Abnormal data alarm method, device, equipment, storage medium and program product

Abstract

The embodiment of the application provides an abnormal data alarm method, device, equipment, storage medium and program product, and relates to the field of cloud computing. The method comprises the following steps: acquiring historical transmission information of service data of a target service scenario, and constructing a target model according to historical data carried in the historical transmission information, wherein the target model is obtained through machine learning of multiple groups of sample data, each group of data in the multiple groups of sample data comprises historical data, a data state of the historical data and a change probability of the data state; real-time monitoring of data transmission information corresponding to the target service scenario is performed, the data transmission information is input into the target model, and an abnormal probability value of the data transmission information is obtained; in the case that the abnormal probability value is greater than a preset value, it is determined that the data transmission information is abnormal data, and abnormal data alarm is initiated. The method of the application achieves the effect of timely detecting network data abnormalities and alarming.

Description

Technical Field

[0001] This application relates to the field of cloud computing, and in particular to an abnormal data alarm method, apparatus, device, storage medium, and program product. Background Technology

[0002] Digital transformation has become a major trend in economic development, with various industries exploring and developing their own suitable digital paths. However, online financial applications have also raised new issues, such as heavy reliance on network conditions. When the network is good, financial applications can receive and forward data packets normally; when the network is poor, they may not receive complete data packets. Even with timeout retransmission mechanisms, there is no guarantee that the data packets will be transmitted completely the next time, and retransmission time is wasted. Based on the above analysis, fault detection for data packet loss in the network is of great significance for financial information security, financial data transmission, and financial digitization.

[0003] In summary, there is an urgent need for a method to detect and alert on network data anomalies in a timely manner. Summary of the Invention

[0004] This application provides an abnormal data alarm method, apparatus, device, storage medium, and program product to solve the current technical problem of lacking a method for timely detecting and alarming abnormalities in network data.

[0005] Firstly, this application provides an abnormal data alarm method, comprising: acquiring historical transmission information of business data in a target business scenario; constructing a target model based on the historical data carried in the historical transmission information, wherein the target model is obtained through machine learning of multiple sets of sample data, each set of sample data including: historical data, the data state of the historical data, and the probability of change of the data state; monitoring the data transmission information corresponding to the target business scenario in real time, inputting the data transmission information into the target model to obtain an abnormal probability value of the data transmission information; and determining that the data transmission information is abnormal data and initiating an abnormal data alarm when the abnormal probability value is greater than a preset value.

[0006] Secondly, this application provides an abnormal data alarm device, comprising: an acquisition module, configured to acquire historical transmission information of business data in a target business scenario, and construct a target model based on the historical data carried in the historical transmission information, wherein the target model is obtained through machine learning of multiple sets of sample data, each set of sample data including: historical data, the data state of the historical data, and the probability of change of the data state; a monitoring module, configured to monitor the data transmission information corresponding to the target business scenario in real time, input the data transmission information into the target model, and obtain an abnormal probability value of the data transmission information; and an alarm module, configured to determine that the data transmission information is abnormal data and initiate an abnormal data alarm when the abnormal probability value is greater than a preset value.

[0007] Thirdly, this application provides an electronic device, including: a memory and a processor;

[0008] The memory stores computer-executed instructions;

[0009] The processor executes computer execution instructions stored in the memory, causing the processor to perform the first aspect and / or various possible implementations of the first aspect as described above.

[0010] Fourthly, embodiments of this application provide a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, are used to implement the first aspect and / or various possible implementations of the first aspect.

[0011] Fifthly, embodiments of this application provide a computer program product, including a computer program that, when executed by a processor, implements the first aspect and / or various possible implementations of the first aspect.

[0012] The abnormal data alarm method, apparatus, device, storage medium, and program product provided in this application acquire historical transmission information of business data in a target business scenario, construct a target model based on the historical data carried in the historical transmission information, wherein the target model is obtained through machine learning of multiple sets of sample data, each set of sample data including: historical data, the data state of the historical data, and the probability of change of the data state; real-time monitoring of data transmission information corresponding to the target business scenario, inputting the data transmission information into the target model to obtain an abnormal probability value of the data transmission information; when the abnormal probability value is greater than a preset value, determining that the data transmission information is abnormal data, initiating an abnormal data alarm, thereby achieving the effect of timely detection and alarm of network data anomalies. Attached Figure Description

[0013] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0014] Figure 1 This is a schematic diagram illustrating the application scenario of the abnormal data alarm method;

[0015] Figure 2 A schematic diagram of the abnormal data alarm method provided in this application;

[0016] Figure 3 A schematic diagram of the abnormal data alarm device provided in this application;

[0017] Figure 4 A schematic diagram of the structure of the device for determining the abnormal data processing scheme provided in this application.

