Enterprise abnormal business data detection method and device, equipment and storage medium

Abstract

The invention relates to an enterprise abnormal business data detection method and device, equipment and a storage medium. The method comprises the following steps: acquiring multiple pieces of business data of an enterprise; determining the number of clusters for the plurality of business data according to the business experience information of the business to which the plurality of business data belong; performing clustering processing on the plurality of business data according to the number of the clustering clusters to obtain a plurality of clusters matched with the number of the clustering clusters; for any cluster in the plurality of clusters, determining a clustering neighborhood radius and a clustering minimum point number according to the data distribution information of any cluster and the business demand information of the plurality of business data attribution businesses; performing clustering processing on any cluster according to the clustering neighborhood radius and the clustering minimum point number to obtain at least one sub-cluster and service data not belonging to the sub-cluster; and determining the business data which do not belong to the sub-cluster as the abnormal business data of the enterprise. By adopting the method, the detection accuracy of the abnormal business data of the enterprise can be improved.

Description

Technical Field

[0001] The present application relates to the field of machine learning technology, and in particular to a method, apparatus, computer equipment, computer-readable storage medium, and computer program product for detecting abnormal business data of an enterprise. Background Art

[0002] With the rapid development of information technology, enterprises will accumulate massive amounts of business data in their daily operations. Taking cutting-edge technology fields such as smart grids and large data centers as examples, these business data not only reflect the operating status and performance of the system, but also provide valuable information for optimizing decision-making, accurate monitoring, and forward-looking risk management. Among these massive amounts of business data, there may be abnormal data or risk signals that cannot be ignored, which may be caused by performance degradation caused by equipment aging, human operational errors, external network attacks, or data entry errors. If these abnormal data cannot be identified and properly handled quickly and accurately, it may not only threaten the stable operation of the system, but may also cause serious consequences such as business interruption and data leakage, which may cause inestimable losses to the enterprise. In traditional technologies, abnormal business data of enterprises can be detected based on methods such as statistical threshold setting and matching judgment of preset rules. However, these methods have a low accuracy rate in detecting abnormal business data of enterprises when facing complex, changeable, large-scale, and multi-dimensional data sets. Summary of the invention

[0003] Based on this, it is necessary to provide a method, device, computer equipment, computer-readable storage medium and computer program product for detecting abnormal business data of an enterprise, which can improve the detection accuracy of abnormal business data of an enterprise, in response to the above technical problems.

[0004] In a first aspect, the present application provides a method for detecting abnormal business data of an enterprise, comprising:

[0005] Acquire multiple business data of the enterprise; the business data includes key indicator sub-data of multiple dimensions;

[0006] Determining the number of clusters for the multiple business data according to the business experience information of the business to which the multiple business data belong;

[0007] According to the number of clusters, clustering processing is performed on the plurality of business data to obtain a plurality of clusters matching the number of clusters; the cluster includes at least one of the business data;

[0008] For any one of the multiple clusters, determining a cluster neighborhood radius and a minimum number of cluster points according to data distribution information of the any one cluster and service demand information of services to which the multiple service data belong;

[0009] According to the cluster neighborhood radius and the minimum number of cluster points, clustering is performed on any one of the clusters to obtain at least one sub-cluster and business data that does not belong to the sub-cluster; the number of business data included in the sub-cluster is greater than or equal to the minimum number of points;

[0010] The business data that does not belong to the sub-cluster is determined as abnormal business data of the enterprise; the abnormal business data of the enterprise is used to generate warning information, and the warning information is used to prompt the abnormal business data of the enterprise to be processed.

[0011] In one embodiment, determining the number of clusters for the multiple business data according to the business experience information of the business to which the multiple business data belong includes:

[0012] Determining the service type of the service to which the multiple service data belong;

[0013] The number of corresponding preset conditions is determined according to the business type, and the number of clusters is determined according to the number of preset conditions.

[0014] In one of the embodiments, determining the cluster neighborhood radius and the minimum number of cluster points according to the data distribution information of any one cluster and the service demand information of the services to which the multiple service data belong includes:

[0015] Determining an initial neighborhood radius according to a standard deviation of each of the service data included in any one of the clusters;

[0016] Determining an initial minimum number of points according to the amount of the business data included in any one of the clusters;

[0017] According to the importance level of the business data, the initial neighborhood radius and the initial minimum number of points are adjusted to obtain the cluster neighborhood radius and the cluster minimum number of points;

[0018] Among them, the higher the importance level is, the smaller the cluster neighborhood radius is, and the higher the minimum number of cluster points is.

[0019] In one of the embodiments, after determining the business data not belonging to the sub-cluster as abnormal business data of the enterprise, the method further includes:

[0020] Determine the distance between the abnormal business data of the enterprise and the center of the sub-cluster closest to it;

[0021] Determining the abnormality degree of the abnormal business data of the enterprise according to the distance;

[0022] For each key indicator sub-data included in the abnormal business data of the enterprise, determining the key indicator sub-data that does not meet the indicator threshold range among the key indicator sub-data as abnormal key indicator sub-data;

[0023] Generate warning information corresponding to the abnormal business data of the enterprise according to the abnormal degree and the abnormal key indicator sub-data;

[0024] The warning information is sent to a terminal associated with the plurality of business data.

[0025] In one of the embodiments, after determining the business data not belonging to the sub-cluster as abnormal business data of the enterprise, the method further includes:

[0026] If the intra-cluster variance of each cluster in the plurality of clusters does not meet the variance threshold range, adjusting the number of clusters to obtain an adjusted number of clusters;

[0027] If all key indicator sub-data included in the enterprise's abnormal business data meet the indicator threshold range, the enterprise's abnormal business data will be determined as detection error data, and when the number of the detection error data meets the quantity threshold, the cluster neighborhood radius and the minimum number of cluster points will be adjusted to obtain the adjusted cluster neighborhood radius and the adjusted minimum number of cluster points.

[0028] In a second aspect, the present application also provides a detection system for abnormal business data of an enterprise, comprising: an application interaction layer, a data processing layer, a data storage layer and an infrastructure layer;

[0029] The application interaction layer is used to send the warning information corresponding to the abnormal business data of the enterprise to the terminals associated with the multiple business data;

[0030] The data processing layer is used to perform the steps of the method for detecting abnormal business data of an enterprise according to any one of claims 1 to 5;

[0031] The data storage layer is used to store the multiple business data;

[0032] The infrastructure layer is used to provide an operating platform for detecting abnormal business data of the enterprise.

