Payment scene anomaly detection method and device, storage medium, electronic equipment and product

Abstract

The invention relates to the technical field of payment systems, and discloses a payment scene anomaly detection method and device, a storage medium, electronic equipment and a product. The method comprises the steps that in response to payment operation of a client, a detection request for the client is generated, the detection request is sent to the client, detection feedback information of the client is received, and the detection feedback information comprises current operation information of the client and a unique detection identifier; performing anomaly detection on the client based on the current operation information of the client and / or the response duration of the detection feedback information to obtain an anomaly detection result; and when the abnormity detection result is that abnormity exists, generating payment abnormity prompt information, and sending the payment abnormity prompt information to the client. Automatic anomaly detection of the client before payment is realized, the detection cost of the client is reduced, and the stability and reliability of a payment scene are improved.

Description

Technical Field

[0001] The present invention relates to the technical field of payment systems, and in particular to an abnormality detection method, device, storage medium, electronic equipment and product for payment scenarios. Background Art

[0002] With the popularity of digital payment methods and the increasing complexity of commercial transactions, the reliability and stability of payment systems are crucial.

[0003] One is to set up a traditional monitoring system to regularly check multiple indicators of the payment system. This method requires customers to purchase professional monitoring systems and software, which is costly. Another is that the cloud service provider's monitoring system can help customers monitor and manage the payment system deployed on the cloud. This method requires customers to purchase cloud vendor services, which is also costly. Summary of the invention

[0004] The present invention provides a payment scenario anomaly detection method, device, storage medium, electronic device and product, which realize automatic anomaly detection of payment scenarios, improve the stability and reliability of payment scenarios, and have low detection cost.

[0005] According to one aspect of the present invention, a payment scenario anomaly detection method is provided, which is applied to a server and includes:

[0006] In response to a payment operation of a client, generating a detection request to the client, and sending the detection request to the client, wherein the detection request includes a unique detection identifier;

[0007] Receiving detection feedback information from the client, the detection feedback information including current operation information of the client and the unique detection identifier;

[0008] Performing anomaly detection on the client based on the current operation information of the client and / or the response time of the detection feedback information to obtain an anomaly detection result, wherein the anomaly detection result includes one or more items of whether an anomaly exists and an anomaly type;

[0009] When the abnormality detection result indicates that an abnormality exists, payment abnormality prompt information is generated and sent to the client, wherein the payment abnormality prompt information includes the abnormality type.

[0010] Optionally, the client is configured with a payment service system, and the payment service system is configured with multiple routing components;

[0011] Sending the detection request to the client includes: sending the detection request to the multi-line routing component, so that the multi-line routing component obtains current operation information of the payment service system, and generates detection feedback information based on the current operation information.

[0012] Optionally, performing anomaly detection on the client based on current operating information of the client to obtain an anomaly detection result includes: comparing the current operating information with a preset information threshold to determine the anomaly detection result.

[0013] Optionally, the current operation information includes one or more of CPU occupancy information and memory occupancy information; the preset information threshold includes one or more of CPU occupancy threshold and memory occupancy threshold;

[0014] The abnormality detection result is obtained based on the comparison between the current running information and the preset information threshold, including: if the CPU occupancy information is greater than the CPU occupancy threshold, the abnormality detection result is that an abnormality exists, and the abnormality type is a load abnormality; and / or, if the memory occupancy information is greater than the memory occupancy threshold, the abnormality detection result is that an abnormality exists, and the abnormality type is a load abnormality.

[0015] Optionally, the detection request also includes a first timestamp; the detection feedback information also includes a second timestamp; and the response duration of the detection feedback information is determined based on a time difference between the second timestamp and the first timestamp;

[0016] Based on the response time of the detection feedback information, the client is detected for anomalies to obtain an anomaly detection result, including: if the response time of the detection feedback information is greater than a first response time threshold, then the anomaly detection result is determined to be an anomaly, and the anomaly type includes a network anomaly.

[0017] Optionally, the method also includes: if the detection feedback information is not received within the time range corresponding to the second response duration threshold after the first timestamp, determining that the abnormality detection result is an abnormality, and the abnormality type includes one or more of network abnormality and hardware failure.

[0018] Optionally, anomaly detection is performed on the client based on the response time of the detection feedback information to obtain an anomaly detection result, including: obtaining the response time of historical detection feedback information within a preset time period, and determining response fluctuation data within the preset time period based on the response time of the detection feedback information and the response time of historical detection feedback information; if the maximum value of the response fluctuation data within the preset time period is greater than a preset fluctuation threshold, then it is determined that the anomaly detection result is that an anomaly exists, and the anomaly type is abnormal fluctuation in response time.

[0019] Optionally, when the anomaly detection result is that an anomaly exists, it also includes: generating an anomaly log, the anomaly log including one or more of the anomaly time information, the anomaly type, the detection request, and the detection feedback information; generating an anomaly analysis report based on the anomaly log, and sending the anomaly analysis report to the client.

[0020] Optionally, the exception analysis report includes one or more of the cause of the exception, the frequency of occurrence of each exception type, the change trend of the client's operating information, and the change trend of the client's response time.

