Abnormal business data determination method, device and equipment

Abstract

The invention provides an abnormal service data determination method. The method can be applied to the technical fields of financial science and technology and information security. The method comprises the steps that a newly-added service downloading data are acquired, the a newly-added service downloading data are input into a pre-trained and optimized spatial clustering model, b non-outlier newly-added service downloading data points are output to serve as b first data points, and each first data point comprises coordinates of the newly-added service downloading data points. And importing the coordinates of the b first data points into a pre-generated first density reachability graph to generate a second density reachability graph. And on the basis of the second density reachability graph, screening out d abnormal data points from the b first data points, and determining d abnormal business data according to the d abnormal data points.

Description

Technical Field

[0001] The present disclosure relates to the field of financial technology, specifically to the field of information security technology, and in particular to a method, device, equipment, medium and program product for determining abnormal business data. Background Art

[0002] In enterprises and organizations, including banks, business reports are an important basis for decision-making and management. However, business reports usually contain sensitive information, such as financial data, customer information, etc. Therefore, business report download systems usually have strong access control and identity authentication mechanisms to ensure that only authorized users can access and download reports, and prevent unauthorized downloads, data leakage and other security risks. However, for authorized business personnel, it is very difficult to define whether the business reports they download are required for work. Usually, the analysis of business report download behavior depends on professionals to manually capture this complex information through business rules and logic, and then judge whether the business report download behavior is abnormal based on personal experience. This method is extremely dependent on the business experience of professionals and consumes a lot of time of business personnel, and the work efficiency is extremely low. Summary of the invention

[0003] In view of the above problems, the present disclosure provides a method, apparatus, device, medium and program product for determining abnormal business data.

[0004] According to the first aspect of the present disclosure, a method for determining abnormal business data is provided, characterized in that the method includes: obtaining a new business download data, inputting the a new business download data into a pre-trained and tuned spatial clustering model, and outputting b non-outlier new business download data points as b first data points, wherein each first data point includes the coordinates of the new business download data point, wherein a is greater than or equal to 2, b is less than or equal to a, and a and b are both positive integers; importing the coordinates of the b first data points into a pre-generated first density reachable graph to generate a second density reachable graph; and based on the second density reachable graph, screening out d abnormal data points from the b first data points, and determining d abnormal business data according to the d abnormal data points, wherein d is less than or equal to b, and d is a positive integer.

[0005] According to an embodiment of the present disclosure, it is characterized in that the first density reachable graph includes: coordinates of outliers in historical business download data points, and based on the second density reachable graph, d abnormal data points are screened out from b first data points, including: obtaining the domain radius of the outlier coordinates in the historical business download data points from the second density reachable graph to generate multiple first historical data points; obtaining multiple first historical data points within the domain radius of each first data point from the second density reachable graph to generate multiple second historical data points corresponding to each first data point; calculating the Euclidean distance between each first data point and multiple second historical data points to generate multiple first distances for each first data point, wherein the domain radius of each second historical data point generating a first distance with the first data point is different; obtaining the domain radius of each second historical data point generating a first distance with the first data point, Generate multiple second distances, wherein the second distance and the first distance are mapped into a one-to-one correspondence through the same historical data point; determine whether there is a second historical data point whose first distance is less than the second distance corresponding to it among the multiple second historical data points corresponding to each first data point, and if there is a second historical data point whose first distance is less than the second distance corresponding to it, obtain c first data points whose first distance is less than the second distance corresponding to it, and generate c second data points, wherein c is less than or equal to b, and c is a positive integer; obtain the second historical data point whose first distance of each second data point is less than the second distance corresponding to it, and generate relevant data points for each second data point; and based on the relevant data points of each second data point, screen out d abnormal data points from the c second data points, wherein d is less than or equal to c, and d is a positive integer.

[0006] According to an embodiment of the present disclosure, it is characterized in that the method also includes: inputting the a new business download data into a pre-trained and tuned spatial clustering model, outputting e outlier new business download data points, where e is a positive integer, and the sum of d and e is equal to a; and determining e abnormal business data based on the e outlier new business download data points.

[0007] According to an embodiment of the present disclosure, it is characterized in that the method also includes: obtaining f first data points for which there is no second historical data point whose first distance is less than the corresponding second distance, generating f third data points, wherein f is less than or equal to b, and f is a positive integer; obtaining the number of second historical data points within the domain radius of each third data point, if the number of second historical data points within the domain radius of the third data point is greater than or equal to a preset threshold, then obtaining g third data points whose number of second historical data points within the domain radius is greater than or equal to the preset threshold from the f third data points, generating g fourth data points, wherein g is less than or equal to f, and g is a positive integer; and determining g abnormal business data based on the g fourth data points.

[0008] According to an embodiment of the present disclosure, it is characterized in that each of the first historical data points includes a feature label, and the method also includes: if the number of second historical data points within the domain radius of the third data point is less than a preset threshold, then obtaining h third data points whose number of second historical data points within the domain radius is less than the preset threshold from the f third data points, generating h fifth data points, wherein the sum of h and g is equal to f, and h is a positive integer; and obtaining and accumulating the feature labels of the second historical data points within the domain radius of each fifth data point, screening out i abnormal data points from the h second data points, and determining i abnormal business data based on the i abnormal data points, wherein i is less than or equal to h, and i is a positive integer.

[0009] According to an embodiment of the present disclosure, it is characterized in that a pre-trained spatial clustering model is tuned, including: based on a new business download data, the pre-trained spatial clustering model is tuned for optimal parameters by a grid search method to generate a tuned spatial clustering model, wherein the optimal parameters include: domain radius.

[0010] According to an embodiment of the present disclosure, it is characterized in that each of the first data points includes a domain radius of this batch of new business download data points, and the pre-generation of the first density reachable graph includes: obtaining multiple batches of historical new business download data, wherein each batch of historical new business download data includes coordinates of multiple business download data points, the coordinates of multiple business download data points in the same batch of historical new business download data have the same domain radius, and the coordinates of multiple business download data points in different batches of historical new business download data have the same domain radius; and importing the multiple batches of historical new business download data into the same coordinate graph to generate a first density reachable graph.

[0011] According to an embodiment of the present disclosure, it is characterized in that each of the first historical data points includes a feature label, and based on the relevant data points of each second data point, d abnormal data points are screened out from c second data points, including: obtaining the feature label of the relevant data point of each second data point to generate multiple relevant feature labels for each second data point; accumulating the multiple relevant feature labels of each second data point to generate a feature label for each second data point; and based on the feature label of each second data point, screening out d abnormal data points from c second data points.

[0012] According to a second aspect of the present disclosure, an abnormal business data determination device is provided, characterized in that the device includes: a first acquisition module, used to acquire a new business download data, input the a new business download data into a pre-trained and tuned spatial clustering model, and output b non-outlier new business download data points as b first data points, wherein each first data point includes the coordinates of the new business download data point, wherein a is greater than or equal to 2, b is less than or equal to a, and a and b are both positive integers; a first generation module, used to import the coordinates of the b first data points into a pre-generated first density reachable graph to generate a second density reachable graph; and a first determination module, used to screen out d abnormal data points from the b first data points based on the second density reachable graph, and determine d abnormal business data according to the d abnormal data points, wherein d is less than or equal to b, and d is a positive integer.

