Abnormal order identification method and device, computer storage medium and electronic equipment

Abstract

The invention belongs to the technical field of artificial intelligence, and relates to an abnormal order recognition method and device, a computer storage medium and electronic equipment, and the method comprises the steps: obtaining multiple groups of to-be-processed order data containing multi-dimensional feature data, and carrying out the preprocessing of the to-be-processed order data; performing dimension reduction processing on the preprocessed to-be-processed order data to obtain target order data including main features; and inputting the target order data to an anomaly detection model, and processing the target order data through the anomaly detection model to obtain an anomaly result corresponding to the to-be-processed order data, the anomaly detection model being obtained by training based on an adaptive learning rate strategy and an active learning strategy. According to the invention, the recognition accuracy and recognition efficiency of abnormal orders in a high-dimensional scene can be improved.

Description

Technical Field

[0001] The present application belongs to the field of artificial intelligence technology, and specifically relates to an abnormal order identification method, an abnormal order identification device, a computer-readable storage medium, and an electronic device. Background Art

[0002] With the development of e-commerce, more and more people choose to shop on e-commerce platforms. However, e-commerce platforms need to perform anomaly detection on numerous orders, detect fake orders, false reviews, account theft and other orders that affect the operating efficiency and user experience of e-commerce platforms, and handle them accordingly.

[0003] At present, there are three methods for anomaly detection: statistical-based method, distance-based method, density-based method and machine learning-based method. However, when these methods process high-dimensional data such as order data, due to the influence of the curse of dimensionality, the calculation of data density and distance becomes difficult and inaccurate. When using machine learning methods, since a fixed learning rate is usually used during model training, the training process takes a long time and is prone to falling into local optimality. In addition, unlabeled data cannot be fully utilized, resulting in limited model performance. Summary of the invention

[0004] The purpose of this application is to provide an abnormal order identification method, an abnormal order identification device, a computer-readable storage medium and an electronic device, which can overcome the problems of poor accuracy and low efficiency of abnormal identification in related technologies.

[0005] Other features and advantages of the present application will become apparent from the following detailed description, or may be learned in part by the practice of the present application.

[0006] According to one aspect of an embodiment of the present application, a method for identifying abnormal orders is provided, the method comprising: obtaining multiple groups of pending order data containing multi-dimensional feature data, and preprocessing the pending order data; performing dimensionality reduction processing on the preprocessed pending order data to obtain target order data containing main features; inputting the target order data into an anomaly detection model, and processing the target order data through the anomaly detection model to obtain abnormal results corresponding to the pending order data, wherein the anomaly detection model is trained based on an adaptive learning rate strategy and an active learning strategy.

[0007] According to one aspect of an embodiment of the present application, an abnormal order identification device is provided, which includes: a preprocessing module, used to obtain multiple groups of to-be-processed order data containing multi-dimensional feature data, and preprocess the to-be-processed order data; a dimensionality reduction module, used to perform dimensionality reduction processing on the preprocessed to-be-processed order data, and obtain target order data containing main features; an abnormality identification module, used to input the target order data into an abnormality detection model, and process the target order data through the abnormality detection model to obtain abnormal results corresponding to the to-be-processed order data, wherein the abnormality detection model is trained based on an adaptive learning rate strategy and an active learning strategy.

[0008] In some embodiments of the present application, the preprocessing module includes: a preprocessing unit, which is used to process missing values ​​in the order data to be processed and standardize the processed order data to be processed.

[0009] In some embodiments of the present application, the preprocessing unit is configured as follows: when the feature type of the missing value is a numerical feature, the mean, median or mode is determined based on the order data to be processed, and the missing value is filled with the mean, median or mode; when the feature type of the missing value is a categorical feature, the missing value is filled with the category that appears most frequently in the order data to be processed.

[0010] In some embodiments of the present application, the pre-processing unit is configured to: scale the processed order data to be processed to a target numerical range according to preset rules.

[0011] In some embodiments of the present application, the dimensionality reduction module includes: a matrix construction unit, which is used to centralize the pre-processed order data to be processed, construct a covariance matrix based on the centralized order data to be processed and the corresponding features, and determine the eigenvalues ​​and eigenvectors of the covariance matrix; a principal component acquisition unit, which is used to sort the eigenvalues ​​from large to small to form an eigenvalue sequence, sequentially obtain the target eigenvectors corresponding to a preset number of eigenvalues ​​in the eigenvalue sequence, and construct a principal component feature matrix based on the target eigenvector; a dimensionality reduction unit, which is used to determine a first dimensionality reduction matrix based on the centralized order data to be processed and the principal component feature matrix, screen the features in the first dimensionality reduction matrix to obtain a second dimensionality reduction matrix, and use the data in the second dimensionality reduction matrix as the target order data.

[0012] In some embodiments of the present application, the abnormal order identification device also includes: a training module, which is used to obtain a set of order sample data before inputting the target order data into the anomaly detection model, and train the anomaly detection model to be trained according to each group of order sample data in the order sample data set to obtain the anomaly detection model.

[0013] In some embodiments of the present application, the training module includes: a sample preprocessing unit, used to preprocess the order sample data, and perform dimensionality reduction processing on the preprocessed order sample data to obtain target order sample data containing main features; an unlabeled data set construction unit, used to divide the order sample data in the order sample data set into a first order sample data subset and a second order sample data subset according to the order, and construct an unlabeled data set according to the target order sample data in the first order sample data subset; a labeled data set construction unit, used to perform outlier detection on the target order sample data in the second order sample data subset, and construct a labeled data set according to the target order sample data in the second order sample data subset and the corresponding labels; a training unit, used to train the anomaly detection model to be trained according to the unlabeled data set and the labeled data set to obtain the anomaly detection model.

[0014] In some embodiments of the present application, the labeled data set construction unit is configured to: poll the target order sample data of the second order sample data subset, and take any of the target order sample data as the target data; determine the k-distance according to the target data and the kth nearest neighbor data corresponding to the target data, where k is a positive integer; obtain the direct distance between the target data and the kth nearest neighbor data, and determine the reachable distance corresponding to the target data according to the k-distance and the direct distance; determine the local reachable density corresponding to the target data according to the reachable distance corresponding to the k nearest neighbor data of the target data, and determine the local outlier factor corresponding to the target data based on the local reachable density; determine whether the target data is abnormal data according to the local outlier factor and a preset threshold, and determine the label corresponding to the order containing the target data according to the judgment result.

[0015] In some embodiments of the present application, the training unit includes: an active selection unit, which is used to actively select data with the largest amount of information from the unlabeled data set, determine the label corresponding to the data with the largest amount of information through manual labeling, and update the labeled data set according to the data with the largest amount of information and the label; an optimization unit, which is used to train the anomaly detection model to be trained according to the updated labeled data set, and optimize the parameters of the anomaly detection model to be trained through an adaptive learning rate strategy during the training process; a loop unit, which is used to repeat the above process until the preset training conditions are met to obtain the anomaly detection model.

[0016] In some embodiments of the present application, the optimization unit is configured to: obtain initial parameters, the initial parameters including weight, bias, first-order moment estimate, second-order moment estimate, time step, learning rate, first-order moment decay factor, second-order moment decay factor and a small constant; determine a first gradient corresponding to the weight and a second gradient corresponding to the bias according to an objective function; the objective function is related to the weight and the bias; update the first-order moment estimate and the second-order moment estimate according to the first-order moment decay factor, the second-order moment decay factor, the first gradient and the second gradient; correct the updated first-order moment estimate and the second-order moment estimate according to the time step, the first-order moment decay factor and the second-order moment decay factor; update the weight and the bias according to the corrected first-order moment estimate, the corrected second-order moment estimate, the learning rate and the small constant.

[0017] In some embodiments of the present application, the optimization unit is further configured to: determine an optimal learning rate according to a gradient corresponding to the updated weight and the updated bias.

[0018] In some embodiments of the present application, the active selection unit is configured to: adopt a maximum uncertainty strategy, a maximum predicted change strategy, or a maximum impact strategy to determine the data with the maximum amount of information.

[0019] In some embodiments of the present application, the abnormal order identification device also includes: an evaluation module, which is used to evaluate the performance of the abnormal detection model by using a cross-validation method and an AUC-ROC curve after completing the training of the abnormal detection model to be trained.

