Abnormal recognition method, device and equipment and storage medium

Abstract

The embodiment of the invention provides an exception identification method, device and equipment and a storage medium, and relates to the technical field of data processing, and the method comprises the steps: collecting first business information generated in an interval time period according to a first time interval in an operation time period of a first type of business negotiated by a first docking mechanism and a comprehensive financial service platform; analyzing the first business information to obtain first business state information including the number of successful and unsuccessful first types of businesses between the first docking mechanism and the integrated financial service platform in the interval period; judging whether the unsuccessful first type of business growth between the first docking mechanism and the comprehensive financial service platform in the current interval period is greater than the successful first type of business growth or not compared with the previous interval period; and if yes, determining that unsuccessful first type of business occurs between the first docking mechanism and the comprehensive financial service platform due to the fact that the storage and management system establishing business docking is abnormal. By applying the scheme, the system abnormity occurring in the storage and management system can be identified more quickly.

Description

Technical Field

[0001] The present application relates to the field of data processing technology, and in particular to an abnormality identification method, device, equipment and storage medium. Background Art

[0002] The integrated financial service platform provides users with a variety of financial products. After users register an account on the integrated financial service platform, in order to successfully trade financial products using the account registered on the integrated financial service platform, it is necessary to link the above account with the user's bank account. Because there are many banking institutions in real life, the integrated financial service platform uses the depository system to link the user's account on the integrated financial service platform with the accounts of various banks.

[0003] In addition to using the above-mentioned custody system to link the accounts of the comprehensive financial service platform and the bank, users can also use the above-mentioned custody system to handle other businesses such as fund management negotiated between the comprehensive financial service platform and the bank.

[0004] However, during the operation of the above-mentioned custody system, abnormalities may occur due to various reasons, thereby causing the failure of the business completed by the user with the help of the above-mentioned custody system.

[0005] Currently, the system anomalies in the depository system are discovered manually, and then the corresponding system anomaly types of these depository system anomalies are mined. The anomaly monitoring system can monitor and handle these mined system anomalies.

[0006] When the business volume in the above-mentioned custody system is large, the efficiency of manually discovering system anomalies is low, and it is difficult to discover new system anomalies in time, and it is also difficult to timely dig out the new types of system anomalies, and further it is difficult to timely monitor and handle new types of system anomalies.

[0007] Therefore, there is an urgent need for an anomaly identification method to more quickly identify system anomalies in the above-mentioned custody system. Summary of the invention

[0008] The purpose of the embodiments of the present application is to provide an abnormality identification method, device, equipment and storage medium to more quickly identify system abnormalities occurring in the depository system. The specific technical solution is as follows:

[0009] In a first aspect of an embodiment of the present application, a method for identifying an abnormality is provided, the method comprising:

[0010] For the first type of business negotiated between the first docking institution and the comprehensive financial service platform, during the time period when the first type of business is running, first business information generated within the interval period is collected at a first time interval;

[0011] Analyze the first business information in each interval period to obtain the first business status information of each interval period, wherein the first business status information of each interval period includes the number of successful first-type businesses and the number of unsuccessful first-type businesses between the first docking institution and the integrated financial service platform in the period;

[0012] According to the obtained first business status information, determine whether the first growth number is greater than the second growth number, wherein the first growth number is: the growth number of the first type of business that was unsuccessful between the first docking institution and the integrated financial service platform in the current interval period compared with the previous interval period, and the second growth number is: the growth number of the first type of business that was successful between the first docking institution and the integrated financial service platform in the current interval period compared with the previous interval period;

[0013] If it is greater, it is determined that an abnormality in the custody system has resulted in an unsuccessful first type of business between the first docking institution and the comprehensive financial service platform, wherein the custody system establishes a business connection between the docking institution and the comprehensive financial service platform.

[0014] In a possible implementation manner, the method further includes:

[0015] According to the first business information and the first business status information, determine whether the first proportion is greater than the preset proportion, and determine whether the third quantity is greater than the preset ratio of the fourth quantity, wherein the first proportion is: the proportion of unsuccessful businesses of the error type with the highest proportion among the unsuccessful businesses of the first type between the first docking institution and the integrated financial service platform in the current interval period, the third quantity is: the number of unsuccessful businesses of the error type with the highest proportion among the unsuccessful businesses of the first type between the first docking institution and the integrated financial service platform in the current interval period, and the fourth quantity is: the total number of the first type of businesses between the first docking institution and the integrated financial service platform from the start time of the current business operation period to the start time of the current interval period;

[0016] If both are greater, it is determined that an abnormality in the custody system has resulted in an unsuccessful first type of business between the first docking institution and the comprehensive financial service platform.

[0017] In a possible implementation manner, the method further includes:

[0018] When the service running period starts, the first time interval is set as a preset initial time interval.

[0019] In a possible implementation manner, the method further includes:

[0020] Determine whether the total number of the first type of services in the current interval is greater than the total number of the first type of services in the previous interval;

[0021] If yes, reducing the first time interval;

[0022] If not, increasing the first time interval;

[0023] After the current interval period, the first service information within the interval period is collected according to the adjusted first time interval.

[0024] In a possible implementation manner, after determining that an abnormality in the depository system causes an unsuccessful first type of business to occur between the first docking institution and the integrated financial service platform, the method further includes:

[0025] Acquire business information of a first business, and extract error prompt information from the acquired business information, wherein the first business is an unsuccessful first type of business between the first docking institution and the integrated financial service platform;

[0026] Determining, according to the error prompt information, a first system abnormality type of the depository system abnormality that caused the failure of the first business;

[0027] Searching for the first system abnormality type in a system abnormality indicator library;

[0028] If not found, the first system abnormality type is updated to the system abnormality indicator library.

