Index data query method, device and equipment

Abstract

The invention discloses an index data query method, device and equipment, based on a query task and a corresponding target cost model, a data partition corresponding to the query task is obtained, and the query task comprises a to-be-queried index and a to-be-queried workload; calculating a data range involved by the query task in the data partition according to the partition index of the data partition; and accessing a physical address space corresponding to the data range, and obtaining target index data of the to-be-queried index under the to-be-queried workload. Therefore, based on a machine learning algorithm, the index structure suitable for the query scene of the index data is constructed, for the index data query task, the target index data of the to-be-queried index can be quickly queried by means of the trained target cost model and the index set, and the query efficiency of the index data is effectively improved.

Description

Technical Field

[0001] The present application relates to the field of data processing technology, and in particular to a method, device and equipment for querying indicator data. Background Art

[0002] In today's Internet development, many indicator data are defined and used. With the increasing number of indicator types and the increase in query complexity, the storage and query methods of indicator data also need more reasonable design.

[0003] For platforms such as anti-fraud, data query is an important part of the system. Query efficiency is the key to the platform's real-time response and further adaptive behavior. It is particularly important to help the platform reduce the response delay of query scenarios through more efficient data query methods. At present, after the real-time indicators are calculated, a large number of subdivisions need to be made from the scene, rule and indicator levels in turn. The real-time indicator calculation requires filtering and querying a large amount of indicator data. When the number of query indicator sets corresponding to the rules is too large, it may cause query timeouts, thereby delaying the timing of further adaptive behavior (such as the best warning time).

[0004] Therefore, it is urgent to design a solution that can perform fast and reasonable queries on indicator data. Summary of the invention

[0005] In order to solve the above technical problems, the present application provides a method, device and equipment for querying indicator data, which can realize fast and efficient query of indicator data on the basis of reasonable storage of indicator data.

[0006] In order to achieve the above objectives, the technical solutions provided by this application are as follows:

[0007] In a first aspect, the present application provides a method for querying indicator data, comprising:

[0008] Based on the query task and the corresponding target cost model, the data partition corresponding to the query task is obtained, wherein the query task includes an indicator to be queried and a workload to be queried, and the target cost model is obtained based on historical indicator data, historical workload and initial data distribution training, wherein the historical indicator data corresponds to the indicator to be queried, and the historical workload corresponds to the workload to be queried;

[0009] According to the partition index of the data partition, the data range involved in the query task in the data partition is calculated, the partition index is determined by an index set, and the index set is obtained by fitting the indicator to be queried in the data partition;

[0010] Access the physical address space corresponding to the data range to obtain target indicator data of the indicator to be queried under the workload to be found.

[0011] Optionally, the query task further includes a query condition, and the method further includes:

[0012] Based on the query condition, the target indicator data is filtered to update the target indicator data.

[0013] Optionally, the method is applied to an anti-fraud platform, and the method further includes:

[0014] Based on the target indicator data and the decision-making strategy of the anti-fraud platform, a warning result of the query task is determined, and the warning result is used to indicate whether the target indicator data indicates a fraudulent transaction.

[0015] Optionally, the method further comprises:

[0016] Building a grid index according to the optimal data distribution in the target cost model, and dividing the storage space into a plurality of data partitions according to the grid index;

[0017] Corresponding the indicator data to be stored to each data partition in the multiple data partitions respectively;

[0018] In each of the multiple data partitions, the index data to be stored in the data partition is sorted from low to high according to the index ranked first, and stored according to the sorting result;

[0019] In each data partition of the multiple data partitions, curve fitting is performed on the indicator data in the data partition according to the dimensions of different indicators to obtain an index set of different indicators in the data partition.

[0020] Optionally, the target cost model is expressed as: Cost(D,Q,L)=ω P t P +ω R t R +ω S t S , where Q is the workload, D is the indicator data, L is the data distribution, ω P t P represents the mapping time, t P It represents the average grid index lookup cost of the workload under the current data distribution, ω R t R refers to the internal index time, which represents the internal index cost when the query is mapped to a single data grid, t R represents the average internal indexing time of the workload under the current data distribution, ω St S is the filtering time, t S represents the average data filtering cost of the workload under the current data distribution, ω P ,ω R and ω S are all learning parameters.

[0021] Optionally, the index set is expressed as: Among them, a i represents the parameters obtained by fitting, c j Indicates the number of columns of the grid index constructed by the (d-1) indices other than index j among the d indices.

