Business process anomaly detection system and method based on machine learning

Abstract

The invention discloses a business process anomaly detection system and method based on machine learning, and belongs to the technical field of business process anomaly detection. The method comprises the following steps: S10, acquiring a target abnormal service parameter; s20, optimizing the rule configured by each business process node; s30, adopting different abnormal event detection methods to detect abnormal events in the business process nodes; and S40, the target service system performs early warning response according to the detection result of the abnormal event. According to the invention, adaptive adjustment of the business process is realized according to the historical performance of the target business system and the business update condition of the business process, the detection accuracy and the detection efficiency of the detection system are further improved, and meanwhile, in the process of detecting the potential abnormal event in the business process through the boundary value, the detection accuracy and the detection efficiency of the detection system are improved. The influence of the business process progress on the detection result is considered, and the detection accuracy of the potential abnormal event is improved.

Description

Technical Field

[0001] The present invention relates to the technical field of business process anomaly detection, and specifically to a business process anomaly detection system and method based on machine learning. Background Art

[0002] With the growth of enterprise data volume and the complexity of business processes, traditional business monitoring methods can no longer effectively identify and handle abnormal events.

[0003] In the existing technology, new rules generated during business development need to be manually added to the business process anomaly detection system. At the same time, it is impossible to dynamically update the rules based on the historical performance of the detection system, resulting in low accuracy and low efficiency of the detection system. In addition, the existing system is unable to correctly identify abnormal events, resulting in business behaviors in which abnormal events are misreported in the detection system. The existing system is unable to achieve real-time monitoring and analysis, resulting in delays in the identification and response of abnormal events. Summary of the invention

[0004] The purpose of the present invention is to provide a business process anomaly detection system and method based on machine learning to solve the problems raised in the above background technology.

[0005] In order to solve the above technical problems, the present invention provides the following technical solutions: a business process anomaly detection method based on machine learning, the method comprising:

[0006] S10: Acquire the business process of the target business system. When a user triggers a business request, acquire the business parameters submitted by the user at the business process node in real time. Combined with the rules configured at each business process node, determine whether the business parameters acquired in real time are abnormal business parameters. Based on the determination result, selectively analyze the deviation of the analyzed business process execution path, and obtain the target abnormal business parameters according to the analysis result.

[0007] S20: training a decision tree model of the business process according to target abnormal business parameters and business adjustment information of the business process to obtain a target decision tree model, and optimizing the rules configured for each business process node using the target decision tree model;

[0008] S30: Analyze the data types of the business parameters submitted by the user to the business process node, the data types include boundary values, abnormal values, and non-boundary values, and based on the analysis results, use different abnormal event detection methods to detect abnormal events in the business process node;

[0009] S40: The target business system performs an early warning response according to the detection result of the abnormal event.

[0010] Further, the S10 includes:

[0011] S101: Acquire the business process of the target business system. The business process includes several business process nodes. When a user triggers a business request, acquire the business parameters submitted by the user at the business process node in real time. If the business parameters acquired in real time do not meet the rules configured for the corresponding business process node, the business parameters acquired in real time are considered to be abnormal business parameters. Otherwise, the business parameters acquired in real time are considered to be normal business parameters.

[0012] S102: generating a plurality of business process execution paths according to the rules configured for each business process node, and when it is analyzed that the business parameters obtained in real time are normal business parameters, determining the execution path of the business process at the next moment, and recording the determined execution path as the first execution path;

[0013] S103: Determine the business process node where the normal business parameters are located, obtain the historical business parameters submitted to the determined business process node, use the K-means clustering algorithm to perform cluster analysis on the obtained historical business parameters, and obtain several historical business parameter data classes, each of which includes a cluster center, and use the Euclidean distance formula to calculate the distance value between the normal business parameters and each cluster center, and use the historical business parameter data class where the cluster center corresponding to the minimum distance value is located as the target data class of the normal business parameters;

