Business log information processing method based on artificial intelligence and server

Abstract

The embodiment of the invention relates to the technical field of data analysis, and particularly provides a service log information processing method based on artificial intelligence and a server, and the embodiment of the invention obtains an identification report by identifying an e-commerce service interaction event, and can comprehensively sort service activity conditions in a target application program log. The generation of the abnormal mode attribute information is helpful for accurately positioning interaction events which may have risks or do not conform to a normal process, such as finding abnormal ordering amount or login behavior and the like. The extraction of the interaction event association attribute information can deeply mine the internal relationship between the events, such as the association between ordering and payment abnormity. Based on the information, matching with historical logs is judged, whether the current log condition is a new problem or not can be quickly determined, the efficiency of monitoring the e-commerce business is improved, the problems such as malicious operation and business process vulnerabilities are found in time, and safe, stable and efficient operation of the e-commerce business is guaranteed.

Description

Technical Field

[0001] The embodiments of the present invention relate to the field of data analysis technology, and in particular to a business log information processing method and server based on artificial intelligence. Background Art

[0002] With the rapid development of e-commerce business, e-commerce platforms generate massive amounts of application logs every day. Traditional log processing methods make it difficult to quickly and effectively obtain valuable information from complex log data. Due to the lack of detailed identification and in-depth analysis of e-commerce business interaction events, it is impossible to accurately judge abnormal situations in business processes. For example, new malicious attack methods cannot be detected in time, such as abnormal login and ordering behaviors, and it is difficult to discover potential loopholes in business processes, such as the mismatch between order amounts and product values. At the same time, when faced with a large amount of log data, it is impossible to efficiently judge whether the current situation is a new problem, resulting in low efficiency in risk prevention and problem troubleshooting. Summary of the invention

[0003] The embodiments of the present invention at least provide a business log information processing method and server based on artificial intelligence.

[0004] An embodiment of the present invention provides a business log information processing method based on artificial intelligence, which is applied to a business log information processing server, and the method includes: identifying each e-commerce business interaction event contained in a target application log to obtain an interaction event identification report; generating abnormal pattern attribute information of each e-commerce business interaction event based on the interaction event identification report; extracting business association tags between each e-commerce business interaction event contained in the target application log based on the abnormal pattern attribute information of each e-commerce business interaction event to obtain interaction event association attribute information; based on the abnormal pattern attribute information and the interaction event association attribute information, determining whether the target application log matches a historical application log in an application log pool.

[0005] An embodiment of the present invention further provides a business log information processing server, comprising a processor and a memory; the processor and the memory are communicatively connected, and the processor is used to read a computer program from the memory and execute it to implement the above method.

[0006] An embodiment of the present invention further provides a computer-readable storage medium on which a computer program is stored. The computer program implements the above method when running.

[0007] The technical solution provided by the embodiment of the present invention may include the following beneficial effects: by identifying e-commerce business interaction events to obtain identification reports, the business activities in the target application log can be comprehensively sorted out. Generating abnormal pattern attribute information helps to accurately locate interaction events that may be risky or not in line with normal processes, such as discovering abnormal order amounts or login behaviors. Extracting the associated attribute information of interaction events can deeply explore the intrinsic connections between events, such as the association between ordering and payment anomalies. Based on this information, the matching with historical logs can be judged to quickly determine whether the current log situation is a new problem, improve the efficiency of monitoring e-commerce business, and promptly discover problems such as malicious operations and business process loopholes to ensure the safe, stable and efficient operation of e-commerce business.

[0008] For a description of the effects of the above-mentioned business log information processing server and computer-readable storage medium, please refer to the description of the above-mentioned method.

[0009] In order to make the above-mentioned purposes, features and advantages of the embodiments of the present invention more obvious and easy to understand, preferred embodiments are specifically cited below and described in detail with reference to the attached drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0010] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for use in the embodiments. The drawings herein are incorporated into the specification and constitute a part of the specification. These drawings illustrate the technical solutions of the embodiments of the present invention and are used together with the specification to illustrate the embodiments of the present invention. It should be understood that the following drawings only illustrate certain embodiments of the embodiments of the present invention and should not be regarded as limiting the scope. For ordinary technicians in this field, other relevant drawings can be obtained based on these drawings without creative work.

[0011] Figure 1 It is a block diagram of a service log information processing server shown in an embodiment of the present invention.

[0012] Figure 2 It is a flowchart of a business log information processing method based on artificial intelligence shown in an embodiment of the present invention. DETAILED DESCRIPTION

[0013] Here, exemplary embodiments will be described in detail, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The implementations described in the following exemplary embodiments do not represent all implementations consistent with the embodiments of the present invention. Instead, they are only examples of devices and methods consistent with some aspects of the embodiments of the present invention.

[0014] Figure 1The structural diagram of the business log information processing server 10 provided in the embodiment of the present invention includes a processor 102, a memory 104, and a bus 106. Among them, the memory 104 is used to store execution instructions, including a memory and an external memory. The memory can also be understood as an internal memory, which is used to temporarily store the operation data in the processor 102 and the data exchanged with the external memory such as the hard disk. The processor 102 exchanges data with the external memory through the memory. When the business log information processing server 10 is running, the processor 102 communicates with the memory 104 through the bus 106, so that the processor 102 executes the business log information processing method based on artificial intelligence in the embodiment of the present invention.

[0015] Please combine Figure 2 , Figure 2 It is a flow chart of a business log information processing method based on artificial intelligence provided by an embodiment of the present invention, which is applied to a business log information processing server. The method may exemplarily include S101-S104.

[0016] S101: The business log information processing server identifies each e-commerce business interaction event contained in the target application log and obtains an interaction event identification report.

[0017] First, in step S101, the business log information processing server needs to identify each e-commerce business interaction event contained in the target application log, so as to obtain an interaction event identification report. E-commerce business interaction events cover a variety of operations, such as user login, product browsing, product addition to shopping cart, ordering, payment, logistics query, etc. Take a typical e-commerce application log as an example, which may contain a series of operation records of the user in a certain period of time. For example, the user logged in to the e-commerce platform at 10:00 on October 1, 2023, and then browsed several mobile phones in the electronic product category, added one of the mobile phones to the shopping cart at 10:15, placed an order at 10:30 and selected a payment method, and completed the payment at 10:35. The business log information processing server will parse these log contents through specific algorithms and technical means to identify these different e-commerce business interaction events. This identification process may involve understanding the log format, searching for specific keywords, and analyzing the order of operations. For example, for a login event, the server may search for log records containing keywords such as "login" or "login", and determine based on the context that this is an e-commerce business interaction event in which a user logged in. Through such a comprehensive and detailed identification process, the business log information processing server can accurately obtain an interaction event identification report for each e-commerce business interaction event in the target application log, which records in detail the type, occurrence time, and related parameters of each identified interaction event.

[0018] S102: The business log information processing server generates abnormal pattern attribute information of each e-commerce business interaction event based on the interaction event identification report.

[0019] Next, enter step S102, the business log information processing server generates abnormal mode attribute information (abnormal mode attribute characteristics) of each e-commerce business interaction event based on the interaction event identification report obtained above. The generation of abnormal mode attribute information is based on the understanding of the normal mode of the e-commerce business interaction event and the judgment of possible abnormal situations. Still taking the above-mentioned e-commerce business interaction event as an example, under normal circumstances, the order operation is usually performed after the product is added to the shopping cart. If the order operation occurs before the product is added to the shopping cart, this may be an abnormal mode. For the payment operation, if the payment amount does not match the product price (such as the product price is 100 yuan, the payment amount is 10 yuan and there is no discount or discount mark), this may also be an abnormal mode. The business log information processing server will establish a model or rule set about the normal mode by learning and analyzing a large amount of normal e-commerce business interaction event data. Then, each interaction event in the interaction event identification report is compared with this normal mode model or rule set to determine whether each interaction event has an abnormal mode attribute. For example, the server may find that a user has made multiple login attempts in a very short period of time (such as within 1 minute), which is inconsistent with the normal user login pattern and may be abnormal. In this case, the server will mark the login interaction event with abnormal pattern attributes, such as "frequent login attempt abnormality", and record related attribute information, such as the number of attempts, time interval, etc. In this way, the business log information processing server generates abnormal pattern attribute information for each e-commerce business interaction event, which helps to further analyze and process the target application log.

[0020] S103: The business log information processing server extracts business association tags between each e-commerce business interaction event contained in the target application log based on the abnormal mode attribute information of each e-commerce business interaction event to obtain interaction event association attribute information.

[0021] In step S103, the business log information processing server extracts the business association tags between each e-commerce business interaction event contained in the target application log based on the abnormal mode attribute information of each e-commerce business interaction event, and obtains the interaction event association attribute information (interaction event association attribute feature). There are inherent business associations between e-commerce business interaction events, and these associations are very important for understanding the entire e-commerce business process and discovering potential problems. For example, the order operation is associated with the product browsing and adding to the shopping cart operation, the payment operation is associated with the order operation, and the logistics query operation is also associated with the order operation. The business log information processing server will analyze these associations based on the abnormal mode attribute information. For example, in the target application log, it is found that an interaction event of adding a product to the shopping cart has an abnormal mode attribute (such as the number of added products exceeds the normal purchase limit), and the subsequent order operation also has an abnormality (such as the order amount does not match the total amount of the products in the shopping cart), then the server will mark a specific business association tag between the two interaction events, such as "shopping cart and order amount do not match association". For another example, if a user's login operation is abnormal (such as logging in from a different location), and the subsequent product browsing and ordering operations are also abnormal (such as browsing product categories that do not meet the user's preferences, using abnormal payment methods when placing orders), the server may mark a business association label such as "login anomaly is associated with subsequent operation anomalies." By analyzing and marking the relationships between all e-commerce business interaction events, the business log information processing server obtains interaction event association attribute information, which reflects the mutual relationship between each interaction event under abnormal circumstances.