[0029] In a second aspect of an embodiment of the present application, a device for identifying an abnormality is provided, the device comprising:

[0030] A collection module, for collecting, for a first type of business negotiated between a first docking institution and a comprehensive financial service platform, first business information generated within a time interval according to a first time interval during a time period during which the first type of business is running;

[0031] An analysis module, configured to analyze the first business information in each interval period to obtain the first business status information in each interval period, wherein the first business status information in each interval period includes the number of successful first-type businesses and the number of unsuccessful first-type businesses between the first docking institution and the integrated financial service platform in the period;

[0032] The first judgment module is used to judge whether the first growth number is greater than the second growth number based on the obtained first business status information, wherein the first growth number is: the growth number of unsuccessful first type businesses between the first docking institution and the integrated financial service platform in the current interval period compared with the previous interval period, and the second growth number is: the growth number of successful first type businesses between the first docking institution and the integrated financial service platform in the current interval period compared with the previous interval period; if it is greater, it is determined that the unsuccessful first type business between the first docking institution and the integrated financial service platform occurs due to an abnormality in the custody system, wherein the custody system establishes business docking between the docking institution and the integrated financial service platform.

[0033] In a possible implementation manner, the device further includes:

[0034] The second judgment module is used to judge whether a first proportion is greater than a preset proportion and whether a third number is greater than a preset ratio of a fourth number according to the first business information and the first business status information, wherein the first proportion is: the proportion of unsuccessful businesses of the error type with the highest proportion among the unsuccessful businesses of the first type between the first docking institution and the integrated financial service platform in the current interval period, the third number is: the number of unsuccessful businesses of the error type with the highest proportion among the unsuccessful businesses of the first type between the first docking institution and the integrated financial service platform in the current interval period, and the fourth number is: the total number of the first type of businesses between the first docking institution and the integrated financial service platform from the start time of the current business operation period to the start time of the current interval period; if both are greater than, it is determined that the abnormality of the custody system has caused the unsuccessful first type of business between the first docking institution and the integrated financial service platform.

[0035] In a possible implementation manner, the device further includes: a setting module, configured to set the first time interval to a preset initial time interval when the service operation period starts.

[0036] In one possible implementation, the device also includes: an adjustment module, used to determine whether the total number of the first type of business in the current interval period is greater than the total number of the first type of business in the previous interval period; if so, reducing the first time interval; if not, increasing the first time interval; after the current interval period, collecting the first business information in the interval period according to the adjusted first time interval.

[0037] In a possible implementation, the device further includes: an updating module, configured to obtain business information of the first business and extract error prompt information from the acquired business information after determining that the abnormality of the custody system caused an unsuccessful first type of business between the first docking institution and the integrated financial service platform, wherein the first business is an unsuccessful first type of business between the first docking institution and the integrated financial service platform; determine a first system abnormality type of the custody system abnormality that caused the failure of the first business according to the error prompt information; search for the first system abnormality type in a system abnormality indicator library; and if not found, update the first system abnormality type to the system abnormality indicator library.

[0038] In a third aspect of the embodiments of the present application, an electronic device is provided, including a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other via the communication bus;

[0039] Memory, used to store computer programs;

[0040] The processor is used to implement the steps of any method described in the first aspect when executing the program stored in the memory.

[0041] In a fourth aspect of an embodiment of the present application, a computer-readable storage medium is provided, wherein a computer program is stored in the computer-readable storage medium, and when the computer program is executed by a processor, the steps of any method described in the first aspect are implemented.

[0042] In a fifth aspect of the embodiments of the present application, a computer program product comprising instructions is provided, which, when executed on a computer, enables the computer to execute the steps of any one of the methods described in the first aspect above.

[0043] Beneficial effects of the embodiments of the present application:

[0044] In the technical solution provided in the embodiment of the present application, the first business information is collected for the first type of business negotiated between the first banking institution and the comprehensive financial service platform, and then the first business information is analyzed to obtain the first business status information. Then, the growth of the number of unsuccessful first type businesses and the number of successful first type businesses in the first business status information in adjacent time periods is used to determine whether a system anomaly has occurred in the custody system. The above method is more efficient than manually discovering system anomalies, and can identify system anomalies in the custody system more quickly, and can then promptly discover new types of system anomalies, which means that business handling failures caused by new types of system anomalies can be monitored and handled in a timely manner.

[0045] Of course, implementing any product or method of the present application does not necessarily require achieving all of the advantages described above at the same time. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application, and for ordinary technicians in this field, other embodiments can also be obtained based on these drawings.

[0047] Figure 1 A schematic diagram of a first flow chart of an abnormality identification method provided in an embodiment of the present application;

[0048] Figure 2 A second flow chart of the abnormality identification method provided in the embodiment of the present application;

[0049] Figure 3 A schematic diagram of a flow chart of a method for adjusting a first time interval provided in an embodiment of the present application;

[0050] Figure 4 A schematic diagram of a flow chart of a method for updating a system abnormality indicator library provided in an embodiment of the present application;

[0051] Figure 5 A flowchart of an example of an abnormality identification method provided by an embodiment of the present application;

[0052] Figure 6 A schematic diagram of the structure of an abnormality identification device provided in an embodiment of the present application;

[0053] Figure 7 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0054] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field based on the present application belong to the scope of protection of the present application.

[0055] The integrated financial service platform provides users with a variety of financial products. After users register an account on the integrated financial service platform, in order to successfully trade financial products using the account registered on the integrated financial service platform, it is necessary to link the above account with the user's bank account. Because there are many banking institutions in real life, the integrated financial service platform uses the depository system to link the user's account on the integrated financial service platform with the accounts of various banks.

