Abnormal data identification method and device, electronic equipment and computer readable medium

Abstract

The invention discloses an abnormal data identification method and device, electronic equipment and a computer readable medium, and relates to the technical field of computers, one specific implementation mode comprises the steps of receiving an abnormal data identification request, and obtaining corresponding order data; extracting address data in the order data, and segmenting the address data based on a preset dimension to generate a dimension address string; determining an abnormal score according to the dimension address string and the abnormal branch character string; and determining and intercepting abnormal order data in the order data based on the abnormal score. Therefore, the capability of identifying the abnormal order data is improved, and the rate and accuracy of identifying the abnormal order data are improved.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to an abnormal data identification method, device, electronic device and computer-readable medium. Background Art

[0002] At present, users who abnormally resell goods or tickets are found in various online and offline scenarios. Popular commodities, concert tickets, train tickets, outpatient registration, shopping mall coupons, etc. are all targets of abnormal arbitrage. At present, for the e-commerce link, it is basically based on inconsistent information, abnormal environment, or abnormal aggregation to determine whether it is abnormal hoarding. Abnormal arbitrage identification is mainly based on abnormal identification rules and is separated from business scenarios, with low identification efficiency and accuracy. Summary of the invention

[0003] In view of this, the embodiments of the present application provide an abnormal data identification method, device, electronic device and computer-readable medium, which can solve the problem that the existing user arbitrage identification of abnormal reselling of materials or tickets is mainly based on abnormal identification rules and is separated from the business scenario, and has low identification efficiency and accuracy.

[0004] To achieve the above object, according to one aspect of an embodiment of the present application, a method for identifying abnormal data is provided, comprising:

[0005] Receive abnormal data identification request and obtain corresponding order data;

[0006] Extracting address data from the order data, and segmenting the address data based on preset dimensions to generate a dimensional address string;

[0007] Determine anomaly scores based on the dimension address string and the anomaly branch string;

[0008] Based on the anomaly score, abnormal order data in the order data is identified and intercepted.

[0009] Optionally, determine an anomaly score, including:

[0010] Match the dimension address string with each character string in the exception branch string to determine the number of matched characters;

[0011] Determine the length of the abnormal branch string, and determine the anomaly score based on the number and length of matched characters.

[0012] Optionally, based on the number and length of characters matched, determine an anomaly score, including:

[0013] Calculate the ratio of the number of matched characters to the length to get each score;

[0014] The largest score among the scores is determined as the anomaly score.

[0015] Optionally, segmenting the address data based on a preset dimension to generate a dimensional address string includes:

[0016] Based on the three-level address dimension and the detailed address dimension corresponding to the administrative area division, the address data is segmented to generate the corresponding dimensional address string.

[0017] Optionally, before determining the anomaly score, the method further comprises:

[0018] Obtain historical abnormal order data and extract corresponding abnormal address data;

[0019] Determine the third-level addresses and detailed addresses in the abnormal address data, and then construct an abnormal frequent pattern tree model corresponding to the detailed address according to each third-level address;

[0020] Based on the abnormal frequent pattern tree model, the abnormal branch string is determined.

[0021] Optionally, based on the anomaly score, determining and intercepting abnormal order data in the order data includes:

[0022] Determine the order data corresponding to the abnormality score greater than the preset threshold as abnormal order data;

[0023] Intercept abnormal order data.

[0024] Optionally, extract address data from the order data, including:

[0025] Eliminate virtual order data and offline store order data from the order data to obtain pre-processed data;

[0026] Extract address data from preprocessed data.

[0027] Optionally, after determining and intercepting abnormal order data in the order data, the method further includes:

[0028] Update the exception branch string based on the abnormal order data.

[0029] In addition, the present application also provides an abnormal data identification device, including:

[0030] A receiving unit is configured to receive an abnormal data identification request and obtain corresponding order data;

[0031] A data extraction unit is configured to extract address data from the order data and segment the address data based on a preset dimension to generate a dimensional address string;

[0032] an anomaly score determination unit, configured to determine an anomaly score based on the dimension address string and the anomaly branch string;

[0033] The interception unit is configured to determine and intercept abnormal order data in the order data based on the abnormality score.

[0034] Optionally, the anomaly score determination unit is further configured to:

[0035] Match the dimension address string with each character string in the exception branch string to determine the number of matched characters;

[0036] Determine the length of the abnormal branch string, and determine the anomaly score based on the number and length of matched characters.

