Index data early warning method and device based on isolated forest, computer equipment, storage medium and program product

Abstract

The invention relates to an index data early warning method and device based on an isolated forest, computer equipment, a computer readable storage medium and a computer program product, and relates to the technical field of data analysis. The method comprises the following steps: extracting to-be-detected financial index data, inputting the to-be-detected financial index data into a pre-trained isolated forest model, and determining an abnormal score of each piece of to-be-detected financial index data based on the pre-trained isolated forest model; comparing each abnormal score with a score threshold, and determining data corresponding to the abnormal score less than the score threshold as abnormal financial index data; determining a risk type, a risk event and a risk reason of each abnormal financial index data based on a preset risk analysis reference; an index data early warning report is generated at least based on the abnormal financial index data, the risk type, the risk event and the risk reason, and early warning of the financial index data is achieved; and automatic processing, intelligent analysis and efficient early warning of mass and high-dimensional financial index data are realized.

Description

Technical Field

[0001] The present application relates to the technical field of data analysis, and in particular to an indicator data early warning method, device, computer equipment, storage medium and program product based on isolation forest. Background Art

[0002] With the rapid development of smart grids, the financial risks faced by power grid companies are becoming increasingly complex and changeable. Among them, effective monitoring and early warning of financial indicator data have become the key to ensuring the stable operation of enterprises. At present, there are many data processing and risk early warning methods on the market, such as threshold judgment based on statistics and support vector machine (SVM) in machine learning. However, when these methods process large-scale, high-dimensional financial indicator data, they often face problems such as high computational complexity, insufficient early warning accuracy or poor model generalization ability.

[0003] Traditional statistical methods rely on preset thresholds and are difficult to adapt to the dynamically changing financial market environment. Complex machine learning models, such as SVM, although they have improved the accuracy of early warning to a certain extent, have a complex training process and are highly sensitive to outliers, and the overall early warning effect can easily be affected by a small amount of abnormal data. Summary of the invention

[0004] Based on this, it is necessary to provide an indicator data warning method, device, computer equipment, computer-readable storage medium and computer program product based on isolation forests, which can improve the accuracy and timeliness of financial data warnings in response to the above technical problems.

[0005] In a first aspect, the present application provides an indicator data early warning method based on isolation forest, which is applied to a power grid financial business system, and the method includes:

[0006] Extracting financial indicator data to be detected, and inputting the financial indicator data to be detected into a pre-trained isolation forest model, and determining anomaly scores of each of the financial indicator data to be detected based on the pre-trained isolation forest model;

[0007] Based on the comparison between each of the abnormal scores and the score threshold, determining that the financial indicator data to be detected corresponding to each of the abnormal scores that is less than the score threshold is abnormal financial indicator data;

[0008] Determine the risk type, risk event and risk cause corresponding to each of the abnormal financial indicator data based on a preset risk analysis benchmark;

[0009] At least based on the abnormal financial indicator data, the risk type, the risk event and the risk cause, an indicator data early warning report is generated to achieve early warning for the financial indicator data.

[0010] In one embodiment, it also includes:

[0011] Obtaining attribute information corresponding to each of the abnormal financial indicator data;

[0012] The generating of an indicator data early warning report based at least on the abnormal financial indicator data, the risk type, the risk event and the risk cause includes:

[0013] An indicator data warning report is generated based on the abnormal financial indicator data, the attribute information corresponding to the abnormal financial indicator data, and the risk type, the risk event and the risk cause.

[0014] In one embodiment, determining the abnormal score of each of the to-be-detected financial indicator data based on the pre-trained isolation forest model includes:

[0015] Control each of the financial indicator data to be detected to traverse each isolated tree in the pre-trained isolation forest model, and obtain the traversal path length of the financial indicator data to be detected in each of the isolated trees;

[0016] Based on the length of each traversal path of each financial indicator data to be detected, an abnormality score of each financial indicator data to be detected is determined.

[0017] In one embodiment, determining the abnormality score of each financial indicator data to be detected based on the traversal path length of each financial indicator data to be detected includes:

[0018] Based on the traversal path lengths of the financial indicator data to be detected, determining the average path lengths corresponding to the financial indicator data to be detected;

[0019] Based on the average path length and the average of the path lengths in all the isolated trees, an abnormality score of each of the financial indicator data to be detected is determined.

[0020] In one embodiment, it also includes:

[0021] Obtain feature vectors of multiple historical financial indicator data;

[0022] A plurality of isolated trees are constructed by unsupervised training using feature vectors of a plurality of historical financial indicator data, and the plurality of isolated trees are used as trained isolation forest models to achieve pre-training of the isolation forest model.

[0023] In one embodiment, it also includes:

[0024] Acquire at least two types of financial data within a preset time period, and integrate the at least two types of financial data into financial indicator data through data extraction, data conversion and data loading;

[0025] The financial indicator data is corrected and denoised to obtain cleaned indicator data, and the cleaned data is converted into dimensionless financial indicator data to be detected.

[0026] In a second aspect, the present application also provides an indicator data early warning device based on isolation forest, which is applied to a power grid financial business system, and the device includes:

[0027] A data processing module, used for extracting financial indicator data to be detected, inputting the financial indicator data to be detected into a pre-trained isolation forest model, and determining anomaly scores of each financial indicator data to be detected based on the pre-trained isolation forest model;

[0028] An abnormal data determination module, configured to determine, based on a comparison between each abnormal score and a score threshold, that the financial indicator data to be detected corresponding to each abnormal score that is less than the score threshold is abnormal financial indicator data;

[0029] A report output module is used to determine the risk type, risk event and risk cause corresponding to each abnormal financial indicator data based on a preset risk analysis benchmark; and generate an indicator data early warning report based at least on the abnormal financial indicator data, the risk type, the risk event and the risk cause, so as to realize early warning for the financial indicator data.

