Abnormal recognition method and device, computer equipment, readable storage medium and program product

Abstract

The invention relates to the technical field of big data, and discloses an exception recognition method and device, computer equipment, a computer readable storage medium and a computer program product. The method comprises the following steps: acquiring resource flow time sequence data of a target area; determining a target abnormal data analysis mode for the resource flow time series data; determining one or more target recognition models matched with the target abnormal data analysis mode in a pre-constructed abnormal data recognition model group; obtaining an abnormal data recognition result of the target area based on the resource flow time sequence data by using one or more target recognition models; and obtaining an abnormal identification result of the resource flow direction of the target area according to the abnormal data identification result and the resource flow direction service features. According to the invention, the comprehensiveness and accuracy of resource flow direction anomaly identification of the target area can be improved.

Description

Technical Field

[0001] The present application relates to the field of big data technology, and in particular to an anomaly identification method, apparatus, computer equipment, computer-readable storage medium, and computer program product. Background Art

[0002] In order to ensure the security and effectiveness of resource management, it is necessary to identify anomalies in resource transfer business. Big data, machine learning, artificial intelligence and other technical means can be used to identify anomalies in resource flow, conduct anomaly correction assessment, anomaly warning and disposal for relevant institutions, effectively control the risks of abnormal resource flow in each institution, timely discover abnormal resource flow in each institution, and provide resource anomaly information and reference for resource management for business personnel related to resource management.

[0003] Current technology mainly mines abnormal data through statistical analysis of historical data, but the identification dimension is relatively one-sided, and there is a technical problem of low accuracy in identifying resource transfer anomalies. Summary of the invention

[0004] Based on this, it is necessary to provide an abnormality identification method, device, computer equipment, computer readable storage medium and computer program product to address the above technical problems.

[0005] In a first aspect, the present application provides an abnormality identification method, comprising:

[0006] Obtain resource flow time series data in the target area;

[0007] Determine a target abnormal data analysis method for the resource flow time series data;

[0008] Determine one or more target recognition models that match the target abnormal data analysis method in a pre-constructed abnormal data recognition model group;

[0009] Using one or more of the target recognition models, based on the resource flow time series data, obtain an abnormal data recognition result of the target area;

[0010] According to the abnormal data identification result and the resource flow business characteristics, an abnormal identification result of the resource flow in the target area is obtained.

[0011] In one of the embodiments, the use of one or more of the target recognition models to obtain the abnormal data recognition result of the target area based on the resource flow time series data includes: inputting the resource flow time series data into the abnormal data recognition model group to obtain the abnormal data recognition result of the target area; wherein one or more of the target recognition models in the abnormal data recognition model group obtains the identification label of the target area according to the resource flow time series data, and determines and outputs the abnormal data recognition result of the target area based on the identification label.

[0012] In one of the embodiments, the inputting of the resource flow time series data into the abnormal data recognition model group to obtain the abnormal data recognition result of the target area includes: inputting the resource flow time series data into one or more of the target recognition models, and having one or more feature extraction modules of the target recognition models perform feature extraction on the resource flow time series data to obtain and output resource flow data features of the resource flow time series data; and having one or more classification modules of the target recognition models obtain and output the identification label of the target area based on the resource flow data features output by the feature extraction modules, and obtaining the abnormal data recognition result of the target area based on the identification label.

[0013] In one embodiment, the resource flow data feature includes a time feature; the identification label of the target area is obtained and output according to the resource flow data feature output by the feature extraction module, including: obtaining date type information of each of the multiple resource flow data contained in the resource flow time series data according to the time feature of the resource flow time series data; obtaining a data identification label of each of the resource flow data according to the date type information of each of the resource flow data; and obtaining the identification label of the target area according to the data identification label of each of the resource flow data.

[0014] In one of the embodiments, the data identification tag of each resource flow data is obtained according to the date type information of each resource flow data, including: determining the same period comparison period of the resource flow time series data according to the date type information of each resource flow data; obtaining the same period change rate of the resource flow time series data according to the same period comparison period; and obtaining the data identification tag of each resource flow data according to the same period change rate.

[0015] In one of the embodiments, the identification label of the target area is obtained and outputted based on the resource flow data features output by the feature extraction module, including: obtaining a difference time series of the resource flow time series data; obtaining first change trend information of the resource flow time series data based on the difference time series; the first change trend information includes a first trend time length; the first trend time length is less than a first length threshold; and obtaining the identification label of the target area based on the first change trend information.

[0016] In one embodiment, the resource flow time series data includes resource inflow sequence data, net resource inflow sequence data and resource outflow sequence data; the difference time series includes a first difference time series corresponding to the resource inflow sequence data, a second difference time series corresponding to the net resource inflow sequence data and a third difference time series corresponding to the resource outflow sequence data; obtaining the first change trend information of the resource flow time series data according to the difference time series includes: obtaining the first symbol difference sequence corresponding to the resource inflow sequence data, the second symbol difference sequence corresponding to the net resource inflow sequence data and the third symbol difference sequence corresponding to the resource outflow sequence data according to the first difference time series, the second difference time series and the third difference time series respectively; obtaining the first change trend information of the resource flow time series data according to the first symbol difference sequence, the second symbol difference sequence and the third symbol difference sequence.

[0017] In one of the embodiments, obtaining and outputting the identification label of the target area based on the resource flow data features output by the feature extraction module includes: obtaining second change trend information of the resource flow time series data; the second change trend information includes a second trend time length; the second trend time length is greater than a second length threshold; and obtaining the identification label of the target area based on the second change trend information.

[0018] In one of the embodiments, the abnormal data identification result and the resource flow business characteristics are used to obtain the abnormal identification result of the resource flow in the target area, including: determining the abnormal change condition of the resource flow according to the resource flow business characteristics; and obtaining the abnormal identification result according to the abnormal change condition and the abnormal data identification result.

[0019] In one of the embodiments, after obtaining the abnormal identification result of the resource flow of the target area according to the abnormal data identification result and the resource flow business characteristics, it also includes: if the abnormal identification result indicates that there is a resource flow abnormality in the target area, generating alarm information of the target area according to the abnormal identification result; sending the alarm information to the regional contact object of the target area; the alarm information is used to prompt the regional contact object to handle the resource flow abnormality of the target area.

[0020] In one of the embodiments, the target area includes multiple target objects; obtaining the resource flow timing data of the target area includes: obtaining the object weight corresponding to each of the multiple target objects; obtaining the object resource flow timing data of each of the multiple target objects; and obtaining the resource flow timing data of the target area based on the object resource flow timing data and the object weight.

[0021] In a second aspect, the present application also provides an abnormality identification device, comprising:

[0022] The acquisition module is used to obtain the resource flow time series data of the target area;

[0023] A determination module, used to determine a target abnormal data analysis method for the resource flow time series data;

[0024] A screening module, used to determine one or more target recognition models matching the target abnormal data analysis method in a pre-built abnormal data recognition model group;

[0025] A calculation module, configured to obtain an abnormal data recognition result of the target area based on the resource flow time series data by using one or more of the target recognition models;

[0026] The correction module is used to obtain an abnormality identification result of the resource flow in the target area according to the abnormal data identification result and the business characteristics of the resource flow.

[0027] In a third aspect, the present application further provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the following steps are implemented:

[0028] Obtain resource flow time series data of a target area; determine a target abnormal data analysis method for the resource flow time series data; determine one or more target recognition models that match the target abnormal data analysis method in a pre-built abnormal data recognition model group; obtain abnormal data recognition results of the target area based on the resource flow time series data using one or more of the target recognition models; and obtain abnormal data recognition results of the resource flow of the target area according to the abnormal data recognition results and the business characteristics of the resource flow.