[0037] Optionally, the anomaly score determination unit is further configured to:

[0038] Calculate the ratio of the number of matched characters to the length to get each score;

[0039] The largest score among the scores is determined as the anomaly score.

[0040] Optionally, the data extraction unit is further configured to:

[0041] Based on the three-level address dimension and the detailed address dimension corresponding to the administrative area division, the address data is segmented to generate the corresponding dimensional address string.

[0042] Optionally, the abnormal data identification device further includes an abnormal branch character string determination unit configured to:

[0043] Obtain historical abnormal order data and extract corresponding abnormal address data;

[0044] Determine the third-level addresses and detailed addresses in the abnormal address data, and then construct an abnormal frequent pattern tree model corresponding to the detailed address according to each third-level address;

[0045] Based on the abnormal frequent pattern tree model, the abnormal branch string is determined.

[0046] Optionally, the interception unit is further configured to:

[0047] Determine the order data corresponding to the abnormality score greater than the preset threshold as abnormal order data;

[0048] Intercept abnormal order data.

[0049] Optionally, the data extraction unit is further configured to:

[0050] Eliminate virtual order data and offline store order data from the order data to obtain pre-processed data;

[0051] Extract address data from preprocessed data.

[0052] Optionally, the abnormal data identification device further includes an updating unit configured to:

[0053] Update the exception branch string based on the abnormal order data.

[0054] In addition, the present application also provides an abnormal data identification electronic device, including: one or more processors; a storage device for storing one or more programs, when the one or more programs are executed by one or more processors, the one or more processors implement the abnormal data identification method as described above.

[0055] In addition, the present application also provides a computer-readable medium on which a computer program is stored, and when the program is executed by a processor, the abnormal data identification method as described above is implemented.

[0056] One embodiment of the above invention has the following advantages or beneficial effects: the present application obtains corresponding order data by receiving an abnormal data identification request; extracts address data in the order data, and segments the address data based on a preset dimension to generate a dimensional address string; determines an abnormal score based on the dimensional address string and the abnormal branch string; determines and intercepts abnormal order data in the order data based on the abnormal score. This improves the ability to identify abnormal order data, and improves the speed and accuracy of identifying abnormal order data.

[0057] The further effects of the above-mentioned non-conventional optional manner will be described below in conjunction with the specific implementation manner. BRIEF DESCRIPTION OF THE DRAWINGS

[0058] The accompanying drawings are used to better understand the present application and do not constitute an improper limitation on the present application.

[0059] Figure 1 It is a schematic diagram of the main process of the abnormal data identification method provided according to one embodiment of the present application;

[0060] Figure 2 It is a schematic diagram of the main process of the abnormal data identification method provided according to one embodiment of the present application;

[0061] Figure 3 This is a schematic diagram of an application scenario of an abnormal data identification method provided according to an embodiment of the present application;

[0062] Figure 4 is a schematic diagram of main units of an abnormal data identification device according to an embodiment of the present application;

[0063] Figure 5 is an exemplary system architecture diagram to which the embodiments of the present application can be applied;

[0064] Figure 6It is a structural diagram of a computer system of a terminal device or server suitable for implementing an embodiment of the present application. DETAILED DESCRIPTION

[0065] The following is an explanation of the exemplary embodiments of the present application in conjunction with the accompanying drawings, including various details of the embodiments of the present application to facilitate understanding, which should be considered as merely exemplary. Therefore, those of ordinary skill in the art should recognize that various changes and modifications can be made to the embodiments described herein without departing from the scope and spirit of the present application. Similarly, for the sake of clarity and conciseness, the description of well-known functions and structures is omitted in the following description. It should be noted that in the technical solution of the present disclosure, the collection, collection, update, analysis, processing, use, transmission, storage and other aspects of user personal information involved are in compliance with the provisions of relevant laws and regulations, are used for legitimate purposes, and do not violate public order and good morals. Take necessary measures for user personal information to prevent illegal access to user personal information data and maintain user personal information security, network security and national security.

[0066] Figure 1 is a schematic diagram of the main process of the abnormal data identification method provided according to an embodiment of the present application, such as Figure 1 As shown, the abnormal data identification method includes:

[0067] Step S101, receiving an abnormal data identification request and obtaining corresponding order data.