[0020] According to one aspect of an embodiment of the present application, a computer-readable medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the abnormal order identification method in the above technical solution is implemented.

[0021] According to one aspect of an embodiment of the present application, an electronic device is provided, comprising: a processor; and a memory for storing executable instructions of the processor; wherein the processor is configured to execute the abnormal order identification method in the above technical solution by executing the executable instructions.

[0022] According to one aspect of an embodiment of the present application, a computer program product is provided, which includes computer instructions. When the computer instructions are executed on a computer, the computer executes the abnormal order identification method in the above technical solution.

[0023] The abnormal order identification method provided in the embodiment of the present application pre-processes the obtained multiple groups of pending order data containing multi-dimensional feature data; then performs dimensionality reduction processing to obtain target order data containing main features; finally, the target order data is input into the anomaly detection model, and the target order data is processed by the anomaly detection model to obtain abnormal results corresponding to the pending order data, wherein the anomaly detection model is trained based on the adaptive learning rate strategy and the active learning strategy. On the one hand, the present application can train the anomaly detection model based on the adaptive learning rate strategy and the active learning strategy, shorten the model training time, and improve the model performance; on the other hand, it can improve the accuracy and efficiency of abnormal order identification in high-dimensional scenarios.

[0024] It should be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] The drawings herein are incorporated into the specification and constitute a part of the specification, illustrate embodiments consistent with the present application, and together with the specification are used to explain the principles of the present application. Obviously, the drawings described below are only some embodiments of the present application, and for ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0026] Figure 1 The structural diagram of the system architecture of the abnormal order identification method in the embodiment of the present application is schematically shown.

[0027] Figure 2 The following is a schematic diagram showing the steps of the abnormal order identification method in an embodiment of the present application.

[0028] Figure 3 The flowchart of the dimensionality reduction processing in the embodiment of the present application is schematically shown.

[0029] Figure 4 The flowchart of obtaining the order sample data set in the embodiment of the present application is schematically shown.

[0030] Figure 5 The flowchart of the detector performing outlier detection on target order sample data in an embodiment of the present application is schematically shown.

[0031] Figure 6 The structural block diagram of the abnormal order identification device in an embodiment of the present application is schematically shown.

[0032] Figure 7 The structure block diagram of a computer system suitable for implementing an electronic device according to an embodiment of the present application is schematically shown. DETAILED DESCRIPTION

[0033] Example embodiments will now be described more fully with reference to the accompanying drawings. However, example embodiments can be implemented in a variety of forms and should not be construed as limited to the examples set forth herein; rather, these embodiments are provided so that this application will be more comprehensive and complete and fully convey the concept of the example embodiments to those skilled in the art.

[0034] In addition, described feature, structure or characteristic can be combined in one or more embodiments in any suitable manner. In the following description, many specific details are provided to provide a full understanding of the embodiments of the present application. However, those skilled in the art will appreciate that the technical scheme of the present application can be put into practice without one or more of the specific details, or other methods, components, devices, steps, etc. can be adopted. In other cases, known methods, devices, realizations or operations are not shown or described in detail to avoid blurring the various aspects of the application.

[0035] The block diagrams shown in the accompanying drawings are merely functional entities and do not necessarily correspond to physically independent entities. That is, these functional entities may be implemented in software form, or in one or more hardware modules or integrated circuits, or in different networks and / or processor devices and / or microcontroller devices.

[0036] The flowcharts shown in the accompanying drawings are only exemplary and do not necessarily include all the contents and operations / steps, nor must they be executed in the order described. For example, some operations / steps can be decomposed, and some operations / steps can be combined or partially combined, so the actual execution order may change according to actual conditions.

[0037] In the related technologies of the present application, when performing anomaly detection, statistical-based methods, distance-based methods, density-based methods and ensemble learning-based methods are usually used, among which the statistical-based method is to identify abnormal data that does not conform to statistical laws by establishing a statistical model of the data; the distance-based method is to calculate the distance between data points and identify abnormal data that is far away from other data points; the density-based method is to identify abnormal data in low-density areas according to the density of data points in the feature space; the ensemble learning-based method is to integrate the output results of multiple detectors to improve detection performance.

[0038] However, these methods have corresponding disadvantages when processing high-dimensional data. First, due to the influence of the curse of dimensionality, the calculation of data density and distance becomes difficult and inaccurate. Second, existing methods usually use a fixed learning rate for model training, which makes the training process time-consuming and prone to falling into local optimality. Finally, existing methods do not make full use of unlabeled data, resulting in limited model performance.

[0039] In view of the related technologies in this field, the embodiment of the present application proposes a method for identifying abnormal orders. Before describing the method for identifying abnormal orders in the present application in detail, the technical terms that may be involved in the present application are first described.

[0040] 1. Adaptive learning rate: A method that dynamically adjusts the learning rate according to the change in loss during model training to improve model convergence speed and accuracy.

[0041] 2. Active learning: A machine learning method that improves model performance by continuously selecting the most informative samples from unlabeled data, labeling them, and adding them to the training set.

[0042] 3. High-dimensional data analysis: Analysis methods for data with a large number of features, mainly involving techniques such as dimensionality reduction, feature selection and feature extraction.

[0043] 4. Outlier detection: used to identify data points that are significantly different from normal data, also known as extreme value detection or outlier detection.

[0044] Next, an exemplary system architecture applying the technical solution of the present application is described.

[0045] Figure 1 The exemplary system architecture block diagram applying the technical solution of the present application is schematically shown.

[0046] like Figure 1As shown, the system architecture 100 may include a terminal device 110, a server 120, and a network 130. The terminal device 110 may include various electronic devices with display screens, such as smart phones, tablet computers, laptops, desktop computers, smart TVs, and smart car terminals. The server 120 may be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides cloud computing services. The network 130 may be a communication medium of various connection types that can provide a communication link between the terminal device 110 and the server 120, such as a wired communication link or a wireless communication link.

[0047] According to implementation requirements, the system architecture in the embodiment of the present application may have any number of terminal devices, networks and servers. For example, the server 120 may be a server group composed of multiple server devices.

[0048] In one embodiment of the present application, multiple groups of high-dimensional order data to be processed are collected through the terminal device 110, and the order data to be processed are sent to the server 120 through the network 130. After receiving the order data to be processed, the server 130 first pre-processes it, then performs dimensionality reduction processing to obtain target order data containing main features, and then inputs the target order data into the anomaly detection model, and detects the abnormal order data in the target order data through the anomaly detection model to obtain abnormal results corresponding to each group of high-dimensional order data to be processed. The anomaly detection model is trained based on the adaptive learning rate strategy and the active learning strategy.

[0049] The technical solution provided in the embodiments of the present application may be applied to the server 120 or to the terminal device 110, or may be implemented jointly by the terminal device 110 and the server 120, and the present application does not impose any special limitation on this.

[0050] In this application, abnormal data is detected by an anomaly detection model, which is a machine learning model and involves artificial intelligence.

[0051] Artificial Intelligence (AI) is the theory, method, technology and application system that uses digital computers or machines controlled by digital computers to simulate, extend and expand human intelligence, perceive the environment, acquire knowledge and use knowledge to obtain the best results. In other words, artificial intelligence is a comprehensive technology in computer science that attempts to understand the essence of intelligence and produce a new intelligent machine that can respond in a similar way to human intelligence. Artificial intelligence is to study the design principles and implementation methods of various intelligent machines so that machines have the functions of perception, reasoning and decision-making.

[0052] Artificial intelligence technology is a comprehensive discipline that covers a wide range of fields, including both hardware-level and software-level technologies. Basic artificial intelligence technologies generally include sensors, dedicated artificial intelligence chips, cloud computing, distributed storage, big data processing technology, operating / interactive systems, mechatronics and other technologies. Artificial intelligence software technologies mainly include computer vision technology, speech processing technology, natural language processing technology, as well as machine learning / deep learning, autonomous driving, smart transportation and other major directions.