[0029] In a fourth aspect, the present application further provides a computer-readable storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, the following steps are implemented:

[0030] Obtain resource flow time series data of a target area; determine a target abnormal data analysis method for the resource flow time series data; determine one or more target recognition models that match the target abnormal data analysis method in a pre-built abnormal data recognition model group; obtain abnormal data recognition results of the target area based on the resource flow time series data using one or more of the target recognition models; and obtain abnormal data recognition results of the resource flow of the target area according to the abnormal data recognition results and the business characteristics of the resource flow.

[0031] In a fifth aspect, the present application further provides a computer program product, including a computer program, which implements the following steps when executed by a processor:

[0032] Obtain resource flow time series data of a target area; determine a target abnormal data analysis method for the resource flow time series data; determine one or more target recognition models that match the target abnormal data analysis method in a pre-built abnormal data recognition model group; obtain abnormal data recognition results of the target area based on the resource flow time series data using one or more of the target recognition models; and obtain abnormal data recognition results of the resource flow of the target area according to the abnormal data recognition results and the business characteristics of the resource flow.

[0033] The above-mentioned anomaly identification method, apparatus, computer equipment, computer-readable storage medium and computer program product can first obtain the resource flow time series data of the target area, then determine the target abnormal data analysis method for the resource flow time series data, determine one or more target identification models that match the target abnormal data analysis method in the pre-built abnormal data identification model group, and then use one or more target identification models to obtain the abnormal data identification result of the target area based on the resource flow time series data, and obtain the abnormal data identification result of the resource flow in the target area according to the abnormal data identification result and the resource flow business characteristics. In the present application, on the one hand, an abnormal data identification result of the target area is obtained by using an abnormal data identification model group. The abnormal data identification model group may include multiple abnormal data identification models. The multiple abnormal data identification models can realize the use of multiple abnormal data analysis methods to obtain the abnormal data identification result of the target area, which can improve the accuracy of the abnormal identification of resource flow data in the target area. On the other hand, the abnormal data identification result output by the abnormal data identification model group is verified and corrected according to the business characteristics of the resource flow, and finally the abnormal identification result of the resource flow in the target area is obtained. In this way, the dual abnormal identification at the data and business levels can be fully combined to improve the comprehensiveness and accuracy of the abnormal identification of resource flow in the target area. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] In order to more clearly illustrate the technical solutions in the embodiments of the present application or related technologies, the drawings required for use in the embodiments of the present application or related technical descriptions will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0035] FIG1 is a schematic diagram of a flow chart of an abnormality identification method in one embodiment;

[0036] FIG2 is a schematic flow chart of a step of obtaining an identification tag of a target area using a first target recognition model in one embodiment;

[0037] FIG3 is a schematic flow chart of a step of obtaining an identification label of a target area using a second target recognition model in one embodiment;

[0038] FIG4 is a schematic diagram of a flow chart of a step of obtaining first change trend information in one embodiment;

[0039] FIG5 is a schematic flow chart of a step of obtaining an identification label of a target area using a third target recognition model in one embodiment;

[0040] FIG6 is a flow chart of a process for performing service verification steps using resource flow service characteristics in one embodiment;

[0041] FIG7 is a schematic diagram of a process of resource flow abnormality alarming step in one embodiment;

[0042] FIG8 is a schematic flow chart of the steps of obtaining resource flow time series data of a target area in one embodiment;

[0043] FIG9 is a block diagram of an abnormality identification device in one embodiment;

[0044] FIG. 10 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0045] In order to make the purpose, technical solutions and advantages of the present application clearer, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application. It should be noted that in the embodiments of the present application, certain software, groups, models and other existing solutions in the industry may be mentioned, which should be considered as exemplary, and their purpose is only to illustrate the feasibility of the implementation of the technical solution of the present application, but it does not mean that the applicant has or will necessarily use the solution.

[0046] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant regulations. The acquisition, storage, use, and processing of data in the technical solution of this application are in compliance with relevant provisions of national laws and regulations.

[0047] As shown in FIG1 , an abnormality identification method is provided. This embodiment uses the method applied to a server as an example for illustration. It is understandable that the method can also be applied to a terminal, and can also be applied to a system including a terminal and a server, and is implemented through the interaction between the terminal and the server. In this embodiment, the method includes the following steps:

[0048] Step 102: Obtain resource flow time series data of the target area.

[0049] Among them, the target area can be a geographical grid of a resource management object. The target area can include multiple resource management objects, such as outlets and institutions, etc., and the resource management objects can also be called target objects. In a possible implementation, the object weight of each resource management object in the multiple resource management objects can be obtained according to the object characteristics of each resource management object in the multiple resource management objects, such as geographical location characteristics and scale characteristics, etc., and the object weight can be used to indicate the importance of the corresponding resource management object to the abnormal identification of the resource flow direction of the target area. Based on this, the object resource flow time series data of each resource management object in the multiple resource management objects can be obtained, and then, the resource flow time series data of the target area can be obtained according to the object weight of each resource management object in the multiple resource management objects and the object resource flow time series data. The resource flow time series data may include multiple resource flow data, wherein a data identifier of each resource flow data in the multiple resource flow data may be generated, and the corresponding resource flow data may be marked using the data identifier, and the data identifier may include but is not limited to the object identifier, time identifier and flow identifier of the corresponding resource flow data, etc. The object identifier may be used to indicate the resource management object to which the corresponding resource flow data belongs; the time identifier may be used to indicate the resource transfer time of the corresponding resource flow data; the flow identifier may be used to indicate the flow attribute of the corresponding resource flow data, such as resource inflow and resource outflow. The resource flow time series data may include resource inflow time series data, net resource inflow time series data and resource outflow time series data. In a possible implementation, the corresponding resource inflow time series data, net resource inflow time series data and resource outflow time series data may be generated according to the resource flow time series data. The resource inflow time series data may be the resource value flowing into the corresponding resource management object; the resource outflow time series data may be the resource value flowing out of the corresponding resource management object; the corresponding net resource inflow time series data may be determined based on the difference between the resource inflow time series data and the resource outflow time series data.

[0050] Step 104: determine a target abnormal data analysis method for resource flow time series data.

[0051] In this step, a pre-built abnormal data identification model group can be used to obtain an abnormal data identification result of the target area according to the resource flow time series data of the target area. The abnormal data identification result can be used to indicate whether there is an abnormality in the resource flow data of the target area. The abnormal data identification model group can include multiple abnormal data identification models, each of which can adopt a different abnormal data identification method to obtain the abnormal data identification result of the target area. The abnormal data identification method corresponds to the abnormal data analysis method, and further, the abnormal data identification model corresponds to the abnormal data analysis method. In a possible implementation, an abnormality analyst may set a target abnormality data analysis method for the resource flow time series data of the target area, and take the first abnormality data analysis method, the second abnormality data analysis method and the third abnormality data analysis method as examples for explanation, wherein the first abnormality data analysis method may be based on the fluctuation information of the resource flow time series data to judge the resource flow abnormality of the resource flow time series data; the second abnormal data analysis method may be based on the first change trend information of the resource flow time series data to judge the resource flow abnormality of the resource flow time series data; the third abnormal data analysis method may be based on the second change trend information of the resource flow time series data to judge the resource flow abnormality of the resource flow time series data. The target abnormality data analysis method may include one or more of the first abnormal data analysis method, the second abnormal data analysis method and the third abnormal data analysis method. Correspondingly, the multiple abnormal data recognition models may include the first abnormal data recognition model, the second abnormal data recognition model and the third abnormal data recognition model. The first abnormal data identification model may correspond to the first abnormal data analysis method; the second abnormal data identification model may correspond to the second abnormal data analysis method; and the third abnormal data identification model may correspond to the third abnormal data analysis method. For example, if the target abnormal data analysis method for the resource flow time series data of the target area set by the abnormality analyst is the first abnormal data analysis method, then the first abnormal data identification model is used to obtain the abnormal data identification result of the target area based on the resource flow time series data; if the target abnormal data analysis method for the resource flow time series data of the target area set by the abnormality analyst is the first abnormal data analysis method and the second abnormal data analysis method, then the first abnormal data identification model and the second abnormal data identification model are used to obtain the abnormal data identification result of the target area based on the resource flow time series data.