[0033] In a third aspect, the present application also provides a device for detecting abnormal business data of an enterprise, comprising:

[0034] A data acquisition module is used to acquire multiple business data of an enterprise; the business data includes key indicator sub-data of multiple dimensions;

[0035] A clustering module, configured to determine the number of clusters for the multiple business data according to business experience information of the business to which the multiple business data belong;

[0036] The clustering module is further used to perform clustering processing on the multiple business data according to the number of clustering clusters to obtain multiple clusters matching the number of clustering clusters; the cluster includes at least one of the business data;

[0037] The clustering module is further configured to determine, for any one of the multiple clusters, a cluster neighborhood radius and a minimum number of cluster points according to data distribution information of the any one cluster and business demand information of the business to which the multiple business data belong;

[0038] The clustering module is further used to perform clustering processing on any one of the clusters according to the cluster neighborhood radius and the minimum number of cluster points to obtain at least one sub-cluster and business data that does not belong to the sub-cluster; the number of business data included in the sub-cluster is greater than or equal to the minimum number of points;

[0039] The abnormality detection module is used to determine the business data that does not belong to the sub-cluster as abnormal business data of the enterprise; the abnormal business data of the enterprise is used to generate warning information, and the warning information is used to prompt the abnormal business data of the enterprise to be processed.

[0040] In a fourth aspect, the present application further provides a computer device, comprising a memory and a processor, wherein the memory stores a computer program, and the processor implements the steps of the above method when executing the computer program.

[0041] In a fifth aspect, the present application also provides a computer-readable storage medium having a computer program stored thereon, and the computer program implements the steps of the above method when executed by a processor.

[0042] In a sixth aspect, the present application also provides a computer program product, including a computer program, which implements the steps of the above method when executed by a processor.

[0043] The above-mentioned detection method, device, computer equipment, computer-readable storage medium and computer program product for abnormal business data of an enterprise obtain multiple business data of an enterprise, and the business data include key indicator sub-data of multiple dimensions; determine the number of clustering clusters for the multiple business data through business experience information of the business to which the multiple business data belong; cluster the multiple business data according to the number of clustering clusters to obtain multiple clusters matching the number of clustering clusters, and the cluster includes at least one business data; for any cluster among the multiple clusters, based on the data distribution information of any cluster and the business demand information of the business to which the multiple business data belong, determine the clustering neighborhood radius and the minimum number of clustering points; cluster any cluster according to the clustering neighborhood radius and the minimum number of clustering points to obtain at least one sub-cluster and business data that does not belong to the sub-cluster, and the number of business data included in the sub-cluster is greater than or equal to the minimum number of points; determine the business data that does not belong to the sub-cluster as abnormal business data of the enterprise, and the abnormal business data of the enterprise is used to generate early warning information, and the early warning information is used to prompt the processing of the abnormal business data of the enterprise. Determining the number of clusters based on business experience information, and determining the cluster neighborhood radius and the minimum number of cluster points based on data distribution information and business demand information can adapt to data characteristics in different business scenarios, improve the pertinence, adaptability and accuracy of abnormal business data detection in enterprises, and perform preliminary clustering of business data, which can effectively reduce the data scale and preliminarily divide the data space, making the clustering process more targeted, accurate and efficient; then perform re-clustering to further refine the analysis of each cluster in the initial clustering results, so as to accurately identify abnormal business data of enterprises; the identified abnormal business data of enterprises is prompted by early warning information, which can respond to abnormal business data of enterprises in a timely manner, and significantly improve the detection accuracy of abnormal business data of enterprises through multi-level clustering processing methods. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] In order to more clearly illustrate the technical solutions in the embodiments of the present application or related technologies, the drawings required for use in the embodiments of the present application or related technical descriptions will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0045] FIG1 is an application environment diagram of a method for detecting abnormal business data of an enterprise in one embodiment;

[0046] FIG2 is a schematic diagram of a flow chart of a method for detecting abnormal business data of an enterprise in one embodiment;

[0047] FIG3 is an architecture diagram of a detection system for abnormal business data of an enterprise according to an embodiment;

[0048] FIG4 is a schematic diagram of a flow chart of a method for detecting abnormal business data of an enterprise in another embodiment;

[0049] FIG5 is a structural block diagram of a device for detecting abnormal business data of an enterprise in one embodiment;

[0050] FIG. 6 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0051] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0052] The method for detecting abnormal business data of an enterprise provided in the embodiment of the present application can be applied in the application environment shown in FIG1. ​​In which, the terminal 102 communicates with the server 104 through the network. The data storage system can store the data that the server 104 needs to process. The data storage system can be integrated on the server 104, or it can be placed on the cloud or other network servers. The terminal 102 obtains multiple business data of the enterprise; the business data includes key indicator sub-data of multiple dimensions; the terminal 102 determines the number of clusters for the multiple business data based on the business experience information of the business to which the multiple business data belong; the terminal 102 clusters the multiple business data according to the number of cluster clusters to obtain multiple clusters matching the number of cluster clusters; the cluster includes at least one business data; the terminal 102 determines the cluster neighborhood radius and the minimum number of cluster points for any cluster among the multiple clusters based on the data distribution information of any cluster and the business demand information of the business to which the multiple business data belong; the terminal 102 clusters any cluster according to the cluster neighborhood radius and the minimum number of cluster points to obtain at least one sub-cluster and business data that does not belong to the sub-cluster; the number of business data included in the sub-cluster is greater than or equal to the minimum number of points; the terminal 102 determines the business data that does not belong to the sub-cluster as abnormal business data of the enterprise; the abnormal business data of the enterprise is used to generate early warning information, and the early warning information is used to prompt the processing of the abnormal business data of the enterprise. The terminal 102 may be, but is not limited to, various personal computers, laptops, smart phones, tablet computers, IoT devices, and portable wearable devices. The IoT devices may be smart speakers, smart TVs, smart air conditioners, smart car devices, projection devices, etc. Portable wearable devices may be smart watches, smart bracelets, head-mounted devices, etc. Head-mounted devices may be virtual reality (VR) devices, augmented reality (AR) devices, smart glasses, etc. The server 104 may be an independent physical server, a server cluster or distributed system consisting of multiple physical servers, or a cloud server that provides cloud computing services.

[0053] In an exemplary embodiment, as shown in FIG2 , a method for detecting abnormal business data of an enterprise is provided, which is described by taking the method applied to the terminal 102 in FIG1 as an example, and includes:

[0054] Step S202, obtaining multiple business data of the enterprise.

[0055] Among them, business data includes key indicator sub-data in multiple dimensions.

[0056] In specific implementation, the business data of an enterprise may refer to various types of data generated by the enterprise during its daily operations, which record information such as business activities, system status, transaction processes, etc. Optionally, the business data may include financial operation data, power grid operation data, marketing data, power transaction data, human asset data, etc.

[0057] Business data includes multiple dimensions of key indicator sub-data, which can refer to data of specific dimensions or specific attributes in business data. For example, taking the business data as financial operation data, key indicator sub-data can include but are not limited to operating income, cost expenditure, profit, accounts receivable, inventory turnover rate and other sub-data.

[0058] In a specific implementation, multiple business data may be business data that has been cleaned and standardized. Data cleaning may include removing duplicate records, processing missing values ​​(such as through interpolation, mean filling, or setting default values ​​according to business rules), correcting erroneous data (such as outliers that are significantly deviated from the industry average), etc., to ensure the integrity and accuracy of business data. Since the dimensions and magnitudes of different key indicator sub-data vary greatly, they need to be standardized. Data standardization may include using standard deviation standardization or minimum-maximum normalization methods to make each key indicator sub-data at the same magnitude, which is convenient for subsequent clustering.