[0030] In a third aspect, the present application further provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the following steps are implemented:

[0031] Extracting financial indicator data to be detected, and inputting the financial indicator data to be detected into a pre-trained isolation forest model, and determining anomaly scores of each of the financial indicator data to be detected based on the pre-trained isolation forest model;

[0032] Based on the comparison between each of the abnormal scores and the score threshold, determining that the financial indicator data to be detected corresponding to each of the abnormal scores that is less than the score threshold is abnormal financial indicator data;

[0033] Determine the risk type, risk event and risk cause corresponding to each of the abnormal financial indicator data based on a preset risk analysis benchmark;

[0034] At least based on the abnormal financial indicator data, the risk type, the risk event and the risk cause, an indicator data early warning report is generated to achieve early warning for the financial indicator data.

[0035] In a fourth aspect, the present application further provides a computer-readable storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, the following steps are implemented:

[0036] Extracting financial indicator data to be detected, and inputting the financial indicator data to be detected into a pre-trained isolation forest model, and determining anomaly scores of each of the financial indicator data to be detected based on the pre-trained isolation forest model;

[0037] Based on the comparison between each of the abnormal scores and the score threshold, determining that the financial indicator data to be detected corresponding to each of the abnormal scores that is less than the score threshold is abnormal financial indicator data;

[0038] Determine the risk type, risk event and risk cause corresponding to each of the abnormal financial indicator data based on a preset risk analysis benchmark;

[0039] At least based on the abnormal financial indicator data, the risk type, the risk event and the risk cause, an indicator data early warning report is generated to achieve early warning for the financial indicator data.

[0040] In a fifth aspect, the present application further provides a computer program product, including a computer program, which implements the following steps when executed by a processor:

[0041] Extracting financial indicator data to be detected, and inputting the financial indicator data to be detected into a pre-trained isolation forest model, and determining anomaly scores of each of the financial indicator data to be detected based on the pre-trained isolation forest model;

[0042] Based on the comparison between each of the abnormal scores and the score threshold, determining that the financial indicator data to be detected corresponding to each of the abnormal scores that is less than the score threshold is abnormal financial indicator data;

[0043] Determine the risk type, risk event and risk cause corresponding to each of the abnormal financial indicator data based on a preset risk analysis benchmark;

[0044] At least based on the abnormal financial indicator data, the risk type, the risk event and the risk cause, an indicator data early warning report is generated to achieve early warning for the financial indicator data.

[0045] In the indicator data early warning method, device, computer equipment, computer-readable storage medium and computer program product based on isolation forest provided by the present application, the indicator data early warning method based on isolation forest is applied to the power grid financial business system, by extracting the financial indicator data to be detected, and inputting the financial indicator data to be detected into the pre-trained isolation forest model, the abnormal score of each financial indicator data to be detected is determined based on the pre-trained isolation forest model; based on the comparison of each abnormal score and the score threshold, the financial indicator data to be detected corresponding to each abnormal score less than the score threshold is determined as abnormal financial indicator data; based on the preset risk analysis benchmark, the risk type, risk event and risk cause corresponding to each abnormal financial indicator data are determined; at least based on the abnormal financial indicator data, as well as the risk type, risk event and risk cause, an indicator data early warning report is generated to realize the early warning of the financial indicator data; thereby realizing the automated processing, intelligent analysis and efficient early warning of massive and high-dimensional financial indicator data, which is conducive to improving the accuracy and timeliness of financial risk early warning and providing strong support for the stable operation of power grid enterprises. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] In order to more clearly illustrate the technical solutions in the embodiments of the present application or related technologies, the drawings required for use in the embodiments of the present application or related technical descriptions will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0047] Figure 1 This is a diagram of an application environment of an indicator data early warning method based on isolation forest in one embodiment;

[0048] Figure 2 A schematic diagram of a process of an indicator data early warning method based on isolation forest in one embodiment;

[0049] Figure 3 A schematic diagram of a flow chart of an indicator data early warning method based on isolation forest in another embodiment;

[0050] Figure 4 This is an architecture diagram of a financial business system in one embodiment;

[0051] Figure 5 It is a structural block diagram of an indicator data early warning device based on isolation forest in one embodiment;

[0052] Figure 6 FIG. 4 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0053] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0054] The indicator data early warning method based on isolation forest provided in the embodiment of the present application can be applied to Figure 1 In the application environment shown. Among them, the terminal 102 communicates with the server 104 through the network. The data storage system can store the data that the server 104 needs to process. The data storage system can be integrated on the server 104, or it can be placed on the cloud or other network servers. The data storage system can be used to store various types of financial indicator data. Among them, the terminal 102 can be, but is not limited to, various personal computers, laptops, smart phones, tablet computers, etc. The server 104 can be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides cloud computing services.

[0055] In an exemplary embodiment, Figure 2 As shown, an indicator data early warning method based on isolation forest is provided. The execution of this method can be based on Figure 1 The method is implemented by taking the terminal 102 in the example as an example, and the method can be specifically applied to a data interaction system in the power industry, for example, a power grid financial business system. The indicator data early warning method based on the isolation forest includes the following steps 201 to 204. Among them:

[0056] Step 201 : extracting financial indicator data to be detected, and inputting the financial indicator data to be detected into a pre-trained isolation forest model, and determining anomaly scores of each financial indicator data to be detected based on the pre-trained isolation forest model.

[0057] Among them, financial indicator data refers to various types of data related to finance in a certain power company, such as financial transaction data, financial statements, budget data, cost allocation data, etc.; that is, this application does not specifically limit the type and quantity of the extracted financial indicator data to be tested, and the specific data type and data quantity included in the financial indicator data to be tested can be selected according to the needs of the test.

[0058] The pre-trained isolation forest model is an isolation forest model that has been trained in advance. The training data used by the isolation forest model is the historical financial data of a certain power company that needs to use the model. This application does not specifically limit the type and quantity of historical financial indicator data used when training the isolation forest model, and it can be selected according to needs.

[0059] The pre-trained isolation forest model can be used to receive the financial indicator data to be detected, and output the abnormality score of each financial indicator data to be detected by processing the financial indicator data to be detected. The abnormality score here can be used to indicate the abnormality degree of each financial indicator data to be detected. For example, it can be set to the smaller the abnormality score, the higher the abnormality degree of the corresponding financial indicator data to be detected, and the larger the abnormality score, the lower the abnormality degree of the corresponding financial indicator data to be detected.

