0019] In a fourth aspect, an embodiment of the present application also provides a computer device, including a memory storing multiple instructions; a processor loads instructions from the memory to execute the steps of any data processing method or data display method provided in the embodiment of the present application.

[0020] In a fifth aspect, an embodiment of the present application also provides a computer-readable storage medium, which stores a plurality of instructions, and the instructions are suitable for a processor to load to execute the steps of any data processing method or data display method provided in the embodiment of the present application.

[0021] In a sixth aspect, an embodiment of the present application further provides a computer program product, including a computer program or instructions, which, when executed by a processor, implements any data processing method or steps in a data processing method provided in an embodiment of the present application.

[0022] Adopting the scheme of the application embodiment, by determining the reference indicator data corresponding to the monitoring indicator data of the business; extracting the associated indicator data of the reference indicator data from the indicator data generated by the business, wherein the time interval between the associated indicator data and the reference indicator data satisfies the preset time interval, the reference indicator data can be appropriately weighted according to the associated indicator data to obtain the weighted reference indicator data, so that the risk identification result of the business can be further accurately determined according to the monitoring indicator data and the weighted reference indicator data. By appropriately weighting the reference indicator data using the associated indicator data whose time interval with the reference indicator data satisfies the preset time interval, it is possible to comprehensively utilize multiple indicator data generated by the business to generate a more accurate threshold value for abnormal identification, avoiding the risk of inaccurate identification results caused by abnormal indicator data when using a single reference indicator data as the threshold for abnormal identification, thereby improving the accuracy of abnormal identification. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For those skilled in the art, other drawings can be obtained based on these drawings without creative work.

[0024] Figure 1 is a schematic diagram of an application environment of the data processing method provided in an embodiment of the present application;

[0025] Figure 2 A schematic diagram of the steps of the data processing method provided in the embodiment of the present application;

[0026] Figure 3 A schematic diagram of a process flow for weighting reference indicator data provided in an embodiment of the present application;

[0027] Figure 4 A schematic diagram of a process flow for determining a risk identification result of a target business based on weighted reference indicator data provided in an embodiment of the present application;

[0028] Figure 5 A schematic diagram of the effect of the indicator data provided in the embodiment of the present application;

[0029] Figure 6 A schematic diagram of a process flow for determining a risk identification result based on multiple monitoring indicator data provided in an embodiment of the present application;

[0030] Figure 7 A flowchart of another step of implementing data processing in a fusion application running state provided in an embodiment of the present application;

[0031] Figure 8 A schematic diagram of a process flow for determining a risk identification result provided in another embodiment of the present application;

[0032] Fig. 9 A schematic diagram of a step flow for displaying risk identification results provided in an embodiment of the present application;

[0033] Fig.10 A schematic diagram of the steps of a data processing display method provided in an embodiment of the present application;

[0034] Fig.11 A schematic diagram of the structure of a data processing device provided in an embodiment of the present application;

[0035] Fig.12 It is a schematic diagram of the internal structure of the computer device provided in the embodiment of the present application. DETAILED DESCRIPTION

[0036] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without making creative work are within the scope of protection of the present application. At the same time, in the description of the embodiments of the present application, the terms "first", "second", etc. are only used to distinguish the descriptions and cannot be understood as indicating or implying relative importance. Thus, the features defined as "first" and "second" may explicitly or implicitly include one or more features. In the description of the embodiments of the present application, the meaning of "multiple" is two or more, unless otherwise clearly and specifically defined.

[0037] In one embodiment of the present application, the data processing method can be run on a local terminal device or a server. When the data processing method is run on a server, the method can be implemented and executed based on a cloud interaction system, wherein the cloud interaction system includes a server and a client device.

[0038] In order to better understand a data processing method, apparatus, computer device and storage medium provided in an embodiment of the present application, an application environment applicable to an embodiment of the present application is first described below.

[0039] See also Figure 1 , Figure 1 FIG. 1 is a schematic diagram showing an application environment of a data processing method provided in an embodiment of the present application. As an implementation mode, the data processing method provided in an embodiment of the present application can be applied to the same computer device. The computer device can be as follows: Figure 1The server 110 shown in the figure can be connected to the terminal device 120 through a network. The network is used to provide a medium for a communication link between the server 110 and the terminal device 120. The network can include various connection types, such as wired communication links, wireless communication links, etc., which are not limited in the embodiments of the present application. Optionally, in other embodiments, the computer device can also be a smart phone, a laptop computer, etc.

[0040] It should be understood that Figure 1 The server 110, network and terminal device 120 are merely illustrative. Depending on the implementation requirements, there may be any number of servers, networks and terminal devices. For example, the server 110 may be a physical server or a server cluster composed of multiple servers, and the terminal device 120 may be a mobile phone, a tablet, a desktop computer, a laptop computer, and the like. It is understood that the embodiments of the present application may also allow multiple terminal devices 120 to access the server 110 at the same time.

[0041] In some embodiments, the terminal device 120 can be a smart phone, a tablet computer, a laptop computer, a desktop computer, a smart watch, an Internet of Things device, a portable wearable device, etc. The terminal device 120 can respond to the user's operation (such as clicking on the session entrance to enter the session page of the intelligent customer service), generate a business trigger request, and transmit it to the server 110 through the network. After receiving the data request sent by different terminal devices 120, the server 110 will return the corresponding data processing result in real time, and record the relevant indicator data in the data processing process. For example, taking the credit business in the financial field as an example, the indicators related to the business include the number of business applications, the time consuming of credit approval, etc. Of course, for other businesses, relevant technical personnel can also determine the relevant indicators based on actual needs. The embodiments of this application will not be repeated here.

[0042] In the data processing scenario, after the server receives the data processing request sent by the terminal device and records the relevant indicator data in the data processing process, considering that the indicator data usually presents a certain periodic variability, the server often compares the indicator data recorded at the current moment with the indicator data of the same period in history to determine whether the business has risks. However, in the actual application process, since the indicator data of the same period in history itself may have abnormal risks, using abnormal indicator data to judge the indicator data at the current moment will lead to inaccurate final identification results. To this end, in the method of the embodiment of the present application, a data processing method is proposed, which can be used in different business risk identification scenarios, in which the reference indicator data corresponding to the monitoring indicator data of the target business is determined; the associated indicator data of the reference indicator data is extracted from the indicator data generated by the target business, wherein the time interval between the associated indicator data and the reference indicator data meets the preset time interval, the reference indicator data can be appropriately weighted according to the associated indicator data to obtain the weighted reference indicator data, thereby reducing the problem of inaccurate risk identification results of the target business due to the use of abnormal reference indicator data, thereby improving the accuracy of business risk identification.

