Transaction index anomaly detection method and device based on index threshold value, and electronic equipment

Abstract

The invention discloses a transaction index anomaly detection method and device based on an index threshold value and electronic equipment, and relates to the field of financial science and technology, and the method comprises the steps: collecting financial transaction data according to an index anomaly detection strategy selected by a business end, the index anomaly detection strategy and the financial transaction data are sent to a transaction anomaly detection model, and the transaction anomaly detection model analyzes a real-time index data value corresponding to each financial transaction index and a preset fixed threshold value or analyzes an ascending proportion or a descending proportion of the index data value and a corresponding preset percentage threshold value; and obtaining a transaction anomaly detection result, triggering a threshold adjustment notification to the service end under the condition that a preset anomaly detection switch and threshold adjustment requirements are met, receiving a threshold adjustment parameter fed back by the service end, and feeding back the threshold adjustment parameter to the transaction anomaly detection model. According to the invention, the technical problem that a fixed threshold anomaly detection mechanism is easy to cause false alarm and low in accuracy in the prior art is solved.

Description

Technical Field

[0001] The present invention relates to the field of financial technology or other related fields, and in particular, to a method and device for detecting anomalies in transaction indicators based on indicator thresholds, and electronic equipment. Background Art

[0002] With the digital transformation of the financial industry and the widespread use of API (Application Programming Interface) services, monitoring between financial institutions and external partners through API interfaces has become increasingly important. The number of partners accessing API services is increasing, and the business scenarios and transaction characteristics of each partner are different, which makes it difficult for a single fixed threshold anomaly detection mechanism to meet the personalized needs of all partners. For example, fixed threshold anomaly detection may produce false positives during the peak business period of some partners, and may miss anomalies during the trough period, which seriously affects the accuracy and effectiveness of transaction monitoring.

[0003] The traditional fixed threshold anomaly detection method monitors indicators based on preset thresholds. This "one-size-fits-all" strategy cannot adapt to the differences in business scenarios of different partners. That is, all partner transactions are based on a single fixed threshold, and its abnormal alarm cannot truly reflect the transaction indicators of each partner. In addition, since the single alarm threshold cannot be personalized to adapt to the actual business anomalies of each partner, it causes false alarms, missed alarms, and frequent alarms.

[0004] The limitations of the fixed threshold anomaly detection mechanism, especially its inflexibility and lack of accuracy when dealing with diverse business scenarios of different partners. Specifically, the present invention proposes a transaction indicator anomaly detection method with customizable thresholds, which aims to overcome the limitations of a single fixed threshold by introducing a fixed threshold anomaly detection strategy and a year-on-year threshold anomaly detection strategy, thereby improving the accuracy and timeliness of transaction anomaly detection, reducing the occurrence of false positives and false negatives, and thus improving the transaction stability and security between financial institutions and partners.

[0005] With the expansion of business, more and more partners are connected to API services. The transaction curves of each partner are different. The abnormal fluctuation alarm based on a single fixed threshold can no longer reflect the real business situation of different partners. All partner transactions are based on a single fixed threshold, and its abnormal alarm cannot truly reflect the transaction indicators of each partner. In addition, the single alarm threshold cannot be personalized to adapt to the real business anomalies of each partner, resulting in false alarms, missed alarms, and frequent alarms.

[0006] To address the above-mentioned problems, no effective solution has been proposed yet. Summary of the invention

[0007] The embodiments of the present invention provide a method and device for detecting anomalies in transaction indicators based on indicator thresholds, and an electronic device, so as to at least solve the technical problems in the related art that the fixed threshold anomaly detection mechanism is prone to false alarms and has low accuracy.

[0008] In order to achieve the above-mentioned purpose, according to one aspect of the present application, a transaction indicator anomaly detection method based on indicator threshold is provided, comprising: receiving an indicator anomaly detection strategy selected by a business end, wherein the indicator anomaly detection strategy comprises: a fixed threshold anomaly detection strategy and a year-on-year threshold anomaly detection strategy, the fixed threshold anomaly detection strategy refers to a strategy of comparing the real-time indicator data value corresponding to each financial transaction indicator with the preset fixed threshold corresponding to the financial transaction indicator, the year-on-year threshold anomaly detection strategy refers to a strategy of comparing the sum of transaction data of the financial transaction indicator in the current time period with the sum of transaction data of the same time period in the historical specified time period, and calculating the increase ratio or decrease ratio with the preset percentage threshold corresponding to the financial transaction indicator; according to the selected indicator anomaly detection strategy, the financial transaction indicators of the current time period are collected. The indicator anomaly detection strategy and the financial transaction data are sent to the transaction anomaly detection model, and the transaction anomaly detection model analyzes the real-time indicator data value corresponding to each financial transaction indicator and the corresponding preset fixed threshold, or analyzes the increase ratio or decrease ratio of the indicator data value of each financial transaction indicator and the corresponding preset percentage threshold to obtain the transaction anomaly detection result; when the transaction anomaly detection result meets the preset anomaly detection switch and threshold adjustment requirements, trigger a threshold adjustment notification to the business end, wherein after receiving the threshold adjustment notification, the business end analyzes the transaction indicator whose indicator threshold needs to be adjusted and the target threshold parameter according to the real-time transaction monitoring curve chart to obtain the threshold adjustment parameter; receives the threshold adjustment parameter fed back by the business end, and feeds the threshold adjustment parameter back to the transaction anomaly detection model.

[0009] Optionally, when the transaction anomaly detection model executes the fixed threshold anomaly detection strategy, it includes: when the real-time indicator data value of the fixed threshold anomaly detection strategy is lower than a first preset fixed threshold, or when the real-time indicator data value of the fixed threshold anomaly detection strategy is higher than a second preset fixed threshold, triggering a first type of alarm, wherein the second preset fixed threshold is greater than the first preset fixed threshold; when the number of the first type of alarms within a preset time period reaches a cumulative threshold of the first type of alarm, triggering a second type of alarm; when the number of the second type of alarms within the preset time period reaches a cumulative threshold of the second type of alarm, triggering a threshold adjustment notification.

[0010] Optionally, when executing the year-on-year threshold anomaly detection strategy, the transaction anomaly detection model includes: obtaining the sum of the first transaction data of the financial transaction indicator in the current time period, and extracting the sum of the second transaction data of the same historical time period as the current time period within a first historical specified time period in the transaction database and the sum of the third transaction data of the same historical time period within a second historical specified time period; calculating the increase ratio or the decrease ratio based on the first transaction data sum, the second transaction data sum and the third transaction data sum; when the increase ratio and the decrease ratio are both greater than 0, and the increase ratio is greater than a first preset percentage threshold, and the decrease ratio is greater than a second preset percentage threshold, triggering a first type of alarm for an increase in the indicator; or, when the increase ratio and the decrease ratio are both less than 0, and the absolute value of the increase ratio is greater than the first preset percentage threshold, and the absolute value of the decrease ratio is greater than the second preset percentage threshold, triggering a first type of alarm for a decrease in the indicator.

[0011] Optionally, when executing the year-on-year threshold anomaly detection strategy, the transaction anomaly detection model also includes: triggering a second type of alarm when the number of first type of alarms for an increase in the indicator reaches a cumulative threshold of the first type of alarm within a preset time period, or when the number of first type of alarms for a decrease in the indicator reaches a cumulative threshold of the first type of alarm within a preset time period; triggering a threshold adjustment notification when the number of second type of alarms reaches a cumulative threshold of the second type of alarm within the preset time period.

[0012] Optionally, after receiving the threshold adjustment parameters, the transaction anomaly detection model further includes: obtaining a partner identifier corresponding to the business end, and extracting financial transaction indicators and partner business scenarios associated with the partner identifier; based on all the extracted financial transaction indicators and partner business scenarios, updating the preset fixed threshold, preset percentage threshold, detection frequency, detection duration, alarm accumulation threshold, and comparison symbol stored in the transaction anomaly detection model.

[0013] Optionally, before receiving the indicator anomaly detection strategy selected by the business end, it also includes: the business end configures the preset fixed threshold and the corresponding comparison symbol according to historical transaction data, the tolerance range of each financial transaction indicator and the business scenario of the partner, and configures the preset percentage threshold and the corresponding comparison symbol.

[0014] Optionally, the financial transaction indicator includes at least one of the following: transaction volume, success rate, and time consumption, wherein the transaction volume is the number of financial transactions occurring in the current time period, the success rate represents the ratio of successful transactions, and the time consumption represents the average processing time for each transaction.

[0015] According to another aspect of an embodiment of the present invention, a transaction indicator anomaly detection device based on indicator threshold is also provided, including: a detection strategy receiving unit, used to receive the indicator anomaly detection strategy selected by the business end, wherein the indicator anomaly detection strategy includes: a fixed threshold anomaly detection strategy and a year-on-year threshold anomaly detection strategy, the fixed threshold anomaly detection strategy refers to a strategy of comparing the real-time indicator data value corresponding to each financial transaction indicator with the preset fixed threshold corresponding to the financial transaction indicator, the year-on-year threshold anomaly detection strategy refers to a strategy of comparing the sum of transaction data of the financial transaction indicator in the current time period with the sum of transaction data of the same time period in the historical specified time period, and calculating the increase ratio or decrease ratio with the preset percentage threshold corresponding to the financial transaction indicator; a model analysis unit, used to collect financial transaction data of the current time period according to the selected indicator anomaly detection strategy. The transaction anomaly detection model is used to analyze the real-time indicator data value corresponding to each financial transaction indicator and the corresponding preset fixed threshold, or analyze the increase ratio or decrease ratio of the indicator data value of each financial transaction indicator and the corresponding preset percentage threshold to obtain the transaction anomaly detection result; a threshold adjustment unit is used to trigger a threshold adjustment notification to the business end when the transaction anomaly detection result meets the preset anomaly detection switch and threshold adjustment requirements, wherein after receiving the threshold adjustment notification, the business end analyzes the transaction indicator whose indicator threshold needs to be adjusted and the target threshold parameter according to the real-time transaction monitoring curve chart to obtain the threshold adjustment parameter; a threshold feedback unit is used to receive the threshold adjustment parameter fed back by the business end, and feed the threshold adjustment parameter back to the transaction anomaly detection model.