[0013] According to an embodiment of the present disclosure, it is characterized in that the first density reachable map includes: the coordinates of the outlier points in the historical business download data points, and the second determination module includes: a fourth generation module, which is used to obtain the domain radius of the outlier point coordinates in the historical business download data points from the second density reachable map, and generate multiple first historical data points; a fifth generation module, which is used to obtain multiple first historical data points within the domain radius of each first data point from the second density reachable map, and generate multiple second historical data points corresponding to each first data point; a sixth generation module, which is used to calculate the Euclidean distance between each first data point and multiple second historical data points, and generate multiple first distances for each first data point, wherein the domain radius of each second historical data point that generates a first distance with the first data point is different; a seventh generation module, which is used to obtain the domain radius of each second historical data point that generates a first distance with the first data point, and generate multiple second distances , wherein the second distance and the first distance are mapped into a one-to-one correspondence through the same historical data point; an eighth generation module, used to determine whether there is a second historical data point whose first distance is less than the second distance corresponding to it among the multiple second historical data points corresponding to each first data point, and if there is a second historical data point whose first distance is less than the second distance corresponding to it, then c first data points whose first distance is less than the second distance corresponding to it are obtained, and c second data points are generated, wherein c is less than or equal to b, and c is a positive integer; a ninth generation module, used to obtain the second historical data point whose first distance of each second data point is less than the second distance corresponding to it, and generate the relevant data points of each second data point; and a first screening module, used to screen out d abnormal data points from the c second data points based on the relevant data points of each second data point, wherein d is less than or equal to c, and d is a positive integer.

[0014] According to an embodiment of the present disclosure, it is characterized in that the first acquisition module includes: a second generation module, used to input the a new business download data into a pre-trained and tuned spatial clustering model, and output e outlier new business download data points, where e is a positive integer, and the sum of d and e is equal to a; and a second determination module, used to determine e abnormal business data based on the e outlier new business download data points.

[0015] According to an embodiment of the present disclosure, it is characterized in that the second acquisition module includes: a third acquisition module, used to acquire f first data points for which there is no second historical data point whose first distance is less than the corresponding second distance, and generate f third data points, wherein f is less than or equal to b, and f is a positive integer; a tenth generation module, used to acquire the number of second historical data points within the domain radius of each third data point, if the number of second historical data points within the domain radius of the third data point is greater than or equal to a preset threshold, then acquiring g third data points whose number of second historical data points within the domain radius is greater than or equal to the preset threshold from the f third data points, and generating g fourth data points, wherein g is less than or equal to f, and g is a positive integer; and a third determination module, used to determine g abnormal business data based on the g fourth data points.

[0016] According to an embodiment of the present disclosure, it is characterized in that the tenth generation module includes: a tenth generation module, which is used to obtain h third data points whose number of second historical data points within the domain radius of the third data point is less than the preset threshold value from the f third data points, and generate h fifth data points, where the sum of h and g is equal to f, and h is a positive integer; and a fourth determination module, which is used to obtain and accumulate feature labels of the second historical data points within the domain radius of each fifth data point, filter out i abnormal data points from the h second data points, and determine i abnormal business data based on the i abnormal data points, where i is less than or equal to h, and i is a positive integer.

[0017] According to an embodiment of the present disclosure, it is characterized in that the first acquisition module also includes: a tuning module, which is used to tune the optimal parameters of the pre-trained spatial clustering model through a grid search method based on a new business download data, and generate a tuned spatial clustering model, wherein the optimal parameters include: domain radius.

[0018] According to an embodiment of the present disclosure, it is characterized in that the first generation module includes: a second acquisition module, used to acquire multiple batches of historical new business download data, wherein each batch of historical new business download data includes coordinates of multiple business download data points, the coordinates of multiple business download data points in the same batch of historical new business download data have the same domain radius, and the coordinates of multiple business download data points in different batches of historical new business download data have the same domain radius; and a third generation module, used to import the multiple batches of historical new business download data into the same coordinate graph to generate a first density reachable graph.

[0019] According to an embodiment of the present disclosure, it is characterized in that the first screening module includes: an eleventh generation module, which is used to obtain the feature label of the relevant data point of each second data point and generate multiple relevant feature labels for each second data point; a twelfth generation module, which is used to accumulate the multiple relevant feature labels of each second data point and generate a feature label for each second data point; and a fifth determination module, which is used to screen out d abnormal data points from c second data points based on the feature label of each second data point.

[0020] According to a third aspect of the present disclosure, an electronic device is provided, comprising: one or more processors; a storage device for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors execute the above-mentioned abnormal business data determination method.

[0021] According to a fourth aspect of the present disclosure, a computer-readable storage medium is provided, on which executable instructions are stored. When the instructions are executed by a processor, the processor executes the above-mentioned abnormal business data determination method.

[0022] According to a fifth aspect of the present disclosure, a computer program product is also provided, including a computer program, which implements the above-mentioned abnormal business data determination method when executed by a processor.

[0023] The disclosed embodiment obtains the first data point by applying the optimized spatial clustering model, and then imports the first data point into the first density reachable graph, filters the first data point in combination with the first density reachable graph, filters out abnormal data points, and determines the technical means of abnormal data. It can exclude a large number of normal business report download behaviors from massive data, automatically identify suspected abnormal business report download behaviors, greatly reduce the workload of personnel for judgment, and improve the technical effect of work efficiency and processing speed. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] The above contents and other objects, features and advantages of the present disclosure will become more apparent through the following description of the embodiments of the present disclosure with reference to the accompanying drawings, in which:

[0025] Figure 1 A diagram schematically shows an application scenario of the method and device for determining abnormal business data according to an embodiment of the present disclosure;

[0026] Figure 2 A flowchart of a method for determining abnormal business data according to an embodiment of the present disclosure is schematically shown;

[0027] Figure 3 A schematic diagram showing an example of DBSCAN clustering in a method for determining abnormal business data according to an embodiment of the present disclosure is shown;

[0028] Figure 4 Schematically shows an example diagram of a grid search in a method for determining abnormal business data according to an embodiment of the present disclosure;

[0029] Figure 5 A flowchart of determining abnormal business data by outputting outlier data points through a spatial clustering model in a method for determining abnormal business data according to an embodiment of the present disclosure is schematically shown;

[0030] Figure 6 A schematic diagram schematically shows a method for determining abnormal business data according to an embodiment of the present disclosure to generate a replacement data point.

[0031] Figure 7 A flowchart for generating a first density reachable graph in a method for determining abnormal business data according to an embodiment of the present disclosure is schematically shown;

[0032] Figure 8 A flowchart for generating d abnormal data points in a method for determining abnormal business data according to an embodiment of the present disclosure is schematically shown;

[0033] Fig. 9 Schematically shows a flowchart of determining abnormal business data when there is no first data point of second historical data whose first distance is smaller than the second distance corresponding thereto in the abnormal business data determination method according to an embodiment of the present disclosure;

[0034] Fig.10 A flowchart of determining abnormal business data if the second historical data point within the field radius of the third data point is less than a preset threshold value in the abnormal business data determination method according to an embodiment of the present disclosure is schematically shown;

[0035] Fig.11 A flowchart for screening out d abnormal data points in the abnormal business data determination method according to an embodiment of the present disclosure is schematically shown;

[0036] Fig.12 The structure block diagram of the abnormal business data determination device according to the embodiment of the present disclosure is schematically shown;

[0037] Fig.13 A block diagram of an electronic device suitable for implementing the abnormal business data determination method according to an embodiment of the present disclosure is schematically shown. DETAILED DESCRIPTION

[0038] Hereinafter, embodiments of the present disclosure will be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of the present disclosure. In the following detailed description, for ease of explanation, many specific details are set forth to provide a comprehensive understanding of the embodiments of the present disclosure. However, it is apparent that one or more embodiments may also be implemented without these specific details. In addition, in the following description, descriptions of known structures and technologies are omitted to avoid unnecessary confusion of the concepts of the present disclosure.