[0056] In addition to using the above-mentioned custody system to link the accounts of the comprehensive financial service platform and the bank, users can also use the above-mentioned custody system to handle other businesses negotiated between the comprehensive financial service platform and the bank.

[0057] However, the above-mentioned depository system may have abnormalities during operation due to various reasons, which may cause the failure of the business completed by the user with the help of the above-mentioned depository system. For example, the clock of the depository system is abnormal, causing the depository system to mistakenly determine that the association relationship between the docking institution established by the user and the comprehensive financial service platform has expired when handling business for the user, thereby causing the business to fail.

[0058] Currently, the system anomalies in the depository system are discovered manually, and then the corresponding system anomaly types of these depository system anomalies are mined. The anomaly monitoring system can monitor and handle these mined system anomalies.

[0059] When the business volume in the above-mentioned custody system is large, the efficiency of manually discovering system anomalies is low, and it is difficult to discover new system anomalies in time, and it is also difficult to timely dig out the new types of system anomalies, and further it is difficult to timely monitor and handle new types of system anomalies.

[0060] Therefore, there is an urgent need for an anomaly identification method to more quickly identify system anomalies in the above-mentioned custody system.

[0061] In order to solve the above problems, the present application embodiment provides an abnormality identification method, such as Figure 1 As shown, the method includes the following steps S101-S104.

[0062] The abnormality identification method provided in the embodiment of the present application can be applied to electronic devices such as desktop computers, laptop computers or servers. For ease of description, the execution subject of the abnormality identification method provided in the embodiment of the present application is collectively referred to as an electronic device.

[0063] Step S101, for a first type of business negotiated between a first docking institution and a comprehensive financial service platform, during the operation period of the first type of business, first business information generated within the interval period is collected at a first time interval.

[0064] The first docking institution is an institution where users can open deposit and withdrawal accounts, which may include large state-owned banks, national joint-stock banks, etc. The comprehensive financial service platform is a platform that provides financial products to users, which may include fund companies, bank wealth management companies, etc.

[0065] The first type of business is a type of business related to the establishment of an association between the first docking institution and the integrated financial service platform by the user. In some embodiments, the first type of business may include: the establishment of an association between the account of the first docking institution and the account of the integrated financial service platform by the user, the transfer of funds between the first docking institution and the integrated financial service platform based on the above association, the termination of the above association by the user, or the update of the personal information of the account of the first docking institution or the integrated financial service platform by the user, etc.

[0066] The user can use the depository system to handle the first type of business negotiated between the comprehensive financial service platform and the first docking institution. The depository system establishes business docking for each docking institution and the comprehensive financial service platform, including establishing business docking for the above-mentioned first docking institution and the comprehensive financial service platform.

[0067] The depository system can handle the first type of business for the user during the operating period of the first type of business. In one example, the operating period of the first type of business can be from 8:30 am to 16:00 pm on a trading day. The operating periods of different types of business are different.

[0068] When the depository system handles business for users, it will generate business information related to the business handling. Business information may include business type, prompt information for successful business handling, error prompt information for unsuccessful business handling, etc. Error prompt information informs users of the direct cause of business handling failure, such as incorrect transfer password, insufficient account balance, expired customer certificate, etc.

[0069] The electronic device can detect in real time whether the start time of the operation time period of the first type of service has been reached to determine whether the operation time period of the first type of service has been entered.

[0070] When the first type of service operation time period is reached, that is, when the first type of service operation time period is entered, the electronic device can collect service information of the first type of service in the interval time period according to the first time interval as the first service information. The first time interval is a preset time interval, which can be 30 seconds, 1 minute, etc. The interval time period is a time period in which the interval duration in the above collection process is the first time interval.

[0071] In one example, the start time of the first type of business operation time period is 8:30 in the morning every day, and the first time interval is 1 minute. The electronic device detects that the first type of business operation time period has begun at 8:30 in the morning. At 8:31, one minute later, the electronic device collects all business information of the first type of business in the time period between 8:30 and 8:31. At 8:32, one minute later, the electronic device collects all business information of the first type of business in the time period between 8:31 and 8:32, and so on. The above-mentioned time periods between 8:30 and 8:31 and between 8:31 and 8:32 are the interval time periods.

[0072] When collecting service information of a first type of service, the electronic device may first determine whether the service is a first type of service according to the service type in the service information of each service, and then collect service information of the service after determining that the service is a first type of service.

[0073] Step S102: Analyze the first service information in each interval period to obtain the first service status information in each interval period.

[0074] The first business status information of each interval period includes the number of successful first type businesses and the number of unsuccessful first type businesses between the first docking institution and the comprehensive financial service platform within the period.

[0075] For each interval period, the electronic device can determine whether each service is successfully handled according to the prompt information of successful handling of each service or the error prompt information of unsuccessful handling in the first service information collected during the interval period. Thus, the electronic device can count the number of first type services successfully handled and the number of first type services unsuccessfully handled during the interval period.

[0076] Step S103: judging whether the first increase amount is greater than the second increase amount according to the obtained first service status information. If it is greater, executing step S104.

[0077] Among them, the first growth number is: the growth number of unsuccessful first type of business between the first docking institution and the comprehensive financial service platform in the current interval period compared with the previous interval period; the second growth number is: the growth number of successful first type of business between the first docking institution and the comprehensive financial service platform in the current interval period compared with the previous interval period.

[0078] The current interval period is: the interval period with the current time as the end time; the previous interval period is: the interval period with the start time of the current interval period as the end time.