[0060] It needs to be explained that the above-mentioned “the smaller the anomaly score, the higher the degree of anomaly of the corresponding financial indicator data to be detected, and the larger the anomaly score, the lower the degree of anomaly of the corresponding financial indicator data to be detected” is only an optional setting method provided by this application, and can also be set to “the larger the anomaly score, the higher the degree of anomaly of the corresponding financial indicator data to be detected, and the smaller the anomaly score, the lower the degree of anomaly of the corresponding financial indicator data to be detected” according to needs.

[0061] It should also be added that the present application does not specifically limit the value range of the abnormality score, and a five-point system, a ten-point system, a hundred-point system, etc. can be selected according to needs.

[0062] Step 202: Based on the comparison between each abnormality score and the score threshold, determine that the financial indicator data to be detected corresponding to each abnormality score smaller than the score threshold is abnormal financial indicator data.

[0063] Among them, the score threshold is set in advance by a certain power company based on demand and the value range of the abnormal score. This application does not limit the specific value of the abnormal score. For example, when the abnormal score is 10 points, the score threshold is 3, 3.5, 4, 4.2, 6, etc., and when the abnormal score is 100 points, the score threshold is 30, 38, 40, 45, 50, 60, etc., that is, the value of the score threshold can be any number within the score range of the corresponding abnormal score.

[0064] The selection of the score threshold needs to be determined based on the actual business situation and historical data of the power company to ensure that the real abnormal data can be accurately identified while avoiding misjudging normal data as abnormal.

[0065] After obtaining the abnormal scores corresponding to each financial indicator data to be detected by executing step 201, how to determine whether the corresponding financial indicator data to be detected is abnormal data based on the abnormal scores, the present application provides an optional implementation method: compare the abnormal scores corresponding to each financial indicator data to be detected with the size of the score threshold set in advance, regard the abnormal scores below the score threshold as abnormal, and determine the financial indicator data to be detected corresponding to the abnormal scores below the score threshold as abnormal financial indicator data.

[0066] It should also be added that the present application uses "the to-be-detected financial indicator data corresponding to the abnormality score below the score threshold is determined as abnormal financial indicator data" because the pre-trained isolation forest model used in the present application, for the indicator data it receives, the more abnormal the data, the lower the abnormality score it finally outputs. In addition, if the pre-trained isolation forest model, for the indicator data it receives, the more abnormal the data, the higher the abnormality score it finally outputs, then the to-be-detected financial indicator data corresponding to the abnormality score above the score threshold will be used as abnormal financial indicator data.

[0067] Step 203: determine the risk type, risk event and risk cause corresponding to each abnormal financial indicator data based on a preset risk analysis benchmark.

[0068] Among them, the preset risk analysis benchmark can be some standards or rules set by professionals based on experience, or it can be a risk analysis model formed by training based on historical experience data. The historical experience data here refers to the correlation between abnormal financial indicator data and risk types, the correlation between abnormal financial indicator data and risk events, the correlation between abnormal financial indicator data and risk causes, etc. This application does not impose too many restrictions on the "preset risk analysis benchmark" used.

[0069] After determining the abnormal financial indicator data in the financial indicator data to be detected based on executing step 202, the risk type, risk event and risk cause pointed to by these abnormal financial indicator data can be further determined based on a pre-set risk analysis benchmark.

[0070] It should be noted that based on the abnormal financial indicator data and the preset risk analysis benchmark, it can be used to determine only at least one of the risk types, risk events and risk causes corresponding to at least some of the abnormal financial indicator data according to needs. That is, it is not necessary to determine the risk type, risk event and risk cause corresponding to each abnormal financial indicator data.

[0071] Step 204, generating an indicator data early warning report based at least on the abnormal financial indicator data, risk type, risk event and risk cause, so as to achieve early warning for the financial indicator data.

[0072] Among them, after determining at least one of the risk type, risk event and risk cause corresponding to each abnormal financial indicator data by executing step 203, a financial indicator data early warning report can be further generated according to needs. The indicator data early warning report can display the determined abnormal financial indicator data based on needs, as well as at least one of the risk type, risk event and risk cause corresponding to each abnormal financial indicator data.

[0073] An embodiment is provided, for example, an indicator data early warning report may include abnormal financial indicator data A and the risk type corresponding to the abnormal financial indicator data A, as well as abnormal financial indicator data B and the risk events and risk causes corresponding to the abnormal financial indicator data B, as well as abnormal financial indicator data C and the risk type and risk events corresponding to the abnormal financial indicator data C, and abnormal financial indicator data D and the risk type, risk events and risk causes corresponding to the abnormal financial indicator data D.

[0074] In addition, the financial indicator data warning report can also choose to simultaneously display various abnormal financial indicator data, as well as the risk type, risk event and risk cause corresponding to each abnormal financial indicator data.

[0075] In the above-mentioned indicator data early warning method based on isolation forest, by extracting the financial indicator data to be detected, and inputting the financial indicator data to be detected into the pre-trained isolation forest model, the abnormal score of each financial indicator data to be detected is determined based on the pre-trained isolation forest model; based on the comparison of each abnormal score and the score threshold, the financial indicator data to be detected corresponding to each abnormal score less than the score threshold is determined as abnormal financial indicator data; based on the preset risk analysis benchmark, the risk type, risk event and risk cause corresponding to each abnormal financial indicator data are determined; based on at least the abnormal financial indicator data, as well as the risk type, risk event and risk cause, an indicator data early warning report is generated to realize early warning of financial indicator data; thereby realizing automated processing, intelligent analysis and efficient early warning of massive, high-dimensional financial indicator data, which is conducive to improving the accuracy and timeliness of financial risk early warning and providing strong support for the stable operation of power grid enterprises.

[0076] In an exemplary embodiment, the indicator data early warning method based on isolation forest provided in the present application may further include the step of: obtaining attribute information corresponding to each abnormal financial indicator data.

[0077] The attribute information here, for example, refers to some more detailed sub-data corresponding to each abnormal financial indicator data.

[0078] Furthermore, the above step 204 generates an indicator data warning report based at least on abnormal financial indicator data, and risk type, risk event and risk cause. The specific execution may be: generating an indicator data warning report based on abnormal financial indicator data, attribute information corresponding to the abnormal financial indicator data, and risk type, risk event and risk cause.

