A Cloud Computing-Based Order Data Risk Monitoring System and Method

Abstract

The present invention discloses a risk monitoring system and method for order data based on cloud computing, which relates to the technical field of data analysis. The system of the present invention includes: a data collection and processing module, a known risk factor extraction and evaluation module, a feature analysis and threshold calculation module, an unknown risk factor extraction and evaluation module, and a real-time data monitoring and alarm module; the data collection and processing module collects historical order data and risk judgment records, and forms a first feature vector; the known risk factor extraction and evaluation module extracts known risk factors and calculates a first risk assessment index; the feature analysis and threshold calculation module analyzes to obtain an evaluation threshold and a second feature vector; the unknown risk factor identification and evaluation module identifies unknown risk factors, calculates a second risk assessment index, and determines its threshold; the real-time data monitoring and alarm module collects order data in real time, calculates a risk assessment index, compares the threshold and outputs a risk prompt message.

Description

Technical Field

[0001] The present invention relates to the technical field of data analysis, and particularly to an order data risk monitoring system and method based on cloud computing. Background Technique

[0002] With the rapid development of e-commerce and online payment, the volume of order data has increased sharply. How to effectively monitor a large amount of order data has become a major challenge for enterprises. The main purpose of order data risk monitoring is to identify and prevent various potential frauds, malicious attacks and abnormal behaviors, such as false orders, payment frauds, account thefts, etc. If these risk events are not discovered and processed in time, they will directly affect the enterprise's revenue, security and customer trust, and may even lead to legal and reputation risks.

[0003] Existing order data risk monitoring methods based on cloud computing can improve the monitoring efficiency to a certain extent, but there are still deficiencies. For example, in existing methods, risk factors are often extracted from order data through technologies such as machine learning and statistical analysis, such as abnormal order frequency, abnormal transaction amount, abnormal IP address, mutated user behavior, etc. These features are used to train a risk assessment model to further classify and evaluate orders. However, the feature extraction process usually relies on the knowledge of domain experts, and the selection and construction of risk factors are highly subjective. Due to the variety of potential risk factors in order data, existing methods often lack the exploration and discovery of unknown risk factors, resulting in the model being too dependent on existing known risk patterns and difficult to cope with new types of fraud behaviors or attack scenarios. Summary of the Invention

[0004] The purpose of the present invention is to provide an order data risk monitoring system and method based on cloud computing to solve the problems raised in the above background technique.

[0005] To solve the above technical problems, the present invention provides the following technical solutions:

[0006] An order data risk monitoring method based on cloud computing, characterized in that: the method includes the following steps:

[0007] Step S100. Collect historical order data and corresponding risk judgment records through a cloud computing platform, and preprocess the historical order data, including removing noise data, filling in missing values, and standardizing the data format; perform corresponding statistical analysis on the preprocessed historical order data, extract the basic features of the historical order data, and form a first feature vector;

[0008] Step S200. According to the risk judgment records corresponding to the historical order data, divide the historical order data accordingly; combine the division results and the first eigenvector to extract known risk factors; based on the known risk factors, conduct a risk assessment on the historical order data to obtain the first risk assessment index;

[0009] Step S300. Obtain the first risk assessment index threshold according to the first risk assessment index and risk judgment records of the historical order data; analyze the first eigenvector according to the known risk factors to obtain the second eigenvector; combine the risk judgment records and the second eigenvector of the historical order data to identify unknown risk factors;

[0010] Step S400. Conduct a risk assessment on the corresponding historical order data according to the unknown risk factors to obtain the second risk assessment index; obtain the second risk assessment index threshold according to the second risk assessment index and risk judgment records of the historical order data;

[0011] Step S500. Obtain the real-time order data of the cloud computing platform, identify unknown risk factors for the real-time order data, calculate the corresponding risk assessment index according to the identification results, compare it with the corresponding risk assessment index threshold, and output the corresponding prompt information according to the comparison results.

[0012] Furthermore, step S100 includes:

[0013] S101. The risk judgment record refers to the final risk judgment result of the historical order data, where the risk judgment record includes normal events and abnormal events; the normal event means that the risk judgment result of the historical order data is normal, and the abnormal event means that the risk judgment result of the historical order data is abnormal; among them, the abnormal event includes false alarm events and missed alarm events. The false alarm event means that the historical order data has no risk but is reported as having risk, and the missed alarm event means that the historical order data has risk but is not reported as having risk;

[0014] S102. Collect historical order data from the cloud computing platform to form a historical order data set D, and D = {d1, d2,..., dn}, where d1 represents the first historical order data, d2 represents the second historical order data, and so on, dn represents the nth historical order data, and n represents the historical order data number; for each historical order data, perform data preprocessing, conduct corresponding statistical analysis on the preprocessed historical order data, and extract basic features; the basic features refer to the data features extracted from the historical order data after statistical analysis, such as the amount size, customer historical behavior (such as the past purchase times), order frequency, order time, etc.; construct the first feature vector A according to the extracted basic features, and A = [a1, a2,..., am], where a1 represents the first feature of the historical order data, a2 represents the second feature of the historical order data, and so on, am represents the mth feature of the historical order data, and m represents the feature dimension.