[0016] Optionally, when executing a fixed threshold anomaly detection strategy, the transaction anomaly detection model in the transaction indicator anomaly detection device based on indicator threshold includes: a first trigger unit, used to trigger a first type of alarm when the real-time indicator data value of the fixed threshold anomaly detection strategy is lower than a first preset fixed threshold, or when the real-time indicator data value of the fixed threshold anomaly detection strategy is higher than a second preset fixed threshold, wherein the second preset fixed threshold is greater than the first preset fixed threshold; a second trigger unit, used to trigger a second type of alarm when the number of the first type of alarms within a preset time period reaches a cumulative threshold of the first type of alarm; and a third trigger unit, used to trigger a threshold adjustment notification when the number of the second type of alarms within a preset time period reaches a cumulative threshold of the second type of alarm.

[0017] Optionally, when executing the year-on-year threshold anomaly detection strategy, the transaction anomaly detection model in the transaction indicator anomaly detection device based on the indicator threshold includes: a data sum acquisition unit, which is used to obtain the first transaction data sum of the financial transaction indicator in the current time period, and extract the second transaction data sum of the same historical time period as the current time period within the first historical specified time period in the transaction database and the third transaction data sum of the same historical time period within the second historical specified time period; a calculation unit, which is used to calculate the increase ratio or the decrease ratio based on the first transaction data sum, the second transaction data sum and the third transaction data sum; a fourth triggering unit, which is used to trigger a first type of alarm for an increase in the indicator when the increase ratio and the decrease ratio are both greater than 0, and the increase ratio is greater than a first preset percentage threshold, and the decrease ratio is greater than a second preset percentage threshold; or, when the increase ratio and the decrease ratio are both less than 0, and the absolute value of the increase ratio is greater than the first preset percentage threshold, and the absolute value of the decrease ratio is greater than the second preset percentage threshold, trigger the first type of alarm for a decrease in the indicator.

[0018] Optionally, when executing the year-on-year threshold anomaly detection strategy, the transaction anomaly detection model in the transaction indicator anomaly detection device based on indicator threshold further includes: a fifth trigger unit, which is used to trigger the second type of alarm when the number of first type of alarms for the increase of the indicator within a preset time period reaches the cumulative threshold of the first type of alarm, or when the number of first type of alarms for the decrease of the indicator within a preset time period reaches the cumulative threshold of the first type of alarm; a sixth trigger unit, which is used to trigger a threshold adjustment notification when the number of second type of alarms within the preset time period reaches the cumulative threshold of the second type of alarm.

[0019] Optionally, the transaction indicator anomaly detection device based on indicator threshold also includes: a partner identification acquisition unit, which is used for the transaction anomaly detection model to obtain the partner identification corresponding to the business end after receiving the threshold adjustment parameter, and extract the financial transaction indicators and partner business scenarios associated with the partner identification; a parameter updating unit, which is used to update the preset fixed threshold, preset percentage threshold, detection frequency, detection duration, alarm accumulation threshold, and comparison symbol stored in the transaction anomaly detection model based on all the extracted financial transaction indicators and partner business scenarios.

[0020] Optionally, the transaction indicator anomaly detection device based on indicator threshold also includes: a threshold configuration unit, which is used to configure the preset fixed threshold and the corresponding comparison symbol, and configure the preset percentage threshold and the corresponding comparison symbol, by the business end according to historical transaction data, the tolerance range of each financial transaction indicator and the business scenario of the partner before receiving the indicator anomaly detection strategy selected by the business end.

[0021] Optionally, the financial transaction indicator includes at least one of the following: transaction volume, success rate, and time consumption, wherein the transaction volume is the number of financial transactions occurring in the current time period, the success rate represents the ratio of successful transactions, and the time consumption represents the average processing time for each transaction.

[0022] According to another aspect of an embodiment of the present invention, a computer-readable storage medium is also provided, wherein the computer-readable storage medium includes a stored computer program, wherein when the computer program is running, the device where the computer-readable storage medium is located is controlled to execute any one of the above-mentioned transaction indicator anomaly detection methods based on indicator thresholds.

[0023] According to another aspect of an embodiment of the present invention, there is also provided an electronic device, comprising one or more processors and a memory, wherein the memory is used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement any one of the above-mentioned transaction indicator anomaly detection methods based on indicator thresholds.

[0024] According to another aspect of an embodiment of the present invention, a computer program product is also provided, including a computer program, which, when executed by a processor, implements the steps of any one of the above-mentioned methods for detecting anomalies in trading indicators based on indicator thresholds.

[0025] In the present disclosure, the indicator anomaly detection strategy selected by the business end is first received, and then the financial transaction data of the current time period is collected according to the selected indicator anomaly detection strategy, and the indicator anomaly detection strategy and the financial transaction data are sent to the transaction anomaly detection model, and the transaction anomaly detection model analyzes the real-time indicator data value corresponding to each financial transaction indicator and the corresponding preset fixed threshold, or analyzes the increase ratio or decrease ratio of the indicator data value of each financial transaction indicator and the corresponding preset percentage threshold to obtain the transaction anomaly detection result. When the transaction anomaly detection result meets the preset anomaly detection switch and threshold adjustment requirements, the threshold adjustment notification is triggered to the business end, wherein after receiving the threshold adjustment notification, the business end analyzes the transaction indicator whose indicator threshold needs to be adjusted and the target threshold parameter according to the real-time transaction monitoring curve chart to obtain the threshold adjustment parameter, receives the threshold adjustment parameter fed back by the business end, and feeds the threshold adjustment parameter back to the transaction anomaly detection model.

[0026] According to the above-mentioned public content, when a large number of alarms or false alarms are detected, a threshold adjustment notification will be triggered. The business end can analyze the business situation according to the real-time transaction monitoring curve chart, flexibly adjust various threshold parameters, and ensure the accuracy of the transaction monitoring strategy. This can solve the technical problems of fixed threshold anomaly detection mechanism in related technologies, which is prone to false alarms and low accuracy. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] The drawings described herein are used to provide a further understanding of the present invention and constitute a part of this application. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute an improper limitation of the present invention. In the drawings:

[0028] Figure 1 A hardware structure block diagram of a computer terminal (or mobile device) for implementing a transaction indicator anomaly detection method based on an indicator threshold is shown;

[0029] Figure 2 is a flowchart of an optional transaction indicator anomaly detection method based on indicator threshold according to an embodiment of the present invention;

[0030] Figure 3 is a flowchart of another optional transaction anomaly detection method based on indicator threshold according to an embodiment of the present invention;

[0031] Figure 4 is a schematic diagram of an optional transaction indicator anomaly detection device based on indicator threshold according to an embodiment of the present invention;

[0032] Figure 5 It is a structural block diagram of an electronic device according to an embodiment of the present application. DETAILED DESCRIPTION

[0033] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0034] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0035] It should be noted that the transaction indicator anomaly detection method based on indicator threshold and the device thereof in the present disclosure can be used in the field of financial technology. When the transaction indicator anomaly detection with customizable thresholds is implemented based on financial technology, it can also be used in any field other than the field of financial technology. When the transaction indicator anomaly detection with customizable thresholds is implemented based on financial technology, the present disclosure does not limit the application field of the transaction indicator anomaly detection method based on indicator threshold and the device thereof.

[0036] It should be noted that the information (including but not limited to business-side equipment information, partner information, user equipment information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) collected by this disclosure are information and data authorized by the user or fully authorized by all parties, and the collection, storage, use, processing, transmission, provision, disclosure and application of relevant data are in compliance with the relevant laws, regulations and standards of the relevant regions, necessary confidentiality measures are taken, and public order and good customs are not violated, and corresponding operation portals are provided for users to choose to authorize or refuse. For example, an interface is set up between this system and relevant users or organizations. Before obtaining relevant information, it is necessary to send an acquisition request to the aforementioned user or organization through the interface, and obtain relevant information after receiving the consent information fed back by the aforementioned user or organization.

[0037] It should be noted that in the present disclosure, when collecting and analyzing customer information, corresponding operation entrances are provided for users to choose to agree or reject the automated decision results; if the user chooses to reject, the expert decision-making process is entered.

[0038] The following embodiments of the present invention can be applied to various systems / applications / devices for transaction indicator anomaly detection based on indicator thresholds. The present invention proposes a transaction indicator anomaly detection method with customizable thresholds, which aims to overcome the limitations of a single fixed threshold by introducing a fixed threshold anomaly detection strategy and a year-on-year threshold anomaly detection strategy, thereby improving the accuracy and timeliness of transaction anomaly detection, reducing the occurrence of false positives and false negatives, and thus improving the transaction stability and security between financial institutions and partners.

[0039] Under the fixed threshold anomaly detection strategy, the present invention solves the problem that a single fixed threshold cannot adapt to transaction indicator monitoring in different business scenarios. The business end flexibly configures detection parameters according to historical transaction data and business needs, including detection frequency, detection duration, alarm accumulation threshold, etc., to ensure the accuracy of anomaly detection.

[0040] Under the year-on-year threshold anomaly detection strategy, the present invention solves the problem of false positives and missed negatives in fixed threshold anomaly detection caused by large fluctuations in indicators such as trading volume in different time periods. By conducting year-on-year analysis on trading data in the same historical period, a more reasonable threshold is used for anomaly detection, thereby improving the accuracy and reliability of the detection results.

[0041] The present invention is described in detail below in conjunction with various embodiments.