[0014] After each historical business parameter stored in the target data class is submitted to a determined business process node, a complete execution path is obtained. When each historical business parameter is submitted to a determined business process node, the execution path of the business process at the next moment is obtained, and the obtained execution path is put into a set A. The deviation γ of the first execution path is predicted according to γ=1-K / U, wherein U represents the total number of execution paths stored in the set A, and K represents the total number of execution paths stored in the set A that are consistent with the first execution path; since there are dependencies between each business sub-process in the business process, when the business parameters meet the rules configured for the corresponding business process node, the smooth progress of the subsequent business process cannot be guaranteed. In order to ensure the smooth progress of the business process, the user needs to repeatedly run the business process multiple times; the present invention performs cluster analysis on historical business parameters, obtains the execution path of the business process at the next moment when each historical business parameter is submitted to a determined business process node, and predicts the deviation of the first execution path based on the obtained information, thereby realizing accurate detection of abnormal business parameters and reducing the time for users to run business processes;

[0015] S104: If 0.4<γ≤1, the attributes of the business parameters obtained in real time are modified. The modification method is: modify the attributes of the business parameters obtained in real time from normal business parameters to abnormal business parameters. If 0≤γ≤0.4, the attributes of the business parameters obtained in real time are not modified, and the business parameters for which the attribute modification operation is performed are used as the target abnormal business parameters.

[0016] Further, the S20 includes:

[0017] S201: constructing a decision tree model of the business process according to the rules configured for each business process node, matching the business process node with the internal nodes set in the decision tree model, and determining whether each business process node needs to be adjusted. If the business process node needs to be adjusted, marking the internal nodes matching the business process nodes to be adjusted in the decision tree model;

[0018] S202: Numbering the various execution paths stored in set A. The numbering result is: i = 1, 2, ..., m; m represents the total number of execution path types stored in set A. i =f i / U is calculated based on maxR i The corresponding number, when the target abnormal business parameter is submitted to the determined business process node, the target execution path of the business process at the next moment is determined, where f i represents the total number of execution paths of the i-th type stored in set A, and max represents the maximum value symbol;

[0019] S203: Using the business adjustment information of the business process node to be adjusted as the input of the marked internal node, training the marked internal node, using (target abnormal task parameter, target execution path) as the training data of the internal node matching the determined business process node, training the internal node matching the determined business process node, and obtaining the target decision tree model;

[0020] S204: According to the input and output of the internal nodes matching each business process node, the rules configured for the corresponding business process node are optimized. The decision tree model of the business process is trained through the historical performance of the business process and the business update of the business process, and the rules configured in each business process node are dynamically updated, which is conducive to improving the accurate detection of abnormal events in the business process.

[0021] Furthermore, the specific method of detecting abnormal events in each business process node in S30 is:

[0022] According to the optimization results of the rules configured by each business process node, the constraint range of each business process node is determined, and whether the business parameters submitted by the user to each business process node belong to the boundary value is judged. The boundary value judgment method is: randomly select a business process node, set the constraint range of the selected business process node as [x, y], and record the business parameter submitted by the user to the selected business process node as h. If x≤h≤x*(1+w) or y*(1-w)≤h≤y, then the business parameter submitted by the user to the selected business process node is considered to belong to the boundary value. Otherwise, it is considered that the business parameter submitted by the user to the selected business process node does not belong to the boundary value, where w is a constant and 0<w≤0.2;

[0023] Ⅰ. When it is determined that the business parameter submitted by the user to the business process node numbered j belongs to the boundary value, the constraint range [x j ,y j ], and the business parameter h submitted by the user to the business process node numbered j j To obtain;

[0024] When x j ≤h j ≤x j *(1+w), according to G j ={1-[(h j -x j ) / (x j *w)]}*[1-exp(u j +1-n)] predicts the probability value of abnormal events in the business process node numbered j;