[0015] Further, step S200 includes:

[0016] S201. According to the risk judgment records of the historical order data, divide the historical order data into two categories: normal and abnormal, which are respectively represented as D_normal and D_abnormal, and associate the historical order data with the corresponding first feature vector, and each historical order data corresponds to a first feature vector; extract known risk factors according to neighborhood knowledge, and combine with the first feature vector A to form a known risk factor vector F, and F = [f1, f2,..., fu], where f1 represents the first eigenvalue of the known risk factor vector, f2 represents the second eigenvalue of the known risk factor vector, and so on, fu represents the u-th eigenvalue of the known risk factor vector; u represents the number of eigenvalues of the known risk factor vector, u < m, and each eigenvalue of the known risk factor vector F exists in the first feature vector;

[0017] S202. According to the known risk factor vector F, calculate the first risk assessment index R1 of all historical order data, and the specific calculation formula is:

[0018] R1 = Σj∈[1,u],wj·fj,

[0019] where, wj represents the weight of the j-th known risk factor, and fj represents the eigenvalue of the j-th known risk factor; and associate the first risk assessment index R1 with the first feature vector of the historical order data, so as to obtain the corresponding relationship between the historical order data, the first feature vector, the known risk factor vector, and the first risk assessment index of the normal and abnormal categories.

[0020] Further, step S300 includes:

[0021] S301. Aggregate the first risk assessment index R1 of the historical order data of the normal category, and arrange the first risk assessment index R1 in ascending order; according to the risk judgment record, take the first historical order data with risks as the first risk assessment index threshold R0; for the first feature vector A of the historical order data of the normal and abnormal categories, combined with the known risk factor vector F, screen out the eigenvalues of the known risk factor vector F from the first feature vector A, so as to obtain the second feature vector B, and B = [b1, b2,..., bm - u]. Similarly, b1 represents the first eigenvalue of the second feature vector, b2 represents the second eigenvalue of the second feature vector, and bm - u represents the (m - u)-th eigenvalue of the second feature vector, and the second feature vector B has u fewer eigenvalues than the first feature vector A;

[0022] S302. For the second feature vector B of the historical order data of the normal category, calculate the average value μ(bk) and the standard deviation σ(bk) of all eigenvalues, where bk represents the k-th eigenvalue of the second feature vector B of the normal category, and k takes values from 1 to m - u; according to the average value μ(bk) and the standard deviation σ(bk) of bk, obtain the corresponding threshold interval Q(bk), and Q(bk) = [μ(bk) - c×σ(bk), μ(bk) + c×σ(bk)], where c represents a constant; for the second feature vector B of the historical order data of the abnormal category, compare all the corresponding eigenvalues bl with the threshold interval Q(bk), where bl represents the l-th eigenvalue of the second feature vector B of the abnormal category, and l takes values from 1 to m - u; if there exists an eigenvalue bl in the second feature vector B of the abnormal category that does not belong to the threshold interval Q(bk), then identify the corresponding eigenvalue bl as an unknown risk factor, aggregate all the unknown risk factors, and form the corresponding unknown risk factor vector Z for the historical order data of the abnormal category, and Z = [z1, z2,..., zv], where z1 represents the first eigenvalue of the unknown risk factor vector, z2 represents the second eigenvalue of the unknown risk factor vector, and so on, zv represents the v-th eigenvalue of the unknown risk factor vector, and v < m.

[0023] Further, step S400 includes:

[0024] For the historical order data of the abnormal category, according to the corresponding unknown risk factor vector Z, calculate the second risk assessment index R2, and the specific calculation formula is:

[0025] R2 = Σh∈[1, v], gh·zh,

[0026] Among them, gh represents the weight of the h-th unknown risk factor, and zh represents the eigenvalue of the h-th unknown risk factor; the second risk assessment index R2 of the historical order data of all abnormal categories is summarized, and the second risk assessment index R2 is arranged in ascending order; according to the risk judgment record, the historical order data of the first actually existing risk is used as the second risk assessment index threshold R3.

[0027] Further, step S500 includes:

[0028] S501. Obtain the real-time order data of the cloud computing platform, perform preprocessing and statistical analysis on the real-time order data, so as to obtain the first eigenvector A'. Find the eigenvalue a's corresponding to the second eigenvector B of the historical order data of the normal category in the first eigenvector A', and a's represents the s-th eigenvalue in the first eigenvector A'. Compare a's with the corresponding threshold interval Q(bk). If each eigenvalue a's in the first eigenvector A' belongs to the threshold interval Q(bk), then calculate the first risk assessment index R1' of the real-time order data, and compare the first risk assessment index R1' with the corresponding first risk assessment index threshold R0. If the first risk assessment index R1' is less than the first risk assessment index threshold R0, no prompt information is output; if the first risk assessment index R1' is greater than or equal to the first risk assessment index threshold R0, a prompt message indicating the existence of risk is output, and the number of the real-time order data is output to the relevant personnel.

[0029] S502. Compare a's with the corresponding threshold interval Q(bk). If there are eigenvalues a's in the first eigenvector A' that do not belong to the threshold interval Q(bk), summarize all the eigenvalues a's that do not belong to the threshold interval Q(bk) and mark them as unknown risk factors; calculate the corresponding second risk assessment index R2' according to the unknown risk factors; compare the second risk assessment index R2' with the corresponding second risk assessment index threshold R3. If the second risk assessment index R2' is less than the second risk assessment index threshold R3, no prompt information is output; if the second risk assessment index R2' is greater than or equal to the second risk assessment index threshold R3, a prompt message indicating the existence of risk is output, and the number of the real-time order data is output to the relevant personnel.