[0068] In this embodiment, the execution subject of the abnormal data identification method (for example, it can be a server) can receive the abnormal data identification request through a wired connection or a wireless connection. Specifically, the abnormal data identification request can be, for example, a request for identification of user order data for abnormal reselling of materials or tickets. The embodiment of the present application does not specifically limit the content of the abnormal data identification request. After receiving the abnormal data identification request, the execution subject can obtain the order data corresponding to the request. Specifically, the order data may include order address data, item type data in the order, item quantity data, etc. The embodiment of the present application does not specifically limit the content of the order data.

[0069] Step S102, extracting address data from the order data, and segmenting the address data based on preset dimensions to generate a dimensional address string.

[0070] The preset dimensions may be, for example, province, city, district, detailed address dimension, etc. The embodiment of the present application does not specifically limit the preset dimensions.

[0071] Specifically, the address data is segmented based on a preset dimension to generate a dimensional address string, including:

[0072] Based on the three-level address dimension and the detailed address dimension corresponding to the administrative area division, the address data is segmented to generate the corresponding dimensional address string.

[0073] The three-level address dimensions corresponding to the administrative division can be the province, city, and district dimensions. The address data is segmented according to the province, city, district dimensions and the detailed address dimensions to obtain the dimensional address string after the address data is segmented. For example, the detailed address can be, for example, A1 Park B1 City. The corresponding dimensional address string can be generated, for example: a1 Province B1 City C1 District A1 Park B1 City, a2 Province B2 City C2 District A2 Park B2 City, a3 Province B3 City C3 District A3 Park B3 City, etc.

[0074] Step S103, determining anomaly scores according to the dimension address string and the abnormal branch string.

[0075] Example, exception string, may include:

[0076] (1) Peak Huada Xinfu Room Pukou XiaoA;

[0077] (2) Yongqing, Shanshening Group;

[0078] (3) LS city building.

[0079] The dimension address string is matched with the abnormal character string, and specifically, the similarity between the dimension address string and the abnormal character string can be calculated, for example, the cosine similarity can be calculated, and the dimension address string corresponding to the similarity greater than the preset similarity threshold is determined as the character string that matches the abnormal branch character string. Specifically, the abnormal score can be determined based on the ratio K of the number of character strings W1 that match the abnormal branch character string and the length L1 of the corresponding abnormal branch character string (1) (or the length L2 of the abnormal branch character string (2), or the length L3 of the abnormal branch character string (3)). For example, the ratio K may include K1, K2, and K3, which may correspond to the ratios of W1 to the abnormal branch character string (1), the abnormal branch character string (2), and the abnormal branch character string (3), respectively. Specifically, the execution entity may sort K1, K2, and K3 in descending order to determine the ratio that is ranked first as the abnormal score, that is, the largest ratio is determined as the abnormal score.

[0080] Step S104: determining and intercepting abnormal order data in the order data based on the abnormality score.

[0081] The execution entity can determine the abnormal order data in the order data based on the abnormal score and the corresponding preset threshold, and superimpose the discount information such as the discount amount and discount ratio.

[0082] Specifically, the discount amount and the discount ratio may be converted into weights. For example, the weights corresponding to the discount amount and the discount ratio are c1 and c2 respectively. The converted weights are multiplied by the abnormal score, such as C, to obtain the final score, such as the final score = C*c1*c2. The abnormal order data in the order data is determined according to the final score. The order data corresponding to the final score greater than the score threshold is determined as abnormal order data.

[0083] This embodiment receives an abnormal data identification request to obtain corresponding order data; extracts address data from the order data, segments the address data based on a preset dimension to generate a dimensional address string; determines an abnormal score based on the dimensional address string and the abnormal branch string; and determines and intercepts abnormal order data in the order data based on the abnormal score. This improves the ability to identify abnormal order data, and increases the speed and accuracy of identifying abnormal order data.

[0084] Figure 2 FIG. 1 is a schematic diagram of the main flow of the abnormal data identification method provided according to an embodiment of the present application. Figure 2 As shown, the abnormal data identification method includes:

[0085] Step S201, receiving an abnormal data identification request and obtaining corresponding order data.

[0086] Step S202, extracting address data from the order data, and segmenting the address data based on preset dimensions to generate a dimensional address string.

[0087] Step S203, matching the dimension address string with each character string in the abnormal branch character string to determine the number of matching characters.

[0088] For example, the dimension address string may be:

[0089] 1) a1 province b1 city c1 district A1 park B1 city;

[0090] 2) a2 province b2 city c2 district A2 park B2 city;

[0091] 3) a3 province, b3 city, c3 district, A3 park, B3 city.

[0092] For example, the exception string may include:

[0093] (1) Peak Huada Xinfu Room Pukou XiaoA;

[0094] (2) Yongqing, Shanshening Group;

[0095] (3) LS city building.