[0053] Machine Learning (ML) is a multi-disciplinary subject involving probability theory, statistics, approximation theory, convex analysis, algorithm complexity theory and other disciplines. It specializes in studying how computers simulate or implement human learning behavior to acquire new knowledge or skills and reorganize existing knowledge structures to continuously improve their performance. Machine learning is the core of artificial intelligence and the fundamental way to make computers intelligent. Its applications are spread across all areas of artificial intelligence. Machine learning and deep learning usually include artificial neural networks, belief networks, reinforcement learning, transfer learning, inductive learning and other technologies.

[0054] In one embodiment of the present application, the server 120 may be a cloud server, and the server 120 may use technologies such as cloud storage and cloud computing to perform the abnormal order identification method in the present application.

[0055] Cloud storage is a new concept that extends and develops from the concept of cloud computing. A distributed cloud storage system (hereinafter referred to as storage system) refers to a storage system that uses cluster applications, grid technology, and distributed storage file systems to bring together a large number of different types of storage devices (storage devices are also called storage nodes) in the network through application software or application interfaces to work together and provide external data storage and business access functions.

[0056] At present, the storage method of the storage system is: create a logical volume, and when creating a logical volume, allocate physical storage space for each logical volume. The physical storage space may be composed of disks of a storage device or several storage devices. The client stores data on a logical volume, that is, stores the data on the file system. The file system divides the data into many parts, each of which is an object. The object contains not only data but also additional information such as data identification (ID, ID entity). The file system writes each object into the physical storage space of the logical volume, and the file system records the storage location information of each object, so that when the client requests to access the data, the file system can allow the client to access the data according to the storage location information of each object.

[0057] The process of the storage system allocating physical storage space to a logical volume is as follows: based on the estimated capacity of the objects stored in the logical volume (this estimate often has a large margin relative to the actual capacity of the objects to be stored) and the grouping of independent redundant disk arrays (RAID, Redundant Array of Independent Disks), the physical storage space is pre-divided into stripes. A logical volume can be understood as a stripe, thereby allocating physical storage space to the logical volume.

[0058] Cloud computing is a computing model that distributes computing tasks on a resource pool composed of a large number of computers, allowing various application systems to obtain computing power, storage space and information services as needed. The network that provides resources is called a "cloud". From the user's perspective, the resources in the "cloud" are infinitely scalable and can be obtained at any time, used on demand, expanded at any time, and paid for by use.

[0059] As a provider of basic cloud computing capabilities, a cloud computing resource pool (referred to as a cloud platform, generally referred to as an IaaS (Infrastructure as a Service) platform) will be established, and various types of virtual resources will be deployed in the resource pool for external customers to choose to use. The cloud computing resource pool mainly includes: computing devices (virtualized machines, including operating systems), storage devices, and network devices.

[0060] According to the logical function division, the PaaS (Platform as a Service) layer can be deployed on the IaaS (Infrastructure as a Service) layer, and the SaaS (Software as a Service) layer can be deployed on the PaaS layer. SaaS can also be deployed directly on IaaS. PaaS is a platform for software operation, such as databases, web containers, etc. SaaS is a variety of business software, such as web portals, SMS mass senders, etc. Generally speaking, SaaS and PaaS are upper layers relative to IaaS.

[0061] Next, the technical solutions such as the abnormal order identification method, abnormal order identification device, computer-readable medium and electronic device provided in the present application are described in detail in combination with specific implementation methods.

[0062] Figure 2 The schematic diagram shows the steps of the abnormal order identification method in one embodiment of the present application. The abnormal order identification method is executed by a server, which can be Figure 1 The server 120 in FIG. Figure 2As shown, the abnormal order identification method in the embodiment of the present application may mainly include the following steps S210 to S230.

[0063] Step S210: acquiring multiple groups of to-be-processed order data containing multi-dimensional feature data, and pre-processing the to-be-processed order data;

[0064] Step S220: performing dimensionality reduction processing on the pre-processed order data to be processed to obtain target order data containing main features;

[0065] Step S230: Input the target order data into an anomaly detection model, and process the target order data through the anomaly detection model to obtain an anomaly result corresponding to the order data to be processed, wherein the anomaly detection model is trained based on an adaptive learning rate strategy and an active learning strategy.

[0066] In the abnormal order identification method provided in the embodiment of the present application, the obtained multiple groups of to-be-processed order data containing multi-dimensional feature data are preprocessed; then dimensionality reduction processing is performed to obtain target order data containing main features; finally, the target order data is input into the anomaly detection model, and the target order data is processed by the anomaly detection model to obtain abnormal results corresponding to the to-be-processed order data, wherein the anomaly detection model is trained based on an adaptive learning rate strategy and an active learning strategy. On the one hand, the present application can train an anomaly detection model based on an adaptive learning rate strategy and an active learning strategy, shorten the model training time, and improve the model performance; on the other hand, it can improve the accuracy and efficiency of abnormal order identification in high-dimensional scenarios.

[0067] The specific implementation method of each method step of the abnormal order identification method in the embodiment of the present application is described in detail below.

[0068] In step S210, multiple groups of to-be-processed order data containing multi-dimensional feature data are obtained, and the to-be-processed order data are pre-processed.

[0069] In one embodiment of the present application, the order data in the e-commerce platform has the characteristics of high dimension, large scale, complexity and dynamics, among which the high dimension is reflected in the fact that the user's behavior data includes browsing, searching, clicking, collecting, purchasing, evaluating and other behaviors, and each behavior is related to multiple factors such as time, place, and commodity type, which constitutes high-dimensional data; the large scale is reflected in the fact that there are many users on the e-commerce platform, and a large amount of behavior data is generated every day, forming a large-scale data set; the complexity is reflected in the fact that the user's behavior data includes data of multiple structures, such as structured data such as purchase quantity and price, discrete data types such as commodity type and payment method, continuous data types such as browsing time and shopping expenses, time series data such as user's browsing and purchasing history, and unstructured data such as evaluation content and search keywords, etc. The user's behavior is also affected by multiple factors, such as personal preferences, time, place, commodity type, etc., forming a complex behavior pattern; the dynamicity is reflected in the fact that the user's behavior pattern is not static and unchanged, but will change with time and situation. Traditional anomaly detection methods usually assume that data is low-dimensional, static, and structured, which is obviously inappropriate for high-dimensional data.

[0070] In one embodiment of the present application, in order to improve the accuracy of anomaly detection for high-dimensional order data, first, multiple groups of pending order data containing multi-dimensional feature data can be obtained and pre-processed to provide a basis for subsequent abnormal data detection. The multiple groups of pending order data containing multi-dimensional feature data can be all order data within a certain time range in the e-commerce platform, can be all order data corresponding to the same user in the e-commerce platform, can be all order data corresponding to the same category of goods in the e-commerce platform, and of course can also be order data under other conditions. The business party can set it according to actual business needs, and the embodiment of the present application does not specifically limit this.

[0071] In one embodiment of the present application, the preprocessing of the order data to be processed is mainly for processing missing values, and the processing methods of missing values ​​are different for different types of features. When the feature type of the missing value is a numerical feature, the mean, median or mode is determined according to the order data to be processed, and the missing value is filled with the mean, median or mode; when the feature type of the missing value is a categorical feature, the category with the highest frequency of occurrence in the order data to be processed is used to fill the missing value. For example, when a category is missing, the frequency of occurrence of each feature category in other groups of order data to be processed can be counted, and the missing value is filled according to the feature category with the highest frequency of occurrence. It is worth noting that the categories in the embodiments of the present application are information of different dimensions in the order, such as purchase price, number of views, evaluation, purchase quantity, and so on.

[0072] Furthermore, the pending order data after missing value filling can be standardized, and the processed pending order data can be scaled to the target value range according to the preset rules. The target value range is [0,1] or [-1,1], which can avoid the influence of individual data on the subsequent abnormal data detection. For example, the purchase price range is very large, ranging from a few yuan to tens of thousands of yuan. If the purchase price is not processed, a small number of high purchase prices may affect the final abnormal data detection results.

[0073] In one embodiment of the present application, after the missing values ​​are filled, outlier processing can also be performed on the order data to be processed, and outliers in the order data to be processed can be preliminarily identified, and replaced with the average values ​​of the upper and lower bounds in the normal value interval or the outliers can be deleted, wherein the normal value interval can be determined according to the 3σ criterion, for example. Outlier processing can reduce the amount of data processing for subsequent abnormal analysis, improve data processing efficiency, and reduce costs. After completing the outlier processing, the data can be standardized and scaled to the target value range.