[0052] Step 106: Determine one or more target recognition models that match the target abnormal data analysis method in the pre-built abnormal data recognition model group.

[0053] In this step, there is a corresponding relationship between the abnormal data recognition model and the abnormal data analysis method. The abnormal data recognition model that matches the target abnormal data analysis method can be determined from the multiple abnormal data recognition models included in the abnormal data recognition model group. The abnormal data recognition model that matches the target abnormal data analysis method can be called a target recognition model. The number of the target recognition models can be one or more, and the number of the target recognition models is consistent with the number of abnormal data analysis methods included in the target abnormal data analysis method. The one or more target recognition models are abnormal data recognition models that obtain the abnormal data recognition results of the target area based on the resource flow time series data of the target area.

[0054] Step 108, using one or more target recognition models, based on the resource flow time series data, obtain the abnormal data recognition results of the target area.

[0055] Among them, the target recognition model can adopt the corresponding target abnormal data analysis method to obtain the abnormal data recognition result of the target area based on the resource flow time series data. The resource flow time series data of the target area and the method identifier of the target abnormal data analysis method can be input into the abnormal data recognition model group. The abnormal data recognition model group can determine one or more target recognition models that match the target abnormal data analysis method according to the method identifier of the target abnormal data analysis method. Then, one or more target recognition models in the abnormal data recognition model group obtain the identification label of the target area according to the resource flow time series data, and determine and output the abnormal data recognition result of the target area based on the identification label. The abnormal data recognition result may include one or more abnormal data recognition sub-results, and there is a corresponding relationship between the abnormal data recognition sub-result and the target recognition model. An abnormal data recognition sub-result for the target area can be obtained through each of the one or more target recognition models.

[0056] Step 110, obtaining an abnormality identification result of the resource flow in the target area according to the abnormal data identification result and the resource flow business characteristics.

[0057] In this step, the business characteristics of resource flow can be used to set abnormal change conditions at the business level for the target area, and then the abnormal data identification result of the target area can be verified based on the abnormal change conditions to obtain a verification result of the abnormal data identification result. The abnormal data identification result is an identification result of the data aspect of the resource flow time series data of the target area. The abnormal change conditions are used to verify the abnormal data identification result of the target area to obtain a verification result of the abnormal data identification result. The abnormal resource flow of the target area can be identified at the business level. The abnormal change conditions can be set based on the business characteristics of the resource flow of the target area, and the resource flow business characteristics can be the business characteristics of the resource flow of the target area. For example, for net resource inflow business: if the current net inflow is negative and the net inflow of the previous period is positive, that is, the net inflow turns from positive to negative, it is an abnormality that requires special attention; when the net inflow increases compared with the previous period, it is not defined as an abnormality; when the net inflow decreases compared with the previous period, the degree of the abnormality is determined according to the degree of decrease; for resource inflow business: when the inflow increases compared with the previous period, it is not considered a business abnormality, and when the inflow decreases compared with the previous period, the degree of the abnormality is determined according to the degree of decrease; for resource outflow business: when the outflow decreases compared with the previous period, it is not considered a business abnormality, and when the outflow increases compared with the previous period, the degree of the abnormality is determined according to the degree of increase.

[0058] In the method of this embodiment, first, the resource flow time series data of the target area can be obtained, and then the target abnormal data analysis method for the resource flow time series data can be determined, and one or more target recognition models that match the target abnormal data analysis method can be determined in the pre-constructed abnormal data recognition model group, and then the abnormal data recognition result of the target area can be obtained based on the resource flow time series data by using one or more target recognition models, and the abnormal data recognition result of the resource flow in the target area can be obtained according to the abnormal data recognition result and the resource flow business characteristics. In this application, on the one hand, the abnormal data recognition result of the target area is obtained by using the abnormal data recognition model group, and the abnormal data recognition model group can include multiple abnormal data recognition models. The multiple abnormal data recognition models can realize the use of multiple abnormal data analysis methods to obtain the abnormal data recognition results of the target area, which can improve the accuracy of the abnormal recognition of the resource flow data in the target area. On the other hand, the abnormal data recognition results output by the abnormal data recognition model group are verified and corrected according to the abnormal change conditions, and finally the abnormal recognition results of the resource flow in the target area are obtained, thereby fully combining the dual abnormal recognition at the data and business levels to improve the comprehensiveness and accuracy of the abnormal recognition of the resource flow in the target area.

[0059] In an exemplary embodiment, step 108 may include:

[0060] The resource flow time series data is input into the abnormal data identification model group to obtain the abnormal data identification result of the target area; wherein, one or more target identification models in the abnormal data identification model group obtain the identification label of the target area according to the resource flow time series data, and determine and output the abnormal data identification result of the target area based on the identification label.

[0061] Among them, the abnormal data identification model group may include multiple abnormal data identification models, each of the multiple abnormal data identification models may adopt a different abnormal data identification method to obtain the abnormal data identification result of the target area, and the abnormal data identification method has a corresponding relationship with the abnormal data analysis method, and then the abnormal data identification model has a corresponding relationship with the abnormal data analysis method. In a possible implementation, the abnormal analysis personnel may set a target abnormal data analysis method for the resource flow time series data of the target area, and then, according to the corresponding relationship between the abnormal data analysis method and the abnormal data identification model, one or more target identification models matching the target abnormal data analysis method may be determined, and then, in the process of obtaining the abnormal data identification result of the target area, the resource flow time series data of the target area and the model identifier of the target identification model may be input into the abnormal data identification model group, and the abnormal data identification model group may determine one or more target identification models matching the target abnormal data analysis method according to the model identifier, and then, one or more target identification models in the abnormal data identification model group obtain the identification label of the target area according to the resource flow time series data, and determine and output the abnormal data identification result of the target area based on the identification label. In another possible implementation, the resource flow time series data of the target area and the method identifier of the target abnormal data analysis method can be input into the abnormal data recognition model group, and the abnormal data recognition model group can determine one or more target recognition models that match the target abnormal data analysis method according to the method identifier of the target abnormal data analysis method, and then, one or more target recognition models in the abnormal data recognition model group obtain the identification label of the target area according to the resource flow time series data, and determine and output the abnormal data recognition result of the target area based on the identification label. Among them, the abnormal data recognition result can include one or more abnormal data recognition sub-results, and there is a corresponding relationship between the abnormal data recognition sub-result and the target recognition model, and an abnormal data recognition sub-result for the target area can be obtained through each of the one or more target recognition models.

[0062] In an exemplary embodiment, the above steps of inputting resource flow time series data into the abnormal data identification model group to obtain abnormal data identification results of the target area may include:

[0063] The resource flow time series data is input into one or more target recognition models, and the feature extraction modules of the one or more target recognition models perform feature extraction on the resource flow time series data to obtain and output resource flow data features of the resource flow time series data; the classification modules of the one or more target recognition models obtain and output identification labels of the target areas according to the resource flow data features output by the feature extraction modules, and obtain abnormal data identification results of the target areas based on the identification labels.

[0064] In this exemplary embodiment, each of the one or more target recognition models may include a feature extraction module and a classification module.