[0079] After learning the attribute information corresponding to each abnormal financial indicator data, the corresponding generated indicator data warning report can further display the attribute information corresponding to at least part of the abnormal financial indicator data according to needs, so as to enhance the richness of the content displayed in the indicator data warning report, and also facilitate the preparation of various information in the indicator data warning report, and also facilitate people who read the indicator data warning report to more clearly understand the reasons for the abnormal financial indicator data abnormalities.

[0080] In the financial indicator data early warning report, you can choose to display all abnormal financial indicator data, the attribute information of each abnormal financial indicator data, and the risk type, risk event and risk cause corresponding to each abnormal financial indicator data. However, you can also choose to display only the data itself and part of the corresponding attribute information, risk type, risk event and risk cause for at least some of the abnormal financial indicator data according to your needs.

[0081] Furthermore, if the attribute information corresponding to some abnormal financial indicator data has a preset value range, the preset value range can be further displayed at the corresponding position of the attribute information, so that users who read the indicator data warning report can clearly know whether the attribute information is less than the normal value range or greater than the normal value range, which is conducive to providing clear data support for subsequent decisions to improve anomalies.

[0082] In an exemplary embodiment, in the indicator data early warning method based on isolation forest provided by the present application, the above step 201 performs the determination of the abnormal score of each financial indicator data to be detected based on the pre-trained isolation forest model, which can be specifically performed as steps 211 and 212, wherein:

[0083] Step 211, controlling each financial indicator data to be detected to traverse each isolated tree in the pre-trained isolation forest model, and obtaining the traversal path length of the financial indicator data to be detected in each isolated tree;

[0084] Step 212: determining the abnormality score of each financial indicator data to be detected based on the length of each traversal path of each financial indicator data to be detected.

[0085] Specifically, each financial indicator data to be detected is made to traverse each isolated tree in the pre-trained isolation forest model respectively, and each isolated tree is traversed based on the financial indicator data to be detected to obtain the traversal path length of the financial indicator data to be detected in each isolated tree; and then when it is necessary to calculate the anomaly score corresponding to a financial data to be detected, the anomaly score corresponding to the financial data to be detected can be obtained based on the traversal path length in each isolated tree. This is conducive to ensuring the accuracy of the anomaly scores corresponding to each financial data to be detected.

[0086] In an exemplary embodiment, in the indicator data early warning method based on isolation forest provided by the present application, the above step 212 is performed based on the length of each traversal path of each financial indicator data to be detected to determine the abnormal score of each financial indicator data to be detected, which can be specifically performed as steps 221 and 222, wherein:

[0087] Step 221, based on the length of each traversal path of each financial indicator data to be detected, determine the average path length corresponding to each financial indicator data to be detected;

[0088] Step 222: Determine the abnormality score of each financial indicator data to be detected based on the average path length and the average value of the path lengths in all isolated trees.

[0089] Specifically, with respect to the calculation of the anomaly score of the financial indicator data to be detected, the present application provides an optional calculation method, which is to first calculate the average value of all traversal path lengths based on the traversal path length of the financial indicator data to be detected in each isolated tree, that is, to obtain the average path length corresponding to the financial indicator data to be detected; and then calculate the anomaly score corresponding to the financial indicator data to be detected based on the calculated average path length and the average value of the path lengths of the isolated trees themselves in all isolated trees.

[0090] In this regard, the present application provides a specific embodiment: for each financial indicator data x to be detected, we calculate its path length c(x,n) in all iTrees (isolated trees), where n is the number of trees. Then, we define the anomaly score S(x,n) based on the mean and standard deviation of the path length. Specifically, we can use the formula S(x,n)=2 ^(-E(h(x)) / c(n)) To calculate the anomaly score, h(x) is the path length of the financial indicator data x to be detected in a single tree, and c(n) is the average path length in all trees. The smaller the calculated anomaly score, the more abnormal the sample point.

[0091] In an exemplary embodiment, the indicator data early warning method based on isolation forest provided by the present application also includes a method for training an isolation forest model, specifically including step 301 and step 302, wherein:

[0092] Step 301, obtaining feature vectors of multiple historical financial indicator data;

[0093] Step 302, using feature vectors of multiple historical financial indicator data to construct multiple isolation trees in an unsupervised training manner, and using the multiple isolation trees as a trained isolation forest model to achieve pre-training of the isolation forest model.

[0094] Specifically, a plurality of historical financial indicator data are first obtained, and then the feature vectors corresponding to these historical financial indicator data are obtained, and then these feature vectors are used to construct a plurality of isolated trees by unsupervised training, and then the constructed plurality of isolated trees are used as the trained isolation forest model.

[0095] The specific method of constructing the isolation forest model will be explained later.

[0096] In an exemplary embodiment, the indicator data early warning method based on isolation forest provided by the present application further includes steps 205 and 206 before step 201 is executed, wherein:

[0097] Step 205, obtaining at least two types of financial data within a preset time period, and integrating the at least two types of financial data into financial indicator data through data extraction, data conversion and data loading;

[0098] Step 206 , performing correction processing and denoising processing on the financial indicator data to obtain cleaned indicator data, and converting the cleaned data into dimensionless financial indicator data to be detected.

[0099] Specifically, based on the time period of the detection requirement, multiple categories of financial data within the preset time period are obtained, and then these multiple categories of financial data are integrated through the steps of data extraction, data conversion and data loading to obtain corresponding financial indicator data; then, the financial indicator data is preprocessed, for example, including correction processing and denoising processing of the financial indicator data to obtain cleaned indicator data, and the cleaned data is converted into dimensionless financial indicator data to be detected, so that the obtained financial indicator data to be detected can be received by the pre-trained isolation forest model and perform related operations.

[0100] For the indicator data early warning method based on isolation forest provided in this application, this application also provides an optional implementation method, which includes three stages: data preprocessing, isolation forest model construction, anomaly detection and risk analysis, wherein:

[0101] The data preprocessing stage includes at least three steps: data source integration, data cleaning, and data standardization.

[0102] Data source integration: In the power grid financial business system, data often comes from multiple different subsystems or databases, such as financial reporting systems, cost accounting systems, budget management systems, etc. The task of the data source integration stage is to integrate these scattered and heterogeneous data sources into a unified data warehouse through the data extraction, transformation and loading (ETL) process. This process ensures comprehensive coverage of data, including financial transaction records, financial statements, budget data, cost allocation and other aspects, while also ensuring the timeliness of the data, that is, it can reflect the latest financial status of the enterprise in a timely manner.