[0079] The electronic device may first search the first service status information for the number of successful first type services and the number of unsuccessful first type services between the first docking institution and the integrated financial service platform in the current interval and the previous interval.

[0080] The electronic device can then calculate the difference between the unsuccessful first type of business between the first docking agency and the comprehensive financial service platform in the current interval period and the previous interval period to obtain a first growth number, and calculate the difference between the successful first type of business between the first docking agency and the comprehensive financial service platform in the current interval period and the previous interval period to obtain a second growth number.

[0081] The electronic device may compare the calculated first growth amount with the second growth amount to determine whether the first growth amount is greater than the second growth amount.

[0082] If the first growth amount is less than or equal to the second growth amount, it means that the unsuccessful first type of business between the first docking institution and the comprehensive financial service platform may be caused by personal reasons such as user misoperation, insufficient funds in the user account, expiration of the association relationship between the first docking institution and the comprehensive financial service platform established by the user, and not by an abnormality of the custody system.

[0083] If the first growth number is greater than the second growth number, it indicates that an abnormal growth has occurred in the number of unsuccessful first type businesses between the first docking institution and the integrated financial service platform. The electronic device may execute step S104 to determine that an abnormality in the custody system has caused the unsuccessful first type businesses to occur between the first docking institution and the integrated financial service platform.

[0084] In the technical solution provided in the embodiment of the present application, the first business information is collected for the first type of business negotiated between the first banking institution and the comprehensive financial service platform, and then the first business information is analyzed to obtain the first business status information. Then, the growth of the number of unsuccessful first type businesses and the number of successful first type businesses in the first business status information in adjacent time periods is used to determine whether a system anomaly has occurred in the custody system. The above method is more efficient than manually discovering system anomalies, and can identify system anomalies in the custody system more quickly, and can then promptly discover new types of system anomalies, which means that business handling failures caused by new types of system anomalies can be monitored and handled in a timely manner.

[0085] In a possible implementation, the electronic device may also use another determination method to determine whether an abnormality occurs in the custody system. Figure 2 As shown, the embodiment of the present application also provides the following anomaly identification method, which also includes the following steps S201-S204.

[0086] Step S201, for the first type of business negotiated between the first docking institution and the comprehensive financial service platform, during the operation period of the first type of business, first business information generated within the interval period is collected according to the first time interval, which is the same as the above step S101.

[0087] Step S202, analyzing the first service information in each interval period to obtain the first service status information in each interval period, which is the same as the above step S102.

[0088] Step S203: According to the first service information and the first service status information, determine whether the first proportion is greater than a preset proportion, and determine whether the third quantity is greater than a preset proportion of the fourth quantity. If both are greater, execute step S204.

[0089] Among them, the first proportion is: the proportion of unsuccessful businesses of the error type with the highest proportion among the unsuccessful first type businesses between the first docking institution and the comprehensive financial service platform in the current interval period; the third quantity is: the number of unsuccessful businesses of the error type with the highest proportion among the unsuccessful first type businesses between the first docking institution and the comprehensive financial service platform in the current interval period; the fourth quantity is: the total number of first type businesses between the first docking institution and the comprehensive financial service platform from the start time of the current business operation period to the start time of the current interval period.

[0090] The above error type may be: the type of direct cause of the failure of the service processing indicated by the error prompt information in the service information. For example, the error type may include: password error type, insufficient balance type, association relationship expired type, etc.

[0091] With respect to the third quantity and the first proportion, the electronic device may first obtain the error prompt information corresponding to each unsuccessful first-type business from the first business information of the unsuccessful first-type business between the first docking institution and the comprehensive financial service platform during the current interval, and determine the corresponding error type of each unsuccessful first-type business. Then, the electronic device may count the number of businesses of various error types in the unsuccessful first-type business, determine the number of businesses corresponding to the error type with the highest proportion in the unsuccessful first-type business as the third quantity, and use the highest proportion determined above as the first proportion.

[0092] For the fourth quantity, the electronic device can obtain from the first business status information the number of successful first type businesses in all interval periods between the start time of the current business operation period and the start time of the current interval period, as well as the number of unsuccessful first type businesses, and accumulate these business numbers to obtain the total number of first type businesses between the first docking institution and the comprehensive financial service platform between the start time of the current business operation period and the start time of the current interval period as the fourth quantity.

[0093] The preset proportion may be any preset proportion, for example, the preset proportion may be 60%. The preset ratio may be any preset proportion, for example, the preset ratio may be 10%.

[0094] The electronic device may compare the first proportion with the preset proportion to determine whether the first proportion is greater than the preset proportion. If the first proportion is greater than the preset proportion, it means that the error types of the unsuccessful first type of business are relatively concentrated, which may be caused by an abnormality in the custody system. If the first proportion is less than or equal to the preset proportion, it means that the error types of the unsuccessful first type of business are relatively scattered, and it is likely to be caused by personal reasons of the user rather than an abnormality in the custody system.

[0095] The electronic device may also compare the obtained third number with a preset ratio of the fourth number to determine whether the third number is greater than the preset ratio of the fourth number.

[0096] If the third number is less than or equal to the preset ratio of the fourth number, it means that the number of the error type of business with the highest proportion in the unsuccessful first type of business is also small, or the total number of unsuccessful first type of business is small. In other words, the unsuccessful first type of business is most likely caused by the user's personal reasons, rather than by the abnormality of the custody system, and the electronic device can determine that no abnormality of the custody system has occurred.

[0097] If the third number is greater than the preset ratio of the fourth number, it means that the first type of business with the same error type appears in a concentrated manner, and the above unsuccessful first type of business is most likely not caused by personal reasons of the user, but by an abnormality of the custody system.

[0098] The electronic device can combine the above two comparisons to determine whether there is any abnormality in the custody system.

