Clearing data anomaly detection method, device and equipment and medium

Abstract

The invention relates to the technical field of data processing, and provides a clearing data anomaly detection method, device and equipment and a medium, anomaly detection can be performed on target clearing data by using an anomaly detection model trained based on a Deep-SVDD model, and due to the fact that the Deep-SVDD model has relatively high feature extraction capability on high-dimensional complex data, the clearing data anomaly detection efficiency is improved. Therefore, the abnormal detection efficiency and accuracy of the liquidation data can be effectively improved, and meanwhile, the score threshold is configured and periodically updated, so that the change of data distribution in different scenes can be effectively adapted, and the situation that the detection accuracy is reduced due to the fact that the model adopts the fixed score threshold when the data distribution changes is avoided.

Description

Technical Field

[0001] The present invention relates to the field of data processing technology, and in particular to a method, device, equipment and medium for detecting anomalies in clearing data. Background Art

[0002] Currently, the demand for anomaly detection of large amounts of high-dimensional data is growing in the financial field.

[0003] In the prior art, traditional rule engines and static threshold methods are usually used to detect anomalies in clearing data. However, traditional rule engines and static threshold methods are difficult to adapt to complex and dynamic data distribution, and their ability to identify anomalies in unknown patterns is also weak. Summary of the invention

[0004] In view of the above, it is necessary to provide a method, device, equipment and medium for detecting anomalies in clearing data, aiming to solve the problem of being unable to effectively detect clearing data.

[0005] A method for detecting anomalies in clearing data, the method comprising: Obtaining historical liquidation data, and using the historical liquidation data to train a Deep-SVDD model to obtain an anomaly detection model; In response to an anomaly detection instruction for target liquidation data, input the target liquidation data into the anomaly detection model for processing to obtain an anomaly score for the target liquidation data; Get the current score threshold that is pre-configured and updated regularly; Comparing the abnormal score with the current score threshold to obtain a comparison result; An abnormality detection result of the target clearing data is generated according to the comparison result.

[0006] According to a preferred embodiment of the present invention, the using of the historical clearing data to train the Deep-SVDD model to obtain the anomaly detection model includes: Cleaning the historical liquidation data to obtain data to be processed; Performing consistency check on the column names of the data to be processed; When the column name of the data to be processed passes the consistency check, constructing a training sample according to the data to be processed; Mapping the training samples to a low-dimensional feature space using the Deep-SVDD model to describe data boundaries of the training samples in the low-dimensional feature space; When all training samples have completed mapping, the currently obtained model is determined as the anomaly detection model.

[0007] According to a preferred embodiment of the present invention, inputting the target liquidation data into the anomaly detection model for processing to obtain an anomaly score for the target liquidation data includes: Mapping the target liquidation data to a low-dimensional feature space through the anomaly detection model to obtain data points of the target liquidation data in the low-dimensional feature space; Determine the center point and radius of the training sample according to the data boundary of the training sample in the low-dimensional feature space; Calculate the distance from the data point to the center point to obtain the target distance; When the target distance is greater than the radius, a difference between the target distance and the radius is calculated as the abnormality score.

[0008] According to a preferred embodiment of the present invention, before obtaining the current scoring threshold that is pre-configured and regularly updated, the method further includes: Calculate the distance from each training sample to the center point, and calculate the maximum difference between each distance and the radius; The maximum difference is determined as an initial scoring threshold.

[0009] According to a preferred embodiment of the present invention, after determining the maximum difference as the initial scoring threshold, the method further includes: Get new clearing data at preset time intervals; Calculate the false positive rate and missed positive rate of the newly added clearing data; When the false detection rate is greater than the configured false detection rate, and / or the missed detection rate is less than the configured missed detection rate, an instruction to update the currently used scoring threshold is triggered.