[0074] In step S220, the pre-processed order data to be processed is subjected to dimensionality reduction processing to obtain target order data containing main features.

[0075] In one embodiment of the present application, since the order data to be processed is high-dimensional data, in order to improve data processing efficiency, anomaly detection can be performed on the principal component data in the order data to be processed. The principal component is a relatively important feature in the order data to be processed, such as product type, number of purchases within a preset time period, etc.

[0076] Figure 3 The schematic diagram of the process of dimensionality reduction processing is shown schematically. Figure 3 As shown, the process of dimensionality reduction processing at least includes steps S301-S303, specifically:

[0077] In step S301, the pre-processed order data to be processed is centralized, a covariance matrix is ​​constructed according to the centrally processed order data to be processed and the corresponding features, and the eigenvalues ​​and eigenvectors of the covariance matrix are determined.

[0078] In one embodiment of the present application, all the order data to be processed are constructed according to the corresponding features to form an original matrix, and the size of the original matrix is ​​n×p, where n is the amount of data and p is the number of features. Then, the original matrix is ​​centralized to make the mean of the data zero, wherein the centralization is achieved by subtracting each data from the corresponding feature mean, and the specific expression is shown in formula (1):

[0079] X centered=X-mean(X) (1)

[0080] Among them, X centered is the centered matrix, X is the original matrix formed by the order data to be processed, and mean(X) is the average value calculated along each feature of X.

[0081] In one embodiment of the present application, after obtaining a centralized matrix formed by the centralized data, a corresponding covariance matrix can be constructed based on the centralized matrix. The specific expression is shown in formula (2):

[0082]

[0083] Among them, C is the covariance matrix with a size of p×p, and T represents the transposed matrix.

[0084] In one embodiment of the present application, after obtaining the covariance matrix C, the eigenvalues ​​and eigenvectors of the covariance matrix C are calculated. The method for calculating the eigenvalues ​​and eigenvectors is a well-known method in the art and will not be described in detail here.

[0085] In step S302, the eigenvalues ​​are sorted from large to small to form an eigenvalue sequence, target eigenvectors corresponding to a preset number of eigenvalues ​​in the eigenvalue sequence are obtained in sequence, and a main eigenmatrix is ​​constructed according to the target eigenvectors.

[0086] In one embodiment of the present application, after obtaining all the eigenvalues ​​of the covariance matrix C, they can be arranged in order from large to small to form an eigenvalue sequence, and the k largest eigenvalues ​​are extracted from the eigenvalue sequence in turn, and the eigenvectors corresponding to the k largest eigenvalues ​​are obtained as target eigenvectors, and the principal component feature matrix is ​​constructed according to the target eigenvector. The size of the principal component feature matrix is ​​p×k, that is, the eigenvectors corresponding to the k largest eigenvalues ​​are the eigenvectors corresponding to the required principal components. Among them, k is a non-zero hyperparameter and is a number much smaller than the total number of features corresponding to the order data to be processed, and can be adjusted according to actual needs.

[0087] In step S303, a first dimensionality reduction matrix is ​​determined based on the to-be-processed order data after centralization and the principal component feature matrix, features in the first dimensionality reduction matrix are screened to obtain a second dimensionality reduction matrix, and data in the second dimensionality reduction matrix is ​​used as the target order data.

[0088] In one embodiment of the present application, after obtaining the principal component feature matrix, the original matrix can be multiplied by the principal component feature matrix to obtain a first dimension reduction matrix. The first dimension reduction matrix, the original matrix, and the principal component feature matrix satisfy the relationship (3):

[0089] Y=X centered×W (3)

[0090] Among them, Y is the first dimension reduction matrix, and W is the principal component feature matrix.

[0091] In one embodiment of the present application, although the first dimension reduction matrix is ​​determined according to the principal component feature matrix, in order to further reduce the amount of data processing, it is also necessary to select the features in the first dimension reduction matrix to obtain the second dimension reduction matrix. When selecting the features in the first dimension reduction matrix, it can be achieved by a lasso regression model or a recursive feature elimination method. When the lasso regression model is used for feature selection, the objective function is the objective function of linear regression plus a multiple of the L1 norm of the parameter vector, and then based on the L1 norm penalty, the coefficients of the features are compressed and some regression coefficients are changed to 0, thereby achieving the purpose of feature selection. When solving, methods such as coordinate descent method and least angle regression method (LARS) can be used. The solution process is an iterative process, and the parameter vector needs to be updated at each step; when the recursive feature elimination method is used for feature selection, all features can be used to train a model first; then the feature importance of the model is calculated. For linear models, the parameters of the model can be directly used as the feature importance; for models such as decision trees or random forests, feature importance scores can be used; then one or more of the least important features are removed according to the feature importance; the above steps are repeated until the predetermined number of features is obtained. Recursive feature elimination gradually approaches the best feature subset by repeatedly training the model and removing the least important features. This method is more complex, but it can usually produce better results than simply using model parameters or feature importance scores.

[0092] In step S230, the target order data is input into an anomaly detection model, and the target order data is processed by the anomaly detection model to obtain an anomaly result corresponding to the order data to be processed, wherein the anomaly detection model is trained based on an adaptive learning rate strategy and an active learning strategy.

[0093] In one embodiment of the present application, the order data contained in the second dimensionality reduction matrix is ​​the target order data. By detecting the target order data with a trained anomaly detection model, the abnormal data therein can be obtained, and the abnormal results corresponding to different orders can be obtained. When at least one data in the order data is detected as abnormal data, the order corresponding to the abnormal data is the abnormal order. The abnormal results corresponding to the abnormal order can be determined according to the type of abnormal data, such as account theft, order brushing, false comments, changes in shopping habits, etc. The anomaly detection model in the present application can be any classification model, such as a decision tree, random forest, etc., and the embodiments of the present application do not specifically limit this.

[0094] In one embodiment of the present application, before using the anomaly detection model to perform anomaly detection on the target order data, it is also necessary to train the anomaly detection model to be trained to obtain a convergent and stable anomaly detection model to ensure the accuracy of the anomaly detection result. In an embodiment of the present application, an active learning strategy and an adaptive learning rate strategy can be used for model training. Next, the model training process is described in detail.

[0095] In one embodiment of the present application, an order sample data set is first obtained, and then each group of order sample data included in the order sample data set is used to train the anomaly detection model to be trained, so as to obtain the anomaly detection model.

[0096] In one embodiment of the present application, the order sample data set includes a labeled data set and an unlabeled data set, wherein the labeled data set includes the order sample data and abnormal labels corresponding to the order sample data, and the unlabeled data set only includes the order sample data. Figure 4 The schematic diagram shows the process of obtaining the order sample data set. Figure 4 As shown, in step S401, order data corresponding to multiple orders are obtained from the e-commerce platform as order sample data; in step S402, all order sample data are preprocessed, and missing values ​​in the order sample data are filled. The missing values ​​include missing numerical features or categorical features. When the missing value is a numerical feature, the average value, median or mode of the order sample data is used to fill it. When the missing value is a categorical feature, the category with the highest frequency in other order sample data is used to fill it. After completing the missing value filling, the data is standardized and scaled to the target data range; then, all the scaled order The sample data is processed for dimensionality reduction to obtain target order sample data containing main features; in step S403, the target order sample data is divided into a first order sample data subset and a second order sample data subset according to the corresponding orders, and an unlabeled data set is constructed based on the target order sample data in the first order sample data subset; in step S404, outlier detection is performed on the target order sample data in the second order sample data subset, and a labeled data set is constructed based on the target order sample data in the second order sample data subset and the corresponding labels; in step S405, an order sample data set is constructed based on the unlabeled data set and the labeled data set.

[0097] Among them, in step S404, when outlier detection is performed on the target order sample data, it can be achieved by manual labeling or detector detection, and the embodiment of the present application does not make any specific limitations on this.

[0098] Figure 5The schematic diagram shows the process flow of the detector performing outlier detection on the target order sample data, as shown in Figure 5 As shown, the process at least includes steps S501-S505, which are as follows:

[0099] In step S501, target order sample data of the second order sample data subset are polled, and any target order sample data is taken as target data.