[0025] When j *(1-w)≤h j ≤y j When, according to G j ={1-[(h j -y j *(1-w)) / (y j *w)]}*[1-exp(u j +1-n)] predicts the probability value of abnormal events in the business process node numbered j;

[0026] Where j = 1, 2, ..., n, represents the number corresponding to each business process node, n represents the total number of business process nodes in the business process, u j It indicates the total number of business process nodes that have been executed when the user executes the business process node numbered j. exp indicates an exponential function with the natural constant e as the base, e=2.72;

[0027] When G j>0.7, it means that an abnormal event can be detected in the business process node numbered j. The abnormal event detected by the business process node numbered j is that the user submits the business parameter h in the business process node numbered j. j , when G j When ≤0.7, it means that no abnormal event can be detected in the business process node numbered j;

[0028] Ⅱ. When the user submits the business parameter h at the business process node numbered j j When it is an abnormal value, an abnormal event can be detected in the business process node numbered j. The abnormal event detected by the business process node numbered j is that the user submits the business parameter h in the business process node numbered j. j ;

[0029] III. When the user submits the business parameter h to the business process node numbered j j When it is a non-boundary value, no abnormal event can be detected in the business process node numbered j;

[0030] Furthermore, S40 includes the target business system sending out a warning signal when detecting an abnormal event at each business process node, and feeding back the detected abnormal event to the user terminal. The user handles the abnormal event in a timely manner according to the warning signal and the feedback information received by the user terminal to ensure the smooth execution of subsequent business processes.

[0031] A business process anomaly detection system based on machine learning, the system comprising a target abnormal business parameter analysis module, a rule optimization module, an abnormal event detection module and an early warning response module;

[0032] The target abnormal business parameter analysis module is used to determine whether the business parameters acquired in real time are abnormal business parameters, and based on the judgment result, selectively analyze the deviation of the analyzed business process execution path, and determine the target abnormal business parameters according to the analysis result;

[0033] The rule optimization module is used to train the decision tree model of the business process according to the target abnormal business parameters and the business adjustment information of the business process, and optimize the rules configured for each business process node according to the trained target decision tree model;

[0034] The abnormal event detection module is used to detect abnormal events in business process nodes using different abnormal event detection methods;

[0035] The early warning response module is used to perform an early warning response according to the detection result of the abnormal event.

[0036] Further, the target abnormal business parameter analysis module includes a business parameter judgment unit, a first execution path determination unit, a path deviation prediction unit and a target abnormal business parameter determination unit;

[0037] The business parameter judgment unit judges whether the business parameter obtained in real time is a normal business parameter or an abnormal business parameter according to the judgment result of whether the business parameter obtained in real time satisfies the rule configured for the corresponding business process node;

[0038] When the business parameter determination unit determines that the business parameter acquired in real time is a normal business parameter, the first execution path determination unit determines the execution path of the business process at the next moment according to the rules configured by each business process node to generate a plurality of business process execution paths, and the determined execution path is the first execution path;

[0039] When the business parameter judgment unit judges that the business parameter obtained in real time is a normal business parameter, the path deviation prediction unit analyzes the historical business parameters submitted to the determined business process node through the K-means clustering algorithm, determines the target data class of the normal business parameter, obtains the execution path of the business process at the next moment in combination with the obtained completed execution path, and predicts the deviation of the first execution path through the constructed mathematical model;

[0040] The target abnormal service parameter determination unit determines the target abnormal service parameter according to the prediction result of the path deviation prediction unit.

[0041] Further, the rule optimization module includes an internal node marking unit, a target execution path determination unit, a decision tree model training unit and a rule optimization unit;

[0042] The internal node marking unit constructs a decision tree model of the business process according to the rules configured for each business process node, matches the business process node with the internal nodes set in the decision tree model, and marks the internal nodes matching the business process nodes to be adjusted in the decision tree model according to the adjustment of the business of each business process node;

[0043] The target execution path determination unit determines the target execution path of the business process at the next moment when the target abnormal business parameter is submitted to the determined business process node according to the constructed mathematical formula;

[0044] The decision tree model training unit uses the business adjustment information of the business process node to be adjusted as the input of the marked internal node, trains the marked internal node, uses (target abnormal task parameter, target execution path) as the training data of the internal node matching the determined business process node, trains the internal node matching the determined business process node, and obtains the target decision tree model;

[0045] The rule optimization unit optimizes the rules configured for the corresponding business process nodes according to the input and output of the internal nodes matching the business process nodes.