[0018] The accompanying drawings illustrate specific embodiments of this application, which will be described in more detail below. These drawings and descriptions are not intended to limit the scope of the concept in any way, but rather to illustrate the concept of this application to those skilled in the art through reference to particular embodiments. Detailed Implementation

[0019] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numbers in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this application. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this application as detailed in the appended claims.

[0020] It should be noted that the abnormal data alarm method, device, equipment, storage medium and product provided in this application can be used in the field of cloud computing, or in any field other than cloud computing. The application field of the abnormal data alarm method, device, equipment, storage medium and program product in this application is not limited.

[0021] The specific application scenario for this application is in the daily business of banks, where users initiate requests through online financial applications. Figure 1This diagram illustrates an application scenario for anomaly data alerting methods. Early banks relied on manual bookkeeping, resulting in low efficiency for withdrawals and deposits. However, with the development of the digital economy, a series of online financial applications have emerged, replacing some manual operations and significantly improving efficiency. However, online financial applications have also introduced new problems, such as heavy dependence on network conditions. When the network is good, financial applications can receive and forward data packets normally; when the network is poor, they may not receive complete data packets. Even with timeout retransmission mechanisms, there is no guarantee that the data packets will be transmitted completely the next time, and retransmission time is wasted.

[0022] like Figure 1 As shown, when a user initiates a request through the client, such as a transaction request, query request, or deposit / retrieval request, if the internet environment is poor, the user's request may not be completely forwarded to the server (bank system server). Alternatively, the server's response data to the user's request may not be completely sent to the client. Sending data to the user only after data corruption has occurred will severely impact the user experience.

[0023] The abnormal data alarm method provided in this application aims to solve the above-mentioned technical problems of the prior art.

[0024] The technical solution of this application and how the technical solution of this application solves the above-mentioned technical problems are described in detail below with specific embodiments. These specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments. The embodiments of this application will now be described with reference to the accompanying drawings.

[0025] Figure 2 This is a flowchart illustrating the abnormal data alarm method provided in this application, such as... Figure 2 As shown, the method includes:

[0026] S201: Obtain historical transmission information of business data in the target business scenario, and construct a target model based on the historical data carried in the historical transmission information. The target model is obtained by machine learning of multiple sets of sample data. Each set of sample data includes: historical data, the data state of the historical data, and the probability of change of the data state.

[0027] First, it's necessary to collect historical data transmission information for the target business scenario. This data may include various types of business data, such as user behavior logs. Useful features are then extracted from the historical data. These features can include the data values ​​themselves, timestamps, data status (e.g., normal or abnormal), and any other relevant contextual information.

[0028] A Markov transition model is trained using machine learning algorithms. This model learns the probability of data transitioning from one state to another. Specifically, the Markov transition model assumes that the current state depends only on the previous state and is independent of earlier states.

[0029] S202: Monitor the data transmission information corresponding to the target business scenario in real time, input the data transmission information into the target model, and obtain the abnormal probability value of the data transmission information;

[0030] During system operation, data transmission information is monitored in real time. This can be achieved by setting triggers or using a stream processing framework. The real-time captured data transmission information is then input into a pre-trained Markov transition model. The model calculates an anomaly probability value based on the current data and historical states.

[0031] S203: If the abnormal probability value is greater than the preset value, determine that the data transmission information is abnormal data and initiate an abnormal data alarm.

[0032] Automated anomaly detection and alarm processes reduce the need for manual intervention and improve processing efficiency. By monitoring data transmission in real time and predicting anomaly probability values ​​based on the monitoring results, alarms are triggered before abnormal data is sent to users, allowing administrators to be aware of and address anomalies immediately, thus enhancing the user experience.