[0103] Data cleaning: Data cleaning is a crucial step in data preprocessing, which directly affects the accuracy and reliability of subsequent data analysis. At this stage, we use advanced algorithms and tools to automatically identify and correct errors in the data, such as format errors, logical errors, duplicate records, etc. For missing values, we use appropriate filling strategies such as mean filling, median filling, interpolation or model-based prediction filling according to the distribution law of the data and business logic. At the same time, we also remove noise data, that is, data points that deviate abnormally from the normal data range or do not conform to business logic, to reduce interference with the analysis results.

[0104] Data standardization: Since different financial indicators (the attribute information of the above-mentioned financial indicator data) differ in terms of dimension, value range, distribution form, etc., direct comparison and analysis may lead to misleading conclusions. Therefore, in the data preprocessing stage, we need to adopt appropriate data standardization methods, such as Z-score standardization (also known as standard deviation standardization), to convert each financial indicator into a dimensionless value so that it has the same scale, which is convenient for subsequent unified analysis and comparison. Z-score standardization is achieved by calculating the difference between each data point and the mean and dividing it by the standard deviation. In this way, the processed data will follow the standard normal distribution, which is convenient for statistical analysis and machine learning modeling.

[0105] The isolation forest model construction phase includes at least three steps: application of the isolation forest algorithm principle, model parameter optimization, and anomaly score calculation.

[0106] Algorithm principle and application: The isolation forest algorithm mainly randomly selects a feature from the training data set (including multiple historical financial indicator data), randomly selects a split point between the maximum and minimum values ​​of the feature, and those less than the split point enter the left branch, and those greater than or equal to the split point enter the right branch; the above process is repeated until there is only one sample (historical financial indicator data) or the same sample (historical financial indicator data) left or the depth limit of the tree is reached, and then the path length is used to indicate the degree to which a sample point (historical financial indicator data) is "isolated".

[0107] The path length h(x) refers to the number of edges of the binary tree that the sample point passes through from the root node to the external node. Usually, the sample with a smaller path length is more "isolated". The calculation formula of the path length h(x) is: h(x)=e+C(T.size); where e represents the number of edges that the test sample data (historical financial indicator data) x passes through from the root node to the leaf node of the isolation tree, T.size is the number of samples on the leaf node where the test sample data is located, and C(T.size) is a correction value, which represents the average path length of the isolation tree constructed with T.size sample data. The calculation formula of C(n) is: C(n)=2H(n-1)-{[2(n-1)] / n}; where n is the number of samples (historical financial indicator data), H(n-1) can be estimated by ln(i)+0.5772156649 (Euler constant). In the same way, multiple iTrees are constructed, and the degree of "isolation" of the samples can be detected based on the path length, which can be judged by the S(x,n) score. Defined as: S(x,n)=2 ^(-E(h(x)) / c(n)) ; Where E(h(x)) is the average path length of all isolated trees in the iForest (isolation forest) of the sample point, and n represents the number of training samples of a single iTree.

[0108] Model parameter optimization: In order to obtain the best detection performance and generalization ability, we need to optimize the parameters of the isolation forest model. These parameters include the number of iTrees, the maximum depth of each tree, the subsample size, etc. Through multiple experiments and verifications, we can use strategies such as grid search, random search, or Bayesian optimization to find the optimal parameter combination. During the optimization process, we need to pay attention to the performance indicators of the model such as detection accuracy, recall rate, F1 score, and ensure that the model can show good performance on both the training set and the validation set.

[0109] Anomaly score calculation: Anomaly score calculation is one of the core steps of the Isolation Forest algorithm. For each sample point (historical financial indicator data) x, we calculate its path length c(x,n) in all iTrees, where n is the number of trees. Then, we define the anomaly score S(x,n) based on the mean and standard deviation of the path length. Specifically, we can use the formula S(x,n)=2 ^(-E(h(x)) / c(n)) To calculate the anomaly score, h(x) is the path length of the sample point x in a single tree, and c(n) is the average path length in all trees.

[0110] The risk analysis phase includes at least three steps: real-time detection phase, abnormal point identification phase and in-depth risk analysis phase, among which:

[0111] Real-time detection: In the anomaly detection stage, we input the financial indicator data to be detected into the trained isolation forest model, calculate the anomaly score of each data point (financial indicator data to be detected) in real time, and make an anomaly determination. Since the isolation forest algorithm has a fast calculation speed and high detection accuracy, it is very suitable for real-time anomaly detection scenarios. By monitoring the changes in financial indicator data in real time, we can promptly discover potential financial risks and take corresponding countermeasures.

[0112] Anomaly Identification: Based on the comparison between the anomaly score and the preset threshold (score threshold), we can automatically mark data points below the threshold as anomalies (abnormal financial indicator data). The selection of the score threshold needs to be determined based on the actual business situation and historical data to ensure that the true anomalies can be accurately identified while avoiding misjudging normal data as anomalies. Once the anomalies are identified, we can conduct in-depth analysis based on business logic and market environment to determine the risk type, potential impact and possible causes.

[0113] In-depth risk analysis: In-depth risk analysis is one of the important steps after anomaly detection. At this stage, we need to conduct an in-depth analysis of the anomalies (abnormal financial indicator data) in combination with the business logic and market environment of the enterprise to determine the specific type of risk (risk type), potential impact (risk event) and possible cause (risk cause). Among them, risk types include credit risk, market risk, operational risk, etc., risk events (potential impact) include capital loss, reputation damage, etc., and risk causes (possible causes) include internal control failure, changes in the external environment, etc. In-depth analysis can provide strong support for subsequent risk response.

[0114] In addition, for the indicator data early warning method based on isolation forest provided in this application, this application also provides a specific optional implementation example. Taking a certain power grid enterprise as an example, the specific implementation steps are as follows:

[0115] Step S1, data collection: on the 5th of each month, the financial indicator data in the financial business system of the previous month is sent to the data center through the interface, including revenue, cost, profit, debt-to-asset ratio, etc.

