Abnormal alarm method and device, computer storage medium and electronic equipment

Abstract

The invention relates to the technical field of computers, and provides an exception warning method, an exception warning device, a computer storage medium and electronic equipment, and the exception warning method comprises the steps: obtaining a cost deviation data sequence according to the cost deviation data corresponding to each moment in a plurality of moments of a service; the multiple moments comprise a current moment and N historical moments before the current moment; the cost deviation data is used for representing the deviation between the actual cost and the standard cost of the business at each moment; n is an integer greater than 0; performing stability analysis on the cost deviation data sequence to determine whether the cost deviation data of the service at the current moment belongs to abnormal fluctuation data; and if the cost deviation data of the service at the current moment belongs to the abnormal fluctuation data, outputting abnormal alarm information. According to the method disclosed by the invention, the business cost can be managed and controlled in time.

Description

Background Art

[0002] Cost analysis is an important part of cost management. Through cost analysis, it is helpful to correctly understand, master and apply the law of cost changes and achieve the goal of reducing costs.

[0003] In the field of logistics, the current logistics cost analysis is a post-event, manually executed, global actual cost analysis, that is, after the entire logistics chain is terminated, the cost analysis is performed based on the actual cost. However, the above solution has poor timeliness and cannot control business costs in a timely manner.

[0004] In view of this, there is an urgent need in the art to develop a new abnormal alarm method and device.

[0005] It should be noted that the information disclosed in the above background technology section is only used to enhance the understanding of the background of the present disclosure. Summary of the invention

[0006] The purpose of the present disclosure is to provide an abnormal alarm method, an abnormal alarm device, a computer storage medium and an electronic device, thereby overcoming the technical problem of being unable to timely control business costs due to the limitations of related technologies to at least a certain extent.

[0007] Other features and advantages of the present disclosure will become apparent from the following detailed description, or may be learned in part by the practice of the present disclosure.

[0008] According to the first aspect of the present disclosure, there is provided an abnormal alarm method, comprising: obtaining a cost deviation data sequence according to cost deviation data corresponding to a business at each of a plurality of moments; the plurality of moments include a current moment and N historical moments before the current moment; the cost deviation data is used to characterize the deviation between the actual cost and the standard cost of the business at each moment; N is an integer greater than 0; performing a stationarity analysis on the cost deviation data sequence to determine whether the cost deviation data of the business at the current moment belongs to abnormal fluctuation data; if the cost deviation data of the business at the current moment belongs to the abnormal fluctuation data, outputting abnormal alarm information.

[0009] In an exemplary embodiment of the present disclosure, the business includes M business links; the standard cost of the business at each moment is comprehensively determined based on the standard costs of the M business links at each moment; M is an integer greater than 1; the cost deviation data corresponding to the business at each moment in multiple moments is determined in the following manner: allocating the actual cost at each moment to obtain the allocated cost corresponding to each business link in the M business links; comparing the allocated cost corresponding to each business link with the standard cost of the business link to obtain the cost deviation data of each business link at each moment; and determining the sum of the cost deviation data of the M business links at each moment as the cost deviation data corresponding to the business at each moment.

[0010] In an exemplary embodiment of the present disclosure, the stationarity analysis of the cost deviation data sequence is performed to determine whether the cost deviation data of the business at the current moment belongs to abnormal fluctuation data, including: performing a multi-dimensional stationarity analysis on the cost deviation data sequence through a bubble test algorithm to obtain multiple stationarity evaluation values; determining a maximum evaluation value from the multiple stationarity evaluation values; if the maximum evaluation value is greater than a preset critical characteristic value, determining that the cost deviation data of the business at the current moment belongs to the abnormal fluctuation data; if the maximum evaluation value is not greater than the preset critical characteristic value, determining that the cost deviation data of the business at the current moment does not belong to the abnormal fluctuation data.

[0011] In an exemplary embodiment of the present disclosure, the preset critical characteristic value includes a statistic corresponding to a 95% confidence level.

[0012] In an exemplary embodiment of the present disclosure, the business includes M business links; the standard cost of the business at each moment is determined comprehensively based on the standard costs of the M business links at each moment; M is an integer greater than 1; after determining that the cost deviation data corresponding to the current moment belongs to the abnormal fluctuation data, the method further includes: obtaining the contribution value of the cost deviation data of each business link to the cost deviation data of the business at the current moment; and determining the abnormal business link from the M business links based on the obtained M contribution values.

[0013] In an exemplary embodiment of the present disclosure, the abnormal business link is determined from the M business links based on the obtained M contribution values, including: obtaining the absolute value of each contribution value in the M contribution values; screening out a target absolute value that meets a preset condition from the M absolute values; the preset condition is that the absolute value exceeds a preset threshold range; and determining the business link corresponding to the target absolute value as the abnormal business link.

[0014] In an exemplary embodiment of the present disclosure, after determining the abnormal business link from the M business links, the method further includes: sending the abnormal alarm information to the supervisor of the abnormal business link so that the supervisor can optimize the cost of the abnormal business link.

[0015] According to a second aspect of the present disclosure, an abnormal alarm device is provided, including: an acquisition module, used to obtain a cost deviation data sequence according to the cost deviation data corresponding to each moment of a business in multiple moments; the multiple moments include the current moment and N historical moments before the current moment; the cost deviation data is used to characterize the deviation between the actual cost and the standard cost of the business at each moment; N is an integer greater than 0; a stationarity analysis module, used to perform a stationarity analysis on the cost deviation data sequence to determine whether the cost deviation data of the business at the current moment belongs to abnormal fluctuation data; an abnormal alarm module, used to output abnormal alarm information if the cost deviation data of the business at the current moment belongs to the abnormal fluctuation data.

