Transaction monitoring method and device, storage medium and electronic equipment

Abstract

The invention discloses a transaction monitoring method and device, a storage medium and electronic equipment. The method relates to the field of artificial intelligence, and comprises the following steps: grouping reference transaction data sets in a first time period according to enterprise numbers to obtain target transaction data sets respectively corresponding to the enterprise numbers; performing data aggregation on the target transaction data set to obtain a technical index set, the technical indexes being used for indicating characteristics of a bank-enterprise system; inputting the target transaction data set into the monitoring model to obtain a transaction data monitoring result; and under the condition that the technical index set meets a preset condition or the transaction data monitoring result is transaction abnormity, determining that the abnormal transaction exists in the first time period. According to the application, the problem of low accuracy of bank-enterprise transaction monitoring in related technologies is solved.

Description

Technical Field

[0001] The present application relates to the field of artificial intelligence, and more specifically, to a transaction monitoring method and device, a storage medium, and an electronic device. Background Art

[0002] In the interconnected system between banks and enterprises, transactions need to be monitored to find abnormal transactions and intervene in them. In related technologies, overall monitoring can be configured according to the dimensions of transactions.

[0003] However, there are nearly a thousand types of transactions in the current bank-enterprise system, tens of thousands of customers, and the daily submission transaction volume reaches millions, and the query transaction volume reaches tens of millions. And for customers, they usually use self-developed systems to monitor bank-enterprise systems, and there is a big gap between different self-developed systems. If the monitoring dimensions are configured manually, the monitoring accuracy is low and it requires a lot of human resources.

[0004] Currently, no effective solution has been proposed to address the problem of low accuracy in bank-enterprise transaction monitoring in related technologies. Summary of the invention

[0005] The main purpose of this application is to provide a transaction monitoring method and device, a storage medium and an electronic device to solve the problem of low accuracy of bank-enterprise transaction monitoring in related technologies.

[0006] In order to achieve the above-mentioned purpose, according to one aspect of the present application, a transaction monitoring method is provided. The method includes: grouping the reference transaction data set within the first time period according to the enterprise number to obtain the target transaction data set corresponding to each enterprise number; aggregating the target transaction data set to obtain a technical indicator set, wherein the technical indicator is used to indicate the characteristics of the bank-enterprise system; inputting the target transaction data set into the monitoring model to obtain the transaction data monitoring result; when the technical indicator set meets the preset conditions or the transaction data monitoring result is an abnormal transaction, determining that there is an abnormal transaction within the first time period.

[0007] In order to achieve the above-mentioned purpose, according to another aspect of the present application, a transaction monitoring device is provided. The device includes: a data grouping unit, which groups the reference transaction data set in the first time period according to the enterprise number to obtain the target transaction data set corresponding to each enterprise number; a data aggregation unit, which is used to aggregate the target transaction data set to obtain a technical indicator set, wherein the technical indicator is used to indicate the characteristics of the bank-enterprise system; a transaction monitoring unit, which is used to input the target transaction data set into the monitoring model to obtain the transaction data monitoring result; an abnormality determination unit, which is used to determine that there is an abnormal transaction in the first time period when the technical indicator set meets the preset conditions or the transaction data monitoring result is a transaction abnormality.

[0008] Optionally, the above-mentioned data grouping unit includes: a first log recording module, used to respond to a transaction request instruction and obtain a transaction request log according to a first log template, wherein the transaction request log is used to indicate transaction data before the transaction starts; a second log recording module, used to respond to a transaction call instruction and obtain a transaction response log according to a second log template, wherein the transaction response log is used to indicate transaction data after the transaction is completed.

[0009] Optionally, the above-mentioned data aggregation unit includes: a first indicator confirmation module, used to determine the number of successful transactions and the total number of transactions in the first time period based on the target transaction data set, and determine the ratio between the number of successful transactions and the total number of transactions as the success rate; a second indicator confirmation module, used to obtain the response time of the transactions in the first time period, and calculate the mean of the response time; a third indicator confirmation module, used to determine the number of occurrences of the error code in the first time period based on the target transaction data set, and calculate the error code ratio.

[0010] Optionally, the above-mentioned abnormality determination unit includes: a cycle determination module, used to determine the second time period based on the first cycle and the first time period, wherein the second time period is the time period before the first time period, and the period between the first time period and multiple second time periods is the first cycle; an interval determination module, used to obtain a set of historical technical indicators corresponding to the second time period, and use the historical technical indicator set to determine the threshold interval of each technical indicator; a condition comparison module, used to determine that the technical indicator set meets the preset conditions when any technical indicator in the technical indicator set does not meet the corresponding threshold interval.

[0011] Optionally, the above-mentioned transaction monitoring unit includes: a data classification module, used to classify the target transaction data set according to transaction categories to obtain a target transaction data subset; a monitoring result generation module, used to input the target transaction data subset into the monitoring model to obtain multiple transaction data monitoring sub-results; a monitoring result determination module, used to determine that the transaction data monitoring result is a transaction abnormality when any transaction data monitoring sub-result is a transaction abnormality.

[0012] Optionally, the above-mentioned transaction monitoring device also includes: a message sending unit, used to generate the abnormal information into a first notification information, and send the first notification information to the confirmation system; a model updating unit, used to respond to the marking information sent by the confirmation system, determine that there is no abnormal transaction within the first time period, and update the monitoring model according to the marking information.

[0013] In an embodiment of the present application, the reference transaction data set in the first time period is grouped according to the enterprise number to obtain the target transaction data set corresponding to each enterprise number; the target transaction data set is aggregated to obtain a technical indicator set, wherein the technical indicator is used to indicate the characteristics of the bank-enterprise system; the target transaction data set is input into the monitoring model to obtain the transaction data monitoring result; when the technical indicator set meets the preset conditions or the transaction data monitoring result is an abnormal transaction, it is determined that there is an abnormal transaction in the first time period. For monitoring transactions within a time period, the transaction data can be divided according to the enterprise number, and the technical indicators can be obtained according to the data aggregation corresponding to the enterprise. The technical indicators can indicate the impact of the transaction corresponding to the enterprise in the first time period on the performance of the system and the overall indicators of the transaction. And the data set corresponding to the enterprise can be input into the monitoring model to obtain the monitoring results corresponding to the transaction business, and finally the abnormality of the transaction is judged from the two dimensions of the technical indicators and the business side corresponding to the enterprise. Thus, the technical problem that the monitoring accuracy is low and a large amount of human resources are consumed due to the combination of artificial means to configure the monitoring dimensions is solved. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] The drawings constituting a part of the present application are used to provide a further understanding of the present application. The illustrative embodiments and descriptions of the present application are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0015] Figure 1 A hardware structure block diagram of a computer terminal for implementing a transaction monitoring method is shown;

[0016] Figure 2 is a flow chart of a transaction monitoring method provided according to an embodiment of the present application;

[0017] Figure 3 is a schematic diagram of a transaction monitoring method provided according to an embodiment of the present application;

[0018] Figure 4 is a schematic diagram of a transaction monitoring device provided according to an embodiment of the present application;

[0019] Figure 5 It is a structural block diagram of an electronic device according to an embodiment of the present application. DETAILED DESCRIPTION

[0020] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present application.