[0033] The above method involves acquiring historical transmission information of business data from the target business scenario, constructing a target model based on the historical data carried in the historical transmission information, wherein the target model is obtained through machine learning of multiple sets of sample data, each set of sample data including: historical data, the data state of the historical data, and the probability of change of the data state; real-time monitoring of data transmission information corresponding to the target business scenario, inputting the data transmission information into the target model to obtain an anomaly probability value of the data transmission information; if the anomaly probability value is greater than a preset value, determining that the data transmission information is abnormal data, initiating an anomaly data alarm, thereby achieving the effect of timely detection and alarm of network data anomalies.

[0034] A threshold for the probability of anomalies is pre-defined. If the anomaly probability value output by the model exceeds this threshold, the data is considered anomalous. Once anomalous data is detected, the system triggers an alarm mechanism. This may include sending email notifications, SMS alerts, or displaying warning messages on the dashboard.

[0035] In an optional embodiment, the data tags carried by the historical data are determined, and the transition probability of the transmission state of the historical data is determined based on the number of times the data tags of the historical data change within a preset time period in the historical transmission information. The data tags include at least one of the following: normal transmission data and abnormal transmission data. The data tags are used to indicate the data transmission state of the historical data. A state transition matrix is ​​constructed based on the transition probabilities corresponding to all historical data, and the state transition matrix is ​​determined as the target model.

[0036] Normal data transmission: This means that no errors or abnormalities occurred during the data transmission process.

[0037] Abnormal data transmission: This indicates that errors or abnormal situations occurred during data transmission, such as data loss, corruption, or excessive latency. It counts the number of times each data point transitions from one state to another within a preset time period. For example, if a data point was "normal data transmission" at one moment and then became "abnormal data transmission" at another moment, this is counted as one state change.

[0038] Calculate the probability of transitioning to other states for each state based on the number of times the statistical labels change. For example, if the number of times the state transitions from "normal data transmission" to "abnormal data transmission" is N, and the total number of times the "normal data transmission" state occurs is M, then the transition probability is N / M.

[0039] All the calculated state transition probabilities are filled into a matrix, where rows represent the current state and columns represent the next state. This matrix is ​​the state transition matrix in the Markov transition model.

[0040] Once the state transition matrix is ​​constructed, it can serve as the target model for the Markov transition model, used to predict future state changes in data.

[0041] In summary, by following the steps above, a Markov transition model can be constructed based on historical data to monitor data anomalies in network communication systems. This method can help to promptly identify and address potential faults, improving system stability and reliability.

[0042] In an optional embodiment, the data response duration carried by the historical data is determined; if the data response duration is greater than a threshold, the data tag of the historical data is determined to be abnormal transmission data; if the data response duration is less than or equal to the threshold, the data tag of the historical data is determined to be normal transmission data.

[0043] To determine the response duration of the historical data, it is first necessary to extract the response duration of each data point from the historical data transmission information. Response duration refers to the time interval between sending a request and receiving a response.

[0044] Based on business needs and system performance, set a reasonable response time threshold. This threshold can be adjusted according to actual conditions to ensure timely detection of anomalies without causing false alarms due to oversensitivity.

[0045] If the data response time exceeds a preset threshold, the data point is marked as "abnormal transmission data".

[0046] If the data response is less than or equal to a preset threshold, the data point is marked as "normal transmission data".

[0047] Historical data with data labels is used to construct the state transition matrix of the Markov transition model. Specifically, the number of transitions from each state to other states is counted, and the transition probability is calculated. This method effectively utilizes data response time to help determine the normality of data transmission, thereby improving the accuracy of anomaly detection.

[0048] In an optional embodiment, a first timestamp of the first triggering of the abnormal data alarm within a first time period and a second timestamp of the second triggering of the abnormal data alarm within the first time period are determined; the difference between the first timestamp and the second timestamp is determined; if the difference is less than a second preset value, it is determined not to initiate the abnormal data alarm.

[0049] It should be noted that the abnormal data represents the difference between the output signal sampled by the adaptive event trigger and the original output information.