[0043] Among them, the scheme of this application can refer to Figure 2 , Figure 2 A schematic diagram of the steps of the data processing method provided in the embodiment of the present application. The method can be performed by Figure 1 The method is performed by a server or a terminal device, or by a server and a terminal device in collaboration. Figure 1 The server execution in is taken as an example to illustrate, including the following steps:

[0044] Step S210: determining reference indicator data corresponding to the monitoring indicator data of the business.

[0045] In the embodiments of the present application, a business generally refers to a business provided by a company to a user after obtaining relevant licenses. For example, in the financial field, a business may be a credit business, or a multi-level sub-business associated with a credit business, such as a real-name authentication business, a four-factor authentication business, a user risk control identification business, a credit authorization business, a credit approval business, etc. The definition of the business is not repeated in the embodiments of the present application. For ease of description, in one embodiment, the business is described below by taking the credit business as an example.

[0046] Since the business is usually triggered by the user's business request behavior, the monitoring index data of the business can usually be processed by user behavior events. For example, taking the credit business mentioned above as an example, the monitoring index data can include the number of applications for the credit business, the time-consuming credit approval, etc. For other businesses, the monitoring index data can also be other information, such as the real-name authentication success rate under the real-name authentication business, etc. Of course, in the actual process, considering that the change of the monitoring index data is continuous, therefore, in order to reduce the amount of data processing, the monitoring index data can be collected in a specific cycle, for example, the cycle can be one minute, that is, every one minute interval, all the information collected in the current minute is counted to obtain real-time monitoring index data. Of course, using other cycles, of course, based on the actual needs of the business, it is also feasible to use other cycles to collect monitoring index data, for example, every two minutes, every five minutes, every half an hour or every hour, etc., the embodiments of this application are not repeated here.

[0047] Further, after determining the real-time monitoring index data of the business as mentioned above, the reference index data of the monitoring index data can usually be further determined from the historical data of the business. Specifically, in combination with the above-mentioned related instructions, it can be known that, due to the comparison after a long time, the monitoring index data mentioned above usually have a certain periodic change rate. For example, the monitoring index data collected at various times of the day or the monitoring index data collected every day of the week may have a relatively regular periodic change feature. Therefore, as a feasible implementation scheme of the present application, the reference index data corresponding to the monitoring index data can be determined based on the time information. For example, taking the monitoring index data collected at various times of the day as an example, there is a relatively regular periodic change feature. At this time, when the monitoring index data of the business is the monitoring index data collected at two o'clock in the afternoon of the same day, its corresponding reference index data can be the index data collected at two o'clock in the afternoon on a certain day in history, such as yesterday, the day before yesterday or a week ago.

[0048] Of course, it should be noted that since the reference indicator data itself may be abnormal data, when the abnormal data is used as the reference indicator data and directly used to identify abnormalities in the business monitoring indicator data, it will affect the accuracy of the risk identification results for the business. For this reason, in the embodiments of the present application, a correction process for the reference indicator data is further proposed. Please refer to the subsequent figure steps and related instructions for details.

[0049] Step S220: extracting the index data associated with the reference index data from the index data generated by the business.

[0050] In the embodiment of the present application, after the reference indicator data corresponding to the monitoring indicator data is determined, the indicator generated by the business can be further used to extract the associated indicator data with the reference indicator data, wherein the time interval between the associated indicator data and the reference indicator data meets the preset time interval. For example, taking the reference indicator data mentioned above as the indicator data collected at 14:00 the day before yesterday as an example, then at this time, the associated indicator data with the time interval between the reference indicator data and the business generated indicator data can be extracted within the preset time interval, such as 3 minutes, that is, the indicator data between 13:57 and 14:03 can be extracted as the associated indicator data. Taking the indicator data collected in sequence every minute as an example, the associated indicator data finally obtained includes the indicator data at 13:57, 13:58, 13:59, 14:01, 14:02 and 14:03. Of course, the preset time interval here can also be set based on actual needs, that is, the associated indicator data can also include more, for example, it can also include data at 13.56 and 14.04, etc., which will not be repeated in the embodiment of the present application.

[0051] Based on the analysis of the associated indicator data, the possibility of abnormality in the reference indicator data can be determined to a certain extent, which is used for subsequent risk identification of the monitoring indicator data. Please refer to the subsequent steps and related instructions for details.

[0052] Step S230: weighting the reference indicator data according to the associated indicator data to obtain weighted reference indicator data.

[0053] In the embodiments of the present application, in combination with the foregoing related descriptions, it can be seen that due to the analysis of the associated indicator data, the possibility of abnormalities in the reference indicator data can be determined to a certain extent. Therefore, weighting the reference indicator data based on the associated indicator data can reduce the possibility of abnormalities in the reference indicator data, that is, the weighted reference indicator data obtained is usually indicator data corresponding to the monitoring indicator data and has no possibility of abnormalities.

[0054] Specifically, weighting the reference indicator data based on the associated indicator data can generally be implemented based on the statistical results of the associated indicator data. For example, as a feasible embodiment of the present application, please refer to Figure 3 , Figure 3A schematic flow chart of a step of weighting reference indicator data provided in an embodiment of the present application, specifically, in the process, the correlation coefficient between the associated indicator data and the reference indicator data is determined based on the time interval between the associated indicator data and the reference indicator data, and the reference indicator data is weighted based on the weighted weight corresponding to the correlation coefficient to obtain the weighted reference indicator data, specifically, including steps S310 to S320:

[0055] S310: For each of the associated indicator data, determine a correlation coefficient of the associated indicator data according to a time interval between the associated indicator data and the reference indicator data.

[0056] In the embodiment of the present application, since the time interval between the associated indicator data and the reference indicator data satisfies the preset time interval, and the time intervals between different associated indicator data and the reference indicator data are often different, the correlation coefficient of the associated indicator data can be determined for each associated indicator data according to the time interval between the associated indicator data and the reference indicator data. It can be understood that the correlation coefficient of the associated indicator data and the time interval can usually be in an inverse proportional relationship, that is, the longer the time interval between the associated indicator data and the reference indicator data, the lower the correlation coefficient can be set, and the shorter the time interval between the associated indicator data and the reference indicator data, the higher the correlation coefficient can be set.

[0057] S320, weighting the reference indicator data according to the first weighted weights corresponding to the respective correlation coefficients to obtain weighted reference indicator data.

[0058] In an embodiment of the present application, on the basis of determining the correlation coefficient between different associated indicator data and reference indicator data based on the time interval between the associated indicator data and the reference indicator data, the reference indicator data is further weighted based on the first weighted weight corresponding to each correlation coefficient, and the final weighted result can be obtained, which is the weighted reference indicator data.

[0059] By using the time interval between the associated indicator data and the reference indicator data as mentioned above to determine the correlation coefficient of the associated indicator data and using the first weighted weight corresponding to the correlation coefficient to perform weighted processing on the reference indicator data, the anomaly of the reference indicator data can be reduced and the weighted reference indicator data can be made more accurate, thereby improving the subsequent risk identification results for the target business.