[0022] In a second aspect, the present application also provides a device for querying indicator data, which is characterized by comprising:

[0023] A first obtaining unit is configured to obtain a data partition corresponding to a query task based on a query task and a corresponding target cost model, wherein the query task includes an indicator to be queried and a workload to be queried, and the target cost model is obtained by training based on historical indicator data, historical workload, and initial data distribution, wherein the historical indicator data corresponds to the indicator to be queried, and the historical workload corresponds to the workload to be queried;

[0024] a calculation unit, configured to calculate a data range involved in the query task in the data partition according to a partition index of the data partition, wherein the partition index is determined by an index set, and the index set is obtained by fitting the indicator to be queried in the data partition;

[0025] The second obtaining unit is used to access the physical address space corresponding to the data range to obtain the target indicator data of the indicator to be queried under the workload to be found.

[0026] Optionally, the query task further includes a query condition, and the device further includes:

[0027] A filtering unit is used to filter the target indicator data based on the query condition to update the target indicator data.

[0028] Optionally, the device is applied to an anti-fraud platform, and the device further includes:

[0029] A determination unit is used to determine a warning result of the query task based on the target indicator data and a decision-making strategy of the anti-fraud platform, wherein the warning result is used to indicate whether the target indicator data indicates a fraudulent transaction.

[0030] Optionally, the device further comprises:

[0031] A construction unit, configured to construct a grid index according to the optimal data distribution in the target cost model, and divide the storage space into a plurality of data partitions according to the grid index;

[0032] A partitioning unit, used to correspond the indicator data to be stored to each data partition in the plurality of data partitions;

[0033] A storage unit, used for sorting the index data to be stored in each data partition of the plurality of data partitions from low to high values ​​according to the index ranked first, and storing the index data according to the sorting result;

[0034] The index unit is used to perform curve fitting on the index data in each data partition of the multiple data partitions according to the dimensions of different indicators to obtain an index set of different indicators in the data partition.

[0035] Optionally, the target cost model is expressed as: Cost(D,Q,L)=ω P t P +ω R t R +ω S t S , where Q is the workload, D is the indicator data, L is the data distribution, ω P t P represents the mapping time, t P It represents the average grid index lookup cost of the workload under the current data distribution, ω R t R refers to the internal index time, which represents the internal index cost when the query is mapped to a single data grid, t R represents the average internal indexing time of the workload under the current data distribution, ω S t S is the filtering time, t S represents the average data filtering cost of the workload under the current data distribution, ω P ,ω R and ω S are all learning parameters.

[0036] Optionally, the index set is expressed as: Among them, a i represents the parameters obtained by fitting, c j Indicates the number of columns of the grid index constructed by the (d-1) indices other than index j among the d indices.

[0037] It should be noted that the specific implementation method of the device and the technical effects achieved can refer to the relevant description of the method provided in the first aspect or any implementation method of the first aspect.

[0038] In a third aspect, the present application further provides an electronic device, the electronic device comprising: a processor and a memory;

[0039] The memory is used to store instructions or programs;

[0040] The processor is used to execute the instructions or programs in the memory so that the electronic device executes the method provided by the first aspect or any one of the implementations of the first aspect.

[0041] In a fourth aspect, the present application further provides a readable medium, in which instructions or programs are stored. When the instructions or programs are executed on a processor, the processor executes the method provided by the first aspect or any one of the implementations of the first aspect.

[0042] Compared with the prior art, the embodiments of the present application have at least the following advantages:

[0043] In the technical solution provided by the present application, a method for querying index data is provided, which method may include: first, based on the query task and the corresponding target cost model, obtain the data partition corresponding to the query task, wherein the query task includes the index to be queried and the workload to be queried, the target cost model is obtained based on the historical index data, the historical workload and the initial data distribution training, the historical index data corresponds to the index to be queried, and the historical workload corresponds to the workload to be queried; then, according to the partition index of the data partition, calculate the data range involved in the query task in the data partition, the partition index is determined by the index set, and the index set is obtained by fitting the index to be queried in the data partition; then, access the physical address space corresponding to the data range to obtain the target index data of the index to be queried under the workload to be found. In this way, based on the machine learning algorithm, an index structure suitable for the query scenario of index data is constructed, and for the index data query task, the target index data of the index to be queried can be quickly queried with the help of the trained target cost model and the index set, which effectively improves the query efficiency of the index data, and provides a high real-time data basis for the subsequent further adaptive behavior. In platforms such as anti-fraud, it makes it possible to identify fraudulent transactions faster and reduce the property loss of users. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0045] Figure 1 This is a flow chart of a current anti-fraud monitoring and early warning model;