[0059] Step S204 : determining the number of clusters for the multiple business data according to the business experience information of the business to which the multiple business data belong.

[0060] The business experience information may refer to the knowledge, rules and historical data analysis results accumulated over a long period of time in the business field. The business experience information can help understand the distribution characteristics of data, the relationship between data and possible abnormal situations.

[0061] A key step in cluster analysis is to determine how many groups (clusters) the data should be divided into. Too many clusters will lead to over-segmentation of the data, making it difficult to find meaningful patterns; too few clusters may cause data of different natures to be mixed together, making it impossible to effectively distinguish abnormal data.

[0062] By utilizing business experience information, the system can more intelligently determine the appropriate number of clusters, so that the clustering results are more in line with the actual business situation. This method improves the accuracy and practicality of clustering analysis and can better support subsequent anomaly detection and data analysis work.

[0063] For example, if the business data is the marketing data of a power grid company, the business experience information of the business belonging to the multiple business data of the enterprise is obtained. Assuming that the business experience information can be divided according to the customer object type of the power grid company marketing, since different types of customers have different electricity needs, the marketing data of the power grid company can be divided into 4 categories, representing industry, commerce, residents and agriculture respectively. Therefore, the number of clusters of the multiple business data can be determined as 4, and the marketing data of the power grid company can be divided into four clusters of "industry", "commerce", "residents" and "agriculture". Step S206, clustering the multiple business data according to the number of clusters to obtain multiple clusters matching the number of clusters.

[0064] A cluster includes at least one business data. A cluster is the result of clustering processing and represents a group of relatively similar data points in multiple business data.

[0065] Clustering is a technique that divides multiple data into multiple clusters, so that the data points in the same cluster have high similarity, while the data points between different clusters have great differences.

[0066] Clustering processing can be performed by performing preliminary division operations on multiple business data through clustering algorithms, and multiple business data are divided into multiple clusters according to the number of clustering clusters, and each cluster represents a set of data points with similar characteristics.

[0067] The number of clusters may refer to the number of clusters divided during the clustering process, and the number of clusters may be set based on experience, business requirements, or algorithm recommendations. The terminal performs clustering on multiple business data according to the number of clusters, and the number of multiple clusters obtained is equal to the number of clusters.

[0068] In a specific implementation, clustering of multiple business data may be performed through a K-means algorithm. The K-means algorithm may select K cluster centers and assign data points in the data set to the nearest cluster center, so that the sum of squared distances between the data points in each cluster and the center point (centroid) of the cluster is minimized, thereby forming a preliminary clustering result. Furthermore, through iterative optimization, the average value of all data points in the cluster is calculated as the cluster center, and whether the cluster center changes is detected. If so, the iterative optimization steps are repeated until the cluster center no longer changes or the preset number of iterations is reached, thereby obtaining K clusters.

[0069] Optionally, the number of clusters may be the K value in the K-means algorithm. The number of clusters may be determined by methods such as the elbow rule and the silhouette coefficient. The elbow rule plots the sum of squares of clustering errors corresponding to different K values ​​and selects the K value at the inflection point as the number of clusters.

[0070] Step S208 , for any one of the multiple clusters, determine the cluster neighborhood radius and the minimum number of cluster points according to the data distribution information of the any one cluster and the service demand information of the services to which the multiple service data belong.

[0071] The cluster neighborhood radius is the neighborhood range around a data point in space defined during the clustering process. Only data points within this neighborhood range are considered to be related to the data point.

[0072] The minimum number of clustering points is the minimum number of neighborhood points required within the neighborhood radius defined in the clustering process. If the number of points in the neighborhood of a data point reaches or exceeds this value, the data point can be considered a core point and participate in further clustering.

[0073] The data distribution information may be the distribution of data points in any cluster in space, including the distance, density, concentration, etc. between the data points.

[0074] Among them, business requirement information can refer to the knowledge, requirements and expectations related to specific business goals and operations.

[0075] For example, if the data distribution within the cluster is relatively dense, a smaller neighborhood radius can be selected; if the data distribution within the cluster is relatively sparse, a larger neighborhood radius can be selected; for example, in the power grid industry, if the business demand information tends to identify abnormally high-load electricity consumption data, then the set clustering parameters need to sensitively capture this specific anomaly, and a smaller neighborhood radius can be selected to identify these subtle changes; for example, assuming that the data distribution of multiple business data is relatively sparse, to identify anomalies in sparse data, a smaller minimum number of clustering points can be selected to ensure that even a small number of points can form a cluster.

[0076] Step S210: performing clustering processing on any cluster according to the cluster neighborhood radius and the minimum number of cluster points to obtain at least one sub-cluster and business data that does not belong to the sub-cluster.

[0077] The amount of business data included in the sub-cluster is greater than or equal to the minimum number of points.

[0078] This clustering process performs a more detailed analysis on the clusters that have been formed. By adjusting the neighborhood radius and the minimum number of points, the business data within the cluster is further divided to identify denser sub-clusters and isolated outliers. Business data that does not belong to a sub-cluster is the identified isolated outlier.

[0079] A subcluster is a smaller clustering result obtained through clustering, which contains a dense set of data points under the conditions of cluster neighborhood radius and minimum number of points. The data points in the subcluster are highly similar to each other, and the number of points meets the minimum number of points requirement.

[0080] In the specific implementation, clustering of any cluster can be performed through the density-based spatial clustering of applications with noise (DBSCAN). The DBSCAN algorithm identifies clusters by defining core points, boundary points and noise points. It can effectively process noise and find clusters of any shape. By calculating the density of data points, data points in high-density areas are divided into clusters, and points in low-density areas are marked as abnormal points or noise points. Based on the above K-means clustering results, each cluster in the K-means clustering results can be used as input to further refine and identify abnormalities through the DBSCAN algorithm. The DBSCAN algorithm divides data points in high-density areas into finer clusters by calculating the density of data points, and identifies abnormal points in low-density areas. The key parameters of the DBSCAN algorithm are the neighborhood radius eps and the minimum number of points min_samples. eps defines the distance between two points considered to be in the neighborhood, and min_samples defines the minimum number of points required to form a dense area. The process of clustering by DBSCAN algorithm may include: 1. Initialization parameters: Initialize the neighborhood radius eps and the minimum number of points min_samples; 2. Mark the visit status: Set an visit status for each point in the data set. Initially, all points are unvisited; 3. Select the starting point: Select an unvisited point from the data set as the starting point. This point can be randomly selected or the first point selected in a certain order (such as index order). The purpose of selecting the starting point is to start exploring the neighborhood of the data point; 4. Explore the neighborhood: For the currently selected point, check all points in its eps neighborhood. If the number of points in the neighborhood is greater than or equal to min_samples, the current point is considered to be a core point; 5. Form a cluster: If the current point is a core point, then it and all its neighboring points form a cluster together, mark these points as visited, and assign them a same cluster identifier; 6. Recursive expansion: For the points newly added to the cluster, if they are also core points, continue to recursively explore their neighborhood points and add the points that meet the conditions to the current cluster; 7. Processing boundary points: If a point is not a core point, but there is at least one core point in its neighborhood, then this point is considered a boundary point, is added to the cluster, and is marked as visited; 8. Identifying noise points: If a point is neither a core point nor a boundary point, then it is considered a noise point and is usually marked as -1; 9. Repeating the process: Repeat steps 3 to 8 above until all unvisited points have been processed; 10. Ending clustering: When all points have been visited and each point has been assigned to a cluster or marked as a noise point, the clustering process ends.