[0060] Step S240: determining a risk identification result of the target business according to the monitoring indicator data and the weighted reference indicator data.

[0061] After completing the weighting of the reference indicator data through the associated indicator data mentioned above, the weighted reference indicator data is obtained. Since the weighted reference indicator data has a lower possibility of risk, the risk identification result of the target business can be determined by comparing the monitoring indicator data with the weighted reference indicator data.

[0062] For example, as a common feasible implementation scheme, the monitoring indicator data and the weighted reference indicator data can be compared. When the indicator difference between the monitoring indicator data and the weighted reference indicator data is within the preset difference threshold, that is, the indicator difference between the monitoring indicator data and the weighted reference indicator data is less than a certain difference threshold, then the current monitoring indicator data can be considered to have normal and reasonable fluctuations. At this time, the risk identification result of the business can be determined to be normal and risk-free. Conversely, when the indicator difference between the monitoring indicator data and the weighted reference indicator data exceeds the preset difference threshold, that is, the indicator difference between the monitoring indicator data and the weighted reference indicator data is greater than the difference threshold, then it can be considered that the current monitoring indicator data has obvious abnormal fluctuations relative to the normal indicator data, and the risk identification result of the business can be confirmed to have abnormal risks.

[0063] Of course, in order to further improve the accuracy of using monitoring indicator data and weighted reference indicator data to determine the risk identification results of the business, as another feasible implementation scheme of the present application, the determined reference indicator data may also include multiple, for example, taking the aforementioned monitoring indicator data collected at 2 pm as an example, the corresponding reference indicator data may include multiple monitoring indicator data collected at 2 pm in the historical period, for example, the reference indicator data may include indicator data collected at 2 pm one day ago, indicator data collected at 2 pm three days ago, and indicator data collected at 2 pm seven days ago, etc. Of course, for each reference indicator data, it is also necessary to go through the aforementioned steps, such as extracting the associated indicator data of each reference indicator data, and weighting the reference indicator data based on its corresponding associated indicator data. The specific weighting process will not be repeated here.

[0064] Based on the above, the risk identification results of the business can be further accurately determined based on the monitoring indicator data and multiple weighted reference indicator data. For details, please refer to Figure 4 , Figure 4 A schematic flow chart of a step of determining a risk identification result of a target business based on weighted reference indicator data provided in an embodiment of the present application, specifically, comprising steps S410 to S440:

[0065] S410: For each reference indicator, determine a first feature of a plurality of associated indicator data corresponding to the reference indicator data.

[0066] In the embodiment of the present application, the first feature of the associated indicator data can generally be understood as the data fluctuation feature of multiple associated indicator data, that is, the feature that describes the fluctuation of the associated indicator data over time, wherein there are multiple feasible schemes for calculating the first feature, for example, the associated indicator data can be processed by a trained data sequence processing model to calculate the first feature, and of course, the associated indicator data can be processed by data processing methods such as variance and difference to calculate the first feature of the associated indicator data. Specifically, the first feature can generally exist in the form of a characteristic value, and the higher the characteristic value, the more obvious the fluctuation of the associated indicator data over time, and vice versa, the lower the characteristic value, the weaker the fluctuation of the associated indicator data over time, and the more stable the data. For example, as a feasible implementation scheme, for the following associated index data (0.6, 0.5, 0.55, 0.75, 0.6), the variance can be calculated as 0.007, and the first-order difference calculation result can be (0.1, 0.05, 0.2, 0.15). Then, the mean value and variance of the first-order difference are summed to obtain the first feature 0.132 describing the fluctuation of this group of data. Similarly, for the following associated index data (0.55, 0.45, 0.65, 0.75, 0.6), the variance is 0.01 and the first-order difference result is (0.1, 0.2, 0.1, 0.15), thereby obtaining the first feature 0.1475 describing the fluctuation of this group of data. It can be seen that, compared with the first group of associated index data, the data fluctuation of the second group of associated index data is more obvious, and the higher its first eigenvalue is. Of course, the above only provides a feasible implementation scheme for calculating the first feature that describes data fluctuations. In fact, other implementation schemes that can be used to describe data fluctuations calculated by data statistics are within the scope of protection required by this application. In addition, in the process of calculating the first feature, the normalization idea can be further considered to map the characteristic value to a numerical range of 0 to 1, so as to reduce the impact of the dimension of the data itself on the calculation of the fluctuation feature and improve the accuracy of subsequent anomaly identification.

[0067] S420: Determine an abnormality coefficient corresponding to each reference indicator data according to the first feature.

[0068] In the embodiment of the present application, combined with the foregoing description, it can be understood that the first feature reflects the stability of the associated indicator data within the corresponding period of a certain reference indicator data, and the stability of the associated indicator data within the corresponding period of the reference indicator data can also reflect the possibility of abnormality in the reference indicator data to a certain extent. Therefore, the abnormal coefficient corresponding to each reference indicator data can be determined based on the first feature. For example, if the data fluctuation change of multiple associated indicator data corresponding to a certain reference indicator data is larger, it indicates that the stability of the data in the corresponding period of the reference indicator data is worse, and there is a higher possibility of abnormality. The abnormal coefficient can be set higher. Conversely, if the data fluctuation change of multiple associated indicator data corresponding to a certain reference indicator data is smaller, it indicates that the stability of the data in the corresponding period of the reference indicator data is more stable, and the possibility of abnormality is lower. At this time, the abnormal coefficient can be set smaller.

[0069] S430, weighting each of the weighted reference indicator data according to the second weighted weight corresponding to each of the abnormal coefficients to obtain an indicator monitoring threshold.

[0070] In an embodiment of the present application, after determining the abnormality coefficient corresponding to each reference indicator data through the data change characteristics of the multiple related indicator data corresponding to the reference indicator data, the weighted reference indicator data is further weighted based on the second weighted weight corresponding to the abnormality coefficient to obtain a more accurate indicator monitoring threshold.

[0071] Specifically, the anomaly coefficient and the second weighted weight can usually be in an inversely proportional relationship, that is, the higher the anomaly coefficient, the higher the possibility of abnormal data existing in the period where the reference indicator data is located. At this time, it is necessary to assign a lower weight to the corresponding weighted reference indicator data to avoid the calculated indicator monitoring threshold being inaccurate due to the existence of abnormal data. Conversely, the lower the anomaly coefficient, the lower the possibility of abnormal data existing in the period where the reference indicator data is located. At this time, the corresponding weighted reference indicator data can be assigned a higher weight to ensure that the obtained indicator monitoring threshold can accurately judge the risk identification results of the target business through the monitoring indicators.

[0072] Specifically, the calculation formula of the indicator monitoring threshold S0 is as follows:

[0073]

[0074] Among them, n is the number of reference indicator data, x i is the weighted i-th reference indicator data obtained by weighting the i-th reference indicator data with its corresponding associated indicator data, and k i That is, it is the second weighted weight determined by the data change characteristics of the associated indicator data corresponding to the i-th reference indicator data.