[0046] Figure 2 A flowchart of a method for querying indicator data provided in an embodiment of the present application;

[0047] Figure 3 A schematic diagram of a flow chart of an example of a method provided in an embodiment of the present application;

[0048] Figure 4 A schematic diagram of the structure of an indicator data query device 400 provided in an embodiment of the present application;

[0049] Figure 5 A schematic diagram of the structure of an electronic device 500 provided in an embodiment of the present application. DETAILED DESCRIPTION

[0050] As the business expands, many indicator data types are defined, among which spatial data such as transaction locations and device Internet Protocol (IP) addresses are used to enhance the ability to monitor fraudulent behavior, such as abnormal user logins, transaction location verification, device monitoring, etc. However, with the increasing number of indicator types and the increase in query complexity, the storage and query methods of indicator data also need to be more reasonably designed.

[0051] At present, commonly used index structures such as dictionary trees, B-trees, hash tables, and Bloom filters organize data by designing sophisticated data structures and constructing unique query algorithms for querying. However, when data needs to be filtered from multiple attributes, querying a single-key index will cause too high a query cardinality, resulting in too high a query latency. For the above problem, the solution is to further reduce the data range through multi-level indexes, but this solution will increase the storage burden of the index itself and the complexity of index maintenance. At this time, full table scan may be a more appropriate solution. In order to solve the above problems, spatial indexes came into being, such as kd trees, R trees, and octrees.

[0052] Today, with the prosperity and development of the Internet, as social networks become popular, new fraud security issues continue to emerge. They spread rapidly, have a large geographical span, and are difficult to track. Traditional anti-fraud methods are difficult to cope with increasingly complex fraud crimes. Therefore, intelligent anti-fraud technology has emerged, and the use of artificial intelligence and big data and other technologies to establish an enterprise-level fraud risk control platform for detecting, monitoring, and real-time warning of fraudulent transaction risks and fraudulent activities has become a popular means. Among them, anti-fraud platform data query is an important part of the intelligent anti-fraud system. Query efficiency is the key to the anti-fraud platform's real-time response to block fraudulent behavior. It is currently an urgent need to help the anti-fraud platform reduce the response delay of the query scenario through a more efficient data query method. In the anti-fraud platform, indicator data occupies a considerable part, and the query method of indicator data has become the focus of improvement in the embodiments of this application.

[0053] Traditional anti-fraud monitoring and early warning models, such as Figure 1 As shown in the figure, transaction data is received from the outside through a unified interface, and real-time indicator calculation and indicator query are performed on various indicators in the anti-fraud platform through differentiated scenarios and rules. Finally, indicator data is analyzed through rule decision-making and control strategies, and the analysis results are given as early warning results through the above unified interface. Figure 1 The anti-fraud platform of the anti-fraud monitoring and early warning model shown in the figure needs to do a lot of segmentation from the scene, rule and indicator levels after receiving the indicator data. The analysis of the indicator data requires filtering and querying a large amount of indicator data. When the number of queried indicators and indicator data sets is too large, it may cause query timeout, thereby delaying the best warning time.

[0054] Based on this, the embodiment of the present application provides a method for querying index data, specifically involving a data index and query method based on machine learning. The method is based on a machine learning algorithm to construct an index structure of index data suitable for query scenarios such as anti-fraud platforms. When there is a query request, the index data can be obtained faster through the index. As an example, the method may include: first, based on the query task and the corresponding target cost model, obtain the data partition corresponding to the query task, wherein the query task includes the index to be queried and the workload to be queried, the target cost model is obtained based on historical index data, historical workload and initial data distribution training, the historical index data corresponds to the index to be queried, and the historical workload corresponds to the workload to be queried; then, according to the partition index of the data partition, calculate the data range involved in the query task in the data partition, the partition index is determined by the index set, and the index set is obtained by fitting the index to be queried in the data partition; then, access the physical address space corresponding to the data range to obtain the target index data of the index to be queried under the workload to be found.

[0055] In this way, based on the machine learning algorithm, an index structure suitable for query scenarios of indicator data is constructed. For indicator data query tasks, the target indicator data of the indicator to be queried can be quickly queried with the help of the trained target cost model and index set, which effectively improves the query efficiency of indicator data and provides a high-real-time data basis for subsequent further adaptive behaviors. In platforms such as anti-fraud, it makes it possible to identify fraudulent transactions more quickly and reduce users' property losses.

[0056] It should be noted that the subject implementing the query method of the index data may be the query device of the index data provided in the embodiment of the present application. The query device of the index data may be carried in an electronic device or a functional module of the electronic device. The query device of the index data may be a functional module on the anti-fraud platform that implements the index data query function.