[0099] If the first proportion is not greater than the preset proportion, or the third quantity is not greater than the preset ratio of the fourth quantity, or the first proportion is not greater than the preset proportion and the third quantity is not greater than the preset ratio of the fourth quantity, then it means that the unsuccessful first type of business between the first docking institution and the comprehensive financial service platform may be due to personal reasons of the user, rather than due to an abnormality of the custody system.

[0100] If the electronic device determines that the first proportion is greater than the preset proportion, and the third number is greater than the preset ratio of the fourth number, it means that the unsuccessful first type of business is most likely not caused by personal reasons of the user, but caused by an abnormality of the custody system. The electronic device can execute step S204 to determine that the abnormality of the custody system caused the unsuccessful first type of business between the first docking institution and the comprehensive financial service platform.

[0101] In the abnormality identification method provided in the embodiment of the present application, whether a system abnormality occurs is determined based on the size relationship between the first proportion and the preset proportion, and the size relationship between the preset ratio of the third number and the fourth number. When the number of unsuccessful first-type businesses or successful first-type businesses in the current interval period does not increase compared to the previous interval period, another judgment method for judging system abnormalities can be provided. This judgment method takes into account the occurrence of unsuccessful businesses of concentrated error types. On the basis of the occurrence of unsuccessful businesses of concentrated error types, it is combined with the size relationship between the number of unsuccessful businesses of the error type with the highest proportion in the current interval period and the total number of first-type businesses before the current interval period in the current business operation period to judge whether an abnormality has occurred in the custody system. Avoiding the misjudgment of an abnormality in the custody system due to a small number of unsuccessful businesses of concentrated error types in the current interval period improves the accuracy of identifying system abnormalities in the custody system.

[0102] In a possible implementation, the electronic device may set the first time interval to a preset initial time interval before the service operation period begins. In the subsequent execution of the abnormality identification method, the first service information within the interval period is collected according to the initial time interval. For example, the electronic device may set the first time interval to a preset initial time interval at the beginning of each day. The preset initial time interval may be any time interval, such as 30 seconds, 1 minute, etc.

[0103] In a possible implementation, during the execution of the abnormality identification method, the electronic device may adjust the first time interval to adapt to changes in the traffic volume. Based on this, the embodiment of the present application also provides a method for adjusting the first time interval, such as Figure 3 As shown, the method includes the following steps S301-S303.

[0104] Step S301, determine whether the total number of first type services in the current interval is greater than the total number of first type services in the previous interval. If yes, execute step S302; if no, execute step S303.

[0105] The electronic device can obtain the number of successful first type businesses between the first docking agency and the comprehensive financial service platform in the current interval period, as well as the number of unsuccessful first type businesses in the current interval period from the first business status information of the current interval period, and add these two numbers to obtain the total number of first type businesses in the current interval period.

[0106] Similarly, the electronic device can also obtain the total number of first type services in the previous interval period in the above manner.

[0107] The electronic device can then compare the total number of first type services in the current interval with the total number of first type services in the previous interval to determine whether the total number of first type services in the current interval is greater than the total number of first type services in the previous interval.

[0108] If the total number of first-type services in the current interval is greater than the total number of first-type services in the previous interval, it means that the total number of first-type services in the current interval has increased, and the total number of subsequent first-type services is expected to increase. The electronic device can execute step S302 to reduce the first time interval. This can reduce the amount of service information collected in the next interval, and can better analyze the service information.

[0109] If the total number of first-type services in the current interval is less than or equal to the total number of first-type services in the previous interval, it means that the total number of first-type services in the current interval is decreasing, and the total number of subsequent first-type services is expected to show a decreasing trend. The electronic device can execute step S303 to increase the first time interval. This can increase the amount of service information collected in the next interval, avoiding the inability to analyze valid information and waste of computing resources due to a small amount of service information.

[0110] In a possible implementation manner, the electronic device may further adjust the first time interval according to the total number of first-type services in similar time periods every day in history.

[0111] For example, if the end time of the current interval period is 9 a.m., and the number of the first type of business in the interval period after 9 a.m. every day in history is relatively large, the electronic device can reduce the first time interval at the end time of the current interval period; for another example, if the end time of the current interval period is 13 p.m., and the number of the first type of business in the interval period after 13 p.m. every day in history is relatively small, the electronic device can increase the first time interval at the end time of the current interval period.

[0112] After the current interval period, the electronic device may collect the first service information within the interval period according to the adjusted first time interval.

[0113] In this way, the electronic device can dynamically adjust the first time interval according to real-time business operation differences to more accurately identify anomalies occurring in the custody system and improve the efficiency of identifying anomalies occurring in the custody system.

[0114] In a possible implementation, after determining in the above step S104 that the abnormality of the depository system causes an unsuccessful first type of business between the first docking institution and the comprehensive financial service platform, the embodiment of the present application further provides a method for updating the system abnormality indicator library to update the system abnormality type corresponding to the discovered system abnormality to the system abnormality indicator library of the abnormality monitoring system, so that the subsequent abnormality monitoring system monitors the system abnormality of this type occurring in the depository system based on the system abnormality indicator library. Figure 4 As shown, the method also includes the following steps S401-S404.

[0115] Step S401: obtain service information of a first service, and extract error prompt information from the obtained service information.

[0116] Among them, the first business is the unsuccessful first type of business between the first docking institution and the comprehensive financial service platform.

[0117] The electronic device can obtain business information corresponding to the business that was not successfully processed from the collected first business information, and extract error prompt information from the obtained business information.

[0118] Step S402: determining the first system abnormality type of the depository system abnormality causing the failure of the first business according to the error prompt information.