[0075] S440: Determine a risk identification result of the business according to the monitoring indicator data and the indicator monitoring threshold.

[0076] In an embodiment of the present application, after the indicator monitoring threshold is determined by a plurality of weighted reference indicator data, the risk identification result of the business can be determined by comparing the monitoring indicator data with the indicator monitoring threshold. For example, when the indicator monitoring threshold is a single value, if the difference between the monitoring indicator data and the indicator monitoring threshold is within a preset range, the risk identification result of the business can be determined to be normal. Conversely, if the difference between the monitoring indicator data and the indicator monitoring threshold is outside the preset range, the risk identification result of the business can be confirmed to be a risk anomaly. Alternatively, when the indicator monitoring threshold is a plurality of thresholds including supremum and infimum determined based on the 3σ principle, at this time, it can be determined whether the monitoring indicator data is within the range of supremum and infimum. If the monitoring indicator data is within the range of supremum and infimum, the risk identification result of the business can be determined to be normal. Conversely, if the monitoring indicator data is outside the range of supremum and infimum, the risk identification result of the business can be determined to be a risk anomaly. That is, according to the monitoring indicator data and the indicator monitoring threshold, the risk identification result of the business is determined, including:

[0077] If the monitoring indicator data is within the indicator monitoring threshold range, determining that the risk identification result of the business is that there is no abnormal risk;

[0078] If the monitoring indicator data is not within the indicator monitoring threshold range, it is determined that the risk identification result of the business is that there is an abnormal risk.

[0079] Specifically, to clearly understand the differences between the monitoring indicator data, reference indicator data, and associated indicator data provided in the embodiments of the present application, please refer to Figure 5 , Figure 5 The effect diagram of the indicator data provided for the embodiment of the present application is described in detail as follows.

[0080] like Figure 5As shown, the changes in the indicator data in the current cycle, the previous historical cycle, the previous two historical cycles, and the previous three historical cycles are shown, where u1 represents the time of the real-time indicator data of the target business, for example, the aforementioned 14:00, that is, the monitoring indicator data of the target business is the indicator data collected at the current time u1 of the current cycle, and the corresponding reference indicator data is the indicator data collected at the corresponding time u1 of the previous historical cycle, the previous two historical cycles, and the previous three historical cycles, such as the previous day, the previous three days, and the previous seven days. On this basis, for each historical cycle, the associated indicator data whose time interval with the reference indicator data meets the preset time interval can be further extracted from the generated indicator data, for example, u0 represents the previous time whose time interval with the current time u1 is the preset time interval, and u2 represents the subsequent time whose time interval with the current time u1 is the preset time interval, then the associated indicator data corresponding to the reference indicator data in each historical cycle includes the data at the time u0~u2 in the corresponding historical cycle.

[0081] Of course, in order to further improve the accuracy of the risk identification results for the business and avoid errors in the risk identification results for the business due to errors in the collection of a single monitoring indicator data, therefore, as another feasible embodiment of the present application, the collected monitoring indicator data also includes multiple. At this time, in the process of determining the risk identification results of the business based on multiple monitoring indicator data and indicator monitoring thresholds, it is necessary to improve the accuracy of the risk identification results for the business by determining the proportion of abnormal indicator data in the monitoring indicator data. For details, please refer to Figure 6 , Figure 6 A schematic flow chart of a step of determining a risk identification result based on multiple monitoring indicator data provided in an embodiment of the present application, specifically, comprising steps S610 to S620:

[0082] S610: For each monitoring indicator data, if the monitoring indicator data is not within the indicator monitoring threshold range, the monitoring indicator data is determined as abnormal indicator data.

[0083] In an embodiment of the present application, when there are multiple monitoring indicator data, similar to the scheme of comparing a single monitoring indicator data with an indicator monitoring threshold to determine the risk identification result of the business, it is possible to first compare each monitoring indicator data with the indicator monitoring threshold, and determine the monitoring indicator data that is not within the range of the indicator monitoring threshold as abnormal indicator data, wherein the abnormal indicator data indicates that there is an abnormality in the monitoring indicator data.

[0084] S620: If the ratio of the abnormal indicator data to the plurality of monitoring indicator data exceeds a preset ratio threshold, it is determined that the risk identification result of the business is that an abnormal risk exists.

[0085] In the embodiment of the present application, after comparing each monitoring indicator data with the indicator monitoring threshold data and determining the abnormal indicator data that may have abnormal risks in the monitoring indicator data, the risk identification result of the business is determined by further determining whether the ratio of the number of abnormal indicator data and the monitoring indicator data exceeds the preset ratio threshold. For example, when the proportion of abnormal indicator data in the monitoring indicator data is less than the preset ratio threshold, it can be considered that the above abnormal indicator data may be an occasional abnormality caused by an error, and the business may not have an abnormal risk. On the contrary, when the proportion of abnormal indicator data in the monitoring indicator data is less than the preset ratio threshold, that is, when multiple monitoring indicator data are abnormal, it can be considered that the risk identification result of the business is that there is an abnormal risk.

[0086] It should be noted that the solution provided in the embodiment of the present application only makes judgments based on a single business indicator. In fact, when there are multiple related indicator data for a business, the above solution can also be used to determine the risk monitoring threshold of each indicator data, and compare them separately to determine the risk identification results of the business. The embodiment of the present application will not be repeated here.

[0087] Adopting the scheme of the embodiment of the application, by determining the reference indicator data corresponding to the monitoring indicator data of the business; extracting the associated indicator data of the reference indicator data from the indicator data generated by the business, wherein the time interval between the associated indicator data and the reference indicator data satisfies the preset time interval, the reference indicator data can be appropriately weighted according to the associated indicator data to obtain the weighted reference indicator data, so that the risk identification result of the business can be further accurately determined according to the monitoring indicator data and the weighted reference indicator data. By appropriately weighting the reference indicator data using the associated indicator data whose time interval with the reference indicator data satisfies the preset time interval, the indicator data at multiple moments can be comprehensively utilized to generate a more accurate threshold value for abnormal identification, avoiding the risk of inaccurate identification results caused by abnormal indicator data when using a single reference indicator data as the threshold for abnormal identification, thereby improving the accuracy of abnormal identification.

[0088] In addition, it should be noted that the risk identification method for the business provided above only relies on the indicator data of the business, such as the number of applications in the credit business, the time taken for approval, and other indicator data for analysis. In fact, in the actual operation process, the online business is usually implemented by the technical components of the underlying application. Therefore, in addition to analyzing business risks based on indicator data, you can further obtain the operating status information of the target application associated with the business, and combine the operating status information with the business indicator data analysis to determine the risk identification results of the business. For details, please refer to Figure 7 , Figure 7Another flow chart of steps for implementing data processing in a fusion application running state provided in an embodiment of the present application, specifically, includes steps S710 to S730:

[0089] S710: Obtain the running status of the application associated with the service.