[0081] Therefore, when the two clustering processes are respectively performed by the K-means clustering algorithm and the DBSCAN density clustering algorithm, the DBSCAN algorithm, due to its density-based clustering characteristics, has a high tolerance to noise and outliers, and can identify isolated points in low-density areas as anomalies; although K-means is sensitive to outliers, its preliminary clustering results as the input of DBSCAN can help DBSCAN to more accurately define the boundaries between normal data areas and abnormal data areas, thereby addressing the challenges of inefficiency, insufficient accuracy and system stability faced by anomaly detection in large-scale indicator data sets. It combines the advantages of the K-means clustering algorithm and the DBSCAN density clustering algorithm to provide an efficient, accurate and stable method for detecting abnormal business data in enterprises.

[0082] In summary, the combination of two clustering processes can efficiently and accurately identify and warn potential abnormal business data of enterprises from large-scale business data to ensure stable system operation and business security.

[0083] Step S212: Determine the business data that does not belong to the sub-cluster as abnormal business data of the enterprise.

[0084] Among them, the abnormal business data of the enterprise is used to generate early warning information, and the early warning information is used to prompt the processing of the abnormal business data of the enterprise.

[0085] Abnormal business data of an enterprise refers to business data points that do not belong to any sub-cluster in the clustering process. These points are marked as abnormal because of their large feature differences from other data points. They may indicate potential errors, risks or special events that require further attention and processing.

[0086] Early warning information is a notification or reminder generated based on the identified abnormal business data of the enterprise, which prompts the staff that there are abnormal situations that need to be handled. This information usually contains the specific details of the abnormality, possible impacts, and recommended handling measures. In specific implementations, early warning information is used to warn of the identified abnormal business data of the enterprise. It can be aggregated and displayed through visual graphics to help staff identify data risks and provide data support for leadership decisions. By timely discovering and warning of abnormal data, enterprises can respond quickly and take measures, such as adjusting strategies, fixing vulnerabilities, or isolating risks, thereby effectively avoiding potential economic losses and reputation damage.

[0087] The above-mentioned method for detecting abnormal business data of an enterprise obtains multiple business data of the enterprise, and the business data includes key indicator sub-data of multiple dimensions; determines the number of clustering clusters for the multiple business data through business experience information of the business to which the multiple business data belong; clusters the multiple business data according to the number of clustering clusters to obtain multiple clusters matching the number of clustering clusters, and the clusters include at least one business data; for any cluster among the multiple clusters, based on the data distribution information of any cluster and the business demand information of the business to which the multiple business data belong, determines the clustering neighborhood radius and the minimum number of clustering points; clusters any cluster according to the clustering neighborhood radius and the minimum number of clustering points to obtain at least one sub-cluster and business data that does not belong to the sub-cluster, and the number of business data included in the sub-cluster is greater than or equal to the minimum number of points; the business data that does not belong to the sub-cluster is determined as abnormal business data of the enterprise, and the abnormal business data of the enterprise is used to generate early warning information, and the early warning information is used to prompt the processing of the abnormal business data of the enterprise. Determining the number of clusters based on business experience information, and determining the cluster neighborhood radius and the minimum number of cluster points based on data distribution information and business demand information can adapt to data characteristics in different business scenarios, improve the pertinence, adaptability and accuracy of abnormal business data detection in enterprises, and perform preliminary clustering of business data, which can effectively reduce the data scale and preliminarily divide the data space, making the clustering process more targeted, accurate and efficient; then perform re-clustering to further refine the analysis of each cluster in the initial clustering results, so as to accurately identify abnormal business data of enterprises; the identified abnormal business data of enterprises is prompted by early warning information, which can respond to abnormal business data of enterprises in a timely manner, and significantly improve the detection accuracy of abnormal business data of enterprises through multi-level clustering processing methods.

[0088] In another embodiment, a detection system for abnormal business data of an enterprise is disclosed, the detection system comprising an application interaction layer, a data processing layer, a data storage layer, and an infrastructure layer;

[0089] The application interaction layer is used to send warning information corresponding to abnormal business data of the enterprise to multiple terminals associated with business data;

[0090] The data processing layer is used for business data including key indicator sub-data of multiple dimensions; according to the business experience information of the business to which the multiple business data belong, the number of clusters for the multiple business data is determined; according to the number of cluster clusters, the multiple business data are clustered to obtain multiple clusters matching the number of cluster clusters; the cluster includes at least one business data; for any cluster among the multiple clusters, according to the data distribution information of any cluster and the business demand information of the business to which the multiple business data belong, the cluster neighborhood radius and the minimum number of cluster points are determined; according to the cluster neighborhood radius and the minimum number of cluster points, any cluster is clustered to obtain at least one sub-cluster and business data that does not belong to the sub-cluster; the number of business data included in the sub-cluster is greater than or equal to the minimum number of points; the business data that does not belong to the sub-cluster is determined as abnormal business data of the enterprise; the abnormal business data of the enterprise is used to generate early warning information, and the early warning information is used to prompt the processing of the abnormal business data of the enterprise;

[0091] The data storage layer is used to obtain multiple business data of the enterprise;

[0092] The infrastructure layer is used to provide an operating platform for the detection of abnormal business data of enterprises.

[0093] To facilitate the understanding of those skilled in the art, FIG3 exemplarily provides an architecture diagram of a detection system for abnormal business data of an enterprise. The system architecture diagram is divided into four layers. Among them, the first layer is the infrastructure layer: this layer is composed of storage facilities, network architecture, and infrastructure, providing basic support for the system. The second layer is the data storage layer: the data is stored in the data center, including financial and operating data, power grid operation data, marketing data, power trading data, human asset data, and other types of data. The third layer is the data processing layer: this layer is composed of data extraction, data cleaning, data calculation, task scheduling, and data query, providing data basic service support for subsequent platform data use. The fourth layer is the application interaction layer: this layer is based on model applications, providing service support for desktop applications, mobile applications, and large-screen applications, ensuring that the data is analyzed and processed by the large model before being displayed.

[0094] For a data set containing millions of data points, the above technical solution can effectively divide the data set into multiple smaller subsets through a preliminary clustering step. The density and distribution characteristics of the data points in each subset are closer, thereby greatly reducing the amount of calculation in the subsequent clustering processing when searching for core points and determining cluster boundaries, and greatly shortening the detection time. The preliminary clustering processing, as a preprocessing step, quickly converges to the local optimal solution, providing excellent initial conditions for the subsequent secondary clustering processing, so that the secondary clustering processing can more efficiently identify high-density areas and potential anomalies in the data, significantly improving the detection accuracy of abnormal business data of enterprises.