[0010] According to a preferred embodiment of the present invention, after triggering the instruction to update the currently used scoring threshold, the method further includes: When the false detection rate is greater than the configured false detection rate, continuously increasing the currently used scoring threshold according to a first preset step size until the false detection rate is less than or equal to the configured false detection rate, and determining the currently obtained scoring threshold as the updated scoring threshold; or When the missed detection rate is less than the configured missed detection rate, continuously reducing the currently used scoring threshold according to a second preset step size until the missed detection rate is greater than or equal to the configured missed detection rate, and determining the currently obtained scoring threshold as the updated scoring threshold; or When the false detection rate is greater than the configured false detection rate and the missed detection rate is less than the configured missed detection rate, the currently used scoring threshold is continuously adjusted according to a third preset step size until the false detection rate and the missed detection rate reach a balance, and the currently obtained scoring threshold is determined as the updated scoring threshold.

[0011] According to a preferred embodiment of the present invention, generating an abnormality detection result of the target liquidation data according to the comparison result includes: When the comparison result is that the abnormality score is greater than the current score threshold, determining that the abnormality detection result is that the target clearing data is abnormal; or When the comparison result is that the abnormality score is less than or equal to the current score threshold, it is determined that the abnormality detection result is that the target clearing data has no abnormality.

[0012] A clearing data anomaly detection device, the clearing data anomaly detection device comprising: A training unit, used to obtain historical liquidation data, and use the historical liquidation data to train a Deep-SVDD model to obtain an anomaly detection model; a processing unit, configured to, in response to an instruction for detecting anomalies of target liquidation data, input the target liquidation data into the anomaly detection model for processing to obtain an anomaly score of the target liquidation data; An acquisition unit, used to acquire a current scoring threshold value that is pre-configured and regularly updated; A comparison unit, used to compare the abnormality score with the current score threshold to obtain a comparison result; A generating unit is used to generate an abnormality detection result of the target clearing data according to the comparison result.

[0013] A computer device, comprising: a memory storing at least one instruction; and A processor executes instructions stored in the memory to implement the clearing data anomaly detection method.

[0014] A computer-readable storage medium stores at least one instruction, and the at least one instruction is executed by a processor in a computer device to implement the clearing data anomaly detection method.

[0015] It can be seen from the above technical solutions that the present invention can use the anomaly detection model trained based on the Deep-SVDD model to perform anomaly detection on the target clearing data. Since the Deep-SVDD model has a strong feature extraction capability for high-dimensional complex data, it can effectively improve the efficiency and accuracy of anomaly detection on clearing data. At the same time, the scoring threshold is configured and regularly updated, so as to effectively adapt to changes in data distribution in different scenarios, and avoid the model using a fixed scoring threshold when the data distribution changes, thereby reducing the detection accuracy. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Figure 1 It is a flow chart of a preferred embodiment of the method for detecting anomalies in clearing data of the present invention; Figure 2 It is a functional module diagram of a preferred embodiment of the clearing data anomaly detection device of the present invention; Figure 3 It is a structural schematic diagram of a computer device of a preferred embodiment of the liquidation data anomaly detection method of the present invention. DETAILED DESCRIPTION

[0017] In order to make the purpose, technical solutions and advantages of the present invention more clear, the present invention is described in detail below with reference to the accompanying drawings and specific embodiments.

[0018] like Figure 1 FIG. 1 is a flow chart of a preferred embodiment of the method for detecting anomalies in clearing data of the present invention. According to different requirements, the order of the steps in the flow chart can be changed, and some steps can be omitted.

[0019] The clearing data anomaly detection method is applied to one or more computer devices, and the computer device is a device that can automatically perform numerical calculations and / or information processing according to pre-set or stored instructions, and its hardware includes but is not limited to microprocessors, application specific integrated circuits (Application Specific Integrated Circuit, ASIC), programmable gate arrays (Field-Programmable Gate Array, FPGA), digital processors (Digital Signal Processor, DSP), embedded devices, etc.