[0042] Embodiment 1

[0043] According to an embodiment of the present invention, an embodiment of a method for detecting anomalies in trading indicators based on indicator thresholds is provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in an order different from that shown here.

[0044] The transaction indicator anomaly detection method embodiment based on indicator threshold provided in the first embodiment of the present application can be executed in a mobile terminal, a computer terminal or a similar computing device. Figure 1 The hardware structure block diagram of a computer terminal (or mobile device) for implementing a transaction indicator anomaly detection method based on an indicator threshold is shown. Figure 1 As shown, the computer terminal 10 (or mobile device) may include one or more ( Figure 1 The computer system 102 includes a processor 102 (the processor 102 may include but is not limited to a microprocessor MCU (Microcontroller Unit) or a programmable logic device FPGA (Field Programmable Gate Array)), a memory 104 for storing data, and a transmission device 106 for communication functions. In addition, it may also include: a display, an input / output interface (I / O interface), a Universal Serial Bus (USB) port (which may be included as one of the ports of the BUS bus), a network interface, a power supply and / or a camera. A person skilled in the art can understand that Figure 1 The structure shown is only for illustration and does not limit the structure of the above electronic device. Figure 1 More or fewer components as shown, or with Figure 1 Different configurations are shown.

[0045] It should be noted that the one or more processors 102 and / or other data processing circuits described above may generally be referred to herein as "data processing circuits". The data processing circuits may be embodied in whole or in part as software, hardware, firmware, or any other combination thereof. In addition, the data processing circuit may be a single independent processing module, or may be incorporated in whole or in part into any of the other components in the computer terminal 10 (or mobile device). As described in the embodiments of the present application, the data processing circuit acts as a processor control (e.g., selection of a variable resistor terminal path connected to an interface).

[0046] The memory 104 can be used to store software programs and modules of application software, such as the program instructions / data storage device corresponding to the transaction index anomaly detection method based on the index threshold in the embodiment of the present application. The processor 102 executes various functional applications and data processing by running the software programs and modules stored in the memory 104, that is, the above-mentioned transaction index anomaly detection method based on the index threshold is realized. The memory 104 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some examples, the memory 104 may further include a memory remotely arranged relative to the processor 102, and these remote memories may be connected to the computer terminal 10 via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and a combination thereof.

[0047] The transmission device 106 is used to receive or send data via a network. The specific example of the above network may include a wireless network provided by a communication provider of the computer terminal 10. In one example, the transmission device 106 includes a network adapter (Network Interface Controller, NIC), which can be connected to other network devices through a base station so as to communicate with the Internet. In one example, the transmission device 106 can be a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

[0048] The display may be, for example, a touch screen liquid crystal display (LCD), which enables a user to interact with a user interface of the computer terminal 10 (or mobile device).

[0049] Under the above operating environment, the present invention provides Figure 2 The trading indicator anomaly detection method based on indicator threshold is shown. Figure 2 The present invention is a flowchart of an optional method for detecting anomalies in transaction indicators based on indicator thresholds according to an embodiment of the present invention.

[0050] The present invention proposes an alarm model with customizable thresholds for financial transaction monitoring indicators such as transaction volume, success rate, and time consumption. It provides two detection schemes: fixed threshold anomaly detection and year-on-year threshold anomaly detection, which are adapted to the anomaly monitoring capabilities of indicators of different natures. At the same time, the switches and threshold parameters of the detection model can be manually adjusted and take effect in real time, which can effectively adapt to differentiated partner business scenarios.

[0051] It should be noted that the transaction index anomaly detection method of the present application is applicable to diversified business scenarios of API interface transaction monitoring between financial institutions and their partners, such as financial transaction volume monitoring scenarios, transaction success rate monitoring scenarios, transaction time monitoring scenarios, real-time transaction risk control scenarios, and dynamic adjustment scenarios of transaction monitoring. Among them, in financial transaction volume monitoring scenarios, such as retail payment, online lending, insurance quotation and other businesses, financial transaction volume will show significant volatility with time, location, holidays and other factors. For example, the transaction volume of subway code scanning payment during peak hours in the morning and evening is much higher than that during non-peak hours, while online insurance sales may drop significantly during holidays. Through the year-on-year threshold anomaly detection strategy of the present invention, the system can automatically compare the transaction volume of the current period with the transaction volume of the same historical period (such as 1 day ago, 7 days ago, etc.), calculate the proportion of increase or decrease, and compare it with the preset percentage threshold, so as to accurately identify the period of abnormal fluctuation of transaction volume and reduce false positives and false negatives. For transaction success rate monitoring scenarios, such as credit card application, bank-enterprise docking, cross-border transactions and other businesses, the transaction success rate is not only affected by system performance, but also by multiple factors such as user behavior and partner service stability. By using the fixed threshold anomaly detection strategy of the present invention, the business end can set a reasonable success ratio threshold. When the real-time transaction success rate is lower than or higher than this threshold, the system automatically triggers an alarm to help financial institutions quickly identify potential risks, such as partner system failures, fraud, etc. For transaction time monitoring scenarios, such as high-frequency transactions, real-time payments, etc., the time consumed by transaction processing has an important impact on user experience and system performance. Time consumption anomalies may be caused by network delays, system bottlenecks, or increased response time of partners. The fixed threshold anomaly detection strategy of the present invention can monitor transaction time indicators in real time. Once it is detected that the time consumption exceeds the preset threshold, an alarm is triggered immediately, so that the technical team can quickly locate and solve the problem to avoid a continuous negative impact on the business. For real-time transaction risk control scenarios, such as in the financial field, timely identification and control of transaction risks are crucial, especially for high-risk scenarios such as large transactions and suspicious transactions. Through the transaction indicator anomaly detection method of the present invention, financial institutions can monitor transaction data in real time. Once anomalies are detected, risk assessment and control are immediately performed, such as suspending transactions, increasing manual review, etc., thereby effectively preventing risks. For the dynamic adjustment scenario of transaction monitoring, the transaction environment and business needs of financial institutions change over time, and fixed anomaly detection strategies may gradually lose their effectiveness. The present invention provides a threshold adjustment mechanism. When the system detects a large number of alarms or false alarms, it will trigger a threshold adjustment notification. Business personnel can analyze the business situation based on the real-time transaction monitoring curve chart and flexibly adjust various threshold parameters to ensure the continued applicability and accuracy of the transaction monitoring strategy.

[0052] like Figure 2As shown, the transaction indicator anomaly detection method based on indicator threshold includes the following steps:

[0053] It should be noted that before the system officially starts the indicator anomaly detection, the business end (such as the risk control department of a financial institution) needs to set the most appropriate indicator anomaly detection strategy parameters based on historical transaction data, business volatility characteristics, and the specific business scenarios of the partners. Optionally, before receiving the indicator anomaly detection strategy selected by the business end, the business end configures the preset fixed threshold and the corresponding comparison symbol based on the historical transaction data, the tolerance range of each financial transaction indicator, and the business scenario of the partner, and configures the preset percentage threshold and the corresponding comparison symbol.

[0054] Business personnel will conduct in-depth analysis of transaction data over a period of time to identify normal fluctuation ranges and abnormal patterns of indicators such as transaction volume, success rate, and time consumption. For example, through the analysis of transaction success rate, it may be found that fluctuations between 98% and 100% are within the normal range, while those below 98% may indicate system problems or fraud.

[0055] When setting the tolerance range of indicators, based on historical data analysis, the business end will set a tolerance range for each monitoring indicator, which reflects the degree of indicator fluctuation that the business can accept. For example, for transaction time, if the average time is 100 milliseconds, a tolerance range of ±20% may be set, that is, fluctuations between 80 and 120 milliseconds are considered normal. When configuring preset fixed thresholds and comparison symbols, business personnel configure a preset fixed threshold and corresponding comparison symbol (such as "less than", "greater than", etc.) for each indicator based on the analysis results. For example, for transaction success rate, the preset fixed threshold may be set to 98%, and the comparison symbol is set to "less than", which means that any success rate below 98% will trigger an alarm. The preset fixed threshold for transaction time may be set to 120 milliseconds, and the comparison symbol is set to "greater than", that is, time exceeding 120 milliseconds will be marked as abnormal. When configuring the preset percentage threshold and comparison symbol, for indicators such as transaction volume, when business personnel adopt the year-on-year threshold anomaly detection strategy, they need to set a preset percentage threshold and corresponding comparison symbol. For example, the threshold for a year-on-year increase or decrease in trading volume may be set at 20%, and the comparison operator is also "greater than" or "less than", which means that an increase or decrease of more than 20% in trading volume compared to the same period in history will trigger anomaly detection.

[0056] By configuring thresholds and comparison symbols, we ensure that the anomaly detection strategy can adapt to the business scenarios of our partners, reduce false positives and false negatives, and improve detection efficiency and accuracy.

[0057] It should also be noted that the present invention can be applied to the transaction anomaly detection system of a financial institution. The transaction anomaly detection system pre-deploys a transaction anomaly detection model and an alarm notification module. The transaction anomaly detection model anomaly detection module will analyze the data according to pre-set strategies and thresholds, and the alarm notification module is responsible for sending alarm notifications to business personnel in a timely manner when an anomaly is detected.

[0058] Step S201, receiving the indicator anomaly detection strategy selected by the business end.

[0059] Among them, the indicator anomaly detection strategy includes: a fixed threshold anomaly detection strategy and a year-on-year threshold anomaly detection strategy. The fixed threshold anomaly detection strategy refers to a strategy that compares the real-time indicator data value corresponding to each financial transaction indicator with the preset fixed threshold value corresponding to the financial transaction indicator. The year-on-year threshold anomaly detection strategy refers to a strategy that compares the total transaction data of the financial transaction indicator in the current time period with the total transaction data of the same period in the historical specified time period, and compares the calculated increase or decrease ratio with the preset percentage threshold value corresponding to the financial transaction indicator.