[0065] The feature extraction module may include at least one convolution layer and at least one pooling layer, wherein the convolution layer is used to extract features of input data; and the pooling layer is used to sample the input data. Both the convolution layer and the pooling layer include an activation function. In an embodiment of the present application, the resource flow time series data may include multiple time series data.

[0066] Specifically, the convolution layer can be used to extract the initial features of multiple time series data. The first step is to convert multiple time series data into vectors to obtain multiple time series data vectors, which can be combined into a time series data vector matrix; the second step is to input the time series data vector matrix into the convolution layer, and use the convolution kernel to perform convolution operation with the time series data vector matrix, that is, to perform inner product operation on the time series data vector matrix and the convolution kernel to obtain the convolution result corresponding to the time series data vector matrix; next, the convolution result is nonlinearly transformed based on the activation function, and the bias vector is added to obtain the initial feature vector; the third step is to input the initial feature vector into the pooling layer, and the initial feature vector can be sampled; then, the feature sampling result is nonlinearly transformed based on the activation function, and the bias vector is added to obtain the resource flow data feature.

[0067] The resource flow data features may include but are not limited to the following three types of features: The first type is numerical statistical features, for example, the mean and percentile values ​​of the capital flows of each target object in the target area within a preset time period. The second type is the geographic grid features of the target area, for example, the business district where the grid is located, the number of outlets in the grid, etc. The third type is time features, for example, the time when the capital flow occurs.

[0068] The classification module may include at least one fully connected layer, which may classify the resource flow data features to obtain abnormal data identification results of the target area. In addition, the fully connected layer may include an activation function, which includes a weight matrix and a bias constant.

[0069] Specifically, the server can input the resource flow data features into the fully connected layer, perform nonlinear transformation on the resource flow data features based on the weight matrix and bias vector of the activation function, and then obtain the abnormal data identification results of the target area through normalization.

[0070] In the method of this embodiment, an abnormal data identification model group can be used to obtain the abnormal data identification results of the target area. The abnormal data identification model group can include multiple abnormal data identification models. The multiple abnormal data identification models can use multiple abnormal data analysis methods to obtain the abnormal data identification results of the target area, which can improve the accuracy of identifying abnormalities in resource flow data in the target area.

[0071] In an exemplary embodiment, as shown in FIG2 , the resource flow data feature includes a time feature; the one or more target recognition models include a first target recognition model; the first target recognition model may be based on fluctuation abnormal data recognition; the above steps may include steps 202 to 206 to obtain and output the identification label of the target area based on the resource flow data feature output by the feature extraction module. Among them:

[0072] Step 202: acquiring date type information of each resource flow data in a plurality of resource flow data included in the resource flow time series data according to the time characteristics of the resource flow time series data.

[0073] Among them, the time feature of each resource flow data in the multiple resource flow data can be obtained by using the feature extraction module in the target recognition model, and the time feature can be used to represent the resource flow time corresponding to the corresponding resource flow data. Taking the current resource management object (for example, outlets and institutions) in the target area as an example, the object resource flow time series data of the current resource management object can include multiple sub-time series data, namely object resource inflow time series data, object net resource inflow time series data and resource outflow time series data. The object resource inflow time series data can be the resource value flowing into the corresponding resource management object; the object resource outflow time series data can be the resource value flowing out of the corresponding resource management object; the corresponding object net resource inflow time series data can be determined according to the difference between the resource inflow time series data and the resource outflow time series data. Each of the multiple sub-time series data contained in the current resource management object may include multiple resource flow data. The time characteristics of each resource flow data may represent the resource flow time corresponding to the corresponding resource flow data. Furthermore, the date type information of each resource flow data may be determined based on the resource flow time corresponding to each resource flow data. The date type information may be used to represent the time attribute of the resource transfer time of each resource flow data, such as holidays, weekends, and weekdays.

[0074] Step 204: acquiring a data identification tag of each resource flow data according to the date type information of each resource flow data.

[0075] Among them, the date type of the resource transfer time of each resource flow data may include multiple date types, including but not limited to holidays, weekends and working days. Resource flow data of different date types have different data distribution patterns, which can also be understood as different change rules of resource flow data of different date types. For example, for holidays, such as holiday A, the current resource management object can set a resource flow implementation plan, which can be used to promote resource owners to perform resource flow operations, which can cause the resource flow data of the current resource management object on the corresponding holidays to have significant changes. For example, during holidays, the resource inflow data of the current resource management object increases and the resource outflow data decreases. In some possible implementations, the acquisition of the data identification tag of the current resource management object may include: determining the same period comparison period of the resource flow time series data according to the date type information of each resource flow data; obtaining the same period change rate of the resource flow time series data according to the same period comparison period; and obtaining the data identification tag of each resource flow data according to the same period change rate. Among them, different same period comparison periods can be set for resource flows of different date types, and the same period comparison period can be the time interval for obtaining the period value. For example, for holidays, the corresponding period comparison cycle can be set to one year, and the impact of the length of holidays and the inconsistency of the number of days in two years on the data needs to be considered. For weekdays and weekends, the corresponding period comparison cycle can be set to one week, that is, the value of the previous cycle is taken as the period value. When the date type of the current cycle is a holiday, the value of the previous two cycles is taken as the period value. Further, the period values ​​of different resource flow data can be obtained according to the set period comparison cycle. Taking holiday A as an example, the period comparison cycle of holiday A can be set to one year. Holiday A can include multiple days. The holiday resource flow data of holiday A in the current cycle can be obtained. The holiday resource flow data can include resource flow data of multiple days. The current value of holiday A in the current cycle can be determined according to the holiday resource flow data, for example, the mean or median value of the holiday resource flow data. Similarly, the holiday resource flow data of holiday A in the previous cycle can be used to determine the same period value of holiday A in the previous cycle.In this way, multiple contemporaneous values ​​of holiday A can be determined, and based on the multiple contemporaneous values, the contemporaneous change rate of each object resource flow data in the object resource flow time series data can be obtained. Taking the current resource flow data as an example, the contemporaneous comparison period of the current resource flow data is determined according to the date type of the current resource flow data. The current resource flow data may include multiple consecutive resource flow data of the same period. For example, if the number of days of the holiday is five, the current resource flow data includes the resource flow data of the five-day holiday; next, the current value and multiple contemporaneous values ​​associated with the current resource flow data can be determined according to the contemporaneous comparison period, and then, the contemporaneous change rate associated with the current resource flow data can be obtained according to the current value and multiple contemporaneous values, and the current resource flow data whose contemporaneous change rate exceeds the change rate threshold is judged as abnormal resource flow data, that is, the data identification label of the current resource flow data is abnormal.

[0076] Step 206: Obtain an identification tag of the target area according to the data identification tags of the resource flow data.

[0077] Among them, the data identification tag can indicate whether each resource flow data in the resource flow time series data in the current resource management object has a resource flow anomaly. The identification tag is whether the resource management object of the target area has a resource flow anomaly. If the data identification tag of the resource flow time series data of the resource management object shows that the resource flow time series data has a resource flow anomaly, it indicates that the resource management object of the target area has a resource flow anomaly, that is, the identification tag of the target area is a resource flow anomaly; if the data identification tag of the resource flow time series data of the resource management object shows that the resource flow time series data is normal, it indicates that the resource flow of the resource management object is normal, and the identification tag of the resource management object is normal. If the identification tags of all resource management objects in the target area are that the resource flow is normal, then the identification tag of the target area is normal.

[0078] In the method of this embodiment, the abnormal data identification result of the target area can be obtained based on the fluctuation information of the resource flow time series data. By obtaining the fluctuation information of the resource flow time series data through the change rate over the same period, the accuracy of identifying the abnormal data of the resource flow in the target area can be improved.