[0021] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0022] It should be noted that the collected information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data for display, data for analysis, etc.) involved in this application are information and data authorized by the user or fully authorized by all parties, and the collection, storage, use, processing, transmission, provision, disclosure and application of relevant data are in compliance with relevant laws, regulations and standards, necessary confidentiality measures are taken, and public order and good customs are not violated, and corresponding operation entrances are provided for users to choose to authorize or refuse. For example, an interface is set up between this system and relevant users or institutions to provide users with corresponding operation entrances for users to choose to agree or refuse the results of automated decision-making; if the user chooses to refuse, the expert decision-making process will be entered.

[0023] Example 1

[0024] According to an embodiment of the present application, a method embodiment of transaction monitoring is also provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although the logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0025] The method embodiment provided in the first embodiment of the present application can be executed in a mobile terminal, a computer terminal or a similar computing device. Figure 1 FIG. 1 shows a hardware structure block diagram of a computer terminal (or mobile device) for implementing a transaction monitoring method. Figure 1 As shown, the computer terminal 10 (or mobile device) may include one or more (102a, 102b, ..., 102n are used to illustrate) processors 102 (the processor 102 may include but is not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA), a memory 104 for storing data, and a transmission device 106 for communication functions. In addition, it may also include: a display, an input / output interface (I / O interface), a universal serial bus (USB) port (which may be included as one of the ports of the BUS bus), a network interface, a power supply and / or a camera. It can be understood by those skilled in the art that Figure 1 The structure shown is only for illustration and does not limit the structure of the above electronic device. Figure 1 More or fewer components as shown, or with Figure 1 Different configurations are shown.

[0026] It should be noted that the one or more processors 102 and / or other data processing circuits described above may generally be referred to herein as "data processing circuits". The data processing circuits may be embodied in whole or in part as software, hardware, firmware, or any other combination thereof. In addition, the data processing circuit may be a single independent processing module, or may be incorporated in whole or in part into any of the other components in the computer terminal 10 (or mobile device). As described in the embodiments of the present application, the data processing circuit acts as a processor control (e.g., selection of a variable resistor terminal path connected to an interface).

[0027] The memory 104 can be used to store software programs and modules of application software, such as the program instructions / data storage device corresponding to the transaction monitoring method in the embodiment of the present application. The processor 102 executes various functional applications and data processing by running the software programs and modules stored in the memory 104, that is, realizing the above-mentioned transaction monitoring method. The memory 104 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some examples, the memory 104 may further include a memory remotely arranged relative to the processor 102, and these remote memories may be connected to the computer terminal 10 via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0028] The transmission device 106 is used to receive or send data via a network. The specific example of the above network may include a wireless network provided by a communication provider of the computer terminal 10. In one example, the transmission device 106 includes a network adapter (Network Interface Controller, NIC), which can be connected to other network devices through a base station so as to communicate with the Internet. In one example, the transmission device 106 can be a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

[0029] The display may be, for example, a touch screen liquid crystal display (LCD) that enables a user to interact with a user interface of the computer terminal 10 (or mobile device).

[0030] Under the above operating environment, this application provides Figure 2 The transaction monitoring method shown. Figure 2 It is a flow chart of the transaction monitoring method according to Example 1 of the present application.

[0031] Step S101, grouping the reference transaction data sets within the first period according to the enterprise numbers to obtain target transaction data sets corresponding to the enterprise numbers;

[0032] It should be noted that in the bank-enterprise interconnection system, the collection of transaction data is continuous and intensive, covering a large number of corporate customers, and corporate customers connect to banks and enterprises through the ERP system. These ERP systems are developed by third-party manufacturers or self-developed by enterprises, and there are large differences. In order to more accurately monitor the transaction status of each corporate customer, all transaction data collected in the first period are grouped according to the enterprise number. The first period is a pre-set time period. For the bank-enterprise interconnection system, transactions can be monitored continuously according to a time, and transactions in each time window can be evaluated and abnormal conditions can be identified.

[0033] In an optional implementation, the transaction logs within the first period can be extracted from the bank-enterprise interconnection system. These logs usually include but are not limited to information such as transaction code, group number, transaction unique number, debit account number, credit account number, amount, postscript, summary, processing status, error code and error message. After the data is extracted, the system will classify the data according to the enterprise number information in each transaction log, and classify the transaction data belonging to the same enterprise number together to form a target transaction data set. This process can be achieved through the group query function of the database, or by using data processing tools such as Python's Pandas library for efficient processing.

[0034] In an optional implementation, assume that in the first period, the system records 1,000 transactions, of which enterprise A conducts 300 transactions, enterprise B conducts 200 transactions, and enterprise C conducts 500 transactions. After grouping by enterprise ID, we will obtain three target transaction data sets, corresponding to the transaction data of enterprises A, B, and C respectively.

[0035] Step S102, aggregating the target transaction data set to obtain a set of technical indicators, wherein the technical indicators are used to indicate the characteristics of the bank-enterprise system;

[0036] It should be noted that after the data grouping is completed, the next step is to aggregate the data for each target transaction data set to generate a series of technical indicators. These technical indicators are key parameters for evaluating the operation status of the bank-enterprise system, including but not limited to: Time period success rate: Calculate the percentage of successfully processed transactions in the target transaction data set to the total number of transactions. Average response time: Calculate the average time from the request reaching the system to the system response for each transaction in the target transaction data set. Average processing time: Calculate the average time from the start of processing to the completion of processing for each transaction in the target transaction data set. Error code proportion: Count the types of error codes that appear in the target transaction data set and the number of times each appears, and calculate the proportion of various error codes in the total transactions.

[0037] In an optional embodiment, the data aggregation process can be implemented by a statistical analysis algorithm, such as using SQL to query and calculate data, or using data analysis software such as R or Python's NumPy and Pandas libraries to process data. The generation of these technical indicators is helpful for subsequent anomaly detection, and by comparing with historical data, indicators that deviate from the normal range can be quickly identified.