[0090] In the embodiments of the present application, the operating status of business-related applications generally refers to the operating status of underlying applications that support business operations, such as middleware, databases, disks and other technical components, for example, qps (Queries-per-second), number of errors, etc. Of course, it can also include operating status such as processor occupancy rate and disk occupancy rate, which will not be repeated in the embodiments of the present application.

[0091] S720: Determine a risk identification result of the application according to the characteristic information of the running status.

[0092] In an embodiment of the present application, since the running state of the application is usually in a stable state compared to the business indicators, the fluctuation characteristics of the running state can be simply used to determine the risk identification result of the application. For example, when the absolute value deviation of the running state from the previous running state is greater than a certain threshold, that is, when the motion state increases or decreases abnormally, it can be considered that the application has a risk abnormality.

[0093] S730: Determine a risk identification result of the business according to the monitoring indicator data, the weighted reference indicator data, and the risk identification result of the application.

[0094] In an embodiment of the present application, after obtaining the risk identification results of the application as mentioned above, the risk of the business in business indicators reflected by the monitoring indicator data and the weighted reference indicator data can be combined to finally determine whether there is a risk identification result for the business. For example, when the risk identification result of the application is abnormal, or when the business indicators reflected by the monitoring indicator data and the weighted reference indicator data are abnormal, it can be considered that the business is abnormal.

[0095] Of course, in the actual application process, the risk identification result of the application may be caused by business indicators, such as an increase in the number of credit requests in the business indicators, which leads to an increase in the operating status. Of course, it may also be due to abnormal underlying applications that cause abnormal business indicators of the user services provided. For example, a disk failure causes a decrease in application service capabilities, thereby affecting the credit approval time. Therefore, as a feasible embodiment of the present application, in the process of finally determining the risk identification result of the business, it will also be determined whether the risk abnormality is caused by the underlying application failure or the abnormal business indicator of the user service. For details, please refer to Figure 8 , Figure 8A flowchart of another step of determining a risk identification result provided in an embodiment of the present application, specifically, includes steps S810 to S830:

[0096] S810: Determine a first risk level of the business based on a risk identification result of the application.

[0097] In an embodiment of the present application, by comparing the running status information of the application with the previous running status and calculating the absolute value deviation, the first risk level of the business can be determined based on the relationship between the absolute value deviation and different level thresholds. For example, the higher the absolute value deviation, the higher the first risk level of the business can be considered.

[0098] S820: Determine a second risk level of the business according to the monitoring indicator data and the weighted reference indicator data.

[0099] In an embodiment of the present application, based on reasons similar to those mentioned above, by comparing the monitoring indicator data with the weighted reference indicator data, the second risk level of the business can be determined based on the relationship between the absolute value deviation of the monitoring indicator data and the weighted reference indicator data and different level thresholds. Similarly, the higher the absolute value deviation here, that is, the greater the difference between the monitoring indicator data and the weighted reference indicator data, the higher the second risk level of the business can be considered.

[0100] S830: Determine a risk identification result of the business according to the first risk level and the second risk level.

[0101] In an embodiment of the present application, after determining the first risk level of the business through the risk identification results of the application, and determining the second risk level of the business through the monitoring indicator data, by comparing the first risk level with the second risk level, it can be determined whether the risk abnormality of the business is caused by the failure of the technical component of the application or by the business indicators of the user service. For example, when the first risk level is higher than the second risk level, it can be considered that it is caused by the failure of the technical component of the application, such as a disk failure resulting in reduced application service capabilities and increased credit business time. When the second risk level is higher than the first risk level, it can be considered that the risk abnormality of the business is caused by the business indicators of the user service, such as an abnormal increase in the number of credit requests.

[0102] In addition, based on the risk anomaly identification method provided above, after identifying the risk identification result of the business, as a feasible embodiment of the present application, in order to facilitate the technical personnel to quickly respond to the risk anomaly and solve it, the relevant information can also be displayed on a preset display device, such as a service screen. For details, please refer to Fig. 9 , Fig. 9A schematic diagram of a step flow for displaying risk identification results provided in an embodiment of the present application, specifically, comprising steps S910 to S920:

[0103] S910: In response to a risk identification result of the business being that an abnormal risk exists, displaying prompt information of the business on a preset display device.

[0104] In an embodiment of the present application, when the risk identification result of a business is that there is an abnormal risk, prompt information of the business will be displayed on a preset display device, such as a preset screen, wherein the preset display device also pre-stores indicator information and application information associated with the business.

[0105] Of course, the prompt information of the service displayed on the preset display device may also be determined based on the abnormal duration and / or abnormal degree of the service, that is, the prompt information of the service is displayed on the preset display device, including:

[0106] Based on the abnormality duration and / or abnormality degree corresponding to the risk identification result, prompt information corresponding to the abnormality duration and / or abnormality degree is displayed on a preset display device.

[0107] Specifically, when the abnormal high duration exceeds a certain time threshold, or the abnormal degree is higher than a certain degree threshold, a more eye-catching red mark can be used for marking and display, or a corresponding voice alarm prompt tone can be output; conversely, when the abnormal duration does not exceed the time threshold, or the abnormal degree does not exceed the degree threshold, a yellow mark can be used for marking; of course, when there is no abnormality in the business, that is, when it is in normal operation, a green mark can also be used for marking.

[0108] S920: In response to a trigger instruction for a service on the preset display device, display indicator information and / or application information identified as abnormal in the target service.

[0109] In an embodiment of the present application, when a technician wants to view the prompt information displayed on a display device, he can trigger a service on a preset display device. At this time, indicator information and / or application information identified as abnormal in the service will be further displayed to facilitate the technician to quickly confirm the cause of the fault.

[0110] Specifically, in order to clearly understand the application of displaying business risk identification information and risk identification information of other businesses or other applications associated with the business through a display device, the following will be explained with visual content. Fig.10 As shown, Fig.10 A schematic diagram of a data display method provided in an embodiment of the present application, specifically, comprising steps S1010 to S1030:

[0111] S1010, displaying a business analysis page, wherein the business analysis page includes a first area and a second area.

[0112] In the embodiment of the present application, the business analysis page is usually set on a business large screen or other display terminal, and can be used to display the risk identification results of a certain business. Specifically, the business analysis page usually includes a first area and a second area.

[0113] S1020, display monitoring indicator data of the target business in the first area.

[0114] In the embodiment of the present application, the monitoring indicator data of the target business will be displayed in real time in the first area of ​​the business analysis page and displayed by scrolling the data.

[0115] S1030: Display a risk identification result of the business in the second area, where the risk identification result is determined based on the monitoring indicator data and reference indicator data of the monitoring indicator data.