[0016] According to a third aspect of the present disclosure, a computer storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the abnormal alarm method described in the first aspect is implemented.

[0017] According to a fourth aspect of the present disclosure, an electronic device is provided, comprising: a processor; and a memory for storing executable instructions of the processor; wherein the processor is configured to execute the abnormal alarm method described in the first aspect above by executing the executable instructions.

[0018] It can be seen from the above technical solutions that the abnormality alarm method, abnormality alarm device, computer storage medium and electronic device in the exemplary embodiments of the present disclosure have at least the following advantages and positive effects:

[0019] In the technical solutions provided by some embodiments of the present disclosure, on the one hand, according to the cost deviation data corresponding to each moment of the business at multiple moments (including the current moment and N historical moments before the current moment), a cost deviation data sequence is obtained, and the cost deviation data sequence is subjected to a stationarity analysis to determine whether the cost deviation data of the business at the current moment belongs to abnormal fluctuation data, providing a new idea of ​​measuring whether the actual cost at the current moment is abnormal by the standard cost of the deviation between the actual cost and the standard cost, solving the problem of inaccurate identification results caused by abnormal identification based on the allocated cost in the related technology, and improving the accuracy of abnormal identification. On the other hand, if the cost deviation data of the business at the current moment belongs to the abnormal fluctuation data, an abnormal alarm message is output, so that the abnormal moment of the relevant cost can be discovered in time during the business execution process, avoiding the problem of irreparable loss caused by the post-analysis cost in the related technology, improving the timeliness of abnormal processing, and facilitating timely control of business costs.

[0020] It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] The accompanying drawings herein are incorporated into the specification and constitute a part of the specification, illustrate embodiments consistent with the present disclosure, and together with the specification are used to explain the principles of the present disclosure. Obviously, the accompanying drawings described below are only some embodiments of the present disclosure, and for ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without creative work.

[0022] Figure 1 A schematic diagram showing a flow chart of an abnormal alarm method in an embodiment of the present disclosure;

[0023] Figure 2 A schematic diagram showing a flow chart of how to obtain cost deviation data corresponding to a business at each of multiple moments in an embodiment of the present disclosure;

[0024] Figure 3 A flow chart showing how to perform a stationarity analysis on a cost deviation data sequence in an embodiment of the present disclosure to determine whether the cost deviation data of a business at the current moment is abnormal fluctuation data;

[0025] Figure 4 A schematic diagram showing a flow chart of how to determine an abnormal business link in an embodiment of the present disclosure;

[0026] Figure 5 A schematic diagram showing how to calculate the SHAP value using the three characteristics of age, gender and job as examples in the embodiment of the present disclosure is shown;

[0027] Figure 6 A schematic diagram showing how to calculate the SHAP value corresponding to age in an embodiment of the present disclosure;

[0028] Figure 7 A result schematic diagram showing the SHAP value corresponding to the cost deviation data of each business link in the embodiment of the present disclosure;

[0029] Figure 8 The overall block diagram of the abnormal alarm method in the embodiment of the present disclosure is shown;

[0030] Fig. 9 A schematic diagram showing the structure of an abnormality alarm device in an exemplary embodiment of the present disclosure is shown;

[0031] Fig.10 A schematic structural diagram of an electronic device in an exemplary embodiment of the present disclosure is shown. DETAILED DESCRIPTION

[0032] Example embodiments will now be described more fully with reference to the accompanying drawings. However, example embodiments can be implemented in a variety of forms and should not be construed as being limited to the examples set forth herein; on the contrary, these embodiments are provided so that the present disclosure will be more comprehensive and complete, and the concepts of the example embodiments are fully conveyed to those skilled in the art. The described features, structures, or characteristics may be combined in one or more embodiments in any suitable manner. In the following description, many specific details are provided to provide a full understanding of the embodiments of the present disclosure. However, those skilled in the art will appreciate that the technical solutions of the present disclosure may be practiced while omitting one or more of the specific details, or other methods, components, devices, steps, etc. may be adopted. In other cases, known technical solutions are not shown or described in detail to avoid obscuring various aspects of the present disclosure.

[0033] The terms "a", "an", "the" and "said" are used in this specification to indicate the presence of one or more elements / components / etc.; the terms "including" and "having" are used to express an open-ended inclusion and mean that additional elements / components / etc. may exist in addition to the listed elements / components / etc.; the terms "first" and "second" etc. are used only as labels and are not intended to limit the quantity of their objects.

[0034] In addition, the accompanying drawings are only schematic illustrations of the present disclosure and are not necessarily drawn to scale. The same reference numerals in the drawings represent the same or similar parts, and their repeated descriptions will be omitted. Some of the block diagrams shown in the accompanying drawings are functional entities and do not necessarily correspond to physically or logically independent entities.

[0035] The current logistics cost analysis is generally an ex post facto, manually executed, global actual cost analysis, which will be allocated based on the overall cost according to different splitting logics.

[0036] The manual cost allocation method has poor timeliness and is difficult to control in a timely manner. In addition, it is impossible to see the cost issues in each link, and in the absence of a cost benchmark, it is impossible to determine whether the current cost is reasonable, resulting in a negative profit and loss. For example, in the actual operation link, sales personnel, based on the result-oriented approach of revenue first, continue to give low discounts to ensure new signings and retention, but ignore the huge damage that discount costs bring to the profitability of logistics itself. In addition, when finalizing the outsourcing cost, it is easy to make the labor cost exceed the preset standard cost of the link in the initial quotation.