[0021] Optionally, the server is provided with a P5 component, and the detection request is sent to the client through the P5 component.

[0022] Optionally, the method further includes: initiating a payment request when the abnormality detection result is that there is no abnormality.

[0023] According to one aspect of the present invention, there is provided an abnormality detection device for a payment scenario, comprising:

[0024] A detection request sending module, used to generate a detection request to the client in response to a payment operation of the client, and send the detection request to the client, wherein the detection request includes a unique detection identifier;

[0025] A detection feedback information acquisition module, used to receive detection feedback information of the client, wherein the detection feedback information includes current operation information of the client and the unique detection identifier;

[0026] An anomaly detection module, used to perform an anomaly detection on the client based on the current operation information of the client and / or the response time of the detection feedback information, and obtain an anomaly detection result, wherein the anomaly detection result includes one or more of whether an anomaly exists and an anomaly type;

[0027] The exception handling module is used to generate payment exception prompt information when the exception detection result is an exception, and send the payment exception prompt information to the client, wherein the payment exception prompt information includes the exception type.

[0028] According to another aspect of the present invention, an electronic device is provided, the electronic device comprising:

[0029] at least one processor; and

[0030] a memory communicatively connected to the at least one processor; wherein,

[0031] The memory stores a computer program that can be executed by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the anomaly detection method for the payment scenario described in any embodiment of the present invention.

[0032] According to another aspect of the present invention, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the anomaly detection method for a payment scenario described in any embodiment of the present invention when executed.

[0033] According to another aspect of the present invention, a computer program product is provided, characterized in that the computer program product includes a computer program, and when the computer program is executed by a processor, the anomaly detection method for a payment scenario described in any embodiment of the present invention is implemented.

[0034] The technical solution of the embodiment of the present invention is to send a detection request to the client before initiating a payment request, obtain the detection feedback information fed back by the client, perform abnormal detection on the client through one or more of the current operation information in the detection feedback information and the response time of the detection feedback information, and when it is determined that the client is abnormal, it indicates that the client has a security risk in the payment scenario, cancels the response to the payment operation, and prompts the client for the abnormality. Further, the abnormality type determined by the abnormality detection is prompted to the client. Abnormal detection of the client is realized before payment, and the client does not need to purchase a third-party monitoring system, which reduces the cost of automatic detection of the client and improves the stability and reliability of the payment scenario.

[0035] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0037] Figure 1 This is a flow chart of an abnormality detection method for a payment scenario provided in Embodiment 1 of the present invention;

[0038] Figure 2 This is a flow chart of an abnormality detection method for a payment scenario provided in Embodiment 2 of the present invention;

[0039] Figure 3 It is a structural diagram of an abnormality detection device for a payment scenario provided in Embodiment 3 of the present invention;

[0040] Figure 4 It is a structural schematic diagram of an electronic device provided in Embodiment 4 of the present invention. DETAILED DESCRIPTION

[0041] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0042] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0043] The acquisition, storage and / or processing of data in the technical solutions involved in this application shall comply with the relevant provisions of national laws and regulations. It should be noted that in the embodiments of this application, some existing solutions in the industry such as certain software, components, models, etc. may be mentioned, which should be considered as exemplary, and their purpose is only to illustrate the feasibility of the implementation of the technical solutions of this application, but it does not mean that the applicant has or will necessarily use the solution.

[0044] Embodiment 1

[0045] Figure 1 It is a flowchart of an anomaly detection method for a payment scenario provided in Example 1 of the present invention. This embodiment can be adapted to the situation where anomaly detection is performed on a client before a payment request is executed in a payment scenario to ensure the stability and reliability of the payment process. The method can be executed by an anomaly detection device for a payment scenario. The anomaly detection device for the payment scenario can be implemented in the form of hardware and / or software. The anomaly detection device for the payment scenario can be configured in an electronic device provided in an embodiment of the present invention, which can be a server, etc.

[0046] The server is connected to multiple clients in communication, wherein the server is configured with a P5 component, which serves as an interface between the server and the client and is used to realize data transmission between the server and the client, such as sending a data request or a control instruction to the client through the P5 component, or receiving a data request or transmitting data transmitted by the client through the P5 component. The client is configured with a payment service system, which is used to complete relevant operations in the payment scenario. Multiple routing components are configured in the payment service system; the multiple routing components can be connected to multiple servers to realize data transmission between multiple servers in the payment scenario. It can be understood that the server can be the server of a financial institution, and correspondingly, the multiple servers can be the servers of different financial institutions. The client can be a personal client or an enterprise client, etc.

[0047] In order to ensure the stability and reliability of the payment scenario, the server performs anomaly detection on the client before responding to the payment request, realizing automatic detection of the client without manual intervention or the purchase of a third-party monitoring system, thus reducing costs. At the same time, through anomaly detection on the client, it can be ensured that the client is in a normal state during the payment process, ensuring the stability and reliability of the payment process.