[0022] S104: The business log information processing server determines whether the target application log matches the historical application log in the application log pool based on the abnormal pattern attribute information and the interaction event association attribute information.

[0023] Finally, in step S104, the business log information processing server determines whether the target application log matches the historical application log in the application log pool based on the abnormal pattern attribute information and the interactive event association attribute information. The historical application log in the application log pool contains a large number of e-commerce business operation records in the past. The business log information processing server compares the abnormal pattern attribute information and the interactive event association attribute information in the target application log with the corresponding information in the historical application log. For example, in the historical application log, there may be some known abnormal patterns and related interactive event association situations, such as frequent login anomalies and abnormal ordering behaviors of users in a certain area in a certain period of time. When similar abnormal pattern attribute information and interactive event association attribute information also appear in the target application log (such as frequent login anomalies and abnormal ordering behaviors of users in the same area), it can be considered that the target application log matches the historical application log to a certain extent. If there are few or almost no abnormal patterns and interactive event association situations similar to those in the target application log in the historical application log, it can be considered that the target application log does not match the historical application log. This matching judgment helps the business log information processing server to further determine whether the abnormal situation in the target application log is new, whether it requires special attention or specific processing measures, etc.

[0024] Through the operations of S101-S104, the business log information processing server can effectively conduct in-depth analysis of the target application log, from identifying e-commerce business interaction events to generating abnormal pattern attribute information, and then extracting interaction event related attribute information, and finally performing matching judgment with historical application logs, thereby providing strong support for the normal operation, risk prevention, and problem troubleshooting of e-commerce business. In the actual e-commerce business environment, with the continuous growth of business volume and the increase in business complexity, this effective processing of application logs has become increasingly important. For example, for the massive log data generated by large e-commerce platforms every day, if the abnormal situations can be accurately identified and compared with historical data, problems such as malicious attacks, business process errors, and abnormal user behavior can be discovered in a timely manner, thereby ensuring the safe, stable, and efficient operation of e-commerce business.

[0025] Based on the above content, take a large e-commerce platform as an example. The platform generates a large amount of application logs every day. The business log information processing server of the platform processes log information from all corners every day to ensure the normal operation of the e-commerce business, timely detect risks and troubleshoot problems, etc.

[0026] In the initial step of S101, the business log information processing server analyzes the target application log to identify the various e-commerce business interaction events contained therein, and then obtains an interaction event identification report. Take a specific user shopping process as an example. A user started a shopping trip on November 10, 2023. At 9:00, the user opened the APP of the e-commerce platform, and this operation will be recorded in the log. The business log information processing server will begin to analyze this record based on its own parsing algorithm. The server knows that this may be an initial operation after the user logs in or a browsing starting point for part of the platform content (such as some public promotion pages) when not logged in.

[0027] As the user's operation progressed, the user logged in at 9:05. The server determined that this was an e-commerce business interaction event in which the user logged in by searching the log for "login" or related identifiers indicating successful login (such as a specific successful login return code, etc.), and combined with the contextual information. Then, the user began to browse clothing products at 9:10. The server identified this as a product browsing event based on the page jump information and product category identifiers recorded in the log.

[0028] At 9:20, the user added a shirt worth 50 yuan to the shopping cart. The server identified the interaction event of adding the item to the shopping cart by analyzing the relevant records of the shopping cart operation in the log (such as the shopping cart update record, the product ID and shopping cart association record, etc.). After that, at 9:30, the user placed an order to buy the shirt and selected an online payment method. The server identified the two interaction events of placing an order and selecting a payment method based on the relevant identifiers of the order operation (such as the order creation record, the record of the order status starting from "pending payment", etc.) and the payment method selection record. Finally, at 9:35, the user completed the payment, and the server identified the interaction event of payment completion through the confirmation record of successful payment (such as the record of the payment success notification returned by the payment platform in the log, etc.).

[0029] Through such a series of detailed analysis of the log content, the business log information processing server identifies all these different types of e-commerce business interaction events and generates an interaction event identification report. This report records in detail the type of each interaction event (such as login, product browsing, adding to shopping cart, ordering, payment, etc.), the time of occurrence (accurate to minutes or even seconds) and related parameters (such as product price, order number, payment method, etc.).

[0030] Then, step S102 is entered. Based on the interaction event identification report generated previously, the business log information processing server starts to generate abnormal mode attribute information of each e-commerce business interaction event. Considering that e-commerce business interaction events have their normal processes and patterns, the server will make judgments based on the normal mode model or rule set established by learning and analyzing a large amount of normal business interaction data.

[0031] For example, under normal circumstances, the items ordered by users should be the items previously added to the shopping cart, and the order amount should match the total amount of the items in the shopping cart (taking into account possible discounts, shipping costs, etc.). If a user's log records show that the ordered items are completely different from the items in the shopping cart, or the order amount is significantly different from the total amount of the items in the shopping cart (for example, the total price of the items in the shopping cart is 50 yuan, and the order amount is 1,000 yuan without a reasonable explanation, such as no other high-priced items added or no special high shipping costs), then for this order interaction event, the server will mark it as having an abnormal mode attribute, such as "the ordered item does not match the shopping cart" or "the order amount is abnormal", and record relevant attribute information, such as the difference between the ordered item and the shopping cart item, the specific difference in amount, etc.

[0032] Let's look at the login event. Under normal circumstances, a user logs in 2-3 times on average in a day, but a user logs in 20 times in a day, and the IP addresses of these logins are distributed in different regions (derived from the analysis of IP address records in the log), which is obviously inconsistent with the normal login pattern. The business log information processing server will mark this login interaction event with abnormal pattern attributes, such as "frequent remote login abnormality", and record the time of each login, IP address and other related attribute information. For product browsing events, if a user browses hundreds of different categories of products in a short period of time (for example, within 10 minutes), this is very different from the browsing behavior pattern of normal users. The server will mark it as "abnormally fast and large-scale browsing abnormality" and record attribute information such as the number of browsed product categories and browsing time range.

[0033] In this way, the business log information processing server generates abnormal pattern attribute information for each e-commerce business interaction event, and this information becomes an important basis for subsequent analysis.

[0034] Next is step S103, where the business log information processing server extracts business association tags between each e-commerce business interaction event contained in the target application log based on the abnormal pattern attribute information of each e-commerce business interaction event, thereby obtaining interaction event association attribute information.

[0035] For example, in the user shopping process mentioned above, if it is found that the user's login event has abnormal pattern attributes, such as "frequent remote login abnormality", and then in the subsequent product browsing, it is found that the products browsed by the user are all high-value products that are completely unrelated to the user's previous browsing history (marked as "abnormal product browsing abnormality"), and finally a rare payment method is used when placing an order (marked as "abnormal payment method selection abnormality"). The business log information processing server will mark the business association tag "login abnormality and abnormal product browsing association" between the login event and the product browsing event, and mark the business association tag "abnormal product browsing and abnormal payment method association" between the product browsing event and the payment method selection event.

[0036] For another example, in a user's log, the interaction event of adding an item to a shopping cart has abnormal pattern attributes. For example, the number of items added is 1,000, which far exceeds the normal purchase limit (marked as "abnormal number of items in the shopping cart"), and the subsequent order operation has an abnormal order amount of 0 yuan (marked as "abnormal order amount of zero"). The server will mark the business association label "association between abnormal number of items in the shopping cart and zero order amount" between these two interaction events.

[0037] Through this analysis and marking of the relationships between all e-commerce business interaction events in the entire target application log, the business log information processing server obtains interaction event correlation attribute information, which accurately reflects the mutual relationships between various interaction events under abnormal circumstances.

[0038] Finally, in step S104, the business log information processing server determines whether the target application log matches the historical application log in the application log pool based on the abnormal pattern attribute information and the interaction event correlation attribute information obtained previously.

[0039] The historical application logs in the application log pool contain the e-commerce business operation records of many users in the past. These historical records are like a huge experience library, which contains a variety of normal and abnormal business operation modes.

[0040] For example, in the historical application logs, it was found that a group of users in a certain region had frequent login anomalies (logging in more than 10 times a day) during a promotional event, and browsed a large number of high-value products (browsing more than 50 high-value products within 1 hour), but rarely placed orders. When the target application logs also show that users in similar regions have similar frequent login anomalies (logging in 15 times a day), browsed a large number of high-value products (browsing 60 high-value products within 45 minutes), and had a very low order rate, the business log information processing server will believe that the target application logs and historical application logs are matched to a certain extent.

[0041] On the contrary, if there is almost no abnormal pattern and related interaction event association in the historical application log, such as a user first adds items to the shopping cart (and the number of added items is normal), and then without any modification, the order amount becomes 10 times the total amount of the shopping cart items, and such a situation occurs in the target application log, then it can be considered that the target application log does not match the historical application log.

[0042] This match or not judgment is of great significance to e-commerce business. If it matches, it means that the abnormal situation in the target application log may be a repetition of a situation that has occurred before, and may be affected by similar factors (such as promotion strategies, market trends, external environment, etc.). If it does not match, it means that this may be a new abnormal situation that requires special attention from the business log information processing server. It may be a new malicious attack method, a new business process loophole, or a new abnormal behavior pattern of the user.