[0050] The monitoring or logging system captures the first and second trigger events of abnormal data alarms within a first time period. These two triggers correspond to two different time points, namely the first timestamp and the second timestamp. The first and second timestamps are compared to calculate the time difference between them. This time difference reflects the situation where abnormal data alarms are triggered consecutively within a very short period of time. Based on a set second preset value (a time threshold), it is determined whether the time difference is less than the preset value. If the time difference is less than the second preset value, it indicates that the interval between the two triggers is very short, possibly due to a brief, non-persistent anomaly. In this case, to avoid false alarms or overreaction, the system will decide not to initiate an abnormal data alarm. In this way, frequent alarms caused by brief fluctuations or transient errors can be effectively reduced, thereby improving the stability and reliability of the system.

[0051] In an optional embodiment, the historical data is input into a preset filter model to obtain noise information corresponding to the historical data; a noise model is then established based on the noise information.

[0052] Historical data transmission information is input into a pre-defined filter model. After the historical data passes through the filter model, the filter analyzes and processes the data according to its internal algorithms and rules. During this process, it identifies which parts of the data might be noise, and provides information such as the characteristics and distribution of this noise. By analyzing and modeling noise in historical data, we can more accurately understand the characteristics and patterns of noise, thereby taking corresponding measures to reduce or eliminate the impact of noise on the data and improve its quality and reliability.

[0053] Based on the data quality assessment results, it is determined whether the target data transmission information can be input into the target model. If the data quality meets the requirements, subsequent analysis and processing can continue; if the data quality does not meet the requirements, it is necessary to return to collect or process the data again.

[0054] In an optional embodiment, the abnormal transmission node corresponding to the abnormal data is determined, and the network status of the abnormal transmission node is monitored; if the network status is abnormal, the previous normal transmission node corresponding to the abnormal data is determined; and an alert instruction is sent to the normal transmission node to prompt the normal transmission node to forward subsequent data to the backup node corresponding to the abnormal transmission node.

[0055] When abnormal data is detected, the first step is to identify the abnormal transmission node corresponding to that data. This step is fundamental to ensuring the accuracy of subsequent monitoring and handling measures. Network status monitoring is then performed on the identified abnormal transmission node. By monitoring network traffic, latency, and packet loss rate in real time, it's possible to determine if there are network problems and take timely countermeasures. If an abnormal network status is detected, it's necessary to further identify the previous normal transmission node corresponding to the abnormal data. This helps to understand the specific location and possible causes of the anomaly, providing a basis for subsequent processing. An alert instruction is sent to the identified previous normal transmission node, prompting it to forward subsequent data to the backup node of the abnormal transmission node. This step aims to ensure the continuity of data transmission and the reliability of the system. Upon receiving the alert instruction, the previous normal transmission node forwards subsequent data to the backup node of the abnormal transmission node. This effectively avoids data transmission interruptions caused by single points of failure, improving the overall stability of the system.

[0056] In an optional embodiment, after the data transmission information is input into the target model, the anomaly type corresponding to the data transmission information and the original anomaly probability corresponding to the anomaly type are determined; according to the weight value corresponding to the anomaly type, the target anomaly probability corresponding to the original anomaly probability is determined; and the target anomaly probability is determined as the anomaly probability value of the data transmission information.

[0057] First, the data transmission information needs to be input into the target model, which can identify anomalies in the data. Once the model identifies anomalies in the data transmission information, it determines the types of these anomalies and calculates the original anomaly probability for each type. Next, a target anomaly probability is calculated based on the weight values ​​corresponding to the anomaly types. These weight values ​​may be determined based on historical data, expert experience, or business rules, reflecting the importance of different anomaly types in the overall risk assessment. Finally, the calculated target anomaly probability is used as the anomaly probability value for the data transmission information. This probability value can be used for further risk assessment and decision-making, such as deciding whether additional monitoring or intervention is needed for data transmission.

[0058] The abnormal data alarm method provided in this application obtains historical transmission information of business data in a target business scenario, constructs a target model based on the historical data carried in the historical transmission information, wherein the target model is obtained through machine learning of multiple sets of sample data, each set of sample data including: historical data, the data state of the historical data, and the probability of change of the data state; the method monitors the data transmission information corresponding to the target business scenario in real time, inputs the data transmission information into the target model, and obtains the abnormal probability value of the data transmission information; if the abnormal probability value is greater than a preset value, the data transmission information is determined to be abnormal data, and an abnormal data alarm is initiated, thereby achieving the effect of timely detection and alarm of network data anomalies.