[0030] An order data risk monitoring system based on cloud computing, including: a data collection and processing module, a known risk factor extraction and evaluation module, a feature analysis and threshold calculation module, an unknown risk factor extraction and evaluation module, and a real-time data monitoring and alarm module;

[0031] The data collection and processing module collects historical order data and corresponding risk judgment records, and preprocesses the historical order data, including removing noise data, filling in missing values, and standardizing the data format; performs corresponding statistical analysis on the preprocessed historical order data, extracts the basic features of the historical order data, and forms the first feature vector;

[0032] The known risk factor extraction and evaluation module divides the historical order data according to the risk judgment records corresponding to the historical order data; combines the division results and the first feature vector to extract known risk factors; based on the known risk factors, performs risk assessment on the historical order data to obtain the first risk assessment index;

[0033] The feature analysis and threshold calculation module obtains the first risk assessment index threshold according to the first risk assessment index and risk judgment records of the historical order data; analyzes the first feature vector according to the known risk factors to obtain the second feature vector;

[0034] The unknown risk factor identification and evaluation module combines the risk judgment records and the second feature vector of the historical order data to identify unknown risk factors; performs risk assessment on the corresponding historical order data according to the unknown risk factors to obtain the second risk assessment index; obtains the second risk assessment index threshold according to the second risk assessment index and risk judgment records of the historical order data;

[0035] The real-time data monitoring and alarm module obtains the real-time order data of the cloud computing platform, identifies unknown risk factors for the real-time order data, calculates the corresponding risk assessment index according to the identification results, compares it with the corresponding risk assessment index threshold, and outputs corresponding prompt information according to the comparison results.

[0036] Furthermore, the data collection and processing module includes a data collection unit and a data processing unit;

[0037] The data collection unit is responsible for collecting historical order data and corresponding risk judgment records from the cloud computing platform and forming a historical order data set; the data processing unit preprocesses the historical order data, including removing noise data, filling in missing values, and standardizing the data format; performs corresponding statistical analysis on the preprocessed historical order data, extracts the basic features of the historical order data, and forms the first feature vector;

[0038] The known risk factor extraction and evaluation module includes a known risk factor extraction unit and a first risk assessment index calculation unit;

[0039] The known risk factor extraction unit extracts known risk factors based on the risk judgment records of historical order data and the first feature vector, combined with domain knowledge; the first risk assessment index calculation unit calculates the first risk assessment index of the historical order data based on the known risk factors.

[0040] Furthermore, the feature analysis and threshold calculation module includes a feature vector screening unit and a threshold calculation unit;

[0041] The feature vector screening unit screens out the features that do not contain known risk factors according to the known risk factors and the first feature vector, and generates a second feature vector; the threshold calculation unit analyzes the historical order data of the normal category, calculates the average value and standard deviation of each feature, and generates the corresponding threshold interval;

[0042] The unknown risk factor identification and evaluation module includes an unknown risk factor identification unit and a second risk assessment index calculation unit;

[0043] The unknown risk factor identification unit analyzes the historical order data of the abnormal category according to the second feature vector and the corresponding threshold interval, identifies the abnormal feature values that are not included in the known risk factors, so as to identify the unknown risk factors;

[0044] The second risk assessment index calculation unit calculates the second risk assessment index based on the identified unknown risk factors; according to the second risk assessment index and the risk judgment records of the historical order data, the second risk assessment index threshold is obtained.

[0045] Furthermore, the real-time data monitoring and alarm module includes a real-time data acquisition and preprocessing unit, a real-time risk assessment unit, and a prompt information generation unit;

[0046] The real-time data acquisition and preprocessing unit collects order data from the cloud computing platform in real time, preprocesses and statistically analyzes the real-time order data, and generates the first feature vector of the real-time order; the real-time risk assessment unit judges whether there are unknown risk factors by comparing with the second feature vector of the normal category; if there are no unknown risk factors, it calculates the first risk assessment index of the real-time order; if there are unknown risk factors in the real-time order data, it calculates the second risk assessment index of the real-time order; the prompt information generation unit compares the first risk assessment index or the second risk assessment index of the real-time order with the corresponding assessment index threshold. If the first risk assessment index or the second risk assessment index is greater than or equal to the corresponding assessment index threshold, it generates a prompt information indicating the existence of risks, and outputs the corresponding real-time order data number to relevant personnel.

[0047] Compared with the prior art, the beneficial effects of the present invention are:

[0048] This method first collects and processes historical order data through a cloud computing platform, performing preprocessing steps such as removing noise data, filling in missing values, and standardizing data formats to ensure the accuracy and consistency of the data. Through these steps, anomalies and irregularities in the data can be effectively eliminated, providing a clearer data foundation for subsequent analysis. By statistically analyzing the historical order data, basic features are extracted and a first feature vector is constructed. Based on the relationship between the first feature vector and the risk judgment records, known risk factors can be further identified. Through risk assessment using these known risk factors, the first risk assessment index obtained can effectively quantify the risk level of the order, improving the accuracy of risk identification. In traditional methods, risk assessment mainly relies on known risk factors, while in this invention, by constructing a second feature vector and setting a threshold interval, unknown risk factors can be identified. By analyzing the eigenvalue in the historical order data of normal and abnormal categories, the eigenvalue that does not meet the threshold interval is extracted and marked as an unknown risk factor, which significantly improves the system's ability to identify new or unknown risks. This invention further combines risk assessment with real-time order monitoring, processes real-time order data on the cloud computing platform, and timely identifies potential risk factors by analyzing the first feature vector and the second feature vector of the real-time data. Once the risk assessment index of a real-time order exceeds the preset threshold, the system can automatically issue an alarm to ensure that relevant personnel can respond in a timely manner and avoid potential risks. This method sorts the risk assessment indexes of historical order data and sets corresponding thresholds, making risk judgment more accurate and flexible. Over time, the risk threshold can be adjusted according to the actual situation to achieve dynamic monitoring. In addition, for different risk factors, the method can achieve personalized monitoring, further improving the adaptability and accuracy of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0049] The drawings are used to provide a further understanding of the present invention and constitute a part of the specification. They are used together with the embodiments of the present invention to explain the present invention, but do not constitute a limitation to the present invention. In the drawings:

[0050] Figure 1 is a schematic diagram of the modules of an order data risk monitoring system based on cloud computing according to the present invention. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0051] The following will clearly and completely describe the technical solutions in the embodiments of the present invention with reference to the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only a part of the embodiments of the present invention, rather than all of the embodiments. All other embodiments obtained by those of ordinary skill in the art based on the embodiments of the present invention without creative efforts shall fall within the protection scope of the present invention.

[0052] Please refer toFigure 1 , the present invention provides a technical solution:

[0053] A risk monitoring system for order data based on cloud computing, comprising: a data collection and processing module, a known risk factor extraction and evaluation module, a feature analysis and threshold calculation module, an unknown risk factor extraction and evaluation module, and a real-time data monitoring and alarm module;

[0054] The data collection and processing module collects historical order data and corresponding risk judgment records, and preprocesses the historical order data, including removing noise data, filling in missing values, and standardizing the data format; performs corresponding statistical analysis on the preprocessed historical order data, extracts the basic features of the historical order data, and forms a first feature vector;

[0055] The known risk factor extraction and evaluation module divides the historical order data according to the risk judgment records corresponding to the historical order data; combines the division results and the first feature vector to extract known risk factors; based on the known risk factors, performs risk assessment on the historical order data to obtain a first risk assessment index;

[0056] The feature analysis and threshold calculation module obtains a first risk assessment index threshold according to the first risk assessment index and risk judgment records of the historical order data; analyzes the first feature vector according to the known risk factors to obtain a second feature vector;

[0057] The unknown risk factor identification and evaluation module combines the risk judgment records and the second feature vector of the historical order data to identify unknown risk factors; performs risk assessment on the corresponding historical order data according to the unknown risk factors to obtain a second risk assessment index; obtains a second risk assessment index threshold according to the second risk assessment index and risk judgment records of the historical order data;

[0058] The real-time data monitoring and alarm module obtains the real-time order data of the cloud computing platform, identifies unknown risk factors for the real-time order data, calculates the corresponding risk assessment index according to the identification results, compares it with the corresponding risk assessment index threshold, and outputs corresponding prompt information according to the comparison results.

[0059] The data collection and processing module includes a data collection unit and a data processing unit;

[0060] The data collection unit is responsible for collecting historical order data and corresponding risk judgment records from the cloud computing platform and forming a historical order data set; the data processing unit preprocesses the historical order data, including removing noise data, filling in missing values, and standardizing the data format; performs corresponding statistical analysis on the preprocessed historical order data, extracts the basic features of the historical order data, and forms a first feature vector;

[0061] The known risk factor extraction and evaluation module includes a known risk factor extraction unit and a first risk assessment index calculation unit;

[0062] The known risk factor extraction unit extracts known risk factors according to the risk judgment records and the first eigenvector of historical order data, combined with domain knowledge; the first risk assessment index calculation unit calculates the first risk assessment index of historical order data based on the known risk factors.

[0063] The feature analysis and threshold calculation module includes a feature vector screening unit and a threshold calculation unit;

[0064] The feature vector screening unit screens out features that do not contain known risk factors according to the known risk factors and the first eigenvector, and generates a second eigenvector; the threshold calculation unit analyzes the historical order data of the normal category, calculates the average value and standard deviation of each feature, and generates the corresponding threshold interval;

[0065] The unknown risk factor identification and evaluation module includes an unknown risk factor identification unit and a second risk assessment index calculation unit;

[0066] The unknown risk factor identification unit analyzes the historical order data of the abnormal category according to the second eigenvector and the corresponding threshold interval, identifies the abnormal eigenvalue not included in the known risk factors, and thus identifies the unknown risk factors;

[0067] The second risk assessment index calculation unit calculates the second risk assessment index based on the identified unknown risk factors; according to the second risk assessment index and the risk judgment record of the historical order data, the second risk assessment index threshold is obtained.

[0068] The real-time data monitoring and alarm module includes a real-time data collection and preprocessing unit, a real-time risk assessment unit, and a prompt information generation unit;

[0069] The real-time data collection and preprocessing unit collects order data from the cloud computing platform in real time, preprocesses and statistically analyzes the real-time order data, and generates the first eigenvector of the real-time order; the real-time risk assessment unit judges whether there are unknown risk factors by comparing with the second eigenvector of the normal category; if there are no unknown risk factors, it calculates the first risk assessment index of the real-time order; if there are unknown risk factors in the real-time order data, it calculates the second risk assessment index of the real-time order; the prompt information generation unit compares the first risk assessment index or the second risk assessment index of the real-time order with the corresponding assessment index threshold. If the first risk assessment index or the second risk assessment index is greater than or equal to the corresponding assessment index threshold, it generates a prompt information indicating the existence of risks and outputs the corresponding real-time order data number to relevant personnel.