[0043] Based on the above application scenario examples, it can be seen that the business log information processing server can deeply mine the information in the target application log. It can accurately identify e-commerce business interaction events, keenly discover the abnormal pattern attribute information, carefully extract the interaction event related attribute information, and finally accurately judge the matching with the historical application log. This series of operations is crucial to the healthy development of e-commerce business. With the continuous development of e-commerce business, the continuous growth of business volume, and the increasing complexity of business, the massive log data generated every day hides various information about business operation status, user behavior, risk factors, etc. Through this effective log analysis technology solution, the e-commerce platform can timely discover problems such as malicious attacks (such as hackers obtaining user information through abnormal logins to steal credit cards, etc.), business process errors (such as incorrect price calculations leading to abnormal order amounts, etc.), and abnormal user behaviors (such as abnormal purchase patterns, browsing patterns, etc.), thereby ensuring the safe, stable and efficient operation of e-commerce business. For example, when a large number of users are found to have similar abnormal ordering behaviors (such as ordering high-value goods at low prices) and they do not match historical data, the platform can take timely measures, such as suspending the processing of related orders, checking whether the price system has errors, and investigating whether there are malicious attacks, etc., to avoid possible economic losses and business risks.

[0044] In an optional technical solution, business association tags between each e-commerce business interaction event contained in the target application log are extracted based on the abnormal pattern attribute information of each e-commerce business interaction event to obtain interaction event association attribute information, including: based on the abnormal pattern attribute information of each e-commerce business interaction event, performing knowledge entity conversion on each e-commerce business interaction event to obtain event entity information of each e-commerce business interaction event; based on the distribution characteristics of each e-commerce business interaction event in the target application log and the event entity information of each e-commerce business interaction event, generating an event knowledge relationship spectrum corresponding to the target application log; and extracting the interaction event association attribute information from the event knowledge relationship spectrum.

[0045] In the above optional technical scheme, there is a more detailed and unique operation process for extracting business association tags between each e-commerce business interaction event in the target application log based on the abnormal pattern attribute information of each e-commerce business interaction event to obtain the interaction event association attribute information.

[0046] First, based on the abnormal pattern attribute information of each e-commerce business interaction event, each e-commerce business interaction event is converted into a knowledge entity to obtain the event entity information of each e-commerce business interaction event. Taking the user login event in the e-commerce business as an example, if the login event has an abnormal pattern attribute, such as "remote login abnormality", when performing knowledge entity conversion, the login event will be converted from the original log record form to event entity information with specific semantics and structure. This may involve combining login-related information, such as login time, login IP address, login account, etc. with the attribute "remote login abnormality" to construct an event entity with rich semantics. For example, it is converted into an event entity named "remote login abnormality event entity", which contains attributes such as "login time: 2023-11-15, 10:00", "login IP address: 192.168.100.200 (different from the usual address)", and "login account: user123".

[0047] Similarly, for the event of adding a product to a shopping cart, if there is an abnormal pattern attribute of "abnormal number of shopping cart products", the converted event entity information may be "shopping cart product quantity abnormal event entity", and its attributes include "adding time: 2023-11-15, 10:10", "product quantity: 100 (far exceeding the normal quantity)", "product category: electronic products", etc. Through such knowledge entity conversion, each e-commerce business interaction event is converted into event entity information with more semantic and logical structure, which is more conducive to subsequent analysis and processing.

[0048] Next, based on the distribution characteristics of each e-commerce business interaction event in the target application log and the event entity information of each e-commerce business interaction event, the event knowledge relationship spectrum corresponding to the target application log is generated. The distribution characteristics of e-commerce business interaction events in the log include information such as the sequence, time interval, and frequency of occurrence of events. For example, in a user's shopping process log, a login event occurs first, followed by a product browsing event in a short period of time (such as 5 minutes later), and then a product adding event to the shopping cart occurs 3 minutes later. The sequence and time interval of such events are part of the distribution characteristics.

[0049] At the same time, considering the event entity information of each e-commerce business interaction event obtained previously, this information is integrated to construct an event knowledge relationship spectrum. For example, within a time period, there are log data of multiple users, among which the event entity information of the login event shows that multiple users have abnormal remote logins, and after these abnormal remote logins, the event entity information of the product browsing event shows that the categories of products browsed by users are all high-value products and the browsing time is short. Then, a relationship connection from "off-site login abnormality event entity" to "high-value product quick browsing event entity" will be established in the event knowledge relationship spectrum. This relationship spectrum is a comprehensive and structured representation of all e-commerce business interaction events and their relationships in the target application log. It shows the relationship between each event entity in the form of a graphical or logical relationship structure, similar to the construction of a knowledge graph.

[0050] Finally, the interactive event association attribute information is extracted from the event knowledge relationship spectrum. In this constructed event knowledge relationship spectrum, by analyzing the connection relationship between each event entity, the weight of the connection (if any, for example, the weight is determined according to the frequency of simultaneous occurrence of events), and other information, the interactive event association attribute information can be accurately extracted. For example, if a strong connection relationship is found between the "off-site login abnormal event entity" and the "high-value commodity quick browsing event entity" in the event knowledge relationship spectrum (such as a high connection weight, indicating that this association frequently appears in the logs of multiple users), then the interactive event association attribute information such as "off-site login and high-value commodity quick browsing association" can be extracted. For another example, if a specific connection relationship is found between the "shopping cart item quantity abnormal event entity" and the "order amount is zero event entity", the interactive event association attribute information of "shopping cart item quantity abnormal association and order amount is zero association" can be extracted.

[0051] In this way, by converting e-commerce business interaction events into knowledge entities, building event knowledge relationship spectra, and extracting interaction event related attribute information from them, an effective way is provided to more accurately analyze the associations between e-commerce business interaction events. It can more deeply mine the information in the target application logs, help to better understand the various abnormal situations in e-commerce business and their interrelationships, and thus provide more powerful support for risk prevention and problem troubleshooting of e-commerce business.

[0052] In the following design idea, based on the abnormal pattern attribute information of each e-commerce business interaction event, the knowledge entity conversion is performed on the each e-commerce business interaction event to obtain the event entity information of each e-commerce business interaction event, including: obtaining a number of key attribute information, wherein the key attribute information is obtained by grouping the abnormal pattern attribute information of the e-commerce business interaction events contained in the historical application log; based on the difference between the abnormal pattern attribute information of each e-commerce business interaction event and the several key attribute information, determining the key attribute information with the minimum difference between the abnormal pattern attribute information of each e-commerce business interaction event; generating the event entity information of each e-commerce business interaction event according to the entity index corresponding to the key attribute information with the minimum difference between the abnormal pattern attribute information of each e-commerce business interaction event.

[0053] Based on the above design ideas, the artificial intelligence-based business log information processing method also includes: obtaining the number of prior e-commerce business interaction events and the number of upstream and downstream business interaction events of the prior e-commerce business interaction events, and obtaining the abnormal pattern attribute information of the e-commerce business interaction events contained in the historical application log; determining the number of key attribute information based on the number of prior e-commerce business interaction events and the number of upstream and downstream business interaction events; based on the number of key attribute information, grouping the abnormal pattern attribute information of the e-commerce business interaction events contained in the historical application log to obtain the several key attribute information.

[0054] In the business log information processing method based on artificial intelligence, there is a rigorous logic and specific operation method for the process of converting knowledge entities based on the abnormal pattern attribute information of each e-commerce business interaction event to obtain event entity information.

[0055] First, in order to obtain several key attribute information, it is necessary to start from the historical application log. The historical application log contains the abnormal pattern attribute information of many e-commerce business interaction events. In this process, the number of a priori e-commerce business interaction events and the number of its upstream and downstream business interaction events are first obtained, and the abnormal pattern attribute information of the e-commerce business interaction events in the historical application log is obtained at the same time. For example, the a priori e-commerce business interaction event is set as a product order event. If the number of order events is 500 times in the log analysis over a period of time, the upstream product browsing event has an average of 4 views per order event, and the number of downstream payment events is 480 times (which means that 20 orders have not completed the payment conversion). The number of key attribute information is determined based on the number of such a priori e-commerce business interaction events and the number of upstream and downstream business interaction events. For example, according to a specific algorithm (this algorithm is based on a deep understanding of e-commerce business logic and data rules), the number of key attribute information is determined to be 30.

[0056] Then, based on the number of key attribute information determined, the abnormal pattern attribute information of the e-commerce business interaction events contained in the historical application log is grouped to obtain several key attribute information. The abnormal pattern attribute information of these e-commerce business interaction events has multiple types. Taking the order of goods as an example, there may be abnormal pattern attribute information such as "the order amount does not match the price of the goods" and "the number of ordered goods exceeds the inventory limit". When grouping, similar or related abnormal pattern attribute information will be grouped together according to certain logic. For example, all abnormal pattern attribute information related to the amount (such as "the order amount does not match the price of the goods" and "the difference between the payment amount and the order amount is too large") are grouped into one group, and abnormal pattern attribute information related to the number of goods (such as "the number of ordered goods exceeds the inventory limit" and "the number of shopping cart goods does not match the number of ordered goods") are grouped into another group. Each group represents a key attribute information.