[0059] Figure 3 A schematic diagram of the abnormal data alarm device provided in this application is shown below. Figure 3 As shown, the abnormal data alarm device 30 provided in this embodiment includes:

[0060] The acquisition module 301 is used to acquire historical transmission information of business data in the target business scenario, and construct a target model based on the historical data carried in the historical transmission information. The target model is obtained by machine learning of multiple sets of sample data. Each set of sample data includes: historical data, the data state of the historical data, and the probability of change of the data state.

[0061] Monitoring module 302 is used to monitor data transmission information corresponding to the target business scenario in real time, input the data transmission information into the target model, and obtain the abnormal probability value of the data transmission information;

[0062] The alarm module 303 is used to determine that the data transmission information is abnormal data and initiate an abnormal data alarm when the abnormal probability value is greater than a first preset value.

[0063] In an optional embodiment, the acquisition module 301 is configured to: determine the data tag carried by the historical data; determine the transition probability of the transmission state of the historical data based on the number of times the data tag changes within a preset time period in the historical transmission information; wherein the data tag includes at least one of the following: normal transmission data and abnormal transmission data; wherein the data tag is used to indicate the data transmission state of the historical data; construct a state transition matrix based on the transition probabilities corresponding to all historical data; and determine the state transition matrix as the target model.

[0064] In an optional embodiment, the acquisition module 301 is configured to: determine the data response duration carried by the historical data; if the data response duration is greater than a threshold, determine that the data tag of the historical data is abnormal transmission data; if the data response duration is less than or equal to the threshold, determine that the data tag of the historical data is normal transmission data.

[0065] In an optional embodiment, the device further includes: an alarm module (not shown in the figure), configured to determine a first timestamp of the first triggering of the abnormal data alarm within a first time period and a second timestamp of the second triggering of the abnormal data alarm within the first time period; determine the difference between the first timestamp and the second timestamp; and determine not to initiate the abnormal data alarm if the difference is less than a second preset value.

[0066] In an optional embodiment, the device further includes: a noise module (not shown in the figure), used to input the data transmission information into a preset filter model to obtain target data transmission information after noise removal; and to determine whether the target data transmission information is allowed to be input into the target model.

[0067] In an optional embodiment, the device further includes: a forwarding module (not shown in the figure), configured to determine the abnormal transmission node currently corresponding to the abnormal data, monitor the network status of the abnormal transmission node; determine the previous normal transmission node corresponding to the abnormal data when the network status is abnormal; and send a reminder instruction to the normal transmission node to prompt the normal transmission node to forward subsequent data to the backup node corresponding to the abnormal transmission node.

[0068] In an optional embodiment, the monitoring module 302 is configured to, after inputting the data transmission information into the target model, determine the anomaly type corresponding to the data transmission information and the original anomaly probability corresponding to the anomaly type; determine the target anomaly probability corresponding to the original anomaly probability based on the weight value corresponding to the anomaly type; and determine the target anomaly probability as the anomaly probability value of the data transmission information.

[0069] The device for determining the abnormal data processing scheme provided in this embodiment can execute the method provided in the above method embodiment. Its implementation principle and technical effect are similar, and will not be described in detail here.

[0070] Figure 4 A schematic diagram of the device used to determine the abnormal data processing scheme provided in this application. (See attached diagram.) Figure 4 As shown, the electronic device 40 provided in this embodiment includes at least one processor 401 and a memory 402. Optionally, the device 40 further includes a communication component 403. The processor 401, memory 402, and communication component 403 are connected via a bus 404.

[0071] In a specific implementation, at least one processor 401 executes computer execution instructions stored in memory 402, causing at least one processor 401 to perform the above-described method.

[0072] The specific implementation process of processor 401 can be found in the above method embodiments, and its implementation principle and technical effect are similar. It will not be repeated here.

[0073] In the above embodiments, it should be understood that the processor can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), etc. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the method disclosed in this invention can be directly implemented by a hardware processor, or implemented by a combination of hardware and software modules within the processor.

[0074] The memory may include random access memory (RAM) and may also include non-volatile memory (NVM), such as at least one disk storage device.

[0075] The bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. Buses can be categorized as address buses, data buses, control buses, etc. For ease of illustration, the buses shown in the accompanying drawings are not limited to a single bus or a single type of bus.

[0076] This application also provides a computer program product, including a computer program that, when executed by a processor, implements the above-described method.