[0116] Step S2, data preprocessing: clean the collected data (remove duplicates, missing values, etc.), convert (such as unifying the monetary unit), and standardize (such as Z-score standardization).

[0117] Step S3, model training: select the financial indicator data of the past 20 years as the training set, and build an isolation forest model containing 100 isolated trees. In the process of building each isolated tree, select multi-dimensional features and divide the data until the stopping condition is met (such as the tree reaches a maximum height of 8 layers, and the number of samples in the node is too small). After obtaining t iTrees, the iForest training is completed, and then we can use the generated iForest to evaluate the test data. For a training data x, we let it traverse each iTree, and then calculate the layer of each tree where x finally falls (the height of x in the tree). Get the average height of x in each tree. If x falls in a node containing multiple training data, a formula can be used to correct the height calculation of x. Set a threshold (boundary value), and the test data with an average path length lower than this threshold is abnormal.

[0118] It is worth noting that this method normalizes the height of the tree and obtains a value between 0 and 1, that is, the shorter the height, the closer it is to 1 (the higher the possibility of abnormality). The default parameter settings of the Isolation Forest Algorithm are: subsample size: 256, Tree height: 8, Number of trees: 100, which means "build 100 iTrees, each iTree has a maximum of 8 layers, and each iTree is built by independently randomly selecting 256 data samples."

[0119] Step S4 (including steps S41 to S44), abnormality detection:

[0120] Step S41, traverse each tree: for the current month or real-time updated financial indicator data (x) to be detected, traverse each trained isolated tree (iTree).

[0121] Step S42, calculate the path length: record the traversal path length of data x in each tree, that is, the height (or depth) of the tree that x finally reaches. If x falls in a node containing multiple training data, use an appropriate formula (such as the average path length formula) to correct the height calculation of x.

[0122] Step S43, calculate the average path length: average the path lengths of x in all 100 trees to obtain the average path length of x in the isolation forest.

[0123] Step S44, normalization and threshold determination: normalize the average path length to obtain a value between 0 and 1, where the closer the value is to 1, the more likely x is an outlier. According to a preset threshold (such as 0.6 or dynamically adjusted according to historical data), determine whether x is lower than this threshold. If so, x is considered to be an outlier.

[0124] Step S5, result output and report:

[0125] The detected abnormal data points are identified and displayed through visual graphics so that relevant staff of the power grid company can further analyze the reasons behind these abnormal data.

[0126] After expert analysis, a risk warning report is generated, which exports detailed abnormal data points (abnormal financial indicator data), the financial indicators involved (attribute information corresponding to the abnormal financial indicator data), lists the degree of abnormality and possible risk analysis, and provides data support for subsequent major decisions.

[0127] The indicator data early warning method based on isolation forest provided in this application has the following four beneficial effects when applied to the financial business system of power grid enterprises, among which:

[0128] First, improve the accuracy of early warning: This invention innovatively introduces the isolation forest algorithm, which, with its unique mechanism, shows excellent performance in anomaly detection of financial indicator data. Compared with traditional methods, the isolation forest algorithm can more accurately capture subtle anomalies in the data and effectively distinguish normal fluctuations from potential risk points. By deeply mining the intrinsic connections between data features, it not only reduces the false alarm rate and unnecessary waste of resources, but also greatly improves the control of the missed alarm rate, ensuring that any potential risk signals will not be missed. This high-precision early warning capability provides solid data support for the stable operation of power grid companies.

[0129] Second, improve processing efficiency: In the face of massive financial indicator data of power grid enterprises, the present invention has achieved a qualitative leap in data processing through parallel processing technology and multi-tree integration strategy. Parallel processing allows data to run simultaneously on multiple processing units, significantly shortening the processing time; and multi-tree integration achieves comprehensive coverage and in-depth analysis of data by constructing multiple isolated tree models. The combination of the two greatly improves the processing speed and efficiency under large amounts of data. This not only meets the business needs of enterprises with high real-time requirements, but also provides a strong guarantee for enterprises to quickly respond to market changes and seize development opportunities.

[0130] Third, enhanced adaptability: The present invention gets rid of the reliance of traditional early warning methods on preset thresholds and adopts the isolation forest algorithm of unsupervised learning, which enables the model to automatically adapt to data changes at different times and in different environments. Whether it is fluctuations in the market environment, adjustments to policies and regulations, or changes in internal corporate management, the present invention can maintain keen insight and accurate judgment of data by dynamically adjusting its own parameters and structures. This powerful adaptability makes the early warning model more flexible and changeable, and can continue to provide enterprises with accurate and effective risk warning services.

[0131] Fourth, decision support: In addition to efficient anomaly detection and data processing capabilities, the present invention also focuses on providing valuable information support for decision makers (grid staff). By deeply analyzing the causes and patterns behind abnormal data, the present invention can generate detailed risk analysis reports, including key information such as abnormal indicators, risk types, possible impact scope and degree. These reports not only help decision makers quickly understand the risk status, but also provide a scientific basis for them to formulate effective response measures.

[0132] It should be understood that, although the various steps in the flowcharts involved in the above-mentioned embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above-mentioned embodiments can include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0133] In addition, the indicator data early warning method based on isolation forest provided in this application can be applied to the financial business system of power grid enterprises, such as Figure 4 As shown, the present application also provides an architecture of a financial business system, and the system application architecture can be divided into four layers, among which:

[0134] The first layer: The user interaction layer is the interface for direct interaction between users and the system, including various front-end applications, such as the Web (World Wide Web) interface, mobile applications, desktop applications, and large-screen displays. Users input commands, view data and analyze results through these interfaces, and exchange information with the system.

[0135] Function: Provide a friendly user interface so that users can easily access the various functions and services of the system.

[0136] The second layer: The business logic layer is the core of the system, responsible for processing user requests and executing specific business logic. It includes multiple business modules, such as "Personal Center", "Intelligent Warning", "Analysis Report", "Warning Information", "Indicator Query" and "Data Analysis", etc. Each module has a specific business function.

[0137] Function: Receive user input, call the data and models of the data processing layer, perform complex business logic processing, and finally return the processing results to the user interaction layer for display.