[0046] Further, the abnormal event detection module includes a boundary value analysis unit, a first abnormal event detection unit and a second abnormal event detection unit;

[0047] The boundary value analysis unit determines the constraint range of each business process node according to the optimization result of the rules configured by each business process node, and analyzes whether the business parameters submitted by the user to each business process node belong to the boundary value;

[0048] The first abnormal event detection unit detects abnormal events in each business process node according to the probability value of the existence of abnormal events in each business process node;

[0049] The second abnormal event detection unit detects abnormal events in each business process node according to the data type of the business parameter submitted by the user to each business process node.

[0050] Furthermore, when the early warning response module detects an abnormal event at each business process node, it sends an early warning signal through the target business system, and feeds back the detected abnormal event to the user end through the target business system.

[0051] Compared with the prior art, the beneficial effects achieved by the present invention are:

[0052] 1. The present invention performs cluster analysis on historical business parameters. When each historical business parameter is submitted to a determined business process node, the execution path of the business process at the next moment is obtained. Based on the obtained information, the deviation of the first execution path is predicted to realize the identification of target abnormal business parameters. Through the identified target abnormal business parameters and the business adjustment information of each business process node, the decision tree model of the business process is trained to obtain the target decision tree model, and the dynamic update of the rules configured for each business process node is realized. This process realizes the adaptive adjustment of the business process according to the historical performance of the target business system and the business update status of the business process, further improving the detection accuracy and efficiency of the detection system.

[0053] 2. The present invention analyzes whether the business parameters submitted by the user belong to boundary values, and selects a suitable abnormal event detection method to detect potential abnormal events in the business process based on the analysis results, thereby further reducing the probability of abnormal events being falsely reported. In the process of detecting potential abnormal events in the business process through boundary values, the impact of the business process progress on the detection results is taken into account, which is conducive to improving the detection accuracy of potential abnormal events.

[0054] 3. The present invention detects and repairs potential abnormal events in business processes to ensure that an early warning response is made before an abnormal situation in the business process occurs, thereby avoiding delayed identification of abnormal events. Users can handle abnormal events in a timely manner based on early warning signals and feedback information, further improving the use effect of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0055] The accompanying drawings are used to provide a further understanding of the present invention and constitute a part of the specification. Together with the embodiments of the present invention, they are used to explain the present invention and do not constitute a limitation of the present invention. In the accompanying drawings:

[0056] Figure 1 It is a workflow diagram of a business process anomaly detection system and method based on machine learning of the present invention;

[0057] Figure 2 It is a structural schematic diagram of the working principle of a business process anomaly detection system and method based on machine learning in the present invention. DETAILED DESCRIPTION

[0058] See also Figure 1 and Figure 2 The present invention provides a technical solution: a business process anomaly detection method based on machine learning, the method comprising:

[0059] S10: Acquire the business process of the target business system. When a user triggers a business request, acquire the business parameters submitted by the user at the business process node in real time. Combined with the rules configured at each business process node, determine whether the business parameters acquired in real time are abnormal business parameters. Based on the determination result, selectively analyze the deviation of the analyzed business process execution path, and obtain the target abnormal business parameters according to the analysis result.

[0060] S10 includes:

[0061] S101: Acquire the business process of the target business system. The business process includes several business process nodes. When a user triggers a business request, acquire the business parameters submitted by the user at the business process node in real time. If the business parameters acquired in real time do not meet the rules configured for the corresponding business process node, the business parameters acquired in real time are considered to be abnormal business parameters. Otherwise, the business parameters acquired in real time are considered to be normal business parameters.