[0077] This application also provides a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, implement the above-described method.

[0078] The aforementioned readable storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk. The readable storage medium can be any available medium accessible to a general-purpose or special-purpose computer.

[0079] An exemplary readable storage medium is coupled to a processor, enabling the processor to read information from and write information to the readable storage medium. Of course, the readable storage medium can also be a component of the processor. The processor and the readable storage medium can reside in an Application Specific Integrated Circuit (ASIC). Alternatively, the processor and the readable storage medium can exist as discrete components in the device.

[0080] The division of units is merely a logical functional division; in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be indirect coupling or communication connection through some interfaces, devices, or units, and may be electrical, mechanical, or other forms.

[0081] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0082] In addition, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0083] If a function is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this invention, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of this invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0084] Those skilled in the art will understand that all or part of the steps of the above-described method embodiments can be implemented by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When executed, the program performs the steps of the above-described method embodiments; and the aforementioned storage medium includes various media capable of storing program code, such as ROM, RAM, magnetic disks, or optical disks.

[0085] Finally, it should be noted that other embodiments of the invention will readily occur to those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This invention is intended to cover any variations, uses, or adaptations of the invention that follow the general principles of the invention and include common knowledge or customary techniques in the art not disclosed herein, and is not limited to the precise structures described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope. The scope of the invention is limited only by the appended claims.

[0086] It should be noted that, for the sake of simplicity, the foregoing method embodiments are all described as a series of actions. However, those skilled in the art should understand that this application is not limited to the described order of actions, as some steps may be performed in other orders or simultaneously according to this application. Furthermore, those skilled in the art should also understand that the embodiments described in the specification are all optional embodiments, and the actions and modules involved are not necessarily essential to this application.

[0087] It should be further noted that although the steps in the flowchart are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowchart may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these sub-steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the sub-steps or stages of other steps.

[0088] It should be understood that the above-described device embodiments are merely illustrative, and the device of this application can also be implemented in other ways. For example, the division of units / modules in the above embodiments is only a logical functional division, and there may be other division methods in actual implementation. For example, multiple units, modules, or components may be combined, or integrated into another system, or some features may be ignored or not executed.

[0089] Furthermore, unless otherwise specified, the functional units / modules in the various embodiments of this application can be integrated into one unit / module, or each unit / module can exist physically separately, or two or more units / modules can be integrated together. The integrated units / modules described above can be implemented in hardware or as software program modules.

[0090] When integrated units / modules are implemented in hardware, the hardware can be digital circuits, analog circuits, etc. The physical implementation of the hardware structure includes, but is not limited to, transistors, memristors, etc. Unless otherwise specified, the processor can be any suitable hardware processor, such as a CPU, GPU, FPGA, DSP, and ASIC, etc. Unless otherwise specified, the storage unit can be any suitable magnetic or magneto-optical storage medium, such as Resistive Random Access Memory (RRAM), Dynamic Random Access Memory (DRAM), Static Random Access Memory (SRAM), Enhanced Dynamic Random Access Memory (EDRAM), High-Bandwidth Memory (HBM), Hybrid Memory Cube (HMC), etc.

[0091] If the integrated unit / module is implemented as a software program module and sold or used as an independent product, it can be stored in a computer-readable storage device (CMD). Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a memory and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of this application. The aforementioned memory includes various media capable of storing program code, such as a USB flash drive, read-only memory (ROM), random access memory (RAM), portable hard drive, magnetic disk, or optical disk.

[0092] In the above embodiments, the descriptions of each embodiment have their own emphasis. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments. The technical features of the above embodiments can be combined arbitrarily. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as the combination of these technical features does not contradict each other, it should be considered within the scope of this specification.

[0093] Other embodiments of this application will readily occur to those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of this application that follow the general principles of this application and include common knowledge or customary techniques in the art not disclosed herein. The specification and examples are to be considered exemplary only, and the true scope and spirit of this application are indicated by the following claims.

[0094] It should be understood that this application is not limited to the precise structure described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope. The scope of this application is limited only by the appended claims.