[0100] In one embodiment of the present application, the second order sample data subset includes multiple data corresponding to different main features. As long as there is abnormal data in each order, the corresponding order is also abnormal. Therefore, it is necessary to perform anomaly detection on each data in the second order sample data subset. Accordingly, any target order sample data in the second order sample data subset can be used as target data, and outlier detection can be performed on it.

[0101] In step S502, a k-distance is determined according to the target data and the kth nearest neighbor data corresponding to the target data, where k is a positive integer.

[0102] In one embodiment of the present application, for the target data x i , the distance between it and other sample data in the target order sample data can be calculated, and the kth nearest neighbor data corresponding to the target data can be determined according to the calculated distance, and the nearest neighbor distance K-dist(x i ).

[0103] In step S503, the direct distance between the target data and the k-th nearest neighbor data is obtained, and the reachable distance corresponding to the target data is determined according to the k-distance and the direct distance.

[0104] In one embodiment of the present application, the reachable distance corresponding to the target data can be obtained, and the reachable distance represents the distance from the target data x to the target data x. i To the kth nearest neighbor data x j How far do you need to go at least? The reachable distance can be determined based on the k-distance and the direct distance between the target data and the kth nearest neighbor data, as shown in formula (4):

[0105]

[0106] Among them, d(x i , x j ) is the data x i and x j The direct distance between.

[0107] In step S504, a local reachable density corresponding to the target data is determined according to the reachable distances corresponding to the k nearest neighbor data of the target data, and a local outlier factor corresponding to the target data is determined based on the local reachable density.

[0108] In one embodiment of the present application, the target data x can be obtained based on step S502 and step S503. i The reachable distance between the target data x and its k nearest neighbors i The reachable distance between the target data x and its k nearest neighbor data can be calculated i The local reachable density of is expressed as shown in formula (5):

[0109]

[0110] Among them, x j ∈N k (x i ) represents the target data x i The k nearest neighbor data.

[0111] In one embodiment of the present application, the local outlier factor corresponding to the target data can be determined according to the local reachable density corresponding to the target data. The specific expression is shown in formula (6):

[0112]

[0113] Among them, LOF k (x i ) represents the target data x i The local outlier factor of Represents data x j The local reachable density of Represents the target data x i The local reachable density of k is the target data x i The number of nearest neighbors.

[0114] In step S505, it is determined whether the target data is abnormal data according to the local outlier factor and a preset threshold, and a label corresponding to the target data is determined according to the determination result.

[0115] In one embodiment of the present application, the local outlier factor represents the target data x i The relative density of other points in its neighborhood is used to obtain the target data x i After the local outlier factor is obtained, the local outlier factor can be compared with a preset threshold, and whether the target data is abnormal data can be determined according to the comparison result, and then the label of the order containing the target data can be determined according to the abnormality detection result of the target data.

[0116] In one embodiment of the present application, the preset threshold can be set to 1. k (x i )~1, it means the target data x i The density of LOF is basically consistent with the density of its surrounding neighbors, without any abnormality. k (x i )<1, it means that the target data x i The density is higher than that of its neighbors, and the target data x i is the dense point (Inlier); when LOF k (x i )>1, it means the target data x i The density of the target data x is smaller than that of its neighbors. i In the embodiment of the present application, the target data x i The degree of exceeding the preset threshold determines the target data x i Is it abnormal data? For example, you can set a rule that when the target data xi exceeds the preset threshold by more than 100%, the target data x is considered abnormal. i is abnormal data. If it does not exceed 100%, the target data x i If it is not abnormal data, of course, other rules can be set, and the embodiment of the present application does not specifically limit this. By setting this rule to judge abnormal data, the amount of abnormal data can be reduced, misjudgment can be avoided, and the fairness and user experience of the e-commerce platform can be guaranteed.

[0117] In one embodiment of the present application, when using each group of order sample data contained in the order sample data set to train the anomaly detection model to be trained, an active learning strategy and an adaptive learning rate strategy can be used for training. The adaptive learning rate strategy is iteratively executed along with the iteration of active learning. That is to say, in each round of training, the model parameters are determined based on the adaptive learning rate strategy to perform model optimization.

[0118] After obtaining the labeled data set and the unlabeled data set, one or more data with the largest amount of information can be actively selected from the unlabeled data set, and then the data with the largest amount of information is manually labeled to determine the corresponding anomaly labels, and then the data with the largest amount of information and the corresponding anomaly labels are added to the labeled data set, and the labeled data set is used to train the anomaly detection model to be trained. During the training process, an adaptive learning rate strategy is used to determine the model parameters and optimize the model until a preset number of trainings are completed or the model performance reaches a threshold, and the training is stopped to obtain the final anomaly detection model.

[0119] Among them, actively selecting one or more data with the largest amount of information from the unlabeled data set can be determined based on the maximum uncertainty strategy, the maximum predicted change strategy or the maximum impact strategy, specifically:

[0120] (1) Maximum uncertainty strategy

[0121] The data with the greatest uncertainty is selected, usually using the probability distribution of the classifier output. For a binary classification problem, the absolute value of the predicted probability can be used to measure uncertainty, as shown in formula (7):

[0122] x i = arg max x∈U |P(y=1|x,M)-0.5| (7)

[0123] Among them, xi is the data with the largest amount of information, U is the data in the unlabeled data set, M is the classifier, and y=1 means that the detector output result is abnormal.

[0124] (2) Maximum Prediction Change Strategy

[0125] Use multiple different machine learning models to predict the data in the unlabeled data set, and select the data with the largest prediction difference between the various machine learning models as the data with the largest amount of information. Among them, the machine learning model may be the same as the anomaly detection model to be trained, or it may be different. For example, it can be a decision tree, a random forest, etc. In the embodiment of the present application, the KL divergence can be used to measure the prediction difference, and the expression is shown in formula (8):

[0126]

[0127] Among them, C is the number of categories of the classification results, usually 2, U is the unlabeled dataset, x is the unlabeled data in the unlabeled dataset, and M and M' are different machine learning models.

[0128] (3) Maximum impact strategy

[0129] The data with the greatest impact on the current model parameter update is selected as the data with the greatest amount of information. The influence can be measured using gradient information, as shown in formula (9):

[0130]

[0131] Among them, U is the unlabeled dataset, x is the unlabeled data in the unlabeled dataset, M is the current model, and L is the loss function.

[0132] In one embodiment of the present application, data with the maximum amount of information and corresponding anomaly labels can be added to a labeled data set, and then the anomaly detection model to be trained is trained based on the labeled data set. During the training process, the model parameters can be determined based on an adaptive learning rate strategy. Next, the method for determining the model parameters based on the adaptive learning rate strategy is described in detail.

[0133] S11, obtaining initialization parameters; for different training rounds, the initialization parameters are different. When the anomaly detection model to be trained is trained for the first round, some parameters can be set as initialization parameters. When the anomaly detection model to be trained is trained for the second round, the model parameters determined in the first round of training are the initialization parameters, and so on.

[0134] In one embodiment of the present application, the initialization parameters include weight w, bias b, first-order moment estimate m (momentum), second-order moment estimate v (RMSProp), time step t, learning rate α, first-order moment decay factor β1, second-order moment decay factor β2, and a small constant ε to prevent division by zero.

[0135] S12, according to the objective function related to the weight w and the bias b, the first gradient corresponding to the weight w and the second gradient corresponding to the bias b are calculated, and the gradient and the objective function, the weight, and the bias satisfy the relationship (10):

[0136]

[0137] Among them, g w is the gradient of the objective function L(w, b) with respect to the weight w, g b is the gradient of the objective function L(w,b) with respect to the bias b.