[0039] The terms used herein are only for describing specific embodiments and are not intended to limit the present disclosure. The terms "comprise", "include", etc. used herein indicate the existence of the features, steps, operations and / or components, but do not exclude the existence or addition of one or more other features, steps, operations or components.

[0040] All terms (including technical and scientific terms) used herein have the meanings commonly understood by those skilled in the art, unless otherwise defined. It should be noted that the terms used herein should be interpreted as having a meaning consistent with the context of this specification, and should not be interpreted in an idealized or overly rigid manner.

[0041] When using expressions such as "at least one of A, B, and C, etc.", they should generally be interpreted according to the meaning of the expression commonly understood by those skilled in the art (for example, "a system having at least one of A, B, and C" should include but is not limited to a system having A alone, B alone, C alone, A and B, A and C, B and C, and / or A, B, C, etc.).

[0042] Some block diagrams and / or flow charts are shown in the accompanying drawings. It should be understood that some blocks or combinations thereof in the block diagrams and / or flow charts may be implemented by computer program instructions. These computer program instructions may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable control device, so that these instructions, when executed by the processor, may create a device for implementing the functions / operations described in these block diagrams and / or flow charts.

[0043] First, the technical terms that appear in this article are explained as follows:

[0044] The DBSCAN (Density-Based Spatial Clustering of Applications with Noise) model is a density-based spatial clustering model used to cluster data points in space. The core concept of DBSCAN is to define clusters around the density of data points. It can identify high-density areas separated by low-density areas and treat these areas as independent clusters.

[0045] Density reachable graph,The graph generated by DBSCAN is called density reachable graph.

[0046] Euclidean distance is the shortest straight-line distance between two points in multidimensional space.

[0047] Grid search is a method for selecting the optimal hyperparameters of a model by exhaustively searching all possible hyperparameter combinations to find the best parameter settings.

[0048] Cartesian product is a basic concept in set theory, which is used to describe the set of all possible ordered pairs between two sets.

[0049] An embodiment of the present disclosure provides a method for determining abnormal business data, the method comprising: obtaining a new business download data, inputting the a new business download data into a pre-trained and tuned spatial clustering model, and outputting b non-outlier new business download data points as b first data points, wherein each first data point includes the coordinates of the new business download data point, wherein a is greater than or equal to 2, b is less than or equal to a, and a and b are both positive integers. The coordinates of the b first data points are imported into a pre-generated first density reachable graph to generate a second density reachable graph. And based on the second density reachable graph, d abnormal data points are screened out from the b first data points, and d abnormal business data are determined based on the d abnormal data points, wherein d is less than or equal to b, and d is a positive integer.

[0050] The disclosed embodiment obtains a first data point by applying an optimized spatial clustering model, and then imports the first data point into a first density reachable graph, and screens the first data point in combination with a second density reachable graph to screen out abnormal data points. The technical means for determining abnormal data can exclude a large number of normal business report download behaviors from massive data, automatically identify suspected abnormal business report download behaviors, greatly reduce the workload of personnel for judgment, and improve the technical effect of work efficiency and processing speed.

[0051] Figure 1 The following schematically shows an application scenario diagram of the abnormal business data determination method and device according to an embodiment of the present disclosure. It should be noted that: Figure 1 The examples shown are merely scenarios in which the embodiments of the present disclosure can be applied, to help those skilled in the art understand the technical content of the present disclosure, but do not mean that the embodiments of the present disclosure cannot be used in other devices, systems, environments or scenarios.

[0052] like Figure 1As shown, the application scenario 100 according to this embodiment may include multiple application terminals and application servers. For example, the multiple application terminals include application terminal 101, application terminal 102, application terminal 103, etc. The network 104 is used to provide a medium for communication links between terminal devices 101, 102, 103 and server 105. The network 104 may include various connection types, such as wired, wireless communication links or optical fiber cables, etc.

[0053] The user can use the application terminal devices 101, 102, 103 to interact with the application server 105 through the network 104 to receive or send messages, etc. Various application programs can be installed on the application terminal devices 101, 102, 103, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social platform software, etc. (only as examples).

[0054] The terminal devices 101 , 102 , and 103 may be various electronic devices having a display screen and supporting web browsing, including but not limited to smart phones, tablet computers, laptop computers, and desktop computers.

[0055] The server 105 may be a server that provides various services, such as a background management server (only an example) that provides support for websites browsed by users using the terminal devices 101, 102, and 103. The background management server may analyze and process the received data such as user requests, and feed back the processing results (such as web pages, information, or data obtained or generated according to user requests) to the terminal device.

[0056] It should be noted that the abnormal business data determination method provided in the embodiment of the present disclosure can generally be executed by the server 105. Accordingly, the abnormal business data determination device provided in the embodiment of the present disclosure can generally be set in the server 105. The abnormal business data determination method provided in the embodiment of the present disclosure can also be performed by a server or server cluster that is different from the server 105 and can communicate with the terminal devices 101, 102, 103 and / or the server 105. Correspondingly, the abnormal business data determination device provided in the embodiment of the present disclosure can also be set in a server or server cluster that is different from the server 105 and can communicate with the terminal devices 101, 102, 103 and / or the server 105.

[0057] It should be understood that Figure 1 The number of terminal devices, networks and servers in the embodiment is only for illustration. Any number of terminal devices, networks and servers may be provided according to implementation requirements.

[0058] The following will be based on Figure 1 The scene described by Figure 2 to Figure 11The abnormal business data determination method of the disclosed embodiment is described in detail. It should be noted that the above application scenarios are only shown to facilitate understanding of the spirit and principle of the present disclosure, and the implementation of the present disclosure is not limited in this respect. On the contrary, the implementation of the present disclosure can be applied to any applicable scenario.

[0059] Figure 2 The flowchart of the abnormal business data determination method according to the embodiment of the present disclosure is schematically shown.

[0060] like Figure 2 As shown, the method 200 includes steps S201 to S203.

[0061] Step S201, obtain a new business download data, input the a new business download data into a pre-trained and tuned spatial clustering model, and output b non-outlier new business download data points as b first data points, wherein each first data point includes the coordinates of the new business download data point and the domain radius of this batch of new business download data points, wherein a is greater than or equal to 2, b is less than or equal to a, and a and b are both positive integers.

[0062] For example, the newly added service download data includes newly added service download data behavior data. A newly added service download behavior data may be obtained, and the a newly added service download behavior data may be input into a pre-trained and tuned spatial clustering model, and b non-outlier newly added service download data points may be output as b first data points.

[0063] In the DBSCAN clustering model, the maximum radius of the core point is defined as ε. If the distance between two data points is less than or equal to ε, they will be judged to be of the same class. In other words, ε is the distance threshold used by DBSCAN to determine whether two points are similar and belong to the same class. ε is also called the domain radius of the DBSCAN clustering model. Within the ε neighborhood of a point, if the number of points contained is not less than MinPts, the point is considered a core point, and the initial point is also included in MinPts. MinPts is also called the minimum number of points in the neighborhood of the DBSCAN clustering model.

[0064] Figure 3 An example diagram of DBSCAN clustering in the abnormal business data determination method according to an embodiment of the present disclosure is schematically shown.