[0116] In an embodiment of the present application, in order to enable the risk identification results of the business to be confirmed by the user in the first time, the reference indicator data obtained by using the monitoring indicator data through the steps provided in the aforementioned embodiments is used to determine the risk identification results of the target business, and the risk identification results will be displayed in real time in the second area, for example, whether the business is normal or there are abnormal risks in the business, etc.

[0117] Specifically, for ease of understanding, the following will provide a complete implementation process for business risk identification in combination with specific processes.

[0118] 1. Create a business impact screen.

[0119] 1. Divide the business by domain. Determine the impact scope of different businesses by summarizing and classifying the company's main business. For example, business domains can include credit granting, cash withdrawal, etc., that is, different business domains are divided according to different stages.

[0120] 2. Associate specific businesses under the business domain and establish associations between businesses. Organize the businesses under different business domains. For example, the credit business domain can be further divided into real-name authentication, four-factor authentication, user risk control identification, credit authorization, credit approval and other businesses.

[0121] 3. Core business indicators of associated services. Associate each business with the business indicators for providing user services. For example, associate the real-name authentication business with business indicators such as the number of real-name authentications and the success rate of real-name authentications. The above core business indicators are mainly used to determine the operating status of the business, such as whether there is a fault, by executing the data processing method provided in this application.

[0122] 4. Other indicators related to the business. Other indicators are usually used to assist in verifying whether the risk detection results obtained above are indeed accurate, and can also be used to locate which indicators of a business are abnormal during risk confirmation and emergency response.

[0123] 5. Establish a business chain. In a distributed scenario, there is often mutual dependence between businesses. When a business has a problem, the dependent business will often be affected to a certain extent. Therefore, it is necessary to establish the relationship between businesses from the business layer in advance, and then establish the relationship between applications under a separate business. Then, when a business has a problem, you can use the business chain to observe and confirm the impact of the business on other businesses. For example, you can establish upstream and downstream dependencies for businesses under a single business domain, that is, business A depends on business B, and establish a directed arrow from A to B. A is the upstream of B, and B is the downstream of A. Or for cross-business domain situations, each business with cross-business dependencies needs to be individually marked as a cross-domain business, and a dependency relationship is also established using directed arrows.

[0124] 6. The business screen is divided into blocks according to the business domain. The business under each business domain is displayed in the form of a business chain. For cross-domain business dependencies, they are marked as cross-domain businesses for associated jumps. In addition, the values ​​of core business indicators are displayed synchronously on different businesses. When a business indicator is detected to be abnormal, the indicator is marked with the abnormal color and duration. The indicator color can be marked from dark to light according to the abnormality level, specifically P0 (very serious) corresponds to red, P1 (serious) corresponds to orange, P2 (warning) corresponds to yellow, and so on.

[0125] 2. Establish the relationship between application and business.

[0126] 1. By counting the relationships between the underlying applications that different services depend on, register on the service screen and select one or more services to associate a certain application. Multiple services provided by a single application are associated using dependency directed arrows, and multiple services are divided into a block using the application name.

[0127] 2. By associating business and applications, we can start from the business impact, directly locate the specific application through the business impact, and then locate related abnormal problems in combination with the application.

[0128] 3. Create a Quality of Service dashboard for your application

[0129] 1. From the perspective of business domain division, a large number of applications are divided into business domains. One business domain corresponds to one system, one business corresponds to one subsystem, and one subsystem includes front-end and back-end applications that directly support this business. Applications under each subsystem are displayed in the form of a list.

[0130] 2. Add the core service indicators of the application associated with each subsystem, such as the operating status information of the technical components, etc.

[0131] 3. Alarms related to other indicators of the application. Other indicators are usually used to assist in verifying whether the aforementioned application risk detection results are indeed accurate. In risk confirmation and emergency response, they can also be used to locate which application and which indicator has an abnormality.

[0132] 4. Establish call dependencies between applications. If there is a problem with application indicator detection, it may be that other applications started by the application have abnormalities, which indirectly affects the application itself. You can use APM tools such as pinpoint to automatically connect the upstream and downstream relationships of applications and automatically build the call dependency relationship of applications.

[0133] 5. To find the root cause of business anomalies or application service anomalies, you can associate components and infrastructure layers. When they are abnormal, they can be issued through alarms and transmitted to the affected applications. Alarms are associated layer by layer from bottom to top, and finally reflected on the application's service quality screen. The troubleshooter uses the screen to troubleshoot and locate the problem layer by layer. For example, establish an application-related data model to store information on components such as middleware and databases directly used by the application, and store the host, virtual machine or corresponding container node where the application and the corresponding component are located. In this way, a mapping relationship between an application and the components used by the application and the infrastructure is established. Alarm conditions are established for each component and infrastructure layer such as the host. When an alarm occurs in the infrastructure layer such as the component or host, the corresponding technical object is extracted, and the technical object is used to find the corresponding application through the application-related data model, and then the alarm is reflected in the application's dependency alarm list.

[0134] Through the visualization scheme provided above, it is possible to quickly respond to faults, automatically locate the responded faults, and provide them to technical personnel in a visualized manner, effectively improving the efficiency of technical personnel in solving business faults. Of course, in order to further ensure that technical personnel solve the risks of related business faults, different risk events and corresponding emergency personnel mapping relationships can also be established in advance. For example, the corresponding relationship table can be maintained in cmdb (Configuration Management Database) or metadata configuration center. Emergency personnel can be the person in charge of the application, developers, operation and maintenance personnel, on-duty personnel, etc. In this way, when the corresponding risk event occurs, it can be determined whether to pull up the emergency according to the scope of influence. At this time, people can be accurately pulled according to the mapping relationship of emergency personnel corresponding to the risk event. For example, follow up the notification object of the associated configuration, quickly pull the group for confirmation, and initiate a group video for a quick response. The problem of untimely risk emergency response is solved. In addition, it can be further confirmed whether the risk event is upgraded to an emergency response based on human feedback. And establish process-based operation and maintenance for risk events to facilitate follow-up management of risks. When the risk has no impact, no further action is taken and continuous observation is sufficient; when the risk does exist, the risk handling process is followed up, small risks are created and followed up, and large risks are upgraded to trigger emergency response and follow the emergency handling process. In the emergency handling process, technical support personnel for the components that the application depends on at the bottom layer can be pulled in with one click through the associated personnel of the components associated with the application, solving the problem of difficulty in finding people across teams and departments and the inability to pull together.