[0060] When the business end selects an indicator anomaly detection strategy from the user interface (such as a web portal, mobile application, or dedicated management tool), the system will first present a strategy selection interface, listing fixed threshold anomaly detection strategies and year-on-year threshold anomaly detection strategies. The business end can select the most appropriate detection strategy based on the business characteristics of the current partner and historical transaction data. When selecting a fixed threshold anomaly detection strategy, the business end needs to set a stable threshold that reflects normal trading activities based on the historical statistical data of the monitoring indicators (such as transaction success rate, transaction volume, and transaction time). For example, the threshold for success rate may be set to 95%, the threshold for transaction volume may be based on 2 times the average daily transaction volume, and the threshold for transaction time may be based on 1.5 times the average transaction time. When selecting a year-on-year threshold anomaly detection strategy, the business personnel need to set the duration of the historical comparison and the year-on-year date (such as 1 day ago or 7 days ago), and set a reasonable percentage threshold based on business volatility, such as a threshold for a 20% increase or decrease in transaction volume.

[0061] It should be noted that the financial transaction indicators mentioned in this embodiment include at least one of the following: transaction volume, success rate, and time consumption. Among them, the transaction volume is the number of financial transactions occurring in the current time period, which reflects the activity of transactions within a certain period of time. For financial institutions, abnormal fluctuations in transaction volume often indicate potential business risks or opportunities. For example, a sudden and sharp drop in transaction volume may mean user loss or system failure, while an abnormal increase in transaction volume may indicate the success of financial promotion activities or the existence of abnormal transaction behavior. The success rate represents the ratio of successful transactions and is an important indicator for measuring the health of the transaction system and the quality of transactions. A stable success rate means the efficient operation of the transaction system, while a sudden drop in the success rate may indicate system performance problems or an increase in fraud. For example, a drop in the success rate of credit card payments may indicate that credit card information has been stolen or that the payment system has failed. The processing time indicates the average processing time of each transaction, which is used to reflect the efficiency of transaction processing. Long processing time may lead to a decline in user experience or even transaction failure. An abnormal increase in processing time may indicate a system bottleneck or external service delay, which needs to be quickly located and resolved. For example, in a payment gateway, if the average processing time of each transaction suddenly increases, it may mean that the processing capacity of the gateway server is insufficient and needs to be expanded or optimized.

[0062] Anomaly detection of financial transaction indicators plays a key role in maintaining the business stability and user trust of financial institutions. By monitoring these indicators in real time and responding quickly when anomalies occur, financial institutions can effectively prevent risks and ensure the normal operation of their businesses. At the same time, due to the flexibility of the indicator anomaly detection strategy, the system can adapt to the business characteristics of different partners and ensure the personalization and precision of the monitoring strategy.

[0063] Step S202: According to the selected indicator anomaly detection strategy, the financial transaction data of the current time period is collected, and the indicator anomaly detection strategy and the financial transaction data are sent to the transaction anomaly detection model. The transaction anomaly detection model analyzes the real-time indicator data value corresponding to each financial transaction indicator and the corresponding preset fixed threshold, or analyzes the increase ratio or decrease ratio of the indicator data value of each financial transaction indicator and the corresponding preset percentage threshold to obtain the transaction anomaly detection result.

[0064] After selecting the detection strategy and completing the threshold configuration on the business side, the system starts to collect financial transaction data in the current time period in real time. For the fixed threshold anomaly detection strategy, the system will compare the real-time data value of each monitoring indicator with the preset fixed threshold in real time. Once the data value deviates from the threshold, it indicates that there may be an anomaly, and the system will generate the corresponding anomaly detection result. For the year-on-year threshold anomaly detection strategy, the system will calculate the total transaction data of the monitoring indicator in the current time period, and compare it with the total transaction data of the same period in the historical specified time period, calculate the increase or decrease ratio, and if the ratio exceeds the preset percentage threshold, it is also considered to be an anomaly, and generate a transaction anomaly detection result. The transaction anomaly detection results, together with the detection strategy and financial transaction data, will be sent to the transaction anomaly detection model, and the model will make further analysis and judgment based on this information.

[0065] It should be noted that, for each indicator, the transaction anomaly detection model is used to check whether its data value is lower than the first preset fixed threshold or higher than the second preset fixed threshold. Optionally, when the transaction anomaly detection model executes the fixed threshold anomaly detection strategy, it includes: when the real-time indicator data value of the fixed threshold anomaly detection strategy is lower than the first preset fixed threshold, or when the real-time indicator data value of the fixed threshold anomaly detection strategy is higher than the second preset fixed threshold, triggering a first type of alarm, wherein the second preset fixed threshold is greater than the first preset fixed threshold; when the number of first type of alarms within a preset time period reaches the cumulative threshold of the first type of alarm, triggering a second type of alarm; when the number of second type of alarms within a preset time period reaches the cumulative threshold of the second type of alarm, triggering a threshold adjustment notification.

[0066] For example, for the transaction success rate indicator, if its real-time data value is lower than the preset 98% (the first preset fixed threshold), or the real-time data value of the time-consuming indicator is higher than the preset 150 milliseconds (the second preset fixed threshold), the model will immediately trigger the first type of alarm. It is worth noting that the second preset fixed threshold is usually greater than the first preset fixed threshold to ensure that the model can distinguish between abnormally low and abnormally high indicator values.

[0067] In this embodiment, the model will record the number of times the first type of alarm is triggered (which can be understood as a normal alarm notification). If the number of times the first type of alarm is triggered reaches the cumulative threshold of the first type of alarm within a preset time period, such as 1 hour, for example, 5 times, the model will upgrade the alarm level and trigger the second type of alarm (which can be understood as a serious alarm notification). The second type of alarm usually represents the persistence of the indicator abnormality, indicating that there may be more serious problems and immediate measures need to be taken. If the second type of alarm is continuously triggered within the preset time period and reaches the cumulative threshold of the second type of alarm, for example, 3 times, the model will automatically trigger a threshold adjustment notification. This indicates that the current detection strategy may no longer be applicable to the current business scenario, and business personnel are required to re-evaluate and adjust the preset fixed threshold to ensure that subsequent anomaly detection is more accurate and effective.

[0068] Optionally, when executing the year-on-year threshold anomaly detection strategy, the transaction anomaly detection model includes: obtaining the sum of the first transaction data of the financial transaction indicator in the current time period, and extracting the sum of the second transaction data of the same historical time period corresponding to the current time period within the first historical specified time period in the transaction database and the sum of the third transaction data of the same historical time period within the second historical specified time period; calculating the increase ratio or the decrease ratio based on the sum of the first transaction data, the sum of the second transaction data and the sum of the third transaction data; when the increase ratio and the decrease ratio are both greater than 0, and the increase ratio is greater than the first preset percentage threshold, and the decrease ratio is greater than the second preset percentage threshold, triggering a first type of alarm for an increase in the indicator; or, when the increase ratio and the decrease ratio are both less than 0, and the absolute value of the increase ratio is greater than the first preset percentage threshold, and the absolute value of the decrease ratio is greater than the second preset percentage threshold, triggering a first type of alarm for a decrease in the indicator.

[0069] The transaction anomaly detection model collects the sum of financial transaction data in the current time period in real time, and extracts the sum of transaction data in the same period within two historical specified time periods (for example, 1 day ago and 7 days ago) from the historical database. For example, for the transaction volume indicator, the model will calculate the sum of transaction volume in the current period (the embodiment of the present invention can set the first transaction data sum to A1), and extract the sum of transaction volume in the same period 1 day ago (the embodiment of the present invention can set the second transaction data sum to A2), and the sum of transaction volume in the same period 7 days ago (the embodiment of the present invention can set the third transaction data sum to A3). Then the transaction anomaly detection model calculates the increase ratio C1 = (A1-A2) / A2 and the decrease ratio C2 = (A1-A3) / A3 of the transaction volume based on the sum of the current transaction data and the sum of the historical transaction data. These two ratios reflect the degree of fluctuation of the current transaction volume compared with the same period in history, which helps to determine whether the transaction volume is abnormal.

[0070] Optionally, when executing the year-on-year threshold anomaly detection strategy, the transaction anomaly detection model also includes: triggering a second type of alarm when the number of first type of alarms for rising indicators within a preset time period reaches a cumulative threshold of the first type of alarm, or when the number of first type of alarms for falling indicators within a preset time period reaches a cumulative threshold of the first type of alarm; triggering a threshold adjustment notification when the number of second type of alarms within the preset time period reaches a cumulative threshold of the second type of alarm.

[0071] The transaction anomaly detection model checks whether the calculated increase ratio C1 and decrease ratio C2 meet the conditions of the preset percentage threshold. If both C1 and C2 are greater than 0, and C1 is greater than the first preset percentage threshold (for example, 5%), and C2 is greater than the second preset percentage threshold (for example, 5%), the model will trigger the first type of alarm for the increase of the indicator. Similarly, if both C1 and C2 are less than 0, and the absolute value of C1 is greater than the first preset percentage threshold, and the absolute value of C2 is greater than the second preset percentage threshold, the model will trigger the first type of alarm for the decrease of the indicator. This indicates that the fluctuation of the current transaction volume exceeds the historical normal range and there may be anomalies. Similar to the fixed threshold anomaly detection strategy, the transaction anomaly detection model records the number of times the first type of alarm is triggered. If the number of times the first type of alarm is triggered reaches the cumulative threshold of the first type of alarm (for example, 5 times) within the preset time period, the model will upgrade the alarm level and trigger the second type of alarm, prompting business personnel to pay attention to the continued abnormal fluctuations. If the second type of alarm is continuously triggered within the preset time period and reaches the cumulative threshold of the second type of alarm (for example, 3 times), the model will automatically trigger a threshold adjustment notification, prompting the business end to re-evaluate the percentage threshold of year-on-year detection to better adapt to the current business fluctuations and market environment.