[0065] like Figure 3As shown in the figure, there are 6 points in the ε of A. If MinPts is less than or equal to 6, then these points are all judged to be of the same class. Specifically, DBSCAN divides all data points into three categories: Core points: If the density of a point exceeds the threshold set by the algorithm, it is a core point. That is, the number of points in the ε neighborhood of the point is not less than MinPts, where ε and MinPts are both pre-set prior values. For example, Figure 1 Point A in is a core point. If the density of a point is less than the threshold set by the algorithm, but the point is within the ε neighborhood of a core point, then it is a boundary point. A boundary point is a neighbor of a core point, but does not meet the conditions to become a core point. For example, Figure 1 Point B in is a boundary point. The remaining points that are neither core points nor boundary points are considered outliers or noise points. These points may be outliers in the data or points that do not belong to any cluster. For example, Figure 1 Point C in the figure is an outlier or a noise point. By determining core points, boundary points, and outliers, DBSCAN can find clusters with different densities and shapes. Compared with some other algorithms, it is more robust in processing noisy data.

[0066] In the disclosed embodiment, the reliability of the DBSCAN clustering model can be gradually improved by first acquiring historical business data, training the DBSCAN clustering model on the historical business data, and continuously improving the DBSCAN clustering model through the DBSCAN clustering model training. The specific method for training the DBSCAN clustering model includes: acquiring historical business data, performing data cleaning and feature selection on the historical business data according to the business scenario, ensuring the quality and suitability of the data, generating historical business data after data cleaning and feature selection, classifying the historical business data, and generating historical sample training data and historical verification training data. Then, the optimal parameter value of the DBSCAN clustering model is obtained, and the parameters of the DBSCAN clustering model are tuned, where the parameter values ​​include the minimum number of points in the radius field and the neighborhood. Then, the historical sample training data is input into the DBSCAN clustering model after parameter tuning for model training, and then the historical verification training data is input into the trained DBSCAN clustering model, and the DBSCAN clustering model is evaluated to generate a training evaluation result. Based on the training evaluation results, the parameter values ​​of the DBSCAN clustering model are adjusted, and the above training and verification steps are repeated to continuously adjust the DBSCAN clustering model parameters and optimize the DBSCAN clustering model until the expected training evaluation results are achieved, the training of the DBSCAN clustering model is completed, and the expected DBSCAN clustering model is generated.

[0067] The DBSCAN clustering model is very sensitive to parameter selection. Different parameters may lead to different clustering results. Therefore, selecting appropriate parameters for parameter tuning is an important step in applying the DBSCAN clustering model. In the disclosed embodiment, based on a newly added business download data, the pre-trained spatial clustering model can be optimized for optimal parameters through a grid search method to generate an optimized spatial clustering model, wherein the optimal parameters include: domain radius ε and the minimum number of points in the neighborhood MinPts. The accuracy of the DBSCAN clustering model output is achieved through model parameter tuning, and the reliability of the DBSCAN clustering model is improved.

[0068] Figure 4 An example diagram of a grid search in a method for determining abnormal business data according to an embodiment of the present disclosure is schematically shown.

[0069] like Figure 4 As shown in Figure 2, grid search is an exhaustive search method that searches for the optimal hyperparameters by traversing all possible combinations of hyperparameters. Depending on the application scenario, the maximum value of ε can be set to (dim represents the dimension of the data point feature), the minimum value is 0.001, and the step size is 0.001. The maximum value of MinPts is set to The minimum value is set to 1 and the step size is set to 1. The idea of ​​setting the maximum value here is that the data point at this time has only two characteristics: normal business report download behavior and abnormal business report download behavior, so the maximum value of MinPts is set to in Indicates rounding down. Next, generate the Cartesian product of ε and MinPts to form a combination grid of hyperparameters. Then, the grid search performs DBSCAN clustering training and evaluation on each hyperparameter combination to find the hyperparameter combination with the best clustering accuracy. Figure 4 As shown, the black dot represents a hyperparameter combination.

[0070] In addition, the a newly added service download data are input into a pre-trained and tuned spatial clustering model, and e outlier newly added service download data points can be output for determining abnormal service data points.

[0071] Figure 5 The flowchart of determining abnormal business data by outputting outlier data points through a spatial clustering model in the abnormal business data determination method according to an embodiment of the present disclosure is schematically shown.

[0072] like Figure 5 As shown, the method 500 includes steps S501-S502.

[0073] Step S501, input the a newly added service download data into a pre-trained and tuned spatial clustering model, and output e outlier newly added service download data points, where e is a positive integer, and the sum of d and e is equal to a.

[0074] Step S502: determining e abnormal service data according to the e outlier newly added service download data points.

[0075] For example, the accuracy of the e outlier new business download data points output by the model can be verified. If the verification is indeed a real outlier new business download data point, it is directly determined as abnormal business data. If the verified outlier new business download data point is a false outlier new business download data point, the outlier data point with errors output in DBSCAN can be eliminated according to the real data label, and a replacement data point can be generated and saved.

[0076] Figure 6 A schematic diagram of generating replacement data points in the abnormal business data determination method according to an embodiment of the present disclosure is schematically shown.

[0077] like Figure 6 As shown in the figure, (A, B, C, D) is a cluster of DBSCAN, C is a false outlier new business download data point, and point C needs to be removed from the cluster, and the label of C and the distance ε′ to the nearest point in the cluster are retained. Then, the center point E of the cluster is calculated based on the remaining (A, B, D) after removing point C. E is a replacement data point, and E can be obtained by calculating the average value of the feature vectors of the remaining points, that is:

[0078]

[0079] Among them, P i represents the feature vector of the i-th point in the cluster, and n represents the number of remaining data points in the cluster after removing the erroneous points.

[0080] Subsequently, the replacement data point E can be subjected to the abnormal data determination step of the non-outlier data point to determine whether the data is abnormal data.

[0081] The spatial clustering model is used to identify outlier new business download data points and determine abnormal business data. This reduces the reliance on manual intervention, reduces the risk of human error, improves automation and stability, and reduces labor costs.

[0082] Return to reference Figure 2 In step S202, the coordinates of the b first data points are imported into a pre-generated first density reachable graph to generate a second density reachable graph, wherein each first data point includes the domain radius of the batch of newly added business download data points, and the first density reachable graph includes: the coordinates of outliers in the historical business download data points.

[0083] Figure 7 The flowchart of generating a first density reachable graph in the abnormal business data determination method according to an embodiment of the present disclosure is schematically shown.

[0084] like Figure 7 As shown, the method 700 includes steps S701 to S702.

[0085] Step S701, obtain multiple batches of historical new business download data, wherein each batch of historical new business download data includes coordinates of multiple business download data points, the coordinates of multiple business download data points in the same batch of historical new business download data have the same field radius, and the coordinates of multiple business download data points in different batches of historical new business download data have the same field radius.

[0086] For example, among the multiple batches of historical new business download data obtained, since parameter tuning is required each time the historical new business download data is obtained, the parameters of the clustering model of each batch are not the same, that is, the domain radius and the minimum number of points in the neighborhood of the coordinates of the data points of each batch of historical new business download data are not necessarily the same.

[0087] Step S702: import the batches of historical newly added service download data into the same coordinate graph to generate a first density reachable graph.

[0088] For example, multiple batches of historical new business download data with different domain radii are imported into the same coordinate graph to generate a first density reachable graph. The generated first density reachable graph includes multiple batches of historical new business download data coordinates with different domain radii.

[0089] The historical data is graphically displayed according to the pre-set first density reachable graph, which is convenient for calculation in combination with the newly added data points and improves the accuracy of abnormal data determination.

[0090] After generating the first density reachable graph, the coordinates of the b first data points are imported into the pre-generated first density reachable graph to generate a second density reachable graph, wherein the generated second density reachable graph includes the coordinates of multiple batches of historical new business download data with different domain radii originally included in the first density reachable graph and the coordinates of the newly imported b first data points, wherein the coordinates of the b first data points have the same domain radius but are not necessarily the same as the domain radius of multiple batches of historical new business download data coordinates.