[0057] Some technical terms involved in the embodiments of the present application are introduced and explained below.

[0058] An indicator can refer to a characteristic variable within a certain time window obtained based on the rolling accumulation of quasi-real-time transaction flows, for example, the cumulative transaction amount of an account in the past 10 minutes.

[0059] Spatial data generally refers to data information related to geographic location, such as the location where the transaction occurred, device IP, etc. In a generalized scenario, it can also refer to data with multiple attributes.

[0060] Real-time monitoring refers to the process in which the caller accesses the anti-fraud platform through an external interface, forwards the request to the decision cluster through load balancing, obtains the dependent indicators (i.e. the indicator status calculated in quasi-real-time scenarios) from the indicator calculation cluster in real time during the decision-making process, and returns the generated risk signal to the caller. The early warning information triggered by the real-time scenario is persisted through the data exchange cluster.

[0061] Learning index refers to the use of machine learning models to obtain adaptive data structures in a training manner, which is consistent with the use of traditional index types, that is, obtaining the physical index location of data by giving a key value.

[0062] Figure 2 The flowchart of a method for querying indicator data provided by an embodiment of the present application is as follows. The method can be applied to an indicator data query device, and the indicator data query device can be, for example, Figure 4 The query device 400 of indicator data is shown.

[0063] like Figure 2 As shown, the method may include, for example, the following S201 to S203:

[0064] S201, based on the query task and the corresponding target cost model, obtain the data partition corresponding to the query task, the query task includes the indicator to be queried and the workload to be queried, the target cost model is obtained based on the historical indicator data, the historical workload and the initial data distribution training, the historical indicator data corresponds to the indicator to be queried, and the historical workload corresponds to the workload to be queried.

[0065] S201 to S203 in the method can be understood as an online query phase, so before S201, the method can also include an offline training phase and a data storage phase. The offline training phase is used to train and obtain a target cost model and an index set.

[0066] Among them, the target cost model is expressed as: Cost(D,Q,L)=ω P t P +ω R t R +ω S t S , where Q is the workload, D is the indicator data, L is the data distribution, ω P t P represents the mapping time, t P It represents the average grid index lookup cost of the workload under the current data distribution, that is, the time it takes to map the grid for a given query; ω R t R refers to the internal index time, which represents the internal index cost when the query is mapped to a single data grid, t R Indicates the average internal index time of the workload under the current data distribution. When the query does not involve columns with internal indexes, the query cost of this part is 0; ω S t S is the filtering time, t S represents the average data filtering cost of the workload under the current data distribution, that is, the filtering cost when the physical data address is finally determined after indexing; ω P ,ω R and ω S are all learning parameters.

[0067] Workload can be understood as the time range for calculating indicator data, such as one day or one week, which can be considered as the workload of indicator data. Different cost models and index sets can be trained for different workloads. When querying online, just select the cost model corresponding to the workload to be queried (hereinafter referred to as the target cost model).

[0068] Among them, the index set is represented as: Among them, a i represents the parameters obtained by fitting, cj Indicates the number of columns of the grid index constructed by the (d-1) indices other than index j among the d indices.

[0069] The offline training phase can be understood as the modeling phase of the machine learning model (such as the phase of modeling the query of the anti-fraud monitoring and early warning model). Assuming that the historical indicator data D contains d indicators in total, the initial data layout L is defined as (O, {c i} 0≤i＜d-1 ), where O represents the order of the d indicators (priority from high to low), c i It represents the number of columns of the grid index constructed by the d-1 indicator dimensions other than indicator i. Define the cost model Cost(D,Q,L)=ω P t P +ω R t R +ω S t S , based on the historical workload Q, historical indicator data D and initial data distribution L, the multiple parameters involved in the cost model are trained. For example, Pareto optimization algorithms such as Particle Swarm Optimization (PSO) and genetic algorithms can be used to seek the optimal solution through a large number of iterations to obtain the data distribution corresponding to the minimum cost (which can also be understood as the optimal data distribution).

[0070] Next, the physical indicator data can be used to construct a grid index according to the optimal data distribution, and the data partitions are divided according to the grid; within the data partitions, the indicator data is sorted from low to high according to the first-ranked indicator and stored in order; the indicator data within the data partition is curve fitted to finally obtain the index set Among them, a i represents the parameters obtained by fitting.