[0095] In another embodiment, it also includes: determining the business type of the business to which the multiple business data belong; determining the corresponding number of preset conditions according to the business type, and determining the number of clusters according to the number of preset conditions.

[0096] Exemplarily, the business data types may include, but are not limited to, financial management, power grid operation, marketing, power trading, human assets, and the like.

[0097] Among them, the number of preset conditions may refer to the number of pre-set, possible business states or situations corresponding to the business data type, which may represent the state of a certain type of business data in different dimensions. For example, if the business data type is a financial operation type, since the financial operation status of an enterprise can be divided into five categories, namely, excellent, good, normal, poor, and extremely poor, the number of preset conditions corresponding to the financial operation type can be determined to be 5; for another example, if the business data type is a power grid operation type, since the power grid operation status can be divided into three categories, namely, normal, abnormal, and closed, the number of preset conditions corresponding to the power grid operation type can be determined to be 3. Therefore, the number of preset conditions matching each business data type can be determined according to business needs, and the corresponding relationship between each business data type and the number of preset conditions is stored in the database. When the business data type is determined, the number of preset conditions corresponding to the business data type is directly read from the database, which improves the efficiency of clustering processing, thereby improving the efficiency of abnormal business data detection of the enterprise.

[0098] In practical applications, assuming that multiple business data are financial and operating data, after preliminary clustering processing, 5 clusters corresponding to 5 types of financial and operating conditions are obtained, namely, excellent, good, normal, poor, and extremely poor. Assuming that for one of the clusters, for example, the cluster corresponding to the poor financial and operating conditions, abnormal data points that do not belong to any sub-cluster can be identified through re-clustering processing, that is, abnormal business data of the enterprise. These abnormal business data of the enterprise may represent abnormal financial and operating conditions, such as a sudden increase in losses and abnormal cash flow fluctuations.

[0099] The above solution can automatically adjust the number of clusters according to business needs, realize adaptive clustering parameter setting, and improve the accuracy and stability of abnormal business data detection in enterprises.

[0100] In another embodiment, it also includes: determining an initial neighborhood radius based on the standard deviation of each business data included in any cluster; determining an initial minimum number of points based on the number of business data included in any cluster; adjusting the initial neighborhood radius and the initial minimum number of points based on the importance level of the business data to obtain a cluster neighborhood radius and a cluster minimum number of points; wherein, the higher the importance level, the smaller the cluster neighborhood radius and the higher the cluster minimum number of points.

[0101] The standard deviation is a statistical measure used to measure the degree of dispersion or dispersion of a set of data. The larger the standard deviation, the more dispersed the distribution of data points; the smaller the standard deviation, the more concentrated the data points.

[0102] The initial neighborhood radius is an initial distance value calculated based on the standard deviation of the business data within the cluster; the initial minimum number of points is a threshold calculated based on the number of business data within the cluster, indicating that there must be a sufficient number of data points within the initial neighborhood radius before these points can be treated as a subcluster.

[0103] The importance level is the priority or importance ranking of business data, reflecting the importance of different business data. The higher the importance level, the more important the business data is in analysis and decision-making, so stricter standards are required for anomaly detection.

[0104] The cluster neighborhood radius is the final neighborhood radius adjusted based on the initial neighborhood radius according to the importance level of the business data. The higher the importance level, the smaller the cluster neighborhood radius is to ensure more precise anomaly detection.

[0105] The minimum number of cluster points is the final point threshold adjusted based on the initial minimum number of points and the importance level of the business data. The higher the importance level, the higher the minimum number of cluster points, to improve the accuracy of clustering and ensure that subclusters are formed only in highly dense data areas.

[0106] The above scheme further optimizes the parameter setting in the secondary clustering process to improve the accuracy of abnormal business data detection in enterprises. Specifically, the method first calculates an initial neighborhood radius based on the standard deviation of each business data in the cluster, which indicates the data range in which a data point is considered relevant during the clustering process. Then, based on the total number of business data in the cluster, an initial minimum number of points is determined as the basic standard for forming subclusters. For example, the initial neighborhood radius can be 0.5 times the standard deviation of each business data in the cluster, and the initial minimum number of points can be 5% of the number of business data in the cluster.

[0107] In order to further accurately detect anomalies, the initial neighborhood radius and the initial minimum number of points can be adjusted according to the importance of business data. Since a higher degree of refinement and stricter standards are required when detecting anomalies in key business data, the adjusted cluster neighborhood radius will become smaller for data with a higher level of importance. Clustering processing will only classify very close data points into the same cluster, which can easily find subtle anomalies and avoid including subtle anomalies in normal clusters due to a large neighborhood radius, thereby improving the accuracy of detecting abnormal business data of enterprises; at the same time, the minimum number of cluster points obtained after adjustment will increase to ensure that the conditions for the formation of subclusters are more stringent, and it can be ensured that a subcluster will only be formed when there are enough data points in the local area, avoiding the possibility of forming unreliable subclusters due to a small number of anomalies, reducing the interference of anomalies on clustering results, and improving the accuracy of detecting abnormal business data of enterprises. This adjustment mechanism makes it easier to identify anomalies when detecting key business data, thereby generating more reliable early warning information and prompting relevant personnel to deal with potential business risks in a timely manner. The above solution can automatically adjust the neighborhood radius and the minimum number of points according to business needs and business characteristics, realize adaptive clustering parameter setting, and improve the accuracy and stability of abnormal business data detection in enterprises.

[0108] In another embodiment, after determining the business data that does not belong to a sub-cluster as abnormal business data of the enterprise, it also includes: determining the distance between the abnormal business data of the enterprise and the center of the sub-cluster closest to it; determining the degree of abnormality of the abnormal business data of the enterprise based on the distance; for each key indicator sub-data included in the abnormal business data of the enterprise, determining the key indicator sub-data that does not meet the indicator threshold range in each key indicator sub-data as abnormal key indicator sub-data; generating early warning information corresponding to the abnormal business data of the enterprise based on the degree of abnormality and the abnormal key indicator sub-data; and sending the early warning information to terminals associated with multiple business data.

[0109] After identifying abnormal business data of an enterprise, the distance between the data point and the nearest sub-cluster center is calculated. This distance reflects the degree of deviation between abnormal data and normal data. The calculated distance can be used to quantify the degree of abnormality of the abnormal business data of the enterprise. The larger the distance, the farther the abnormal data deviates from the normal range, and the higher the degree of abnormality.

[0110] Then, further analyze each key indicator sub-data in the enterprise abnormal business data to check whether these key indicator sub-data meet the preset indicator threshold range. If a key indicator sub-data exceeds the indicator threshold range, it will be marked as abnormal key indicator sub-data.