[0020] The computer device may be any electronic product that can perform human-computer interaction with a user, such as a personal computer, a tablet computer, a smart phone, a personal digital assistant (PDA), a game console, an interactive network television (IPTV), a smart wearable device, etc.

[0021] The computer device may also include a network device and / or a user device, wherein the network device includes, but is not limited to, a single network server, a server group consisting of multiple network servers, or a cloud consisting of a large number of hosts or network servers based on cloud computing.

[0022] The server can be an independent server or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, content delivery networks (CDN), as well as big data and artificial intelligence platforms.

[0023] Among them, Artificial Intelligence (AI) is the theory, method, technology and application system that uses digital computers or machines controlled by digital computers to simulate, extend and expand human intelligence, perceive the environment, acquire knowledge and use knowledge to obtain the best results.

[0024] AI basic technologies generally include sensors, dedicated AI chips, cloud computing, distributed storage, big data processing technology, operation / interaction systems, mechatronics, etc. AI software technologies mainly include computer vision technology, robotics technology, biometrics technology, speech processing technology, natural language processing technology, and machine learning / deep learning.

[0025] The network where the computer device is located includes but is not limited to the Internet, a wide area network, a metropolitan area network, a local area network, a virtual private network (VPN), etc.

[0026] S10, obtaining historical liquidation data, and using the historical liquidation data to train a Deep-SVDD (Deep Support Vector Data Description) model to obtain an anomaly detection model.

[0027] In this embodiment, the historical settlement data can be obtained from a designated trading system.

[0028] In this embodiment, the use of the historical clearing data to train the Deep-SVDD model to obtain the anomaly detection model includes: Cleaning the historical liquidation data to obtain data to be processed; Performing consistency check on the column names of the data to be processed; When the column name of the data to be processed passes the consistency check, constructing a training sample according to the data to be processed; Mapping the training samples to a low-dimensional feature space using the Deep-SVDD model to describe data boundaries of the training samples in the low-dimensional feature space; When all training samples have completed mapping, the currently obtained model is determined as the anomaly detection model.

[0029] The historical settlement data may include data formats such as CSV, Excel, and message data.

[0030] Among them, by cleaning the historical liquidation data, all empty columns and rows containing missing values ​​can be removed to ensure data integrity. At the same time, only numerical features can be retained and non-numerical fields can be removed for use in subsequent model training.

[0031] Among them, by performing consistency check on the column name of each data file, the consistency of the model input data format can be ensured.

[0032] By describing the data boundaries of the training samples in the low-dimensional feature space, the distribution characteristics of normal data can be learned.

[0033] S11, in response to an anomaly detection instruction for target liquidation data, inputting the target liquidation data into the anomaly detection model for processing to obtain an anomaly score for the target liquidation data.

[0034] In this embodiment, the anomaly detection instruction may be automatically triggered when data is detected to be uploaded to a designated interactive interface, or may be triggered by a person responsible for clearing data anomaly detection.

[0035] In this embodiment, the inputting the target liquidation data into the anomaly detection model for processing to obtain an anomaly score of the target liquidation data includes: Mapping the target liquidation data to a low-dimensional feature space through the anomaly detection model to obtain data points of the target liquidation data in the low-dimensional feature space; Determine the center point and radius of the training sample according to the data boundary of the training sample in the low-dimensional feature space; Calculate the distance from the data point to the center point to obtain the target distance; When the target distance is greater than the radius, a difference between the target distance and the radius is calculated as the abnormality score.

[0036] Theoretically, all points beyond the data boundary are abnormal points. Therefore, when the distance between a data point and the center point is greater than the radius, it means that the data point exceeds the data boundary and may be abnormal data. Therefore, the difference between the target distance and the radius is calculated as the abnormality score. The larger the difference, the more likely it is to be judged as abnormal data, thereby combining artificial intelligence means to achieve effective detection of abnormal data.

[0037] S12, obtaining a current scoring threshold that is pre-configured and regularly updated.