[0048] Abnormal detection on the client can be understood as abnormal detection on the payment service system configured in the client. The client can include a physical device, which can be a mobile terminal such as a mobile phone and a tablet computer, a host or a host group, etc. The payment service system can be installed in the physical device, for example, the payment service system can include one or more virtual machines in the physical device.

[0049] like Figure 1 As shown, the method includes:

[0050] S110. In response to a payment operation of a client, generate a detection request for the client, and send the detection request to the client, wherein the detection request includes a unique detection identifier.

[0051] S120: Receive detection feedback information from the client, where the detection feedback information includes current operation information of the client and the unique detection identifier.

[0052] S130. Perform anomaly detection on the client based on the current operation information of the client and / or the response time of the detection feedback information to obtain an anomaly detection result, wherein the anomaly detection result includes one or more items of whether an anomaly exists and an anomaly type.

[0053] S140. When the abnormality detection result indicates that an abnormality exists, generate payment abnormality prompt information, and send the payment abnormality prompt information to the client, wherein the payment abnormality prompt information includes the abnormality type.

[0054] The user inputs a payment operation through the client, wherein the client can display a payment page, and the payment operation can be a click operation on a payment control on the payment page. Exemplarily, the payment page may include a payment object and payment data, and the payment page may also include payment controls such as "Confirm Payment". When the client detects a payment operation, it may generate a payment signal corresponding to the payment operation and send the payment signal to the server. The server receives the signal, and in order to ensure the stability and reliability of the payment process, before generating a payment request, it performs an anomaly detection on the client to obtain an anomaly detection result. When the anomaly detection result is that there is no anomaly, a payment request is generated and executed to complete the payment operation. When the anomaly detection result is that there is an anomaly, the payment request is canceled to avoid security risks during the payment process.

[0055] The server generates a probe request, which can be understood as a request to detect the client. Through the probe request, the client's current operation information can be requested from the client, and the client's response status to the probe request can also be obtained through the probe request. The client's current operation information and the client's response status to the probe request can reflect whether the client's overall operation status meets the execution conditions of the payment request.

[0056] The detection request includes a unique detection identifier, which is used to represent the current detection process of the client. The unique detection identifier may include one or more of numbers, letters, and characters. The form of the unique detection identifier is not limited here, and the detection request can be uniquely represented.

[0057] In this embodiment, in the payment scenario, anomaly detection is performed on the payment service system of the client. Accordingly, the server sending the detection request to the client can be understood as the server sending the detection request to the multi-line routing component in the payment service system of the client through the P5 component, so that the multi-line routing component obtains the current operation information of the payment service system and generates detection feedback information based on the current operation information.

[0058] The payment service system of the client responds to the detection request, reads the current operation information of the payment service system, and generates detection feedback information based on the current operation information of the payment service system. The detection feedback information can be in the form of an http message, which is not limited here. Specifically, the payment service system encapsulates the current operation information and the unique detection identifier in the detection request into the detection feedback information in the form of an http message, and transmits it to the server through multiple lines of routing components.

[0059] The server receives the detection feedback information sent by the client. It is understandable that the server can simultaneously perform abnormal detection on one or more clients. The server matches the unique detection identifier included in the detection feedback information with the unique detection identifier in the detection request to determine the corresponding relationship between the detection feedback information and the detection request.

[0060] The server parses the current operation information in the detection feedback information, and the current operation information in the detection feedback information is information that characterizes the current operation status of the payment service system; the response time of the detection feedback information can characterize the response status of the client to the detection request. In this embodiment, at least one detection item of the client is detected by one or more of the current operation information and the response time of the detection feedback information to obtain the abnormal detection result of the client, wherein the abnormal detection result may be the presence of an abnormality or the absence of an abnormality. Optionally, at least one detection item includes an operation information detection item, a response timeout detection item, a no response detection item, and a response time fluctuation detection item. The abnormal judgment condition of each of the above detection items is pre-set, and when any detection item meets the corresponding abnormal judgment condition, the abnormal detection result is determined to be the presence of an abnormality. Among them, the operation information detection item can be a detection of the current operation information, and the response timeout detection item, the no response detection item, and the response time fluctuation detection item can be a detection of the response time of the detection feedback information from different dimensions.

[0061] Optionally, the abnormality types corresponding to the detection items are pre-set, and each detection item may correspond to one or more abnormality types. When any detection item meets the corresponding abnormality determination condition, the abnormality type of the client is determined based on the abnormality type corresponding to the detection item that meets the abnormality determination condition. Exemplarily, the abnormality type corresponding to the operation information detection item may be a load abnormality, the abnormality type corresponding to the response timeout detection item may be a network abnormality, the abnormality type corresponding to the no response detection item may be a network abnormality or a hardware failure, and the abnormality type corresponding to the response time fluctuation detection item may be an abnormal fluctuation in the response time. It can be understood that the correspondence between the detection items and the abnormality types can be determined based on the historical abnormality analysis results of the client, and the above correspondence can be updated as needed to improve the accuracy of the abnormality type.