[0138] The third layer: data processing and model layer is responsible for data processing, analysis and model building. It includes modules such as "data preprocessing", "model processing", "model building", "model configuration", and more detailed data processing sub-modules such as "data collection", "data processing", "data cleaning", "data query", etc.

[0139] Function: Acquire data from data sources, clean, convert and integrate data to provide the required data support for the business logic layer; at the same time, build and optimize analysis models to support complex business analysis and prediction.

[0140] The fourth layer: the infrastructure and support service layer is the infrastructure and support service layer that provides the upper layer with necessary physical resources, virtualization environment, development tools and security assurance, etc. It includes infrastructure such as "PasS (Platform as a Service) platform", "Container Operation Platform (TCNP)", "Microservice Framework" (TSF), "DevOps (Development and Operation) Framework", and the underlying physical resources and virtualization support provided by "Iaas (Infrastructure as a Service, cloud computing service model) platform".

[0141] Function: Ensure the stable operation and efficient development of the system, and provide necessary resource management and service support, such as load balancing, service discovery, configuration management, security monitoring, etc.

[0142] These four layers together constitute the complete application architecture of the system, from user interaction to data processing to infrastructure support, forming an efficient, stable and scalable system environment.

[0143] In addition, the system also includes the specific architecture information of the business service layer and the data processing layer, which can be referred to Figure 4 It should be noted that Figure 4 This is only an architectural embodiment of a financial business system provided by this application, and does not mean that the indicator data early warning method based on isolation forest provided by this application can only be used for Figure 4 In the financial business system architecture shown, users can also Figure 4 The architectural content in the architecture of the financial business system shown is adjusted.

[0144] Based on the same inventive concept, the embodiment of the present application also provides an indicator data warning device based on an isolation forest for implementing the indicator data warning method based on an isolation forest. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above method, so the specific limitations in one or more embodiments of the indicator data warning device based on an isolation forest provided below can refer to the limitations of the indicator data warning method based on an isolation forest above, and will not be repeated here.

[0145] In an exemplary embodiment, Figure 5 As shown, an indicator data early warning device 300 based on isolation forest is provided, which is applied to the power grid financial business system, including: a data processing module 81, an abnormal data determination module 82 and a report output module 83, wherein:

[0146] The data processing module 81 is used to extract the financial indicator data to be detected, input the financial indicator data to be detected into the pre-trained isolation forest model, and determine the abnormal score of each financial indicator data to be detected based on the pre-trained isolation forest model;

[0147] An abnormal data determination module 82 is used to determine that the financial indicator data to be detected corresponding to each abnormal score less than the score threshold is abnormal financial indicator data based on the comparison between each abnormal score and the score threshold;

[0148] The report output module 83 is used to determine the risk type, risk event and risk cause corresponding to each abnormal financial indicator data based on a preset risk analysis benchmark; and generate an indicator data early warning report based on at least the abnormal financial indicator data, and the risk type, risk event and risk cause, so as to realize the early warning of the financial indicator data.

[0149] In an exemplary embodiment, the abnormal data determination module 82 is further used to obtain attribute information corresponding to each abnormal financial indicator data. The report output module 83 is used to generate an indicator data warning report based on at least the abnormal financial indicator data, the risk type, the risk event and the risk cause, including: generating an indicator data warning report based on the abnormal financial indicator data, the attribute information corresponding to the abnormal financial indicator data, and the risk type, the risk event and the risk cause.

[0150] In an exemplary embodiment, the data processing module 81 is used to determine the abnormality score of each financial indicator data to be detected based on a pre-trained isolation forest model, including: controlling each financial indicator data to be detected to traverse each isolated tree in the pre-trained isolation forest model, and obtaining the traversal path length of the financial indicator data to be detected in each isolated tree; based on each traversal path length of each financial indicator data to be detected, determining the abnormality score of each financial indicator data to be detected.

[0151] In an exemplary embodiment, the data processing module 81 is used to determine the abnormality score of each financial indicator data to be detected based on the traversal path length of each financial indicator data to be detected, including: determining the average path length corresponding to each financial indicator data to be detected based on the traversal path length of each financial indicator data to be detected; determining the abnormality score of each financial indicator data to be detected based on the average path length and the average value of the path lengths in all isolated trees.

[0152] In an exemplary embodiment, the indicator data early warning device 300 based on isolation forest also includes a data acquisition module, which is used to obtain feature vectors of multiple historical financial indicator data; the data processing module 81 is used to use the feature vectors of multiple historical financial indicator data to construct multiple isolated trees using an unsupervised training method, and use the multiple isolated trees as trained isolation forest models to achieve pre-training of the isolation forest model.

[0153] In an exemplary embodiment, the data acquisition module is also used to acquire at least two types of financial data within a preset time period, and then call the data processing module 81 to integrate at least two types of financial data into financial indicator data through data extraction, data conversion and data loading; perform correction processing and denoising on the financial indicator data to obtain cleaned indicator data, and convert the cleaned data into dimensionless financial indicator data to be tested.

[0154] Each module in the above-mentioned indicator data early warning device 300 based on isolation forest can be implemented in whole or in part by software, hardware and a combination thereof. Each of the above-mentioned modules can be embedded in or independent of a processor in a computer device in the form of hardware, or can be stored in a memory in a computer device in the form of software, so that the processor can call and execute operations corresponding to each of the above modules.

[0155] In an exemplary embodiment, a computer device is provided. The computer device may be a terminal, and its internal structure diagram may be as shown in FIG. Figure 6As shown. The computer device includes a processor, a memory, an input / output interface, a communication interface, a display unit and an input device. The processor, the memory and the input / output interface are connected through a system bus, and the communication interface, the display unit and the input device are connected to the system bus through the input / output interface. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The input / output interface of the computer device is used to exchange information between the processor and the external device. The communication interface of the computer device is used to communicate with an external terminal in a wired or wireless manner, and the wireless manner can be implemented through WIFI, a mobile cellular network, near field communication (NFC) or other technologies. When the computer program is executed by the processor, an indicator data early warning method based on an isolation forest is implemented. The display unit of the computer device is used to form a visually visible picture, which can be a display screen, a projection device or a virtual reality imaging device. The display screen can be a liquid crystal display screen or an electronic ink display screen, and the input device of the computer device can be a touch layer covering the display screen, or a button, trackball or touchpad set on the computer device shell, or an external keyboard, touchpad or mouse.