[0096] The embodiment of the present application does not specifically limit the number and content of abnormal branch character strings.

[0097] The exception branch character string can be one or more.

[0098] When there are multiple abnormal branch character strings, the execution entity may match the dimension address string with the multiple abnormal branch character strings respectively. Specifically, the matching may be based on cosine similarity, that is, the cosine similarity between each character in the dimension address strings 1), 2), and 3) and each character in the multiple abnormal branch character strings (1), (2), and (3) is calculated, and the number of characters in the dimension address string that matches the multiple abnormal branch character strings is determined respectively.

[0099] Step S204, determining the length of the abnormal branch character string, and determining the abnormality score according to the number and length of matched characters.

[0100] The length of the abnormal branch string can be determined according to the number of characters in the abnormal branch string, that is, the number of characters in the abnormal branch string is determined as the length of the corresponding abnormal branch string.

[0101] For example, when the abnormal branch string is: (1) Shanding Huada Xinfushi Pukou Xiao A, there are 11 characters in total, then the length of the corresponding abnormal branch string (1) is 11.

[0102] Specifically, the anomaly score is determined according to the number and length of matched characters, including: calculating the ratio of the number and length of matched characters to obtain various scores; and determining the largest score among the various scores as the anomaly score.

[0103] The ratio of the number of matched characters to the length of the corresponding abnormal branch character string is calculated. For example, if there are 3 abnormal branch character strings, then 3 ratio calculations are performed accordingly to obtain 3 ratios. In the embodiment of the present application, the ratio is the score, and specifically the largest ratio is determined as the abnormal score.

[0104] In one embodiment of the present application, the execution entity may also calculate the absolute value of the length of the abnormal branch string (eg, m1) minus the number of matching characters (eg, m2), such as |m1-m2|, and determine the largest absolute value as the abnormality score.

[0105] Step S205: determining and intercepting abnormal order data in the order data based on the abnormality score.

[0106] Specifically, the order data corresponding to the abnormal scores within the preset score range can be determined as abnormal order data. Among them, the preset score range can be obtained based on the order portraits corresponding to the historical abnormal order data, and the embodiment of the present application does not specifically limit the preset score range. The embodiment of the present application can improve the ability to identify abnormal order data and improve the speed and accuracy of identifying abnormal order data.

[0107] Figure 3The following is a schematic diagram of an application scenario of an abnormal data identification method provided by an embodiment of the present application. The abnormal data identification method of the embodiment of the present application can be applied to the business scenario of issuing coupons to identify abnormal reselling orders of materials or tickets. Figure 3 The abnormal data identification method of the embodiment of the present application may include the following eight steps:

[0108] The first step is to analyze the commonalities of historical abnormal order data.

[0109] Specifically, it can be based on the abnormal orders identified in the historical consumption voucher orders, and then summarized and sorted. It is found that the core abnormal pattern of the consumption voucher is that the intermediary or abnormal guidance of users to place orders for the goods with the consumption voucher discount card amount in the mall is concentrated and mailed to the abnormal location, and the goods are sold in an abnormal concentration. This abnormal pattern has obvious clustering at the delivery address, and the delivery address will be clearly marked at the delivery address or the name of the consignee in order to change it so that the abnormal group can be easily identified, and the mark is relatively fixed.

[0110] The second step is data extraction.

[0111] Data extraction is divided into two parts: 1) Label sample data. For example, this part of data can come from abnormal orders identified by various models and strategies of the real-time version or offline version of payment marketing. 2) Full verification sample data. This part of data is all orders that have been used in payment marketing, as well as the corresponding payment discount information, transaction information, etc. of these orders.

[0112] The third step is data preprocessing.

[0113] 1) Label sample screening. From the label sample data, only the abnormal orders identified by the order dimension are screened, and the abnormal orders identified by the user dimension are eliminated. Because there are relatively more abnormal reasons for the user dimension, and the abnormal orders identified by the order dimension basically have obvious clustering and commonality of user labeling on the delivery address.

[0114] 2) Remove redundant words from the label sample data. It is normal for numbers or house numbers or common address words (such as street, road, room) to appear in the sample, so these words need to be removed.

[0115] 3) Preprocessing of the full sample data. This part of the data is mainly used for verification and scoring. For this part of the orders, the virtual order type is removed and only the physical order type is retained, and offline store orders are removed (offline stores will have completely identical delivery addresses, resulting in misidentification).