[0072] Step S203, when the transaction anomaly detection result meets the preset anomaly detection switch and threshold adjustment requirements, trigger a threshold adjustment notification to the business end. After receiving the threshold adjustment notification, the business end analyzes the transaction indicators and target threshold parameters of the indicator threshold that need to be adjusted according to the real-time transaction monitoring curve chart to obtain the threshold adjustment parameters.

[0073] Here, after analyzing all transaction data, the transaction anomaly detection model will determine whether a threshold adjustment notification needs to be triggered based on the preset anomaly detection switch and threshold adjustment rules. If the detection results reach or exceed the cumulative threshold of severe alarms for multiple consecutive times, or the frequency of false positives / missed negatives is higher than the preset value, the model will recognize that the current detection strategy and threshold may no longer be applicable to the current business scenario, and a threshold adjustment notification will be triggered.

[0074] It should be noted that the threshold adjustment notification will be sent to the business end. After receiving the notification, the business end will call up the real-time transaction monitoring curve chart and analyze the current business situation by observing the trend of the curve. The curve chart will show the change trend of each monitoring indicator over time, as well as the comparison with the preset detection threshold, to help the business end determine which indicator needs to be adjusted, as well as the magnitude and direction of the adjustment. Based on the analysis results, the business end determines the indicator threshold and target threshold parameters that need to be adjusted, and generates the threshold adjustment parameters.

[0075] Step S204, receiving the threshold adjustment parameters fed back by the business end, and feeding back the threshold adjustment parameters to the transaction anomaly detection model.

[0076] After generating the threshold adjustment parameters, the business end will feed back the adjustment parameters to the transaction anomaly detection model through the interface or interface provided by the system. After receiving the new threshold adjustment parameters, the transaction anomaly detection model will immediately update its internal detection strategy and threshold settings to reflect the latest analysis results and adjustment decisions of the business personnel. The update process is real-time, ensuring that the new threshold parameters can take effect immediately, so as to quickly adapt to the current business fluctuations and risk conditions and improve the accuracy and timeliness of anomaly detection. After the model update is completed, the new detection strategy and threshold will continue to be used for real-time monitoring of transaction data, forming a closed-loop transaction anomaly detection and adjustment mechanism.

[0077] Through the above steps, the indicator anomaly detection strategy selected by the business end can be received first, and then according to the selected indicator anomaly detection strategy, the financial transaction data of the current time period can be collected, and the indicator anomaly detection strategy and the financial transaction data can be sent to the transaction anomaly detection model, and the transaction anomaly detection model can analyze the real-time indicator data value corresponding to each financial transaction indicator and the corresponding preset fixed threshold, or analyze the rising ratio or falling ratio of the indicator data value of each financial transaction indicator and the corresponding preset percentage threshold, and obtain the transaction anomaly detection result. When the transaction anomaly detection result meets the preset anomaly detection switch and threshold adjustment requirements, the threshold adjustment notification is triggered to the business end, wherein after the business end receives the threshold adjustment notification, the transaction indicator and the target threshold parameter of the indicator threshold that need to be adjusted are analyzed according to the real-time transaction monitoring curve chart, and the threshold adjustment parameter is obtained, and the threshold adjustment parameter is received from the business end, and the threshold adjustment parameter is fed back to the transaction anomaly detection model. In this embodiment, when a large number of alarms or false alarms are detected, the threshold adjustment notification will be triggered, and the business end can analyze the business situation according to the real-time transaction monitoring curve chart, flexibly adjust various threshold parameters, ensure the accuracy of the transaction monitoring strategy, and solve the technical problems of the fixed threshold anomaly detection mechanism in the related technology, which is prone to false alarms and low accuracy.

[0078] Optionally, after receiving the threshold adjustment parameters, the transaction anomaly detection model also includes: obtaining the partner identifier corresponding to the business end, and extracting the financial transaction indicators and partner business scenarios associated with the partner identifier; based on all the extracted financial transaction indicators and partner business scenarios, updating the preset fixed threshold, preset percentage threshold, detection frequency, detection duration, alarm accumulation threshold, and comparison symbol saved in the transaction anomaly detection model.

[0079] When the transaction anomaly detection model receives the threshold adjustment parameters fed back by the business side, the model will perform a series of updates and optimization operations to ensure that its detection strategy can adapt to business development and market changes in real time and accurately. The transaction anomaly detection model will first extract the partner ID corresponding to the business side from the threshold adjustment notification. This ID is important correlation information for transaction monitoring and anomaly detection between the partner and the financial institution. Then, the transaction anomaly detection model will extract all financial transaction indicator data related to the partner from the system database based on the partner ID, including but not limited to transaction volume, success rate, time consumption, etc., as well as the partner's business scenario information, such as business type, transaction peak period, holiday impact, etc.

[0080] For different anomaly detection strategies, the parameters to be adjusted are different. For indicators that use a fixed threshold anomaly detection strategy, the model will update the preset fixed threshold saved inside the model according to the new threshold provided by the business personnel in the threshold adjustment parameters. For example, if the business personnel adjusts the threshold of the transaction success rate, the model will update the fixed threshold of the transaction success rate to the new value to reflect the latest business risk tolerance. For indicators that use a year-on-year threshold anomaly detection strategy, the model will update the preset percentage threshold saved inside the model according to the threshold adjustment parameters of the business personnel. For example, if the business personnel adjusts the percentage threshold of the year-on-year increase in transaction volume based on market changes, the model will update the corresponding percentage threshold to ensure the accuracy and timeliness of year-on-year detection.

[0081] The threshold adjustment parameters may include adjustments to the detection frequency and detection duration. The detection frequency determines the cycle of the model's indicator data sampling and anomaly detection, while the detection duration affects the statistical range of the data. The model will adjust its data collection and analysis cycle based on these parameters to more accurately reflect the real-time status of the current business.

[0082] The transaction anomaly detection model can also adjust parameters based on the thresholds of the business end, update the cumulative thresholds of the first and second category alarms, and the comparison symbols related to threshold detection (such as "less than", "greater than", etc.). This helps the model more accurately determine when to upgrade from the first category alarm to the second category alarm, and when to trigger the threshold adjustment notification, thereby optimizing the alarm triggering mechanism and reducing false positives and false negatives.

[0083] After updating the above parameters, the transaction anomaly detection model re-evaluates and optimizes its overall detection strategy based on the new partner business scenarios and indicator thresholds, including adjusting the data processing algorithm and optimizing the data storage structure to improve the efficiency and accuracy of anomaly detection. In addition, the transaction anomaly detection model can also flexibly switch between fixed threshold anomaly detection and year-on-year threshold anomaly detection strategies according to business needs to adapt to indicator monitoring needs of different natures.

[0084] Another optional specific implementation is described in detail below.

[0085] The purpose of the implementation mode of the present invention is to realize an alarm model with customizable thresholds for transaction monitoring indicators such as transaction volume, success rate, and time consumption. It can effectively adapt to differentiated API product service scenarios, identify transaction anomalies of specific partners and interfaces, and help business personnel to timely perceive, identify, and handle possible risks in massive data.

[0086] Figure 3 is a flowchart of another optional transaction anomaly detection method based on indicator threshold according to an embodiment of the present invention, such as Figure 3 As shown, including:

[0087] S1: Initialize the configuration of alarm switches and thresholds.

[0088] When the business end uses the transaction anomaly detection system for the first time, it is necessary to configure the alarm switches and thresholds of various monitoring indicators based on the business's historical transaction data and specific needs, including the configuration of the total anomaly detection switch for success rate, transaction volume, time consumption, fixed threshold detection switch configuration, year-on-year detection switch configuration, detection frequency, detection duration, detection threshold and comparison symbol, year-on-year date, common alarm cumulative threshold, and severe alarm cumulative threshold.

[0089] The anomaly detection model deployed in the transaction anomaly detection system pre-sets a set of default thresholds. These default values ​​are set based on industry standards and internal specifications to ensure that the system can still operate and provide basic anomaly detection functions without manual intervention. However, in order to adapt to more specific and complex business scenarios, the business side can personalize the detection strategy based on the actual transaction data and indicator tolerance requirements. For example, for the success rate indicator, a fixed threshold detection strategy can be set to configure the detection frequency, detection duration, detection threshold (such as 95%) and comparison symbol (such as "less than"). For the transaction volume indicator, the business side may prefer to set a year-on-year threshold detection strategy to adapt to the fluctuation of transaction volume over time, holidays and other factors. Both detection schemes support parallel execution according to the configuration of the business side, and in the alarm information, it will clearly distinguish whether the alarm is triggered based on the fixed threshold or the year-on-year threshold detection strategy, so that the business side can quickly locate the problem.

[0090] The business end can choose fixed threshold detection or year-on-year threshold detection, or both, based on the characteristics of the indicator to be detected. When both are selected, the two detection schemes will be executed in parallel according to their own logic without interfering with each other. The text content of the abnormal alarm will distinguish which detection scheme issued the alarm, which is convenient for the business end to distinguish.

[0091] like Figure 3 As shown in the figure, after the anomaly detection model is deployed, the transaction flow data of the partner can be collected in real time, and the data values ​​corresponding to each financial transaction indicator can be extracted. The financial transaction indicators include: transaction volume, success rate and time consumption. Then it will confirm whether to turn on anomaly detection and provide the option of anomaly detection to the business end / partner. If so, the partner / business end needs to choose whether to select a fixed threshold detection strategy or a year-on-year threshold detection strategy, and then perform anomaly detection analysis and threshold adjustment according to the corresponding threshold.

[0092] S2: Fixed threshold anomaly detection analysis.

[0093] 1) The anomaly detection model obtains the detection frequency V set in advance by the business end (for example, V=1, which means that the indicator mean is calculated once every 1 minute).