[0091] Return to reference Figure 2In step S203, based on the second density reachable graph, d abnormal data points are screened out from the b first data points, and d abnormal business data are determined according to the d abnormal data points, where d is less than or equal to b and d is a positive integer.

[0092] Figure 8 The flowchart of generating d abnormal data points in the abnormal business data determination method according to an embodiment of the present disclosure is schematically shown.

[0093] like Figure 8 As shown, the method 800 includes steps S801 to S807.

[0094] Step S801: acquiring the area radius of the outlier coordinates in the historical business download data points from the second density reachable graph, and generating a plurality of first historical data points.

[0095] For example, the outlier coordinates in the historical business download data points here include the outlier coordinates in multiple batches of historical data, wherein the domain radius of the outlier coordinates in the same batch of historical business download data points is the same, and the domain radius of the outlier coordinates in different batches of historical business download data points may be the same or different, and the domain radius mainly depends on the selection of model parameters when inputting historical data. Since the historical business download data points generally include an identification value set and a feature label of whether it belongs to abnormal business report download behavior, its identification value set includes the amount of customer information in the downloaded business report, whether the business report file contains sensitive data, download time, download IP address, employee authority and other information. Therefore, the first historical data point generated can include a feature label.

[0096] Step S S802, obtaining multiple first historical data points within the range radius of each first data point from the second density reachable graph, and generating multiple second historical data points corresponding to each first data point.

[0097] For example, using the second density reachable graph as a standard, multiple first historical data points within the domain radius of each first data point are obtained, and multiple second historical data points corresponding to each first data point are generated. In other words, a cluster with each first data point as a core point and multiple first historical data points within the domain radius of each first data point as edge points is obtained, and the edge points of the cluster formed by each first data point are extracted to generate multiple second historical data points corresponding to each first data point.

[0098] Step S803, calculating the Euclidean distance between each first data point and multiple second historical data points, generating multiple first distances for each first data point, wherein the domain radius of each second historical data point generating the first distance with the first data point is different.

[0099] For example, the Euclidean distance between each first data point and multiple second historical data points can be calculated to generate multiple first distances for each first data point, each first distance is formed by a first data point and a second historical data point, and each first data point corresponds to multiple first distances. Since multiple second historical data points are within the domain radius of the first data point, all first distances are smaller than the domain radius of the first data point.

[0100] Step S804, obtaining the area radius of each second historical data point that generates a first distance with the first data point, and generating multiple second distances, wherein the second distance and the first distance are mapped into a one-to-one correspondence through the same historical data point.

[0101] For example, the domain radius of the second historical data point corresponding to each first data point can be obtained to generate multiple second distances. Since each second distance is the domain radius of the second historical data point, each second distance has the same second historical data point as each first distance, and the second distance and the first distance can be mapped into a one-to-one correspondence through the same historical data point.

[0102] Step S805, determine whether there is a second historical data point whose first distance is less than the corresponding second distance among the multiple second historical data points corresponding to each first data point. If there is a second historical data point whose first distance is less than the corresponding second distance, obtain c first data points whose first distance is less than the corresponding second distance, and generate c second data points, where c is less than or equal to b, and c is a positive integer.

[0103] For example, the first distance and the second distance of each second historical data point among the multiple second historical data points corresponding to each first data point are compared, and the first data points whose first distance is less than the second distance corresponding to them are screened out. Since each first data point may correspond to multiple second historical data points, as long as there is a second historical data point for the first data point that satisfies the first distance less than the second distance corresponding to it, the first data point that satisfies the condition is obtained, that is, c first data points that meet the above condition are obtained from b first data points as c second data points.

[0104] In addition, if it is determined that there is no first data point of the second historical data whose first distance is smaller than the corresponding second distance, a preset threshold method may be used to determine abnormal business data.

[0105] Fig. 9 Schematically shows a flowchart of determining abnormal business data if there is no first data point of second historical data whose first distance is smaller than the second distance corresponding thereto in the abnormal business data determination method according to an embodiment of the present disclosure;

[0106] like Fig. 9 As shown, the method 900 includes steps S901 to S903.

[0107] Step S901, obtaining f first data points for which there is no second historical data point whose first distance is less than the corresponding second distance, and generating f third data points, wherein f is less than or equal to b and f is a positive integer.

[0108] Step S902, obtain the number of second historical data points within the domain radius of each third data point. If the number of second historical data points within the domain radius of the third data point is greater than or equal to a preset threshold, then obtain g third data points whose number of second historical data points within the domain radius is greater than or equal to the preset threshold from the f third data points, and generate g fourth data points, where g is less than or equal to f and g is a positive integer.

[0109] If the number of second historical data points within the area radius of the third data point is greater than or equal to a preset threshold, the abnormal business data can be determined by accumulating feature labels.

[0110] Fig.10 A flowchart of determining abnormal business data if the second historical data point within the field radius of the third data point is less than a preset threshold value in the abnormal business data determination method according to an embodiment of the present disclosure is schematically shown.

[0111] like Fig.10 As shown, the method 1000 includes steps S1001 to S1002.

[0112] Step S1001, if the number of second historical data points within the domain radius of the third data point is less than a preset threshold, obtaining h third data points whose number of second historical data points within the domain radius is less than the preset threshold from the f third data points, and generating h fifth data points, wherein the sum of h and g is equal to f, and h is a positive integer; and

[0113] Step S1002, obtain and accumulate the feature labels of the second historical data points within the range radius of each fifth data point, filter out i abnormal data points from h second data points, and determine i abnormal business data based on the i abnormal data points, where i is less than or equal to h and i is a positive integer.

[0114] For example, the characteristic tags of the second historical data points within the domain radius of each fifth data point can be obtained as multiple related tags of each fifth data point, and these related tags are accumulated to generate the characteristic tag of each fifth data point. According to the characteristic tag of each fifth data point, i abnormal data points are screened out from the h second data points, and i abnormal business data are determined according to the i abnormal data points.

[0115] The third data point is screened by accumulating feature labels, which further improves the accuracy of abnormal data acquisition.

[0116] Return to reference Fig. 9 In step S903, g abnormal business data are determined based on the g fourth data points.

[0117] The third data point is screened by a preset threshold, thereby improving the accuracy of abnormal data acquisition.

[0118] Return to reference Figure 8 In step S S806, a second historical data point whose first distance to each second data point is smaller than its corresponding second distance is obtained, and a related data point of each second data point is generated.

[0119] For example, obtain second historical data points among c second data points, each of which satisfies a first distance less than a second distance corresponding thereto, obtain these second historical data points, and generate relevant data points for each second data point.

[0120] Step S807, based on the related data points of each second data point, d abnormal data points are screened out from the c second data points, where d is less than or equal to c and d is a positive integer.

[0121] Fig.11 The flowchart of screening out d abnormal data points in the abnormal business data determination method according to an embodiment of the present disclosure is schematically shown.

[0122] like Fig.11 As shown, the method 1100 includes steps S1101 to S1103.

[0123] Step S1101, obtaining feature labels of data points related to each second data point, and generating multiple related feature labels for each second data point.

[0124] For example, if the multiple relevant feature labels of a second data point are 1 feature label of normal download behavior and 2 feature labels of normal download behavior, then the relevant feature labels of this second data point can be expressed as [normal download behavior, abnormal download behavior] = [1, 2].

[0125] Step S1102: Accumulate multiple relevant feature labels of each second data point to generate a feature label for each second data point.

