Dynamic threshold determination method and device, electronic equipment and computer program product

Abstract

The invention discloses a dynamic threshold determination method and device, electronic equipment and a computer program product. The method comprises the steps that a user historical bill is acquired, the user historical bill comprises multiple pieces of index data used for bill evaluation, and the index data at least comprises first index data used for evaluating non-time sequence indexes and second index data used for evaluating time sequence indexes; the non-time sequence index is insensitive to the time change, and the time sequence index is sensitive to the time change; analyzing the first index data by using a first dynamic threshold model to obtain a non-time sequence dynamic threshold corresponding to the non-time sequence index; and analyzing the second index data by using a second dynamic threshold model to obtain a time sequence dynamic threshold corresponding to the time sequence index. According to the invention, the technical problem of low threshold configuration efficiency caused by manual threshold configuration in the prior art is solved.

Description

Technical Field

[0001] The present invention relates to the field of artificial intelligence, and in particular to a method, device, electronic device and computer program product for determining a dynamic threshold. Background Art

[0002] With the continuous improvement of the digital level of enterprises, the requirements for the timeliness and accuracy of risk prevention and control are further improved. The system needs to output a large number of operational indicators, and the traditional fixed threshold setting cannot meet the needs of indicator monitoring and anomaly detection for risk prevention and control.

[0003] Since the setting of fixed thresholds requires manual experience and cannot change with business development, the alarms are frequently "too many, wrong, too few, missed, and late", which seriously affects the decision-making quality and operational efficiency of risk control. In addition, in terms of threshold setting, manual threshold configuration often requires relevant field personnel to set and adjust repeatedly according to the deployment situation and business characteristics before it can be applied to production operations. The personnel have different levels of mastery of different businesses, and the efficiency is low; there are many risk control scenario indicators, the configuration workload is heavy, and the real-time scenario takes a long time; at the same time, it cannot adapt to the changes in business volume caused by different time periods and business development, and the accuracy is difficult to grasp.

[0004] In terms of IT self-operation and maintenance, risk prevention and control adopts the method of post-warning, and is currently unable to prevent risks in advance. That is, it is impossible to predict the system status within a certain period of time in the future based on the current status, and the ability cannot support the development needs of IT self-operation and maintenance.

[0005] The above-mentioned prior art adopts manual threshold configuration, which has the problem of low threshold configuration efficiency, and no effective solution has been proposed yet. Summary of the invention

[0006] The embodiments of the present invention provide a method, device, electronic device and computer program product for determining a dynamic threshold, so as to at least solve the technical problem that the threshold configuration is manually performed in the prior art and the efficiency of the threshold configuration is low.

[0007] According to one aspect of an embodiment of the present invention, a method for determining a dynamic threshold is provided, comprising: obtaining a user's historical bills, wherein the user's historical bills include: a plurality of indicator data for bill evaluation, wherein the indicator data are at least divided into: a first indicator data for evaluating a non-time series indicator, and a second indicator data for evaluating a time series indicator, wherein the non-time series indicator is insensitive to time changes, and the time series indicator is sensitive to time changes; using a first dynamic threshold model to analyze the first indicator data to obtain a non-time series dynamic threshold corresponding to the non-time series indicator, wherein the first dynamic threshold model is an extreme gradient boosting model, and the extreme gradient boosting model uses a gradient boosting decision tree as a model framework; using a second dynamic threshold model to analyze the second indicator data to obtain a time series dynamic threshold corresponding to the time series indicator, wherein the second dynamic threshold model is an attention-based deep neural network model.

[0008] Optionally, the method also includes: detecting whether the update time since the last update of the dynamic threshold model reaches a preset update period, wherein the dynamic threshold model includes: the first dynamic threshold model and the second dynamic threshold model; when the last update time of the dynamic threshold model reaches the preset update period, updating the user history bill, wherein the time span of the user history bill is greater than the preset update period.

[0009] Optionally, the method also includes: obtaining a bill to be evaluated within a period to be evaluated, wherein the time span of the bill to be evaluated is smaller than the time span of the user's historical bills, and the bill to be evaluated includes: data to be evaluated corresponding to multiple preset indicators, and the preset indicators include at least: the non-time series indicators and the time series indicators; using a preset dynamic threshold in a preset risk fee model to detect the data to be evaluated corresponding to each of the preset indicators in the bill to be evaluated, wherein the preset dynamic threshold includes at least: the non-time series dynamic threshold and the time series dynamic threshold; generating a warning message when the data to be evaluated does not meet the preset dynamic threshold.

[0010] Optionally, before obtaining the bills to be evaluated within the time period to be evaluated, the method also includes: obtaining multiple bills to be predicted that are earlier than the time period to be evaluated, wherein each of the bills to be predicted has the same time span as the bill to be evaluated; using a preset evaluation prediction model to analyze the multiple bills to be predicted to obtain a predicted bill for the time period to be evaluated, wherein the preset evaluation prediction model is a machine learning model pre-trained using multiple sample bills with the same time span, and the predicted bill includes at least: a predicted value corresponding to each preset indicator; determining the predicted value in the predicted bill as the data to be evaluated to obtain the bill to be evaluated.

[0011] Optionally, before using the preset risk fee model to detect whether the predicted value corresponding to the same preset indicator matches the preset dynamic threshold, the method also includes: using the non-time series dynamic threshold obtained by the first dynamic threshold model, and the time series dynamic threshold obtained by the second dynamic threshold model, to update the preset dynamic threshold in the preset risk fee model.

[0012] Optionally, after obtaining the bill to be evaluated within the evaluation period, the method further includes: detecting whether the influencing factors in the bill to be evaluated and the user's historical bill have changed, wherein the influencing factors are description items of the indicator data, and the non-time series indicators are sensitive to factor changes; if the influencing factors in the bill to be evaluated and the user's historical bill have changed, updating the user's historical bill.

[0013] Optionally, when the data to be evaluated does not meet the preset dynamic threshold, generating early warning information includes: when the data to be evaluated does not meet the preset dynamic threshold, determining the data to be evaluated as abnormal data; detecting whether each of the indicators to be evaluated in the bill to be evaluated has been detected by the preset risk fee model; when each of the indicators to be evaluated in the bill to be evaluated has been detected by the preset risk fee model, aggregating the abnormal data and generating the early warning information.

[0014] According to another aspect of an embodiment of the present invention, a device for determining a dynamic threshold is also provided, including: an acquisition module, used to acquire a user's historical bills, wherein the user's historical bills include: a plurality of indicator data for bill evaluation, wherein the indicator data are at least divided into: first indicator data for evaluating non-time series indicators, and second indicator data for evaluating time series indicators, wherein the non-time series indicators are insensitive to time changes, and the time series indicators are sensitive to time changes; a first analysis module, used to analyze the first indicator data using a first dynamic threshold model to obtain a non-time series dynamic threshold corresponding to the non-time series indicator, wherein the first dynamic threshold model is an extreme gradient boosting model, and the extreme gradient boosting model uses a gradient boosting decision tree as a model framework; a second analysis module, used to analyze the second indicator data using a second dynamic threshold model to obtain a time series dynamic threshold corresponding to the time series indicator, wherein the second dynamic threshold model is an attention-based deep neural network model.