[0037] In addition, there are some solutions that use classification models to identify abnormal costs. However, although the classification model can record the cost status of each day in an array and train to identify abnormal points through different status arrays of multiple days, in essence, the above solution has subjectivity and limitations in the definition and selection of abnormal samples, and thus the accuracy of the recognition results cannot be guaranteed.

[0038] In the embodiments of the present disclosure, firstly, an abnormal alarm method is provided, which at least to a certain extent overcomes the defect in the related art that the business cost cannot be controlled in time.

[0039] Figure 1 A flow chart of the abnormality alarm method in the embodiment of the present disclosure is shown. The execution subject of the abnormality alarm method may be a server that executes the abnormality alarm.

[0040] refer to Figure 1 According to an embodiment of the present disclosure, the abnormal alarm method includes the following steps:

[0041] Step S110, obtaining cost deviation data corresponding to each moment of the business in multiple moments; the multiple moments include the current moment and N historical moments before the current moment; the cost deviation data is used to characterize the deviation between the actual cost and the standard cost of the business at each moment; N is an integer greater than 0;

[0042] Step S120, performing a stationarity analysis on the cost deviation data sequence to determine whether the cost deviation data of the business at the current moment is abnormal fluctuation data;

[0043] Step S130: If the cost deviation data of the business at the current moment is abnormal fluctuation data, output abnormal alarm information.

[0044] exist Figure 1In the technical solution provided by the illustrated embodiment, on the one hand, according to the cost deviation data corresponding to each moment of the business at multiple moments (including the current moment and N historical moments before the current moment), a cost deviation data sequence is obtained, and the cost deviation data sequence is subjected to a stationarity analysis to determine whether the cost deviation data of the business at the current moment belongs to abnormal fluctuation data, providing a new idea of ​​measuring whether the actual cost at the current moment is abnormal by the standard cost of the deviation between the actual cost and the standard cost, solving the problem of inaccurate identification results caused by abnormal identification based on the allocated cost in the related technology, and improving the accuracy of abnormal identification. On the other hand, if the cost deviation data of the business at the current moment belongs to the abnormal fluctuation data, an abnormal alarm message is output, so that the abnormal moment of the relevant cost can be discovered in time during the business execution process, avoiding the problem of irreparable loss caused by the post-analysis cost in the related technology, improving the timeliness of abnormal processing, and facilitating timely control of business costs.

[0045] The following Figure 1 The specific implementation process of each step is described in detail:

[0046] In step S110, cost deviation data corresponding to the business at each of multiple moments is obtained.

[0047] In this step, business refers to the affairs that need to be handled in various industries, but usually refers to sales affairs, because any company unit is ultimately still mainly engaged in selling products, services, technology, etc. For example, the business in this disclosure can be logistics and transportation business, goods production business, goods sales business, etc., which can be set according to actual conditions, and this disclosure does not make special restrictions on this.

[0048] The above business may include at least M (M is an integer greater than 1) business links. A business link is an orderly combination of various tasks performed to complete a certain business. It may be the matters, steps or procedures included in the above business. Through the flow of each business link, the above business can be completed. Taking the above business as logistics and transportation business as an example, the business links it includes may be: transporting items from the war zone to the district, transporting items from the district to the business department, and transporting items from the business department to the site.

[0049] In the following embodiments, the logistics and transportation business is taken as an example, and the business includes five business links A, B, C, D, and E.

[0050] The above cost deviation data is used to characterize the deviation between the actual cost and the standard cost of the business at each moment.

[0051] Among them, the actual cost of the business at each moment refers to the cost that has already occurred and can be clearly confirmed and measured.

[0052] Standard cost refers to the cost of manufacturing products under normal and efficient operation conditions, rather than the actual cost incurred. It is a target cost incurred under effective operating conditions, also known as "should cost". Specifically, the standard cost of a business at each moment is determined based on the standard costs of the above M business links at each moment. For example, suppose at any moment t 0 , the standard costs corresponding to the five business links A, B, C, D, and E are: A' 1 ,B' 1 ,C 1 ',D' 1 ,E' 1 , then the standard cost of the business at that time is A' 1 +B' 1 +C' 1 +D' 1 +E' 1 .

[0053] Specifically, refer to Figure 2 , Figure 2 A flow chart showing how to obtain cost deviation data corresponding to a business at each of multiple moments in the embodiment of the present disclosure includes steps S201 to S203:

[0054] In step S201, the actual cost at each moment is apportioned to obtain the apportioned cost corresponding to each of the M business links.

[0055] In this step, the above-mentioned multiple moments include the current moment and N (N is an integer greater than 0) historical moments before the current moment. The time interval between each moment can be set according to actual conditions. For example, it can be 1 minute, 5 minutes, or 10 minutes. It can be set according to actual conditions. The present disclosure does not make any special limitation on this.

[0056] For example, assuming that the service starts at 8 o'clock, the current time is 9 o'clock, and the time interval between each time is 1 minute, then the multiple time periods can be every minute from 8 o'clock to 9 o'clock, that is, a total of 60 time periods.

[0057] Therefore, still at any time t 0 Take this as an example to illustrate, assuming t 0 The actual cost at the moment is cost 1 , and the apportionment rule is that business link A accounts for 10%, business link B accounts for 40%, business link C accounts for 20%, business link D accounts for 20%, and business link E accounts for 10%. For example, at t 1 At this moment, the apportioned costs of the above five business links can be expressed as: A1 (10%*cost 1 ), B 1 (40%*cost 1 ), C 1 (20%*cost 1 )、D 1 (20%*cost 1 ), E 1 (10%*cost 1 ). It should be noted that the above-mentioned apportionment rules can be set according to actual conditions, and this disclosure does not make any special restrictions on this.