[0138] S13, update the first-order moment estimate and the second-order moment estimate according to the first-order moment decay factor, the second-order moment decay factor, the first gradient and the second gradient; update the first-order moment estimate and the second-order moment estimate using the weighted average value of the gradient. The first-order moment estimate includes a weighted first-order moment estimate and a biased first-order moment estimate, and the second-order moment estimate includes a weighted second-order moment estimate and a deflected second-order moment estimate. The weighted first-order moment estimate, the biased first-order moment estimate, the weighted second-order moment estimate, and the deflected second-order moment estimate respectively satisfy the relationship shown in formulas (11)-(14) with the first-order moment decay factor, the second-order moment decay factor, the first gradient and the second gradient:

[0139] m' w =β1×m w +(1-β1)×g w (11)

[0140] m' b =β1×m b +(1-β1)×g b (12)

[0141]

[0142]

[0143] Among them, m w ' is the weighted first-order moment estimate, β1 is the first-order moment decay factor, g w is the first gradient, m b ' is the biased first-order moment estimate, v w ' is the weighted second-order moment estimate, v b ' is the weighted second-order moment estimate, β2 is the second-order moment decay factor, g b is the second gradient.

[0144] S14, the updated first-order moment estimate and second-order moment estimate are corrected according to the time step, the first-order moment decay factor and the second-order moment decay factor; the first-order moment estimate and the second-order moment estimate respectively satisfy the relationship shown in formulas (15)-(18) with the time step, the first-order moment decay factor and the second-order moment decay factor:

[0145]

[0146]

[0147]

[0148]

[0149] in, is the modified weighted first-order moment estimate, is the corrected biased second-order moment estimate, is the corrected biased first-order moment estimate, is the corrected biased second-order moment estimate, t is the current time step, and the current time step can be understood as the number of rounds of current parameter optimization.

[0150] S15, updating the weights and biases according to the corrected first-order moment estimate, the corrected second-order moment estimate, the learning rate and the small constant.

[0151] The updated weights and the corrected weight first-order moment estimate, the corrected weight second-order moment estimate, the learning rate and the small constant satisfy the relationship (19):

[0152]

[0153] Where w' is the updated weight and sqrt(·) is the square root operation.

[0154] The updated bias and the corrected bias first-order moment estimate, the corrected bias second-order moment estimate, the learning rate and the small constant satisfy the relationship (20):

[0155]

[0156] Where b' is the updated bias and sqrt(·) is the square root operation.

[0157] Repeat the process of S11-S15 until the termination condition is met, which can be the maximum number of iterations or the gradient change of the weight and bias is less than a certain threshold. It is worth noting that the learning rate is also variable, which can be determined according to the gradient change of the weight and bias. When the gradient change of the weight and bias is less than a certain threshold, the corresponding learning rate is the optimal learning rate.

[0158] After the model parameters are determined through the adaptive learning rate strategy, the model parameters can be assigned to the anomaly detection model to be trained, and then the anomaly detection model to be trained is trained again according to the active learning strategy until a preset number of training times is reached or the model performance reaches a threshold.

[0159] In the embodiments of the present application, by determining the model parameters based on an adaptive learning rate strategy, the model training time can be shortened, the model training efficiency can be improved, and the model performance can be enhanced. At the same time, training the model based on an active learning strategy can reduce the amount of label annotation tasks and reduce labor costs.

[0160] In one embodiment of the present application, after completing the model training and obtaining the anomaly detection model, it is also necessary to evaluate the performance of the anomaly detection model and adjust the parameters according to the evaluation results. The model performance can be evaluated by cross-validation and AUC-ROC curve, wherein cross-validation is a method for evaluating the generalization performance of the model, mainly used for parameter tuning and model selection; AUC-ROC curve is a method for evaluating the performance of the classification model, mainly used for unbalanced data sets.

[0161] Commonly used cross-validation methods include K-Fold cross-validation and leave-one-out cross-validation. Specifically, K-Fold cross-validation: randomly and evenly divide the training data set into K subsets; for each subset, use it as the validation set, and the remaining K-1 subsets as the training set, train the model and calculate the performance indicators on the validation set; take the average of the K-times performance indicators as the final evaluation result of the model. Leave-one-out cross-validation: When K is equal to the total number of samples N, K-Fold cross-validation becomes leave-one-out cross-validation. The advantage of leave-one-out cross-validation is that it uses the most data for training, but the computational cost is often relatively high.

[0162] The ROC curve is a curve drawn with the false positive rate (FPR) as the horizontal axis and the true positive rate (TPR) as the vertical axis. AUC (Area Under Curve) is the area under the ROC curve. The specific steps are as follows: Calculate all possible TPRs and FPRs based on the model's predicted probability for each sample; Draw the ROC curve with FPR as the horizontal axis and TPR as the vertical axis; Calculate the area under the ROC curve AUC. The closer the AUC value is to 1, the better the classification performance of the model.

[0163] According to the above-mentioned cross-validation and AUC-ROC curve evaluation method, the performance evaluation and parameter adjustment of the anomaly detection model trained in the embodiment of the present application can be performed, and the final anomaly detection model is used as the final anomaly detection model for abnormal order identification.

[0164] In one embodiment of the present application, after the abnormality detection is performed on the order data to be processed by the abnormality detection model, the detection result can be output and displayed in the display interface of the terminal device. In the display interface, the abnormal results corresponding to each order can be displayed, and the abnormal proportion and normal proportion in the order data to be processed can also be displayed, so that the business personnel can determine the cause and impact of the abnormality according to the displayed information, and provide a basis for decision-making. The abnormal results corresponding to the order can be specific abnormal types, such as account theft, order brushing, false comments, etc. According to these abnormal results, the business personnel can perform corresponding processing, such as reminding the user to reset the password, improve the security level of the stolen account; punish the order brushing behavior; delete false comments, etc. Further, according to the detection and analysis results, the user experience and business decisions can be optimized. For example, for users who are identified as suddenly changing their shopping habits, the recommendation strategy can be adjusted to provide products that better meet the current needs of users. For merchants identified as order brushing or false comments, corresponding penalties can be imposed to ensure the fairness and justice of the e-commerce platform.

[0165] In addition to being applied to e-commerce platform scenarios, the abnormal order identification method in the present application can also be applied to other scenarios, such as classifying users through abnormal order identification, recommending products to users through abnormal order identification, and other scenarios.

[0166] The abnormal order identification method provided in the embodiment of the present application pre-processes the obtained multiple groups of pending order data containing multi-dimensional feature data; then performs dimensionality reduction processing to obtain target order data containing main features; finally, the target order data is input into the anomaly detection model, and the target order data is processed by the anomaly detection model to obtain abnormal results corresponding to the pending order data, wherein the anomaly detection model is trained based on the adaptive learning rate strategy and the active learning strategy. On the one hand, the present application can train the anomaly detection model based on the adaptive learning rate strategy and the active learning strategy, shorten the model training time, and improve the model performance; on the other hand, it can improve the accuracy and efficiency of abnormal order identification in high-dimensional scenarios.

[0167] It can be understood that in the specific implementation of this application, it involves the collection of multimedia-related data. When the above embodiments of this application are applied to specific products or technologies, user / platform permission or consent is required, and the collection, use and processing of relevant data need to comply with relevant laws, regulations and standards of relevant countries and regions.

[0168] It should be noted that although the steps of the method in the present application are described in a specific order in the drawings, this does not require or imply that the steps must be performed in this specific order, or that all the steps shown must be performed to achieve the desired results. Additionally or alternatively, some steps may be omitted, multiple steps may be combined into one step, and / or one step may be decomposed into multiple steps, etc.

[0169] The following introduces an apparatus embodiment of the present application, which can be used to execute the abnormal order identification method in the above-mentioned embodiment of the present application. Figure 6 The structure block diagram of the abnormal order identification device provided in the embodiment of the present application is schematically shown as follows: Figure 6 As shown, the abnormal order identification device 600 includes: a pre-processing module 610, a dimension reduction module 620 and an abnormality identification module 630, specifically:

[0170] A preprocessing module 610 is used to obtain multiple groups of to-be-processed order data containing multi-dimensional feature data, and preprocess the to-be-processed order data;

[0171] A dimension reduction module 620 is used to perform dimension reduction processing on the pre-processed order data to be processed, and obtain target order data containing main features;

[0172] The anomaly identification module 630 is used to input the target order data into an anomaly detection model, and process the target order data through the anomaly detection model to obtain an anomaly result corresponding to the order data to be processed, wherein the anomaly detection model is trained based on an adaptive learning rate strategy and an active learning strategy.