[0062] S102: generating a plurality of business process execution paths according to the rules configured for each business process node, and when it is analyzed that the business parameters obtained in real time are normal business parameters, determining the execution path of the business process at the next moment, and recording the determined execution path as the first execution path;

[0063] S103: Determine the business process node where the normal business parameters are located, obtain the historical business parameters submitted to the determined business process node, use the K-means clustering algorithm (the K-means clustering algorithm is a widely used unsupervised learning algorithm for grouping or clustering data points) to perform cluster analysis on the obtained historical business parameters to obtain several historical business parameter data classes, each of which includes a cluster center, and use the Euclidean distance formula to calculate the distance value between the normal business parameters and each cluster center, and use the historical business parameter data class where the cluster center corresponding to the minimum distance value is located as the target data class of the normal business parameters;

[0064] After submitting each historical business parameter stored in the target data class to the determined business process node, the complete execution path is obtained. After submitting the historical business parameters to the determined business process node, if the user can successfully execute the subsequent business process, the execution path of the user in the subsequent business process is called the complete execution path. When each historical business parameter is submitted to the determined business process node, the execution path of the business process at the next moment is obtained, and the obtained execution path is put into the set A. The deviation γ of the first execution path is predicted according to γ=1-K / U, where U represents the total number of execution paths stored in the set A, and K represents the total number of execution paths stored in the set A that are consistent with the first execution path;

[0065] S104: if 0.4<γ≤1, modify the attributes of the service parameters obtained in real time, and the modification method is: modify the attributes of the service parameters obtained in real time from normal service parameters to abnormal service parameters; if 0≤γ≤0.4, do not modify the attributes of the service parameters obtained in real time, and use the service parameters for which the attribute modification operation is performed as the target abnormal service parameters;

[0066] S20: training a decision tree model of the business process according to target abnormal business parameters and business adjustment information of the business process to obtain a target decision tree model, and optimizing the rules configured for each business process node using the target decision tree model;

[0067] The S20 includes:

[0068] S201: According to the rules configured for each business process node, a decision tree model of the business process is constructed, and the business process node is matched with the internal node set in the decision tree model. The internal node is used to store the rules configured for the business process node, and the input business parameters are classified or divided according to the stored rules to determine whether each business process node needs to be adjusted. If the business process node needs to be adjusted, the internal node matching the business process node to be adjusted is marked in the decision tree model;

[0069] S202: Numbering the various execution paths stored in set A. The numbering result is: i = 1, 2, ..., m; m represents the total number of execution path types stored in set A. i =f i / U is calculated based on maxR i The corresponding number, when the target abnormal business parameter is submitted to the determined business process node, the target execution path of the business process at the next moment is determined, and maxR is recorded i The corresponding number is k, k = 1, 2, ..., m, then the target execution path is the kth type of execution path stored in set A, where f i represents the total number of execution paths of the i-th type stored in set A, and max represents the maximum value symbol;

[0070] S203: Using the business adjustment information of the business process node to be adjusted as the input of the marked internal node, training the marked internal node, using (target abnormal task parameter, target execution path) as the training data of the internal node matching the determined business process node, training the internal node matching the determined business process node, and obtaining the target decision tree model;

[0071] S204: Optimizing the rules configured for the corresponding business process nodes according to the input and output of the internal nodes matching the business process nodes;

[0072] S30: Analyze the data types of the business parameters submitted by the user to the business process node. The data types include boundary values, abnormal values, and non-boundary values. The abnormal values ​​refer to business parameters that are not within the constraint range. Based on the analysis results, different abnormal event detection methods are used to detect abnormal events in the business process node.