[0015] According to another aspect of an embodiment of the present invention, there is further provided an electronic device, including a memory and a processor, wherein the memory stores a computer program, and the processor is configured to execute the above-mentioned method for determining the dynamic threshold through the computer program.

[0016] According to another aspect of an embodiment of the present invention, a computer program product is provided, including computer instructions, which implement the steps of the above-mentioned method for determining the dynamic threshold when executed by a processor.

[0017] In an embodiment of the present invention, a dynamic threshold model is used to analyze indicator data in a user's historical bill, thereby achieving the purpose of automatically determining a dynamic threshold. In the case of setting a dynamic threshold, the indicator data in the user's historical bill can be divided into first indicator data of non-time series indicators that are insensitive to time changes, and second indicator data of time series indicators that are sensitive to time changes. The first dynamic threshold model is used to generate a non-time series dynamic threshold based on the first indicator data, and the second dynamic threshold model is used to generate a time series dynamic threshold based on the second indicator. On the basis of automatically generating a dynamic threshold, the generated dynamic threshold can be made more accurate, thereby achieving the technical effect of improving the configuration efficiency of the dynamic threshold, thereby solving the technical problem that the existing technology uses manual threshold configuration and has low threshold configuration efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] The drawings described herein are used to provide a further understanding of the present invention and constitute a part of this application. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute an improper limitation of the present invention. In the drawings:

[0019] Figure 1 is a flow chart of a method for determining a dynamic threshold according to an embodiment of the present invention;

[0020] Figure 2 is a schematic diagram of a system for implementing a warning and interception system based on a dynamic threshold according to an embodiment of the present invention;

[0021] Figure 3 is a schematic diagram of system integration relationship according to an embodiment of the present invention;

[0022] Figure 4 is a schematic diagram of a dynamic threshold construction process according to an embodiment of the present invention;

[0023] Figure 5 is a schematic diagram of a method for realizing early warning and interception according to a dynamic threshold by a system according to an embodiment of the present invention;

[0024] Figure 6 is a schematic diagram of a device for determining a dynamic threshold according to an embodiment of the present invention;

[0025] Figure 7 It is a structural block diagram of a computer terminal according to an embodiment of the present invention. DETAILED DESCRIPTION

[0026] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0027] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0028] First, some nouns or terms that appear in the description of the embodiments of the present application are subject to the following explanations:

[0029] XGBoost: is an efficient gradient boosting decision tree (GBDT) framework, mainly used for machine learning tasks such as classification, regression and sorting.

[0030] TFT is a model that combines recurrent neural networks (RNNs) and attention mechanisms to handle multivariate time series forecasting problems.

[0031] According to an embodiment of the present invention, an embodiment of a method for determining a dynamic threshold is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0032] Figure 1 is a flow chart of a method for determining a dynamic threshold according to an embodiment of the present invention. Figure 1 As shown, the method comprises the following steps:

[0033] Step S102, obtaining a user's historical bill, wherein the user's historical bill includes: a plurality of indicator data for bill evaluation, the indicator data being at least divided into: first indicator data for evaluating a non-time series indicator, and second indicator data for evaluating a time series indicator, the non-time series indicator being insensitive to time changes, and the time series indicator being sensitive to time changes;

[0034] Step S106, using the first dynamic threshold model to analyze the first indicator data to obtain a non-time series dynamic threshold corresponding to the non-time series indicator, wherein the first dynamic threshold model is an extreme gradient boosting model, and the extreme gradient boosting model uses a gradient boosting decision tree as a model framework;

[0035] Step S108, using the second dynamic threshold model to analyze the second indicator data to obtain a time series dynamic threshold corresponding to the time series indicator, wherein the second dynamic threshold model is an attention-based deep neural network model.

[0036] In an embodiment of the present invention, a dynamic threshold model is used to analyze indicator data in a user's historical bill, thereby achieving the purpose of automatically determining a dynamic threshold. In the case of setting a dynamic threshold, the indicator data in the user's historical bill can be divided into first indicator data of non-time series indicators that are insensitive to time changes, and second indicator data of time series indicators that are sensitive to time changes. The first dynamic threshold model is used to generate a non-time series dynamic threshold based on the first indicator data, and the second dynamic threshold model is used to generate a time series dynamic threshold based on the second indicator. On the basis of automatically generating a dynamic threshold, the generated dynamic threshold can be made more accurate, thereby achieving the technical effect of improving the configuration efficiency of the dynamic threshold, thereby solving the technical problem that the existing technology uses manual threshold configuration and has low threshold configuration efficiency.

[0037] In the above step S102, the non-time series indicator is insensitive to time changes but sensitive to factor changes.

[0038] In the above step S102, the time series indicator is sensitive to time changes.

[0039] In the above step S106, the first dynamic threshold model is an extreme gradient boosting model, which adopts the XGBoost algorithm and uses the gradient boosting decision tree GBDT as a model framework mainly for machine learning tasks such as classification, regression and sorting.

[0040] In the above step S108, the second dynamic threshold model is an attention-based deep neural network model, which adopts the TFT (Temporal Fusion Transformers) algorithm, combines the recurrent neural network (RNN) and the attention mechanism, uses the attention mechanism to capture the complex interactions between variables, and uses external information (such as time features) to enhance the prediction ability, which is used to deal with multivariate time series prediction problems.

[0041] As an optional embodiment, the method also includes: detecting whether the update time since the last update of the dynamic threshold model reaches a preset update period, wherein the dynamic threshold model includes: a first dynamic threshold model and a second dynamic threshold model; when the last update time of the dynamic threshold model reaches the preset update period, updating the user's historical bill, wherein the time span of the user's historical bill is greater than the preset update period.

[0042] In the above-mentioned embodiment of the present application, the dynamic threshold model includes: a first dynamic threshold model and a second dynamic threshold model. The dynamic threshold model can be updated according to a preset update cycle. Further, when the update time of the dynamic threshold model from the last update reaches the preset update cycle, the user history bill for training the dynamic threshold model can be updated, and the dynamic threshold model can be retrained according to the updated user history bill, thereby realizing the update of the dynamic threshold model according to the preset update cycle.

[0043] Optionally, the time span of the user's historical bill is greater than the preset update period. The larger the time span, the more indicator data in the user's historical bill. Therefore, a more accurate dynamic threshold model can be trained based on more labeled data.

[0044] Optionally, the preset update period may be one month, and the time span of the user's historical bills may be one year.

[0045] As an optional embodiment, the method also includes: obtaining the bill to be evaluated within the period to be evaluated, wherein the time span of the bill to be evaluated is smaller than the time span of the user's historical bills, and the bill to be evaluated includes: data to be evaluated corresponding to multiple preset indicators, and the preset indicators include at least: non-time series indicators and time series indicators; using the preset dynamic threshold in the preset risk fee model to detect the data to be evaluated corresponding to each preset indicator in the bill to be evaluated, wherein the preset dynamic threshold includes at least: non-time series dynamic threshold and time series dynamic threshold; when the data to be evaluated does not meet the preset dynamic threshold, generating warning information.