[0038] Step S103, inputting the target transaction data set into the monitoring model to obtain the transaction data monitoring result;

[0039] It should be noted that after obtaining the set of technical indicators, the target transaction data set can be input into a monitoring model. The monitoring model here can be an anomaly detection model based on unsupervised learning, such as Isolation Forest, Autoencoder or 1D Convolutional Neural Network (1D CNN), etc., which is used to identify abnormal patterns in transaction data.

[0040] The training of the monitoring model is usually based on historical transaction data to learn the distribution characteristics of normal transaction data. After the model training is completed, the target transaction data set of each enterprise in the first period is input into the model. The model will determine whether each data point is abnormal based on the learned normal distribution characteristics. If the input data deviates significantly from the normal range understood by the model, the model will mark it as abnormal.

[0041] In an optional implementation, assuming that the monitoring model is a one-dimensional convolutional neural network, and the training data contains the normal transaction data of all enterprises in the past month, when the transaction data of the first period of enterprise A is input, the model will identify several data points where the transaction response time suddenly increases significantly and mark them as abnormal.

[0042] Step S104: when the technical indicator set meets the preset conditions or the transaction data monitoring result shows that the transaction is abnormal, it is determined that there is abnormal transaction in the first time period.

[0043] It should be noted that the preset condition can be a threshold based on historical data statistics or a threshold set according to business rules. For example, if the average response time exceeds two standard deviations of the historical average, or the error code ratio exceeds 10% of the historical average, the technical indicator set is considered to meet the preset abnormal conditions. At the same time, according to the transaction data monitoring results in step S103, if the monitoring model identifies anomalies in the transaction data, it is also identified as an abnormal transaction. When any condition is met, the system will automatically trigger the alarm mechanism to notify the operation and maintenance management personnel to conduct further inspection and processing.

[0044] In an optional implementation, assuming that during the first period, the average response time of enterprise A suddenly increases from 500 milliseconds to 1000 milliseconds, exceeding the preset abnormal condition (historical average response time plus two standard deviations), the system will immediately send an alarm to the operation and maintenance personnel, prompting that there may be abnormalities in the transactions of enterprise A. At the same time, if the monitoring model also identifies abnormal patterns in the transaction data of enterprise A, this alarm will be doubly confirmed, thereby improving the accuracy and timeliness of anomaly detection.

[0045] In the embodiment of the present application, the reference transaction data set in the first time period is grouped according to the enterprise number to obtain the target transaction data set corresponding to each enterprise number; the target transaction data set is aggregated to obtain a technical indicator set, wherein the technical indicator is used to indicate the characteristics of the bank-enterprise system; the target transaction data set is input into the monitoring model to obtain the transaction data monitoring result; when the technical indicator set meets the preset conditions or the transaction data monitoring result is an abnormal transaction, it is determined that there is an abnormal transaction in the first time period. For monitoring transactions within a time period, the transaction data can be divided according to the enterprise number, and the technical indicators can be obtained according to the data aggregation corresponding to the enterprise. The technical indicators can indicate the impact of the transaction corresponding to the enterprise in the first time period on the performance of the system and the overall indicators of the transaction. And the data set corresponding to the enterprise can be input into the monitoring model to obtain the monitoring results corresponding to the transaction business, and finally the abnormality of the transaction is judged from the two dimensions of the technical indicators and the business side corresponding to the enterprise. In addition, the technical problem that the monitoring accuracy is low and a large amount of human resources are consumed due to the combination of manual means to configure the monitoring dimensions is solved. The bank-enterprise interconnection system can realize automatic transaction abnormality monitoring, which not only improves the efficiency and accuracy of monitoring, but also reduces the dependence on manual intervention, and provides a strong technical guarantee for the stable operation of the system.

[0046] Optionally, in the transaction monitoring method provided in the embodiment of the present application, before the reference transaction data set within the first time period is grouped according to the enterprise number, it includes: responding to the transaction request instruction, obtaining the transaction request log according to the first log template, wherein the transaction request log is used to indicate the transaction data before the transaction starts; responding to the transaction call instruction, obtaining the transaction response log according to the second log template, wherein the transaction response log is used to indicate the transaction data after the transaction is completed.

[0047] It should be noted that in the bank-enterprise transaction monitoring system, in order to achieve accurate and comprehensive transaction anomaly detection, the system needs to collect detailed transaction data from the beginning to the end of the transaction. This means that before grouping the reference transaction data set in the first period according to the enterprise number, the system first needs to respond to the transaction request instruction and the transaction call instruction to obtain the transaction request log and the transaction response log. These two types of logs provide the basis for subsequent data grouping and anomaly detection.

[0048] In an optional implementation, when an enterprise submits a transaction request through the bank-enterprise interconnection system, the system will respond to this instruction, collect transaction data according to the first log template before the transaction begins, and generate a transaction request log. The first log template is usually designed to record key information at the beginning of the transaction, including but not limited to the enterprise number, transaction code, transaction unique number, debit account number, credit account number, transaction amount, transaction remarks, transaction summary, etc. This information reflects the basic content of the transaction request and is crucial for subsequent grouping and data analysis.

[0049] For example, when Enterprise A submits a transaction request for a payment transfer, the system responds immediately and records Enterprise A's group number, the transaction code for the payment transfer, the unique number of the transaction, debit and credit account information, the transfer amount, and any additional instructions, such as "insurance compensation", "guaranteed payment", etc., according to the first log template. This information can help the system understand the details of the transaction request and provide basic data for subsequent data grouping and indicator calculation.

[0050] In an optional implementation, after the transaction request is processed and completed, the system also needs to respond to the transaction call instruction, record the data after the transaction is completed according to the second log template, and generate a transaction response log. The second log template usually contains all the information in the transaction request log, and also records the transaction processing status, response time, processing time, and error code and error information returned by the system. This information reflects the results of transaction processing and the status of system operation, and plays a key role in judging whether the transaction is normal and whether the system operation is stable.

[0051] For example, for a payment transfer transaction of Enterprise A, when the transaction is completed, the system responds to the transaction call instruction and records the final processing status of the transaction (such as success or failure), system response time, transaction processing time, and the error code and error message returned by the system in the event of a transaction failure according to the second log template. This information can help the system accurately evaluate the execution effect of the transaction, and provide detailed data support for the detection of transaction anomalies and subsequent troubleshooting.