[0057] After obtaining these key attribute information, for the abnormal pattern attribute information of each e-commerce business interaction event, it is necessary to determine the key attribute information with the smallest difference between them. For example, for a current e-commerce business interaction event, its abnormal pattern attribute information is "the order amount is far lower than the product price and there is no reasonable discount." Compare this abnormal pattern attribute information with the key attribute information obtained by the previous group processing. In the group related to the amount, there are multiple key attribute information, such as "the order amount does not match the product price", "the difference between the payment amount and the order amount is too large", etc. Through detailed comparison, it is found that the key attribute information "the order amount does not match the product price" has the smallest difference with the abnormal pattern attribute information of the current e-commerce business interaction event "the order amount is far lower than the product price and there is no reasonable discount". The judgment of this difference may involve multiple aspects. For example, in terms of numerical value, for the key attribute information "the order amount does not match the commodity price", if the common discrepancy ratio in historical data is between 20% and 50%, and the order amount of the current event is 10% of the commodity price, it is closer to the numerical range covered by the key attribute information "the order amount does not match the commodity price" and is more similar in numerical feature vectors than other key attribute information; in terms of semantics, both revolve around the relationship between the order amount and the commodity price and have a stronger correlation.

[0058] Finally, according to the entity index corresponding to the key attribute information with the minimum difference between the abnormal mode attribute information of each e-commerce business interaction event, the event entity information of each e-commerce business interaction event is generated. Each key attribute information corresponds to a specific entity index, which contains rich information. Continuing with the above-mentioned order event as an example, if the entity index corresponding to the key attribute information "the order amount does not match the product price" contains the order number range of the order event (such as the order number between 1000-2000), the value range of the product price (such as the product price between 50-200 yuan), the user group characteristics involved (such as the high proportion of new users), and other entity-related index information. Based on these entity index information, the event entity information of the current order event, an e-commerce business interaction event, is generated. This event entity information will contain detailed attributes related to the order event, such as the order number is 1500, the order time is 10:00 on November 10, 2023, and information related to the order amount and the product price not matching, such as the product price is 100 yuan, the order amount is 10 yuan, etc.

[0059] Based on the above embodiments, firstly, by closely integrating with historical application logs, the number of key attribute information is determined by utilizing the number of prior e-commerce business interaction events and their upstream and downstream business interaction events, so that the key attribute information obtained by the cluster processing is highly targeted and representative. This helps to accurately find the key attribute information with the smallest difference from the abnormal mode attribute information of each e-commerce business interaction event. Secondly, when determining the key attribute information with the smallest difference, comprehensive consideration of multiple factors such as numerical feature vectors and semantics enables more accurate matching, thereby improving the accuracy of event entity information generation. Finally, accurate event entity information provides a reliable foundation for subsequent operations such as constructing event knowledge relationship spectra and extracting interactive event related attribute information, which helps to improve the overall quality and efficiency of business log information processing, and better realize functions such as monitoring, risk prevention and problem troubleshooting of e-commerce business.

[0060] In a preferred embodiment, based on the distribution characteristics of the various e-commerce business interaction events in the target application log and the event entity information of the various e-commerce business interaction events, an event knowledge relationship spectrum corresponding to the target application log is generated, including: based on the distribution characteristics of the various e-commerce business interaction events in the target application log, updating the semantic variables of the distribution characteristics corresponding to the various e-commerce business interaction events through the event entity information of the various e-commerce business interaction events; updating the semantic variables in the target application log except the distribution characteristics corresponding to the various e-commerce business interaction events as target variables, so as to generate the event knowledge relationship spectrum corresponding to the target application log.

[0061] In this preferred embodiment, the event knowledge relationship spectrum corresponding to the target application log is generated based on the distribution characteristics of each e-commerce business interaction event in the target application log and the event entity information of each e-commerce business interaction event. This process has a detailed and unique operating logic.

[0062] First, based on the distribution characteristics of each e-commerce business interaction event in the target application log, the semantic variables of the distribution characteristics corresponding to each e-commerce business interaction event are updated through the event entity information of each e-commerce business interaction event. Taking the user login event and product browsing event in the e-commerce business as an example, in the target application log, the login event occurs before the browsing event, which is a distribution feature. For example, the event entity information of the login event includes the login time of 10:00 on December 1, 2023, the login location of Beijing, and the account level of ordinary users; the event entity information of the browsing event includes the browsing start time of 10:05 on December 1, 2023, the browsed product category of electronic products, and the browsing time of 10 minutes. For the distribution characteristics of the login event, such as the semantic variable of the time interval, it may originally be a simple numerical representation of the 5-minute interval, but after being updated through the event entity information of the login event and the browsing event, this semantic variable has a richer semantic connotation. For example, if an ordinary user logs in at 10:00 in Beijing and starts browsing electronic products within 5 minutes, this involves the update of the semantic variable of time interval based on information such as user type, login location, and browsed product categories.

[0063] Let's look at the numerical manifestation. For example, in the log of an e-commerce platform, the original value of the time interval distribution feature between the order event and the payment event may be an average of 3 minutes. However, when the event entity information of the order event (such as the order amount is 100 yuan, the product is clothing, the ordering user is a new user, etc.) and the event entity information of the payment event (the payment method is online payment, the payment success mark, etc.) are combined, the 3-minute time interval semantic variable will be updated. For example, if it is found that when a new user places an order for a clothing product with a low amount (100 yuan), the payment event is often completed in a shorter time, then the semantic variable of this time interval may be updated to "the short time interval from the new user placing an order for a low-value clothing product to payment", which reflects the influence of the numerical characteristics in the event entity information (such as the order amount of 100 yuan, which can be regarded as a numerical manifestation of a low amount) on the distribution feature semantic variable.

[0064] Then, the semantic variables in the target application log other than the distribution characteristics corresponding to each e-commerce business interaction event are updated as target variables to generate the event knowledge relationship spectrum corresponding to the target application log. For example, in addition to the semantic variables related to the distribution characteristics of the above-mentioned login-browsing, order-payment and other events in the target application log, there are also some other semantic variables, such as server load information, network traffic information, etc. This information may not be directly related to the e-commerce business interaction event, but in order to build a complete event knowledge relationship spectrum, these semantic variables are uniformly updated as target variables. This target variable can be a standardized representation, such as a target variable representation that divides the server load information into three levels of high, medium and low according to the load degree, and a target variable representation that divides the network traffic information into three levels of large, medium and small according to the traffic size.

[0065] The event knowledge relationship spectrum constructed in this way is a comprehensive structure with rich semantic information. In this relationship spectrum, the relationship between each e-commerce business interaction event is not only based on simple distribution characteristics such as time sequence or operation sequence, but also integrates more semantic connotations brought by event entity information. For example, in the event knowledge relationship spectrum, the relationship between user login events and product browsing events is no longer just a sequential relationship, but also includes the association of multiple information such as user type, login location, and browsed product category. The relationship between order events and payment events is not just a time interval relationship, but also involves a comprehensive consideration of factors such as order amount, product category, and payment method. This construction method enables the event knowledge relationship spectrum to more accurately reflect the true relationship between e-commerce business interaction events, and provides a more reliable basis for the subsequent extraction of interaction event association attribute information from the event knowledge relationship spectrum.

[0066] It can be seen that by using the event entity information of each e-commerce business interaction event to update the semantic variables of the distribution features, the relationship information in the event knowledge relationship spectrum can be made richer and more accurate. It is no longer limited to the traditional simple distribution feature representation, but incorporates more business-related semantic information, which helps to more deeply understand the intrinsic connection between e-commerce business interaction events. Updating other semantic variables to target variables can simplify the construction of the relationship spectrum, while not losing information that is not related to the business interaction event but may affect the overall business environment, making the entire event knowledge relationship spectrum both comprehensive and focused. This way of constructing the event knowledge relationship spectrum provides a more effective tool for the analysis, monitoring, and risk prevention of e-commerce business, and can more accurately discover abnormal situations and potential problems in business processes, thereby improving the efficiency and security of e-commerce business operations.

[0067] In an alternative embodiment, the interactive event associated attribute information is extracted from the event knowledge relationship spectrum, including: inputting the event knowledge relationship spectrum into an event knowledge mining algorithm, the event knowledge mining algorithm including a plurality of cascaded feature pyramid branches, the event knowledge relationship spectrum is input into the first feature pyramid branch among the plurality of feature pyramid branches; integrating the outputs of at least two of the plurality of feature pyramid branches after respectively subjecting them to knowledge feature downsampling processing to obtain the interactive event associated attribute information.

[0068] On the basis of the above-mentioned replaceable embodiments, the business log information processing method based on artificial intelligence also includes the following technical ideas: obtaining a training data set for debugging the event knowledge mining algorithm, the training data set including an initial application log, a first application training log and a second application training log; wherein the initial application log, the first application training log and the second application training log are all mapped into event knowledge relationship spectra; inputting the training data set into the event knowledge mining algorithm to obtain the first abnormal pattern training information for the initial application log, the second abnormal pattern training information for the second application training log and the third abnormal pattern training information for the first application training log generated by the event knowledge mining algorithm; based on the first difference between the first abnormal pattern training information and the second abnormal pattern training information, and the second difference between the first abnormal pattern training information and the third abnormal pattern training information, determining a discrimination index according to the first difference and the second difference; taking the discrimination index being not less than the preset index as the debugging termination requirement, optimizing the algorithm weight of the event knowledge mining algorithm.

[0069] Furthermore, with the debugging termination requirement that the discrimination index is not less than a preset index, the algorithm weight of the event knowledge mining algorithm is optimized, including: generating a training error corresponding to the training data set based on the discrimination index and the preset index; summing the training errors corresponding to a set number of training data sets to determine a cycle error under a debugging cycle; and optimizing the algorithm weight of the event knowledge mining algorithm based on the cycle error.

[0070] In this alternative embodiment, the process of extracting interactive event-related attribute information from the event knowledge relationship spectrum requires a complex and sophisticated technical solution, and the related event knowledge mining algorithm debugging technology ideas in the artificial intelligence-based business log information processing method are also very critical.