[0046] In the above-mentioned embodiment of the present application, the bill to be evaluated includes data to be evaluated corresponding to multiple preset indicators. When evaluating the bill to be evaluated within the period to be evaluated, the preset risk fee model can be used for evaluation. The preset dynamic threshold used to evaluate the bill to be evaluated in the preset risk fee model may include: a non-time series dynamic threshold determined according to the first dynamic threshold model, and a time series dynamic threshold determined according to the second dynamic threshold model. Therefore, when the bill to be evaluated does not meet the preset dynamic threshold, it indicates that the bill to be evaluated is at risk, and then generates early warning information.

[0047] Optionally, the period to be evaluated may be one month, and the time span of the user's historical bills may be one year.

[0048] Optionally, the bill to be evaluated can be an actual bill, such as a monthly bill settled at the end of the month, and the dynamic threshold (i.e., the non-time series dynamic threshold and the time series dynamic threshold) can be used to evaluate the difference between the monthly bills of two adjacent months, wherein the difference can be the difference for the same indicator, such as the difference for non-time series indicators, as well as the difference between time series indicators.

[0049] Optionally, the bill to be evaluated can also be predicted based on existing bills, and the predicted bill obtained, such as the predicted bill predicted based on the data of the current month a few days before the end of the month, the dynamic threshold (i.e., the non-time series dynamic threshold and the time series dynamic threshold) can be used to evaluate the difference between the predicted bill and the bill of the previous month; the dynamic threshold (i.e., the non-time series dynamic threshold and the time series dynamic threshold) can also be used to evaluate the difference between the predicted bill and the actual bill of the current month, wherein the difference can be the difference for the same indicator, such as the difference for non-time series indicators, and the difference between time series indicators.

[0050] As an optional embodiment, before obtaining the bills to be evaluated within the time period to be evaluated, the method also includes: obtaining multiple bills to be predicted that are earlier than the time period to be evaluated, wherein each bill to be predicted has the same time span as the bill to be evaluated; using a preset evaluation prediction model to analyze the multiple bills to be predicted to obtain a predicted bill for the time period to be evaluated, wherein the preset evaluation prediction model is a machine learning model pre-trained using multiple sample bills with the same time span, and the predicted bill includes at least: a predicted value corresponding to each preset indicator; determining the predicted value in the predicted bill as the data to be evaluated, and obtaining the bill to be evaluated.

[0051] In the above-mentioned embodiments of the present application, the bill to be evaluated may be a predicted bill obtained by a preset evaluation prediction model, which may be obtained by machine learning using multiple bills to be predicted with the same time span, and the bill to be predicted may be a bill generated historically. Furthermore, according to the preset evaluation prediction model, the bill to be evaluated in the period to be evaluated may be predicted based on the bills to be predicted that have already been generated, thereby realizing the prediction of the bill to be evaluated.

[0052] Optionally, the multiple bills to be predicted used to predict the predicted bill of the time period to be evaluated have a time span that is the same as the time span of the time period to be evaluated, and the time intervals between the multiple bills to be predicted and the predicted bill are also the same.

[0053] Optionally, the multiple bills to be predicted used to train the preset evaluation prediction model have the same time span and the same time interval. During the training phase, any bill to be predicted can be used as a training target, and multiple bills to be predicted that are earlier than the training target can be input into the preset evaluation prediction model as training data. The preset evaluation prediction model can then output a prediction result based on the input content, and then compare the difference between the prediction result and the training target, and adjust the model parameters of the preset evaluation prediction model based on the difference to complete the search for the preset evaluation prediction model. After the training of the preset evaluation prediction model is completed, the preset evaluation prediction model can use multiple bills to be predicted that are earlier than the time period to be evaluated to generate a predicted bill for the time period to be evaluated.

[0054] As an optional embodiment, before using the preset risk fee model to detect whether the predicted value corresponding to the same preset indicator matches the preset dynamic threshold, the method also includes: using the non-time series dynamic threshold obtained by the first dynamic threshold model, and the time series dynamic threshold obtained by the second dynamic threshold model, to update the preset dynamic threshold in the preset risk fee model.

[0055] In the above-mentioned embodiment of the present application, before using the preset risk fee model, the non-time series dynamic threshold obtained by the first dynamic threshold model and the time series dynamic threshold obtained by the second dynamic threshold model can be used to update the preset dynamic threshold in the preset risk fee model to ensure that the preset risk fee model can use the latest determined preset dynamic threshold for risk assessment.

[0056] As an optional embodiment, after obtaining the bill to be evaluated within the evaluation period, the method also includes: detecting whether the influencing factors in the bill to be evaluated and the user's historical bill have changed, wherein the influencing factors are descriptive items of the indicator data, and non-time series indicators are sensitive to factor changes; if the influencing factors in the bill to be evaluated and the user's historical bill have changed, updating the user's historical bill.

[0057] In the above-mentioned embodiment of the present application, the non-time series indicator is sensitive to the change of factors. In the case where the influencing factors used for the indicator data change, the dynamic threshold model (i.e., the first dynamic threshold model and the second dynamic threshold model) also needs to be updated. Therefore, after obtaining the bill to be evaluated within the period to be evaluated, the bill to be evaluated is also compared with the user's historical bill to determine whether the influencing factors in the bill to be evaluated have changed. If the influencing factors in the bill to be evaluated have changed, the user's historical bill for training the dynamic threshold model is updated, and the dynamic threshold model is retrained based on the updated user's historical bill, thereby realizing the update of the dynamic threshold model according to the preset update cycle.

[0058] As an optional embodiment, when the data to be evaluated does not meet the preset dynamic threshold, generating early warning information includes: when the data to be evaluated does not meet the preset dynamic threshold, determining the data to be evaluated as abnormal data; detecting whether each indicator to be evaluated in the bill to be evaluated has been detected by the preset risk fee model; when each indicator to be evaluated in the bill to be evaluated has been detected by the preset risk fee model, aggregating the abnormal data and generating early warning information.

[0059] In the above-mentioned embodiment of the present application, the bill to be evaluated includes multiple data to be evaluated, and each data to be evaluated will be compared with the corresponding preset dynamic threshold. For example, the data to be evaluated corresponding to the same indicator to be evaluated will be compared with the preset dynamic threshold. After all the multiple data to be evaluated in the bill to be evaluated are compared, the comparison result can be obtained to indicate that the data to be evaluated is abnormal. Then, the abnormal data in the bill to be evaluated can be summarized, and early warning information can be generated to achieve risk prevention and control.

[0060] The present invention also provides a preferred embodiment, which provides a method for realizing system early warning and interception based on dynamic thresholds, by constructing an indicator trend prediction and threshold generation model, and developing a risk prevention and control dynamic threshold component based on the model, so as to simplify the threshold setting, improve the accuracy, and reduce the situation of "too many, wrong, too few, missed, and late" alarms, while providing the basic capability of system status prediction to support the construction of IT operation and maintenance self-intelligence.