[0052] In an optional implementation, after data collection is completed, the system will group the transaction data according to the enterprise number to form a target transaction data set, and then aggregate the data for each set to generate a set of technical indicators, including success rate, response time, processing time, etc., for evaluating the operation status of the bank-enterprise system. At the same time, based on the collected transaction data and the generated technical indicators, the system uses a monitoring model to detect anomalies in the transaction data, and ultimately determines whether there are abnormal transactions to ensure the safe and stable operation of the system.

[0053] Through the above implementation methods of this application, the collection of transaction request logs and transaction response logs is the core link of data collection in the bank-enterprise transaction monitoring system. This not only provides detailed basic data for subsequent data analysis, but also ensures the comprehensiveness and accuracy of transaction monitoring, which is a key step in achieving efficient system monitoring and rapid response to abnormalities.

[0054] Optionally, in the transaction monitoring method provided in the embodiment of the present application, the target transaction data set is aggregated to obtain a technical indicator set, including at least one of the following:

[0055] (1) determining the number of successful transactions and the total number of transactions in the first period according to the target transaction data set, and determining the ratio between the number of successful transactions and the total number of transactions as the success rate;

[0056] It should be noted that the success rate is a key performance indicator used to measure the efficiency and accuracy of the system in processing transaction requests within a given time frame. The process of calculating the success rate involves the following steps: filtering out transactions that have been successfully processed in the first period from the target transaction data set, recording their number, i.e., the number of successful transactions; counting the number of all transactions in the first period, i.e., the total number of transactions; calculating the success rate, i.e., the ratio of the number of successful transactions to the total number of transactions. This ratio reflects the success rate of the system in processing transactions. The higher the ratio, the more stable the system operation and the higher the efficiency of processing transactions.

[0057] For example, in the first period, enterprise A submitted 1,000 transaction requests, of which 950 were successfully processed and 50 failed. Then, the transaction success rate of enterprise A in this period is 950 / 1000=95%, which indicates that the system has a high efficiency in transaction processing in this period.

[0058] (2) Obtain the response time of transactions in the first period and calculate the average response time;

[0059] It should be noted that response time is another important technical indicator. It reflects the length of time from the submission of a transaction request to the system giving a response, and is a direct reflection of system performance and user experience. The process of calculating the average response time is as follows: extract the response time of each transaction from the target transaction data set, which is the time difference from the transaction request arriving at the system to the system completing the processing and giving a response; count the response time of all transactions and calculate the average value, that is, the average response time. This step helps to identify whether there is a situation where the response time is too long, or whether the response time is kept at a reasonable level.

[0060] For example, in the first period, among the 1,000 transactions of enterprise A, the response time of each transaction is different, some are hundreds of milliseconds, and some may reach thousands of milliseconds. By calculating the average of all transaction times, the average response time of enterprise A in this period can be obtained, and whether there is a response delay problem can be determined based on this.

[0061] (3) determining the number of occurrences of the error code in the first period according to the target transaction data set, and calculating the error code ratio;

[0062] It should be noted that the error code ratio is another important indicator in the technical indicator set, which directly reflects the situation of errors in the system when processing transactions. The process of calculating the error code ratio is as follows: count the number of error codes that appear in all transactions in the first period from the target transaction data set, including the number of occurrences of each error code; calculate the total number of occurrences of the error code, and compare it with the total number of transactions to calculate the error code ratio. The higher this ratio is, the more frequent the system errors are, and there may be functional defects or performance bottlenecks.

[0063] For example, in the first period, among the 1,000 transactions of Enterprise A, 30 transactions returned error codes, of which error code "E001" appeared 10 times and error code "E002" appeared 20 times. Then, the total number of occurrences of the error code is 30 times, and the error code ratio is 30 / 1000 = 3%. This indicator can help system operation and maintenance personnel quickly locate the frequency and type of problems, and provide data support for troubleshooting and system optimization.

[0064] Through the above implementation of the present application, the technical indicator set generated by the system can fully reflect the operation status of the bank-enterprise system in the first period, including success rate, average response time and error code ratio, etc. These indicators are crucial for subsequent anomaly detection and system monitoring. By analyzing the technical indicator set, potential problems in system operation can be discovered in a timely manner to ensure the stability and security of the system.

[0065] Optionally, in the transaction monitoring method provided in the embodiment of the present application, the technical indicator set meets the preset conditions, including: determining the second time period based on the first cycle and the first time period, wherein the second time period is the time period before the first time period, and the period between the first time period and multiple second time periods is the first cycle; obtaining the historical technical indicator set corresponding to the second time period, and using the historical technical indicator set to determine the threshold interval of each technical indicator; when any technical indicator in the technical indicator set does not meet the corresponding threshold interval, determining that the technical indicator set meets the preset conditions.

[0066] It should be noted that the system needs to determine the second time period corresponding to the first time period based on the preset first cycle. The first cycle usually refers to a fixed time interval, such as one day, one week or one hour, and the first time period refers to the current monitoring period. The second time period refers to one or more time periods of the same cycle before the first time period, which are used for comparative analysis with the data of the current time period. For example, if the first cycle is set to one day, and the first time period is from 14:42 to 15:42 on March 28, 2023, then the second time period can be from 14:42 to 15:42 on March 27, 2023, or more broadly, it can be the time period from 14:42 to 15:42 every day in the past week, so as to collect more historical data for analysis.

[0067] For enterprises, there may be cyclical businesses, such as the monthly payment of employee wages; periodic settlement can be based on a preset cycle. Therefore, for the transaction data of enterprises, the data can be differentiated according to the enterprise and business, and the transaction data of the same enterprise and the same business in the previous cycle can be used to calculate the threshold range to better meet the current business needs and improve the accuracy of monitoring.

[0068] In an optional implementation, after determining the second time period, the system will extract a set of technical indicators corresponding to the second time period from the stored historical data. These historical technical indicator sets include technical indicators such as success rate, average response time, processing time, and error code ratio in the same period of the past. Based on these historical data, the system will calculate the statistical characteristics of each technical indicator, such as the mean, standard deviation, or percentile, to determine the normal range or threshold interval of the technical indicator. For example, for the indicator of success rate, the system can calculate the mean and standard deviation of the success rate from 14:42 to 15:42 every day in the past week, so as to set a dynamic threshold interval, such as the range of the mean plus or minus two times the standard deviation.