[0062] Optionally, the current operation information includes one or more of CPU occupancy information and memory occupancy information. CPU occupancy information can be understood as a measure of the amount of time the CPU spends executing various tasks and processes. The CPU occupancy information can be calculated by 1-idle time / total CPU time. The CPU occupancy information is data between 1-100%. The larger the CPU occupancy information, the greater the load. Memory occupancy information can be understood as the proportion of physical memory in use in the payment business system to the total available memory. The larger the memory occupancy information, the less available memory.

[0063] Optionally, an abnormality detection is performed on the client based on the current operation information of the client to obtain an abnormality detection result, including: determining the abnormality detection result based on a comparison between the current operation information and a preset information threshold. The preset information threshold can be understood as data for abnormal determination of the current operation information. The preset information threshold can be determined according to the type of current operation information, and different current operation information can correspond to different preset information thresholds. The preset information threshold can be determined based on the detection requirements for the client, for example, based on the operation information of the client required for the payment process. In the case where the current operation information includes CPU occupancy information and memory occupancy information, any one of the CPU occupancy information and the memory occupancy information exceeds the corresponding preset information threshold, indicating that the current operation state of the client cannot meet the execution conditions of the payment request.

[0064] In this embodiment, a CPU occupancy rate threshold is set for the CPU occupancy rate information in the current operation information, and a memory occupancy rate threshold is set for the memory occupancy rate information in the current operation information, and the CPU occupancy rate information and the memory occupancy rate information are detected respectively. Specifically, if the CPU occupancy rate information is greater than the CPU occupancy rate threshold, the abnormality detection result is that an abnormality exists; and if the memory occupancy rate information is greater than the memory occupancy rate threshold, the abnormality detection result is that an abnormality exists.

[0065] When the CPU usage information is greater than the CPU usage threshold and / or the memory usage information is greater than the memory usage threshold, that is, the operation information detection item meets the corresponding abnormal judgment condition, indicating that the client's payment business system load is too high. Excessive load may cause the payment business system to respond slowly or be unable to process requests. Therefore, the abnormality type can be determined as a load abnormality.

[0066] On the basis of the above embodiment, the running state of the client also includes the response state of the client to the detection request. The faster the client responds to the detection request, the better the running state of the client is. Conversely, the slower the client responds to the detection request, the worse the running state of the client is. The response state of the client to the detection request can be characterized by the response duration of the detection feedback information. The shorter the response duration of the detection feedback information, the faster the client responds to the detection request, and the better the response state of the client. The response duration of the detection feedback information can be determined by the time information corresponding to the server sending the detection request and the time information corresponding to the detection feedback information. The time information corresponding to the detection feedback information can be the time information when the client sends the detection feedback information, or it can also be the time information when the server receives the detection feedback information.

[0067] Optionally, the detection request also includes a first timestamp; the detection feedback information also includes a second timestamp; the first timestamp may represent the sending time information of the detection request, and the second timestamp may represent the time information when the client sends the detection feedback information. The response duration of the detection feedback information is determined based on the time difference between the second timestamp and the first timestamp, for example, the time difference between the second timestamp and the first timestamp is determined as the response duration of the detection feedback information.

[0068] Accordingly, the client is detected for abnormality based on the response time of the detection feedback information to obtain an abnormality detection result, including: if the response time of the detection feedback information is greater than the first response time threshold, indicating that the client responds slowly to the detection request and cannot meet the execution conditions of the payment scenario, then the abnormality detection result is determined to be abnormal. Exemplarily, the first response time threshold may be 500ms.

[0069] The response duration of the detection feedback information is greater than the first response duration threshold, that is, the response timeout detection item meets the corresponding abnormality determination condition, and it can be determined that the abnormality type includes a network abnormality.

[0070] Based on the above embodiment, the detection process of the unresponsive detection item may be: if the detection feedback information is not received within the time range corresponding to the second response duration threshold after the first timestamp, the abnormal detection result is determined to be an abnormality, and the abnormality type includes one or more of network abnormality and hardware failure.

[0071] Timing is performed when a detection request is sent to the client. The timing duration for receiving the detection feedback information is determined. If the timing duration for receiving the detection feedback information is less than the second response duration threshold, it indicates that the client can respond to the detection request, that is, the no-response detection item does not meet the corresponding abnormality judgment condition. The timing duration for receiving the detection feedback information reaches the second response duration threshold, and the detection feedback information sent by the client is not received, indicating that the client has no response to the detection request, that is, the no-response detection item meets the corresponding abnormality judgment condition. It can be determined that the abnormal detection result is an abnormality, as well as the corresponding abnormality type. Exemplarily, the second response duration threshold can be 3s.

[0072] On the basis of the above-mentioned embodiments, the response duration of the detection feedback information can characterize the response status of the client to the detection request. The response duration of a single detection feedback information has a certain degree of randomness, and the response status of the client to the detection request can be comprehensively determined by the response duration of multiple detection feedback information, that is, the fluctuation of the client's response to the detection request. Among them, the greater the fluctuation of the client's response to the detection request, the more unstable the client network is, and the smaller the fluctuation of the client's response to the detection request, the more stable the client network is. In order to ensure the stability of the payment scenario, the fluctuation detection item of the response duration is detected to avoid the impact of network instability on the payment scenario.