[0116] 4) Segment the identified abnormal order addresses or the order addresses of the full sample into four field structures, for example, province, city, district, and detailed address, for backup. For example: a1 province b1 city c1 district A1 park B1 city

[0117] The fourth step is to construct an abnormal frequent pattern tree (fptree) model corresponding to each region.

[0118] For the processed label sample data, the abnormal frequent pattern tree (fptree) model corresponding to the detailed address is constructed for different three-level addresses. Here, it is necessary to find the minimum support and maximum support. If the threshold of the minimum support is set too high, it is likely that the complete abnormal frequent pattern tree (fptree) will not be found. If the minimum support threshold is set too low or the maximum support threshold is too high, it will be inaccurate. Therefore, the minimum support and maximum support here are not fixed values, but the frequency statistics of each word corresponding to the sample size are performed, and the statistical values ​​are arranged in reverse order and screened according to business experience. For example: a1 province b1 city c1 district A1 park B1 city, take the characters with a cumulative word frequency of 3% to 90% as samples for building the fptree tree model. The calculation method of 3% to 90% is to analyze the cumulative word frequency of each district and the business experience, and then build the frequent pattern tree (fptree) model and calculate the abnormal branch string.

[0119] The fifth step is to prune the frequent pattern tree (fptree).

[0120] For abnormal branches of the generated frequent pattern tree (fptree), it is necessary to prune the branches to improve accuracy. The current pruning logic is:

[0121]

[0122] : represents abnormal branches after pruning

[0123] : represents fptree directly generates abnormal branches

[0124] none: represents empty

[0125] Calculate the length of abnormal branches

[0126] W i : represents the threshold value, here it is directly taken as 0.25

[0127] Represents the maximum length of all abnormal branches generated by the fptree

[0128] Step 6: Full sample scoring

[0129] For all order address samples, the first three levels of addresses are removed, and only the detailed addresses are retained. The detailed addresses are segmented word by word, and the segmented strings are matched one by one with the strings after branch reduction in the fifth step. The number of matched characters / the length of the string after branch reduction is used as the current score, and finally the maximum score is selected as the final score.

[0130] Corresponding thresholds are set for the above abnormal scores and discount information such as discount amount and discount ratio are superimposed to identify abnormal arbitrage orders in each third-level region.

[0131] For example, the scoring threshold determination scheme may be: randomly screening 3,000 samples for manual labeling, observing the score distribution of the labeled samples, and determining that the scoring threshold is set to 0.5.

[0132] The specific formula for scoring sample addresses is as follows:

[0133]

[0134] in:

[0135] score j : Represents the current order address score

[0136] Samp j : The current order address list after word separation

[0137] Abnormal branch list

[0138] The length of the exception branch list

[0139] The length of the intersection of the current order and the exception branch

[0140] Step 7: Abnormal order data handling plan.

[0141] 1) Deploy identification strategies in real time.

[0142] The offline deployment model T+1 generates abnormal branches of the abnormal frequent pattern tree (fptree) corresponding to different provinces, cities, and regions, and pushes the abnormal branches generated by the abnormal frequent pattern tree (fptree) into the online cache. Then, combined with the actual application scenarios and activities, real-time matching calculation and scoring are performed, and the corresponding abnormal arbitrage identification strategy is deployed for superimposed arbitrage consumption voucher activities for real-time interception.

[0143] 2) Use of offline storage tags

[0144] Users who place abnormal arbitrage orders that meet the above scores and are identified in real time will be placed offline, and subsequent activities that may involve abnormal arbitrage will be pre-emptively blacklisted, that is, blacklist verification will be performed in advance.

[0145] Step 8: Effect evaluation.

[0146] The online deployment and implementation strategy recovers the loss calculation and calculates the return on investment (ROI). The loss calculation is to calculate the amount of coupons that can be effectively intercepted after the real-time deployment strategy. Offline calculation can increase the recognition volume by 15% compared to online. ROI refers to the profit that can be brought after the coupon is issued.