[0126] For example, the relevant feature label of the second data point of the example in step S1101 can be represented as [normal download behavior, abnormal download behavior] = [1, 2], and the feature label of the second data point is accumulated to obtain abnormal behavior. Accumulating the relevant feature labels may include: comparing the normal download behavior and the abnormal download behavior in the relevant feature labels, if the normal download behavior is greater than the abnormal download behavior, then the feature label of the second data point is normal behavior, if the normal download behavior is less than or equal to the abnormal download behavior, then the feature label of the second data point is abnormal behavior.

[0127] Step S1103: based on the feature label of each second data point, d abnormal data points are screened out from the c second data points, and d abnormal business data are determined according to the d abnormal data points.

[0128] By accumulating labels of the relevant data points of each second data point to determine the characteristic label of each second data point, the reliability of abnormal data determination is improved. And by obtaining c second data points of the second historical data point whose first distance is less than the corresponding second distance, and screening out d abnormal data points in combination with the relevant data points of each second data point, the accuracy of determining d abnormal data can be improved, and the reliability of identifying suspected abnormal business report downloading behavior can be improved.

[0129] In addition, the abnormal business data determined by the above method can be judged again through error index calculation, residual analysis, etc. to generate the final result. The final result is saved in the historical database and the historical data is iteratively updated.

[0130] According to the embodiment of the present disclosure, clusters with different densities and shapes are effectively identified through the DBSCAN model, and excellent performance is shown when processing noise data. By using a clustering method based on the DBSCAN model and combining the determination of outliers, the business report download behavior is accurately classified. The grid search technology is used to obtain the optimal parameter value, and by correcting the labels of false data points and their related information, the accuracy and generalization ability of the algorithm are improved, and the accuracy and robustness of outlier detection are improved. By correcting the false data points in the training phase, the false alarm rate is effectively reduced, the interference with normal business operations is reduced, and the reliability and stability of the algorithm are enhanced. By calculating and comparing the generated data points, the classification of the data points is more accurately determined, and the workload of manual judgment is reduced. The abnormal results are judged twice to ensure accuracy and reliability, and all data point feature information and labels are fed back to the historical data set for updating, further enhancing the reliability of the system. By continuously updating the historical database and continuously optimizing the model, the adaptability to new download behaviors is improved, forming a circular feedback mechanism to maintain the efficiency and accuracy of the model. Through automated feature learning and parameter adjustment, the reliance on manual intervention is reduced, the risk of human error is reduced, the degree of automation and stability are improved, and labor costs are reduced. This method excludes a large number of normal business report download behaviors from massive data, automatically identifies suspected abnormal business report download behaviors, greatly reduces the workload of personnel for judgment, and improves work efficiency and processing speed.

[0131] Fig.12 The structural block diagram of the abnormal business data determination device according to an embodiment of the present disclosure is schematically shown.

[0132] like Fig.12 As shown, the device 1200 includes: a first acquisition module 1201 , a first generation module 1202 and a first determination module 1203 .

[0133] The first acquisition module 1201 is used to acquire a new business download data, input the a new business download data into a pre-trained and tuned spatial clustering model, and output b non-outlier new business download data points as b first data points, wherein each first data point includes the coordinates of the new business download data point and the domain radius of the new business download data points in this batch, wherein a is greater than or equal to 2, b is less than or equal to a, and a and b are both positive integers. In one embodiment, the first acquisition module 1201 can be used to execute step S201 described above, which will not be repeated here.

[0134] The first generation module 1202 is used to import the coordinates of the b first data points into a pre-generated first density reachable graph to generate a second density reachable graph, wherein the first density reachable graph includes: the coordinates of outliers in the historical business download data points. In one embodiment, the first generation module 1202 can be used to execute step S202 described above, which will not be repeated here.

[0135] The first determination module 1203, based on the second density reachable graph, selects d abnormal data points from the b first data points, and determines d abnormal business data according to the d abnormal data points, where d is less than or equal to b and d is a positive integer. In one embodiment, the first determination module 1203 can be used to execute step S203 described above, which is not repeated here.

[0136] According to the embodiment of the present disclosure, the first acquisition module 1201 includes: a seventh generation module and a second determination module.

[0137] The second generation module is used to input the a newly added service download data into a pre-trained and tuned spatial clustering model, and output e outlier newly added service download data points, where e is a positive integer, and the sum of d and e is equal to a. In one embodiment, the second generation module can be used to execute step S501 described above, which will not be repeated here.

[0138] The second determination module is used to determine e abnormal service data according to the e outlier newly added service download data points. In one embodiment, the second determination module can be used to execute the above-described step S502, which will not be described in detail here.

[0139] According to an embodiment of the present disclosure, the first acquisition module 1201 also includes: a tuning module, which is used to tune the optimal parameters of the pre-trained spatial clustering model based on a new business download data through a grid search method to generate a tuned spatial clustering model, wherein the optimal parameters include: domain radius.

[0140] According to an embodiment of the present disclosure, the first generating module 1202 includes: a second acquiring module and a third generating module.

[0141] The second acquisition module is used to acquire multiple batches of historical new business download data, wherein each batch of historical new business download data includes coordinates of multiple business download data points, the coordinates of multiple business download data points in the same batch of historical new business download data have the same field radius, and the coordinates of multiple business download data points in different batches of historical new business download data have the same field radius. In one embodiment, the second acquisition module can be used to execute step S701 described above, which will not be repeated here.

[0142] The third generating module is used to import the batches of historical newly added service download data into the same coordinate graph to generate a first density reachable graph. In one embodiment, the third generating module can be used to execute the above-described step S702, which will not be described in detail here.

[0143] According to an embodiment of the present disclosure, the first determination module 1203 includes: a fourth generation module, a fifth generation module, a sixth generation module, a seventh generation module, an eighth generation module, a ninth generation module and a first screening module.

[0144] The fourth generation module is used to obtain the domain radius of the outlier coordinates in the historical business download data points from the second density reachable graph to generate multiple first historical data points. In one embodiment, the fourth generation module can be used to execute step S801 described above, which will not be repeated here.

[0145] The fifth generation module is used to obtain multiple first historical data points within the range radius of each first data point from the second density reachable graph, and generate multiple second historical data points corresponding to each first data point. In one embodiment, the fifth generation module can be used to execute step S802 described above, which will not be repeated here.

[0146] The sixth generation module is used to calculate the Euclidean distance between each first data point and multiple second historical data points, and generate multiple first distances for each first data point, wherein the domain radius of each second historical data point that generates the first distance with the first data point is different. In one embodiment, the sixth generation module can be used to execute step S803 described above, which will not be repeated here.

[0147] The seventh generation module is used to obtain the area radius of each second historical data point that generates a first distance from the first data point, and generate multiple second distances, wherein the second distance and the first distance are mapped into a one-to-one correspondence through the same historical data point. In one embodiment, the seventh generation module can be used to execute step S804 described above, which is not repeated here.

[0148] The eighth generation module is used to determine whether there is a second historical data point whose first distance is less than the second distance corresponding to each first data point among the multiple second historical data points corresponding to each first data point, and if there is a second historical data point whose first distance is less than the second distance corresponding to it, then obtain c first data points whose first distance is less than the second distance corresponding to it, and generate c second data points, where c is less than or equal to b, and c is a positive integer. In one embodiment, the eighth generation module can be used to execute step S805 described above.

[0149] The ninth generation module is used to obtain the second historical data point whose first distance of each second data point is less than the second distance corresponding thereto, and generate the relevant data point of each second data point. In one embodiment, the ninth generation module can be used to execute the step S806 described above, which will not be described in detail here.