[0071] After the offline training stage, the storage process may include: constructing a grid index according to the optimal data distribution in the target cost model, and dividing the storage space into multiple data partitions according to the grid index; corresponding the indicator data to be stored to each of the multiple data partitions; in each of the multiple data partitions, sorting the indicator data to be stored in the data partition from low to high according to the first-ranked indicator, and storing according to the sorting result; in each of the multiple data partitions, performing curve fitting on the indicator data in the data partition according to the dimensions of different indicators to obtain an index set of different indicators in the data partition.

[0072] In the online query stage, S201 may include, for example: selecting a target cost model corresponding to the workload to be queried in the query task; inputting the query task or the queried index included in the query task into the selected target cost model to obtain the data partition corresponding to the query task. The queried index may be multiple indexes within a certain range or a certain index.

[0073] S202, calculating the data range involved in the query task in the data partition according to the partition index of the data partition, the partition index is determined by an index set, and the index set is obtained by fitting the index to be queried in the data partition.

[0074] In specific implementation, S202 may include: for each data partition obtained through S201, estimating the data range involved in the partition through the corresponding partition index.

[0075] S203, accessing the physical address space corresponding to the data range, and obtaining the target indicator data of the indicator to be queried under the workload to be found.

[0076] As an example, S203 may include: accessing the actual physical address space according to the data range obtained in S202 to obtain target indicator data of the indicator to be queried under the workload to be found.

[0077] As another example, if the query task also includes a query condition, then S203 may include: accessing the actual physical address space according to the data range obtained in S202 to obtain indicator data 1. After S203, it may also include: filtering indicator data 1 based on the query condition to obtain target indicator data of the indicator to be queried under the workload to be found.

[0078] In some implementations, taking the method provided in the embodiment of the present application as an example of applying to an anti-fraud platform, after obtaining the target indicator data, the method may also include: determining the early warning result of the query task based on the target indicator data and the decision-making strategy of the anti-fraud platform, and the early warning result is used to indicate whether the target indicator data indicates a fraudulent transaction. This step may be an operation performed by an early warning algorithm or an early warning model on the anti-fraud platform, that is, after the query device for the indicator data on the anti-fraud platform executes S203, the target indicator data is fed back to the early warning algorithm or the early warning model, and the early warning algorithm or the early warning model performs subsequent decisions to obtain an early warning result (which may also correspond to the early warning information in the above text).

[0079] It can be seen that through this method, an index structure suitable for query scenarios of indicator data is constructed. For indicator data query tasks, the target indicator data of the indicator to be queried can be quickly queried with the help of the trained target cost model and index set, which effectively improves the query efficiency of indicator data and provides a high-real-time data basis for subsequent further adaptive behaviors. In platforms such as anti-fraud, it makes it possible to identify fraudulent transactions more quickly and reduce users' property losses.

[0080] In order to make the introduction of the method provided in the embodiment of the present application clearer and more complete, Figure 3 An example is given below to illustrate.

[0081] like Figure 3 As shown, the anti-fraud data indexing and query process based on machine learning indexing may include:

[0082] The offline training phase may include:

[0083] S11, the historical query results of the anti-fraud platform and the historical indicator data of the anti-fraud platform are used to optimize the data layout.

[0084] S12, optimizing the data layout for creating indexes and updating layout parameters.

[0085] S13, after pre-processing such as data screening and cleaning, the historical indicator data of the anti-fraud platform is sorted and partitioned and stored according to the updated layout parameters.

[0086] The online inquiry stage may include:

[0087] S21, for the query task, first search the index, that is, obtain the data partitions involved through the query index range, and then for each data partition, estimate the data range involved in the partition through the corresponding partition index.

[0088] S22, accessing the physical database, that is, accessing the physical address space of the actual indicator data according to the data range obtained in S21.

[0089] S23, scanning and filtering, that is, filtering the indicator data within the estimation range according to the query conditions.

[0090] After that, the queried indicator data can be returned to the subsequent decision-making module.

[0091] It can be seen that in the embodiment of the present application, the optimal data layout and index structure are constructed based on the machine learning algorithm. By learning the historical workload and index data, the physical layout of the index data can be more in line with the needs of actual application environment queries, and the grid index constructed according to the optimal layout can reduce the query cardinality and avoid scanning irrelevant data partitions. Finally, the machine learning index located inside the data partition can also speed up the progress of data query to a certain extent, further optimizing the overall efficiency. Taking the anti-fraud scenario as an example, for transaction data that triggers an early warning, the method provided by the embodiment of the present application can be used to more quickly identify and intercept related fraudulent behaviors, reducing the property losses of financial users such as banks.