[0073] The specific method for S30 to detect abnormal events in each business process node is:

[0074] According to the optimization results of the rules configured by each business process node, the constraint range of each business process node is determined. For example, a business process node is randomly selected, and the optimized rule of the selected business process node is: when 10≤the business parameter submitted by the user to the selected business process node≤20, enter the next business process node, otherwise, the business process terminates. It can be seen that the constraint range of the selected business process node is [10,20]. It is judged whether the business parameter submitted by the user to each business process node belongs to the boundary value. The method for judging the boundary value is: randomly select a business process node, and set the constraint range of the selected business process node to [x, y], let the business parameter submitted by the user to the selected business process node be h, if x≤h≤x*(1+w) or y*(1-w)≤h≤y, then the business parameter submitted by the user to the selected business process node is considered to be a boundary value, otherwise, the business parameter submitted by the user to the selected business process node is considered not to be a boundary value, where w is a constant and 0<w≤0.2, non-boundary value refers to the business parameter within the constraint range and does not satisfy x≤h≤x*(1+w) and y*(1-w)≤h≤y, boundary value refers to the business parameter within the constraint range and satisfies x≤h≤x*(1+w) or y*(1-w)≤h≤y;

[0075] Ⅰ. When it is determined that the business parameter submitted by the user to the business process node numbered j belongs to the boundary value, the constraint range [x j ,y j ], and the business parameter h submitted by the user to the business process node numbered j j To obtain;

[0076] When x j ≤h j ≤x j *(1+w), according to G j ={1-[(h j -x j ) / (x j *w)]}*[1-exp(u j +1-n)] predicts the probability value of abnormal events in the business process node numbered j;

[0077] When j *(1-w)≤h j ≤y j When, according to G j ={1-[(h j -y j *(1-w)) / (y j*w)]}*[1-exp(u j +1-n)] predicts the probability value of abnormal events in the business process node numbered j;

[0078] Where j = 1, 2, ..., n, represents the number corresponding to each business process node, n represents the total number of business process nodes in the business process, u j It indicates the total number of business process nodes that have been executed when the user executes the business process node numbered j. exp indicates an exponential function with the natural constant e as the base, e=2.72;

[0079] When G j >0.7, it means that an abnormal event can be detected in the business process node numbered j. The abnormal event detected by the business process node numbered j is that the user submits the business parameter h in the business process node numbered j. j , when G j When ≤0.7, it means that no abnormal event can be detected in the business process node numbered j;

[0080] Ⅱ. When the user submits the business parameter h to the business process node numbered j j When it is an abnormal value, an abnormal event can be detected in the business process node numbered j. The abnormal event detected by the business process node numbered j is that the user submits the business parameter h in the business process node numbered j. j ;

[0081] III. When the user submits the business parameter h to the business process node numbered j j When it is a non-boundary value, no abnormal event can be detected in the business process node numbered j;

[0082] S40: The target business system performs an early warning response according to the detection result of the abnormal event;

[0083] S40 includes the target business system sending out a warning signal when detecting an abnormal event at each business process node, and feeding back the detected abnormal event to the user terminal.

[0084] A business process anomaly detection system based on machine learning, the system includes a target abnormal business parameter analysis module, a rule optimization module, an abnormal event detection module and an early warning response module;

[0085] The target abnormal business parameter analysis module is used to determine whether the business parameters obtained in real time are abnormal business parameters, and based on the judgment result, selectively analyze the deviation of the analyzed business process execution path, and determine the target abnormal business parameters according to the analysis result;

[0086] The target abnormal business parameter analysis module includes a business parameter judgment unit, a first execution path determination unit, a path deviation prediction unit and a target abnormal business parameter determination unit;

[0087] The business parameter judgment unit judges whether the business parameter obtained in real time is a normal business parameter or an abnormal business parameter according to a judgment result of whether the business parameter obtained in real time satisfies a rule configured for a corresponding business process node;

[0088] When the business parameter determination unit determines that the business parameter obtained in real time is a normal business parameter, the first execution path determination unit determines the execution path of the business process at the next moment according to the rules configured by each business process node to generate a plurality of business process execution paths, and the determined execution path is the first execution path;