[0061] Figure 2 is a schematic diagram of implementing a system according to an embodiment of the present invention according to a dynamic threshold warning and interception system, such as Figure 2 As shown, the system includes at least: an application layer, a server layer, a component layer and a data layer, wherein the application layer is used for risk prevention and control applications, including at least: new indicators, historical indicator optimization, threshold query, alarm, anomaly detection, operation guidance trend optimization and system anomaly prediction; the service layer includes at least: historical indicator information collection, risk prevention and control dynamic API and historical and current indicator information records; the component layer uses a risk prevention and control dynamic threshold model, including at least: a dynamic threshold algorithm based on time series, stable type, cyclic severity, regular mutation type, seasonal characteristics, holiday characteristics and confidence interval; the data layer is used to provide risk prevention and control dynamic threshold data, including at least: sub-total threshold, hourly threshold, daily threshold, operation indicator definition, indicator historical data record and other time dimension thresholds.

[0062] Figure 3 is a schematic diagram of a system integration relationship according to an embodiment of the present invention, such as Figure 3 As shown, the system at least includes:

[0063] Risk prevention and control collection module 22: It can provide functions such as data source management, collection rule management, historical metadata collection, real-time metadata collection and collection task management. Through the collection module, the data related to risk prevention and control operation events are collected and converted into structured operation indicator data, which is provided to the risk prevention and control intelligent model for use.

[0064] Risk prevention and control intelligent model (also known as dynamic threshold model) 24: It can provide data source management, dynamic threshold training, dynamic threshold reasoning, dynamic threshold generation, and dynamic threshold update capabilities. The constructed dynamic threshold model is placed in the risk prevention and control intelligent model, and the dynamic threshold algorithm model link parameters are provided externally.

[0065] Risk prevention and control alarm module 26: It can provide functions such as data source management, alarm rule management, anomaly detection management reasoning, threshold management and dynamic threshold components. After development, the risk prevention and control dynamic threshold component service is deployed in the risk prevention and control alarm module, providing API capabilities for risk prevention and control applications to call. According to the link parameters provided by the risk prevention and control intelligent model, it connects to the dynamic threshold intelligent model required by the component.

[0066] Risk prevention and control scenario application module 28: Provides functions such as risk prevention and control scenario management, risk prevention and control time management, and risk prevention and control indicator management. As a risk prevention and control data source, the risk prevention and control scenario application provides operational data to the risk prevention and control acquisition module, the risk prevention and control intelligent model, and the risk prevention and control alarm module. The operational data includes: operational scenario definition, scenario indicators, indicator attribution system, indicator value, etc.; in the risk prevention and control indicator management process, the API interface of the dynamic threshold component of the risk prevention and control alarm module is called to inject intelligence into the risk prevention and control scenario.

[0067] It should be noted that in the risk prevention and control scenario, intelligence refers to the use of advanced technologies such as artificial intelligence, big data, and cloud computing to improve the intelligence level of risk prevention and control.

[0068] Figure 4 is a schematic diagram of a dynamic threshold construction process according to an embodiment of the present invention, such as Figure 4 As shown, the steps include:

[0069] Step 1.1: The risk prevention and control intelligent model (i.e., dynamic threshold model) performs data source link parameter configuration.

[0070] Step 1.2: The risk prevention and control intelligent model transmits data source link parameters to the risk prevention and control acquisition module.

[0071] Step 1.3, the risk prevention and control acquisition module transmits data source link parameters to the risk prevention and control scenario and data (such as the risk prevention and control scenario application module).

[0072] Step 2.1, risk prevention and control scenarios and data respond to data source link parameters and collect operation history source data.

[0073] Step 2.2, risk prevention and control scenarios and data respond to data source link parameters and collect real-time source data for operations.

[0074] Step 2.3: The risk prevention and control collection module receives the historical operation source data and real-time operation source data of the risk prevention and control scenarios and data, and generates structured operation data (such as user historical bills).

[0075] In step 2.4, the risk prevention and control intelligent model uses the structured operational data generated by the risk prevention and control acquisition module to perform dynamic threshold training and reasoning configuration.

[0076] Step 3.1: The risk prevention and control intelligent model returns the time dimension threshold (i.e., the preset dynamic threshold) to the risk prevention and control scenario and data.

[0077] As an optional example, based on Figure 1 As shown, the specific implementation process of this application is as follows:

[0078] Step 1: Build a dynamic threshold model for risk prevention and control (i.e., dynamic threshold model), and generate preset dynamic thresholds based on the historical records of operating indicators as the component layer and storage layer. The algorithm is used to generate two thresholds in combination with real-time scenarios: non-time series dynamic thresholds and time series dynamic thresholds. The non-time series dynamic thresholds are sensitive to changes in factors but not to changes in time; while the time series dynamic thresholds are more biased towards scenarios that are sensitive to changes in time.

[0079] Optionally, the XGBoost algorithm is selected for the dynamic threshold of non-time series. XGBoost is an efficient gradient boosting decision tree (GBDT) framework, which is mainly used for machine learning tasks such as classification, regression and sorting.

[0080] Optionally, the objective function of XGBoost (such as the first dynamic threshold model) includes: a loss function and a regularization term, wherein the objective function is: Obj=L(y,y_pred)+Ω(f); L(y,y_pred)=loss function, such as square loss, logarithmic loss, etc.; Ω(f)=γT+1 / 2*λΣwj^2, T=number of leaf nodes, wj=weight of leaf node, γ=penalty coefficient of number of leaf nodes, λ=penalty coefficient of weight of leaf node.

[0081] In the above embodiment of the present application, XGBoost constructs an additive model by optimizing the objective function, wherein the loss function measures the gap between the model prediction and the true value, and combines the regularization term to penalize the model complexity to prevent overfitting. XGBoost uses pre-sorting and sparse matrix technology to accelerate calculations. The algorithm has the following features: efficient parallel computing, flexible cross-validation strategy, built-in missing value processing, support for custom loss functions, etc.

[0082] Optionally, the first dynamic threshold model is applicable to scenarios such as monthly rental management and monthly pre-deposit transfer, which are statistically analyzed on a monthly basis, relatively stable, sensitive to changes in factors but not sensitive to changes in time, and are non-time series characteristics, such as dynamic rental thresholds.

[0083] It should be noted that the dynamic threshold of rental fees is relatively stable based on monthly statistics. It is sensitive to changes in factors but not to changes in time. It is a non-time series characteristic, so the XGBoost algorithm is used.

[0084] Table 1 is a schematic diagram of factors affecting the rental result determined according to a rental calculation rule according to an embodiment of the present invention. As shown in Table 1, multiple factors affecting the rental result are represented.

[0085] Table 1

[0086]

[0087]

[0088] Table 2 is a schematic table of determining influencing factors affecting a threshold according to a user level rule according to an embodiment of the present invention. As shown in Table 2, multiple influencing factors are represented.

[0089] Table 2

[0090] Impact Type Influencing factors illustrate Common Factor Time online Common Factor Number of complaints by month Common Factor Frequency of package changes Common Factor Is it a contract user? Common Factor Red List Common Factor Free Common Factor Government and Enterprise

[0091] It should be noted that the construction of the preset dynamic threshold does not recalculate the rental fee based on the provided influencing factors, but constructs an impact model (such as the first dynamic threshold model) based on the above factors, and then realizes the possible difference in cost range relative to the previous month according to business needs. That is, the threshold range is expressed as: [last month's rental fee + lower limit change, last month's rental fee + upper limit change].