[0119] The electronic device can analyze the error type indicated by the error prompt information, and then find the abnormality occurring in the corresponding processing module in the custody system, and determine the first system abnormality type of the abnormality.

[0120] Step S403, searching the system abnormality indicator library for the first system abnormality type. If not found, executing step S404.

[0121] The electronic device may match the abnormality type in the system abnormality indicator library with the first system abnormality type to find whether the first system abnormality type exists in the system abnormality indicator library. If not found, the electronic device may execute step S404 to update the first system abnormality type to the system abnormality indicator library.

[0122] In this way, the subsequent exception monitoring system can monitor the system exceptions of the first system exception type occurring in the custody system based on the updated system exception indicator library.

[0123] In addition, the electronic device can also display prompt information including the first system abnormality type to the operation and maintenance personnel of the custody system on the display interface, prompting the operation and maintenance personnel to update the emergency response plan for this type of system abnormality in the abnormality monitoring system, so as to promptly handle the abnormalities occurring in the custody system.

[0124] In order to better illustrate the above abnormality identification method, the embodiment of the present application also provides the following example of applying the above abnormality identification method, such as Figure 5 shown.

[0125] Figure 5 In the example, a pre-built state matrix is ​​used. and the time matrix , to identify anomalies.

[0126] Among them, the state matrix as follows:

[0127] ;

[0128] Among them, m represents the mth docking institution, n represents the nth business type, Represents the business status information of the nth business type negotiated between the mth docking institution and the comprehensive financial service platform during the interval from time t-1 to time t; It represents the business status information of n types of business negotiated between m docking institutions and the comprehensive financial service platform during the interval from time t-1 to time t.

[0129] include{ 、r , , },in, represents the total number of n-th type of services from the start of the service operation period to time t-1, r It represents the number of successful n-th type of business in the interval from time t-1 to time t. Indicates the number of unsuccessful n-th type of services in the interval from time t-1 to time t. It indicates the proportion of unsuccessful services of the error type with the highest proportion among the unsuccessful services of the nth type during the interval from time t-1 to time t.

[0130] Time Matrix as follows:

[0131] ;

[0132] in, Represents the first time interval corresponding to the nth business type negotiated between the mth docking institution and the comprehensive financial service platform.

[0133] For each business type of each of the m docking institutions mentioned above, the electronic device can be identified according to any abnormality identification method provided in the embodiments of the present application, as follows.

[0134] Figure 5 In the process, before the business operation period begins, such as the beginning of each day, the electronic equipment first checks the state matrix and the time matrix Initialization is performed to obtain the initialization state matrix S(0) and the initialization time matrix T(0). Among them, any item in the initialization state matrix S(0) are initialized to {0, 0, 0, 0%}, and any item in the initialization time matrix T(0) The initial value is set to 30 seconds.

[0135] Afterwards, the electronic device waits for the business start time, and determines in real time whether it has entered the start time, that is, for each of the m docking institutions, the n types of business, respectively, determine in real time whether the corresponding business operation time period has arrived, and after entering the start time, that is, after reaching the business operation time period, collect business operation data according to the time matrix T(t), collect business operation data within the interval period, that is, the first business information, as described in the above step S101. When the electronic device collects business operation data for the first time, it can collect according to the time interval recorded in the initialization time matrix T(0).

[0136] The electronic device can also analyze the collected service operation data to obtain service status information, such as the above step S102. The electronic device can write the above service status information into the state matrix S(t). When the electronic device obtains the service status information for the first time, it can write the service status information into the initialization state matrix S(0).

[0137] The electronic device identifies whether an abnormality occurs in the custody system based on the state matrix S(t), such as steps S103-S104 and steps S203-S204 described above.

[0138] After identifying an abnormality in the custody system, the electronic device can determine the type of abnormality that occurred in the custody system and determine whether the abnormality type needs to be included in the indicator set, that is, updated to the system abnormality indicator library, that is, determine whether the first system abnormality type can be found in the system abnormality indicator library. As shown in the above steps S401-S403. The above system abnormality indicator library can also be called a system monitoring indicator set.

[0139] If the electronic device determines that the discovered abnormality type needs to be updated to the system abnormality indicator library, the update process is performed. As in the above step S404. The electronic device can also display prompt information including the first system abnormality type to the operation and maintenance personnel of the depository system on the display interface, prompting the operation and maintenance personnel to update the emergency response plan for the type of system abnormality in the abnormality monitoring system, so as to promptly handle the abnormality occurring in the depository system.

[0140] If the electronic device determines that it does not need to update the discovered abnormal type to the system abnormal indicator library, it can adaptively update the time matrix according to the real-time business situation , that is, update the time matrix according to the change of business quantity The time interval in is as described in the above steps S301-S303.

[0141] After updating the time interval, the electronic device can also determine whether it has entered the end time, that is, whether the service operation period has ended. If it has ended, the above abnormality identification method will no longer be executed. If it has not ended, it will continue to be based on the updated time matrix. The business operation data is collected at the time interval and the subsequent processes are executed.