[0069] In an optional implementation, after the system obtains the technical indicator set for the current first period, it will compare it with the previously set threshold interval. If the value of any technical indicator in the technical indicator set, such as the success rate, average response time, or error code ratio, exceeds the threshold interval corresponding to the indicator, the system will determine that the technical indicator set meets the preset anomaly detection conditions. This means that in the current period, there may be anomalies in the operation of the bank-enterprise system, and further inspection and intervention are required. For example, if the success rate of the current period is lower than the historical mean minus two standard deviations, or the average response time is higher than the historical mean plus two standard deviations, the system will automatically trigger the alarm mechanism and promptly notify the operation and maintenance personnel to conduct investigations to ensure the stable operation of the system.

[0070] Through the above-mentioned implementation methods of the present application, thresholds can be set dynamically based on historical data, anomalies in transaction data can be effectively identified, the false alarm rate is reduced, the accuracy and timeliness of monitoring are improved, and it plays an important role in ensuring the normal operation of the bank-enterprise system and improving service quality.

[0071] Optionally, in the transaction monitoring method provided in the embodiment of the present application, the target transaction data set is input into the monitoring model to obtain a transaction data monitoring result, including: classifying the target transaction data set according to the transaction category to obtain a target transaction data subset; inputting the target transaction data subset into the monitoring model to obtain multiple transaction data monitoring sub-results; when any transaction data monitoring sub-result is a transaction anomaly, determining that the transaction data monitoring result is a transaction anomaly.

[0072] It should be noted that different transaction categories (such as payment, inquiry, transfer, etc.) may have different normal behavior patterns. The same business type has similar characteristics, so the transaction data of the enterprise can be divided according to the business category to obtain data subsets.

[0073] In an optional implementation, the system first divides all transaction data from the target transaction data set into several target transaction data subsets based on the transaction code or transaction type field, and each subset contains transaction data of the same category. For example, assuming that the target transaction data set contains all transaction data of enterprise A in the first period, the system will further divide these data into payment transaction subsets, query transaction subsets, and transfer transaction subsets based on transaction categories, so as to perform more accurate anomaly detection for transactions of different categories later.

[0074] In an optional implementation, the system will input each target transaction data subset into the monitoring model to detect potential transaction anomalies. The monitoring model can be an algorithm based on unsupervised learning, such as Isolation Forest, Auto encoder or one-dimensional convolutional neural network (1D CNN), etc. These models have learned the characteristics and patterns of normal transaction data during the training phase, so they can effectively identify abnormal data that deviates from these patterns. The monitoring model will analyze the payment transaction subset, query transaction subset and transfer transaction subset respectively, and generate a transaction data monitoring sub-result for each subset, which will indicate whether the transaction data in the subset is normal, or what type of anomaly exists.

[0075] It should be noted that if the monitoring model identifies anomalies in the transaction data when analyzing any target transaction data subset (that is, any transaction data monitoring sub-result is a transaction anomaly), the system will determine the overall result of the transaction data monitoring as a transaction anomaly. This means that even if the transaction data is normal in most transaction categories in the first period, if abnormal behavior is detected in a certain type of transaction, the system will issue an alarm to prompt the operation and maintenance personnel to handle the abnormal transaction. For example, in the first period, the monitoring model did not find any anomalies when analyzing the payment transaction subset, but identified abnormal transaction data when analyzing the transfer transaction subset, such as abnormally high transaction frequency, abnormal transaction amount, or incorrect account information. At this time, the system will immediately determine that the transaction data monitoring result is a transaction anomaly and send an alarm to the operation and maintenance personnel to ensure that any potential risks or problems are handled in a timely manner.

[0076] It should be noted that the monitoring model can be a model trained separately for different businesses, and the monitoring model can be a model trained separately for different business scenarios. This is an effective strategy to improve the accuracy and pertinence of anomaly detection. In the bank-enterprise transaction system, different business types such as payment, transfer, inquiry, etc. usually have their own unique data characteristics and behavior patterns. Therefore, the use of monitoring models specific to business scenarios can more accurately identify abnormal transactions and reduce false alarms. At the same time, it can also locate problems more quickly and improve the efficiency of troubleshooting.

[0077] In an optional implementation, the system can collect a large amount of historical transaction data, which can fully cover the normal transaction behavior in various business scenarios. Data preprocessing includes steps such as cleaning, standardization, and feature extraction to ensure data quality and model training effect. For each business type, the system can use a specific data set to train the monitoring model. The goal of model training is to learn the patterns and distribution of normal transaction data, as well as potential abnormal behavior characteristics. During the training process, the model automatically adjusts its parameters to maximize the fit of normal transaction patterns in historical data while being able to distinguish abnormal transactions. For example, for payment services, the monitoring model may focus on features such as transaction amount, transaction frequency, and transaction time to identify possible fraud or system failures; while for query services, the model may focus more on indicators such as response time, success rate, and query type to evaluate the performance and stability of the system.

[0078] Through the above implementation of the present application, abnormal situations in transaction data can be efficiently and accurately identified, which not only improves the efficiency of monitoring, but also enables detailed analysis of different types of transactions, which helps to quickly locate problems and ensure the safe and stable operation of the bank-enterprise system. And the use of a business-specific monitoring model can more accurately identify abnormal patterns related to the business, reduce false positives and missed reports, and once an abnormality is detected in a specific business, the system can immediately take targeted measures to speed up the response and reduce the impact of the abnormality on the business.

[0079] Optionally, in the transaction monitoring method provided in the embodiment of the present application, after determining that there are abnormal transactions within the first time period, it also includes: generating the abnormal information as first notification information, and sending the first notification information to a confirmation system; in response to the annotation information sent by the confirmation system, determining that there are no abnormal transactions within the first time period, and updating the monitoring model according to the annotation information.

[0080] It should be noted that when the transaction monitoring model detects abnormal transactions in the first time period, the system will automatically generate the first notification information. The first notification information usually contains specific information about the abnormal transaction, such as the type of abnormal transaction, transaction time, enterprise number involved, transaction code, specific manifestations of the abnormality (such as abnormally high response time, incorrect transaction amount, etc.) and preliminary analysis of the cause of the abnormality. This information is crucial for operation and maintenance personnel to quickly understand the abnormal situation and locate the root cause of the problem. Subsequently, the system will send the first notification information to the confirmation system, which usually refers to a module or platform specifically used to receive abnormal information, perform manual confirmation and feedback the results. The confirmation system can be an internal operation and maintenance management platform or an external customer service system, depending on the sensitivity of the abnormal information and the requirements of the processing process. The system can notify the operation and maintenance management personnel through SMS, email, etc., reminding XX customers of XX transactions that there may be abnormal risks in the XXX time period.