[0092] The core protection of the embodiment of the present application is a method for indexing and querying indicator data. The method utilizes a machine learning algorithm to learn historical indicator data and historical workloads in scenarios such as anti-fraud platforms, and improves the efficiency of back-end decision-making by constructing the optimal data layout and corresponding index structure in the current scenario.

[0093] The query method for indicator data in the embodiment of the present application can also be used for indexing and querying spatial data, thereby improving the query efficiency of spatial data.

[0094] Correspondingly, the embodiment of the present application also provides a device 400 for querying indicator data, such as Figure 4 The device 400 may include:

[0095] A first obtaining unit 401 is used to obtain a data partition corresponding to the query task based on the query task and the corresponding target cost model, wherein the query task includes an indicator to be queried and a workload to be queried, and the target cost model is obtained by training based on historical indicator data, historical workload and initial data distribution, wherein the historical indicator data corresponds to the indicator to be queried, and the historical workload corresponds to the workload to be queried;

[0096] A calculation unit 402 is used to calculate the data range involved in the query task in the data partition according to the partition index of the data partition, wherein the partition index is determined by an index set, and the index set is obtained by fitting the index to be queried in the data partition;

[0097] The second obtaining unit 403 is used to access the address space of the physical data corresponding to the data range, and obtain the target indicator data of the indicator to be queried under the workload to be found.

[0098] Optionally, the query task further includes a query condition, and the device 400 further includes:

[0099] A filtering unit is used to filter the target indicator data based on the query condition to update the target indicator data.

[0100] Optionally, the device 400 is applied to an anti-fraud platform, and the device 400 further includes:

[0101] A determination unit is used to determine a warning result of the query task based on the target indicator data and a decision-making strategy of the anti-fraud platform, wherein the warning result is used to indicate whether the target indicator data indicates a fraudulent transaction.

[0102] Optionally, the device 400 further includes:

[0103] A construction unit, configured to construct a grid index according to the optimal data distribution in the target cost model, and divide the storage space into a plurality of data partitions according to the grid index;

[0104] A partitioning unit, used to correspond the indicator data to be stored to each data partition in the plurality of data partitions;

[0105] A storage unit, used for sorting the index data to be stored in each data partition of the plurality of data partitions from low to high values ​​according to the index ranked first, and storing the index data according to the sorting result;

[0106] The index unit is used to perform curve fitting on the index data in each data partition of the multiple data partitions according to the dimensions of different indicators to obtain an index set of different indicators in the data partition.

[0107] Optionally, the target cost model is expressed as: Cost(D,Q,L)=ω P t P +ω R t R +ω S t S , where Q is the workload, D is the indicator data, L is the data distribution, ω P t P represents the mapping time, t P It represents the average grid index lookup cost of the workload under the current data distribution, ω R t R refers to the internal index time, which represents the internal index cost when the query is mapped to a single data grid, t R represents the average internal indexing time of the workload under the current data distribution, ω S t S is the filtering time, t S represents the average data filtering cost of the workload under the current data distribution, ω P,ω R and ω S are all learning parameters.

[0108] Optionally, the index set is expressed as: Among them, a i represents the parameters obtained by fitting, c j Indicates the number of columns of the grid index constructed by the (d-1) indices other than index j among the d indices.

[0109] It should be noted that the specific implementation method of the device 400 and the technical effects achieved can be found in Figure 2 or Figure 3 The relevant description in the method shown.

[0110] In addition, an embodiment of the present application also provides an electronic device, which includes a processor and a memory: the memory is used to store instructions or computer programs; the processor is used to execute the instructions or computer programs in the memory, so that the electronic device executes any implementation of the method provided in the embodiment of the present application.

[0111] See also Figure 5 , which shows a schematic diagram of the structure of an electronic device 500 suitable for implementing the embodiment of the present disclosure. The terminal device in the embodiment of the present disclosure may include but is not limited to mobile terminals such as mobile phones, laptop computers, digital broadcast receivers, PDAs (personal digital assistants), PADs (tablet computers), PMPs (portable multimedia players), vehicle-mounted terminals (such as vehicle-mounted navigation terminals), etc., and fixed terminals such as digital TVs, desktop computers, etc. Figure 5 The electronic device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present disclosure.

[0112] like Figure 5 As shown, the electronic device 500 may include a processing device (e.g., a central processing unit, a graphics processing unit, etc.) 501, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 502 or a program loaded from a storage device 508 into a random access memory (RAM) 503. In the RAM 503, various programs and data required for the operation of the electronic device 500 are also stored. The processing device 501, the ROM 502, and the RAM 503 are connected to each other via a bus 504. An input / output (I / O) interface 505 is also connected to the bus 504.