[0079] In another exemplary embodiment, as shown in FIG3 , the one or more target recognition models include a second target recognition model; the second target recognition model may be based on short-term trend abnormal data recognition; the above steps may include steps 302 to 306 to obtain and output the identification label of the target area based on the resource flow data features output by the feature extraction module. Among them:

[0080] Step 302: Obtain the difference time series of resource flow time series data.

[0081] Among them, the second target recognition model can be based on short-term trend abnormal data recognition, which can be understood as the first change trend information based on the resource flow time series data, the first change trend information can be short-term change trend information, and the first trend time length of the short-term change trend information is less than the first length threshold. Obtain the abnormal data recognition result of the resource flow time series data. Taking the current resource management object (for example, outlets and institutions) in the target area as an example, the object resource flow time series data of the current resource management object can include multiple sub-time series data, namely object resource inflow time series data, object net resource inflow time series data and resource outflow time series data. The object resource inflow time series data can be the resource value flowing into the corresponding resource management object; the object resource outflow time series data can be the resource value flowing out of the corresponding resource management object; the corresponding object net resource inflow time series data can be determined according to the difference between the resource inflow time series data and the resource outflow time series data. Each of the multiple sub-series data included in the current resource management object may include multiple resource flow direction data. In this step, the difference between the resource flow direction data in each sub-series data of the current resource management object can be obtained, and the difference time series of each sub-series data can be obtained based on the difference. The difference time series includes a first difference time series corresponding to the object resource inflow sequence data, a second difference time series corresponding to the object net resource inflow sequence data, and a third difference time series corresponding to the object resource outflow sequence data.

[0082] Step 304: Obtain first change trend information of resource flow time series data according to the difference time series.

[0083] Wherein, the first change trend information may include the first trend time length; the first trend time length is less than the first length threshold, and the first length threshold may be set in days, for example, the first length threshold may be 10 days, 20 days, and 60 days, etc. The first change trend information may be short-term change trend information. In this step, the symbol difference sequence of each sub-time series data may be obtained according to the difference time series of each sub-time series data, including: obtaining the first symbol difference sequence corresponding to the resource inflow sequence data according to the first difference time series; obtaining the second symbol difference sequence corresponding to the resource inflow sequence data according to the second difference time series; obtaining the third symbol difference sequence corresponding to the resource inflow sequence data according to the third difference time series; obtaining the first change trend information of the resource flow time series data according to the first symbol difference sequence, the second symbol difference sequence, and the third symbol difference sequence. Wherein, the logical rule for obtaining the symbol difference sequence of each sub-time series data is that for the first difference time series and the second difference time series, the difference greater than zero is marked as 0, and the difference less than zero is marked as 1; for the third difference time series, the difference greater than zero is marked as 1, and the difference less than zero is marked as 0. Next, the subsequences of each sign difference sequence can be obtained according to the sign difference sequence of each sub-time series data, which can include: determining multiple calculation lengths of each sign difference sequence, for example, n, n-1, n-2, the calculation length n is determined by the periodicity of the data, and further, the number difference corresponding to each calculation length can be obtained, the number difference is the difference between the number of "1" and "0" in the corresponding sign difference sequence, and the subsequences of each sign difference sequence can be obtained according to the number difference. Furthermore, the subsequence value of the subsequence of each sign difference sequence can be obtained according to the subsequence of each sign difference sequence, which can refer to formula (1), and the short-term change trend of the object resource flow time series data of the current resource management object can be judged according to the subsequence value and the subsequence length, that is, the first change trend information of the object resource flow time series data of the current resource management object is obtained.

[0084]

[0085] Among them, b i is the data value of the i-th signature difference sequence; k is the subsequence length of the subsequence of the i-th signature difference sequence; c n is the subsequence value of the subsequence of the i-th signature sequence.

[0086] If the subsequence value and the subsequence length are equal, then the number of consecutive change days of the corresponding sub-series data of the current resource management object is determined, for example, the net resource inflow and resource inflow have decreased for n / n-1 / n-2 consecutive days, and the resource outflow has increased for n / n-1 / n-2 consecutive days, and the maximum consecutive change days is determined as the trend time length of the short-term change trend of the current resource management object.

[0087] Step 306: Obtain an identification tag of the target area according to the first change trend information.

[0088] Among them, after obtaining the first change trend information of the object resource flow time series data of the current resource management object, the predicted data value of the current resource flow data in the object resource flow time series data can be obtained according to the first change trend information; next, the data identification label of the current resource flow data can be obtained according to the deviation between the predicted data value and the actual data value of the current resource flow data. If the deviation between the predicted data value and the actual data value of the current resource flow data is greater than the preset deviation threshold, the data identification label of the current resource flow data is judged to be abnormal resource flow; if the deviation between the predicted data value and the actual data value of the current resource flow data is less than or equal to the preset deviation threshold, the data identification label of the current resource flow data is judged to be normal resource flow. Furthermore, the identification label of the current resource management object and the identification label of the target area can be obtained according to the data identification label of any current resource flow data. The current resource flow data is any resource flow data in the object resource flow time series data of the current resource management object; the current resource management object is any resource management object among multiple resource management objects in the target area. The first change trend information can be used to indicate the continuous change trend, continuous change rate, and continuous change amplitude of the object resource flow time series data of the current resource management object within the trend time length of the short-term change trend.

[0089] In an exemplary embodiment, as shown in FIG4 , step 304 may include steps 402 to 404. Among them:

[0090] Step 402, according to the first difference time series, the second difference time series and the third difference time series, respectively obtain the first symbol difference sequence corresponding to the resource inflow sequence data, the second symbol difference sequence corresponding to the net resource inflow sequence data and the third symbol difference sequence corresponding to the resource outflow sequence data.

[0091] Step 404: Acquire first change trend information of resource flow timing data according to the first signature difference sequence, the second signature difference sequence, and the third signature difference sequence.

[0092] Specifically, based on the first difference time series, a first symbol difference sequence corresponding to the resource inflow sequence data is obtained; based on the second difference time series, a second symbol difference sequence corresponding to the resource inflow sequence data is obtained; based on the third difference time series, a third symbol difference sequence corresponding to the resource inflow sequence data is obtained; based on the first symbol difference sequence, the second symbol difference sequence and the third symbol difference sequence, the first change trend information of the resource flow timing data is obtained.

[0093] Among them, the logical rule for obtaining the sign difference sequence of each sub-time series data is that for the first difference time series and the second difference time series, the difference greater than zero is marked as 0, and the difference less than zero is marked as 1; for the third difference time series, the difference greater than zero is marked as 1, and the difference less than zero is marked as 0. Next, according to the sign difference sequence of each sub-time series data, the subsequence of each sign difference sequence can be obtained, which may include: determining multiple calculation lengths of each sign difference sequence, for example, n, n-1, n-2, the calculation length n is determined by the periodicity of the data, and further, the number difference corresponding to each calculation length can be obtained, the number difference is the difference between the number of "1" and "0" in the corresponding sign difference sequence, and according to the number difference, the subsequence of each sign difference sequence is obtained. Furthermore, the subsequence values ​​of the subsequences of the sign difference sequences can be obtained according to the subsequences of the sign difference sequences, as shown in formula (1), and the short-term change trend of the object resource flow time series data of the current resource management object can be determined according to the subsequence value and the subsequence length, that is, the first change trend information of the object resource flow time series data of the current resource management object can be obtained. If the subsequence value and the subsequence length are equal, the number of consecutive change days of the subsequence data of the corresponding current resource management object is determined, for example, the net resource inflow and the resource inflow have been decreasing for n / n-1 / n-2 consecutive days, and the resource outflow has been increasing for n / n-1 / n-2 consecutive days, and the maximum number of consecutive change days is determined as the trend time length of the short-term change trend of the current resource management object.