[0150] The first screening module is used to screen out d abnormal data points from c second data points based on the relevant data points of each second data point, and determine d abnormal business data according to the d abnormal data points, where d is less than or equal to c and d is a positive integer. In one embodiment, the first screening module can be used to execute step S807 described above.

[0151] According to an embodiment of the present disclosure, the eighth generating module includes: a third acquiring module, a fourth acquiring module and a third determining module.

[0152] The third acquisition module is used to acquire f first data points for which there is no second historical data point whose first distance is less than the second distance corresponding to the first data point, and generate f third data points, where f is less than or equal to b, and f is a positive integer. In one embodiment, the third acquisition module can be used to execute step S901 described above, which is not repeated here.

[0153] The fourth acquisition module is used to obtain the number of second historical data points within the domain radius of each third data point. If the number of second historical data points within the domain radius of the third data point is greater than or equal to a preset threshold, g third data points whose number of second historical data points within the domain radius is greater than or equal to the preset threshold are obtained from the f third data points to generate g fourth data points, where g is less than or equal to f and is a positive integer. In one embodiment, the fourth acquisition module can be used to execute step S902 described above.

[0154] The third determination module is used to determine g abnormal business data based on the g fourth data points. In one embodiment, the third determination module can be used to execute step S903 described above, which will not be described in detail here.

[0155] According to an embodiment of the present disclosure, the fourth acquisition module includes: a tenth generation module and a fourth determination module.

[0156] The tenth generation module is used to obtain h third data points whose number of second historical data points within the domain radius is less than the preset threshold value from the f third data points if the number of second historical data points within the domain radius of the third data point is less than the preset threshold value, and generate h fifth data points, where the sum of h and g is equal to f, and h is a positive integer. In one embodiment, the tenth generation module can be used to execute step S1001 described above, which will not be repeated here.

[0157] The fourth determination module is used to obtain and accumulate the feature labels of the second historical data points within the domain radius of each fifth data point, screen out i abnormal data points from the h second data points, and determine i abnormal business data based on the i abnormal data points, where i is less than or equal to h and i is a positive integer. In one embodiment, the fourth determination module can be used to execute step S1002 described above, which will not be repeated here.

[0158] According to an embodiment of the present disclosure, the first screening module includes: an eleventh generating module, a twelfth generating module and a fifth determining module.

[0159] The eleventh generating module is used to obtain the feature labels of the data points related to each second data point and generate multiple related feature labels for each second data point. In one embodiment, the twelfth generating module can be used to execute the step S1101 described above and will not be described in detail here.

[0160] The twelfth generating module is used to accumulate the multiple relevant feature labels of each second data point to generate a feature label of each second data point. In one embodiment, the twelfth generating module can be used to execute the step S1102 described above, which will not be described in detail here.

[0161] The fifth determination module is used to screen out d abnormal data points from the c second data points based on the feature label of each second data point, and determine d abnormal business data according to the d abnormal data points. In one embodiment, the fifth determination module can be used to execute step S1103 described above, which will not be repeated here.

[0162] According to an embodiment of the present disclosure, any multiple modules in the first acquisition module 1201, the first generation module 1202 and the first determination module 1203 can be combined into one module for implementation, or any one of the modules can be split into multiple modules. Alternatively, at least part of the functions of one or more of these modules can be combined with at least part of the functions of other modules and implemented in one module. According to an embodiment of the present disclosure, at least one of the first acquisition module 1201, the first generation module 1202 and the first determination module 1203 can be at least partially implemented as a hardware circuit, such as a field programmable gate array (FPGA), a programmable logic array (PLA), a system on a chip, a system on a substrate, a system on a package, an application-specific integrated circuit (ASIC), or can be implemented by hardware or firmware such as any other reasonable way of integrating or packaging the circuit, or implemented in any one of the three implementation methods of software, hardware and firmware or in any appropriate combination of any of them. Alternatively, at least one of the first acquisition module 1201, the first generation module 1202 and the first determination module 1203 can be at least partially implemented as a computer program module, and when the computer program module is run, the corresponding function can be executed.

[0163] Fig.13 A block diagram of an electronic device suitable for implementing the abnormal business data determination method according to an embodiment of the present disclosure is schematically shown.

[0164] like Fig.13 As shown, the electronic device 1300 according to an embodiment of the present disclosure includes a processor 1301, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 1302 or a program loaded from a storage part 1308 into a random access memory (RAM) 1303. The processor 1301 may include, for example, a general-purpose microprocessor (e.g., a CPU), an instruction set processor and / or a related chipset and / or a special-purpose microprocessor (e.g., an application-specific integrated circuit (ASIC)), etc. The processor 1301 may also include an onboard memory for caching purposes. The processor 1301 may include a single processing unit or multiple processing units for performing different actions of the method flow according to an embodiment of the present disclosure.

[0165] In RAM 1303, various programs and data required for the operation of electronic device 1300 are stored. Processor 1301, ROM 1302 and RAM 1303 are connected to each other through bus 1304. Processor 1301 performs various operations of the method flow according to the embodiment of the present disclosure by executing the program in ROM 1302 and / or RAM 1303. It should be noted that the program can also be stored in one or more memories other than ROM 1302 and RAM 1303. Processor 1301 can also perform various operations of the method flow according to the embodiment of the present disclosure by executing the program stored in the one or more memories.

[0166] According to an embodiment of the present disclosure, the electronic device 1300 may further include an input / output (I / O) interface 1305, which is also connected to the bus 1304. The electronic device 1300 may further include one or more of the following components connected to the I / O interface 1305: an input portion 1306 including a keyboard, a mouse, etc.; an output portion 1307 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage portion 1308 including a hard disk, etc.; and a communication portion 1309 including a network interface card such as a LAN card, a modem, etc. The communication portion 1309 performs communication processing via a network such as the Internet. A drive 1310 is also connected to the I / O interface 1305 as needed. A removable medium 1311, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 1310 as needed, so that a computer program read therefrom is installed into the storage portion 1308 as needed.

[0167] The present disclosure also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments; or may exist independently without being assembled into the device / apparatus / system. The above computer-readable storage medium carries one or more programs, and when the above one or more programs are executed, the method according to the embodiment of the present disclosure is implemented.

[0168] According to an embodiment of the present disclosure, a computer-readable storage medium may be a non-volatile computer-readable storage medium, for example, may include but is not limited to: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program, which may be used by or in combination with an instruction execution system, an apparatus, or a device. For example, according to an embodiment of the present disclosure, a computer-readable storage medium may include the ROM 1302 and / or RAM 1303 described above and / or one or more memories other than ROM 1302 and RAM 1303.

[0169] The embodiment of the present disclosure also includes a computer program product, which includes a computer program, and the computer program contains program code for executing the method shown in the flowchart. When the computer program product is run in a computer system, the program code is used to enable the computer system to implement the abnormal business data determination method provided by the embodiment of the present disclosure.

[0170] The above functions defined in the system / device of the embodiment of the present disclosure are performed when the computer program is executed by the processor 1301. According to the embodiment of the present disclosure, the system, device, module, unit, etc. described above can be implemented by a computer program module.

[0171] In one embodiment, the computer program may rely on tangible storage media such as optical storage devices, magnetic storage devices, etc. In another embodiment, the computer program may also be transmitted and distributed in the form of signals on a network medium, and downloaded and installed through the communication part 1309, and / or installed from the removable medium 1311. The program code contained in the computer program may be transmitted using any appropriate network medium, including but not limited to: wireless, wired, etc., or any suitable combination of the above.