[0094] 2) The anomaly detection model obtains the detection duration D set in advance by the business end (for example, D=10, which means that each detection obtains the indicator data of the most recent 10 minutes and calculates the average indicator value within this time period).

[0095] 3) The anomaly detection model obtains the detection threshold T and comparison symbol set in advance by the business end (for example, T=95, the comparison symbol is "less than", which means that each detection success rate is less than 95%, which triggers a normal alarm notification).

[0096] 4) The anomaly detection model obtains the common alarm accumulation threshold N1 set in advance by the business end (for example, N1=5, which means that if the common alarm reaches 5 times in a row, a serious alarm notification will be triggered).

[0097] 5) The anomaly detection model obtains the critical alarm cumulative threshold N2 set in advance by the business end (for example, N2=3, which means that if the critical alarm reaches 3 times in a row, a threshold adjustment notification will be triggered).

[0098] 6) After receiving the threshold adjustment notification, the business end checks the real-time monitoring curve chart to analyze the business situation and manually determines whether the threshold parameters need to be adjusted and how to adjust them.

[0099] 7) The anomaly detection model obtains the adjusted threshold parameters and performs anomaly detection analysis based on the new threshold.

[0100] S3: Year-on-year threshold anomaly detection analysis.

[0101] For monitoring indicators such as transaction volume, the transaction volume will fluctuate greatly in different time periods (for example, during the Double Eleven period, the number of shopping transactions using financial institutions to pay at night is much higher than the transaction volume during the same period of other dates. For example, during the morning and evening peak hours every day, the transaction volume of using financial institutions' APP to scan codes to pay for subway transportation fares is much higher than the transaction volume in other time periods). Fixed threshold anomaly detection will result in false alarms and missed alarms. It is recommended to use year-on-year threshold anomaly detection analysis. When performing year-on-year threshold detection, the system will take the total number or average value of indicators within the detection time range for year-on-year comparison of the threshold. Occasionally, missing or abnormal transaction data will basically not affect the accuracy of the alarm. In step S1, after the business end sets the threshold parameters according to the actual situation of its own business, the anomaly detection analysis is implemented as follows:

[0102] 1) The anomaly detection model obtains the detection frequency V set in advance by the business end (for example, V=1, which means that the total indicator data is calculated once every 1 minute).

[0103] 2) The anomaly detection model obtains the detection duration D set in advance by the business end (for example, D=10, which means that each detection obtains the indicator data of the most recent 10 minutes and calculates the sum of the indicator data within this duration, recorded as A1).

[0104] 3) The anomaly detection model obtains the same-year date DAY1 set in advance by the business end (for example, DAY1=1, which means that each detection obtains the indicator data of the same period one day ago and calculates the sum of the indicator data within this period, recorded as A2).

[0105] 4) The anomaly detection model obtains the same-year date DAY2 set in advance by the business end (for example, DAY1=7, which means that each detection obtains the indicator data of the same period 7 days ago and calculates the sum of the indicator data within this period, recorded as A3).

[0106] 5) The anomaly detection model obtains the detection threshold T set in advance by the business end. According to the formula (A1-A2) / A2=C1, (A1-A3) / A3=C2, C1 represents the percentage of increase / decrease in the current period's transaction volume compared with the same period of DAY1, and the same applies to C2.

[0107] When C1>0 and C2>0 and C1>T and C2>percentage threshold T, it means that the current period's trading volume has increased compared with the same period of DAY1 and DAY2, and the increase exceeds the percentage threshold T, which triggers a normal alarm notification of indicator increase.

[0108] When C1<0 and C2<0 and |C1|>T and |C2|>T, it means that the transaction volume in the current period has decreased compared with the transaction volume in the same period of DAY1 and DAY2, and the decrease exceeds the percentage threshold T, which triggers a normal alarm notification of indicator decline.

[0109] 6) The anomaly detection model obtains the common alarm cumulative threshold N1 set in advance by the business end (for example, N1=5, which means that if the common alarm of rising / falling reaches 5 times in a row, a serious alarm notification will be triggered).

[0110] 7) The anomaly detection model obtains the severe alarm cumulative threshold N2 set in advance by the business end (for example, N2=3, which means that severe alarms are reached three times in a row, triggering a threshold adjustment notification).

[0111] 8) After receiving the threshold adjustment notification, the business end checks the real-time monitoring curve chart to analyze the business situation and manually determines whether the threshold parameters need to be adjusted and how to adjust them.

[0112] 9) The anomaly detection model obtains the adjusted threshold parameters and performs anomaly detection analysis based on the new threshold.

[0113] Through the above implementation, a refined risk control capability of transaction indicator anomaly detection is realized, and two detection schemes are provided: fixed threshold anomaly detection and year-on-year threshold anomaly detection. The ability to adapt to the abnormal monitoring of indicators of different natures is adapted. The transaction anomaly detection model can more accurately and efficiently monitor and detect various abnormal situations in financial transactions, which not only improves the risk control capabilities of financial institutions, but also enhances the adaptability to business scenarios of different partners, reduces the risk of false positives and false negatives, and provides strong technical support for the transaction security and business development of financial institutions. In addition, the model's alarm mechanism and threshold adjustment function enable the system to continuously optimize the detection strategy and better respond to the ever-changing market environment and business needs.

[0114] The following is a detailed description in conjunction with another embodiment.

[0115] Embodiment 2

[0116] A transaction indicator anomaly detection device based on indicator threshold provided in this embodiment includes multiple implementation units, each implementation unit corresponds to each implementation step in the above-mentioned embodiment one. Its specific implementation method and beneficial effects can refer to the above-mentioned method embodiment, which will not be repeated here.

[0117] Figure 4 is a schematic diagram of an optional transaction indicator anomaly detection device based on indicator threshold according to an embodiment of the present invention, such as Figure 4As shown, the transaction indicator anomaly detection device based on indicator threshold may include: a detection strategy receiving unit 41, a model analysis unit 41, a threshold adjustment unit 43, and a threshold feedback unit 44.

[0118] Among them, the detection strategy receiving unit 41 is used to receive the indicator anomaly detection strategy selected by the business end, wherein the indicator anomaly detection strategy includes: a fixed threshold anomaly detection strategy and a year-on-year threshold anomaly detection strategy. The fixed threshold anomaly detection strategy refers to a strategy that compares the real-time indicator data value corresponding to each financial transaction indicator with the preset fixed threshold value corresponding to the financial transaction indicator. The year-on-year threshold anomaly detection strategy refers to a strategy that compares the total transaction data of the financial transaction indicator in the current time period with the total transaction data of the same time period in the historical specified time period, and compares the calculated increase ratio or decrease ratio with the preset percentage threshold value corresponding to the financial transaction indicator.

[0119] The model analysis unit 41 is used to collect financial transaction data in the current time period according to the selected indicator anomaly detection strategy, and send the indicator anomaly detection strategy and the financial transaction data to the transaction anomaly detection model, and the transaction anomaly detection model analyzes the real-time indicator data value corresponding to each financial transaction indicator and the corresponding preset fixed threshold, or analyzes the increase ratio or decrease ratio of the indicator data value of each financial transaction indicator and the corresponding preset percentage threshold to obtain the transaction anomaly detection result.

[0120] The threshold adjustment unit 43 is used to trigger a threshold adjustment notification to the business end when the transaction anomaly detection result meets the preset anomaly detection switch and threshold adjustment requirements. After receiving the threshold adjustment notification, the business end analyzes the transaction indicators whose indicator thresholds need to be adjusted and the target threshold parameters according to the real-time transaction monitoring curve chart to obtain the threshold adjustment parameters.

[0121] The threshold feedback unit 44 is used to receive the threshold adjustment parameters fed back by the business end, and feed back the threshold adjustment parameters to the transaction anomaly detection model.

[0122] The above-mentioned transaction indicator anomaly detection device based on indicator threshold can receive the indicator anomaly detection strategy selected by the business end through the detection strategy receiving unit 41, and then the model analysis unit 42 collects the financial transaction data of the current time period according to the selected indicator anomaly detection strategy, and sends the indicator anomaly detection strategy and the financial transaction data to the transaction anomaly detection model, and the transaction anomaly detection model analyzes the real-time indicator data value corresponding to each financial transaction indicator and the corresponding preset fixed threshold, or analyzes the increase ratio or decrease ratio of the indicator data value of each financial transaction indicator and the corresponding preset percentage threshold to obtain the transaction anomaly detection result, and then through the threshold adjustment unit 43, when the transaction anomaly detection result meets the preset anomaly detection switch and threshold adjustment requirements, triggers the threshold adjustment notification to the business end, wherein, after receiving the threshold adjustment notification, the business end analyzes the transaction indicator whose indicator threshold needs to be adjusted and the target threshold parameter according to the real-time transaction monitoring curve chart to obtain the threshold adjustment parameter, and then receives the threshold adjustment parameter fed back by the business end through the threshold feedback unit 44, and feeds the threshold adjustment parameter back to the transaction anomaly detection model. In this embodiment, when a large number of alarms or false alarms are detected, a threshold adjustment notification will be triggered. The business end can analyze the business situation based on the real-time transaction monitoring curve chart and flexibly adjust various threshold parameters to ensure the accuracy of the transaction monitoring strategy. This can solve the technical problems of fixed threshold anomaly detection mechanism in related technologies, which is prone to false alarms and low accuracy.

[0123] Optionally, when executing a fixed threshold anomaly detection strategy, the transaction anomaly detection model in the transaction indicator anomaly detection device based on indicator threshold includes: a first trigger unit, used to trigger a first type of alarm when the real-time indicator data value of the fixed threshold anomaly detection strategy is lower than a first preset fixed threshold, or when the real-time indicator data value of the fixed threshold anomaly detection strategy is higher than a second preset fixed threshold, wherein the second preset fixed threshold is greater than the first preset fixed threshold; a second trigger unit, used to trigger a second type of alarm when the number of first type of alarms within a preset time period reaches a cumulative threshold of the first type of alarm; and a third trigger unit, used to trigger a threshold adjustment notification when the number of second type of alarms within a preset time period reaches a cumulative threshold of the second type of alarm.