[0070] A risk monitoring method for order data based on cloud computing, characterized in that the method comprises the following steps:

[0071] Step S100. Collect historical order data and corresponding risk judgment records through a cloud computing platform, and preprocess the historical order data, including removing noise data, filling in missing values, and standardizing the data format; perform corresponding statistical analysis on the preprocessed historical order data, extract the basic features of the historical order data, and form a first feature vector;

[0072] Step S200. According to the risk judgment records corresponding to the historical order data, divide the historical order data accordingly; combine the division results and the first feature vector, and extract known risk factors; based on the known risk factors, perform a risk assessment on the historical order data to obtain a first risk assessment index;

[0073] Step S300. According to the first risk assessment index and risk judgment records of the historical order data, obtain a first risk assessment index threshold; analyze the first feature vector according to the known risk factors to obtain a second feature vector; combine the risk judgment records and the second feature vector of the historical order data to identify unknown risk factors;

[0074] Step S400. According to the unknown risk factors, perform a risk assessment on the corresponding historical order data to obtain a second risk assessment index; according to the second risk assessment index and risk judgment records of the historical order data, obtain a second risk assessment index threshold;

[0075] Step S500. Obtain real-time order data from the cloud computing platform, identify unknown risk factors for the real-time order data, calculate the corresponding risk assessment index according to the identification results, compare it with the corresponding risk assessment index threshold, and output corresponding prompt information according to the comparison results.

[0076] Step S100 includes:

[0077] S101. The risk judgment record refers to the final risk judgment result of the historical order data, where the risk judgment record includes normal events and abnormal events; the normal event refers to the normal risk judgment result of the historical order data, and the abnormal event refers to the abnormal risk judgment result of the historical order data; among them, the abnormal event includes false alarm events and missed alarm events, the false alarm event refers to the situation where there is no risk in the historical order data but it is reported that there is a risk, and the missed alarm event refers to the situation where there is a risk in the historical order data but it is not reported as having a risk;

[0078] S102. Collect historical order data from the cloud computing platform to form a historical order data set D, and D = {d1, d2,..., dn}, where d1 represents the first historical order data, d2 represents the second historical order data, and so on, dn represents the nth historical order data, and n represents the historical order data number; for each historical order data, perform data preprocessing, conduct corresponding statistical analysis on the preprocessed historical order data, and extract basic features; the basic features refer to the data features extracted after the statistical analysis of the historical order data, such as the amount size, customer historical behavior (such as the past purchase times), order frequency, order time, etc.; construct a first feature vector A according to the extracted basic features, and A = [a1, a2,..., am], where a1 represents the first feature of the historical order data, a2 represents the second feature of the historical order data, and so on, am represents the mth feature of the historical order data, and m represents the feature dimension.

[0079] In this embodiment, for each historical order data, perform data preprocessing; the data preprocessing process is as follows:

[0080] Noise data removal: Use the Z-score normalization method to detect and remove outliers. For the historical order data di, calculate its Z-score value, Zi = (X_di - μ) / σ; where X_di represents the data point of the historical order data di, and μ and σ respectively represent the mean and standard deviation of the corresponding data points; assume |Z_i| > 3, then consider this data point as an outlier, and it can be removed or corrected.

[0081] Missing value filling: For the processing of missing values, methods such as mean filling, interpolation method, or nearest neighbor filling can be adopted.

[0082] Normalization processing: In order to eliminate the dimensional difference between different data points in the historical order data, normalize each data point. After normalization, the mean of the data points is 0 and the standard deviation is 1, so as to ensure that each data point is on the same scale.

[0083] Step S200 includes:

[0084] S201. According to the risk judgment records of historical order data, divide the historical order data into two categories: normal and abnormal, denoted as D_normal and D_abnormal respectively, and associate the historical order data with the corresponding first feature vectors, where each historical order data corresponds to a first feature vector; extract known risk factors according to neighborhood knowledge, and combine them with the first feature vector A to form a known risk factor vector F, and F = [f1, f2,..., fu], where f1 represents the first eigenvalue of the known risk factor vector, f2 represents the second eigenvalue of the known risk factor vector, and so on, fu represents the u-th eigenvalue of the known risk factor vector; u represents the number of eigenvalues of the known risk factor vector, u < m, and each eigenvalue of the known risk factor vector F exists in the first feature vector.

[0085] S202. Calculate the first risk assessment index R1 of all historical order data according to the known risk factor vector F, and the specific calculation formula is:

[0086] R1 = Σj∈[1,u],wj·fj,

[0087] where wj represents the weight of the j-th known risk factor, and fj represents the eigenvalue of the j-th known risk factor; and associate the first risk assessment index R1 with the first feature vector of the historical order data, so as to obtain the corresponding relationship between the historical order data of the normal and abnormal categories, the first feature vector, the known risk factor vector, and the first risk assessment index.

[0088] Step S300 includes:

[0089] S301. Aggregate the first risk assessment index R1 of the historical order data in the normal category, and arrange the first risk assessment index R1 in ascending order; according to the risk judgment records, take the first historical order data with risks as the first risk assessment index threshold R0; for the first feature vectors A of the historical order data in the normal and abnormal categories, combine them with the known risk factor vector F, and screen out the eigenvalues of the known risk factor vector F from the first feature vector A to obtain a second feature vector B, and B = [b1, b2,..., bm-u], similarly, b1 represents the first eigenvalue of the second feature vector, b2 represents the second eigenvalue of the second feature vector, bm-u represents the (m - u)-th eigenvalue of the second feature vector, and the second feature vector B has u fewer eigenvalues than the first feature vector A.