[0135] It should be understood that, although each step in the flowcharts involved in the above-mentioned embodiments is displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above-mentioned embodiments can include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0136] Adopting the scheme of the application embodiment, by determining the reference indicator data corresponding to the monitoring indicator data of the business; extracting the associated indicator data of the reference indicator data from the indicator data generated by the business, wherein the time interval between the associated indicator data and the reference indicator data satisfies the preset time interval, the reference indicator data can be appropriately weighted according to the associated indicator data to obtain the weighted reference indicator data, so that the risk identification result of the target business can be further accurately determined based on the monitoring indicator data and the weighted reference indicator data. By appropriately weighting the reference indicator data using the associated indicator data whose time interval with the reference indicator data satisfies the preset time interval, the indicator data at multiple times can be comprehensively utilized to generate a more accurate threshold value for abnormal identification, avoiding the risk of inaccurate identification results caused by abnormal indicator data when using a single reference indicator data as the threshold for abnormal identification, thereby improving the accuracy of abnormal identification.

[0137] Based on the same inventive concept, the embodiment of the present application also provides a data processing device for implementing the data processing method involved above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above method, so the specific limitations in the embodiments of one or more data processing devices provided below can refer to the limitations on the data processing method above, and the specific limitations will not be repeated here.

[0138] This embodiment also provides a data processing device, which can be integrated into a server. Fig.11 As shown, the data processing device may include:

[0139] A determination module 1110 is used to determine reference indicator data corresponding to monitoring indicator data of a business;

[0140] An extraction module 1120 is used to extract the associated indicator data of the reference indicator data from the indicator data generated by the business, and the time interval between the associated indicator data and the reference indicator data meets the preset time interval;

[0141] An adjustment module 1130, configured to weight the reference indicator data according to the associated indicator data to obtain weighted reference indicator data;

[0142] The identification module 1140 is used to determine the risk identification result of the business according to the monitoring indicator data and the weighted reference indicator data.

[0143] In some embodiments, the adjustment module 1130 is also used to determine, for each of the associated indicator data, the correlation coefficient of the associated indicator data according to the time interval between the associated indicator data and the reference indicator data; and weight the reference indicator data according to the first weighted weight corresponding to each of the associated indicator coefficients to obtain the weighted reference indicator data.

[0144] In some embodiments, the identification module 1140 is also used to determine, for each reference indicator, a first feature of multiple related indicator data corresponding to the reference indicator data; determine an abnormality coefficient corresponding to each reference indicator data based on the first feature; weight each weighted reference indicator data according to a second weighted weight corresponding to each abnormality coefficient to obtain an indicator monitoring threshold; determine a risk identification result of the business based on the monitoring indicator data and the indicator monitoring threshold.

[0145] In some embodiments, the identification module 1140 is also used to determine that the risk identification result of the business is that there is no abnormal risk if the monitoring indicator data is within the indicator monitoring threshold range; if the monitoring indicator data is not within the indicator monitoring threshold range, then determine that the risk identification result of the business is that there is an abnormal risk.

[0146] In some embodiments, the identification module 1140 is also used to determine, for each of the monitoring indicator data, the monitoring indicator data as abnormal indicator data if the monitoring indicator data is not within the indicator monitoring threshold range; if the ratio of the abnormal indicator data to the quantity of multiple monitoring indicator data exceeds a preset ratio threshold, then determine that the risk identification result of the business is that there is an abnormal risk.

[0147] In some embodiments, the identification module 1140 is also used to obtain the running status of the application associated with the business; determine the risk identification result of the application based on the characteristic information of the running status; determine the risk identification result of the target business based on the monitoring indicator data, the weighted reference indicator data and the risk identification result of the target application.

[0148] In some embodiments, the identification module 1140 is also used to determine the first risk level of the business based on the risk identification result of the application; determine the second risk level of the business according to the monitoring indicator data and the weighted reference indicator data; and determine the risk identification result of the business according to the first risk level and the second risk level.

[0149] In some embodiments, the business risk identification device also includes a display module, which is also used to display prompt information of the business on a preset display device in response to the risk identification result of the business being an abnormal risk; the preset display device also pre-stores indicator information and application information associated with the business.

[0150] In some embodiments, the display module is further used to display prompt information corresponding to the abnormality duration and / or abnormality degree corresponding to the risk identification result on a preset display device.

[0151] Based on the same inventive concept, the embodiment of the present application also provides a computer device, which may be a server or a terminal device, and includes a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the steps of the above data processing method when executing the computer program. Thereby, various functions are realized, for example:

[0152] Determine the reference indicator data corresponding to the monitoring indicator data of the business;

[0153] Extracting associated indicator data of the reference indicator data from the indicator data generated by the business, wherein the time interval between the associated indicator data and the reference indicator data satisfies a preset time interval;

[0154] Weighting the reference indicator data according to the associated indicator data to obtain weighted reference indicator data;

[0155] A risk identification result of the business is determined according to the monitoring indicator data and the weighted reference indicator data.

[0156] Adopting the scheme of the embodiment of the application, by determining the reference indicator data corresponding to the monitoring indicator data of the business; extracting the associated indicator data of the reference indicator data from the indicator data generated by the business, wherein the time interval between the associated indicator data and the reference indicator data satisfies the preset time interval, the reference indicator data can be appropriately weighted according to the associated indicator data to obtain the weighted reference indicator data, so that the risk identification result of the business can be further accurately determined according to the monitoring indicator data and the weighted reference indicator data. By appropriately weighting the reference indicator data using the associated indicator data whose time interval with the reference indicator data satisfies the preset time interval, the indicator data at multiple moments can be comprehensively utilized to generate a more accurate threshold value for abnormal identification, avoiding the risk of inaccurate identification results caused by abnormal indicator data when using a single reference indicator data as the threshold for abnormal identification, thereby improving the accuracy of abnormal identification.

[0157] The specific implementation of the above operations can be found in the previous embodiments, which will not be described in detail here.

[0158] In one embodiment, the computer device is a terminal device, for example, its internal structure diagram can be as follows: Fig.12 As shown. The computer device includes a processor, a memory, an input / output interface, a communication interface, a display unit and an input device. Among them, the processor, the memory and the input / output interface are connected through a system bus, and the communication interface, the display unit and the input device are connected to the system bus through the input / output interface. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal in a wired or wireless manner, and the wireless manner can be implemented through WIFI, a mobile cellular network, NFC (near field communication) or other technologies. When the computer program is executed by the processor, a data processing method is implemented. The display unit of the computer device is used to form a visually visible image, and can be a display screen, a projection device or a virtual reality imaging device. The display screen can be a liquid crystal display screen or an electronic ink display screen. The input device of the computer device can be a touch layer covered on the display screen, or a button, trackball or touchpad set on the computer device casing, or an external keyboard, touchpad or mouse, etc.

[0159] Those skilled in the art will understand that Fig.12 The structure shown in the figure is only a block diagram of a partial structure related to the present application scheme, and does not constitute a limitation on the computer device to which the present application scheme is applied. The specific computer device may include more or fewer components than shown in the figure, or combine certain components, or have a different component arrangement.

[0160] Based on the same inventive concept, an embodiment of the present application also provides a computer-readable storage medium, which may include: a read-only memory (ROM), a random access memory (RAM), a disk or an optical disk, etc.