[0092] Table 3 is a schematic table of feature conversion of influencing factors according to an embodiment of the present invention. As shown in Table 3, based on the influence of rental fees and user levels, the influencing factors can be converted into features, discrete features, numerical features, and label features.

[0093] Table 3

[0094]

[0095] As a result, the TFT (Temporal Fusion Transformers) algorithm is used for time series dynamic thresholds. TFT is a model that combines recurrent neural networks (RNNs) and attention mechanisms to handle multivariate time series prediction problems. TFT uses attention mechanisms to capture complex interactions between variables and uses external information (such as temporal features) to enhance prediction capabilities.

[0096] Optionally, the TFT model includes multiple components, among which the attention mechanism is the core part, and the self-attention function is: Attention(Q,K,V)=softmax((QK^T) / √dk)*V, where Q, K, V are query, key and value matrices obtained by linear transformation of the input data, and dk is the dimension of the key.

[0097] Optionally, the TFT algorithm has the ability to capture the relationship between variables using the attention mechanism and integrate external information (such as time coding, static features). It is suitable for scenarios such as real-time signal control shutdown and restart, where factors will change in real time within a short period of time and are sensitive to time factors.

[0098] Table 4 is a schematic diagram of feature conversion of influencing factors according to an embodiment of the present invention. As shown in Table 4, time series indicators are constructed with indicator information, indicator source, indicator generation time, and indicator dimension. A structure that conforms to the communication billing IT support system is constructed based on this information. k1 and k2 are business indicator values.

[0099] Table 4

[0100]

[0101]

[0102] Step 2. Build and encapsulate risk prevention and control operational indicator collection and threshold request services: collect operational indicators and record historical data, obtain dynamic thresholds of indicators based on current operational indicator data access, and encapsulate them into indicator collection and threshold access API interfaces to form a service layer.

[0103] Step 3: Embed the dynamic threshold of risk prevention and control into the alarm, anomaly detection, indicator trend visualization, and system anomaly prediction process: Modify the threshold acquisition method, embed the dynamic threshold component of risk prevention and control, replace the fixed threshold with the preset dynamic threshold, and add the upper limit, lower limit, and predicted value. The following is a simple sample display:

[0104] Optionally, a sample request for threshold replacement is:

[0105]

[0106] Optionally, a sample response for a successful threshold replacement is:

[0107]

[0108]

[0109] Optionally, a sample response for a failed threshold replacement request is:

[0110]

[0111] Step 4: The new data is called through the API interface to filter and separate the users who exceed the set dynamic threshold, and analyze whether the data is abnormal and needs to be corrected.

[0112] Figure 5 is a schematic diagram of a method for realizing system early warning and interception according to a dynamic threshold value according to an embodiment of the present invention, such as Figure 5 As shown, the specific implementation process is as follows:

[0113] Step 51: Extract the user's monthly bill data for the past year (such as the user's historical bill), compile the indicator data into statistics at the minute level, hour level, day level, and other dimensions, and enhance the attributes such as month, day, week, holiday, and quarter.

[0114] Step 52: Perform model training and adjust parameters by using the selected XGBOOST (such as the first dynamic threshold model) and TFT (such as the second dynamic threshold model) algorithms. When the user information changes, the model prediction may deviate from the actual situation, which will trigger a synchronous update of the model.

[0115] Step 53: Encapsulate the results derived from the algorithm into indicator collection and threshold access API interfaces to form a service layer.

[0116] Step 54: Call the encapsulated API interface with the real-time data of the billing month to predict the upper and lower limits of the user's rental fee and gift fee (such as preset dynamic thresholds).

[0117] Step 55: When the predicted value exceeds the upper and lower limits of the model (such as the predicted value exceeds the preset dynamic threshold), the application will perform interception and screening and send it to the corresponding management personnel for verification and approval.

[0118] Step 56: After approval and verification by the administrator, the next step (allow / pass) is triggered based on the review opinion.

[0119] The above-mentioned embodiments of the present application formulate personalized fee interception thresholds according to each user's historical consumption behavior, credit record and specific needs; by implementing a real-time monitoring system, it is possible to instantly analyze risks during the rental fee calculation process and respond quickly to achieve real-time risk control during the process; establish a flexible architecture that can automatically adjust thresholds based on factors such as market changes, business demand adjustments and the launch of new packages, thereby ensuring that the interception rules are always consistent with the current business environment and user needs, improving the adaptability and accuracy of the system, reducing the risks of missed alarms and alarm storms, and being more efficient; and the intelligent threshold configuration makes the overall fluency of the system higher, and risk prevention and control can be achieved in advance, avoiding system problems from affecting customer use, and improving customer perception.

[0120] The above-mentioned embodiments of the present application can reduce costs and increase efficiency, improve the accuracy of system warnings, and effectively improve customer perception and enterprise service levels, which are mainly manifested in:

[0121] 1) Reduce costs and increase efficiency, reduce the number of professional operation and maintenance personnel by one third, and save more than 3 million yuan.

[0122] 2) The system failure rate dropped by 60%, which improved customer perception and increased the monthly customer satisfaction rate by 30%.

[0123] 3) System-related complaints have been reduced by more than 60 percent, from an average of 25 complaints per month to the current average of 3.

[0124] 4) Reduce the error rate of front desk operations by more than 80%, especially in the scenarios of wrong charging, wrong payment, and wrong shutdown.

[0125] The present application provides a method for realizing system warning and interception based on dynamic thresholds, and tests personalized risk prevention and control dynamic thresholds by calculating the model of each customer's behavior habits, payment ability, and monthly bill costs. Compared with the fixed thresholds in the old mode, the present application has high flexibility, and formulates personalized fee interception warning thresholds according to each user's historical consumption behavior, credit record and specific needs; combined with the non-time series XGBOOST algorithm and the time series TFT algorithm, through the continuous deduction and training of massive data, the risk prevention and control dynamic threshold component with the optimal error rate is obtained, and the accuracy of the warning interception threshold given in the end is improved; by establishing a flexible architecture, the threshold can be automatically adjusted according to market changes, business demand adjustments, and the launch of new packages. This ensures that the interception rules are always consistent with the current business environment and user needs, improves the adaptability and accuracy of the system, reduces the risk of missed alarms and alarm storms, and is more efficient; through the indicator threshold and indicator trend prediction capabilities provided by the risk prevention and control dynamic threshold component, the risk prevention and control indicator threshold is automatically generated, and different thresholds for different time periods are generated according to the time dimension, which improves the threshold accuracy and reduces the workload of personnel; indicator trend prediction, predicting different time dimensions, the indicator status for a period of time in the future, provides basic data for system status trend analysis.

[0126] The above-mentioned embodiments of the present application automatically generate risk prevention and control indicator thresholds through the indicator thresholds and indicator trend prediction capabilities provided by the risk prevention and control dynamic threshold component, generate different thresholds for different time periods according to the time dimension, improve threshold accuracy, and reduce personnel workload; indicator trend prediction predicts the indicator status for different time dimensions and a period of time in the future, providing basic data for system status trend analysis.