[0081] In an optional implementation, after the confirmation system receives the first notification information, the operation and maintenance personnel or relevant persons in charge will conduct manual inspection and confirmation based on the abnormal details in the notification information, combined with additional information such as system logs and transaction records. If, after manual analysis, it is confirmed that the abnormal information is actually caused by specific business rules, system upgrades or other non-abnormal situations, the operation and maintenance personnel will send annotation information through the confirmation system to indicate that the abnormal information is a false alarm. After receiving the annotation information, the system will mark the falsely reported abnormal transactions as normal transactions based on the feedback results. This process is called "annotation". The annotation information is not only used to correct the current anomaly detection results, but more importantly, it will be used to update the monitoring model. The monitoring model will adjust its understanding of normal transaction patterns based on the normal transaction data fed back in the annotation information, thereby reducing similar false alarms in future detections.

[0082] For example, during a system upgrade test at a certain enterprise, a large number of small test transactions may occur, which rarely occur in normal business and are therefore misjudged as abnormal by the monitoring model. The operation and maintenance personnel confirm the annotation information sent by the system, indicating that these small transactions are normal test behaviors. The system will update the monitoring model based on this information, so that it can better identify similar test transactions in the future and avoid false positives again.

[0083] Through the above implementation of this application, not only can real abnormal situations be discovered and responded to in a timely manner, but also the performance of the monitoring model can be continuously optimized through manual annotation and model update, the false alarm rate can be reduced, and the accuracy and reliability of abnormality detection can be improved. This mechanism reflects that the system can adaptively learn and adjust during operation to adapt to the ever-changing business environment and technical requirements, providing strong support for the stable operation of the bank-enterprise system.

[0084] Figure 3 is a schematic diagram of a transaction monitoring method provided according to an embodiment of the present application; Figure 3 As shown, step S302, obtain transaction data. In the bank-enterprise interconnection system, transaction logs are added before and after the service call through the service interceptor to record key business elements, including transaction code, group number, transaction unique number, debit account, credit account, amount, remarks, summary, processing status, error code, error message, etc.

[0085] Step S304, data grouping and aggregation. The above transaction log message is transmitted to the monitoring system through Kafka message push. The monitoring system stores information in the form of streaming data, and completes data grouping and aggregation through scheduled tasks, and statistically calculates technical indicators such as time period success rate, response time, and error code ratio. The transaction log can be pushed through Kafka. This can be achieved by configuring a log framework such as log4j to send the log directly to the Kafka topic. The monitoring system stores information in the form of streaming data, and tools such as Apache Kafka and Apache Flink can be used. These tools can handle high-throughput real-time data streams and support real-time processing and analysis of data.

[0086] Step S306, abnormal transaction monitoring. According to the historical technical indicator details, through the artificial intelligence algorithm, according to the indicator deviation and abnormal detection ideas, it is judged whether there is an abnormality in the current time period. If an abnormality is detected, it will enter the alarm manual intervention stage. Two processes, technical indicator monitoring and transaction abnormality monitoring, can be carried out, and abnormal transactions can be monitored at the same time.

[0087] Step S308, abnormal message push. The system notifies the operation and maintenance management personnel through SMS, email, etc., reminding that XX transaction XX customer may have abnormal risks in XXX time period. The operation and maintenance personnel log in to the monitoring system, observe the indicator details on the intelligent indicator abnormal detection page, and combine transaction data query and log acquisition to judge the system operation status. For the false alarm scenario, it can be marked as no problem. The system records the marking results and optimizes the subsequent abnormal detection process.

[0088] In an embodiment of the present application, the reference transaction data set in the first time period is grouped according to the enterprise number to obtain the target transaction data set corresponding to each enterprise number; the target transaction data set is aggregated to obtain a technical indicator set, wherein the technical indicator is used to indicate the characteristics of the bank-enterprise system; the target transaction data set is input into the monitoring model to obtain the transaction data monitoring result; when the technical indicator set meets the preset conditions or the transaction data monitoring result is an abnormal transaction, it is determined that there is an abnormal transaction in the first time period. For monitoring transactions within a time period, the transaction data can be divided according to the enterprise number, and the technical indicators can be obtained according to the data aggregation corresponding to the enterprise. The technical indicators can indicate the impact of the transaction corresponding to the enterprise in the first time period on the performance of the system and the overall indicators of the transaction. And the data set corresponding to the enterprise can be input into the monitoring model to obtain the monitoring results corresponding to the transaction business, and finally the abnormality of the transaction is judged from the two dimensions of the technical indicators and the business side corresponding to the enterprise. Thus, the technical problem that the monitoring accuracy is low and a large amount of human resources are consumed due to the combination of artificial means to configure the monitoring dimensions is solved.

[0089] It should be noted that the steps shown in the flowcharts of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and that, although a logical order is shown in the flowcharts, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0090] Example 2

[0091] The embodiment of the present application also provides a transaction monitoring device. It should be noted that the transaction monitoring device of the embodiment of the present application can be used to execute the transaction monitoring method provided in the embodiment of the present application. The transaction monitoring device provided in the embodiment of the present application is introduced below.

[0092] According to an embodiment of the present application, a device for implementing the above transaction monitoring method is also provided, such as Figure 4 As shown, the device comprises:

[0093] The data grouping unit 402 groups the reference transaction data set in the first period according to the enterprise number to obtain the target transaction data set corresponding to each enterprise number;

[0094] The data aggregation unit 404 is used to aggregate the target transaction data set to obtain a technical indicator set, wherein the technical indicator is used to indicate the characteristics of the bank-enterprise system;

[0095] The transaction monitoring unit 406 is used to input the target transaction data set into the monitoring model to obtain the transaction data monitoring result;

[0096] The abnormality determination unit 408 is used to determine whether there is an abnormal transaction in the first time period when the technical indicator set meets the preset conditions or the transaction data monitoring result is an abnormal transaction.

[0097] The transaction monitoring device provided by the embodiment of the present application groups the reference transaction data set in the first time period according to the enterprise number to obtain the target transaction data set corresponding to each enterprise number; aggregates the target transaction data set to obtain a technical indicator set, wherein the technical indicator is used to indicate the characteristics of the bank-enterprise system; inputs the target transaction data set into the monitoring model to obtain the transaction data monitoring result; when the technical indicator set meets the preset conditions or the transaction data monitoring result is an abnormal transaction, it is determined that there is an abnormal transaction in the first time period. For monitoring transactions within a time period, the transaction data can be divided according to the enterprise number, and the technical indicators can be obtained according to the data aggregation corresponding to the enterprise. The technical indicators can indicate the impact of the transaction corresponding to the enterprise in the first time period on the performance of the system and the overall indicators of the transaction. And the data set corresponding to the enterprise can be input into the monitoring model to obtain the monitoring results corresponding to the transaction business, and finally the abnormality of the transaction is judged from the two dimensions of the technical indicators and the business side corresponding to the enterprise. Thus, the technical problem that the monitoring accuracy is low and a large amount of human resources are consumed due to the combination of artificial means to configure the monitoring dimensions is solved.