[0073] Optionally, the detection process of the response time fluctuation detection item may be: obtaining the response time of historical detection feedback information within a preset time period, and determining the response fluctuation data within the preset time period based on the response time of the detection feedback information and the response time of historical detection feedback information; if the maximum value of the response fluctuation data within the preset time period is greater than a preset fluctuation threshold, then determining that the abnormal detection result is an abnormality, and the abnormality type is abnormal fluctuation in response time.

[0074] The preset time period can be one day or one hour, etc. The response fluctuation data of the client within the preset time period is determined by the response time of the historical detection feedback information within the preset time period. Optionally, the response time of the historical detection feedback information within the preset time period is sorted according to the timestamp of the historical detection feedback information, and the time difference between the response time of adjacent historical detection feedback information is obtained, and multiple time differences are formed into the response fluctuation data within the preset time period. Each time difference can represent the fluctuation of the network state during the two detections of the client. The larger the time difference, the greater the fluctuation of the network state. The maximum value is determined in the response fluctuation data, and the maximum value in the response fluctuation data is compared based on the preset fluctuation threshold. The maximum value in the response fluctuation data is greater than the preset fluctuation threshold, indicating that the client's network has abnormal fluctuations, that is, the abnormal detection result is that there is an abnormality. The maximum value in the response fluctuation data is less than or equal to the preset fluctuation threshold, indicating that the client's network fluctuation is small, and the client's network state can meet the execution conditions of the payment scenario, and the abnormal detection result is determined to be that there is no abnormality.

[0075] Optionally, the response fluctuation data within the preset time period is formed based on the time difference between any two response durations of the response durations of the historical detection feedback information within the preset time period. For example, the time difference between the maximum response duration and the minimum response duration in the response durations of the historical detection feedback information within the preset time period is taken as the maximum value in the response fluctuation data, and the maximum value in the response fluctuation data is compared based on a preset fluctuation threshold. If the maximum value in the response fluctuation data is greater than the preset fluctuation threshold, it indicates that there is abnormal fluctuation in the client's network, that is, the abnormal detection result is that there is an abnormality.

[0076] On the basis of the above embodiment, by detecting multiple detection items separately, when any detection item meets the corresponding abnormality judgment condition, the abnormality detection result of the client is determined to be that an abnormality exists; when multiple detection items do not meet the abnormality judgment condition, the abnormality detection result of the client is determined to be that no abnormality exists.

[0077] When the anomaly detection result shows that an anomaly exists, payment anomaly prompt information is generated based on the anomaly identifier and the identified anomaly type, and the payment anomaly prompt information is sent to the client for display. For example, the payment anomaly prompt information may be displayed to the client's operation and maintenance personnel so that the operation and maintenance personnel can repair or adjust the cause of the client's anomaly.

[0078] When the anomaly detection result is that there is no anomaly, a payment request is generated and sent to the client, so that the payment service system of the client executes the payment request and completes the payment task.

[0079] The technical solution provided by the embodiment of the present invention sends a detection request to the client before initiating a payment request, obtains the detection feedback information fed back by the client, performs abnormal detection on the client through one or more of the current operation information in the detection feedback information and the response time of the detection feedback information, and when it is determined that the client is abnormal, it indicates that the client has a security risk in the payment scenario, cancels the response to the payment operation, and prompts the client for the abnormality. Further, the abnormality type determined by the abnormality detection is prompted to the client. Abnormal detection of the client is realized before payment, and the client does not need to purchase a third-party monitoring system, which reduces the cost of automatic detection of the client and improves the stability and reliability of the payment scenario.

[0080] Embodiment 2

[0081] Figure 2 It is a flowchart of an abnormality detection method for a payment scenario provided by an embodiment of the present invention, and the method specifically includes: before initiating a payment request, a detection request is sent to a multi-line routing component of a client through a P5 component, and the detection request includes a unique detection identifier and a first timestamp. If the detection feedback information sent by the multi-line routing component is not received within the time range corresponding to the second response time threshold, that is, the multi-line routing component does not respond to the detection request within the time range corresponding to the second response time threshold, it is determined that the abnormal detection information is abnormal, and abnormal prompt information is generated.

[0082] When detection feedback information sent by a multi-line routing component is received within a time range corresponding to a second response time threshold, that is, when the multi-line routing component responds to the detection request within a time range corresponding to the second response time threshold, the detection feedback information is parsed, and the detection feedback information includes current operation information and a second timestamp. The detection feedback information can be sent in the form of an http message or in the form of a response data packet.

[0083] The current operation information includes CPU occupancy information and memory occupancy information. When the CPU occupancy information is greater than a CPU occupancy threshold and / or the memory occupancy information is greater than a memory occupancy threshold, it is determined that the abnormality detection information is abnormal, and abnormality prompt information is generated;

[0084] The response time of the detection feedback information is determined based on the second timestamp and the first timestamp. When the response time of the detection feedback information is greater than the first response time threshold, the abnormal detection information is determined to be abnormal, and abnormal prompt information is generated.