[0127] According to an embodiment of the present invention, an embodiment of a device for determining a dynamic threshold is also provided. It should be noted that the device for determining a dynamic threshold can be used to execute the method for determining a dynamic threshold in an embodiment of the present invention, and the method for determining a dynamic threshold in an embodiment of the present invention can be executed in the device for determining a dynamic threshold.

[0128] Figure 6 is a schematic diagram of a device for determining a dynamic threshold according to an embodiment of the present invention. Figure 6 As shown, the device may include: an acquisition module 62, used to acquire user historical bills, wherein the user historical bills include: multiple indicator data for bill evaluation, and the indicator data are divided into at least: first indicator data for evaluating non-time series indicators, and second indicator data for evaluating time series indicators, the non-time series indicators are insensitive to time changes, and the time series indicators are sensitive to time changes; a first analysis module 64, used to use a first dynamic threshold model to analyze the first indicator data to obtain a non-time series dynamic threshold corresponding to the non-time series indicator, wherein the first dynamic threshold model is an extreme gradient boosting model, and the extreme gradient boosting model uses a gradient boosting decision tree as a model framework; a second analysis module 66, used to use a second dynamic threshold model to analyze the second indicator data to obtain a time series dynamic threshold corresponding to the time series indicator, wherein the second dynamic threshold model is an attention-based deep neural network model.

[0129] It should be noted that the acquisition module 62 in this embodiment can be used to execute step S102 in the embodiment of the present application, the first analysis module 64 in this embodiment can be used to execute step S106 in the embodiment of the present application, and the second analysis module 66 in this embodiment can be used to execute step S108 in the embodiment of the present application. The examples and application scenarios implemented by the above modules and corresponding steps are the same, but are not limited to the contents disclosed in the above embodiments.

[0130] In an embodiment of the present invention, a dynamic threshold model is used to analyze indicator data in a user's historical bill, thereby achieving the purpose of automatically determining a dynamic threshold. In the case of setting a dynamic threshold, the indicator data in the user's historical bill can be divided into first indicator data of non-time series indicators that are insensitive to time changes, and second indicator data of time series indicators that are sensitive to time changes. The first dynamic threshold model is used to generate a non-time series dynamic threshold based on the first indicator data, and the second dynamic threshold model is used to generate a time series dynamic threshold based on the second indicator. On the basis of automatically generating a dynamic threshold, the generated dynamic threshold can be made more accurate, thereby achieving the technical effect of improving the configuration efficiency of the dynamic threshold, thereby solving the technical problem that the existing technology uses manual threshold configuration and has low threshold configuration efficiency.

[0131] As an optional embodiment, the device also includes: a first detection submodule, used to detect whether the update time since the last update of the dynamic threshold model reaches a preset update period, wherein the dynamic threshold model includes: a first dynamic threshold model and a second dynamic threshold model; a first update submodule, used to update the user's historical bill when the last update time of the dynamic threshold model reaches a preset update period, wherein the time span of the user's historical bill is greater than the preset update period.

[0132] As an optional embodiment, the device also includes: a first acquisition submodule, used to obtain the bills to be evaluated within the period to be evaluated, wherein the time span of the bills to be evaluated is smaller than the time span of the user's historical bills, and the bills to be evaluated include: data to be evaluated corresponding to multiple preset indicators, and the preset indicators include at least: non-time series indicators and time series indicators; a second detection submodule, used to use the preset dynamic threshold in the preset risk fee model to detect the data to be evaluated corresponding to each preset indicator in the bill to be evaluated, wherein the preset dynamic threshold includes at least: non-time series dynamic threshold and time series dynamic threshold; a generation submodule, used to generate warning information when the data to be evaluated does not meet the preset dynamic threshold.

[0133] As an optional embodiment, the device also includes: a second acquisition sub-module, used to obtain multiple bills to be predicted that are earlier than the time period to be evaluated before obtaining the bills to be evaluated within the time period to be evaluated, wherein each bill to be predicted has the same time span as the bill to be evaluated; a first analysis sub-module, used to use a preset evaluation prediction model to analyze multiple bills to be predicted to obtain a predicted bill for the time period to be evaluated, wherein the preset evaluation prediction model is a machine learning model pre-trained using multiple sample bills with the same time span, and the predicted bill includes at least: a predicted value corresponding to each preset indicator; a determination sub-module, used to determine the predicted value in the predicted bill as the data to be evaluated, and obtain the bill to be evaluated.

[0134] As an optional embodiment, the device also includes: a second updating sub-module, which is used to update the preset dynamic threshold in the preset risk fee model using the non-time series dynamic threshold obtained by the first dynamic threshold model and the time series dynamic threshold obtained by the second dynamic threshold model before using the preset risk fee model to detect whether the predicted value corresponding to the same preset indicator matches the preset dynamic threshold.

[0135] As an optional embodiment, after obtaining the bill to be evaluated within the period to be evaluated, the device also includes: a third detection submodule, used to detect whether the influencing factors in the bill to be evaluated and the user's historical bill have changed, wherein the influencing factors are descriptive items of the indicator data, and non-time series indicators are sensitive to changes in factors; a third update submodule, used to update the user's historical bill when the influencing factors in the bill to be evaluated and the user's historical bill have changed.

[0136] As an optional embodiment, the generation module includes: a determination unit, used to determine the data to be evaluated as abnormal data when the data to be evaluated does not meet the preset dynamic threshold; a detection unit, used to detect whether each indicator to be evaluated in the bill to be evaluated has been detected by the preset risk fee model; a generation unit, used to summarize the abnormal data and generate early warning information when each indicator to be evaluated in the bill to be evaluated has been detected by the preset risk fee model.

[0137] An embodiment of the present invention may provide an electronic device, which may be a computer terminal, and the computer terminal may be any computer terminal device in a computer terminal group. Optionally, in this embodiment, the computer terminal may also be replaced by a terminal device such as a mobile terminal.

[0138] Optionally, in this embodiment, the computer terminal may be located in at least one network device among a plurality of network devices of the computer network.

[0139] In this embodiment, the above-mentioned computer terminal can execute the program code of the following steps in the method for determining the dynamic threshold: obtaining the user's historical bills, wherein the user's historical bills include: multiple indicator data for bill evaluation, and the indicator data are at least divided into: first indicator data for evaluating non-time series indicators, and second indicator data for evaluating time series indicators, the non-time series indicators are insensitive to time changes, and the time series indicators are sensitive to time changes; using the first dynamic threshold model to analyze the first indicator data to obtain a non-time series dynamic threshold corresponding to the non-time series indicator, wherein the first dynamic threshold model is an extreme gradient boosting model, and the extreme gradient boosting model uses a gradient boosting decision tree as a model framework; using the second dynamic threshold model to analyze the second indicator data to obtain a time series dynamic threshold corresponding to the time series indicator, wherein the second dynamic threshold model is an attention-based deep neural network model.

[0140] Figure 7 is a structural block diagram of a computer terminal according to an embodiment of the present invention. Figure 7 As shown, the computer terminal 70 may include: one or more (only one is shown in the figure) processors 72 and a memory 74 .