[0090] S302. For the second eigenvector B of the historical order data of the normal category, calculate the average value μ(bk) and the standard deviation σ(bk) of all eigenvalues, where bk represents the k-th eigenvalue of the second eigenvector B of the normal category, and k ranges from 1 to m - u; according to the average value μ(bk) and the standard deviation σ(bk) of bk, obtain the corresponding threshold interval Q(bk), and Q(bk) = [μ(bk) - c×σ(bk), μ(bk) + c×σ(bk)], where c represents a constant; for the second eigenvector B of the historical order data of the abnormal category, compare all the corresponding eigenvalues bl with the threshold interval Q(bk), where bl represents the l-th eigenvalue of the second eigenvector B of the abnormal category, and l ranges from 1 to m - u; if there exists an eigenvalue bl in the second eigenvector B of the abnormal category that does not belong to the threshold interval Q(bk), then identify the corresponding eigenvalue bl as an unknown risk factor, summarize all the unknown risk factors, and form the corresponding unknown risk factor vector Z for the historical order data of the abnormal category, and Z = [z1, z2,..., zv], where z1 represents the first eigenvalue of the unknown risk factor vector, z2 represents the second eigenvalue of the unknown risk factor vector, and so on, zv represents the v-th eigenvalue of the unknown risk factor vector, and v < m.

[0091] Step S400 includes:

[0092] For the historical order data of the abnormal category, calculate the second risk assessment index R2 according to the corresponding unknown risk factor vector Z, and the specific calculation formula is:

[0093] R2 = Σh∈[1,v],gh·zh,

[0094] where, gh represents the weight of the h-th unknown risk factor, and zh represents the eigenvalue of the h-th unknown risk factor; summarize the second risk assessment indices R2 of all the historical order data of the abnormal category, and arrange the second risk assessment indices R2 in ascending order; according to the risk judgment record, take the first historical order data with an actual risk as the second risk assessment index threshold R3.

[0095] Step S500 includes:

[0096] S501. Obtain the real-time order data of the cloud computing platform, preprocess and statistically analyze the real-time order data to obtain the first feature vector A'. Find the eigenvalue a's in the first feature vector A' corresponding to the second feature vector B of the historical order data of the normal category, and a's represents the s-th eigenvalue in the first feature vector A'. Compare a's with the corresponding threshold interval Q(bk). If each eigenvalue a's in the first feature vector A' belongs to the threshold interval Q(bk), calculate the first risk assessment index R1' of the real-time order data, and compare the first risk assessment index R1' with the corresponding first risk assessment index threshold R0. If the first risk assessment index R1' is less than the first risk assessment index threshold R0, do not output any prompt information; if the first risk assessment index R1' is greater than or equal to the first risk assessment index threshold R0, output a prompt information indicating the existence of risk, and output the number of the real-time order data to the relevant personnel.

[0097] S502. Compare a's with the corresponding threshold interval Q(bk). If there is an eigenvalue a's in the first feature vector A' that does not belong to the threshold interval Q(bk), summarize all the eigenvalues a's that do not belong to the threshold interval Q(bk) and mark them as unknown risk factors. Calculate the corresponding second risk assessment index R2' according to the unknown risk factors. Compare the second risk assessment index R2' with the corresponding second risk assessment index threshold R3. If the second risk assessment index R2' is less than the second risk assessment index threshold R3, do not output any prompt information; if the second risk assessment index R2' is greater than or equal to the second risk assessment index threshold R3, output a prompt information indicating the existence of risk, and output the number of the real-time order data to the relevant personnel.

[0098] It should be noted that in this article, relational terms such as first and second are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations. Moreover, the term "including", "comprising" or any other variant thereof is intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements not only includes those elements, but also includes other elements not expressly listed, or further includes elements inherent to such process, method, article or device.

[0099] Finally, it should be noted that the above are only preferred embodiments of the present invention and are not used to limit the present invention. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art can still modify the technical solutions recorded in the foregoing embodiments or perform equivalent replacements for some of the technical features. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included within the protection scope of the present invention.

Claims

1. A method for monitoring order data risk based on cloud computing, characterized in that: The method comprises the following steps: Step S100. Collect historical order data and corresponding risk judgment records through the cloud computing platform, and pre-process the historical order data, including removing noise data, filling missing values, and standardizing data formats; perform corresponding statistical analysis on the pre-processed historical order data, extract basic features of the historical order data, and form a first feature vector; Step S200. According to the risk judgment records corresponding to the historical order data, the historical order data is divided accordingly; the known risk factors are extracted by combining the division result and the first feature vector; based on the known risk factors, the historical order data is risk assessed to obtain a first risk assessment index; Step S300. According to the first risk assessment index and risk judgment record of the historical order data, a first risk assessment index threshold is obtained; for the first feature vector A of the historical order data of the two categories of normal and abnormal in the risk judgment record, in combination with the known risk factor vector F, the eigenvalue of the known risk factor vector F is screened out from the first feature vector A, thereby obtaining a second feature vector B, and B = [b1, b2, ..., bm-u], similarly, b1 represents the first eigenvalue of the second eigenvector, b2 represents the second eigenvalue of the second eigenvector, bm-u represents the muth eigenvalue of the second eigenvector, and the second eigenvector B has u fewer eigenvalues ​​than the first eigenvector A; For the second eigenvector B of the historical order data of the normal category, the average value μ(bk) and the standard deviation σ(bk) of all eigenvalues ​​are calculated, where bk represents the kth eigenvalue of the second eigenvector B of the normal category, and k ranges from 1 to mu; according to the average value μ(bk) and the standard deviation σ(bk) of bk, the corresponding threshold interval Q(bk) is obtained, and Q(bk)=[μ(bk)-c×σ(bk), μ(bk)+c×σ(bk)], where c represents a constant; for the second eigenvector B of the historical order data of the abnormal category, all corresponding eigenvalues ​​bl are compared with the threshold interval Q(bk), where bl represents the lth eigenvalue of the second eigenvector B of the abnormal category, and l ranges from 1 to mu; if there is an eigenvalue bl in the second eigenvector B of the abnormal category that does not belong to the threshold interval Q(bk), the corresponding eigenvalue bl is identified as an unknown risk factor; Step S400. According to the unknown risk factor, the corresponding historical order data is risk assessed to obtain a second risk assessment index; according to the second risk assessment index of the historical order data and the risk judgment record, a second risk assessment index threshold is obtained; Step S500. Acquire real-time order data of the cloud computing platform, identify unknown risk factors of the real-time order data, calculate the corresponding risk assessment index based on the identification result, compare it with the corresponding risk assessment index threshold, and output corresponding prompt information based on the comparison result.