[0113] Typically, the following devices may be connected to the I / O interface 505: an input device 506 including, for example, a touch screen, a touch pad, a keyboard, a mouse, a camera, a microphone, an accelerometer, a gyroscope, etc.; an output device 507 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; a storage device 508 including, for example, a magnetic tape, a hard disk, etc.; and a communication device 509. The communication device 509 may allow the electronic device 500 to communicate with other devices wirelessly or by wire to exchange data. Although Figure 5 The electronic device 500 is shown with various devices, but it should be understood that it is not required to implement or possess all the devices shown. More or fewer devices may be implemented or possessed instead.

[0114] In particular, according to an embodiment of the present disclosure, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present disclosure includes a computer program product, which includes a computer program carried on a non-transitory computer-readable medium, and the computer program contains program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from the network through the communication device 509, or installed from the storage device 508, or installed from the ROM502. When the computer program is executed by the processing device 501, the above-mentioned functions defined in the method of the embodiment of the present disclosure are executed.

[0115] The electronic device provided by the embodiment of the present disclosure and the method provided by the above embodiment belong to the same inventive concept, and the technical details not fully described in this embodiment can be referred to the above embodiment, and this embodiment has the same beneficial effects as the above embodiment.

[0116] The embodiment of the present application also provides a computer-readable medium, in which instructions or computer programs are stored. When the instructions or computer programs are executed on a device, the device executes any implementation of the method provided in the embodiment of the present application.

[0117] It should be noted that the computer-readable medium disclosed above may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program that may be used by or in combination with an instruction execution system, device or device. In the present disclosure, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, in which a computer-readable program code is carried. This propagated data signal may take a variety of forms, including but not limited to an electromagnetic signal, an optical signal, or any suitable combination of the above. The computer readable signal medium may also be any computer readable medium other than a computer readable storage medium, which may send, propagate or transmit a program for use by or in conjunction with an instruction execution system, apparatus or device. The program code contained on the computer readable medium may be transmitted using any suitable medium, including but not limited to: wires, optical cables, RF (radio frequency), etc., or any suitable combination of the above.

[0118] In some embodiments, the client and the server may communicate using any currently known or future developed network protocol such as HTTP (Hyper Text Transfer Protocol), and may be interconnected with any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include a local area network ("LAN"), a wide area network ("WAN"), an internet (e.g., the Internet), and a peer-to-peer network (e.g., an ad hoc peer-to-peer network), as well as any currently known or future developed network.

[0119] The computer-readable medium may be included in the electronic device, or may exist independently without being incorporated into the electronic device.

[0120] The computer-readable medium carries one or more programs, and when the one or more programs are executed by the electronic device, the electronic device can execute the method.

[0121] Computer program code for performing the operations of the present disclosure may be written in one or more programming languages ​​or a combination thereof, including, but not limited to, object-oriented programming languages, such as Java, Smalltalk, C++, and conventional procedural programming languages, such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., through the Internet using an Internet service provider).

[0122] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present disclosure. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some implementations as replacements, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0123] The units involved in the embodiments described in the present disclosure may be implemented by software or hardware, wherein the name of a unit / module does not, in some cases, constitute a limitation on the unit itself.

[0124] The functions described above herein may be performed at least in part by one or more hardware logic components. For example, without limitation, exemplary types of hardware logic components that may be used include: field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), complex programmable logic devices (CPLDs), and the like.

[0125] In the context of the present disclosure, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or equipment. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or equipment, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0126] It should be noted that the various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments, and the same or similar parts between the various embodiments can be referred to each other. For the system or device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part description.

[0127] It should be understood that in the present application, "at least one (item)" means one or more, and "plurality" means two or more. "And / or" is used to describe the association relationship of associated objects, indicating that three relationships may exist. For example, "A and / or B" can mean: only A exists, only B exists, and A and B exist at the same time, where A and B can be singular or plural. The character " / " generally indicates that the objects associated before and after are in an "or" relationship. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single or plural items. For example, at least one of a, b or c can mean: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, c can be single or multiple.