[0161] Since the computer program stored in the computer-readable storage medium can execute any data processing method provided in the embodiments of the present application, the beneficial effects that can be achieved by any data processing method provided in the embodiments of the present application can be achieved. Please refer to the previous embodiments for details and will not be repeated here.

[0162] Based on the same inventive concept, the embodiment of the present application further provides a computer program product or a computer program, which includes a computer instruction, and the computer instruction is stored in a computer-readable storage medium. The processor of the computer device reads the computer instruction from the computer-readable storage medium, and the processor executes the computer instruction, so that the computer device executes the method provided in various optional implementations in the above embodiments.

[0163] It should be noted that the object data (including but not limited to user device information, user personal information, etc.) and conversation data involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data need to comply with relevant laws, regulations and standards of relevant countries and regions. A person of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment method can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods.

[0164] Any reference to the memory, database or other media used in the embodiments provided in the present application may include at least one of non-volatile and volatile memory. Non-volatile memory may include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (Re RAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory may include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM may be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM), etc.

[0165] The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. The non-relational database may include a distributed database based on blockchain, etc., but is not limited thereto. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., but is not limited thereto.

[0166] In the above data processing device, computer-readable storage medium, computer equipment, and computer program product embodiments, the description of each embodiment has its own emphasis. For parts not described in detail in a certain embodiment, reference can be made to the relevant description of other embodiments. Those skilled in the art can clearly understand that for the convenience and simplicity of description, the specific working process and beneficial effects of the above-described data processing device, computer-readable storage medium, computer program product, computer equipment, and its corresponding units can refer to the description of the data processing method in the above embodiment, and will not be repeated here.

[0167] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0168] The above is a detailed introduction to a data processing method, device, computer equipment, computer-readable storage medium and computer program product provided in the embodiments of the present application. Specific examples are used in this article to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method of the present application and its core idea; at the same time, for technical personnel in this field, according to the idea of ​​the present application, there will be changes in the specific implementation method and application scope. In summary, the content of this specification should not be understood as a limitation on the present application.

Claims

1. A data processing method, It is characterized in that The method comprises: Determine the reference indicator data corresponding to the monitoring indicator data of the business; Extracting associated indicator data of the reference indicator data from the indicator data generated by the business, wherein the time interval between the associated indicator data and the reference indicator data satisfies a preset time interval; Weighting the reference indicator data according to the associated indicator data to obtain weighted reference indicator data; A risk identification result of the business is determined according to the monitoring indicator data and the weighted reference indicator data.

2. The method according to claim 1, It is characterized in that The associated indicator data includes a plurality of items, and the weighting of the reference indicator data according to the associated indicator data to obtain the weighted reference indicator data includes: For each of the correlation indicator data, determining a correlation coefficient of the correlation indicator data according to a time interval between the correlation indicator data and the reference indicator data; The reference indicator data are weighted according to the first weighted weights corresponding to the respective correlation coefficients to obtain weighted reference indicator data.

3. The method according to claim 2, It is characterized in that The reference indicator data includes a plurality of data, and determining the risk identification result of the business according to the monitoring indicator data and the weighted reference indicator data includes: For each reference indicator, determining a first feature of a plurality of associated indicator data corresponding to the reference indicator data; Determine an abnormality coefficient corresponding to each reference indicator data according to the first feature; Weighting each of the weighted reference indicator data according to the second weighted weight corresponding to each of the abnormal coefficients to obtain an indicator monitoring threshold; A risk identification result of the business is determined based on the monitoring indicator data and the indicator monitoring threshold.

4. The method according to claim 3, It is characterized in that Determining the risk identification result of the business according to the monitoring indicator data and the indicator monitoring threshold includes: If the monitoring indicator data is within the indicator monitoring threshold range, determining that the risk identification result of the business is that there is no abnormal risk; If the monitoring indicator data is not within the indicator monitoring threshold range, it is determined that the risk identification result of the business is that there is an abnormal risk.

5. The method according to claim 3, It is characterized in that The monitoring indicator data includes a plurality of items, and determining the risk identification result of the business according to the monitoring indicator data and the indicator monitoring threshold includes: For each monitoring indicator data, if the monitoring indicator data is not within the indicator monitoring threshold range, the monitoring indicator data is determined as abnormal indicator data; If the ratio of the abnormal indicator data to the plurality of monitoring indicator data exceeds a preset ratio threshold, it is determined that the risk identification result of the business is that there is an abnormal risk.

6. The method according to claim 1, It is characterized in that Before the step of determining the risk identification result of the business according to the monitoring indicator data and the weighted reference indicator data, the method further includes: Obtaining the running status of the application associated with the business; Determining a risk identification result of the application according to the characteristic information of the running status; The determining the risk identification result of the business according to the monitoring indicator data and the weighted reference indicator data includes: Determining a first risk level of the business based on a risk identification result of the application; Determining a second risk level of the business according to the monitoring indicator data and the weighted reference indicator data; A risk identification result of the business is determined according to the first risk level and the second risk level.

7. The method according to any one of claims 1 to 6, It is characterized in that After the step of determining the risk identification result of the business according to the monitoring indicator data and the weighted reference indicator data, the method further includes: In response to the risk identification result of the business being that an abnormal risk exists, prompt information of the business is displayed on a preset display device.

8. The method according to claim 7, It is characterized in that The displaying of the prompt information of the service on a preset display device includes: Based on the abnormality duration and / or abnormality degree corresponding to the risk identification result, prompt information corresponding to the abnormality duration and / or abnormality degree is displayed on a preset display device.

9. A data display method, It is characterized in that include: Displaying a business analysis page, wherein the business analysis page includes a first area and a second area; Displaying monitoring indicator data of the business in the first area; The risk identification result of the business is displayed in the second area, and the risk identification result is determined according to the monitoring indicator data and the reference indicator data of the monitoring indicator data.

10. A data processing device, It is characterized in that The device comprises: A determination module, used to determine reference indicator data corresponding to the monitoring indicator data of the business; An extraction module, used to extract associated indicator data of the reference indicator data from the indicator data generated by the business, wherein the time interval between the associated indicator data and the reference indicator data satisfies a preset time interval; An adjustment module, configured to weight the reference indicator data according to the associated indicator data to obtain weighted reference indicator data; An identification module is used to determine a risk identification result of the business based on the monitoring indicator data and the weighted reference indicator data.

11. A computer device, It is characterized in that It comprises a processor and a memory, wherein the memory stores a plurality of instructions; the processor loads instructions from the memory to execute the steps of the data processing method according to any one of claims 1 to 8 or the steps of the data display method according to claim 9.

12. A computer-readable storage medium, It is characterized in that The computer-readable storage medium stores a plurality of instructions, and the instructions are suitable for being loaded by a processor to execute the steps of the data processing method according to any one of claims 1 to 8 or the steps of the data display method according to claim 9.

Images