[0038] In this embodiment, before obtaining the current scoring threshold that is pre-configured and regularly updated, the method further includes: Calculate the distance from each training sample to the center point, and calculate the maximum difference between each distance and the radius; The maximum difference is determined as an initial scoring threshold.

[0039] In the above embodiment, the maximum distance between the data point and the radius is used as the initial scoring threshold for reference in subsequent anomaly detection.

[0040] In this embodiment, after determining the maximum difference as the initial scoring threshold, the method further includes: Get new clearing data at preset time intervals; Calculate the false positive rate and missed positive rate of the newly added clearing data; When the false detection rate is greater than the configured false detection rate, and / or the missed detection rate is less than the configured missed detection rate, an instruction to update the currently used scoring threshold is triggered.

[0041] The preset time interval may be comprehensively configured according to the detection accuracy and detection frequency of abnormal data in actual scenarios.

[0042] The false positive rate refers to the proportion of qualified products that are mistakenly judged as unqualified products during the detection process. The lower the false positive rate, the more accurately the detection system can distinguish qualified products from unqualified products.

[0043] The missed detection rate refers to the proportion of unqualified products that are mistakenly judged as qualified products during the detection process. The lower the missed detection rate, the more likely the detection system is to find existing problems.

[0044] In this embodiment, after the instruction to update the currently used scoring threshold is triggered, the method further includes: When the false detection rate is greater than the configured false detection rate, continuously increasing the currently used scoring threshold according to a first preset step size until the false detection rate is less than or equal to the configured false detection rate, and determining the currently obtained scoring threshold as the updated scoring threshold; or When the missed detection rate is less than the configured missed detection rate, continuously reducing the currently used scoring threshold according to a second preset step size until the missed detection rate is greater than or equal to the configured missed detection rate, and determining the currently obtained scoring threshold as the updated scoring threshold; or When the false detection rate is greater than the configured false detection rate and the missed detection rate is less than the configured missed detection rate, the currently used scoring threshold is continuously adjusted according to a third preset step size until the false detection rate and the missed detection rate reach a balance, and the currently obtained scoring threshold is determined as the updated scoring threshold.

[0045] The first preset step length, the second preset step length, and the third preset step length can be obtained based on experiments.

[0046] Through the above embodiments, the two errors are eliminated as much as possible, or a balance is achieved between the two errors, so as to optimize the detection effect of the anomaly detection model.

[0047] S13, comparing the abnormality score with the current score threshold to obtain a comparison result.

[0048] In this embodiment, by comparing the abnormal score with the current score threshold, it can be determined whether the abnormal score exceeds a reasonable range, thereby further determining whether the corresponding liquidation data is abnormal.

[0049] S14, generating an abnormality detection result of the target liquidation data according to the comparison result.

[0050] In this embodiment, generating the abnormality detection result of the target liquidation data according to the comparison result includes: When the comparison result is that the abnormality score is greater than the current score threshold, determining that the abnormality detection result is that the target clearing data is abnormal; or When the comparison result is that the abnormality score is less than or equal to the current score threshold, it is determined that the abnormality detection result is that the target clearing data has no abnormality.

[0051] In the above embodiment, the liquidation data can be combined with the dynamically adjusted scoring threshold to detect whether it is abnormal, making the abnormality detection result more accurate. In addition, the Deep-SVDD model has a strong processing ability for high-dimensional complex data, which can further ensure the processing efficiency and accuracy of liquidation data abnormality detection.

[0052] It can be seen from the above technical solutions that the present invention can use the anomaly detection model trained based on the Deep-SVDD model to perform anomaly detection on the target clearing data. Since the Deep-SVDD model has a strong feature extraction capability for high-dimensional complex data, it can effectively improve the efficiency and accuracy of anomaly detection on clearing data. At the same time, the scoring threshold is configured and regularly updated, so as to effectively adapt to changes in data distribution in different scenarios, and avoid the model using a fixed scoring threshold when the data distribution changes, thereby reducing the detection accuracy.