[0071] Extracting the associated attribute information of interactive events from the event knowledge relationship spectrum is an important part of the whole process. First, the event knowledge relationship spectrum is input into the event knowledge mining algorithm. The event knowledge mining algorithm in the embodiment of the present invention includes several cascaded feature pyramid branches. Take a specific e-commerce business system as an example. For example, the system processes a large number of user interaction events every day, such as user login, product browsing, adding to shopping cart, ordering, payment, logistics query, etc. These interactive events and their relationships constitute the event knowledge relationship spectrum. If there are 5 feature pyramid branches, each branch processes different feature dimensions in the event knowledge relationship spectrum.

[0072] When the event knowledge relationship spectrum enters the first feature pyramid branch, it will perform preliminary feature extraction on various types of information in the event knowledge relationship spectrum. For example, in e-commerce business, the nodes in the event knowledge relationship spectrum can represent different interactive events, and the edges represent the relationship between events. The features of the edges may include information such as the time interval and sequence between events. The first feature pyramid branch may quantify the features of these edges, such as converting the time interval into a specific numerical range, such as 0-5 minutes is represented by a numerical range of 0.1-0.3 (this is a mapping relationship determined according to business logic and data distribution), 5-10 minutes is represented by 0.3-0.5, etc. For the sequence, it may be converted into a binary feature vector value through some encoding method, such as 0 for the event that occurs first and 1 for the event that occurs later. These encoded values ​​will be used as part of the feature vector.

[0073] As the event knowledge relationship spectrum is transmitted in the feature pyramid branch, different branches will process different features. Taking the second feature pyramid branch as an example, it may pay more attention to the type of event and the user attribute information related to it. In e-commerce business, user attributes may include user level, user registration time, user geographic location, etc. For different types of interactive events, such as browsing product events, if a high-level user browses a high-value product, it may be assigned a specific feature vector value, such as [0.6, 0.3, 0.1]. The values ​​in the embodiments of the present invention may respectively represent the possibility of browsing high-value products, user purchase tendencies, and correlations with other products. For low-level users browsing low-value products, they may be assigned feature vector values ​​of [0.1, 0.6, 0.3].

[0074] The third feature pyramid branch may focus on processing semantic associations between events. In the event knowledge relationship spectrum, semantic association is a complex relationship. For example, there is not only a temporal order relationship between order events and payment events, but also a semantic logical association, that is, payment is an inevitable operation after placing an order (under normal business processes). This branch will quantify this semantic association. For example, the semantic association strength from order events to payment events is quantified as 0.8. For other events with weaker associations, such as browsing products and logistics inquiries (under normal circumstances, browsing products does not necessarily trigger logistics inquiries immediately), their semantic association strength may be quantified as 0.1.

[0075] When the outputs of at least two feature pyramid branches among several feature pyramid branches are to be integrated after being processed by knowledge feature downsampling to obtain the interactive event association attribute information, this process requires careful operation. For example, the outputs of the second and third feature pyramid branches are selected for integration. The feature vector values ​​output by the second feature pyramid branch are as mentioned above [0.6, 0.3, 0.1] and [0.1, 0.6, 0.3], and the outputs of the third feature pyramid branch are as 0.8, 0.1, etc. The knowledge feature downsampling process is to reduce the amount of data while retaining key features. For example, for the output of the second feature pyramid branch, the dimension of the feature vector may be reduced by a certain algorithm, such as from 3 dimensions to 2 dimensions, and [0.6, 0.3, 0.1] may be downsampled to [0.7, 0.3]. For the output of the third feature pyramid branch, 0.8 may be downsampled to 0.9 (indicating that the semantic association strength emphasizes its importance after downsampling), and 0.1 may be downsampled to 0.05.

[0076] Then, integration is performed. Integration is not a simple addition, but different weights are assigned according to the importance of each feature. For example, the weight of the feature vector after downsampling for the second feature pyramid branch is 0.6, and the weight of the feature vector after downsampling for the third feature pyramid branch is 0.4. Then the integration result for [0.7, 0.3] and [0.9, 0.05] is [(0.7*0.6+0.9*0.4), (0.3*0.6+0.05*0.4)]=[0.78, 0.2], which is part of the interaction event association attribute information obtained, which integrates multiple aspects of information such as user attributes and semantic associations.

[0077] On the basis of the above replaceable embodiments, the business log information processing method based on artificial intelligence also includes a technical idea. First, a training data set for debugging the event knowledge mining algorithm is obtained, and the training data set includes an initial application log, a first application training log, and a second application training log, and these logs are mapped into an event knowledge relationship spectrum.

[0078] Taking a large-scale e-commerce platform as an example, the initial application log may contain tens of thousands of interaction event records. These records cover the operations of different users in different time periods. For example, during promotional activities, the user's operation frequency and behavior pattern may be different from usual. When these interaction events and their relationships are mapped into an event knowledge relationship spectrum, a large and complex structure will be formed. For example, one of the nodes can represent the browsing event of a popular product, and the edges connected to it represent other events related to the browsing event, such as whether to add it to the shopping cart after browsing, whether to share it with other users, etc. The feature vector values ​​of these edges will be set according to business rules and data statistics.

[0079] The same is true for the first application training log and the second application training log. The first application training log may be obtained from a specific business module of the platform, such as an interaction event log specifically for mobile users. The interaction event may focus more on the operation characteristics of the mobile terminal, such as the impact of touch operation, screen sliding, etc. on the interaction event. The second application training log may be obtained from the high-value user group of the platform. The operation mode of these users may be different from that of ordinary users. For example, they are more inclined to buy high-end products, and the order frequency may be lower but the order amount is higher.

[0080] After the training data set is input into the event knowledge mining algorithm, the first abnormal pattern training information for the initial application log, the second abnormal pattern training information for the second application training log, and the third abnormal pattern training information for the first application training log generated by the event knowledge mining algorithm will be obtained.

[0081] To illustrate with a numerical example, for example, the first abnormal pattern training information in the initial application log represents the abnormal operation pattern of the user during the promotional activity. For example, a large number of users frequently browse high-value products in a short period of time but the order rate is extremely low. This abnormal pattern may be expressed as [0.9, 0.05, 0.05] in the feature vector value. 0.9 in the embodiment of the present invention represents the abnormally high browsing frequency of high-value products, 0.05 represents the extremely low order rate, and another 0.05 can represent the abnormal correlation with other related events (such as sharing, adding to shopping cart, etc.).

[0082] The second abnormal pattern training information may be a special abnormal pattern for high-value user groups. For example, the occasional large-scale purchase of low-priced goods in high-value user groups (may be malicious brushing or other abnormal situations), the feature vector value may be [0.05, 0.9, 0.05], where 0.9 indicates the degree of abnormally high purchase volume of low-priced goods.

[0083] The third abnormal pattern training information may be an abnormal pattern for mobile users. For example, after a version is updated, mobile users frequently fail to log in but browse normally. The feature vector value may be [0.8, 0.1, 0.1], where 0.8 indicates an abnormally high frequency of login failures.

[0084] Next, based on the first difference between the first abnormal pattern training information and the second abnormal pattern training information, and the second difference between the first abnormal pattern training information and the third abnormal pattern training information, a discrimination index is determined according to the first difference and the second difference. When calculating the first difference, for example, the values ​​of the corresponding positions of the two feature vector values ​​[0.9, 0.05, 0.05] and [0.05, 0.9, 0.05] are subtracted and the absolute values ​​are taken and summed to obtain (0.85+0.85+0)=1.7. When calculating the second difference, the same operation is performed on [0.9, 0.05, 0.05] and [0.8, 0.1, 0.1] to obtain (0.1+0.05+0.05)=0.2. Then, the discrimination index is determined according to the two differences, for example, by using a weighted average method, the weight of the first difference is 0.6, and the weight of the second difference is 0.4, then the discrimination index is (1.7*0.6+0.2*0.4)=1.06.

[0085] Finally, the algorithm weight of the event knowledge mining algorithm is optimized with the discriminant index being no less than the preset index as the debugging termination requirement. First, the training error corresponding to the training data set is generated based on the discriminant index and the preset index. For example, if the preset index is 1 and the discriminant index is 1.06, then the training error may be calculated according to a certain algorithm based on the difference between the two. For example, if the difference is 0.06, the training error is calculated as 0.0036 through a certain function (such as a square function).

[0086] The training errors corresponding to the set number of training data sets are summed to determine the cycle error under a debugging cycle. If the set number is 10, and the training errors corresponding to each training data set are 0.0036, 0.0025, 0.0041, etc. (exemplary training errors of different training data sets), then the cycle error is the sum of these values, for example, 0.03. The algorithm weights of the event knowledge mining algorithm are optimized based on this cycle error. For example, if the algorithm weights have a weight of 0.3 related to user attribute processing, a weight of 0.4 related to semantic association processing, and a weight of 0.3 related to time interval processing. According to the cycle error, these weights may be adjusted according to a certain proportion, such as adjusting the weight related to user attribute processing to 0.28, the weight related to semantic association processing to 0.42, and the weight related to time interval processing to 0.3. In this way, the continuous optimization of the algorithm weights can improve the accuracy and generalization ability of the event knowledge mining algorithm.

[0087] This design extracts the associated attribute information of interactive events through complex feature pyramid branch processing and knowledge feature downsampling integration operations in the event knowledge mining algorithm, which can deeply mine the hidden information in the event knowledge relationship spectrum and accurately obtain the associated attribute information of interactive events by integrating various factors. Using the training data set to debug the event knowledge mining algorithm and optimize the algorithm weights according to the discrimination index, training error and cycle error can make the algorithm better adapt to different business scenarios and data patterns, improve the accuracy and stability of the algorithm when processing business log information, and thus more effectively identify abnormal patterns, ensure the safe and stable operation of e-commerce business, and help e-commerce companies to carry out risk prevention, user behavior analysis and other operations.