[0058] In step S202, the allocated cost corresponding to each business link is compared with the standard cost of the business link to obtain the cost deviation data of each business link at each moment.

[0059] In this step, referring to the relevant explanations of the above steps, it can be seen that the standard costs of the above five business links are A' 1 , B' 1 , C' 1 , D' 1 , E' 1 , and the corresponding apportioned costs of the above five business links are A 1 , B 1 , C 1 , D 1 , E 1 , thus, the cost deviation data Diff of business link A at each moment A Can be A 1 -A' 1 , the cost deviation data Diff of business link B at each moment B Can be B 1 -B′ 1 , the cost deviation data Diff of business link C at each moment C Can be C 1 -C' 1 , the cost deviation data Diff of business link D at each moment D It can be D 1 -D′ 1 , the cost deviation data Diff of business link E at each moment E It can be E 1 -E′ 1 .

[0060] In step S203, the sum of the cost deviation data of the M business links at each moment is determined as the cost deviation data corresponding to the business at each moment.

[0061] In this step, the sum of the cost deviation data of the above M business links at each moment can be: Diff A +Diff B +Dif C +Diff D +Diff E , so the cost deviation data corresponding to the business at each moment is Diff A +Diff B +Diff C +Diff D +Diff E .

[0062] Similarly, multiple cost deviation data corresponding to the business at multiple times can be calculated through steps S201 to S203. For example, taking the multiple times from time ti to time t as an example, the multiple cost deviation data corresponding to the multiple times can be expressed as Diff t-i 、......、Diff t-1 、Diff t .

[0063] After obtaining a plurality of cost deviation data corresponding to the business at a plurality of time points, the process may proceed to step S120 to perform a stationarity analysis on the cost deviation data sequence to determine whether the cost deviation data of the business at the current time point is abnormal fluctuation data.

[0064] In this step, you can refer to Figure 3 , Figure 3 A flow chart showing how to perform a stationarity analysis on a cost deviation data sequence in an embodiment of the present disclosure to determine whether the cost deviation data of a business at the current moment is abnormal fluctuation data includes steps S301 to S304:

[0065] In step S301, a multi-dimensional stationarity analysis is performed on the cost deviation data sequence using a bubble test algorithm to obtain multiple stationarity evaluation values.

[0066] In this step, the GSADF test algorithm can be used to perform a multi-dimensional stationarity analysis on the above-mentioned multiple cost deviation data to determine whether the cost deviation data at the current moment is abnormal fluctuation data. The GSADF test is generally used to detect the degree of bubble in the financial market (a bubble is an economic phenomenon in which asset prices continue to deviate significantly from their underlying value). The present disclosure creatively applies the test method to the detection of cost abnormal data to identify abnormal fluctuation data in the above-mentioned multiple cost deviation data.

[0067] The concept of GSADF comes from ADF (Augmented Dickey-Fuller test, unit root test), which means that in an autoregressive process: y t =by t-1 +a+∈ t , a is a constant, ∈ t is the residual, and if the lag term coefficient b is 1, it is called a unit root. When a unit root exists, the relationship between the independent variable and the dependent variable is deceptive because the residual sequence ∈ t Any error in will not decay as the sample size (i.e., the number of periods) increases, which means that the residual effect in the model is permanent, and the target y will always be in an unstable state of random fluctuations. When there is no unit root, the target y is relatively stable overall and the range is controllable.

[0068] The idea of ​​the GSADF test is to traverse the sample data multiple times, select sub-samples of different dimensions in each traversal (for example, the cost deviation data can be slidingly intercepted multiple times with data interception windows of different lengths, and the data fragments intercepted each time are different), and use the sub-samples to calculate the ADF statistic. The maximum value of the multiple ADF statistics obtained by multiple traversals is taken as the GSADF statistic, which is compared with the critical value (which can be the statistic corresponding to the 95% confidence level). If it is greater than the critical value, it falls into the rejection domain, indicating that there is a bubble in the sequence (that is, the sequence is in an unstable state).

[0069] Therefore, corresponding to the present disclosure, the cost deviation data corresponding to the current moment and the N historical moments between the current moment can be used to construct a p-order autoregressive function for the cost deviation data at the current moment: Where a is a constant, to is the lag term coefficient, ∈ t is the residual. Autoregression, also known as autoregressive model (AR model for short), is a statistical method for processing time series. It uses the performance of the same variable in previous periods to predict the performance of the variable in this period. Because it is not used to predict other variables, but to predict itself, it is called autoregression.

[0070] Therefore, the present disclosure can be based on the multiple cost deviation data Diff corresponding to the above multiple moments. t-i 、……、Diff t-1 、Diff t Subsamples of different dimensions are selected to construct different p-order autoregressive functions for the cost deviation data at the current moment. Each p-order autoregressive function outputs a prediction value. Thus, multiple prediction values, i.e., the multiple stationarity estimation values ​​mentioned above, can be obtained.

[0071] In step S302, a maximum evaluation value is determined from a plurality of stationarity evaluation values.

[0072] In this step, a maximum evaluation value, that is, a stability evaluation value with the largest value, can be determined from the above multiple stability evaluation values.

[0073] In step S303, if the maximum evaluation value is greater than the preset critical characteristic value, it is determined that the cost deviation data of the business at the current moment is abnormal fluctuation data.