Claims

1. An alarm method for abnormal data, characterized in that, include: The historical transmission information of business data in the target business scenario is obtained, and a target model is constructed based on the historical data carried in the historical transmission information. The target model is obtained by machine learning of multiple sets of sample data. Each set of sample data includes: historical data, the data state of the historical data, and the probability of change of the data state. Real-time monitoring of data transmission information corresponding to the target business scenario; inputting the data transmission information into the target model to obtain the abnormal probability value of the data transmission information; If the abnormal probability value is greater than a first preset value, the data transmission information is determined to be abnormal data, and an abnormal data alarm is initiated. After determining that the data transmission information is abnormal and initiating an abnormal data alarm when the abnormal probability value is greater than a first preset value, the method further includes: Determine the abnormal transmission node corresponding to the abnormal data and monitor the network status of the abnormal transmission node; In the event of an abnormal network condition, determine the previous normal transmission node corresponding to the abnormal data; A reminder instruction is sent to the normal transmission node to prompt it to forward subsequent data to the backup node corresponding to the abnormal transmission node.

2. The method according to claim 1, characterized in that, Constructing a target model based on historical data carried in the historical transmission information includes: The data tag carried by the historical data is determined, and the transition probability of the transmission status of the historical data is determined based on the number of times the data tag of the historical data changes within a preset time period in the historical transmission information. The data tag includes at least one of the following: normal transmission data and abnormal transmission data. The data tag is used to indicate the data transmission status of the historical data. A state transition matrix is ​​constructed based on the transition probabilities corresponding to all historical data, and the state transition matrix is ​​determined as the target model.

3. The method according to claim 2, characterized in that, The method for determining the data tags carried by the historical data further includes: Determine the data response time carried by the historical data; If the data response time exceeds a threshold, the data tag of the historical data is determined to be abnormal transmission data; If the data response time is less than or equal to the threshold, the data tag of the historical data is determined to be normal transmission data.

4. The method according to claim 1, characterized in that, Before initiating an abnormal data alarm, the method further includes: Determine the first timestamp of the first trigger of the abnormal data alarm within the first time period and the second timestamp of the second trigger of the abnormal data alarm within the first time period; Determine the difference between the first timestamp and the second timestamp; If the difference is less than the second preset value, it is determined that the abnormal data alarm will not be initiated.

5. The method according to claim 1, characterized in that, Before constructing the target model based on the historical data carried in the historical transmission information, the method further includes: The historical data is input into a preset filter model to obtain the noise information corresponding to the historical data; A noise model is established based on the noise information.

6. The method according to claim 1, characterized in that, Real-time monitoring of data transmission information corresponding to the target business scenario, inputting the data transmission information into the target model, and obtaining the anomaly probability value of the data transmission information, including: After inputting the data transmission information into the target model, the anomaly type corresponding to the data transmission information and the original anomaly probability corresponding to the anomaly type are determined; Based on the weight value corresponding to the anomaly type, determine the target anomaly probability corresponding to the original anomaly probability; The target anomaly probability is determined as the anomaly probability value of the data transmission information.

7. An abnormal data alarm device, comprising: The acquisition module is used to acquire historical transmission information of business data in the target business scenario, and construct a target model based on the historical data carried in the historical transmission information. The target model is obtained by machine learning of multiple sets of sample data. Each set of sample data includes: historical data, the data state of the historical data, and the probability of change of the data state. The monitoring module is used to monitor the data transmission information corresponding to the target business scenario in real time, input the data transmission information into the target model, and obtain the abnormal probability value of the data transmission information. An alarm module is used to determine that the data transmission information is abnormal data and initiate an abnormal data alarm when the abnormal probability value is greater than a first preset value. The forwarding module is used to determine the abnormal transmission node corresponding to the abnormal data and monitor the network status of the abnormal transmission node; if the network status is abnormal, determine the previous normal transmission node corresponding to the abnormal data; and send an alert instruction to the normal transmission node to prompt the normal transmission node to forward subsequent data to the backup node corresponding to the abnormal transmission node.

8. An electronic device, characterized in that, include: A processor, and a memory communicatively connected to the processor; The memory stores computer-executed instructions; The processor executes computer execution instructions stored in the memory to implement the method as described in any one of claims 1 to 5.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-executable instructions, which, when executed by a processor, are used to implement the method as described in any one of claims 1 to 5.

10. A computer program product, characterized in that, Includes a computer program that, when executed by a processor, implements the method of any one of claims 1 to 5.

Images