[0085] Determine the response fluctuation data of the response time of multiple detection feedback information within the historical time period. When the maximum value in the response fluctuation data is greater than the preset fluctuation threshold, determine that the abnormal detection information is abnormal and generate abnormal prompt information.

[0086] When detection feedback information sent by the multi-line routing component is received within the time range corresponding to the second response time threshold, and when the CPU occupancy information is less than or equal to the CPU occupancy threshold, the memory occupancy information is less than or equal to the memory occupancy threshold, the response time of the detection feedback information is less than or equal to the first response time threshold, and the response fluctuation data of the response time of the detection feedback information within the preset time period is less than the preset fluctuation threshold, it is determined that the abnormality detection information does not contain any abnormality, a payment request is generated, and the payment request is sent to the multi-line routing component of the client to execute the payment request.

[0087] When the anomaly detection result is that an anomaly exists, it also includes: generating an anomaly log, the anomaly log including one or more of the anomaly time information, the anomaly type, the detection request, and the detection feedback information; generating an anomaly analysis report based on the anomaly log, and sending the anomaly analysis report to the client.

[0088] The abnormal time information may be the first timestamp or the second timestamp. By generating an abnormal log, the abnormal situation of the client is recorded, which is convenient for subsequent query and analysis of the running status of the client.

[0089] Optionally, a log analysis model is pre-set, and the log analysis model may be a pre-trained neural network model, which can be used to analyze the abnormal log and obtain the abnormal analysis report of the client. Specifically, the abnormal log is input into the log analysis model to obtain the abnormal analysis report output by the log analysis model. The abnormal log here can be the abnormal log generated by the current detection process, or the abnormal log within a preset time period.

[0090] Optionally, abnormal log analysis items and analysis rules corresponding to each abnormal log analysis item are pre-set, and the abnormal log is analyzed based on the analysis rules corresponding to each abnormal log analysis item to obtain the analysis results corresponding to each abnormal log analysis item. The analysis results corresponding to multiple abnormal log analysis items form an abnormal analysis report for the client.

[0091] Among them, the abnormal analysis report includes one or more of the abnormal cause, the occurrence frequency of each of the abnormal types, the change trend of the client's operating information, and the change trend of the client's response time. Each abnormal type may correspond to one or more abnormal causes, and the correspondence between the abnormal type and the abnormal cause is pre-set, and the abnormal cause corresponding to the abnormal type is determined according to the identified abnormal type. For example, the abnormal cause corresponding to the load abnormality may include one or more of too many concurrent requests and memory leaks. The abnormal cause corresponding to the network abnormality may include a network link failure. The abnormal cause corresponding to the hardware failure may include one or more of server downtime and hardware device damage. The abnormal cause corresponding to the abnormal fluctuation in response time may include one or more of network jitter and system internal resource contention.

[0092] The frequency of occurrence of an exception type can be understood as the frequency and number of occurrences of the exception type within the statistical time range. The statistical time range can be multiple, such as one hour, one day, one week, one month, or one year. The frequency of occurrence of each exception type is counted through different statistical time ranges to provide data references of different dimensions for the client.

[0093] The change trend of the client's operation information can be the change trend of the operation information obtained over time during different detection processes within the statistical time range, for example, it can be displayed in the form of a chart or the like. The change trend of the client's response time can be the change trend of the response time of the detection feedback information during different detection processes within the statistical time range, for example, it can be displayed in the form of a chart or the like. Similarly, the statistical time range this time is one or more determined according to statistical requirements.

[0094] In this embodiment, an exception analysis is performed on the client to obtain an exception analysis report, which is transmitted to the client to provide a basis for the client to modify the exception.

[0095] Figure 3 Schematic diagram of the structure of an abnormality detection device for a payment scenario provided by Embodiment 3 of the present invention. Figure 3 As shown, the device comprises:

[0096] A detection request sending module 310, for generating a detection request to the client in response to a payment operation of the client, and sending the detection request to the client, wherein the detection request includes a unique detection identifier;

[0097] A detection feedback information acquisition module 320, configured to receive detection feedback information from the client, wherein the detection feedback information includes current operation information of the client and the unique detection identifier;

[0098] An anomaly detection module 330 is used to perform an anomaly detection on the client based on the current operation information of the client and / or the response time of the detection feedback information to obtain an anomaly detection result, wherein the anomaly detection result includes one or more of whether an anomaly exists and an anomaly type;

[0099] The exception handling module 340 is used to generate payment exception prompt information when the exception detection result shows that an exception exists, and send the payment exception prompt information to the client, wherein the payment exception prompt information includes the exception type.

[0100] Based on the above embodiment, optionally, the client is configured with a payment service system, and the payment service system is configured with multiple routing components;

[0101] The detection request sending module 310 is used to send the detection request to the multi-line routing component, so that the multi-line routing component obtains the current operation information of the payment service system and generates detection feedback information based on the current operation information.