[0173] In some embodiments of the present application, based on the above technical solution, the preprocessing module 610 includes: a preprocessing unit, which is used to process the missing values ​​in the order data to be processed and standardize the processed order data to be processed.

[0174] In some embodiments of the present application, based on the above technical solution, the preprocessing unit is configured as follows: when the feature type of the missing value is a numerical feature, the mean, median or mode is determined according to the order data to be processed, and the missing value is filled with the mean, median or mode; when the feature type of the missing value is a categorical feature, the missing value is filled with the category with the highest frequency in the order data to be processed.

[0175] In some embodiments of the present application, based on the above technical solution, the preprocessing unit is configured to: scale the processed order data to be processed to a target numerical range according to preset rules.

[0176] In some embodiments of the present application, based on the above technical solution, the dimension reduction module 620 includes: a matrix construction unit, which is used to centralize the pre-processed order data to be processed, construct a covariance matrix according to the centralized order data to be processed and the corresponding features, and determine the eigenvalues ​​and eigenvectors of the covariance matrix; a principal component acquisition unit, which is used to sort the eigenvalues ​​from large to small to form an eigenvalue sequence, sequentially obtain the target eigenvectors corresponding to a preset number of eigenvalues ​​in the eigenvalue sequence, and construct a principal component feature matrix according to the target eigenvector; a dimension reduction unit, which is used to determine a first dimensionality reduction matrix according to the centralized order data to be processed and the principal component feature matrix, screen the features in the first dimensionality reduction matrix to obtain a second dimensionality reduction matrix, and use the data in the second dimensionality reduction matrix as the target order data.

[0177] In some embodiments of the present application, based on the above technical solution, the abnormal order identification device 600 also includes: a training module, which is used to obtain an order sample data set before inputting the target order data into the abnormal detection model, and train the abnormal detection model to be trained according to each group of order sample data in the order sample data set to obtain the abnormal detection model.

[0178] In some embodiments of the present application, based on the above technical solution, the training module includes: a sample preprocessing unit, used to preprocess the order sample data, and perform dimensionality reduction processing on the preprocessed order sample data to obtain target order sample data containing main features; an unlabeled data set construction unit, used to divide the order sample data in the order sample data set into a first order sample data subset and a second order sample data subset according to the order, and construct an unlabeled data set according to the target order sample data in the first order sample data subset; a labeled data set construction unit, used to perform outlier detection on the target order sample data in the second order sample data subset, and construct a labeled data set according to the target order sample data in the second order sample data subset and the corresponding labels; a training unit, used to train the anomaly detection model to be trained according to the unlabeled data set and the labeled data set to obtain the anomaly detection model.

[0179] In some embodiments of the present application, based on the above technical solution, the annotation data set construction unit is configured to: poll the target order sample data of the second order sample data subset, and take any of the target order sample data as the target data; determine the k-distance according to the target data and the kth nearest neighbor data corresponding to the target data, where k is a positive integer; obtain the direct distance between the target data and the kth nearest neighbor data, and determine the reachable distance corresponding to the target data according to the k-distance and the direct distance; determine the local reachable density corresponding to the target data according to the reachable distance corresponding to the k nearest neighbor data of the target data, and determine the local outlier factor corresponding to the target data based on the local reachable density; determine whether the target data is abnormal data according to the local outlier factor and a preset threshold, and determine the label corresponding to the order containing the target data according to the judgment result.

[0180] In some embodiments of the present application, based on the above technical solution, the training unit includes: an active selection unit, which is used to actively select data with the largest amount of information from the unlabeled data set, determine the label corresponding to the data with the largest amount of information by manual labeling, and update the labeled data set according to the data with the largest amount of information and the label; an optimization unit, which is used to train the anomaly detection model to be trained according to the updated labeled data set, and optimize the parameters of the anomaly detection model to be trained through an adaptive learning rate strategy during the training process; a loop unit, which is used to repeat the above process until the preset training conditions are met to obtain the anomaly detection model.

[0181] In some embodiments of the present application, based on the above technical solution, the optimization unit is configured to: obtain initial parameters, the initial parameters including weight, bias, first-order moment estimate, second-order moment estimate, time step, learning rate, first-order moment decay factor, second-order moment decay factor and small constant; determine the first gradient corresponding to the weight and the second gradient corresponding to the bias according to the objective function; the objective function is related to the weight and the bias; update the first-order moment estimate and the second-order moment estimate according to the first-order moment decay factor, the second-order moment decay factor, the first gradient and the second gradient; correct the updated first-order moment estimate and the second-order moment estimate according to the time step, the first-order moment decay factor and the second-order moment decay factor; update the weight and the bias according to the corrected first-order moment estimate, the corrected second-order moment estimate, the learning rate and the small constant.

[0182] In some embodiments of the present application, based on the above technical solution, the optimization unit is further configured to: determine the optimal learning rate according to the gradient corresponding to the updated weight and the updated bias.

[0183] In some embodiments of the present application, based on the above technical solution, the active selection unit is configured to: adopt a maximum uncertainty strategy, a maximum predicted change strategy or a maximum impact strategy to determine the data with the maximum amount of information.

[0184] In some embodiments of the present application, based on the above technical solution, the abnormal order identification device 600 also includes: an evaluation module, which is used to evaluate the performance of the abnormal detection model by using a cross-validation method and an AUC-ROC curve after completing the training of the abnormal detection model to be trained.

[0185] The specific details of the abnormal order identification device provided in each embodiment of the present application have been described in detail in the corresponding method embodiments and will not be repeated here.

[0186] Figure 7 The computer system structure block diagram of the electronic device used to implement the embodiment of the present application is schematically shown. The electronic device may be as follows: Figure 1 The terminal device 110 or the server 120 shown in FIG.

[0187] It should be noted that Figure 7 The computer system 700 of the electronic device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0188] like Figure 7As shown, the computer system 700 includes a central processing unit 701 (CPU), which can perform various appropriate actions and processes according to the program stored in the read-only memory 702 (ROM) or the program loaded from the storage part 708 to the random access memory 703 (RAM). Various programs and data required for system operation are also stored in the random access memory 703. The central processing unit 701, the read-only memory 702 and the random access memory 703 are connected to each other through a bus 704. An input / output interface 705 (Input / Output interface, i.e., I / O interface) is also connected to the bus 704.

[0189] In some embodiments, the following components are connected to the input / output interface 705: an input section 706 including a keyboard, a mouse, etc.; an output section 707 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker; a storage section 708 including a hard disk, etc.; and a communication section 709 including a network interface card such as a local area network card, a modem, etc. The communication section 709 performs communication processing via a network such as the Internet. A drive 710 is also connected to the input / output interface 705 as needed. A removable medium 711, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 710 as needed, so that a computer program read therefrom is installed into the storage section 708 as needed.

[0190] In particular, according to an embodiment of the present application, the process described in each method flow chart can be implemented as a computer software program. For example, an embodiment of the present application includes a computer program product, which includes a computer program carried on a computer readable medium, and the computer program contains a program code for executing the method shown in the flow chart. In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 709, and / or installed from the removable medium 711. When the computer program is executed by the central processor 701, various functions defined in the system of the present application are executed.

[0191] It should be noted that the computer-readable medium shown in the embodiment of the present application can be a computer-readable signal medium or a computer-readable medium or any combination of the above two. Computer-readable media can be, for example, - but not limited to - electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or devices, or any combination of the above. More specific examples of computer-readable media can include, but are not limited to: electrical connections with one or more wires, portable computer disks, hard disks, random access memories (RAM), read-only memories (ROM), erasable programmable read-only memories (Erasable Programmable Read Only Memory, EPROM), flash memory, optical fibers, portable compact disk read-only memories (Compact Disc Read-Only Memory, CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the above. In the present application, a computer-readable medium can be any tangible medium containing or storing a program, which can be used by an instruction execution system, device or device or used in combination with it. In the present application, a computer-readable signal medium can include a data signal propagated in a baseband or as a part of a carrier wave, wherein a computer-readable program code is carried. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Computer readable signal media may also be any computer readable medium other than computer readable media, which may send, propagate, or transmit programs for use by or in conjunction with an instruction execution system, apparatus, or device. The program code contained on the computer readable medium may be transmitted using any appropriate medium, including but not limited to: wireless, wired, etc., or any suitable combination of the above.