[0074] In this step, the above-mentioned preset critical eigenvalue can be a statistic corresponding to a 95% confidence level. The preset critical eigenvalue can be obtained by looking up a standard normal distribution table. Exemplarily, it can also be set to other values ​​and can be set according to actual conditions. The present disclosure does not make any special limitations on this.

[0075] If the maximum evaluation value is greater than the preset critical characteristic value, it can be determined that the cost deviation data of the business at the current moment is abnormal fluctuation data, that is, the abnormal label is 1.

[0076] In step S304, if the maximum evaluation value is not greater than the preset critical characteristic value, it is determined that the cost deviation data of the business at the current moment does not belong to abnormal fluctuation data.

[0077] In this step, if the maximum evaluation value is not greater than (ie, less than or equal to) the preset critical characteristic value, it can be determined that the cost deviation data of the business at the current moment does not belong to abnormal fluctuation data, that is, the abnormal label is 0.

[0078] Next reference Figure 1 In step S130, if the cost deviation data of the business at the current moment is abnormal fluctuation data, an abnormal alarm message is output.

[0079] In this step, after determining that the cost deviation data of the business at the current moment is abnormal fluctuation data, abnormal alarm information can be output, for example: the cost at the current moment is abnormal, please pay attention, so that relevant supervisors can pay attention to the abnormal fluctuation data in time and optimize and adjust the business cost in advance before the business is completed.

[0080] Optionally, after determining that the cost deviation data of the business at the current moment is abnormal fluctuation data, the present disclosure may also identify abnormal business links in the business that cause the cost deviation data to be abnormal, thereby providing targeted abnormal reasons.

[0081] refer to Figure 4 , Figure 4A flowchart showing how to determine an abnormal business link in an embodiment of the present disclosure includes steps S401 and S402:

[0082] In step S401, the contribution value of the cost deviation data of each business link to the cost deviation data of the business at the current moment is obtained.

[0083] In this step, the contribution value of the cost deviation data of each business link to the cost deviation data of the business at the current moment can be obtained, where the contribution value is the SHAP value. SHAP stands for SHapley Additive exPlanation, which is a relatively versatile model interpretability method that can be used for both global and local interpretations, that is, the SHAP value can be used to explain the decisions of machine learning methods. SHAP belongs to the method of post-model interpretation, and its core idea is to quantify the contribution of each feature to the prediction made by the model. Therefore, by measuring the contribution value of the cost deviation data of each business link at each moment to the cost deviation data of the business at the current moment, the diagnosis of abnormal business links can be achieved.

[0084] Exemplarily, the abnormal label corresponding to the cost deviation data of the above-mentioned business at the current moment (the abnormal label is 1 if it belongs to abnormal fluctuation data, and the abnormal label is 0 if it does not belong to abnormal fluctuation data) and the cost deviation data of each business link at the current moment can be input into the SHAP calculation model, and the SHAP value corresponding to the cost deviation data of each business link can be obtained according to the output of the SHAP model.

[0085] The following uses the prediction of age, gender, and job as an example to explain how to calculate the SHAP value. Figure 5 , Figure 5 FIG. 1 is a schematic diagram showing how to calculate the SHAP value by taking age, gender, and job as examples in the embodiment of the present disclosure. Figure 5 As shown:

[0086] The above three characteristics can be freely combined and shared There are 8 cases in total. Assuming that 8 linear regression models have been trained (model 1 is a model without any features), these 8 models are used to predict the same test sample, and 8 prediction results can be output. Figure 5 In the figure, f represents the number of available features. In the box corresponding to each model, the first row represents the combination of features, the second row represents the model's predicted income, and each edge represents the marginal contribution of a feature to the model.

[0087] SHAP considers the marginal contribution of each feature, so for model 2, the marginal contribution of the Age feature alone is: MCAge{Age} =40k$-50k$=-10k$, but if you want to calculate the total marginal contribution of a certain feature, you need to sum up the marginal contributions of all models involving this feature.

[0088] refer to Figure 6 , Figure 6 A schematic diagram showing how to calculate the SHAP value corresponding to age in the embodiment of the present disclosure. Figure 6 As shown, the marginal contribution brought by Age needs to consider model 1 (the marginal contribution brought by the empty set model is 0), 2, 5, 6, and 8 at the same time. The contribution value of age is: SHAP age =w 1 *MC Age{Age} +w 2 *MC Age{Age,Gender} +w 3 *MC Age{Age,Job} +w 4 *MC Age{Age,Gender,Job} , where w 1 +w 2 +w 3 +w 4 =1.

[0089] Second, the weights are determined based on several principles: the sum of the weights of all marginal contributions to a model with 1 feature should be equal to the sum of the weights of all marginal contributions to a model with 2 features, and so on. In other words, the sum of all weights on the same number of combined layers should be equal to the sum of all weights on any other combined layers, i.e., w 1 =w 2 +w 3 =w 4 In addition, the weights of all marginal contributions to the model of feature combinations on the same combination layer should be equal, that is, w 2 =w 3 , from which we can conclude: thereby, Similarly, SHAP Gender =-2.33k$,SHAP Job =46.66k$.