[0111] In practical applications, it is assumed that multiple business data are multiple financial and operating data, and the multiple dimensions of key indicator sub-data included in each financial and operating data may be operating income, cost expenditure, profit, accounts receivable, and inventory turnover rate. After preliminary clustering processing, 5 clusters corresponding to five types of financial and operating conditions, namely, excellent, good, normal, poor, and extremely poor, are obtained. Assuming that for one of the clusters, such as the cluster corresponding to the poor financial and operating conditions, clustering processing is performed again to identify abnormal data points that do not belong to any sub-cluster, that is, abnormal business data of the enterprise. The multiple dimensions of key indicator sub-data included in this abnormal business data of the enterprise are operating income, cost expenditure, profit, accounts receivable, and inventory turnover rate. The reason for the abnormality of this business data may be that the key indicator sub-data of all dimensions are abnormal, or the key indicator sub-data of some dimensions are abnormal. Therefore, after detecting the abnormal business data of the enterprise, it is necessary to further check whether the various key indicator sub-data included in the abnormal business data of the enterprise meet the preset indicator threshold range, so as to identify the abnormal indicators, namely, abnormal key indicator sub-data. Each key indicator sub-data may correspond to a different indicator threshold range. For example, for the cluster corresponding to the poor financial and operating conditions, it can be generally considered that the operating income is between 10,000 and 20,000, which means the financial and operating conditions are poor. Therefore, the indicator threshold range of operating income can be 10,000 to 20,000. Assuming that the key indicator sub-data included in the enterprise's abnormal business data includes an operating income of 5,000, which is far below this indicator threshold range, this key indicator sub-data can be considered as abnormal indicator sub-data.

[0112] The above technical solution generates detailed warning information by evaluating the degree of abnormality and abnormal indicators, ensuring that more refined and reliable warning information can be provided when dealing with abnormal business data of the enterprise, thereby improving the efficiency and pertinence of abnormal business data detection of the enterprise.

[0113] In actual applications, after marking the abnormal business data of an enterprise, detailed information of the abnormal business data can be recorded, including the branch to which it belongs, abnormal indicators, degree of abnormality, type of abnormality, possible causes, recommended countermeasures, etc., and early warning information can be generated based on these detailed information.

[0114] Finally, the warning information is sent to the terminals associated with multiple business data, which can be sent to the terminals of the staff related to the business data in a timely manner through the system interface, email, SMS and other methods to ensure that they can respond quickly and take measures to deal with it. After receiving the warning information, the relevant staff can conduct in-depth analysis of the abnormal business data of the enterprise, find out the reasons, and take corresponding corrective measures.

[0115] In actual applications, terminals associated with multiple business data can be integrated with a data monitoring platform to achieve real-time monitoring and automatic alarm, reducing the need for manual intervention and improving the automation level and response speed of abnormal data detection.

[0116] In another embodiment, after determining the business data that does not belong to the sub-cluster as abnormal business data of the enterprise, it also includes: if the intra-cluster variance of each cluster in the multiple clusters does not meet the variance threshold range, the number of cluster clusters is adjusted to obtain an adjusted number of cluster clusters; if each key indicator sub-data included in the abnormal business data of the enterprise meets the indicator threshold range, the abnormal business data of the enterprise is determined as misdetected data, and when the number of misdetected data meets the quantity threshold, the cluster neighborhood radius and the minimum number of cluster points are adjusted to obtain an adjusted cluster neighborhood radius and an adjusted minimum number of cluster points.

[0117] The intra-cluster variance refers to the average of the sum of squares of the deviations between each data point and the cluster center within a cluster. It measures the dispersion of the data points within the cluster. The smaller the variance, the more concentrated the data points within the cluster and the higher the similarity; the larger the variance, the more dispersed the data points. The variance threshold range is a pre-set value used to determine whether the intra-cluster variance is within an acceptable range. This threshold is usually used to evaluate the quality of clustering results. If the variance of a cluster exceeds this threshold, it may mean that the clustering effect is not good.

[0118] Exemplarily, if the variance of a cluster is greater than the maximum value of the variance threshold range, it means that the data points in the cluster are dispersed to a large extent, the clustering result may not be ideal, and the data points contained in the cluster may be quite different from each other. The number of clusters can be increased so that the original large clusters are divided into more small clusters. Increasing the number of clusters can separate the relatively different data points that were originally clustered together, thereby forming more homogeneous small clusters and reducing the variance within the cluster. If the variance of a cluster is less than the minimum value of the variance threshold range, it means that the data points in the cluster are too concentrated, which may indicate that the number of clusters is set too much, resulting in too fine clustering. The number of clusters can be reduced to merge some small clusters into larger clusters to form a more reasonable clustering result. According to the adjusted number of clusters, clustering is performed again to divide new clusters, thereby continuously optimizing the number of clusters until the variance within the cluster is generally within the variance threshold range, thereby achieving a better clustering effect.

[0119] Misdetected data can refer to those data points that are mistakenly identified as abnormal in cluster analysis. Although they are marked as abnormal, further inspection finds that all their key indicator sub-data are within the normal range (that is, they all meet the indicator threshold range), so they are considered to be misjudgments in the detection process. The quantity threshold is a pre-set value used to determine whether the number of misdetected data is within an acceptable range. If the number of misdetected data points exceeds this threshold, it means that the cluster neighborhood radius and the minimum number of cluster points need to be adjusted.

[0120] After identifying the abnormal business data of the enterprise, the above scheme further checks the various key indicator sub-data of these data to determine whether they meet the indicator threshold range. If all the key indicator sub-data are within the normal range, it means that the data point may be mistakenly identified as abnormal. After determining the detection error data and the number of detection error data reaches or exceeds the preset number threshold, the clustering neighborhood radius and the minimum number of clustering points can be adjusted. Exemplarily, if the number of detection error data is too large, it indicates that the current neighborhood radius may be too large, resulting in some abnormal points that are relatively close to normal data points being mistakenly marked as abnormal. The neighborhood radius can be reduced so that the clustering algorithm only focuses on more closely clustered data points in the secondary clustering, which can reduce misjudgment and avoid misclassifying normal data points as abnormal; at the same time, if the number of detection error data is too large, it may be because the current minimum number of points is set too low, resulting in small noise points or a small number of data points forming sub-clusters, and these sub-clusters are mistakenly regarded as abnormal. The minimum number of points can be increased so that sub-clusters are formed only when enough data points are gathered, thereby reducing misjudgment. Another example is that if it is found that some of the detected misdetected data are actually due to the data points slightly deviating from the center in the normal cluster, but still within the normal range, then the neighborhood radius can be appropriately increased so that more data points are included in the normal cluster, thereby reducing misjudgment; if the misjudgment is due to the current minimum number of points being set too high, resulting in some small clusters that are actually denser not being formed and being regarded as abnormal, then the minimum number of points can be reduced so that more small-scale clusters can be identified as normal subclusters. After adjusting the cluster neighborhood radius and the minimum number of cluster points, clustering and anomaly detection are re-performed, thereby continuously optimizing the cluster neighborhood radius and the minimum number of cluster points, and improving the clustering effect.