[0089] When the business parameter judgment unit determines that the business parameter obtained in real time is a normal business parameter, the path deviation prediction unit analyzes the historical business parameters submitted to the determined business process node through the K-means clustering algorithm, determines the target data class of the normal business parameter, obtains the execution path of the business process at the next moment in combination with the obtained completed execution path, and predicts the deviation of the first execution path through the constructed mathematical model;

[0090] The target abnormal service parameter determination unit determines the target abnormal service parameter according to the prediction result of the path deviation prediction unit;

[0091] The rule optimization module is used to train the decision tree model of the business process according to the target abnormal business parameters and the business adjustment information of the business process, and optimize the rules configured for each business process node according to the trained target decision tree model;

[0092] The rule optimization module includes an internal node marking unit, a target execution path determination unit, a decision tree model training unit and a rule optimization unit;

[0093] The internal node marking unit constructs a decision tree model of the business process according to the rules configured for each business process node, matches the business process node with the internal nodes set in the decision tree model, and marks the internal nodes matching the business process nodes to be adjusted in the decision tree model according to the adjustment of the business of each business process node;

[0094] The target execution path determination unit determines the target execution path of the business process at the next moment when the target abnormal business parameter is submitted to the determined business process node according to the constructed mathematical formula;

[0095] The decision tree model training unit uses the business adjustment information of the business process node to be adjusted as the input of the marked internal node, trains the marked internal node, uses (target abnormal task parameter, target execution path) as the training data of the internal node matching the determined business process node, trains the internal node matching the determined business process node, and obtains the target decision tree model;

[0096] The rule optimization unit optimizes the rules configured for the corresponding business process nodes according to the input and output of the internal nodes matching each business process node;

[0097] The abnormal event detection module is used to detect abnormal events in business process nodes using different abnormal event detection methods;

[0098] The abnormal event detection module includes a boundary value analysis unit, a first abnormal event detection unit, and a second abnormal event detection unit;

[0099] The boundary value analysis unit determines the constraint range of each business process node according to the optimization result of the rules configured through each business process node, and analyzes whether the business parameters submitted by the user to each business process node belong to the boundary value;

[0100] The first abnormal event detection unit detects abnormal events in each business process node according to the probability value of the existence of abnormal events in each business process node;

[0101] The second abnormal event detection unit detects abnormal events in each business process node according to the data type of the business parameter submitted to each business process node by the user.

[0102] The early warning response module is used to respond to early warnings based on the detection results of abnormal events;

[0103] When the early warning response module detects an abnormal event at each business process node, it sends a warning signal through the target business system and feeds back the detected abnormal event to the user end through the target business system.

[0104] Example 1: Assume that the business parameter h submitted by the user to the business process node numbered 3 3 =19, the constraint range of the business process node numbered 3 [x 3 ,y 3 ]=[10,20],w=0.1;

[0105] Because of y 3 *(1-w)=18≤h 3 ≤y 3 =20 and service parameter h 3 Within the constraints, we know that h 3is the boundary value, and model G is selected at this time j ={1-[(h j -x j ) / (x j *w)]}*[1-exp(u j +1-n)] predicts the probability value of abnormal events occurring in the business process node numbered 3;

[0106] Assume that there are 10 business process nodes in the business process. When the user executes the business process node numbered 3, the total number of business process nodes that have been executed is u 3 =2, then:

[0107] G 3 ={1-[(h 3 -y 3 *(1-w)) / (y 3 *w)]}*[1-exp(u 3 +1-n)]

[0108] ={1-[(19-20*(1-0.1)) / (20*0.1)]}*[1-exp(2+1-10)]=0.5;

[0109] Due to G 3 =0.5<0.7, it is considered that no abnormal event can be detected in the business process node numbered 3.

[0110] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device.