[0192] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present application. In this regard, each box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the above-mentioned module, program segment or a part of a code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flow chart, and the combination of the boxes in the block diagram or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0193] It should be noted that, although several modules or units of the equipment for action execution are mentioned in the above detailed description, this division is not mandatory. In fact, according to the embodiments of the present application, the features and functions of two or more modules or units described above can be embodied in one module or unit. On the contrary, the features and functions of one module or unit described above can be further divided into being embodied by multiple modules or units.

[0194] Through the description of the above implementation methods, it is easy for those skilled in the art to understand that the example implementation methods described here can be implemented by software or by combining software with necessary hardware. Therefore, the technical solution according to the implementation methods of the present application can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, and includes several instructions to enable an electronic device to execute the method according to the implementation methods of the present application.

[0195] Those skilled in the art will readily appreciate other embodiments of the present application after considering the specification and practicing the invention disclosed herein. The present application is intended to cover any modification, use or adaptation of the present application, which follows the general principles of the present application and includes common knowledge or customary technical means in the art that are not disclosed in the present application.

[0196] It should be understood that the present application is not limited to the precise structures that have been described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof. The scope of the present application is limited only by the appended claims.

Claims

1. A method for identifying abnormal orders, It is characterized in that include: Acquire multiple groups of to-be-processed order data containing multi-dimensional feature data, and pre-process the to-be-processed order data; Performing dimensionality reduction processing on the pre-processed order data to be processed to obtain target order data containing main features; The target order data is input into an anomaly detection model, and the target order data is processed by the anomaly detection model to obtain an anomaly result corresponding to the order data to be processed, wherein the anomaly detection model is trained based on an adaptive learning rate strategy and an active learning strategy.

2. The method according to claim 1, It is characterized in that The preprocessing of the to-be-processed order data includes: The missing values ​​in the order data to be processed are processed, and the processed order data to be processed are standardized.

3. The method according to claim 2, It is characterized in that The processing of missing values ​​in the to-be-processed order data includes: When the feature type of the missing value is a numerical feature, determining the mean value, median value or mode according to the order data to be processed, and using the mean value, median value or mode value to fill the missing value; When the feature type of the missing value is a categorical feature, the missing value is filled with the category that appears most frequently in the order data to be processed.

4. The method according to claim 2, It is characterized in that The step of performing standardization on the processed order data to be processed includes: The processed order data to be processed is scaled to a target value range according to preset rules.

5. The method according to claim 1, It is characterized in that The step of performing dimensionality reduction processing on the pre-processed order data to be processed to obtain target order data containing main features includes: Centralizing the preprocessed order data to be processed, constructing a covariance matrix according to the centrally processed order data to be processed and corresponding features, and determining eigenvalues ​​and eigenvectors of the covariance matrix; The eigenvalues ​​are sorted from large to small to form an eigenvalue sequence, target eigenvectors corresponding to a preset number of eigenvalues ​​in the eigenvalue sequence are sequentially obtained, and a principal component feature matrix is ​​constructed according to the target eigenvectors; A first dimensionality reduction matrix is ​​determined based on the to-be-processed order data after centralization and the principal component feature matrix, features in the first dimensionality reduction matrix are screened to obtain a second dimensionality reduction matrix, and data in the second dimensionality reduction matrix is ​​used as the target order data.

6. The method according to claim 1, It is characterized in that Before inputting the target order data into the anomaly detection model, the method further includes: An order sample data set is obtained, and an anomaly detection model to be trained is trained according to each group of order sample data in the order sample data set to obtain the anomaly detection model.

7. The method according to claim 6, It is characterized in that The training of the to-be-trained anomaly detection model according to each group of order sample data in the order sample data set to obtain the anomaly detection model comprises: Preprocessing the order sample data, and performing dimensionality reduction processing on the preprocessed order sample data to obtain target order sample data containing main features; Dividing the order sample data in the order sample data set into a first order sample data subset and a second order sample data subset according to the orders, and constructing an unlabeled data set according to the target order sample data in the first order sample data subset; Performing outlier detection on the target order sample data in the second order sample data subset, and constructing a labeled data set according to the target order sample data and corresponding labels in the second order sample data subset; The anomaly detection model to be trained is trained according to the unlabeled data set and the labeled data set to obtain the anomaly detection model.

8. The method according to claim 7, It is characterized in that The performing outlier detection on the target order sample data in the second order sample data subset includes: Polling the target order sample data of the second order sample data subset, and taking any of the target order sample data as target data; Determine a k-distance according to the target data and the kth nearest neighbor data corresponding to the target data, where k is a positive integer; Obtaining a direct distance between the target data and the k-th nearest neighbor data, and determining a reachable distance corresponding to the target data according to the k-distance and the direct distance; Determine a local reachable density corresponding to the target data according to the reachable distances corresponding to the k nearest neighbor data of the target data, and determine a local outlier factor corresponding to the target data based on the local reachable density; Whether the target data is abnormal data is determined according to the local outlier factor and a preset threshold, and a label corresponding to the order containing the target data is determined according to the determination result.

9. The method according to claim 7, It is characterized in that The training of the anomaly detection model to be trained according to the unlabeled data set and the labeled data set to obtain the anomaly detection model includes: Actively selecting data with the largest amount of information from the unlabeled data set, determining a label corresponding to the data with the largest amount of information by manual labeling, and updating the labeled data set according to the data with the largest amount of information and the label; Training the anomaly detection model to be trained according to the updated labeled data set, and optimizing the parameters of the anomaly detection model to be trained by an adaptive learning rate strategy during the training process; The above process is repeated until the preset training condition is reached to obtain the anomaly detection model.

10. The method according to claim 9, It is characterized in that Optimizing the parameters of the anomaly detection model to be trained by an adaptive learning rate strategy during the training process includes: Obtaining initial parameters, the initial parameters including weight, bias, first-order moment estimate, second-order moment estimate, time step, learning rate, first-order moment decay factor, second-order moment decay factor and a small constant; Determining a first gradient corresponding to the weight and a second gradient corresponding to the bias according to an objective function; the objective function is related to the weight and the bias; Update the first-order moment estimate and the second-order moment estimate according to the first-order moment decay factor, the second-order moment decay factor, the first gradient, and the second gradient; Correcting the updated first-order moment estimate and the second-order moment estimate according to the time step, the first-order moment decay factor, and the second-order moment decay factor; The weight and the bias are updated according to the modified first-order moment estimate, the modified second-order moment estimate, the learning rate and the small constant.

11. The method according to claim 10, It is characterized in that The method further comprises: An optimal learning rate is determined according to the gradient corresponding to the updated weight and the updated bias.

12. The method according to claim 9, It is characterized in that The actively selecting data with the maximum amount of information from the unlabeled data set includes: The data with the maximum amount of information is determined using a maximum uncertainty strategy, a maximum predicted change strategy, or a maximum impact strategy.

13. The method according to claim 6, It is characterized in that The method further comprises: After completing the training of the anomaly detection model to be trained, the performance of the anomaly detection model is evaluated using a cross-validation method and an AUC-ROC curve.

14. An abnormal order identification device, It is characterized in that include: A preprocessing module, used to obtain multiple groups of to-be-processed order data containing multi-dimensional feature data, and preprocess the to-be-processed order data; A dimension reduction module is used to perform dimension reduction processing on the pre-processed order data to be processed, and obtain target order data containing main features; An anomaly identification module is used to input the target order data into an anomaly detection model, and process the target order data through the anomaly detection model to obtain an anomaly result corresponding to the order data to be processed, wherein the anomaly detection model is trained based on an adaptive learning rate strategy and an active learning strategy.

15. A computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the abnormal order identification method described in any one of claims 1 to 13.

16. An electronic device, It is characterized in that include: processor; as well as A memory for storing instructions; Wherein, the processor executes the instructions stored in the memory to implement the abnormal order identification method described in any one of claims 1 to 13.

17. A computer program product, It is characterized in that The computer program product includes computer instructions, and when the computer instructions are executed on a computer, the computer is caused to execute the abnormal order identification method according to any one of claims 1 to 13.

Images