[0102] Based on the above embodiment, optionally, the anomaly detection module 330 is used to determine the anomaly detection result based on the comparison between the current operation information and a preset information threshold.

[0103] Optionally, the current operation information includes one or more of CPU occupancy information and memory occupancy information; the preset information threshold includes one or more of CPU occupancy threshold and memory occupancy threshold;

[0104] Optionally, the anomaly detection module 330 is also used to, if the CPU occupancy information is greater than the CPU occupancy threshold, then the anomaly detection result is that an anomaly exists, and the anomaly type is a load anomaly; and / or, if the memory occupancy information is greater than the memory occupancy threshold, then the anomaly detection result is that an anomaly exists, and the anomaly type is a load anomaly.

[0105] Optionally, the detection request also includes a first timestamp; the detection feedback information also includes a second timestamp; and the response duration of the detection feedback information is determined based on a time difference between the second timestamp and the first timestamp;

[0106] The anomaly detection module 330 is also used to determine that the anomaly detection result is anomaly, and the anomaly type includes network anomaly, if the response time of the detection feedback information is greater than the first response time threshold.

[0107] Optionally, the anomaly detection module 330 is also used to: if the detection feedback information is not received within the time range corresponding to the second response duration threshold after the first timestamp, determine that the anomaly detection result is an anomaly, and the anomaly type includes one or more of a network anomaly and a hardware failure.

[0108] Optionally, the anomaly detection module 330 is also used to: obtain the response time of historical detection feedback information within a preset time period, and determine the response fluctuation data within the preset time period based on the response time of the detection feedback information and the response time of historical detection feedback information; if the maximum value of the response fluctuation data within the preset time period is greater than a preset fluctuation threshold, then it is determined that the anomaly detection result is an abnormality, and the anomaly type is abnormal fluctuation in response time.

[0109] Based on the above embodiment, optionally, the exception handling module 340 is also used to: generate an exception log, the exception log including one or more of the exception time information, the exception type, the detection request, and the detection feedback information; generate an exception analysis report based on the exception log, and send the exception analysis report to the client.

[0110] Optionally, the exception analysis report includes one or more of the cause of the exception, the frequency of occurrence of each exception type, the change trend of the client's operating information, and the change trend of the client's response time.

[0111] Optionally, the server is provided with a P5 component, and the detection request is sent to the client through the P5 component.

[0112] Optionally, the exception handling module 340 is further configured to initiate a payment request when the exception detection result is that there is no exception.

[0113] The anomaly detection device for payment scenarios provided in the embodiments of the present invention can execute the anomaly detection method for payment scenarios provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0114] Embodiment 4

[0115] Figure 41 is a schematic diagram of the structure of an electronic device provided in Embodiment 4 of the present invention. The electronic device 10 is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device may also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.

[0116] like Figure 4 As shown, the electronic device 10 includes at least one processor 11, and a memory connected to the at least one processor 11, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 11 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 12 or the computer program loaded from the storage unit 18 to the random access memory (RAM) 13. In the RAM 13, various programs and data required for the operation of the electronic device 10 can also be stored. The processor 11, the ROM 12, and the RAM 13 are connected to each other through a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0117] A number of components in the electronic device 10 are connected to the I / O interface 15, including: an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a disk, an optical disk, etc.; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0118] The processor 11 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any appropriate processor, controller, microcontroller, etc. The processor 11 executes the various methods and processes described above, such as an anomaly detection method for a payment scenario.

[0119] In some embodiments, the anomaly detection method for payment scenarios may be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 10 via the ROM 12 and / or the communication unit 19. When the computer program is loaded into the RAM 13 and executed by the processor 11, one or more steps of the anomaly detection method for payment scenarios described above may be performed. Alternatively, in other embodiments, the processor 11 may be configured to execute the anomaly detection method for payment scenarios in any other appropriate manner (e.g., by means of firmware).

[0120] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0121] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer program is executed by the processor, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer program may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0122] Embodiment 5

[0123] Embodiment 5 of the present invention further provides a computer-readable storage medium, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to execute a method for detecting anomalies in a payment scenario, the method comprising:

[0124] In response to a payment operation of a client, a detection request for the client is generated, and the detection request is sent to the client, wherein the detection request includes a unique detection identifier; detection feedback information of the client is received, and the detection feedback information includes current operation information of the client and the unique detection identifier; an anomaly detection is performed on the client based on the current operation information of the client and / or the response time of the detection feedback information to obtain an anomaly detection result, wherein the anomaly detection result includes one or more of whether an anomaly exists and the type of anomaly; when the anomaly detection result is that an anomaly exists, payment anomaly prompt information is generated, and the payment anomaly prompt information is sent to the client, wherein the payment anomaly prompt information includes the type of anomaly.

[0125] In the context of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in combination with an instruction execution system, device or equipment. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0126] To provide interaction with a user, the systems and techniques described herein may be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).

[0127] The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0128] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The client and server relationship is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services.

[0129] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

[0130] Embodiment 6

[0131] Embodiment 6 of the present invention further provides a computer program product, including a computer program, which, when executed by a processor, implements the anomaly detection method for a payment scenario according to any embodiment of the present invention.