[0098] Optionally, the data grouping unit 402 includes: a first log recording module, used to respond to a transaction request instruction and obtain a transaction request log according to a first log template, wherein the transaction request log is used to indicate transaction data before the transaction starts; a second log recording module, used to respond to a transaction call instruction and obtain a transaction response log according to a second log template, wherein the transaction response log is used to indicate transaction data after the transaction is completed.

[0099] Optionally, the above-mentioned data aggregation unit 404 includes: a first indicator confirmation module, used to determine the number of successful transactions and the total number of transactions in the first time period according to the target transaction data set, and determine the ratio between the number of successful transactions and the total number of transactions as the success rate; a second indicator confirmation module, used to obtain the response time of the transactions in the first time period, and calculate the mean of the response time; a third indicator confirmation module, used to determine the number of occurrences of the error code in the first time period according to the target transaction data set, and calculate the error code ratio.

[0100] Optionally, the above-mentioned abnormality determination unit 408 includes: a period determination module, which is used to determine the second time period based on the first period and the first time period, wherein the second time period is the time period before the first time period, and the period between the first time period and multiple second time periods is the first period; an interval determination module, which is used to obtain a set of historical technical indicators corresponding to the second time period, and use the historical technical indicator set to determine the threshold interval of each technical indicator; a condition comparison module, which is used to determine that the technical indicator set meets the preset conditions when any technical indicator in the technical indicator set does not meet the corresponding threshold interval.

[0101] Optionally, the transaction monitoring unit 406 includes: a data classification module, used to classify the target transaction data set according to the transaction category to obtain a target transaction data subset; a monitoring result generation module, used to input the target transaction data subset into the monitoring model to obtain multiple transaction data monitoring sub-results; a monitoring result determination module, used to determine that the transaction data monitoring result is a transaction abnormality when any transaction data monitoring sub-result is a transaction abnormality.

[0102] Optionally, the above-mentioned transaction monitoring device also includes: a message sending unit, used to generate the abnormal information into a first notification information, and send the first notification information to the confirmation system; a model updating unit, used to respond to the marking information sent by the confirmation system, determine that there is no abnormal transaction within the first time period, and update the monitoring model according to the marking information.

[0103] It should be noted that the data grouping unit 402 to the abnormality determination unit 408 correspond to steps S101 to S104 in Example 1, and the two modules and the corresponding steps implement the same examples and application scenarios, but are not limited to the contents disclosed in the above-mentioned Example 1. It should be noted that the above-mentioned modules or units can be hardware components or software components stored in a memory (e.g., memory 104) and processed by one or more processors (e.g., processors 102a, 102b, ..., 102n), and the above-mentioned modules can also be part of the device and can be run in the computer terminal 10 provided in Example 1.

[0104] Example 3

[0105] An embodiment of the present application may provide an electronic device, Figure 5 is a structural block diagram of an electronic device according to an embodiment of the present application. Figure 5 As shown, the electronic device may include: one or more ( Figure 5 (only one is shown) processor 1002, memory 1004, storage controller, and peripheral interface, wherein the peripheral interface is connected to the radio frequency module, audio module and display.

[0106] Among them, the memory can be used to store software programs and modules, such as program instructions / modules corresponding to the methods and devices in the embodiments of the present application, and the processor executes various functional applications and data processing by running the software programs and modules stored in the memory, that is, realizing the above-mentioned method. The memory may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory may further include a memory remotely arranged relative to the processor, and these remote memories may be connected to the terminal via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0107] The processor may call the information and application program stored in the memory through the transmission device to perform the following steps:

[0108] S1, grouping the reference transaction data set within the first period according to the enterprise number to obtain the target transaction data set corresponding to each enterprise number;

[0109] S2, aggregating the target transaction data set to obtain a set of technical indicators, wherein the technical indicators are used to indicate the characteristics of the bank-enterprise system;

[0110] S3, input the target transaction data set into the monitoring model to obtain the transaction data monitoring results;

[0111] S4, when the technical indicator set meets the preset conditions or the transaction data monitoring result shows that the transaction is abnormal, determine that there is abnormal transaction in the first period.

[0112] The processor can also call the information and application stored in the memory through the transmission device to perform the following steps: in response to the transaction request instruction, obtain the transaction request log according to the first log template, wherein the transaction request log is used to indicate the transaction data before the transaction starts; in response to the transaction call instruction, obtain the transaction response log according to the second log template, wherein the transaction response log is used to indicate the transaction data after the transaction is completed.

[0113] The processor can also call the information and application programs stored in the memory through the transmission device to perform the following steps: determine the number of successful transactions and the total number of transactions in the first time period based on the target transaction data set, and determine the ratio between the number of successful transactions and the total number of transactions as the success rate; obtain the response time of the transactions in the first time period, and calculate the mean of the response time; determine the number of occurrences of the error code in the first time period based on the target transaction data set, and calculate the error code ratio.

[0114] The processor can also call the information and application stored in the memory through the transmission device to perform the following steps: determine the second time period based on the first cycle and the first time period, wherein the second time period is the time period before the first time period, and the period between the first time period and multiple second time periods is the first cycle; obtain the historical technical indicator set corresponding to the second time period, and use the historical technical indicator set to determine the threshold interval of each technical indicator; when any technical indicator in the technical indicator set does not meet the corresponding threshold interval, determine that the technical indicator set meets the preset conditions.

[0115] The processor can also call the information and application programs stored in the memory through the transmission device to perform the following steps: classify the target transaction data set according to the transaction category to obtain a target transaction data subset; input the target transaction data subset into the monitoring model to obtain multiple transaction data monitoring sub-results; when any transaction data monitoring sub-result is a transaction abnormality, determine that the transaction data monitoring result is a transaction abnormality.

[0116] The processor can also call the information and application programs stored in the memory through the transmission device to perform the following steps: generate the abnormal information as the first notification information, and send the first notification information to the confirmation system; in response to the marking information sent by the confirmation system, determine that there are no abnormal transactions in the first time period, and update the monitoring model according to the marking information.