[0088] On the basis of the above technical ideas, the business log information processing method based on artificial intelligence also includes: obtaining multiple event knowledge relationship spectra and an interaction event annotation list corresponding to each event knowledge relationship spectrum, wherein the interaction event annotation list is obtained by prioritizing the event entity information of the e-commerce business interaction events contained in the event knowledge relationship spectrum according to preset rules; screening the target event knowledge relationship spectrum from the multiple event knowledge relationship spectra, and based on the target interaction event annotation list corresponding to the target event knowledge relationship spectrum, retrieving the first event knowledge relationship spectrum whose corresponding interaction event annotation list is the same as or includes the target interaction event annotation list from the multiple event knowledge relationship spectra; using the target event knowledge relationship spectrum as the initial application log, using the first event knowledge relationship spectrum as the first application training log corresponding to the target event knowledge relationship spectrum, and using the remaining event knowledge relationship spectra in the multiple event knowledge relationship spectra except the target event knowledge relationship spectrum and the first event knowledge relationship spectrum as the second application training log corresponding to the target event knowledge relationship spectrum, to generate the training data set.

[0089] Based on the above technical ideas of the business log information processing method based on artificial intelligence, it also includes a series of operations to generate a training data set.

[0090] First, obtain multiple event knowledge relationship spectra and the interactive event annotation list corresponding to each event knowledge relationship spectrum. The interactive event annotation list in the embodiment of the present invention is obtained by prioritizing the event entity information of the e-commerce business interactive events contained in the event knowledge relationship spectrum according to the preset rules. Taking the order processing process in the e-commerce business as an example, the event knowledge relationship spectrum contains the event entity information of the e-commerce business interactive events such as ordering, payment, and logistics. The entity information of the order event may include the order time, the ordered goods, the order amount, etc., and the entity information of the payment event includes the payment method, payment time, etc. Priority is sorted according to the preset rules. If the normal advancement of the business process is an important consideration, then the order event may have a higher priority because it is the starting key link of the entire order processing process. In its corresponding interactive event annotation list, the order event and its related entity information will be ranked in a relatively front position, followed by payment, logistics and other events and their entity information.

[0091] Filter the target event knowledge relationship spectrum from multiple event knowledge relationship spectra. This screening process may be based on a variety of factors, such as the business scope, business period, or specific business indicators involved in the event knowledge relationship spectrum. For example, there are a number of event knowledge relationship spectra, some of which are about e-commerce business interaction events of a certain type of goods (such as electronic products), and the other part is about other goods (such as clothing). If the current research focus is on electronic product-related businesses, then the event knowledge relationship spectrum about electronic products can be filtered as the target event knowledge relationship spectrum.

[0092] Based on the target interactive event annotation list corresponding to the target event knowledge relationship spectrum, the corresponding interactive event annotation list is retrieved from multiple event knowledge relationship spectra to be the same as the target interactive event annotation list or to include the first event knowledge relationship spectrum of the target interactive event annotation list. To illustrate with a numerical example, for example, the numerical value of a certain feature vector of the order event in the target interactive event annotation list is [0.8, 0.1, 0.1] (the numerical value in the embodiment of the present invention can represent the comprehensive characteristics of factors such as the order amount, the number of ordered goods, and the type of ordering user), and the numerical value of the feature vector of the payment event is [0.6, 0.3, 0.1]. In the retrieval process, if the numerical value of the feature vector of the order event in the interactive event annotation list of a certain event knowledge relationship spectrum is [0.8, 0.1, 0.1], and the numerical value of the feature vector of the payment event is [0.6, 0.3, 0.1], then this event knowledge relationship spectrum meets the requirements and can be regarded as the first event knowledge relationship spectrum. Or if the interaction event annotation list of an event knowledge relationship spectrum contains the same feature vector values ​​of ordering and payment events as the target interaction event annotation list, and also contains the feature vector values ​​of logistics events [0.5, 0.4, 0.1], it also meets the requirement of including the target interaction event annotation list and can also be regarded as the first event knowledge relationship spectrum.

[0093] Then, the target event knowledge relationship spectrum is used as the initial application log, the first event knowledge relationship spectrum is used as the first application training log corresponding to the target event knowledge relationship spectrum, and the remaining event knowledge relationship spectra except the target event knowledge relationship spectrum and the first event knowledge relationship spectrum in the multiple event knowledge relationship spectra are used as the second application training log corresponding to the target event knowledge relationship spectrum, thereby generating a training data set. For example, there are 10 event knowledge relationship spectra, one of which is selected as the target event knowledge relationship spectrum, and 3 are retrieved as the first event knowledge relationship spectrum, then the remaining 6 are used as the second application training log. By constructing the training data set in this way, the relationship between the event knowledge relationship spectrum and its interactive event annotation list can be fully utilized, so that the training data set has a certain degree of pertinence and representativeness.

[0094] By prioritizing the event entity information according to preset rules to obtain an interactive event annotation list, the training data set can better focus on important e-commerce business interactive event features during the construction process. Screening the target event knowledge relationship spectrum and retrieving the first event knowledge relationship spectrum based on the target interactive event annotation list helps to ensure the logical relevance and consistency within the training data set. Using different event knowledge relationship spectra as the initial application log, the first application training log, and the second application training log, respectively, can enable the training data set to cover different situations, improve the accuracy and generalization ability of the business log information processing method based on artificial intelligence when processing different types of business logs, thereby better realizing the analysis of e-commerce business interactive events, anomaly detection and other functions.

[0095] Based on the above technical ideas, a training data set is obtained for debugging the event knowledge mining algorithm, including: obtaining the selected initial application log; on the basis that the business-related features in the initial application log are not updated, adjusting the initial application log to obtain a first application training log corresponding to the initial application log.

[0096] Alternatively, based on the above technical ideas, a training data set is obtained for debugging the event knowledge mining algorithm, including: obtaining the selected initial application log; updating at least one of the e-commerce business interaction events and business association features in the initial application log, and obtaining a second application training log corresponding to the initial application log.

[0097] Based on the above technical ideas, there is a specific operation method for obtaining a training data set for debugging the event knowledge mining algorithm.

[0098] First, regarding the method of obtaining the selected initial application log and adjusting the initial application log on the basis that the business-related features in the initial application log are not updated to obtain a first application training log corresponding to the initial application log.

[0099] The initial application log contains information such as numerous e-commerce business interaction events and the business association characteristics between them. Taking the user behavior log in the e-commerce business as an example, the initial application log records a series of interaction events such as user login, product browsing, ordering, and payment. For example, in this initial application log, for the user login event, its feature vector value is [0.1, 0.8, 0.1] (the values ​​in the embodiment of the present invention may respectively represent certain quantitative characteristics of factors such as login time, login device type, and login location), and the feature vector value of the product browsing event is [0.3, 0.5, 0.2] (which can represent factors such as the browsed product category, browsing time, and browsing time period). In terms of business association characteristics, for example, the correlation strength between user login and product browsing may be quantified as 0.6, indicating the possibility of browsing after logging in to a certain extent.

[0100] The initial application log is adjusted on the basis that the business association features are not updated to obtain the first application training log. This adjustment may be a fine-tuning of certain numerical features in the interaction event. For example, for the user login event, the characteristic value of the login time is adjusted from the original [0.1, 0.8, 0.1] to [0.2, 0.7, 0.1], which can simulate a login situation with a slight delay in time. For the commodity browsing event, the characteristic value of the browsing time is adjusted from [0.3, 0.5, 0.2] to [0.4, 0.4, 0.2], indicating a change in browsing time. These adjusted interaction events are combined to form the first application training log, which is consistent with the initial application log in terms of business association features, but different in certain numerical features of the interaction events, so that it can be used to test the performance of the event knowledge mining algorithm when facing similar business associations but with changes in the numerical features of the interaction events.

[0101] Another way to obtain the training data set is to obtain a selected initial application log, and then update at least one of the e-commerce business interaction events and business association features in the initial application log to obtain a second application training log corresponding to the initial application log.

[0102] Still taking the previous e-commerce business user behavior log as an example, the e-commerce business interaction events in the initial application log are updated. For example, in the user login event, the original login device type may be mainly mobile devices, but now it is updated to some users logging in from the PC, which changes the characteristics of the login event. From the perspective of the feature vector value, if the original feature vector value of the mobile login is [0.1, 0.8, 0.1], where 0.8 represents the characteristics of the mobile device type, after it is updated to PC login, this value may become [0.1, 0.2, 0.7] (here 0.2 means that the mobile device characteristics are weakened, and 0.7 means that the PC device characteristics are enhanced).

[0103] For the update of business association features, for example, the original association strength between user login and product browsing is 0.6. Now, due to a change in some business strategy, such as the introduction of personalized recommendations for logged-in users, users are more likely to browse products after logging in, and the association strength is updated to 0.8. These updated logs of e-commerce business interaction events and business association features constitute the second application training log. This method can be used to test the performance of event knowledge mining algorithms when facing changes in e-commerce business interaction events and business association features, ensuring that the algorithm can adapt to different business situations.