[0147] The corresponding ROI formula is:

[0148]

[0149] in:

[0150] o i : Represents the number of transaction orders in different cities

[0151] L i : Represents the LTV value of consumption voucher orders in different cities, fixed value

[0152] W i Represents the weight of different cities

[0153] o j : Represents the number of orders for different activities

[0154] a j : Represents the discount amount for different activities

[0155] The embodiments of the present application can achieve innovation in business scenarios: generally, abnormal arbitrage is basically identified for popular commodities, concert tickets, train tickets, outpatient registration, shopping mall coupons, etc., and the consumer voucher scenario has not been touched. The application scenario of the embodiments of the present application is consumer vouchers, and abnormal arbitrage order data is identified through the abnormal frequent pattern tree (fptree) model. In-depth mining of the aggregation of consumer voucher delivery addresses and common features of abnormal labeling, using the fptree algorithm to mine the potential common features of this batch of addresses. In order to improve the accuracy of generating abnormal branches, the minimum support and maximum support are calculated based on the word frequency and business experience. And for the abnormal branches generated by the algorithm, a specific formula is designed to reduce the branches. Finally, a scoring rule formula is set specifically for consumer voucher activities to perform scoring processing. At present, abnormal address recognition is mainly based on similarity and clustering. For abnormal keywords in abnormal addresses, there are no similar features (for example, the original address keyword is "banana", and it is later changed to "apple" to bypass online strategies). The abnormal frequent pattern tree (fptree) model can generate abnormal branches based on other words for statistical analysis (the abnormal branches may not contain the keywords "fragrant" and "banana") to solve the problem of unrecognized situations caused by changing keywords. Application in the direction of precision marketing, because the abnormal frequent pattern tree (fptree) model is based on a specific area to build an abnormal frequent pattern tree (fptree), it can effectively identify certain areas as high-risk areas, and adjust the activity list for the risk area. For example, in the high-risk D area (for example, the risk is mainly concentrated on abnormal stockpiling of mobile phones and digital products), relatively low-discount coupons can be issued (for example: 80 yuan for daily consumption coupons, but not 5000 yuan for 3C home appliance consumption coupons). The abnormal frequent pattern tree (fptree) model is easier to deploy online in real time and has more flexible online strategies compared to other models with higher complexity (for example, network models and deep learning related models). Evaluation method for abnormal arbitrage of consumer vouchers: Historically, the effect has been measured by evaluating the number of identified users, order volume, and asset loss. The embodiment of the present application introduces a return on investment (ROI) calculation method. This ROI calculation method can effectively evaluate the effect of the overall consumer vouchers in each city, and can evaluate the degree to which the algorithm improves the consumer voucher business.

[0156] The embodiment of the present application aims to mine the inherent pattern of abnormal arbitrage delivery addresses based on actual business coupon scenarios, and through the existing identified abnormal arbitrage orders, the abnormal branches corresponding to the plaintext delivery addresses are mined through the algorithm fptree, and then all existing order addresses are scored by comparing the plaintext address text library of all consumption coupons. Finally, the preferential behavior and transaction behavior of the order are combined to intercept the batch of orders in real time, which can improve the ability to identify abnormal order data and improve the speed and accuracy of identifying abnormal order data.

[0157] Figure 4 Schematic diagram of the main units of the abnormal data identification device according to an embodiment of the present application. Figure 4 As shown, the abnormal data identification device 400 includes a receiving unit 401 , a data extraction unit 402 , an abnormal score determination unit 403 and an interception unit 404 .

[0158] The receiving unit 401 is configured to receive an abnormal data identification request and obtain corresponding order data;

[0159] The data extraction unit 402 is configured to extract address data from the order data, and segment the address data based on a preset dimension to generate a dimensional address string;

[0160] An anomaly score determination unit 403 is configured to determine an anomaly score according to the dimension address string and the anomaly branch string;

[0161] The interception unit 404 is configured to determine and intercept abnormal order data in the order data based on the abnormality score.

[0162] In some embodiments, the anomaly score determination unit 403 is further configured to: match the dimension address string with each string in the anomaly branch string to determine the number of matched characters; determine the length of the anomaly branch string, and determine the anomaly score based on the number and length of matched characters.

[0163] In some embodiments, the anomaly score determination unit 403 is further configured to: calculate the ratio of the number of matched characters to the length to obtain various scores; and determine the largest score among the various scores as the anomaly score.

[0164] In some embodiments, the data extraction unit 402 is further configured to: segment the address data based on the three-level address dimension and the detailed address dimension corresponding to the administrative area division to generate corresponding dimensional address strings.

[0165] In some embodiments, the abnormal data identification device further includes Figure 4 The abnormal branch string determination unit not shown in the figure is configured to: obtain historical abnormal order data and extract corresponding abnormal address data; determine the third-level address and detailed address in the abnormal address data, and then construct an abnormal frequent pattern tree model corresponding to the detailed address according to each third-level address; determine the abnormal branch string based on the abnormal frequent pattern tree model.