[0090] Similarly, corresponding to the five business links in this disclosure, they are freely combined and shared. In this case, SHAP needs to train a different model for each different combination, which means there are 32 models. These models are completely equivalent when it comes to their hyperparameters and training data. The only difference is the features included in the model. Exemplarily, the cost deviation data of each business link before time ti can be obtained as a training set, and the data at time (ti, t] can be used as a validation set. The training set is used to train an initial model, and then the validation set is used to adjust the parameters of the initial model to obtain the above 32 models. After training the above 32 models, the SHAP value corresponding to the cost deviation data of each link can be calculated by referring to the above principles. Exemplarily, for business link A, the models involving business link A as a feature have a total of , where 1 means the number of models that only involve one business link as a feature and include business link A. Indicates the number of models that involve only two business links as features and include business link A. Indicates the number of models that involve three business links as features and include business link A. Indicates the number of models that involve four business links as features and include business link A. represents the number of models that involve five business links as features and include business link A. Thus, SHAP A =w 1 *MC A{A} +...+w n *MC A{A,B,C,D,E} ,Similarly, SHAP values ​​of other business links can be obtained.

[0091] refer to Figure 7 , Figure 7 A schematic diagram showing the result of the SHAP value corresponding to the cost deviation data of each business link in the embodiment of the present disclosure is shown. Figure 7 It can be seen that the SHAP value corresponding to the cost deviation data of business link A is +5.79, the SHAP value corresponding to the cost deviation data of business link B is -2.17, the SHAP value corresponding to the cost deviation data of business link C is -0.73, the SHAP value corresponding to the cost deviation data of business link D is -0.49, and the SHAP value corresponding to the cost deviation data of business link E is -0.43.

[0092] In step S402, an abnormal business link is determined from the M business links according to the obtained M contribution values.

[0093] In this step, the absolute value of each contribution value among the M contribution values ​​can be obtained, and the target absolute value that meets the preset conditions can be screened out from the M absolute values. Then, the business link corresponding to the target absolute value can be determined as an abnormal business link.

[0094] Next reference Figure 7 , then the absolute value of +5.79 is 5.79, the absolute value of -2.17 is 2.17, the absolute value of -0.73 is 0.73, the absolute value of -0.49 is 0.49, and the absolute value of -0.43 is 0.43. Assuming that the above preset condition is that the absolute value exceeds the preset threshold range, taking the preset threshold range of [0, 3] as an example, it can be determined that 5.79 is the target absolute value that exceeds the preset threshold range. Therefore, the business link A corresponding to 5.79 can be determined as the above abnormal business link.

[0095] After the abnormal business link is determined from the M business links, an abnormal alarm message can be sent to the supervisor of the abnormal business link so that the supervisor can optimize the cost of the abnormal business link. For example, assuming that the abnormal business link is a trunk link, the supervisor can take some cost constraint measures to optimize the cost, such as changing to a more economical transportation method to save costs while ensuring timeliness and experience.

[0096] refer to Figure 8 , Figure 8 The overall block diagram of the abnormal alarm method in the embodiment of the present disclosure is shown as follows: Figure 8 As shown, the cost offset data sequences at multiple moments can be input into the bubble test model. Based on the output of the bubble test model, it can be predicted whether the cost offset data sequence at the current moment is abnormal fluctuation data. Afterwards, the prediction results and the cost offset data of each business link at the current moment can be input into the SHAP model, and the SHAP value output by the SHAP model can be used to explain the reasons for the above prediction results.

[0097] The present disclosure innovatively uses the GSADF test commonly used in the financial field for bubble detection to identify abnormal cost moments in the business and output the explanation reasons corresponding to the abnormal identification results (i.e., which business link caused the cost abnormality), so as to achieve abnormal problem diagnosis. The above information can be input into the actual operation link as a reference for cost control to adjust the operation action and achieve cost optimization.

[0098] The present disclosure also provides an abnormal alarm device, Fig. 9 A schematic diagram showing the structure of an abnormality alarm device in an exemplary embodiment of the present disclosure is shown; Fig. 9 As shown, the abnormality alarm device 900 may include an acquisition module 910, a stability analysis module 920 and an abnormality alarm module 930. Among them:

[0099] The acquisition module 910 is used to obtain a cost deviation data sequence according to the cost deviation data corresponding to each moment of the business in multiple moments; the multiple moments include the current moment and N historical moments before the current moment; the cost deviation data is used to represent the deviation between the actual cost of the business at each moment and the standard cost; N is an integer greater than 0;

[0100] A stationarity analysis module 920 is used to perform a stationarity analysis on the cost deviation data sequence to determine whether the cost deviation data of the business at the current moment is abnormal fluctuation data;

[0101] The abnormal alarm module 930 is used to output abnormal alarm information if the cost deviation data of the business at the current moment belongs to the abnormal fluctuation data.

[0102] In an exemplary embodiment of the present disclosure, the business includes M business links; the standard cost of the business at each moment is comprehensively determined based on the standard costs of the M business links at each moment; M is an integer greater than 1; the cost deviation data corresponding to the business at each moment in multiple moments is determined in the following manner: allocating the actual cost at each moment to obtain the allocated cost corresponding to each business link in the M business links; comparing the allocated cost corresponding to each business link with the standard cost of the business link to obtain the cost deviation data of each business link at each moment; and determining the sum of the cost deviation data of the M business links at each moment as the cost deviation data corresponding to the business at each moment.

[0103] In an exemplary embodiment of the present disclosure, the stationarity analysis module 920 performs a stationarity analysis on the cost deviation data sequence to determine whether the cost deviation data of the business at the current moment belongs to abnormal fluctuation data, including: performing a multi-dimensional stationarity analysis on the cost deviation data sequence through a bubble test algorithm to obtain multiple stationarity evaluation values; determining a maximum evaluation value from the multiple stationarity evaluation values; if the maximum evaluation value is greater than a preset critical characteristic value, determining that the cost deviation data of the business at the current moment belongs to the abnormal fluctuation data; if the maximum evaluation value is not greater than the preset critical characteristic value, determining that the cost deviation data of the business at the current moment does not belong to the abnormal fluctuation data.