[0124] Optionally, when executing the year-on-year threshold anomaly detection strategy, the transaction anomaly detection model in the transaction indicator anomaly detection device based on the indicator threshold includes: a data sum acquisition unit, which is used to obtain the first transaction data sum of the financial transaction indicator in the current time period, and extract the second transaction data sum of the same historical time period corresponding to the current time period within the first historical specified time period in the transaction database and the third transaction data sum of the same historical time period within the second historical specified time period; a calculation unit, which is used to calculate the increase ratio or the decrease ratio based on the first transaction data sum, the second transaction data sum and the third transaction data sum; a fourth trigger unit, which is used to trigger a first type of alarm for an increase in the indicator when the increase ratio and the decrease ratio are both greater than 0, and the increase ratio is greater than the first preset percentage threshold, and the decrease ratio is greater than the second preset percentage threshold; or, when the increase ratio and the decrease ratio are both less than 0, and the absolute value of the increase ratio is greater than the first preset percentage threshold, and the absolute value of the decrease ratio is greater than the second preset percentage threshold, trigger the first type of alarm for a decrease in the indicator.

[0125] Optionally, when executing the year-on-year threshold anomaly detection strategy, the transaction anomaly detection model in the transaction indicator anomaly detection device based on indicator threshold further includes: a fifth trigger unit, which is used to trigger the second type of alarm when the number of first type of alarms for rising indicators within a preset time period reaches the cumulative threshold of the first type of alarm, or when the number of first type of alarms for falling indicators within the preset time period reaches the cumulative threshold of the first type of alarm; a sixth trigger unit, which is used to trigger the threshold adjustment notification when the number of second type of alarms within the preset time period reaches the cumulative threshold of the second type of alarm.

[0126] Optionally, the transaction indicator anomaly detection device based on indicator threshold also includes: a partner identification acquisition unit, which is used for the transaction anomaly detection model to obtain the partner identification corresponding to the business end after receiving the threshold adjustment parameter, and extract the financial transaction indicators and partner business scenarios associated with the partner identification; a parameter updating unit, which is used to update the preset fixed threshold, preset percentage threshold, detection frequency, detection duration, alarm accumulation threshold, and comparison symbol stored in the transaction anomaly detection model based on all extracted financial transaction indicators and partner business scenarios.

[0127] Optionally, the transaction indicator anomaly detection device based on indicator threshold also includes: a threshold configuration unit, which is used to configure a preset fixed threshold and a corresponding comparison symbol, and configure a preset percentage threshold and a corresponding comparison symbol, based on historical transaction data, tolerance ranges of various financial transaction indicators, and business scenarios of partners before receiving the indicator anomaly detection strategy selected by the business end.

[0128] Optionally, the financial transaction indicator includes at least one of the following: transaction volume, success rate, and time consumption, wherein the transaction volume is the number of financial transactions occurring in the current time period, the success rate represents the ratio of successful transactions, and the time consumption represents the average processing time for each transaction.

[0129] The above-mentioned transaction indicator anomaly detection device based on indicator threshold can also include a processor and a memory. The above-mentioned detection strategy receiving unit 41, model analysis unit 41, threshold adjustment unit 43, threshold feedback unit 44, etc. are all stored in the memory as program units, and the processor executes the above-mentioned program units stored in the memory to realize the corresponding functions.

[0130] The processor includes a kernel, which retrieves the corresponding program unit from the memory. One or more kernels can be set to realize the transaction fluctuation alarm based on the financial transaction indicator threshold by adjusting the kernel parameters.

[0131] The above-mentioned memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM, and the memory includes at least one storage chip.

[0132] Embodiment 3

[0133] An embodiment of the present application may provide an electronic device, Figure 5 is a structural block diagram of an electronic device according to an embodiment of the present application. Figure 5 As shown, the electronic device may include: one or more ( Figure 5 (only one is shown) processor 502, memory 504, storage controller, and peripheral interface, wherein the peripheral interface is connected to the radio frequency module, audio module and display.

[0134] Among them, the memory can be used to store software programs and modules, such as the program instructions / modules corresponding to the transaction index anomaly detection method and device based on the index threshold in the embodiment of the present application. The processor executes various functional applications and data processing by running the software programs and modules stored in the memory, that is, the above-mentioned transaction index anomaly detection method based on the index threshold is realized. The memory may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory may further include a memory remotely arranged relative to the processor, and these remote memories can be connected to the terminal via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and a combination thereof.

[0135] The processor can call the information and application program stored in the memory through the transmission device to perform the following steps: receiving the indicator anomaly detection strategy selected by the business end, wherein the indicator anomaly detection strategy includes: a fixed threshold anomaly detection strategy and a year-on-year threshold anomaly detection strategy, the fixed threshold anomaly detection strategy refers to a strategy of comparing the real-time indicator data value corresponding to each financial transaction indicator with the preset fixed threshold value corresponding to the financial transaction indicator, and the year-on-year threshold anomaly detection strategy refers to a strategy of comparing the sum of transaction data of the financial transaction indicator in the current time period with the sum of transaction data of the same time period in the historical specified time period, and calculating the increase ratio or decrease ratio with the preset percentage threshold value corresponding to the financial transaction indicator; according to the selected indicator anomaly detection strategy, collecting the financial transaction data of the current time period. The data is collected and the indicator anomaly detection strategy and the financial transaction data are sent to the transaction anomaly detection model, which analyzes the real-time indicator data value corresponding to each financial transaction indicator and the corresponding preset fixed threshold, or analyzes the increase ratio or decrease ratio of the indicator data value of each financial transaction indicator and the corresponding preset percentage threshold to obtain the transaction anomaly detection result; when the transaction anomaly detection result meets the preset anomaly detection switch and threshold adjustment requirements, the threshold adjustment notification is triggered to the business end, wherein after receiving the threshold adjustment notification, the business end analyzes the transaction indicator whose indicator threshold needs to be adjusted and the target threshold parameter according to the real-time transaction monitoring curve chart to obtain the threshold adjustment parameter; the threshold adjustment parameter fed back by the business end is received, and the threshold adjustment parameter is fed back to the transaction anomaly detection model.

[0136] The processor can also call the information and application programs stored in the memory through the transmission device to perform the following steps: when the transaction anomaly detection model executes the fixed threshold anomaly detection strategy, when the real-time indicator data value of the fixed threshold anomaly detection strategy is lower than the first preset fixed threshold, or when the real-time indicator data value of the fixed threshold anomaly detection strategy is higher than the second preset fixed threshold, a first type of alarm is triggered, wherein the second preset fixed threshold is greater than the first preset fixed threshold; when the number of first type of alarms within the preset time period reaches the cumulative threshold of the first type of alarm, a second type of alarm is triggered; when the number of second type of alarms within the preset time period reaches the cumulative threshold of the second type of alarm, a threshold adjustment notification is triggered.

[0137] The processor can also call the information and application stored in the memory through the transmission device to perform the following steps: when the transaction anomaly detection model executes the year-on-year threshold anomaly detection strategy, it obtains the first transaction data sum of the financial transaction indicator in the current time period, and extracts the second transaction data sum of the same historical time period corresponding to the current time period within the first historical specified time period in the transaction database and the third transaction data sum of the same historical time period within the second historical specified time period; based on the first transaction data sum, the second transaction data sum and the third transaction data sum, calculate the increase ratio or decrease ratio; when the increase ratio and the decrease ratio are both greater than 0, and the increase ratio is greater than the first preset percentage threshold, and the decrease ratio is greater than the second preset percentage threshold, trigger a first type of alarm for an increase in the indicator; or, when the increase ratio and the decrease ratio are both less than 0, and the absolute value of the increase ratio is greater than the first preset percentage threshold, and the absolute value of the decrease ratio is greater than the second preset percentage threshold, trigger a first type of alarm for a decrease in the indicator.

[0138] The processor can also call the information and application programs stored in the memory through the transmission device to perform the following steps: when the transaction anomaly detection model executes the year-on-year threshold anomaly detection strategy, when the number of first-class alarms for rising indicators within a preset time period reaches the cumulative threshold of first-class alarms, or when the number of first-class alarms for falling indicators within a preset time period reaches the cumulative threshold of first-class alarms, a second-class alarm is triggered; when the number of second-class alarms within the preset time period reaches the cumulative threshold of second-class alarms, a threshold adjustment notification is triggered.

[0139] The processor can also call the information and application programs stored in the memory through the transmission device to perform the following steps: after receiving the threshold adjustment parameters, the transaction anomaly detection model obtains the partner identifier corresponding to the business end, and extracts the financial transaction indicators and partner business scenarios associated with the partner identifier; based on all the extracted financial transaction indicators and partner business scenarios, the preset fixed threshold, preset percentage threshold, detection frequency, detection duration, alarm accumulation threshold, and comparison symbol saved in the transaction anomaly detection model are updated.

[0140] The processor can also call the information and applications stored in the memory through the transmission device to perform the following steps: before receiving the indicator anomaly detection strategy selected by the business end, the business end configures the preset fixed threshold and the corresponding comparison symbol based on the historical transaction data, the tolerance range of each financial transaction indicator and the business scenario of the partner, and configures the preset percentage threshold and the corresponding comparison symbol.

[0141] The processor can also call the information and application programs stored in the memory through the transmission device to perform the following steps: the financial transaction indicators include at least one of the following: transaction volume, success rate, and time consumption, wherein the transaction volume is the number of financial transactions occurring in the current time period, the success rate indicates the ratio of successful transactions, and the time consumption indicates the average processing time for each transaction.