[0094] In the method of this embodiment, the abnormal data identification result of the target area can be obtained based on the first change trend information of the resource flow time series data, which can improve the accuracy of identifying the abnormal data of the resource flow in the target area.

[0095] In another exemplary embodiment, as shown in FIG5 , one or more target recognition models include a third target recognition model; the third target recognition model may be based on long-term trend abnormal data recognition; resource flow time series data includes resource inflow sequence data, net resource inflow sequence data and resource outflow sequence data; the above steps may include steps 502 to 504 to obtain and output the identification label of the target area based on the resource flow data features output by the feature extraction module. Among them:

[0096] Step 502: Obtain second change trend information of resource flow time series data.

[0097] Step 504: Obtain an identification tag of the target area according to the second change trend information.

[0098] Specifically, obtain the second change trend information of the resource inflow sequence data; obtain the second change trend information of the net resource inflow sequence data; obtain the second change trend information of the resource outflow sequence data; and obtain the identification tag of the target area according to the second change trend information.

[0099] Among them, the third target recognition model can be based on long-term trend abnormal data recognition, which can be understood as obtaining the abnormal data recognition result of the resource flow time series data based on the second change trend information of the resource flow time series data, and the second change trend information can be long-term change trend information. The second trend time length of the long-term change trend of the resource flow time series data is greater than the first trend time length of the short-term change trend, and the second trend time length is greater than the second length threshold, and the second length threshold is greater than the first length threshold; the second length threshold can be set in years, for example, the second length threshold can be half a year and one year, etc. Taking the current resource management object (for example, outlets and institutions) in the target area as an example, the object resource flow time series data of the current resource management object can include multiple sub-time series data, namely object resource inflow time series data, object net resource inflow time series data and resource outflow time series data. The object resource inflow time series data can be the resource value flowing into the corresponding resource management object; the object resource outflow time series data can be the resource value flowing out of the corresponding resource management object; the corresponding object net resource inflow time series data can be determined according to the difference between the resource inflow time series data and the resource outflow time series data. Each of the multiple sub-series data included in the current resource management object may include multiple resource flow direction data. The second change trend information of each sub-series data included in the current resource management object can be obtained based on the multiple resource flow direction data. Next, the predicted data value of any current resource flow direction data in each sub-series data can be obtained based on the second change trend information of each sub-series data; further, the data identification label of each sub-series data can be obtained based on the deviation between the predicted data value and the actual data value of the current resource flow direction data. If the deviation between the predicted data value and the actual data value of the current resource flow direction data is greater than the preset deviation threshold, the data identification label of the current resource flow direction data is judged to be abnormal resource flow direction; if the deviation between the predicted data value and the actual data value of the current resource flow direction data is less than or equal to the preset deviation threshold, the data identification label of the current resource flow direction data is judged to be normal resource flow direction. Furthermore, the identification label of the current resource management object and the identification label of the target area can be obtained based on the data identification label of any current resource flow direction data. The second change trend information can be used to indicate the continuous change trend, continuous change rate, and continuous change amplitude of the object resource flow time series data of the current resource management object within the trend time length of the long-term change trend.

[0100] In the method of this embodiment, the abnormal data identification result of the target area can be obtained based on the second change trend information of the resource flow time series data, which can improve the accuracy of identifying the abnormal data of the resource flow in the target area.

[0101] In an exemplary embodiment, as shown in FIG6 , step 110 may include steps 602 to 604. Among them:

[0102] Step 602: Determine abnormal change conditions of resource flow according to the service characteristics of resource flow.

[0103] Step 604, obtaining an abnormality identification result according to the abnormal change condition and the abnormal data identification result.

[0104] The abnormal data identification result is the data identification result of the resource flow time series data of the target area. According to the business characteristics of the resource flow, the abnormal change conditions of the resource flow are determined. The abnormal data identification result of the target area is verified by using the abnormal change conditions. The abnormal identification of the resource flow of the target area can be performed at the business level. The abnormal change conditions can be set according to the characteristics of the resource flow of the target area at the business level. The resource flow business characteristics are the characteristics of the resource flow of the target area at the business level. For example, for the net resource inflow business: the net inflow of the current period is negative, and the net inflow of the previous period is positive, that is, the net inflow changes from positive to negative, which is an abnormality that needs to be paid attention to; when the net inflow increases compared with the previous period, it is not defined as an abnormality; when the net inflow decreases compared with the previous period, the degree of abnormality is determined according to the degree of decrease; for the resource inflow business: when the inflow increases compared with the previous period, it is not regarded as a business abnormality, and when the inflow decreases compared with the previous period, the degree of abnormality is determined according to the degree of decrease; for the resource outflow business: when the outflow decreases compared with the previous period, it is not regarded as a business abnormality, and when the outflow increases compared with the previous period, the degree of abnormality is determined according to the degree of increase.

[0105] In the method of this embodiment, the abnormal data identification results output by the abnormal data identification model group can be identified at the business level according to the abnormal change conditions, and finally the abnormal identification results of the resource flow in the target area can be obtained. The dual abnormal identification at the data and business levels can be fully combined to improve the comprehensiveness and accuracy of the abnormal identification of the resource flow in the target area.

[0106] In an exemplary embodiment, as shown in FIG7 , the present application further includes the following steps, which are used to provide an implementation method for sending an alarm to a regional contact object when there is an abnormal resource flow in the target area, and may include steps 702 to 704. Among them:

[0107] Step 702: If the abnormality identification result indicates that there is abnormal resource flow in the target area, alarm information of the target area is generated according to the abnormality identification result.

[0108] Step 704: Send the alarm information to the regional contact object of the target area.

[0109] Among them, the alarm information is used to prompt the regional contact object to handle the abnormal resource flow in the target area. The regional contact object may be the person in charge of the target area. The alarm information may include the regional identification of the target area and the abnormal identification result of the target area. In one possible implementation, when the abnormal identification result of the target area is obtained and the abnormal identification result indicates that there is a resource flow abnormality in the target area, the alarm information of the target area is generated according to the abnormal identification result in the form of automatic triggering, and the alarm information is sent to the regional contact object of the target area. In another possible implementation, if the abnormal identification result indicates that there is a resource flow abnormality in the target area, the administrator can manually select the corresponding regional contact object and send the alarm information of the target area to the regional contact object of the target area.

[0110] In the method of this embodiment, when there is a resource flow abnormality in the target area, an alarm can be issued to the regional contact object, so that the regional contact object can handle the resource flow abnormality in the target area in a timely manner, thereby improving the timeliness and safety of handling the resource flow abnormality in the target area.

[0111] In an exemplary embodiment, as shown in FIG8 , step 102 may include steps 802 to 806. Among them:

[0112] Step 802: Obtain an object weight corresponding to each target object among a plurality of target objects.

[0113] Step 804: Obtain object resource flow time series data of each target object among the multiple target objects.

[0114] Step 806, acquiring resource flow time series data of the target area according to the object resource flow time series data and the object weight.

[0115] Among them, the target area can be a geographical grid of a resource management object. The target area can include multiple resource management objects, such as outlets and institutions, etc., and the resource management objects can also be called target objects. In a possible implementation, the object weight of each resource management object in the multiple resource management objects can be obtained according to the object characteristics of each resource management object in the multiple resource management objects, such as geographical location characteristics and scale characteristics, etc., and the object weight can be used to indicate the importance of the corresponding resource management object to the abnormal identification of the resource flow direction of the target area. Based on this, the object resource flow time series data of each resource management object in the multiple resource management objects can be obtained, and then, the resource flow time series data of the target area can be obtained according to the object weight of each resource management object in the multiple resource management objects and the object resource flow time series data.