[0121] The above technical solution can effectively reduce the number of detection errors and improve the accuracy of anomaly detection by dynamically adjusting the number of clusters, the radius of cluster neighborhoods and the minimum number of cluster points. By continuously optimizing clustering parameters, the stability, adaptability and robustness of abnormal business data detection in enterprises can be further improved, ensuring efficient and accurate anomaly detection capabilities in various complex scenarios.

[0122] In another embodiment, as shown in FIG. 4 , a method for detecting abnormal business data of an enterprise is provided, which is described by taking the method applied to the terminal in FIG. 1 as an example, and includes the following steps:

[0123] Step S402, obtaining multiple business data of the enterprise.

[0124] Among them, business data includes key indicator sub-data in multiple dimensions.

[0125] Step S404, determining the service type of the service to which the plurality of service data belong; determining the corresponding number of preset conditions according to the service type, and determining the number of clusters according to the number of preset conditions.

[0126] Step S406: clustering the plurality of business data according to the number of clustering clusters to obtain a plurality of clusters matching the number of clustering clusters.

[0127] A cluster includes at least one service data.

[0128] Step S408, for any cluster among the multiple clusters, determine the initial neighborhood radius according to the standard deviation of each business data included in any cluster; determine the initial minimum number of points according to the number of business data included in any cluster; adjust the initial neighborhood radius and the initial minimum number of points according to the importance level of the business data to obtain the cluster neighborhood radius and the cluster minimum number of points.

[0129] The higher the importance level, the smaller the cluster neighborhood radius and the higher the minimum number of cluster points. Step S410: cluster any cluster according to the cluster neighborhood radius and the minimum number of cluster points to obtain at least one subcluster and business data that does not belong to the subcluster.

[0130] The amount of business data included in the sub-cluster is greater than or equal to the minimum number of points.

[0131] Step S412: determine the business data that does not belong to the sub-cluster as abnormal business data of the enterprise.

[0132] The abnormal business data of an enterprise is used to generate early warning information, and the early warning information is used to prompt the processing of the abnormal business data of the enterprise.

[0133] Step S414, determine the distance between the enterprise's abnormal business data and the center of the subcluster closest to it; determine the degree of abnormality of the enterprise's abnormal business data based on the distance; for each key indicator sub-data included in the enterprise's abnormal business data, determine the key indicator sub-data that does not meet the indicator threshold range among the key indicator sub-data as abnormal key indicator sub-data; generate warning information corresponding to the enterprise's abnormal business data based on the degree of abnormality and the abnormal key indicator sub-data.

[0134] Step S416: Send the warning information to the terminal associated with the multiple business data.

[0135] Step S418: if the intra-cluster variance of each cluster in the multiple clusters does not meet the variance threshold range, the number of clusters is adjusted to obtain an adjusted number of clusters.

[0136] Step S420: If all key indicator sub-data included in the enterprise abnormal business data meet the indicator threshold range, the enterprise abnormal business data is determined as detection error data, and when the number of detection error data meets the quantity threshold, the cluster neighborhood radius and the minimum number of cluster points are adjusted to obtain the adjusted cluster neighborhood radius and the adjusted minimum number of cluster points.

[0137] It should be noted that the specific limitations of the above steps can refer to the specific limitations of a method for detecting abnormal business data of an enterprise mentioned above.

[0138] It should be understood that, although the various steps in the flowcharts involved in the above-mentioned embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above-mentioned embodiments can include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0139] Based on the same inventive concept, the embodiment of the present application also provides a detection device for abnormal business data of an enterprise for implementing the above-mentioned detection method for abnormal business data of an enterprise. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above-mentioned method, so the specific limitations in the embodiments of the detection device for abnormal business data of an enterprise provided below can refer to the limitations of the detection method for abnormal business data of an enterprise above, and will not be repeated here.

[0140] In an exemplary embodiment, as shown in FIG5 , a device for detecting abnormal business data of an enterprise is provided, comprising:

[0141] The data acquisition module 510 is used to acquire multiple business data of the enterprise; the business data includes key indicator sub-data of multiple dimensions.

[0142] The clustering module 520 is configured to determine the number of clusters for the multiple business data according to the business experience information of the business to which the multiple business data belong.

[0143] The clustering module 520 is further configured to perform clustering processing on the plurality of business data according to the number of clustering clusters to obtain a plurality of clusters matching the number of clustering clusters; the cluster includes at least one of the business data;

[0144] The clustering module 520 is further configured to determine, for any one of the plurality of clusters, a cluster neighborhood radius and a minimum number of cluster points according to data distribution information of the any one of the clusters and business demand information of the business to which the plurality of business data belong;

[0145] The clustering module 520 is further configured to perform clustering processing on any one of the clusters according to the cluster neighborhood radius and the minimum number of cluster points to obtain at least one sub-cluster and business data that does not belong to the sub-cluster; the number of business data included in the sub-cluster is greater than or equal to the minimum number of points;

[0146] The abnormality detection module 530 is used to determine the business data that does not belong to the sub-cluster as abnormal business data of the enterprise; the abnormal business data of the enterprise is used to generate warning information, and the warning information is used to prompt the abnormal business data of the enterprise to be processed.

[0147] In one embodiment, the clustering module 520 is used to determine the service type of the service to which the multiple service data belong; determine the corresponding number of preset conditions according to the service type, and determine the number of clusters according to the number of preset conditions.

[0148] In one embodiment, the clustering module 520 is also used to determine the initial neighborhood radius based on the standard deviation of each of the business data included in any one of the clusters; determine the initial minimum number of points based on the number of the business data included in any one of the clusters; adjust the initial neighborhood radius and the initial minimum number of points based on the importance level of the business data to obtain the cluster neighborhood radius and the cluster minimum number of points; wherein, the higher the importance level, the smaller the cluster neighborhood radius, and the higher the cluster minimum number of points.

[0149] In one embodiment, the device also includes a sending module; the sending module is used to determine the distance between the enterprise abnormal business data and the center of the subcluster closest to it; determine the degree of abnormality of the enterprise abnormal business data based on the distance; for each key indicator sub-data included in the enterprise abnormal business data, determine the key indicator sub-data that does not meet the indicator threshold range among the key indicator sub-data as abnormal key indicator sub-data; generate warning information corresponding to the enterprise abnormal business data based on the abnormal degree and the abnormal key indicator sub-data; and send the warning information to a terminal associated with the multiple business data.

[0150] In one embodiment, the clustering module 520 is also used to adjust the number of cluster clusters if the intra-cluster variance of each cluster in the multiple clusters does not meet the variance threshold range, so as to obtain an adjusted number of cluster clusters; if each key indicator sub-data included in the enterprise abnormal business data meets the indicator threshold range, the enterprise abnormal business data is determined as detection error data, and when the number of detection error data meets the quantity threshold, the cluster neighborhood radius and the minimum number of cluster points are adjusted to obtain an adjusted cluster neighborhood radius and an adjusted minimum number of cluster points.