[0172] In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 1309, and / or installed from the removable medium 1311. When the computer program is executed by the processor 1301, the above functions defined in the system of the embodiment of the present disclosure are performed. According to the embodiment of the present disclosure, the system, device, apparatus, module, unit, etc. described above can be implemented by a computer program module.

[0173] According to an embodiment of the present disclosure, the program code for executing the computer program provided by the embodiment of the present disclosure can be written in any combination of one or more programming languages. Specifically, these computing programs can be implemented using high-level process and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages ​​include, but are not limited to, Java, C++, python, "C" language or similar programming languages. The program code can be executed entirely on the user computing device, partially on the user device, partially on the remote computing device, or entirely on the remote computing device or server. In the case of a remote computing device, the remote computing device can be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computing device (for example, using an Internet service provider to connect through the Internet).

[0174] The flow charts and block diagrams in the accompanying drawings illustrate the possible architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each box in the flow chart or block diagram can represent a module, a program segment, or a part of a code, and the above-mentioned module, program segment, or a part of a code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flow chart, and the combination of the boxes in the block diagram or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0175] It will be appreciated by those skilled in the art that the features described in the various embodiments and / or claims of the present disclosure may be combined and / or combined in a variety of ways, even if such combinations and / or combinations are not explicitly described in the present disclosure. In particular, the features described in the various embodiments and / or claims of the present disclosure may be combined and / or combined in a variety of ways without departing from the spirit and teachings of the present disclosure. All of these combinations and / or combinations fall within the scope of the present disclosure.

[0176] The embodiments of the present disclosure are described above. However, these embodiments are only for illustrative purposes and are not intended to limit the scope of the present disclosure. Although the embodiments are described above separately, this does not mean that the measures in the various embodiments cannot be used in combination to advantage. The scope of the present disclosure is defined by the attached claims and their equivalents. Without departing from the scope of the present disclosure, those skilled in the art may make a variety of substitutions and modifications, which should all fall within the scope of the present disclosure.

Claims

1. A method for determining abnormal business data, characterized in that: The method includes: Obtain a new business download data, input the a new business download data into a pre-trained and tuned spatial clustering model, and output b non-outlier new business download data points as b first data points, wherein each first data point includes the coordinates of the new business download data point, wherein a is greater than or equal to 2, b is less than or equal to a, and a and b are both positive integers; Importing the coordinates of the b first data points into a pre-generated first density reachable graph to generate a second density reachable graph; and Based on the second density reachable graph, d abnormal data points are screened out from the b first data points, and d abnormal business data are determined according to the d abnormal data points, where d is less than or equal to b and d is a positive integer.

2. The method according to claim 1, characterized in that The first density reachable graph includes: coordinates of outlier points in historical business download data points, and the step of selecting d abnormal data points from b first data points based on the second density reachable graph includes: Acquire the domain radius of the outlier coordinates in the historical business download data points from the second density reachable graph to generate a plurality of first historical data points; Acquire a plurality of first historical data points within a range radius of each first data point from the second density reachable graph, and generate a plurality of second historical data points corresponding to each first data point; Calculating the Euclidean distance between each first data point and a plurality of second historical data points to generate a plurality of first distances for each first data point, wherein the domain radius of each second historical data point generating the first distance with the first data point is different; Obtaining a domain radius of each second historical data point that generates a first distance from the first data point, and generating a plurality of second distances, wherein the second distances and the first distances are mapped into a one-to-one correspondence through the same historical data point; Determine whether there is a second historical data point whose first distance is less than the second distance corresponding to each first data point among the multiple second historical data points corresponding to each first data point, and if there is a second historical data point whose first distance is less than the second distance corresponding to the first data point, obtain c first data points whose first distance is less than the second distance corresponding to the first historical data point, and generate c second data points, where c is less than or equal to b, and c is a positive integer; Acquire a second historical data point whose first distance to each second data point is smaller than its corresponding second distance, and generate a related data point for each second data point; and Based on the related data points of each second data point, d abnormal data points are screened out from the c second data points, where d is less than or equal to c and d is a positive integer.

3. The method according to claim 1, characterized in that The method further includes: Inputting the a newly added service download data into a pre-trained and tuned spatial clustering model, and outputting e outlier newly added service download data points, wherein e is a positive integer, and the sum of d and e is equal to a; and According to the e outlier newly added service download data points, e abnormal service data are determined.

4. The method according to claim 2, characterized in that: The method further includes: Obtain f first data points whose first distance does not exist as a second historical data point less than the second distance corresponding to the first data point, and generate f third data points, where f is less than or equal to b and f is a positive integer; Obtaining the number of second historical data points within the domain radius of each third data point, if the number of second historical data points within the domain radius of the third data point is greater than or equal to a preset threshold, obtaining g third data points whose number of second historical data points within the domain radius is greater than or equal to the preset threshold from the f third data points, and generating g fourth data points, wherein g is less than or equal to f and is a positive integer; and Based on the g fourth data points, g abnormal business data are determined.

5. The method according to claim 4, characterized in that Each of the first historical data points includes a feature tag, and the method further includes: If the number of second historical data points within the domain radius of the third data point is less than a preset threshold, obtaining h third data points whose number of second historical data points within the domain radius is less than the preset threshold from the f third data points, and generating h fifth data points, wherein the sum of h and g is equal to f, and h is a positive integer; and Obtain and accumulate the feature labels of the second historical data points within the radius of each fifth data point, filter out i abnormal data points from h second data points, and determine i abnormal business data based on the i abnormal data points, where i is less than or equal to h and i is a positive integer.

6. The method according to claim 1, characterized in that Fine-tune a pre-trained spatial clustering model, including: Based on a newly added business download data, the pre-trained spatial clustering model is optimized by grid search method to generate an optimized spatial clustering model, wherein the optimal parameters include: domain radius.

7. The method according to any one of claims 1 to 6, characterized in that: in, Each of the first data points includes a domain radius of the batch of newly added service download data points, and the pre-generated first density reachable graph includes: Acquire multiple batches of historical new business download data, wherein each batch of historical new business download data includes coordinates of multiple business download data points, the coordinates of multiple business download data points in the same batch of historical new business download data have the same field radius, and the coordinates of multiple business download data points in different batches of historical new business download data have the same field radius; and The multiple batches of historical newly added business download data are imported into the same coordinate graph to generate a first density reachable graph.

8. The method according to claim 2, characterized in that: Each of the first historical data points includes a feature label, and based on the related data points of each second data point, d abnormal data points are screened out from c second data points, including: Acquire feature labels of data points related to each second data point, and generate multiple related feature labels for each second data point; Accumulating a plurality of relevant feature labels of each second data point to generate a feature label of each second data point; and Based on the feature label of each second data point, d abnormal data points are screened out from the c second data points.

9. An abnormal business data determination device, characterized in that: The device includes: A first acquisition module is used to acquire a new service download data, input the a new service download data into a pre-trained and tuned spatial clustering model, and output b non-outlier new service download data points as b first data points, wherein each first data point includes the coordinates of the new service download data point, wherein a is greater than or equal to 2, b is less than or equal to a, and both a and b are positive integers; A first generating module, configured to import the coordinates of the b first data points into a pre-generated first density reachable graph to generate a second density reachable graph; and The first determination module is used to screen out d abnormal data points from b first data points based on the second density reachable graph, and determine d abnormal business data according to the d abnormal data points, wherein d is less than or equal to b and d is a positive integer.

10. An electronic device comprising: one or more processors; a storage device for storing one or more computer programs, The method is characterized in that the one or more processors execute the one or more computer programs to implement the steps of the method according to any one of claims 1 to 8.

11. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 8 are implemented.

12. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 8 are implemented.

Images