[0116] In the method of this embodiment, the object weight of each resource management object can be set, and the resource flow time series data of the target area can be obtained based on the object weight and the object resource flow time series data, thereby reducing the amount of calculated data and improving the data calculation rate. Furthermore, the efficiency and accuracy of identifying resource flow anomalies in the target area can be improved.

[0117] It should be understood that, although the various steps in the flowcharts involved in the above-mentioned embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above-mentioned embodiments can include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0118] Based on the same inventive concept, the embodiment of the present application also provides an abnormality identification device for implementing the abnormality identification method involved above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above method, so the specific limitations in one or more abnormality identification device embodiments provided below can refer to the limitations on the abnormality identification method above, and will not be repeated here.

[0119] In an exemplary embodiment, as shown in FIG9 , an abnormality identification device is provided, including: an acquisition module 902 , a determination module 904 , a screening module 906 , a calculation module 908 and a correction module 910 , wherein:

[0120] An acquisition module 902 is used to acquire resource flow time series data of a target area;

[0121] A determination module 904 is used to determine a target abnormal data analysis method for the resource flow time series data;

[0122] A screening module 906 is used to determine one or more target recognition models that match the target abnormal data analysis method in the pre-built abnormal data recognition model group;

[0123] A calculation module 908 is used to obtain an abnormal data recognition result of the target area based on the resource flow time series data by using one or more of the target recognition models;

[0124] The correction module 910 is used to obtain an abnormality identification result of the resource flow of the target area according to the abnormal data identification result and the resource flow business characteristics.

[0125] In one embodiment, the calculation module 908 is also used to: input the resource flow time series data into the abnormal data identification model group to obtain the abnormal data identification result of the target area; wherein one or more target identification models in the abnormal data identification model group obtain the identification label of the target area according to the resource flow time series data, and determine and output the abnormal data identification result of the target area based on the identification label.

[0126] In one embodiment, the calculation module 908 is also used to: input the resource flow time series data into one or more of the target recognition models, and use the feature extraction modules of the one or more target recognition models to extract features from the resource flow time series data to obtain and output resource flow data features of the resource flow time series data; use the classification modules of one or more of the target recognition models to obtain and output the identification label of the target area based on the resource flow data features output by the feature extraction module, and obtain the abnormal data identification result of the target area based on the identification label.

[0127] In one embodiment, the resource flow data characteristics include time characteristics; the first target recognition model is a fluctuation abnormality data recognition model; the calculation module 908 is also used to: obtain the date type information of each of the multiple resource flow data contained in the resource flow time series data according to the time characteristics of the resource flow time series data; obtain the data identification label of each of the resource flow data according to the date type information of each of the resource flow data; obtain the identification label of the target area according to the data identification label of each of the resource flow data.

[0128] In one embodiment, the calculation module 908 is also used to: determine the same period comparison period of the resource flow time series data according to the date type information of each resource flow data; obtain the same period change rate of the resource flow time series data according to the same period comparison period; and obtain the data identification tag of each resource flow data according to the same period change rate.

[0129] In one embodiment, the calculation module 908 is also used to: obtain a difference time series of the resource flow time series data; obtain first change trend information of the resource flow time series data based on the difference time series; the first change trend information includes a first trend time length; the first trend time length is less than a first length threshold; and obtain the identification tag of the target area based on the first change trend information.

[0130] In one embodiment, the resource flow time series data includes resource inflow sequence data, net resource inflow sequence data and resource outflow sequence data; the difference time series includes a first difference time series corresponding to the resource inflow sequence data, a second difference time series corresponding to the net resource inflow sequence data and a third difference time series corresponding to the resource outflow sequence data; the calculation module 908 is also used to: obtain the first symbol difference sequence corresponding to the resource inflow sequence data, the second symbol difference sequence corresponding to the net resource inflow sequence data and the third symbol difference sequence corresponding to the resource outflow sequence data according to the first difference time series, the second difference time series and the third difference time series; obtain the first change trend information of the resource flow time series data according to the first symbol difference sequence, the second symbol difference sequence and the third symbol difference sequence. In one embodiment, the calculation module 908 is also used to: obtain the second change trend information of the resource flow time series data; the second change trend information includes a second trend time length; the second trend time length is greater than a second length threshold; according to the second change trend information, obtain the identification tag of the target area.

[0131] In one embodiment, the correction module 910 is further used to: determine the abnormal change condition of the resource flow according to the business characteristics of the resource flow; and obtain the abnormal identification result according to the abnormal change condition and the abnormal data identification result.

[0132] In one embodiment, the correction module 910 is also used to: if the abnormality identification result indicates that there is a resource flow abnormality in the target area, generate alarm information for the target area according to the abnormality identification result; send the alarm information to the regional contact object of the target area; the alarm information is used to prompt the regional contact object to handle the resource flow abnormality in the target area.

[0133] In one embodiment, the target area includes multiple target objects; the acquisition module 902 is also used to: obtain the object weight corresponding to each of the multiple target objects; obtain the object resource flow timing data of each of the multiple target objects; and obtain the resource flow timing data of the target area based on the object resource flow timing data and the object weight.

[0134] Each module in the above-mentioned abnormality identification device can be implemented in whole or in part by software, hardware and a combination thereof. Each of the above-mentioned modules can be embedded in or independent of the processor in the computer device in the form of hardware, or can be stored in the memory in the computer device in the form of software, so that the processor can call and execute the operations corresponding to each of the above modules.

[0135] In an exemplary embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be shown in FIG10. The computer device includes a processor, a memory, an input / output interface (Input / Output, referred to as I / O) and a communication interface. Among them, the processor, the memory and the input / output interface are connected through a system bus, and the communication interface is connected to the system bus through the input / output interface. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store abnormal identification data. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, an abnormal identification method is implemented.

[0136] Those skilled in the art will understand that the structure shown in FIG. 10 is merely a block diagram of a partial structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than shown in the figure, or combine certain components, or have a different arrangement of components.

[0137] In one embodiment, a computer device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the steps in the above-mentioned method embodiments when executing the computer program.

[0138] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps in the above-mentioned method embodiments are implemented.

[0139] In one embodiment, a computer program product is provided, including a computer program, which implements the steps in the above method embodiments when executed by a processor.

[0140] A person of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment method can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, an artificial intelligence (AI) processor, etc., but are not limited to this.

[0141] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0142] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A method for identifying anomalies, characterized in that: The method comprises: Obtain resource flow time series data in the target area; Determine a target abnormal data analysis method for the resource flow time series data; Determine one or more target recognition models that match the target abnormal data analysis method in a pre-constructed abnormal data recognition model group; Using one or more of the target recognition models, based on the resource flow time series data, obtain an abnormal data recognition result of the target area; According to the abnormal data identification result and the resource flow business characteristics, an abnormal identification result of the resource flow in the target area is obtained.

2. The method according to claim 1, characterized in that The using one or more of the target recognition models to obtain the abnormal data recognition result of the target area based on the resource flow time series data includes: Inputting the resource flow time series data into the abnormal data identification model group to obtain the abnormal data identification result of the target area; Among them, one or more target recognition models in the abnormal data recognition model group obtains the identification label of the target area according to the resource flow time series data, and determines and outputs the abnormal data recognition result of the target area based on the identification label.

3. The method according to claim 2, characterized in that The step of inputting the resource flow time series data into the abnormal data identification model group to obtain the abnormal data identification result of the target area includes: Input the resource flow time series data into one or more target recognition models, and use one or more feature extraction modules of the target recognition models to extract features from the resource flow time series data, and obtain and output resource flow data features of the resource flow time series data; One or more classification modules of the target recognition model obtain and output the identification label of the target area according to the resource flow data features output by the feature extraction module, and obtain the abnormal data recognition result of the target area based on the identification label.