[0104] By adjusting the initial application log to obtain the first application training log while keeping the business-related features unchanged, the sensitivity of the event knowledge mining algorithm to the changes in the numerical features of the interaction event can be tested, which helps to improve the accuracy of the algorithm when processing different data representations under similar business logic. By updating the e-commerce business interaction events and business-related features to obtain the second application training log, the event knowledge mining algorithm can better adapt to the dynamic changes of the e-commerce business, enhance the generalization ability of the algorithm, and enable the algorithm to effectively mine event knowledge under different business scenarios and business logic changes, thereby improving the reliability and effectiveness of the entire business log information processing method based on artificial intelligence.

[0105] In an optional technical solution, based on the abnormal pattern attribute information and the interactive event association attribute information, it is determined whether the target application log matches the historical application log in the application log pool, including: if the abnormal pattern attribute information and the abnormal pattern attribute information corresponding to the specified historical application log meet the correspondence condition, and the interactive event association attribute information and the interactive event association attribute information corresponding to the specified historical application log meet the correspondence condition, then it is determined that the target application log matches the specified historical application log.

[0106] In another optional technical solution, based on the abnormal pattern attribute information and the interactive event association attribute information, it is determined whether the target application log matches the historical application log in the application log pool, including: if the abnormal pattern attribute information and the abnormal pattern attribute information corresponding to the specified historical application log do not meet the correspondence condition, or the interactive event association attribute information and the interactive event association attribute information corresponding to the specified historical application log do not meet the correspondence condition, then it is determined that the target application log does not match the specified historical application log.

[0107] In the business log information processing method based on artificial intelligence, both the target application log and the historical application log contain a large amount of information related to e-commerce business interaction events, which is reflected in the form of abnormal pattern attribute information and interaction event correlation attribute information.

[0108] First, if the exception pattern attribute information meets the correspondence condition with the exception pattern attribute information corresponding to the specified historical application log, and the interaction event association attribute information meets the correspondence condition with the interaction event association attribute information corresponding to the specified historical application log, then determine whether the target application log matches the specified historical application log.

[0109] Taking the order processing flow in e-commerce business as an example, in the target application log, the abnormal pattern attribute information of the order event may be expressed in the form of a feature vector value. For example, the feature vector value of the abnormal pattern attribute information in terms of the order amount is [0.8, 0.1, 0.1] (the value in the embodiment of the present invention can represent the quantitative characteristics of factors such as the order amount is too high, the order amount does not match the value of the product, and the order amount does not match the user's historical consumption habits). In the specified historical application log, the feature vector value of the abnormal pattern attribute information corresponding to the order event is [0.7, 0.2, 0.1]. From a numerical point of view, the two are similar in the two factors of the order amount being too high and the order amount not matching the value of the product, and it can be considered that the correspondence condition is met.

[0110] Looking at the interaction event correlation attribute information, in the target application log, the interaction event correlation attribute information between the order event and the payment event may be represented by the feature vector value [0.6, 0.3, 0.1] (here it can represent factors such as the closeness of the association, the time interval of the association, etc.), and the interaction event correlation attribute information between the order and payment events in the specified historical application log is [0.5, 0.4, 0.1]. The two are similar in terms of the closeness of the association and other factors, and meet the correspondence condition. When both conditions are met, it can be determined that the target application log matches the specified historical application log. This match means that the situation in the target application log has historically shown a similar pattern, which may be a normal business fluctuation or a repetition of a known business situation.

[0111] If the abnormal pattern attribute information does not meet the correspondence condition with the abnormal pattern attribute information corresponding to the specified historical application log, or the interactive event association attribute information does not meet the correspondence condition with the interactive event association attribute information corresponding to the specified historical application log, it is determined that the target application log does not match the specified historical application log.

[0112] For example, in the target application log, the feature vector value of the abnormal pattern attribute information of the product browsing event is [0.9, 0.05, 0.05] (which can represent abnormal rapid browsing of a large number of products, browsing of products that do not match the user's interests, etc.), while the feature vector value of the abnormal pattern attribute information corresponding to the product browsing event in the specified historical application log is [0.1, 0.8, 0.1]. The two are very different in various factors and do not meet the correspondence condition.

[0113] Or in terms of interaction event correlation attribute information, in the target application log, the characteristic vector value of the interaction event correlation attribute information between the product added to the shopping cart and the order placement event is [0.8, 0.1, 0.1] (indicating the correlation strength, order, and other factors between the two), and the corresponding interaction event correlation attribute information in the specified historical application log is [0.1, 0.8, 0.1]. The two are very different in terms of correlation strength and order, and do not meet the correspondence condition. When such abnormal pattern attribute information appears or the interaction event correlation attribute information does not meet the correspondence condition, it is determined that the target application log does not match the specified historical application log. This mismatch indicates that the situation in the target application log is new or very different from the historical situation, and may require further attention, such as new business risks, new user behavior patterns, or new problems in the system.

[0114] By accurately comparing the abnormal pattern attribute information and interaction event correlation attribute information of the target application log and the historical application log, it is possible to accurately identify whether the situation in the target application log has existed in the past. If it matches, it helps to classify the situation in the target application log into a known business model, reducing unnecessary analysis and processing. If it does not match, new situations can be discovered in a timely manner, allowing e-commerce business operators to conduct risk assessment, business optimization or problem troubleshooting for new situations, thereby improving the security, stability and operational efficiency of e-commerce business.

[0115] On the basis of S101-S104, in an independent embodiment, the artificial intelligence-based business log information processing method also includes: if it is detected that there are historical application logs that need to be disaster-freed to the application log pool, then identifying each e-commerce business interaction event contained in the historical application log, and obtaining an interaction event identification report corresponding to the historical application log; generating abnormal pattern attribute information of each e-commerce business interaction event in the historical application log based on the interaction event identification report corresponding to the historical application log, and obtaining the abnormal pattern attribute information corresponding to the historical application log; extracting business association tags between each e-commerce business interaction event contained in the historical application log based on the abnormal pattern attribute information corresponding to each e-commerce business interaction event in the historical application log, and obtaining the interaction event association attribute information corresponding to the historical application log; synchronizing the historical application log with the abnormal pattern attribute information and interaction event association attribute information corresponding to the historical application log for disaster recovery to the application log pool.

[0116] Based on S101-S104, this independent embodiment adds new content to the business log information processing method based on artificial intelligence, especially in the disaster recovery of historical application logs to the application log pool.

[0117] When it is detected that there are historical application logs that need to be restored to the application log pool, the first step is to identify the various e-commerce business interaction events contained in the historical application logs, so as to obtain the interaction event identification report corresponding to the historical application logs. Taking the historical records of e-commerce business as an example, it contains e-commerce business interaction events such as user login, product browsing, order placement, payment, etc. For user login events, the login time may be recorded (for example, represented by the feature vector value [0.1, 0.8, 0.1], and the values ​​in the embodiment of the present invention may respectively represent the quantitative characteristics of factors such as login time period, login device type, and login location), and the product browsing event may record the browsed product category (represented by [0.3, 0.5, 0.2], which can represent the popularity of the product, the price range of the product, the category attributes of the product, etc.). By analyzing and identifying these information, a complete interaction event identification report is formed, which records in detail the type of each interaction event, the relevant feature vector value, and other information.

[0118] Next, based on the interaction event identification report corresponding to the historical application log, the abnormal pattern attribute information of each e-commerce business interaction event in the historical application log is generated to obtain the abnormal pattern attribute information corresponding to the historical application log. Still taking the above-mentioned e-commerce business interaction event as an example, for the order event, if there is an abnormal relationship between the order amount and the product price, such as the order amount is far lower than the product price and there is no reasonable discount or promotion explanation, then the abnormal pattern attribute information of the order event may be expressed as a feature vector value [0.8, 0.1, 0.1] (the value in the embodiment of the present invention can represent the degree of difference between the order amount and the price, whether there are suspicious operating factors, and the degree of deviation from the user's historical order amount pattern. Factors such as). By analyzing each interaction event in the interaction event identification report, it is determined whether each interaction event has an abnormality and the specific pattern attributes of the abnormality, thereby obtaining the abnormal pattern attribute information corresponding to the entire historical application log.

[0119] Then, based on the abnormal pattern attribute information corresponding to each e-commerce business interaction event in the historical application log, the business association tags between each e-commerce business interaction event contained in the historical application log are extracted to obtain the interaction event association attribute information corresponding to the historical application log. For example, in the historical application log, if it is found that the login event has abnormal pattern attribute information (such as abnormal login in a different place, the feature vector value is [0.7, 0.2, 0.1], which can represent the abnormal degree of the login location, the degree of deviation from the usual login location, the risk factor of the login, etc.), and the subsequent order event also has an abnormality (such as abnormal order amount, the feature vector value is [0.8, 0.1, 0.1]), then the two events can be marked as having a specific business association tag, such as "login abnormality is associated with order amount abnormality". By analyzing the relationship between all e-commerce business interaction events based on abnormal pattern attribute information, the interaction event association attribute information corresponding to the historical application log is obtained.

[0120] Finally, the historical application logs and the abnormal pattern attribute information and interaction event related attribute information corresponding to the historical application logs are synchronized to the application log pool for disaster recovery. The significance of this is that when a comprehensive analysis, risk assessment or problem troubleshooting of the e-commerce business is required, the data in the application log pool not only contains the original historical application logs, but also contains the abnormal pattern attribute information and interaction event related attribute information obtained after analysis and processing. This allows the data in the application log pool to be directly used when querying, analyzing or comparing with the new target application log in the future, without the need to repeat the analysis and processing of the historical application logs, thereby improving the efficiency and accuracy of data processing.