[0053] like Figure 2, which is a functional module diagram of a preferred embodiment of the clearing data anomaly detection device of the present invention. The clearing data anomaly detection device 11 includes a training unit 110, a processing unit 111, an acquisition unit 112, a comparison unit 113, and a generation unit 114. The module / unit referred to in the present invention refers to a series of computer program segments that can be executed by a processor and can perform fixed functions, which are stored in a memory. In this embodiment, the functions of each module / unit will be described in detail in subsequent embodiments.

[0054] The training unit 110 is used to obtain historical clearing data and train the Deep-SVDD model using the historical clearing data to obtain an anomaly detection model; The processing unit 111 is used for inputting the target liquidation data into the anomaly detection model for processing in response to an anomaly detection instruction for the target liquidation data to obtain an anomaly score for the target liquidation data; The acquisition unit 112 is used to acquire a current scoring threshold that is pre-configured and regularly updated; The comparison unit 113 is used to compare the abnormality score with the current score threshold to obtain a comparison result; The generating unit 114 is configured to generate an abnormality detection result of the target liquidation data according to the comparison result.

[0055] It can be seen from the above technical solutions that the present invention can use the anomaly detection model trained based on the Deep-SVDD model to perform anomaly detection on the target clearing data. Since the Deep-SVDD model has a strong feature extraction capability for high-dimensional complex data, it can effectively improve the efficiency and accuracy of anomaly detection on clearing data. At the same time, the scoring threshold is configured and regularly updated, so as to effectively adapt to changes in data distribution in different scenarios, and avoid the model using a fixed scoring threshold when the data distribution changes, thereby reducing the detection accuracy.

[0056] like Figure 3 The figure is a schematic diagram of the structure of a computer device of a preferred embodiment of the method for detecting anomalies in clearing data according to the present invention.

[0057] The computer device 1 may include a memory 12, a processor 13 and a bus, and may also include a computer program stored in the memory 12 and executable on the processor 13, such as a clearing data anomaly detection program.

[0058] Those skilled in the art will appreciate that the schematic diagram is merely an example of the computer device 1 and does not constitute a limitation on the computer device 1. The computer device 1 may be a bus-type structure or a star-type structure. The computer device 1 may also include more or less other hardware or software than shown in the diagram, or a different arrangement of components. For example, the computer device 1 may also include input and output devices, network access devices, etc.

[0059] It should be noted that the computer device 1 is only an example, and other existing or future electronic products that are suitable for the present invention should also be included in the protection scope of the present invention and included here by reference.

[0060] Among them, the memory 12 includes at least one type of readable storage medium, and the readable storage medium includes flash memory, mobile hard disk, multimedia card, card-type memory (for example: SD or DX memory, etc.), magnetic memory, disk, optical disk, etc. In some embodiments, the memory 12 can be an internal storage unit of the computer device 1, such as a mobile hard disk of the computer device 1. In other embodiments, the memory 12 can also be an external storage device of the computer device 1, such as a plug-in mobile hard disk, a smart memory card (Smart Media Card, SMC), a secure digital (SecureDigital, SD) card, a flash card (Flash Card), etc. equipped on the computer device 1. Further, the memory 12 can also include both an internal storage unit of the computer device 1 and an external storage device. The memory 12 can not only be used to store application software and various types of data installed in the computer device 1, such as the code of the clearing data anomaly detection program, etc., but also can be used to temporarily store data that has been output or is to be output.

[0061] In some embodiments, the processor 13 may be composed of an integrated circuit, for example, a single packaged integrated circuit, or a plurality of packaged integrated circuits with the same or different functions, including one or more central processing units (CPUs), microprocessors, digital processing chips, graphics processors, and combinations of various control chips. The processor 13 is the control core (Control Unit) of the computer device 1, and uses various interfaces and lines to connect various components of the entire computer device 1, and executes various functions and processes data of the computer device 1 by running or executing programs or modules stored in the memory 12 (for example, executing a clearing data anomaly detection program, etc.), and calling data stored in the memory 12.