[0128] It should also be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0129] The steps of the method or algorithm described in conjunction with the embodiments disclosed herein may be implemented directly using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0130] It should be noted that in the embodiments of the present application, user sensitive information is not involved, and user-related information is obtained, used and determined after user authorization. In one example, before obtaining user-related information, the corresponding interface displays prompt information related to obtaining data use authorization. The prompt information is based on relevant laws and regulations in an appropriate manner to inform the user of the type, scope of use, usage scenarios, etc. of the personal information involved in this disclosure, so that the user can determine whether to agree to the authorization based on the prompt information. It can be understood that the above notification and the process of obtaining user authorization are only illustrative and do not constitute a limitation on the implementation method of the present disclosure. Other methods that meet relevant laws and regulations may also be applied to the implementation method of the present disclosure.

[0131] The above description of the disclosed embodiments enables those skilled in the art to implement or use the present application. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present application. Therefore, the present application will not be limited to the embodiments shown herein, but will conform to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A method for querying indicator data, characterized in that: include: Based on the query task and the corresponding target cost model, the data partition corresponding to the query task is obtained, wherein the query task includes an indicator to be queried and a workload to be queried, and the target cost model is obtained based on historical indicator data, historical workload and initial data distribution training, wherein the historical indicator data corresponds to the indicator to be queried, and the historical workload corresponds to the workload to be queried; According to the partition index of the data partition, the data range involved in the query task in the data partition is calculated, the partition index is determined by an index set, and the index set is obtained by fitting the indicator to be queried in the data partition; Access the physical address space corresponding to the data range to obtain target indicator data of the indicator to be queried under the workload to be found.

2. The method according to claim 1, characterized in that The query task also includes a query condition, and the method further includes: Based on the query condition, the target indicator data is filtered to update the target indicator data.

3. The method according to claim 1 or 2, characterized in that: The method is applied to an anti-fraud platform, and the method further comprises: Based on the target indicator data and the decision-making strategy of the anti-fraud platform, a warning result of the query task is determined, and the warning result is used to indicate whether the target indicator data indicates a fraudulent transaction.

4. The method according to claim 1, characterized in that: The method further comprises: Building a grid index according to the optimal data distribution in the target cost model, and dividing the storage space into a plurality of data partitions according to the grid index; Corresponding the indicator data to be stored to each data partition in the multiple data partitions respectively; In each of the multiple data partitions, the index data to be stored in the data partition is sorted from low to high according to the index ranked first, and stored according to the sorting result; In each data partition of the multiple data partitions, curve fitting is performed on the indicator data in the data partition according to the dimensions of different indicators to obtain an index set of different indicators in the data partition.

5. The method according to claim 1, characterized in that The target cost model is expressed as: Cost(D,Q,L)=ω P t P +ω R t R +ω S t S , where Q is the workload, D is the indicator data, L is the data distribution, ω P t P represents the mapping time, t P It represents the average grid index lookup cost of the workload under the current data distribution, ω R t R refers to the internal index time, which represents the internal index cost when the query is mapped to a single data grid, t R represents the average internal indexing time of the workload under the current data distribution, ω S t S is the filtering time, t S represents the average data filtering cost of the workload under the current data distribution, ω P ,ω R and ω S are all learning parameters.

6. The method according to claim 1, characterized in that The index set is represented as: Among them, a i represents the parameters obtained by fitting, c j Indicates the number of columns of the grid index constructed by the (d-1) indices other than index j among the d indices.

7. A device for querying index data, characterized in that: include: A first obtaining unit is configured to obtain a data partition corresponding to a query task based on a query task and a corresponding target cost model, wherein the query task includes an indicator to be queried and a workload to be queried, and the target cost model is obtained by training based on historical indicator data, historical workload, and initial data distribution, wherein the historical indicator data corresponds to the indicator to be queried, and the historical workload corresponds to the workload to be queried; a calculation unit, configured to calculate a data range involved in the query task in the data partition according to a partition index of the data partition, wherein the partition index is determined by an index set, and the index set is obtained by fitting the indicator to be queried in the data partition; The second obtaining unit is used to access the physical address space corresponding to the data range to obtain the target indicator data of the indicator to be queried under the workload to be found.

8. The device according to claim 7, characterized in that The device is applied to an anti-fraud platform, and the device further comprises: A determination unit is used to determine a warning result of the query task based on the target indicator data and a decision-making strategy of the anti-fraud platform, wherein the warning result is used to indicate whether the target indicator data indicates a fraudulent transaction.

9. An electronic device, characterized in that: The electronic device comprises: a processor and a memory; The memory is used to store instructions or programs; The processor is used to execute the instructions or programs in the memory so that the electronic device executes the method according to any one of claims 1 to 6.

10. A readable medium, characterized in that: The readable medium stores instructions or programs, and when the instructions or programs are executed on a processor, the processor is enabled to execute the method according to any one of claims 1 to 6.

Images