[0141] Among them, the memory can be used to store software programs and modules, such as the program instructions / modules corresponding to the method and device for determining the dynamic threshold in the embodiment of the present invention. The processor executes various functional applications and data processing by running the software programs and modules stored in the memory, that is, the above-mentioned method for determining the dynamic threshold is realized. The memory may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some examples, the memory may further include a memory remotely arranged relative to the processor, and these remote memories can be connected to the terminal 60 via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0142] The processor can call the information and application programs stored in the memory through the transmission device to perform the following steps: obtain the user's historical bills, wherein the user's historical bills include: multiple indicator data for bill evaluation, and the indicator data are divided into at least: first indicator data for evaluating non-time series indicators, and second indicator data for evaluating time series indicators, the non-time series indicators are insensitive to time changes, and the time series indicators are sensitive to time changes; use the first dynamic threshold model to analyze the first indicator data to obtain the non-time series dynamic threshold corresponding to the non-time series indicator, wherein the first dynamic threshold model is an extreme gradient boosting model, and the extreme gradient boosting model uses the gradient boosting decision tree as the model framework; use the second dynamic threshold model to analyze the second indicator data to obtain the time series dynamic threshold corresponding to the time series indicator, wherein the second dynamic threshold model is an attention-based deep neural network model.

[0143] Optionally, the processor may also execute the program code of the following steps: detecting whether the update time since the last update of the dynamic threshold model reaches a preset update period, wherein the dynamic threshold model includes: a first dynamic threshold model and a second dynamic threshold model; when the last update time of the dynamic threshold model reaches a preset update period, updating the user's historical bill, wherein the time span of the user's historical bill is greater than the preset update period.

[0144] Optionally, the processor may also execute the program code of the following steps: obtaining the bill to be evaluated within the period to be evaluated, wherein the time span of the bill to be evaluated is smaller than the time span of the user's historical bills, and the bill to be evaluated includes: data to be evaluated corresponding to multiple preset indicators, and the preset indicators include at least: non-time series indicators and time series indicators; using the preset dynamic threshold in the preset risk fee model to detect the data to be evaluated corresponding to each preset indicator in the bill to be evaluated, wherein the preset dynamic threshold includes at least: non-time series dynamic threshold and time series dynamic threshold; generating warning information when the data to be evaluated does not meet the preset dynamic threshold.

[0145] Optionally, the processor may also execute the program code of the following steps: obtaining multiple bills to be predicted that are earlier than the time period to be evaluated, wherein each bill to be predicted has the same time span as the bill to be evaluated; using a preset evaluation prediction model to analyze the multiple bills to be predicted to obtain a predicted bill for the time period to be evaluated, wherein the preset evaluation prediction model is a machine learning model pre-trained using multiple sample bills with the same time span, and the predicted bill includes at least: a predicted value corresponding to each preset indicator; determining the predicted value in the predicted bill as the data to be evaluated to obtain the bill to be evaluated.

[0146] Optionally, the processor may also execute the program code of the following steps: updating the preset dynamic threshold in the preset risk fee model using the non-time series dynamic threshold obtained by the first dynamic threshold model and the time series dynamic threshold obtained by the second dynamic threshold model.

[0147] Optionally, the processor may also execute the program code of the following steps: detecting whether the influencing factors in the bill to be evaluated and the user's historical bill have changed, wherein the influencing factors are descriptive items of the indicator data, and non-time series indicators are sensitive to changes in factors; if the influencing factors in the bill to be evaluated and the user's historical bill have changed, updating the user's historical bill.

[0148] Optionally, the processor may also execute the program code of the following steps: when the data to be evaluated does not meet the preset dynamic threshold, determining the data to be evaluated as abnormal data; detecting whether each indicator to be evaluated in the bill to be evaluated has been detected by the preset risk fee model; when each indicator to be evaluated in the bill to be evaluated has been detected by the preset risk fee model, aggregating the abnormal data and generating early warning information.

[0149] It can be understood by those skilled in the art that Figure 7The structure shown is for illustration only, and the computer terminal may also be a smart phone (such as an Android phone, an iOS phone, etc.), a tablet computer, a handheld computer, a mobile Internet device (Mobile Internet Devices, MID), a PAD, or other terminal devices. Figure 7 The structure of the electronic device is not limited. For example, the computer terminal 70 may also include Figure 7 More or fewer components (such as network interfaces, display devices, etc.) shown in, or having Figure 7 Different configurations shown.

[0150] A person of ordinary skill in the art can understand that all or part of the steps in the various methods of the above embodiments can be completed by instructing the hardware related to the terminal device through a computer program. The computer program can be stored in a non-volatile medium. The non-volatile storage medium may include: a flash drive, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, etc.

[0151] The embodiment of the present invention further provides a non-volatile storage medium. Optionally, in this embodiment, the non-volatile storage medium can be used to store the program code executed by the dynamic threshold determination method provided in the above embodiment.

[0152] Optionally, in this embodiment, the non-volatile storage medium may be located in any computer terminal in a computer terminal group in a computer network, or in any mobile terminal in a mobile terminal group.

[0153] Optionally, in this embodiment, the non-volatile storage medium is configured to store program code for executing the following steps: obtaining a user's historical bills, wherein the user's historical bills include: a plurality of indicator data for bill evaluation, the indicator data being divided into at least: first indicator data for evaluating non-time series indicators, and second indicator data for evaluating time series indicators, the non-time series indicators being insensitive to time changes, and the time series indicators being sensitive to time changes; using a first dynamic threshold model to analyze the first indicator data to obtain a non-time series dynamic threshold corresponding to the non-time series indicator, wherein the first dynamic threshold model is an extreme gradient boosting model, and the extreme gradient boosting model uses a gradient boosting decision tree as a model framework; using a second dynamic threshold model to analyze the second indicator data to obtain a time series dynamic threshold corresponding to the time series indicator, wherein the second dynamic threshold model is an attention-based deep neural network model.

[0154] Optionally, in this embodiment, the non-volatile storage medium is configured to store program code for performing the following steps: detecting whether the update time since the last update of the dynamic threshold model reaches a preset update period, wherein the dynamic threshold model includes: a first dynamic threshold model and a second dynamic threshold model; when the last update time of the dynamic threshold model reaches a preset update period, updating the user's historical bill, wherein the time span of the user's historical bill is greater than the preset update period.

[0155] Optionally, in this embodiment, the non-volatile storage medium is configured to store program codes for executing the following steps: obtaining a bill to be evaluated within a period to be evaluated, wherein the time span of the bill to be evaluated is shorter than the time span of the user's historical bills, and the bill to be evaluated includes: data to be evaluated corresponding to a plurality of preset indicators, and the preset indicators at least include: a non-time series indicator and a time series indicator;

[0156] Use the preset dynamic threshold in the preset risk fee model to detect the data to be evaluated corresponding to each preset indicator in the bill to be evaluated, where the preset dynamic threshold includes at least: a non-time series dynamic threshold and a time series dynamic threshold; if the data to be evaluated does not meet the preset dynamic threshold, generate a warning message.

[0157] Optionally, in this embodiment, the non-volatile storage medium is configured to store program code for executing the following steps: obtaining multiple bills to be predicted that are earlier than the time period to be evaluated, wherein each bill to be predicted has the same time span as the bill to be evaluated; using a preset evaluation prediction model to analyze the multiple bills to be predicted to obtain a predicted bill for the time period to be evaluated, wherein the preset evaluation prediction model is a machine learning model pre-trained using multiple sample bills with the same time span, and the predicted bill includes at least: a predicted value corresponding to each preset indicator; determining the predicted value in the predicted bill as the data to be evaluated, and obtaining the bill to be evaluated.