[0062] The processor 13 executes the operating system of the computer device 1 and various installed applications. The processor 13 executes the applications to implement the steps in the above-mentioned embodiments of the clearing data anomaly detection method, for example Figure 1 Steps shown.

[0063] Exemplarily, the computer program may be divided into one or more modules / units, which are stored in the memory 12 and executed by the processor 13 to complete the present invention. The one or more modules / units may be a series of computer-readable instruction segments capable of completing specific functions, which are used to describe the execution process of the computer program in the computer device 1. For example, the computer program may be divided into a training unit 110, a processing unit 111, an acquisition unit 112, a comparison unit 113, and a generation unit 114.

[0064] The above-mentioned integrated unit implemented in the form of a software function module can be stored in a computer-readable storage medium. The above-mentioned software function module is stored in a storage medium, and includes a number of instructions for enabling a computer device (which can be a personal computer, a computer device, or a network device, etc.) or a processor to execute a part of the clearing data anomaly detection method described in each embodiment of the present invention.

[0065] If the module / unit integrated in the computer device 1 is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the present invention implements all or part of the processes in the above-mentioned embodiment method, and can also be completed by instructing the relevant hardware devices through a computer program. The computer program can be stored in a computer-readable storage medium, and when the computer program is executed by a processor, the steps of each of the above-mentioned method embodiments can be implemented.

[0066] The computer program includes computer program code, which may be in source code form, object code form, executable file or some intermediate form, etc. The computer readable medium may include: any entity or device capable of carrying the computer program code, recording medium, USB flash drive, mobile hard disk, magnetic disk, optical disk, computer memory, read-only memory (ROM), random access memory, etc.

[0067] Furthermore, the computer-readable storage medium may mainly include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application required for at least one function, etc.; the data storage area may store data created according to the use of the blockchain node, etc.

[0068] The blockchain referred to in this invention is a new application model of computer technologies such as distributed data storage, peer-to-peer transmission, consensus mechanism, encryption algorithm, etc. Blockchain is essentially a decentralized database, a string of data blocks generated by cryptographic methods. Each data block contains a batch of network transaction information, which is used to verify the validity of its information (anti-counterfeiting) and generate the next block. Blockchain can include the blockchain underlying platform, platform product service layer, and application service layer.

[0069] The bus can be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus. The bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 3 The bus is represented by only one straight line, but it does not mean that there is only one bus or one type of bus. The bus is configured to realize the connection and communication between the memory 12 and at least one processor 13, etc.

[0070] Although not shown, the computer device 1 may also include a power source (such as a battery) for supplying power to various components. Preferably, the power source may be logically connected to the at least one processor 13 through a power management device, so that the power management device can realize functions such as charging management, discharging management, and power consumption management. The power source may also include any components such as one or more DC or AC power sources, recharging devices, power failure detection circuits, power converters or inverters, and power status indicators. The computer device 1 may also include a variety of sensors, Bluetooth modules, Wi-Fi modules, etc., which will not be repeated here.

[0071] Furthermore, the computer device 1 may also include a network interface. Optionally, the network interface may include a wired interface and / or a wireless interface (such as a WI-FI interface, a Bluetooth interface, etc.), which is usually used to establish a communication connection between the computer device 1 and other computer devices.

[0072] Optionally, the computer device 1 may further include a user interface, which may be a display, an input unit (such as a keyboard), or a standard wired interface or a wireless interface. Optionally, in some embodiments, the display may be an LED display, a liquid crystal display, a touch-sensitive liquid crystal display, and an OLED (Organic Light-Emitting Diode) touch device. The display may also be appropriately referred to as a display screen or a display unit, which is used to display information processed in the computer device 1 and to display a visual user interface.

[0073] It should be understood that the embodiment is for illustration only and the scope of the patent application is not limited to this structure.