[0132] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A payment scenario anomaly detection method, characterized in that: Applied to the server, including: In response to a payment operation of a client, generating a detection request to the client, and sending the detection request to the client, wherein the detection request includes a unique detection identifier; Receiving detection feedback information from the client, the detection feedback information including current operation information of the client and the unique detection identifier; Performing anomaly detection on the client based on the current operation information of the client and / or the response time of the detection feedback information to obtain an anomaly detection result, wherein the anomaly detection result includes one or more items of whether an anomaly exists and an anomaly type; When the abnormality detection result indicates that an abnormality exists, payment abnormality prompt information is generated and sent to the client, wherein the payment abnormality prompt information includes the abnormality type.

2. The method according to claim 1, characterized in that The client is configured with a payment service system, and the payment service system is configured with multiple routing components; Sending the probe request to the client includes: The detection request is sent to the multi-line routing component, so that the multi-line routing component obtains current operation information of the payment service system and generates detection feedback information based on the current operation information.

3. The method according to claim 1, characterized in that The performing anomaly detection on the client based on the current operation information of the client to obtain an anomaly detection result includes: The abnormality detection result is determined based on a comparison between the current operation information and a preset information threshold.

4. The method according to claim 3, characterized in that The current operation information includes one or more of CPU occupancy information and memory occupancy information; the preset information threshold includes one or more of CPU occupancy threshold and memory occupancy threshold; The comparing the current operation information with the preset information threshold to obtain the abnormality detection result includes: If the CPU occupancy rate information is greater than the CPU occupancy rate threshold, the abnormality detection result is that an abnormality exists, and the abnormality type is a load abnormality; and / or, If the memory occupancy rate information is greater than the memory occupancy rate threshold, the abnormality detection result is that an abnormality exists, and the abnormality type is a load abnormality.

5. The method according to claim 1, characterized in that The detection request also includes a first timestamp; the detection feedback information also includes a second timestamp; The response duration of the detection feedback information is determined based on the time difference between the second timestamp and the first timestamp; Performing anomaly detection on the client based on the response time of the detection feedback information to obtain anomaly detection results, including: If the response time of the detection feedback information is greater than the first response time threshold, it is determined that the abnormality detection result is abnormal, and the abnormality type includes network abnormality.

6. The method according to claim 5, characterized in that The method further comprises: If the detection feedback information is not received within the time range corresponding to the second response duration threshold after the first timestamp, it is determined that the abnormality detection result is abnormal, and the abnormality type includes one or more of network abnormality and hardware failure.

7. The method according to claim 1, characterized in that Performing anomaly detection on the client based on the response time of the detection feedback information to obtain anomaly detection results, including: Obtaining the response duration of historical detection feedback information within a preset time period, and determining the response fluctuation data within the preset time period based on the response duration of the detection feedback information and the response duration of historical detection feedback information; If the maximum value of the response fluctuation data within the preset time period is greater than the preset fluctuation threshold, it is determined that the abnormality detection result is abnormal, and the abnormality type is abnormal fluctuation of response duration.

8. The method according to claim 1, characterized in that When the abnormality detection result is that an abnormality exists, the method further includes: Generate an exception log, wherein the exception log includes one or more of the exception time information, the exception type, the detection request, and the detection feedback information; An exception analysis report is generated based on the exception log, and the exception analysis report is sent to the client.

9. The method according to claim 8, characterized in that The abnormality analysis report includes one or more of the abnormality cause, the occurrence frequency of each abnormality type, the change trend of the client's operation information, and the change trend of the client's response time.

10. The method according to claim 1, characterized in that The server is provided with a P5 component, and the detection request is sent to the client through the P5 component.

11. The method according to claim 1, characterized in that: The method further comprises: When the abnormality detection result is that there is no abnormality, a payment request is initiated.

12. An abnormality detection device for a payment scenario, characterized in that: include: A detection request sending module, used to generate a detection request to the client in response to a payment operation of the client, and send the detection request to the client, wherein the detection request includes a unique detection identifier; A detection feedback information acquisition module, used to receive detection feedback information of the client, wherein the detection feedback information includes current operation information of the client and the unique detection identifier; An anomaly detection module, used to perform an anomaly detection on the client based on the current operation information of the client and / or the response time of the detection feedback information, and obtain an anomaly detection result, wherein the anomaly detection result includes one or more of whether an anomaly exists and an anomaly type; The exception handling module is used to generate payment exception prompt information when the exception detection result is an exception, and send the payment exception prompt information to the client, wherein the payment exception prompt information includes the exception type.

13. An electronic device, characterized in that: The electronic device comprises: at least one processor; and a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the anomaly detection method for the payment scenario described in any one of claims 1-11.

14. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the anomaly detection method for a payment scenario according to any one of claims 1 to 11 when executed.

15. A computer program product, characterized in that The computer program product comprises a computer program, which, when executed by a processor, implements the anomaly detection method for a payment scenario according to any one of claims 1 to 11.

Images