[0104] In an exemplary embodiment of the present disclosure, the preset critical characteristic value includes a statistic corresponding to a 95% confidence level.

[0105] In an exemplary embodiment of the present disclosure, the business includes M business links; the standard cost of the business at each moment is comprehensively determined based on the standard costs of the M business links at each moment; M is an integer greater than 1; after determining that the cost deviation data corresponding to the current moment belongs to the abnormal fluctuation data, the abnormal alarm module 930 is configured to:

[0106] Acquire the contribution value of the cost deviation data of each business link to the cost deviation data of the business at the current moment; and determine the abnormal business link from the M business links based on the obtained M contribution values.

[0107] In an exemplary embodiment of the present disclosure, the abnormal alarm module 930 determines the abnormal business link from the M business links based on the M contribution values ​​obtained, including: obtaining the absolute value of each contribution value in the M contribution values; screening out the target absolute value that meets the preset condition from the M absolute values; the preset condition is that the absolute value exceeds a preset threshold range; and determining the business link corresponding to the target absolute value as the abnormal business link.

[0108] In an exemplary embodiment of the present disclosure, after determining an abnormal service link from the M service links, the abnormal alarm module 930 is configured to:

[0109] The abnormal alarm information is sent to the supervisor of the abnormal business link, so that the supervisor can optimize the cost of the abnormal business link.

[0110] The specific details of each module in the above abnormal alarm device have been described in detail in the corresponding abnormal alarm method, so they will not be repeated here.

[0111] It should be noted that, although several modules or units of the device for action execution are mentioned in the above detailed description, this division is not mandatory. In fact, according to the embodiments of the present disclosure, the features and functions of two or more modules or units described above can be embodied in one module or unit. On the contrary, the features and functions of one module or unit described above can be further divided into multiple modules or units to be embodied.

[0112] In addition, although the steps of the method in the present disclosure are described in a specific order in the drawings, this does not require or imply that the steps must be performed in this specific order, or that all the steps shown must be performed to achieve the desired results. Additionally or alternatively, some steps may be omitted, multiple steps may be combined into one step, and / or one step may be decomposed into multiple steps, etc.

[0113] Through the description of the above implementation, it is easy for those skilled in the art to understand that the example implementation described here can be implemented by software, or by software combined with necessary hardware. Therefore, the technical solution according to the implementation of the present disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, including several instructions to enable a computing device (which can be a personal computer, a server, a mobile terminal, or a network device, etc.) to execute the method according to the implementation of the present disclosure.

[0114] The present application also provides a computer-readable storage medium, which may be included in the electronic device described in the above embodiment; or may exist independently without being assembled into the electronic device.

[0115] The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus or device, or any combination thereof. More specific examples of computer-readable storage media may include, but are not limited to, an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program that may be used by or in conjunction with an instruction execution system, apparatus, or device.

[0116] Computer-readable storage media can send, propagate or transmit programs for use by or in conjunction with an instruction execution system, apparatus or device. The program code contained on the computer-readable storage medium can be transmitted using any appropriate medium, including but not limited to: wireless, wire, optical cable, RF, etc., or any suitable combination of the above.

[0117] The computer-readable storage medium carries one or more programs. When the one or more programs are executed by an electronic device, the electronic device implements the method described in the above embodiments.

[0118] In addition, an electronic device capable of implementing the above method is also provided in an embodiment of the present disclosure.

[0119] Those skilled in the art will appreciate that various aspects of the present disclosure may be implemented as systems, methods or program products. Therefore, various aspects of the present disclosure may be specifically implemented in the following forms, namely: complete hardware implementation, complete software implementation (including firmware, microcode, etc.), or a combination of hardware and software, which may be collectively referred to herein as "circuits", "modules" or "systems".

[0120] Refer to the following Fig.10 The electronic device 1000 according to this embodiment of the present disclosure is described. Fig.10 The electronic device 1000 shown is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present disclosure.

[0121] like Fig.10 As shown, the electronic device 1000 is in the form of a general computing device. The components of the electronic device 1000 may include, but are not limited to: the at least one processing unit 1010, the at least one storage unit 1020, a bus 1030 connecting different system components (including the storage unit 1020 and the processing unit 1010), and a display unit 1040.

[0122] The storage unit stores program codes, which can be executed by the processing unit 1010, so that the processing unit 1010 performs the steps according to various exemplary embodiments of the present disclosure described in the above “Exemplary Method” section of this specification. For example, the processing unit 1010 can perform the following steps: Figure 1 As shown in: Step S110, obtaining a cost deviation data sequence according to the cost deviation data corresponding to each moment of the business in multiple moments; the multiple moments include the current moment and N historical moments before the current moment; the cost deviation data is used to characterize the deviation between the actual cost and the standard cost of the business at each moment; N is an integer greater than 0; Step S120, performing a stationarity analysis on the cost deviation data sequence to determine whether the cost deviation data of the business at the current moment belongs to abnormal fluctuation data; Step S130, if the cost deviation data of the business at the current moment belongs to the abnormal fluctuation data, outputting abnormal alarm information.

[0123] The storage unit 1020 may include a readable medium in the form of a volatile storage unit, such as a random access storage unit (RAM) 10201 and / or a cache storage unit 10202 , and may further include a read-only storage unit (ROM) 10203 .