4. The method according to claim 3, characterized in that: The resource flow data characteristics include time characteristics; The obtaining and outputting the identification label of the target area according to the resource flow data feature output by the feature extraction module includes: According to the time feature of the resource flow time series data, obtaining date type information of each resource flow data in a plurality of resource flow data included in the resource flow time series data; According to the date type information of each resource flow data, obtaining a data identification tag of each resource flow data; The identification tag of the target area is acquired according to the data identification tag of each resource flow data.

5. The method according to claim 4, characterized in that The acquiring, according to the date type information of each resource flow data, a data identification tag of each resource flow data comprises: Determine a same period comparison period of the resource flow time series data according to the date type information of each resource flow data; According to the synchronous comparison cycle, obtaining the synchronous change rate of the resource flow time series data; The data identification tag of each resource flow data is obtained according to the change rate during the same period.

6. The method according to claim 3, characterized in that The obtaining and outputting the identification label of the target area according to the resource flow data feature output by the feature extraction module includes: Obtaining a time series of differences in the resource flow time series data; According to the difference time series, first change trend information of the resource flow time series data is obtained; the first change trend information includes a first trend time length; the first trend time length is less than a first length threshold; The identification label of the target area is acquired according to the first change trend information.

7. The method according to claim 6, characterized in that The resource flow time series data includes resource inflow sequence data, net resource inflow sequence data and resource outflow sequence data; the difference time series includes a first difference time series corresponding to the resource inflow sequence data, a second difference time series corresponding to the net resource inflow sequence data and a third difference time series corresponding to the resource outflow sequence data; The acquiring, according to the difference time series, first change trend information of the resource flow time series data includes: According to the first difference time series, the second difference time series and the third difference time series, respectively obtain a first symbol difference sequence corresponding to the resource inflow sequence data, a second symbol difference sequence corresponding to the net resource inflow sequence data and a third symbol difference sequence corresponding to the resource outflow sequence data; The first change trend information of the resource flow timing data is acquired according to the first signature difference sequence, the second signature difference sequence and the third signature difference sequence.

8. The method according to claim 3, characterized in that The obtaining and outputting the identification label of the target area according to the resource flow data feature output by the feature extraction module includes: Acquire second change trend information of the resource flow time series data; the second change trend information includes a second trend time length; the second trend time length is greater than a second length threshold; The identification label of the target area is acquired according to the second change trend information.

9. The method according to claim 1, characterized in that: The obtaining, according to the abnormal data identification result and the resource flow business characteristics, an abnormal identification result of the resource flow of the target area includes: Determining abnormal change conditions of the resource flow according to the service characteristics of the resource flow; The abnormality identification result is obtained according to the abnormal change condition and the abnormal data identification result.

10. The method according to claim 9, characterized in that After obtaining the abnormality identification result, the method further includes: If the abnormality identification result indicates that there is abnormal resource flow in the target area, generating alarm information of the target area according to the abnormality identification result; the alarm information is used to prompt the regional contact object of the target area to handle the abnormal resource flow in the target area; The alarm information is sent to the area contact object of the target area.

11. The method according to any one of claims 1 to 10, characterized in that The target area includes a plurality of target objects; and obtaining resource flow time series data of the target area includes: Obtaining an object weight corresponding to each of the target objects; Acquire object resource flow time series data of each of the target objects; The resource flow time series data of the target area is acquired according to the object resource flow time series data and the object weight.

12. An abnormality identification device, characterized in that: The device comprises: The acquisition module is used to obtain the resource flow time series data of the target area; A determination module, used to determine a target abnormal data analysis method for the resource flow time series data; A screening module, used to determine one or more target recognition models matching the target abnormal data analysis method in a pre-built abnormal data recognition model group; A calculation module, configured to obtain an abnormal data recognition result of the target area based on the resource flow time series data by using one or more of the target recognition models; The correction module is used to obtain an abnormality identification result of the resource flow in the target area according to the abnormal data identification result and the business characteristics of the resource flow.

13. The device according to claim 12, characterized in that The computing module is further used for: Inputting the resource flow time series data into the abnormal data identification model group to obtain the abnormal data identification result of the target area; Among them, one or more target recognition models in the abnormal data recognition model group obtains the identification label of the target area according to the resource flow time series data, and determines and outputs the abnormal data recognition result of the target area based on the identification label.

14. The device according to claim 13, characterized in that The computing module is further used for: Input the resource flow time series data into one or more target recognition models, and use one or more feature extraction modules of the target recognition models to extract features from the resource flow time series data, and obtain and output resource flow data features of the resource flow time series data; One or more classification modules of the target recognition model obtain and output the identification label of the target area according to the resource flow data features output by the feature extraction module, and obtain the abnormal data recognition result of the target area based on the identification label.

15. The device according to claim 14, characterized in that The resource flow data feature includes a time feature; the calculation module is further used to: According to the time feature of the resource flow time series data, obtaining date type information of each resource flow data in a plurality of resource flow data included in the resource flow time series data; According to the date type information of each resource flow data, obtaining a data identification tag of each resource flow data; The identification tag of the target area is acquired according to the data identification tag of each resource flow data.

16. The device according to claim 15, characterized in that The computing module is further used for: Determine a same period comparison period of the resource flow time series data according to the date type information of each resource flow data; According to the synchronous comparison cycle, obtaining the synchronous change rate of the resource flow time series data; The data identification tag of each resource flow data is obtained according to the change rate during the same period.

17. The device according to claim 14, characterized in that The computing module is further used for: Obtaining a time series of differences in the resource flow time series data; According to the difference time series, obtaining first change trend information of the resource flow time series data; the first change trend information includes a first trend time length; The first trend time length is less than a first length threshold; The identification label of the target area is acquired according to the first change trend information.

18. The device according to claim 17, characterized in that The resource flow time series data includes resource inflow sequence data, net resource inflow sequence data and resource outflow sequence data; the difference time series includes a first difference time series corresponding to the resource inflow sequence data, a second difference time series corresponding to the net resource inflow sequence data and a third difference time series corresponding to the resource outflow sequence data; the calculation module is further used to: According to the first difference time series, the second difference time series and the third difference time series, respectively obtain a first symbol difference sequence corresponding to the resource inflow sequence data, a second symbol difference sequence corresponding to the net resource inflow sequence data and a third symbol difference sequence corresponding to the resource outflow sequence data; The first change trend information of the resource flow timing data is acquired according to the first signature difference sequence, the second signature difference sequence and the third signature difference sequence.

19. The device according to claim 14, characterized in that The computing module is further used for: Acquire second change trend information of the resource flow time series data; the second change trend information includes a second trend time length; the second trend time length is greater than a second length threshold; The identification label of the target area is acquired according to the second change trend information.

20. The device according to claim 12, characterized in that The correction module is further used for: Determining abnormal change conditions of the resource flow according to the service characteristics of the resource flow; The abnormality identification result is obtained according to the abnormal change condition and the abnormal data identification result.

21. The device according to claim 20, characterized in that The correction module is further used for: If the abnormal identification result indicates that there is abnormal resource flow in the target area, generating alarm information of the target area according to the abnormal identification result; The alarm information is sent to the regional contact object of the target area; the alarm information is used to prompt the regional contact object to handle the abnormal resource flow of the target area.

22. The device according to any one of claims 12 to 21, characterized in that The target area includes a plurality of target objects; the acquisition module is further used for: Obtaining an object weight corresponding to each of the target objects; Acquire object resource flow time series data of each of the target objects; The resource flow time series data of the target area is acquired according to the object resource flow time series data and the object weight.

23. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 11 are implemented.

24. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 11 are implemented.

25. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 11 are implemented.

Images