[0166] In some embodiments, the interception unit 404 is further configured to: determine order data corresponding to an abnormality score greater than a preset threshold as abnormal order data; and intercept the abnormal order data.

[0167] In some embodiments, the data extraction unit 402 is further configured to: remove virtual order data and offline store order data from the order data to obtain pre-processed data; and extract address data from the pre-processed data.

[0168] In some embodiments, the abnormal data identification device further includes Figure 4 The updating unit not shown in the figure is configured to update the abnormal branch string based on the abnormal order data.

[0169] It should be noted that the abnormal data identification method and abnormal data identification device of the present application have a corresponding relationship in terms of specific implementation contents, so the repeated contents will not be described again.

[0170] Figure 5 An exemplary system architecture 500 is shown to which the abnormal data identification method or abnormal data identification device according to the embodiment of the present application can be applied.

[0171] like Figure 5 As shown, system architecture 500 may include terminal devices 501, 502, 503, a network 504 and a server 505. Network 504 is used to provide a medium for communication links between terminal devices 501, 502, 503 and server 505. Network 504 may include various connection types, such as wired, wireless communication links or optical fiber cables, etc.

[0172] Users can use terminal devices 501, 502, 503 to interact with server 505 through network 504 to receive or send messages, etc. Various communication client applications can be installed on terminal devices 501, 502, 503, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social platform software, etc. (only as examples).

[0173] The terminal devices 501 , 502 , and 503 may be various electronic devices having an abnormal data identification and processing screen and supporting web browsing, including but not limited to smart phones, tablet computers, laptop computers, desktop computers, and the like.

[0174] Server 505 may be a server that provides various services, such as a background management server that provides support for abnormal data identification requests submitted by users using terminal devices 501, 502, and 503 (for example only). The background management server may receive abnormal data identification requests and obtain corresponding order data; extract address data from the order data, segment the address data based on preset dimensions to generate a dimensional address string; determine an abnormal score based on the dimensional address string and the abnormal branch string; determine and intercept abnormal order data in the order data based on the abnormal score. This improves the ability to identify abnormal order data, and improves the rate and accuracy of identifying abnormal order data.

[0175] It should be noted that the abnormal data identification method provided in the embodiment of the present application is generally executed by the server 505 , and accordingly, the abnormal data identification device is generally set in the server 505 .

[0176] It should be understood that Figure 5 The number of terminal devices, networks and servers in the embodiment is only for illustration. Any number of terminal devices, networks and servers may be provided according to implementation requirements.

[0177] Reference below Figure 6 , which shows a schematic diagram of the structure of a computer system 600 of a terminal device suitable for implementing an embodiment of the present application. Figure 6 The terminal device shown is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0178] like Figure 6 As shown, the computer system 600 includes a central processing unit (CPU) 601, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 602 or a program loaded from a storage part 608 into a random access memory (RAM) 603. In the RAM 603, various programs and data required for the operation of the computer system 600 are also stored. The CPU 601, the ROM 602, and the RAM 603 are connected to each other via a bus 604. An input / output (I / O) interface 605 is also connected to the bus 604.

[0179] The following components are connected to the I / O interface 605: an input section 606 including a keyboard, a mouse, etc.; an output section 607 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 608 including a hard disk, etc.; and a communication section 609 including a network interface card such as a LAN card, a modem, etc. The communication section 609 performs communication processing via a network such as the Internet. A drive 610 is also connected to the I / O interface 605 as needed. A removable medium 611, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 610 as needed, so that a computer program read therefrom is installed into the storage section 608 as needed.

[0180] In particular, according to the embodiments disclosed in the present application, the process described above with reference to the flowchart can be implemented as a computer software program. For example, the embodiments disclosed in the present application include a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 609, and / or installed from the removable medium 611. When the computer program is executed by the central processing unit (CPU) 601, the above-mentioned functions defined in the system of the present application are executed.

[0181] It should be noted that the computer-readable medium shown in the present application may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. Computer-readable storage media may include, for example, but are not limited to electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or devices, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present application, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, device or device. In the present application, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, in which a computer-readable program code is carried. This propagated data signal may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Computer-readable signal media may also be any computer-readable medium other than computer-readable storage media, which may send, propagate or transmit a program for use by or in conjunction with an instruction execution system, apparatus or device. The program code contained on the computer-readable medium may be transmitted using any appropriate medium, including but not limited to: wireless, wire, optical cable, RF, etc., or any suitable combination of the above.