[0142] Corresponding to the above-mentioned abnormality identification method, the embodiment of the present application also provides an abnormality identification device, such as Figure 6 As shown, the device comprises:

[0143] The collection module 601 is used to collect, for a first type of business negotiated between a first docking institution and a comprehensive financial service platform, first business information generated within a time interval according to a first time interval during a time period in which the first type of business is running;

[0144] The analysis module 602 is used to analyze the first business information in each interval period to obtain the first business status information of each interval period, wherein the first business status information of each interval period includes the number of successful first type businesses and the number of unsuccessful first type businesses between the first docking institution and the integrated financial service platform in the period;

[0145] The first judgment module 603 is used to judge whether the first growth number is greater than the second growth number based on the obtained first business status information, wherein the first growth number is: the growth number of unsuccessful first type businesses between the first docking institution and the integrated financial service platform in the current interval period compared with the previous interval period, and the second growth number is: the growth number of successful first type businesses between the first docking institution and the integrated financial service platform in the current interval period compared with the previous interval period; if it is greater, it is determined that the abnormality of the custody system has caused the unsuccessful first type business to occur between the first docking institution and the integrated financial service platform, wherein the custody system establishes business docking between the docking institution and the integrated financial service platform.

[0146] In the technical solution provided in the embodiment of the present application, the first business information is collected for the first type of business negotiated between the first banking institution and the comprehensive financial service platform, and then the first business information is analyzed to obtain the first business status information. Then, the growth of the number of unsuccessful first type businesses and the number of successful first type businesses in the first business status information in adjacent time periods is used to determine whether a system anomaly has occurred in the custody system. The above method is more efficient than manually discovering system anomalies, and can identify system anomalies in the custody system more quickly, and can then promptly discover new types of system anomalies, which means that business handling failures caused by new types of system anomalies can be monitored and handled in a timely manner.

[0147] In a possible implementation manner, the above-mentioned abnormality identification device further includes:

[0148] The second judgment module is used to judge whether the first proportion is greater than the preset proportion and whether the third number is greater than the preset ratio of the fourth number according to the first business information and the first business status information, wherein the first proportion is: the proportion of the unsuccessful businesses of the error type with the highest proportion among the unsuccessful first type businesses between the first docking institution and the comprehensive financial service platform in the current interval period, the third number is: the number of the unsuccessful businesses of the error type with the highest proportion among the unsuccessful first type businesses between the first docking institution and the comprehensive financial service platform in the current interval period, and the fourth number is: the total number of the first type businesses between the first docking institution and the comprehensive financial service platform from the start time of the current business operation period to the start time of the current interval period; if both are greater, it is determined that the abnormality of the custody system has caused the unsuccessful first type business between the first docking institution and the comprehensive financial service platform.

[0149] In a possible implementation manner, the above-mentioned abnormality identification device further includes: a setting module, which is used to set the first time interval as a preset initial time interval when the service operation period starts.

[0150] In a possible implementation, the above-mentioned abnormality identification device also includes: an adjustment module, used to determine whether the total number of first type businesses in the current interval period is greater than the total number of first type businesses in the previous interval period; if so, reducing the first time interval; if not, increasing the first time interval; after the current interval period, collecting the first business information in the interval period according to the adjusted first time interval.

[0151] In a possible implementation, the above-mentioned anomaly identification device also includes: an updating module, which is used to obtain business information of the first business after determining that the abnormality of the custody system caused an unsuccessful first type of business between the first docking institution and the comprehensive financial service platform, and extract error prompt information from the acquired business information, wherein the first business is an unsuccessful first type of business between the first docking institution and the comprehensive financial service platform; determine the first system abnormality type of the custody system abnormality that caused the unsuccessful first business according to the error prompt information; search for the first system abnormality type in the system abnormality indicator library; if not found, update the first system abnormality type to the system abnormality indicator library.

[0152] In the technical solution of this application, the operations involved in obtaining, storing, using, processing, transmitting, providing and disclosing user personal information are all carried out with the user's authorization.

[0153] The present application also provides an electronic device, such as Figure 7 As shown, it includes a processor 701 , a communication interface 702 , a memory 703 and a communication bus 704 , wherein the processor 701 , the communication interface 702 , and the memory 703 communicate with each other via the communication bus 704 .

[0154] Memory 703, used for storing computer programs;

[0155] The processor 701 is used to implement the steps of any of the above-mentioned abnormality identification methods when executing the program stored in the memory 703.

[0156] The communication bus mentioned in the above electronic device can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. The communication bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, only one thick line is used in the figure, but it does not mean that there is only one bus or one type of bus.

[0157] The communication interface is used for communication between the above electronic device and other devices.

[0158] The memory may include a random access memory (RAM) or a non-volatile memory (NVM), such as at least one disk memory. Optionally, the memory may also be at least one storage device located away from the aforementioned processor.

[0159] The above-mentioned processor can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components.

[0160] In another embodiment provided in the present application, a computer-readable storage medium is provided, in which a computer program is stored. When the computer program is executed by a processor, the steps of any of the above-mentioned abnormality identification methods are implemented.

[0161] In another embodiment provided in the present application, a computer program product including instructions is also provided, which, when executed on a computer, enables the computer to execute the steps of any of the above-mentioned abnormality identification methods.

[0162] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions may be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions may be transmitted from a website site, a computer, a server or a data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) mode to another website site, computer, server or data center. The computer-readable storage medium may be any available medium that a computer can access or a data storage device such as a server or a data center that includes one or more available media integrated. The available medium may be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state drive Solid State Disk (SSD)), etc.

[0163] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

[0164] Each embodiment in this specification is described in a related manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the device, electronic device, computer-readable storage medium, and computer program product embodiments, since they are basically similar to the method embodiments, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiments.

[0165] The above description is only a preferred embodiment of the present application and is not intended to limit the protection scope of the present application. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application are included in the protection scope of the present application.