[0158] Optionally, in this embodiment, the non-volatile storage medium is configured to store program code for performing the following steps: updating a preset dynamic threshold in a preset risk fee model using a non-time series dynamic threshold obtained using a first dynamic threshold model and a time series dynamic threshold obtained using a second dynamic threshold model.

[0159] Optionally, in this embodiment, the non-volatile storage medium is configured to store program code for executing the following steps: detecting whether the influencing factors in the bill to be evaluated and the user's historical bill have changed, wherein the influencing factors are descriptive items of the indicator data, and non-time series indicators are sensitive to changes in factors; if the influencing factors in the bill to be evaluated and the user's historical bill have changed, updating the user's historical bill.

[0160] Optionally, in this embodiment, the non-volatile storage medium is configured to store program codes for executing the following steps: when the data to be evaluated does not meet a preset dynamic threshold, determining the data to be evaluated as abnormal data; detecting whether each indicator to be evaluated in the bill to be evaluated has been detected by a preset risk fee model; when each indicator to be evaluated in the bill to be evaluated has been detected by a preset risk fee model, aggregating the abnormal data and generating early warning information.

[0161] The embodiment of the present invention further provides a computer program product, including a computer program. Optionally, in this embodiment, when the computer program is executed by a processor, the steps of the method for determining the dynamic threshold provided in the above embodiment are implemented.

[0162] The serial numbers of the above embodiments of the present invention are only for description and do not represent the advantages or disadvantages of the embodiments.

[0163] In the above embodiments of the present invention, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0164] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only schematic. For example, the division of the units can be a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0165] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple units. Some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0166] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0167] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a non-volatile storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product. The computer software product is stored in a non-volatile storage medium, including several instructions for a computer device (which can be a personal computer, server or network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned non-volatile storage medium includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, magnetic disk or optical disk and other media that can store program codes.

[0168] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principle of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A method for determining a dynamic threshold, characterized in that: include: Obtaining a user's historical bill, wherein the user's historical bill includes: a plurality of indicator data for bill evaluation, the indicator data being at least divided into: first indicator data for evaluating a non-time series indicator, and second indicator data for evaluating a time series indicator, the non-time series indicator being insensitive to time changes, and the time series indicator being sensitive to time changes; Analyze the first indicator data using a first dynamic threshold model to obtain a non-time series dynamic threshold corresponding to the non-time series indicator, wherein the first dynamic threshold model is an extreme gradient boosting model, and the extreme gradient boosting model uses a gradient boosting decision tree as a model framework; The second indicator data is analyzed using a second dynamic threshold model to obtain a time series dynamic threshold corresponding to the time series indicator, wherein the second dynamic threshold model is an attention-based deep neural network model.

2. The method according to claim 1, characterized in that The method further comprises: Detect whether the update duration of the last update of the distance dynamic threshold model reaches a preset update period, wherein the dynamic threshold model includes: the first dynamic threshold model and the second dynamic threshold model; When the last update time of the dynamic threshold model reaches the preset update period, the user history bill is updated, wherein the time span of the user history bill is greater than the preset update period.

3. The method according to claim 1, characterized in that The method further comprises: Obtaining a bill to be evaluated within a period to be evaluated, wherein the time span of the bill to be evaluated is shorter than the time span of the user's historical bills, and the bill to be evaluated includes: data to be evaluated corresponding to a plurality of preset indicators, and the preset indicators include at least: the non-time series indicator and the time series indicator; Using the preset dynamic threshold in the preset risk fee model, detecting the data to be evaluated corresponding to each preset indicator in the bill to be evaluated, wherein the preset dynamic threshold at least includes: the non-time series dynamic threshold and the time series dynamic threshold; When the data to be evaluated does not meet the preset dynamic threshold, a warning message is generated.

4. The method according to claim 3, characterized in that Before obtaining the bills to be evaluated within the period to be evaluated, the method further includes: Acquire multiple bills to be predicted that are earlier than the time period to be evaluated, wherein each of the bills to be predicted has the same time span as the bill to be evaluated; Analyze the multiple bills to be predicted using a preset evaluation prediction model to obtain a predicted bill for the time period to be evaluated, wherein the preset evaluation prediction model is a machine learning model pre-trained using multiple sample bills with the same time span, and the predicted bill includes at least: a predicted value corresponding to each preset indicator; The predicted value in the predicted bill is determined as the data to be evaluated, to obtain the bill to be evaluated.

5. The method according to claim 3, characterized in that: Before using the preset risk fee model to detect whether the predicted value corresponding to the same preset indicator matches the preset dynamic threshold, the method further includes: The preset dynamic threshold in the preset risk fee model is updated using the non-time series dynamic threshold obtained by the first dynamic threshold model and the time series dynamic threshold obtained by the second dynamic threshold model.

6. The method according to claim 3, characterized in that After obtaining the bills to be evaluated within the period to be evaluated, the method further includes: Detect whether the influencing factors in the bill to be evaluated and the historical bill of the user have changed, wherein the influencing factors are description items of the indicator data, and the non-time series indicator is sensitive to changes in the factors; When the influencing factors between the bill to be evaluated and the historical bill of the user change, the historical bill of the user is updated.

7. The method according to claim 3, characterized in that When the data to be evaluated does not meet the preset dynamic threshold, generating warning information includes: When the data to be evaluated does not meet the preset dynamic threshold, determining the data to be evaluated as abnormal data; Detecting whether each of the indicators to be evaluated in the bill to be evaluated has been detected by the preset risk fee model; When each of the indicators to be evaluated in the bill to be evaluated has been detected by the preset risk fee model, the abnormal data is summarized to generate the early warning information.

8. A device for determining a dynamic threshold, characterized in that: include: An acquisition module, used for acquiring a user's historical bill, wherein the user's historical bill includes: a plurality of indicator data for bill evaluation, wherein the indicator data is at least divided into: first indicator data for evaluating a non-time series indicator, and second indicator data for evaluating a time series indicator, wherein the non-time series indicator is insensitive to time changes, and the time series indicator is sensitive to time changes; A first analysis module is used to analyze the first indicator data using a first dynamic threshold model to obtain a non-time series dynamic threshold corresponding to the non-time series indicator, wherein the first dynamic threshold model is an extreme gradient boosting model, and the extreme gradient boosting model uses a gradient boosting decision tree as a model framework; The second analysis module is used to analyze the second indicator data using a second dynamic threshold model to obtain a time series dynamic threshold corresponding to the time series indicator, wherein the second dynamic threshold model is an attention-based deep neural network model.

9. An electronic device, comprising a memory and a processor, characterized in that: A computer program is stored in the memory, and the processor is configured to execute the method for determining the dynamic threshold value according to any one of claims 1 to 7 through the computer program.

10. A computer program product comprising computer instructions, characterized in that: When the computer instructions are executed by a processor, the steps of the method for determining a dynamic threshold value described in any one of claims 1 to 7 are implemented.

Images