2. The method for monitoring order data risk based on cloud computing according to claim 1, characterized in that: The step S100 includes: S101. The risk judgment record refers to the final risk judgment result of the historical order data, wherein the risk judgment record includes normal events and abnormal events; the normal event refers to the normal risk judgment result of the historical order data, and the abnormal event refers to the abnormal risk judgment result of the historical order data; wherein the abnormal event includes false positive events and missed positive events, wherein the false positive event refers to the historical order data reporting the existence of risk when there is no risk, and the missed positive event refers to the historical order data not reporting the risk when there is risk; S102. Collect historical order data from the cloud computing platform to form a historical order data set D, where D = {d1, d2, ..., dn}, where d1 represents the first historical order data, d2 represents the second historical order data, and so on, dn represents the nth historical order data, and n represents the historical order data number; for each historical order data, perform data preprocessing, perform corresponding statistical analysis on the preprocessed historical order data, and extract basic features; the basic features refer to data features extracted from the historical order data after statistical analysis; construct a first feature vector A based on the extracted basic features, and A = [a1, a2, ..., am], where a1 represents the first feature of the historical order data, a2 represents the second feature of the historical order data, and so on, am represents the mth feature of the historical order data, and m represents the feature dimension.

3. The method for monitoring order data risk based on cloud computing according to claim 2, characterized in that: The step S200 includes: S201. According to the risk judgment record of the historical order data, the historical order data is divided into two categories, normal and abnormal, which are represented as D_normal and D_abnormal respectively, and the historical order data is associated with the corresponding first eigenvectors, and each historical order data corresponds to a first eigenvector; according to the neighborhood knowledge, the known risk factors are extracted, and combined with the first eigenvector A, a known risk factor vector F is formed, and F = [f1, f2, ..., fu], where f1 represents the first eigenvalue of the known risk factor vector, f2 represents the second eigenvalue of the known risk factor vector, and so on, fu represents the uth eigenvalue of the known risk factor vector; u represents the number of eigenvalues ​​of the known risk factor vector, u<m, and each eigenvalue of the known risk factor vector F exists in the first eigenvector; S202. Calculate the first risk assessment index R1 of all historical order data based on the known risk factor vector F, and the specific calculation formula is: R1=Σj∈[1,u],wj·fj, Among them, wj represents the weight of the j-th known risk factor, fj represents the eigenvalue of the j-th known risk factor; and the first risk assessment index R1 is associated with the first eigenvector of the historical order data to obtain the correspondence between the normal and abnormal categories of historical order data, the first eigenvector, the known risk factor vector and the first risk assessment index.

4. The method for monitoring order data risk based on cloud computing according to claim 3 is characterized in that: The step S300 includes: Summarize the first risk assessment index R1 of historical order data of normal category, and arrange the first risk assessment index R1 in ascending order; according to the risk judgment record, take the first historical order data with risk as the first risk assessment index threshold R0; analyze the first eigenvector according to the known risk factors to obtain the second eigenvector; identify the unknown risk factors by combining the risk judgment record of the historical order data and the second eigenvector, summarize all the unknown risk factors, and construct the corresponding unknown risk factor vector Z for the historical order data of abnormal category, and Z=[z1,z2,...,zv], where z1 represents the first eigenvalue of the unknown risk factor vector, z2 represents the second eigenvalue of the unknown risk factor vector, and so on, zv represents the vth eigenvalue of the unknown risk factor vector, and v<m.

5. The method for monitoring order data risk based on cloud computing according to claim 4, characterized in that: The step S400 includes: For the historical order data of the abnormal category, the second risk assessment index R2 is calculated according to the corresponding unknown risk factor vector Z, and the specific calculation formula is: R2=Σh∈[1,v],gh·zh, Wherein, gh represents the weight of the hth unknown risk factor, zh represents the characteristic value of the hth unknown risk factor; the second risk assessment index R2 of all abnormal categories of historical order data is summarized, and the second risk assessment index R2 is arranged in ascending order; according to the risk judgment record, the first historical order data that actually has risks is used as the second risk assessment index threshold R3.