[0151] Each module in the above-mentioned detection device for abnormal business data of an enterprise can be implemented in whole or in part by software, hardware or a combination thereof. Each of the above-mentioned modules can be embedded in or independent of a processor in a computer device in the form of hardware, or can be stored in a memory in a computer device in the form of software, so that the processor can call and execute the operations corresponding to each of the above modules.

[0152] In an exemplary embodiment, a computer device is provided, which may be a terminal, and its internal structure diagram may be shown in FIG6. The computer device includes a processor, a memory, an input / output interface, a communication interface, a display unit, and an input device. The processor, the memory, and the input / output interface are connected via a system bus, and the communication interface, the display unit, and the input device are connected to the system bus via the input / output interface. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal in a wired or wireless manner, and the wireless manner may be implemented through WIFI, a mobile cellular network, near field communication (NFC) or other technologies. When the computer program is executed by the processor, a method for detecting abnormal business data of an enterprise is implemented. The display unit of the computer device is used to form a visually visible picture, which may be a display screen, a projection device, or a virtual reality imaging device. The display screen can be a liquid crystal display screen or an electronic ink display screen, and the input device of the computer device can be a touch layer covering the display screen, or a button, trackball or touchpad set on the computer device shell, or an external keyboard, touchpad or mouse.

[0153] Those skilled in the art will understand that the structure shown in FIG. 6 is merely a block diagram of a partial structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than shown in the figure, or combine certain components, or have a different arrangement of components.

[0154] In an exemplary embodiment, a computer device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the steps of the above method embodiment when executing the computer program.

[0155] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps of the above method embodiment are implemented.

[0156] In one embodiment, a computer program product is provided, comprising a computer program, which implements the steps of the above method embodiment when executed by a processor.

[0157] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant regulations.

[0158] A person of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment method can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, an artificial intelligence (AI) processor, etc., but are not limited to this.

[0159] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0160] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A method for detecting abnormal business data of an enterprise, characterized in that: The method comprises: Acquire multiple business data of the enterprise; the business data includes key indicator sub-data of multiple dimensions; Determining the number of clusters for the multiple business data according to the business experience information of the business to which the multiple business data belong; According to the number of clusters, clustering processing is performed on the plurality of business data to obtain a plurality of clusters matching the number of clusters; the cluster includes at least one of the business data; For any one of the multiple clusters, determining a cluster neighborhood radius and a minimum number of cluster points according to data distribution information of the any one cluster and service demand information of services to which the multiple service data belong; According to the cluster neighborhood radius and the minimum number of cluster points, clustering is performed on any one of the clusters to obtain at least one sub-cluster and business data that does not belong to the sub-cluster; the number of business data included in the sub-cluster is greater than or equal to the minimum number of points; The business data that does not belong to the sub-cluster is determined as abnormal business data of the enterprise; the abnormal business data of the enterprise is used to generate warning information, and the warning information is used to prompt the abnormal business data of the enterprise to be processed.

2. The method according to claim 1, characterized in that The determining, according to the business experience information of the business to which the multiple business data belong, the number of clusters for the multiple business data comprises: Determining the service type of the service to which the multiple service data belong; The number of corresponding preset conditions is determined according to the business type, and the number of clusters is determined according to the number of preset conditions.

3. The method according to claim 1, characterized in that The determining, according to the data distribution information of any one of the clusters and the service demand information of the services to which the plurality of service data belong, the cluster neighborhood radius and the minimum number of cluster points comprises: Determining an initial neighborhood radius according to a standard deviation of each of the service data included in any one of the clusters; Determining an initial minimum number of points according to the amount of the business data included in any one of the clusters; According to the importance level of the business data, the initial neighborhood radius and the initial minimum number of points are adjusted to obtain the cluster neighborhood radius and the cluster minimum number of points; Among them, the higher the importance level is, the smaller the cluster neighborhood radius is, and the higher the minimum number of cluster points is.

4. The method according to claim 1, characterized in that: After determining the business data not belonging to the sub-cluster as abnormal business data of the enterprise, the method further includes: Determine the distance between the abnormal business data of the enterprise and the center of the sub-cluster closest to it; Determining the abnormality degree of the abnormal business data of the enterprise according to the distance; For each key indicator sub-data included in the abnormal business data of the enterprise, determining the key indicator sub-data that does not meet the indicator threshold range among the key indicator sub-data as abnormal key indicator sub-data; Generate warning information corresponding to the abnormal business data of the enterprise according to the abnormal degree and the abnormal key indicator sub-data; The warning information is sent to a terminal associated with the plurality of business data.

5. The method according to claim 1, characterized in that After determining the business data not belonging to the sub-cluster as abnormal business data of the enterprise, the method further includes: If the intra-cluster variance of each cluster in the plurality of clusters does not meet the variance threshold range, adjusting the number of clusters to obtain an adjusted number of clusters; If all key indicator sub-data included in the enterprise's abnormal business data meet the indicator threshold range, the enterprise's abnormal business data will be determined as detection error data, and when the number of the detection error data meets the quantity threshold, the cluster neighborhood radius and the minimum number of cluster points will be adjusted to obtain the adjusted cluster neighborhood radius and the adjusted minimum number of cluster points.

6. A detection system for abnormal business data of an enterprise, characterized in that: The system includes: an application interaction layer, a data processing layer, a data storage layer and an infrastructure layer; The application interaction layer is used to send the warning information corresponding to the abnormal business data of the enterprise to the terminals associated with the multiple business data; The data processing layer is used to perform the steps of the method for detecting abnormal business data of an enterprise according to any one of claims 1 to 5; The data storage layer is used to store the multiple business data; The infrastructure layer is used to provide an operating platform for detecting abnormal business data of the enterprise.

7. A device for detecting abnormal business data of an enterprise, characterized in that: The device comprises: A data acquisition module is used to acquire multiple business data of an enterprise; the business data includes key indicator sub-data of multiple dimensions; A clustering module, configured to determine the number of clusters for the multiple business data according to business experience information of the business to which the multiple business data belong; The clustering module is further used to perform clustering processing on the multiple business data according to the number of clustering clusters to obtain multiple clusters matching the number of clustering clusters; the cluster includes at least one of the business data; The clustering module is further configured to determine, for any one of the multiple clusters, a cluster neighborhood radius and a minimum number of cluster points according to data distribution information of the any one cluster and business demand information of the business to which the multiple business data belong; The clustering module is further used to perform clustering processing on any one of the clusters according to the cluster neighborhood radius and the minimum number of cluster points to obtain at least one sub-cluster and business data that does not belong to the sub-cluster; the number of business data included in the sub-cluster is greater than or equal to the minimum number of points; The abnormality detection module is used to determine the business data that does not belong to the sub-cluster as abnormal business data of the enterprise; the abnormal business data of the enterprise is used to generate warning information, and the warning information is used to prompt the abnormal business data of the enterprise to be processed.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 5 are implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 5 are implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 5 are implemented.

Images