[0074] It can be understood by those skilled in the art that Figure 3 The structure shown does not constitute a limitation on the computer device 1, and may include fewer or more components than shown in the figure, or combine certain components, or arrange the components differently.

[0075] Combination Figure 1 , the memory 12 in the computer device 1 stores a plurality of instructions to implement a clearing data anomaly detection method, and the processor 13 can execute the plurality of instructions to implement: Obtaining historical liquidation data, and using the historical liquidation data to train a Deep-SVDD model to obtain an anomaly detection model; In response to an anomaly detection instruction for target liquidation data, input the target liquidation data into the anomaly detection model for processing to obtain an anomaly score for the target liquidation data; Get the current score threshold that is pre-configured and updated regularly; Comparing the abnormal score with the current score threshold to obtain a comparison result; An abnormality detection result of the target clearing data is generated according to the comparison result.

[0076] Specifically, the specific implementation method of the processor 13 for the above instructions can refer to Figure 1 The description of the relevant steps in the corresponding embodiments will not be repeated here.

[0077] It should be noted that the data involved in this case were all obtained legally.

[0078] In the several embodiments provided by the present invention, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only illustrative, for example, the division of the modules is only a logical function division, and there may be other division methods in actual implementation.

[0079] The present invention can be used in many general or special computer system environments or configurations. For example: personal computers, server computers, handheld or portable devices, tablet devices, multiprocessor systems, microprocessor-based systems, set-top boxes, programmable consumer electronic devices, network PCs, minicomputers, mainframe computers, distributed computing environments including any of the above systems or devices, etc. The present invention can be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform specific tasks or implement specific abstract data types. The present invention can also be practiced in distributed computing environments, in which tasks are performed by remote processing devices connected through a communication network. In a distributed computing environment, program modules can be located in local and remote computer storage media including storage devices.

[0080] The modules described as separate components may or may not be physically separated, and the components shown as modules may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0081] In addition, each functional module in each embodiment of the present invention may be integrated into one processing unit, each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of hardware plus software functional modules.

[0082] It is obvious to those skilled in the art that the present invention is not limited to the details of the above exemplary embodiments, and that the present invention can be implemented in other specific forms without departing from the spirit or essential characteristics of the present invention.

[0083] Therefore, no matter from which point of view, the embodiments should be regarded as illustrative and non-restrictive, and the scope of the present invention is limited by the appended claims rather than the above description, so it is intended that all changes falling within the meaning and scope of the equivalent elements of the claims are included in the present invention. Any attached figure mark in the claims should not be regarded as limiting the claims involved.

[0084] In addition, it is clear that the word "comprising" does not exclude other units or steps, and the singular does not exclude the plural. Multiple units or devices stated in the present invention can also be implemented by one unit or device through software or hardware. The words first, second, etc. are used to indicate names, and do not indicate any particular order.

[0085] Finally, it should be noted that the above embodiments are only used to illustrate the technical solution of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solution of the present invention can be modified or replaced by equivalents without departing from the spirit and scope of the technical solution of the present invention.

Claims

1. A method for detecting anomalies in clearing data, characterized in that: The clearing data anomaly detection method comprises: Obtaining historical liquidation data, and using the historical liquidation data to train a Deep-SVDD model to obtain an anomaly detection model; In response to an anomaly detection instruction for target liquidation data, input the target liquidation data into the anomaly detection model for processing to obtain an anomaly score for the target liquidation data; Get the current score threshold that is pre-configured and updated regularly; Comparing the abnormal score with the current score threshold to obtain a comparison result; An abnormality detection result of the target clearing data is generated according to the comparison result.

2. The method for detecting anomalies in clearing data according to claim 1, characterized in that: The using of the historical clearing data to train the Deep-SVDD model to obtain an anomaly detection model includes: Cleaning the historical liquidation data to obtain data to be processed; Performing consistency check on the column names of the data to be processed; When the column name of the data to be processed passes the consistency check, constructing a training sample according to the data to be processed; Mapping the training samples to a low-dimensional feature space using the Deep-SVDD model to describe data boundaries of the training samples in the low-dimensional feature space; When all training samples have completed mapping, the currently obtained model is determined as the anomaly detection model.