[0182] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present application. In this regard, each box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the above-mentioned module, program segment or a part of a code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flow chart, and the combination of the boxes in the block diagram or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0183] The units involved in the embodiments described in the present application may be implemented by software or hardware. The units described may also be set in a processor, for example, it may be described as: a processor includes a receiving unit, a data extraction unit, an abnormal score determination unit, and an interception unit. The names of these units do not constitute limitations on the units themselves in some cases.

[0184] As another aspect, the present application also provides a computer-readable medium, which may be included in the device described in the above embodiment; or it may exist independently without being assembled into the device. The above computer-readable medium carries one or more programs, and when the above one or more programs are executed by a device, the device receives an abnormal data identification request and obtains corresponding order data; extracts address data in the order data, and divides the address data based on a preset dimension to generate a dimensional address string; determines an abnormal score based on the dimensional address string and the abnormal branch string; and determines and intercepts abnormal order data in the order data based on the abnormal score.

[0185] According to the technical solution of the embodiment of the present application, the ability to identify abnormal order data can be improved, and the speed and accuracy of identifying abnormal order data can be increased.

[0186] The above specific implementations do not constitute a limitation on the protection scope of this application. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions may occur depending on design requirements and other factors. Any modifications, equivalent substitutions and improvements made within the spirit and principles of this application should be included in the protection scope of this application.

Claims

1. A method for identifying abnormal data, characterized in that: include: Receive abnormal data identification request and obtain corresponding order data; Extracting address data from the order data, and segmenting the address data based on a preset dimension to generate a dimensional address string; Determining an anomaly score according to the dimension address string and the anomaly branch string; Based on the anomaly score, abnormal order data in the order data is determined and intercepted.

2. The method according to claim 1, characterized in that Determining the anomaly score includes: Matching the dimension address string with each character string in the abnormal branch character string to determine the number of matched characters; The length of the abnormal branch character string is determined, and an abnormal score is determined based on the number of matched characters and the length.

3. The method according to claim 2, characterized in that The determining of anomaly scores according to the number of matched characters and the length includes: Calculating the ratio of the number of matched characters to the length to obtain respective scores; The largest score among the scores is determined as the abnormal score.

4. The method according to claim 1, characterized in that The segmenting of the address data based on a preset dimension to generate a dimensional address string includes: Based on the three-level address dimensions and the detailed address dimensions corresponding to the administrative area divisions, the address data is segmented to generate corresponding dimensional address strings.

5. The method according to claim 1, characterized in that Prior to determining the anomaly score, the method further includes: Obtain historical abnormal order data and extract corresponding abnormal address data; Determine the third-level addresses and the detailed addresses in the abnormal address data, and then construct an abnormal frequent pattern tree model corresponding to the detailed address according to each of the third-level addresses; Based on the abnormal frequent pattern tree model, an abnormal branch character string is determined.

6. The method according to claim 1, characterized in that The determining and intercepting abnormal order data in the order data based on the abnormality score includes: Determine the order data corresponding to the abnormality score greater than the preset threshold as abnormal order data; The abnormal order data is intercepted.

7. The method according to claim 1, characterized in that The extracting the address data from the order data includes: Eliminate virtual order data and offline store order data from the order data to obtain pre-processed data; Address data in the preprocessed data is extracted.

8. The method according to claim 1, characterized in that After determining and intercepting abnormal order data in the order data, the method further includes: The abnormal branch character string is updated based on the abnormal order data.

9. An abnormal data identification device, characterized in that: include: A receiving unit is configured to receive an abnormal data identification request and obtain corresponding order data; A data extraction unit is configured to extract address data from the order data, and segment the address data based on a preset dimension to generate a dimensional address string; an anomaly score determination unit, configured to determine an anomaly score according to the dimension address string and the anomaly branch string; The interception unit is configured to determine and intercept abnormal order data in the order data based on the abnormality score.

10. The device according to claim 9, characterized in that The anomaly score determination unit is further configured to: Matching the dimension address string with each character string in the abnormal branch character string to determine the number of matched characters; The length of the abnormal branch character string is determined, and an abnormal score is determined based on the number of matched characters and the length.

11. An electronic device for identifying abnormal data, characterized in that: include: one or more processors; a storage device for storing one or more programs, When the one or more programs are executed by the one or more processors, the one or more processors implement the method according to any one of claims 1 to 8.

12. A computer readable medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the method according to any one of claims 1 to 8 is implemented.

Images