Claims

1. A method for identifying anomalies, characterized in that: The method comprises: For the first type of business negotiated between the first docking institution and the comprehensive financial service platform, during the time period when the first type of business is running, first business information generated within the interval period is collected at a first time interval; Analyze the first business information in each interval period to obtain the first business status information of each interval period, wherein the first business status information of each interval period includes the number of successful first-type businesses and the number of unsuccessful first-type businesses between the first docking institution and the integrated financial service platform in the period; According to the obtained first business status information, determine whether the first growth number is greater than the second growth number, wherein the first growth number is: the growth number of the first type of business that was unsuccessful between the first docking institution and the integrated financial service platform in the current interval period compared with the previous interval period, and the second growth number is: the growth number of the first type of business that was successful between the first docking institution and the integrated financial service platform in the current interval period compared with the previous interval period; If it is greater, it is determined that an abnormality in the custody system has resulted in an unsuccessful first type of business between the first docking institution and the comprehensive financial service platform, wherein the custody system establishes a business connection between the docking institution and the comprehensive financial service platform.

2. The method according to claim 1, characterized in that The method further comprises: According to the first business information and the first business status information, determine whether the first proportion is greater than the preset proportion, and determine whether the third quantity is greater than the preset ratio of the fourth quantity, wherein the first proportion is: the proportion of unsuccessful businesses of the error type with the highest proportion among the unsuccessful businesses of the first type between the first docking institution and the integrated financial service platform in the current interval period, the third quantity is: the number of unsuccessful businesses of the error type with the highest proportion among the unsuccessful businesses of the first type between the first docking institution and the integrated financial service platform in the current interval period, and the fourth quantity is: the total number of the first type of businesses between the first docking institution and the integrated financial service platform from the start time of the current business operation period to the start time of the current interval period; If both are greater, it is determined that an abnormality in the custody system has caused an unsuccessful first type of business between the first docking institution and the comprehensive financial service platform.

3. The method according to claim 1, characterized in that The method further comprises: When the service running period starts, the first time interval is set as a preset initial time interval.

4. The method according to claim 1, characterized in that: The method further comprises: Determine whether the total number of the first type of services in the current interval is greater than the total number of the first type of services in the previous interval; If yes, reducing the first time interval; If not, increasing the first time interval; After the current interval period, the first service information within the interval period is collected according to the adjusted first time interval.

5. The method according to any one of claims 1 to 4, characterized in that After determining that an abnormality in the depository system causes an unsuccessful first type of business to occur between the first docking institution and the integrated financial service platform, the method further includes: Acquire business information of a first business, and extract error prompt information from the acquired business information, wherein the first business is an unsuccessful first type of business between the first docking institution and the integrated financial service platform; Determining, according to the error prompt information, a first system abnormality type of the depository system abnormality that caused the failure of the first business; Searching for the first system abnormality type in a system abnormality indicator library; If not found, the first system abnormality type is updated to the system abnormality indicator library.

6. An abnormality identification device, characterized in that: The device comprises: A collection module, for collecting, for a first type of business negotiated between a first docking institution and a comprehensive financial service platform, first business information generated within a time interval according to a first time interval during a time period during which the first type of business is running; An analysis module, configured to analyze the first business information in each interval period to obtain the first business status information in each interval period, wherein the first business status information in each interval period includes the number of successful first-type businesses and the number of unsuccessful first-type businesses between the first docking institution and the integrated financial service platform in the period; The first judgment module is used to judge whether the first growth number is greater than the second growth number based on the obtained first business status information, wherein the first growth number is: the growth number of unsuccessful first type businesses between the first docking institution and the integrated financial service platform in the current interval period compared with the previous interval period, and the second growth number is: the growth number of successful first type businesses between the first docking institution and the integrated financial service platform in the current interval period compared with the previous interval period; if it is greater, it is determined that the unsuccessful first type business between the first docking institution and the integrated financial service platform occurs due to an abnormality in the custody system, wherein the custody system establishes business docking between the docking institution and the integrated financial service platform.

7. The device according to claim 6, characterized in that The device also includes: The second judgment module is used to judge whether a first proportion is greater than a preset proportion and whether a third number is greater than a preset ratio of a fourth number according to the first business information and the first business status information, wherein the first proportion is: the proportion of unsuccessful businesses of the error type with the highest proportion among the unsuccessful businesses of the first type between the first docking institution and the integrated financial service platform in the current interval period, the third number is: the number of unsuccessful businesses of the error type with the highest proportion among the unsuccessful businesses of the first type between the first docking institution and the integrated financial service platform in the current interval period, and the fourth number is: the total number of the first type of businesses between the first docking institution and the integrated financial service platform from the start time of the current business operation period to the start time of the current interval period; if both are greater than, it is determined that the abnormality of the custody system has caused the unsuccessful first type of business between the first docking institution and the integrated financial service platform.

8. The device according to claim 6, characterized in that The device further includes: a setting module, configured to set the first time interval to a preset initial time interval when the service operation period starts; and / or The device further includes: an adjustment module, configured to determine whether the total number of the first type of services in the current interval period is greater than the total number of the first type of services in the previous interval period; if so, reduce the first time interval; if not, increase the first time interval; after the current interval period, collect the first service information in the interval period according to the adjusted first time interval; and / or The device also includes: an updating module, which is used to obtain business information of the first business and extract error prompt information from the obtained business information after determining that the abnormality of the depository system causes an unsuccessful first type of business between the first docking institution and the integrated financial service platform, wherein the first business is the unsuccessful first type of business between the first docking institution and the integrated financial service platform; determine the first system abnormality type of the depository system abnormality that caused the failure of the first business according to the error prompt information; search for the first system abnormality type in the system abnormality indicator library; if not found, update the first system abnormality type to the system abnormality indicator library.

9. An electronic device, characterized in that: It includes a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other through the communication bus; Memory, used to store computer programs; A processor, for implementing the steps of the method according to any one of claims 1 to 5 when executing a program stored in a memory.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 5 are implemented.

Images