6. The method for monitoring order data risk based on cloud computing according to claim 5, characterized in that: The step S500 includes: S501. Obtain the real-time order data of the cloud computing platform, perform preprocessing and statistical analysis on the real-time order data, thereby obtaining a first eigenvector A', find the eigenvalue a's corresponding to the second eigenvector B of the historical order data of the normal category in the first eigenvector A', and a's represents the sth eigenvalue in the first eigenvector A'; compare a's with the corresponding threshold interval Q(bk); if each eigenvalue a's in the first eigenvector A' belongs to the threshold interval Q(bk), calculate the first risk assessment index R1' of the real-time order data, and compare the first risk assessment index R1' with the corresponding first risk assessment index threshold R0; if the first risk assessment index R1' is less than the first risk assessment index threshold R0, no prompt information is output; if the first risk assessment index R1' is greater than or equal to the first risk assessment index threshold R0, output a prompt information indicating the existence of risk, and output the number of the real-time order data to relevant personnel; S502. Compare a's with the corresponding threshold interval Q(bk). If there are eigenvalues ​​a's that do not belong to the threshold interval Q(bk) in the first eigenvector A', then all eigenvalues ​​a's that do not belong to the threshold interval Q(bk) are summarized and marked as unknown risk factors; based on the unknown risk factor, calculate the corresponding second risk assessment index R2'; compare the second risk assessment index R2' with the corresponding second risk assessment index threshold R3. If the second risk assessment index R2' is less than the second risk assessment index threshold R3, no prompt information is output; if the second risk assessment index R2' is greater than or equal to the second risk assessment index threshold R3, a prompt information indicating the existence of risks is output, and the number of the real-time order data is output to the relevant personnel.

7. A cloud computing-based order data risk monitoring system, applied to a cloud computing-based order data risk monitoring method according to any one of claims 1 to 6, characterized in that: The system includes: a data acquisition and processing module, a known risk factor extraction and evaluation module, a feature analysis and threshold calculation module, an unknown risk factor extraction and evaluation module, and a real-time data monitoring and alarm module; The data collection and processing module collects historical order data and corresponding risk judgment records, and preprocesses the historical order data, including removing noise data, filling missing values, and standardizing data formats; performs corresponding statistical analysis on the preprocessed historical order data, extracts basic features of the historical order data, and forms a first feature vector; The known risk factor extraction and assessment module divides the historical order data accordingly according to the risk judgment records corresponding to the historical order data; extracts the known risk factors based on the division result and the first eigenvector; and performs risk assessment on the historical order data based on the known risk factors, thereby obtaining a first risk assessment index; The feature analysis and threshold calculation module obtains a first risk assessment index threshold according to the first risk assessment index and risk judgment record of the historical order data; analyzes the first feature vector according to the known risk factors to obtain a second feature vector; The unknown risk factor identification and assessment module identifies the unknown risk factor by combining the risk judgment record of the historical order data and the second feature vector; performs risk assessment on the corresponding historical order data according to the unknown risk factor, thereby obtaining a second risk assessment index; obtains a second risk assessment index threshold according to the second risk assessment index of the historical order data and the risk judgment record; The real-time data monitoring and alarm module obtains real-time order data of the cloud computing platform, identifies unknown risk factors of the real-time order data, calculates a corresponding risk assessment index based on the identification result, compares it with a corresponding risk assessment index threshold, and outputs corresponding prompt information based on the comparison result.

8. The cloud computing-based order data risk monitoring system according to claim 7, characterized in that: The data acquisition and processing module includes a data acquisition unit and a data processing unit; The data collection unit is responsible for collecting historical order data and corresponding risk judgment records from the cloud computing platform and forming a historical order data set; the data processing unit pre-processes the historical order data, including removing noise data, filling missing values ​​and standardizing data formats; Perform corresponding statistical analysis on the preprocessed historical order data, extract the basic features of the historical order data, and form the first feature vector; The known risk factor extraction and assessment module includes a known risk factor extraction unit and a first risk assessment index calculation unit; The known risk factor extraction unit extracts the known risk factors based on the risk judgment records of the historical order data and the first feature vector in combination with the domain knowledge; The first risk assessment index calculation unit calculates a first risk assessment index of the historical order data based on known risk factors.

9. The order data risk monitoring system based on cloud computing according to claim 7 is characterized in that: The feature analysis and threshold calculation module includes a feature vector screening unit and a threshold calculation unit; The feature vector screening unit screens out features that do not contain known risk factors based on the known risk factors and the first feature vector, and generates a second feature vector; the threshold calculation unit analyzes the historical order data of the normal category, calculates the average value and standard deviation of each feature, and generates a corresponding threshold interval; The unknown risk factor identification and assessment module includes an unknown risk factor identification unit and a second risk assessment index calculation unit; The unknown risk factor identification unit analyzes the historical order data of the abnormal category according to the second feature vector and the corresponding threshold interval, identifies the abnormal feature value not included in the known risk factor, and thus identifies the unknown risk factor; The second risk assessment index calculation unit calculates a second risk assessment index based on the identified unknown risk factors; and obtains a second risk assessment index threshold according to the second risk assessment index of the historical order data and the risk judgment record.

10. The order data risk monitoring system based on cloud computing according to claim 7, characterized in that: The real-time data monitoring and alarm module includes a real-time data acquisition and preprocessing unit, a real-time risk assessment unit and a prompt information generation unit; The real-time data collection and preprocessing unit collects order data from the cloud computing platform in real time, performs preprocessing and statistical analysis on the real-time order data, and generates a first feature vector of the real-time order; The real-time risk assessment unit determines whether there is an unknown risk factor by comparing with the second feature vector of the normal category; If there is no unknown risk factor, calculating a first risk assessment index for the real-time order; If there are unknown risk factors in the real-time order data, the second risk assessment index of the real-time order is calculated; the prompt information generation unit compares the first risk assessment index or the second risk assessment index of the real-time order with the corresponding assessment index threshold; if the first risk assessment index or the second risk assessment index is greater than or equal to the corresponding assessment index threshold, a prompt information indicating the existence of risk is generated, and the corresponding real-time order data number is output to relevant personnel.

Images