[0121] By comprehensively analyzing and processing historical application logs during the disaster recovery process, abnormal pattern attribute information and interaction event correlation attribute information are obtained and synchronized to the application log pool for disaster recovery, which can enrich the data content in the application log pool. This helps to improve the efficiency of subsequent data processing. For example, when performing operations such as log matching and anomaly detection, these existing analysis results can be directly used. At the same time, the preservation of complete historical application logs and related analysis information is conducive to the long-term monitoring and risk analysis of e-commerce business, and can more comprehensively grasp the development trend and potential risks of e-commerce business, thereby providing better support for the stable operation of e-commerce business.

[0122] In summary, the embodiments of the present invention can comprehensively sort out the business activities in the target application log by identifying e-commerce business interaction events to obtain identification reports. Generating abnormal pattern attribute information helps to accurately locate interaction events that may be risky or do not conform to normal processes, such as discovering abnormal order amounts or login behaviors. Extracting the associated attribute information of interaction events can deeply explore the intrinsic connections between events, such as the connection between ordering and payment anomalies. Based on this information to judge the matching with historical logs, it can quickly determine whether the current log situation is a new problem, improve the efficiency of e-commerce business monitoring, and promptly discover problems such as malicious operations and business process loopholes to ensure the safe, stable and efficient operation of e-commerce business.

[0123] Furthermore, a readable storage medium is provided, on which a program is stored, and the program implements the above method when executed by a processor.

[0124] Those skilled in the art can clearly understand that, for the convenience and simplicity of description, the specific working process of the system and device described in the above exemplary embodiment can refer to the corresponding process in the aforementioned method embodiment, and will not be repeated here. In the several embodiments provided in the embodiments of the present invention, it should be understood that the disclosed system, device and method can be implemented in other ways. The device embodiments described above are merely schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some communication interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

Claims

1. A business log information processing method based on artificial intelligence, characterized in that: The method is applied to a service log information processing server, and the method comprises: Identify each e-commerce business interaction event contained in the target application log and obtain an interaction event identification report; Generate abnormal pattern attribute information of each e-commerce business interaction event based on the interaction event identification report; Extracting business association tags between each e-commerce business interaction event contained in the target application log based on the abnormal mode attribute information of each e-commerce business interaction event to obtain interaction event association attribute information; Based on the abnormal pattern attribute information and the interaction event association attribute information, it is determined whether the target application log matches the historical application log in the application log pool.

2. The business log information processing method based on artificial intelligence according to claim 1, characterized in that: Based on the abnormal mode attribute information of each e-commerce business interaction event, the business association tags between each e-commerce business interaction event contained in the target application log are extracted to obtain the interaction event association attribute information, including: Based on the abnormal mode attribute information of each e-commerce business interaction event, the knowledge entity conversion is performed on each e-commerce business interaction event to obtain event entity information of each e-commerce business interaction event; Based on the distribution characteristics of each e-commerce business interaction event in the target application log and the event entity information of each e-commerce business interaction event, generating an event knowledge relationship spectrum corresponding to the target application log; The interactive event related attribute information is extracted from the event knowledge relationship spectrum.

3. The business log information processing method based on artificial intelligence according to claim 2, characterized in that: Based on the abnormal mode attribute information of each e-commerce business interaction event, each e-commerce business interaction event is converted into a knowledge entity to obtain event entity information of each e-commerce business interaction event, including: Acquire a number of key attribute information, where the key attribute information is obtained by performing group processing on the abnormal pattern attribute information of the e-commerce business interaction events contained in the historical application log; Based on the differences between the abnormal pattern attribute information of each e-commerce business interaction event and the plurality of key attribute information, determining the key attribute information having the smallest difference with the abnormal pattern attribute information of each e-commerce business interaction event; Generate event entity information of each e-commerce business interaction event according to the entity index corresponding to the key attribute information with the minimum difference between the abnormal mode attribute information of each e-commerce business interaction event; The business log information processing method based on artificial intelligence also includes: Obtaining the number of prior e-commerce business interaction events and the number of upstream and downstream business interaction events of the prior e-commerce business interaction events, and obtaining abnormal mode attribute information of the e-commerce business interaction events contained in the historical application logs; Determining the number of key attribute information based on the number of the prior e-commerce business interaction events and the number of the upstream and downstream business interaction events; Based on the number of the key attribute information, the abnormal pattern attribute information of the e-commerce business interaction events contained in the historical application log is grouped to obtain the plurality of key attribute information.

4. The business log information processing method based on artificial intelligence according to claim 2, characterized in that: Based on the distribution characteristics of each e-commerce business interaction event in the target application log and the event entity information of each e-commerce business interaction event, an event knowledge relationship spectrum corresponding to the target application log is generated, including: Based on the distribution characteristics of each e-commerce business interaction event in the target application log, updating the semantic variables of the distribution characteristics corresponding to each e-commerce business interaction event through the event entity information of each e-commerce business interaction event; The semantic variables in the target application log except the distribution features corresponding to the various e-commerce business interaction events are updated as target variables to generate an event knowledge relationship spectrum corresponding to the target application log.

5. The business log information processing method based on artificial intelligence as claimed in claim 2, characterized in that: Extracting the interactive event related attribute information from the event knowledge relationship spectrum includes: Inputting the event knowledge relationship spectrum into an event knowledge mining algorithm, wherein the event knowledge mining algorithm includes a plurality of cascaded feature pyramid branches, and the event knowledge relationship spectrum is input into the first feature pyramid branch among the plurality of feature pyramid branches; The outputs of at least two feature pyramid branches among the plurality of feature pyramid branches are respectively subjected to knowledge feature downsampling processing and then integrated to obtain the interaction event related attribute information; The business log information processing method based on artificial intelligence also includes: Acquire a training data set for debugging the event knowledge mining algorithm, the training data set comprising an initial application log, a first application training log, and a second application training log; wherein the initial application log, the first application training log, and the second application training log are all mapped into an event knowledge relationship spectrum; Inputting the training data set into the event knowledge mining algorithm to obtain first abnormal pattern training information for the initial application log, second abnormal pattern training information for the second application training log, and third abnormal pattern training information for the first application training log generated by the event knowledge mining algorithm; Based on a first difference between the first abnormal pattern training information and the second abnormal pattern training information, and a second difference between the first abnormal pattern training information and the third abnormal pattern training information, determining a discrimination index according to the first difference and the second difference; The debugging termination requirement is that the discrimination index is not less than a preset index, and the algorithm weight of the event knowledge mining algorithm is optimized.

6. The business log information processing method based on artificial intelligence according to claim 5, characterized in that: Taking the discrimination index being not less than the preset index as the debugging termination requirement, the algorithm weight of the event knowledge mining algorithm is optimized, including: Generate a training error corresponding to the training data set based on the discrimination index and the preset index; The training errors corresponding to the set number of training data sets are summed to determine the cycle error in one debugging cycle; The algorithm weight of the event knowledge mining algorithm is optimized according to the periodic error.

7. The business log information processing method based on artificial intelligence as claimed in claim 5, characterized in that: The business log information processing method based on artificial intelligence also includes: Acquire multiple event knowledge relationship spectra and an interactive event annotation list corresponding to each event knowledge relationship spectra, wherein the interactive event annotation list is obtained by sorting the event entity information of the e-commerce business interactive events contained in the event knowledge relationship spectra by priority according to a preset rule; Filter a target event knowledge relationship spectrum from the multiple event knowledge relationship spectrums, and based on a target interactive event annotation list corresponding to the target event knowledge relationship spectrum, retrieve a first event knowledge relationship spectrum from the multiple event knowledge relationship spectrums, the first event knowledge relationship spectrum having a corresponding interactive event annotation list that is the same as the target interactive event annotation list or includes the target interactive event annotation list; The training data set is generated by using the target event knowledge relationship spectrum as the initial application log, using the first event knowledge relationship spectrum as the first application training log corresponding to the target event knowledge relationship spectrum, and using the remaining event knowledge relationship spectra among the multiple event knowledge relationship spectra except the target event knowledge relationship spectrum and the first event knowledge relationship spectrum as the second application training log corresponding to the target event knowledge relationship spectrum.

8. The business log information processing method based on artificial intelligence according to claim 5, characterized in that: Acquiring a training data set for debugging the event knowledge mining algorithm includes: Get the selected initial application log; On the basis that the business-related feature in the initial application log is not updated, adjusting the initial application log to obtain a first application training log corresponding to the initial application log; Alternatively, obtaining a training data set for debugging the event knowledge mining algorithm includes: Get the selected initial application log; At least one of the e-commerce business interaction event and the business association feature in the initial application log is updated to obtain a second application training log corresponding to the initial application log.

9. The business log information processing method based on artificial intelligence according to claim 1, characterized in that: Based on the abnormal pattern attribute information and the interactive event association attribute information, determining whether the target application log matches the historical application log in the application log pool, including: if the abnormal pattern attribute information and the abnormal pattern attribute information corresponding to the specified historical application log meet the correspondence condition, and the interactive event association attribute information and the interactive event association attribute information corresponding to the specified historical application log meet the correspondence condition, then determining that the target application log matches the specified historical application log; Alternatively, based on the abnormal pattern attribute information and the interactive event association attribute information, it is determined whether the target application log matches the historical application log in the application log pool, including: if the abnormal pattern attribute information and the abnormal pattern attribute information corresponding to the specified historical application log do not meet the correspondence condition, or the interactive event association attribute information and the interactive event association attribute information corresponding to the specified historical application log do not meet the correspondence condition, then it is determined that the target application log does not match the specified historical application log.

10. A business log information processing server, characterized in that: It comprises a processor and a memory; the processor and the memory are communicatively connected, and the processor is used to read a computer program from the memory and execute it to implement the method described in any one of claims 1 to 9.

Images