[0124] The storage unit 1020 may also include a program / utility 10204 having a set (at least one) of program modules 10205, such program modules 10205 including but not limited to: an operating system, one or more application programs, other program modules, and program data, each of which or some combination may include an implementation of a network environment.

[0125] Bus 1030 may represent one or more of several types of bus structures, including a memory unit bus or memory unit controller, a peripheral bus, an accelerated graphics port, a processing unit, or a local bus using any of a variety of bus architectures.

[0126] The electronic device 1000 may also communicate with one or more external devices 1100 (e.g., keyboards, pointing devices, Bluetooth devices, etc.), may also communicate with one or more devices that enable a user to interact with the electronic device 1000, and / or may communicate with any device that enables the electronic device 1000 to communicate with one or more other computing devices (e.g., routers, modems, etc.). Such communication may be performed via an input / output (I / O) interface 1050. Furthermore, the electronic device 1000 may also communicate with one or more networks (e.g., a local area network (LAN), a wide area network (WAN), and / or a public network, such as the Internet) via a network adapter 1060. As shown, the network adapter 1060 communicates with other modules of the electronic device 1000 via a bus 1030. It should be understood that, although not shown in the figure, other hardware and / or software modules may be used in conjunction with the electronic device 1000, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0127] Those skilled in the art will readily appreciate other embodiments of the present disclosure after considering the specification and practicing the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of the present disclosure that follow the general principles of the present disclosure and include common knowledge or customary technical means in the art that are not disclosed in the present disclosure. The specification and examples are to be considered exemplary only, and the true scope and spirit of the present disclosure are indicated by the claims.

Claims

1. An abnormal alarm method, characterized in that: include: According to the cost deviation data corresponding to each moment of the business in multiple moments, a cost deviation data sequence is obtained; the multiple moments include the current moment and N historical moments before the current moment; the cost deviation data is used to characterize the deviation between the actual cost and the standard cost of the business at each moment; N is an integer greater than 0; Performing a stationarity analysis on the cost deviation data sequence to determine whether the cost deviation data of the business at the current moment is abnormal fluctuation data; If the cost deviation data of the business at the current moment belongs to the abnormal fluctuation data, an abnormal alarm message is output.

2. The method according to claim 1, characterized in that: The business includes M business links; the standard cost of the business at each moment is determined comprehensively based on the standard costs of the M business links at each moment; M is an integer greater than 1; The cost deviation data corresponding to each moment of the business at a plurality of moments is determined in the following manner: Apportioning the actual cost at each moment to obtain an apportioned cost corresponding to each of the M business links; Compare the allocated cost corresponding to each business link with the standard cost of the business link to obtain the cost deviation data of each business link at each moment; The sum of the cost deviation data of the M business links at each moment is determined as the cost deviation data corresponding to the business at each moment.

3. The method according to claim 1, characterized in that The performing stationarity analysis on the cost deviation data sequence to determine whether the cost deviation data of the business at the current moment is abnormal fluctuation data includes: Performing a multi-dimensional stationarity analysis on the cost deviation data sequence through a bubble test algorithm to obtain multiple stationarity evaluation values; Determining a maximum evaluation value from the plurality of stationarity evaluation values; If the maximum evaluation value is greater than a preset critical characteristic value, it is determined that the cost deviation data of the business at the current moment belongs to the abnormal fluctuation data; If the maximum evaluation value is not greater than the preset critical characteristic value, it is determined that the cost deviation data of the business at the current moment does not belong to the abnormal fluctuation data.

4. The method according to claim 3, characterized in that: The preset critical characteristic value includes a statistic corresponding to a 95% confidence level.

5. The method according to claim 1, characterized in that The business includes M business links; the standard cost of the business at each moment is determined comprehensively based on the standard costs of the M business links at each moment; M is an integer greater than 1; After determining that the cost deviation data corresponding to the current moment belongs to the abnormal fluctuation data, the method further includes: Acquire the contribution value of the cost deviation data of each business link to the cost deviation data of the business at the current moment; According to the obtained M contribution values, an abnormal business link is determined from the M business links.

6. The method according to claim 5, characterized in that Determining an abnormal business link from the M business links according to the obtained M contribution values ​​includes: Obtaining the absolute value of each contribution value among the M contribution values; Filter out a target absolute value that meets a preset condition from the M absolute values; the preset condition is that the absolute value exceeds a preset threshold range; The business link corresponding to the target absolute value is determined as the abnormal business link.

7. The method according to claim 5, characterized in that After determining the abnormal business link from the M business links, the method further includes: The abnormal alarm information is sent to the supervisor of the abnormal business link, so that the supervisor can optimize the cost of the abnormal business link.

8. An abnormal alarm device, characterized in that: include: An acquisition module, used to obtain a cost deviation data sequence according to cost deviation data corresponding to each moment of a business in a plurality of moments; the plurality of moments include a current moment and N historical moments before the current moment; the cost deviation data is used to characterize the deviation between the actual cost of the business at each moment and the standard cost; N is an integer greater than 0; A stationarity analysis module, used for performing stationarity analysis on the cost deviation data sequence to determine whether the cost deviation data of the business at the current moment is abnormal fluctuation data; The abnormal alarm module is used to output abnormal alarm information if the cost deviation data of the business at the current moment belongs to the abnormal fluctuation data.

9. A computer storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the abnormality alarm method according to any one of claims 1 to 7 is implemented.

10. An electronic device, characterized in that: include: processor; as well as A memory, configured to store executable instructions of the processor; The processor is configured to execute the abnormality alarm method according to any one of claims 1 to 7 by executing the executable instructions.

Images