[0156] Those skilled in the art will understand that Figure 6 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0157] In an exemplary embodiment, a computer device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and when the processor executes the computer program, the following steps are implemented:

[0158] Extracting the financial indicator data to be detected, and inputting the financial indicator data to be detected into the pre-trained isolation forest model, and determining the abnormal score of each financial indicator data to be detected based on the pre-trained isolation forest model;

[0159] Based on the comparison between each abnormal score and the score threshold, determine that the financial indicator data to be detected corresponding to each abnormal score less than the score threshold is abnormal financial indicator data;

[0160] Determine the risk type, risk event and risk cause corresponding to each abnormal financial indicator data based on the preset risk analysis benchmark;

[0161] At least based on abnormal financial indicator data, as well as risk type, risk event and risk cause, an indicator data early warning report is generated to achieve early warning of financial indicator data.

[0162] In one embodiment, a computer readable storage medium is provided, on which a computer program is stored, and when the computer program is executed by a processor, the following steps are implemented:

[0163] Extracting the financial indicator data to be detected, and inputting the financial indicator data to be detected into the pre-trained isolation forest model, and determining the abnormal score of each financial indicator data to be detected based on the pre-trained isolation forest model;

[0164] Based on the comparison between each abnormal score and the score threshold, determine that the financial indicator data to be detected corresponding to each abnormal score less than the score threshold is abnormal financial indicator data;

[0165] Determine the risk type, risk event and risk cause corresponding to each abnormal financial indicator data based on the preset risk analysis benchmark;

[0166] At least based on abnormal financial indicator data, as well as risk type, risk event and risk cause, an indicator data early warning report is generated to achieve early warning of financial indicator data.

[0167] In one embodiment, a computer program product is provided, comprising a computer program, which, when executed by a processor, implements the following steps:

[0168] Extracting the financial indicator data to be detected, and inputting the financial indicator data to be detected into the pre-trained isolation forest model, and determining the abnormal score of each financial indicator data to be detected based on the pre-trained isolation forest model;

[0169] Based on the comparison between each abnormal score and the score threshold, determine that the financial indicator data to be detected corresponding to each abnormal score less than the score threshold is abnormal financial indicator data;

[0170] Determine the risk type, risk event and risk cause corresponding to each abnormal financial indicator data based on the preset risk analysis benchmark;

[0171] At least based on abnormal financial indicator data, as well as risk type, risk event and risk cause, an indicator data early warning report is generated to achieve early warning of financial indicator data.

[0172] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant regulations.

[0173] A person of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment method can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, an artificial intelligence (AI) processor, etc., but are not limited to this.

[0174] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0175] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. An indicator data early warning method based on isolation forest, characterized in that: Applied to a power grid financial business system, the method comprises: Extracting financial indicator data to be detected, and inputting the financial indicator data to be detected into a pre-trained isolation forest model, and determining anomaly scores of each of the financial indicator data to be detected based on the pre-trained isolation forest model; Based on the comparison between each of the abnormal scores and the score threshold, determining that the financial indicator data to be detected corresponding to each of the abnormal scores that is less than the score threshold is abnormal financial indicator data; Determine the risk type, risk event and risk cause corresponding to each of the abnormal financial indicator data based on a preset risk analysis benchmark; At least based on the abnormal financial indicator data, the risk type, the risk event and the risk cause, an indicator data early warning report is generated to achieve early warning for the financial indicator data.

2. The method according to claim 1, characterized in that: Also includes: Obtaining attribute information corresponding to each of the abnormal financial indicator data; The generating of an indicator data warning report based at least on the abnormal financial indicator data, the risk type, the risk event and the risk cause includes: An indicator data warning report is generated based on the abnormal financial indicator data, the attribute information corresponding to the abnormal financial indicator data, and the risk type, the risk event and the risk cause.

3. The method according to claim 1, characterized in that The determining of the abnormality score of each of the to-be-detected financial indicator data based on the pre-trained isolation forest model includes: Control each of the financial indicator data to be detected to traverse each isolated tree in the pre-trained isolation forest model, and obtain the traversal path length of the financial indicator data to be detected in each of the isolated trees; Based on the length of each traversal path of each financial indicator data to be detected, an abnormality score of each financial indicator data to be detected is determined.

4. The method according to claim 3, characterized in that: The determining, based on the length of each traversal path of each financial indicator data to be detected, an abnormality score of each financial indicator data to be detected includes: Based on the traversal path lengths of the financial indicator data to be detected, determining the average path lengths corresponding to the financial indicator data to be detected; Based on the average path length and the average of the path lengths in all the isolated trees, an abnormality score of each of the financial indicator data to be detected is determined.

5. The method according to claim 1, characterized in that Also includes: Obtain feature vectors of multiple historical financial indicator data; A plurality of isolated trees are constructed by unsupervised training using feature vectors of a plurality of historical financial indicator data, and the plurality of isolated trees are used as trained isolation forest models to achieve pre-training of the isolation forest model.

6. The method according to any one of claims 1 to 5, characterized in that: Also includes: Acquire at least two types of financial data within a preset time period, and integrate the at least two types of financial data into financial indicator data through data extraction, data conversion and data loading; The financial indicator data is corrected and denoised to obtain cleaned indicator data, and the cleaned data is converted into dimensionless financial indicator data to be detected.

7. An indicator data early warning device based on isolation forest, characterized in that: Applied to a power grid financial business system, the device comprises: A data processing module, used for extracting financial indicator data to be detected, inputting the financial indicator data to be detected into a pre-trained isolation forest model, and determining anomaly scores of each financial indicator data to be detected based on the pre-trained isolation forest model; An abnormal data determination module, configured to determine, based on a comparison between each abnormal score and a score threshold, that the financial indicator data to be detected corresponding to each abnormal score that is less than the score threshold is abnormal financial indicator data; A report output module is used to determine the risk type, risk event and risk cause corresponding to each abnormal financial indicator data based on a preset risk analysis benchmark; and generate an indicator data early warning report based at least on the abnormal financial indicator data, the risk type, the risk event and the risk cause, so as to realize early warning for the financial indicator data.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 6 are implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images