[0142] The embodiment of the present application provides a solution for detecting financial transaction anomalies based on indicator thresholds. When a large number of alarms or false alarms are detected, a threshold adjustment notification will be triggered. The business end can analyze the business situation based on the real-time transaction monitoring curve chart, flexibly adjust various threshold parameters, and ensure the accuracy of the transaction monitoring strategy.

[0143] It can be understood by those skilled in the art that Figure 5 The structure shown is for illustration only, and the electronic device may also be a smart phone, a tablet computer, a PDA, a mobile Internet device (MID), a PAD, or other terminal devices. Figure 5 The structure of the electronic device is not limited. Figure 5 More or fewer components (such as network interfaces, display devices, etc.) shown in, or having Figure 5 Different configurations are shown.

[0144] A person of ordinary skill in the art can understand that all or part of the steps in the various transaction indicator anomaly detection methods based on indicator thresholds in the above-mentioned embodiments can be completed by instructing the hardware related to the terminal device through a program, and the program can be stored in a computer-readable storage medium, and the storage medium may include: a flash drive, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, etc.

[0145] Embodiment 4

[0146] The embodiment of the present application further provides a storage medium. Optionally, in this embodiment, the storage medium can be used to store the program code executed by the transaction indicator anomaly detection method based on indicator threshold provided in the first embodiment.

[0147] According to another aspect of an embodiment of the present invention, a computer-readable storage medium is also provided, and the computer-readable storage medium includes a stored computer program, wherein when the computer program is running, the device where the computer-readable storage medium is located is controlled to execute any one of the transaction indicator anomaly detection methods based on indicator thresholds in the above-mentioned embodiment one.

[0148] Optionally, in this embodiment, the above storage medium may be located in any computer terminal in a computer terminal group in a computer network, or in any mobile terminal in a mobile terminal group.

[0149] The present application also provides a computer program product, including a computer program, which, when executed by a processor, implements the steps of the transaction indicator anomaly detection method based on indicator thresholds described in each embodiment of the present application.

[0150] The present application also provides a computer program product, including a non-volatile computer-readable storage medium, wherein the non-volatile computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the transaction indicator anomaly detection method based on indicator thresholds described in each embodiment of the present application are implemented.

[0151] The serial numbers of the above embodiments of the present invention are only for description and do not represent the advantages or disadvantages of the embodiments.

[0152] In the above embodiments of the present invention, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0153] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only schematic. For example, the division of the units can be a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0154] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple units. Some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0155] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0156] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, magnetic disk or optical disk and other media that can store program codes.

[0157] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principle of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A transaction indicator anomaly detection method based on indicator threshold, characterized in that: include: Receive an indicator anomaly detection strategy selected by the business end, wherein the indicator anomaly detection strategy includes: a fixed threshold anomaly detection strategy and a year-on-year threshold anomaly detection strategy, wherein the fixed threshold anomaly detection strategy refers to a strategy for comparing the real-time indicator data value corresponding to each financial transaction indicator with a preset fixed threshold corresponding to the financial transaction indicator, and the year-on-year threshold anomaly detection strategy refers to a strategy for comparing the calculated increase ratio or decrease ratio with a preset percentage threshold corresponding to the financial transaction indicator based on the comparison of the total transaction data of the financial transaction indicator in the current time period with the total transaction data of the same time period in the historical specified time period; According to the selected indicator anomaly detection strategy, the financial transaction data of the current time period is collected, and the indicator anomaly detection strategy and the financial transaction data are sent to the transaction anomaly detection model, and the transaction anomaly detection model analyzes the real-time indicator data value corresponding to each financial transaction indicator and the corresponding preset fixed threshold, or analyzes the increase ratio or decrease ratio of the indicator data value of each financial transaction indicator and the corresponding preset percentage threshold, to obtain the transaction anomaly detection result; When the transaction anomaly detection result meets the preset anomaly detection switch and threshold adjustment requirements, triggering a threshold adjustment notification to the service end, wherein after receiving the threshold adjustment notification, the service end analyzes the transaction index whose index threshold needs to be adjusted and the target threshold parameter according to the real-time transaction monitoring curve chart to obtain the threshold adjustment parameter; Receive the threshold adjustment parameter fed back by the business end, and feed the threshold adjustment parameter back to the transaction anomaly detection model.

2. The method for detecting abnormal trading indicators according to claim 1, characterized in that: The transaction anomaly detection model, when executing the fixed threshold anomaly detection strategy, includes: When the real-time indicator data value of the fixed threshold anomaly detection strategy is lower than a first preset fixed threshold, or when the real-time indicator data value of the fixed threshold anomaly detection strategy is higher than a second preset fixed threshold, a first type of alarm is triggered, wherein the second preset fixed threshold is greater than the first preset fixed threshold; When the number of the first type of alarms within the preset time period reaches the first type of alarm accumulation threshold, triggering the second type of alarm; When the number of the second type of alarms within the preset time period reaches the second type of alarm accumulation threshold, a threshold adjustment notification is triggered.

3. The transaction indicator anomaly detection method according to claim 1, characterized in that: When executing the year-on-year threshold anomaly detection strategy, the transaction anomaly detection model includes: Obtain the sum of first transaction data of the financial transaction indicator in the current time period, and extract the sum of second transaction data of the same historical time period as the current time period in the first historical specified time period and the sum of third transaction data of the same historical time period in the second historical specified time period from the transaction database; Calculate an increase ratio or a decrease ratio based on the sum of the first transaction data, the sum of the second transaction data, and the sum of the third transaction data; When both the increase ratio and the decrease ratio are greater than 0, and the increase ratio is greater than a first preset percentage threshold, and the decrease ratio is greater than a second preset percentage threshold, a first type of alarm indicating an increase in the indicator is triggered; or When both the increase ratio and the decrease ratio are less than 0, and the absolute value of the increase ratio is greater than a first preset percentage threshold, and the absolute value of the decrease ratio is greater than a second preset percentage threshold, a first type of alarm of indicator decrease is triggered.

4. The method for detecting abnormality of transaction indicators according to claim 3, characterized in that: When executing the year-on-year threshold anomaly detection strategy, the transaction anomaly detection model further includes: When the number of first-category alarms of the indicator rising within the preset time period reaches the first-category alarm accumulation threshold, or when the number of first-category alarms of the indicator falling within the preset time period reaches the first-category alarm accumulation threshold, a second-category alarm is triggered; When the number of the second type of alarms within the preset time period reaches the second type of alarm accumulation threshold, a threshold adjustment notification is triggered.

5. The transaction indicator anomaly detection method according to claim 1, characterized in that: After receiving the threshold adjustment parameter, the transaction anomaly detection model further includes: Obtaining a partner identifier corresponding to the business end, and extracting financial transaction indicators and partner business scenarios associated with the partner identifier; Based on all the extracted financial transaction indicators and partner business scenarios, the preset fixed threshold, preset percentage threshold, detection frequency, detection duration, alarm accumulation threshold, and comparison symbol stored in the transaction anomaly detection model are updated.

6. The transaction indicator anomaly detection method according to claim 1, characterized in that: Before receiving the indicator anomaly detection strategy selected by the business end, it also includes: The business end configures the preset fixed threshold and the corresponding comparison symbol according to the historical transaction data, the tolerance range of each financial transaction indicator and the business scenario of the partner, and configures the preset percentage threshold and the corresponding comparison symbol.

7. The method for detecting abnormality of transaction indicators according to any one of claims 1 to 6, characterized in that: The financial transaction indicator includes at least one of the following: transaction volume, success rate, and time consumption, wherein the transaction volume is the number of financial transactions occurring in the current time period, the success rate represents the ratio of successful transactions, and the time consumption represents the average processing time for each transaction.

8. A transaction index anomaly detection device based on index threshold, characterized in that: include: A detection strategy receiving unit, used for receiving an indicator anomaly detection strategy selected by a business end, wherein the indicator anomaly detection strategy includes: a fixed threshold anomaly detection strategy and a year-on-year threshold anomaly detection strategy, wherein the fixed threshold anomaly detection strategy refers to a strategy for comparing the real-time indicator data value corresponding to each financial transaction indicator with a preset fixed threshold corresponding to the financial transaction indicator, and the year-on-year threshold anomaly detection strategy refers to a strategy for comparing the calculated increase ratio or decrease ratio with a preset percentage threshold corresponding to the financial transaction indicator based on the comparison of the total transaction data of the financial transaction indicator in the current time period with the total transaction data of the same time period in the historical specified time period; A model analysis unit, configured to collect financial transaction data of the current time period according to the selected indicator anomaly detection strategy, and send the indicator anomaly detection strategy and the financial transaction data to the transaction anomaly detection model, wherein the transaction anomaly detection model analyzes the real-time indicator data value corresponding to each financial transaction indicator and the corresponding preset fixed threshold, or analyzes the increase ratio or decrease ratio of the indicator data value of each financial transaction indicator and the corresponding preset percentage threshold, to obtain a transaction anomaly detection result; A threshold adjustment unit, configured to trigger a threshold adjustment notification to the service end when the transaction anomaly detection result meets the preset anomaly detection switch and threshold adjustment requirements, wherein after receiving the threshold adjustment notification, the service end analyzes the transaction index whose index threshold needs to be adjusted and the target threshold parameter according to the real-time transaction monitoring curve chart to obtain the threshold adjustment parameter; A threshold feedback unit is used to receive the threshold adjustment parameter fed back by the business end, and feed back the threshold adjustment parameter to the transaction anomaly detection model.

9. An electronic device, characterized in that: It includes one or more processors and a memory, wherein the memory is used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement the transaction indicator anomaly detection method based on indicator threshold as described in any one of claims 1 to 7.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method for detecting anomalies in trading indicators based on indicator thresholds described in any one of claims 1 to 7 are implemented.

Images