[0117] In an embodiment of the present application, the reference transaction data set in the first time period is grouped according to the enterprise number to obtain the target transaction data set corresponding to each enterprise number; the target transaction data set is aggregated to obtain a technical indicator set, wherein the technical indicator is used to indicate the characteristics of the bank-enterprise system; the target transaction data set is input into the monitoring model to obtain the transaction data monitoring result; when the technical indicator set meets the preset conditions or the transaction data monitoring result is an abnormal transaction, it is determined that there is an abnormal transaction in the first time period. For monitoring transactions within a time period, the transaction data can be divided according to the enterprise number, and the technical indicators can be obtained according to the data aggregation corresponding to the enterprise. The technical indicators can indicate the impact of the transaction corresponding to the enterprise in the first time period on the performance of the system and the overall indicators of the transaction. And the data set corresponding to the enterprise can be input into the monitoring model to obtain the monitoring results corresponding to the transaction business, and finally the abnormality of the transaction is judged from the two dimensions of the technical indicators and the business side corresponding to the enterprise. Thus, the technical problem that the monitoring accuracy is low and a large amount of human resources are consumed due to the combination of artificial means to configure the monitoring dimensions is solved.

[0118] It can be understood by those skilled in the art that Figure 5The structure shown is for illustration only, and the electronic device may also be a smart phone (such as an Android phone, an iOS phone, etc.), a tablet computer, a PDA, a mobile Internet device (Mobile Internet Devices, MID), a PAD, or other terminal devices. Figure 5 The structure of the electronic device is not limited. Figure 5 More or fewer components (such as network interfaces, display devices, etc.) shown in, or having Figure 5 Different configurations are shown.

[0119] A person of ordinary skill in the art can understand that all or part of the steps in the various methods of the above embodiments can be completed by instructing the hardware related to the terminal device through a program, and the program can be stored in a computer-readable storage medium, and the storage medium may include: a flash drive, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, etc.

[0120] Example 4

[0121] The embodiment of the present application further provides a storage medium. Optionally, in this embodiment, the storage medium can be used to store the program code executed by the transaction monitoring method provided in the first embodiment.

[0122] Optionally, in this embodiment, the above storage medium may be located in any computer terminal in a computer terminal group in a computer network, or in any mobile terminal in a mobile terminal group.

[0123] The present application also provides a computer program product, which, when executed on a data processing device, is suitable for executing the program of the transaction monitoring method.

[0124] The serial numbers of the above-mentioned embodiments of the present application are for description only and do not represent the advantages or disadvantages of the embodiments.

[0125] In the above embodiments of the present application, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, please refer to the relevant description of other embodiments.

[0126] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0127] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0128] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0129] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, in essence, or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions to enable a computer device (which can be a personal computer, a server or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, disk or optical disk and other media that can store program codes.

[0130] The above is only a preferred implementation of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. A transaction monitoring method, characterized in that: include: The reference transaction data set within the first period is grouped according to the enterprise number to obtain the target transaction data set corresponding to each enterprise number; Aggregating the target transaction data set to obtain a set of technical indicators, wherein the technical indicators are used to indicate the characteristics of the bank-enterprise system; Inputting the target transaction data set into the monitoring model to obtain transaction data monitoring results; When the technical indicator set meets the preset conditions or the transaction data monitoring result is an abnormal transaction, it is determined that there is an abnormal transaction in the first time period.

2. The method according to claim 1, characterized in that: Before grouping the reference transaction data set within the first period according to the enterprise number, the method includes: In response to the transaction request instruction, obtaining a transaction request log according to a first log template, wherein the transaction request log is used to indicate transaction data before the transaction starts; In response to the transaction call instruction, a transaction response log is obtained according to the second log template, wherein the transaction response log is used to indicate transaction data after the transaction is completed.

3. The method according to claim 1, characterized in that The step of aggregating the target transaction data set to obtain a set of technical indicators includes at least one of the following: Determine the number of successful transactions and the total number of transactions in the first period according to the target transaction data set, and determine the ratio between the number of successful transactions and the total number of transactions as the success rate; Obtaining response times of transactions in the first period, and calculating an average of the response times; The number of occurrences of the error code in the first time period is determined according to the target transaction data set, and the error code ratio is calculated.

4. The method according to claim 3, characterized in that The technical indicator set meets the preset conditions, including: Determine a second time period according to the first cycle and the first time period, wherein the second time period is a time period before the first time period, and a period between the first time period and a plurality of the second time periods is the first cycle; Acquire a set of historical technical indicators corresponding to the second period, and determine a threshold range of each technical indicator using the set of historical technical indicators; When any one of the technical indicators in the technical indicator set does not meet the corresponding threshold interval, it is determined that the technical indicator set meets the preset condition.

5. The method according to claim 1, characterized in that The step of inputting the target transaction data set into the monitoring model to obtain the transaction data monitoring result includes: Classifying the target transaction data set according to transaction categories to obtain a target transaction data subset; Inputting the target transaction data subset into the monitoring model to obtain a plurality of transaction data monitoring sub-results; In the case where any one of the transaction data monitoring sub-results is a transaction abnormality, it is determined that the transaction data monitoring result is a transaction abnormality.

6. The method according to any one of claims 1 to 5, characterized in that After determining that there is an abnormal transaction within the first time period, the method further includes: Generating the abnormal information as first notification information, and sending the first notification information to the confirmation system; In response to the annotation information sent by the confirmation system, it is determined that there is no abnormal transaction in the first time period, and the monitoring model is updated according to the annotation information.

7. A transaction monitoring device, characterized in that: include: A data grouping unit, grouping the reference transaction data set within the first period according to the enterprise number, to obtain a target transaction data set corresponding to each enterprise number; A data aggregation unit, used for aggregating the target transaction data set to obtain a technical indicator set, wherein the technical indicator is used to indicate the characteristics of the bank-enterprise system; A transaction monitoring unit, used for inputting the target transaction data set into a monitoring model to obtain a transaction data monitoring result; The abnormality determination unit is used to determine whether there is an abnormal transaction in the first time period when the technical indicator set meets the preset conditions or the transaction data monitoring result is an abnormal transaction.

8. A computer-readable storage medium, characterized in that: The computer-readable storage medium includes a stored executable program, wherein when the executable program is executed, the device where the computer-readable storage medium is located is controlled to execute the transaction monitoring method according to any one of claims 1 to 6.

9. An electronic device, characterized in that: include: A memory storing an executable program; A processor, configured to run the program, wherein the program executes the method according to any one of claims 1 to 6 when running.

10. A computer program product comprising computer instructions, characterized in that: When the computer instructions are executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images