3. The method for detecting anomalies in clearing data according to claim 2, characterized in that: Inputting the target liquidation data into the anomaly detection model for processing to obtain an anomaly score for the target liquidation data includes: Mapping the target liquidation data to a low-dimensional feature space through the anomaly detection model to obtain data points of the target liquidation data in the low-dimensional feature space; Determine the center point and radius of the training sample according to the data boundary of the training sample in the low-dimensional feature space; Calculate the distance from the data point to the center point to obtain the target distance; When the target distance is greater than the radius, a difference between the target distance and the radius is calculated as the abnormality score.

4. The method for detecting anomalies in clearing data according to claim 3, characterized in that: Before obtaining the current scoring threshold value that is pre-configured and regularly updated, the method further includes: Calculate the distance from each training sample to the center point, and calculate the maximum difference between each distance and the radius; The maximum difference is determined as an initial scoring threshold.

5. The method for detecting anomalies in clearing data according to claim 4, characterized in that: After determining the maximum difference as the initial scoring threshold, the method further includes: Get new clearing data at preset time intervals; Calculate the false positive rate and missed positive rate of the newly added clearing data; When the false detection rate is greater than the configured false detection rate, and / or the missed detection rate is less than the configured missed detection rate, an instruction to update the currently used scoring threshold is triggered.

6. The method for detecting anomalies in clearing data according to claim 5, characterized in that: After triggering the update instruction of the currently used scoring threshold, the method further includes: When the false detection rate is greater than the configured false detection rate, continuously increasing the currently used scoring threshold according to a first preset step size until the false detection rate is less than or equal to the configured false detection rate, and determining the currently obtained scoring threshold as the updated scoring threshold; or When the missed detection rate is less than the configured missed detection rate, continuously reducing the currently used scoring threshold according to a second preset step size until the missed detection rate is greater than or equal to the configured missed detection rate, and determining the currently obtained scoring threshold as the updated scoring threshold; or When the false detection rate is greater than the configured false detection rate and the missed detection rate is less than the configured missed detection rate, the currently used scoring threshold is continuously adjusted according to a third preset step size until the false detection rate and the missed detection rate reach a balance, and the currently obtained scoring threshold is determined as the updated scoring threshold.

7. The method for detecting anomalies in clearing data according to claim 1, characterized in that: Generating the abnormality detection result of the target liquidation data according to the comparison result includes: When the comparison result is that the abnormality score is greater than the current score threshold, determining that the abnormality detection result is that the target clearing data is abnormal; or When the comparison result is that the abnormality score is less than or equal to the current score threshold, it is determined that the abnormality detection result is that the target clearing data has no abnormality.

8. A clearing data anomaly detection device, characterized in that: The clearing data anomaly detection device comprises: A training unit, used to obtain historical liquidation data, and use the historical liquidation data to train a Deep-SVDD model to obtain an anomaly detection model; a processing unit, configured to, in response to an instruction for detecting anomalies of target liquidation data, input the target liquidation data into the anomaly detection model for processing to obtain an anomaly score of the target liquidation data; An acquisition unit, used to acquire a current scoring threshold value that is pre-configured and regularly updated; A comparison unit, used to compare the abnormality score with the current score threshold to obtain a comparison result; A generating unit is used to generate an abnormality detection result of the target clearing data according to the comparison result.

9. A computer device, characterized in that: The computer device comprises: a memory storing at least one instruction; and A processor executes instructions stored in the memory to implement the clearing data anomaly detection method as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores at least one instruction, and the at least one instruction is executed by a processor in a computer device to implement the clearing data anomaly detection method as described in any one of claims 1 to 7.

Images