[0111] Finally, it should be noted that the above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art can still modify the technical solutions described in the aforementioned embodiments or replace some of the technical features therein by equivalents. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A business process anomaly detection method based on machine learning, characterized in that: The method comprises: S10: Acquire the business process of the target business system. When a user triggers a business request, acquire the business parameters submitted by the user at the business process node in real time. Combined with the rules configured at each business process node, determine whether the business parameters acquired in real time are abnormal business parameters. Based on the determination result, selectively analyze the deviation of the analyzed business process execution path, and obtain the target abnormal business parameters according to the analysis result. S20: training a decision tree model of the business process according to target abnormal business parameters and business adjustment information of the business process to obtain a target decision tree model, and optimizing the rules configured for each business process node using the target decision tree model; S30: Analyze the data types of the business parameters submitted by the user to the business process node, the data types include boundary values, abnormal values, and non-boundary values, and based on the analysis results, use different abnormal event detection methods to detect abnormal events in the business process node; S40: The target business system performs an early warning response according to the detection result of the abnormal event.

2. The method for detecting business process anomalies based on machine learning according to claim 1, characterized in that: The S10 includes: S101: Acquire the business process of the target business system. The business process includes several business process nodes. When a user triggers a business request, acquire the business parameters submitted by the user at the business process node in real time. If the business parameters acquired in real time do not meet the rules configured for the corresponding business process node, the business parameters acquired in real time are considered to be abnormal business parameters. Otherwise, the business parameters acquired in real time are considered to be normal business parameters. S102: generating a plurality of business process execution paths according to the rules configured for each business process node, and when it is analyzed that the business parameters obtained in real time are normal business parameters, determining the execution path of the business process at the next moment, and recording the determined execution path as the first execution path; S103: Determine the business process node where the normal business parameters are located, obtain the historical business parameters submitted to the determined business process node, use the K-means clustering algorithm to perform cluster analysis on the obtained historical business parameters, and obtain several historical business parameter data classes, each of which includes a cluster center, and use the Euclidean distance formula to calculate the distance value between the normal business parameters and each cluster center, and use the historical business parameter data class where the cluster center corresponding to the minimum distance value is located as the target data class of the normal business parameters; After each historical business parameter stored in the target data class is submitted to the determined business process node, the complete execution path is obtained. When each historical business parameter is submitted to the determined business process node, the execution path of the business process at the next moment is obtained, and the obtained execution path is put into the set A. The deviation γ of the first execution path is predicted according to γ=1-K / U, where U represents the total number of execution paths stored in the set A, and K represents the total number of execution paths stored in the set A that are consistent with the first execution path; S104: If 0.4<γ≤1, the attributes of the business parameters obtained in real time are modified. The modification method is: modify the attributes of the business parameters obtained in real time from normal business parameters to abnormal business parameters. If 0≤γ≤0.4, the attributes of the business parameters obtained in real time are not modified, and the business parameters for which the attribute modification operation is performed are used as the target abnormal business parameters.

3. The method for detecting business process anomalies based on machine learning according to claim 2, characterized in that: The S20 includes: S201: constructing a decision tree model of the business process according to the rules configured for each business process node, matching the business process node with the internal nodes set in the decision tree model, and determining whether each business process node needs to be adjusted. If the business process node needs to be adjusted, marking the internal nodes matching the business process nodes to be adjusted in the decision tree model; S202: various execution paths stored in set A are numbered, and the numbering result is: i=1,2,…,m; m represents the total number of execution path types stored in set A. i =f i / U is calculated based on maxR i The corresponding number, when the target abnormal business parameter is submitted to the determined business process node, the target execution path of the business process at the next moment is determined, where f i represents the total number of execution paths of the i-th type stored in set A, and max represents the maximum value symbol; S203: Using the business adjustment information of the business process node to be adjusted as the input of the marked internal node, training the marked internal node, using (target abnormal task parameter, target execution path) as the training data of the internal node matching the determined business process node, training the internal node matching the determined business process node, and obtaining the target decision tree model; S204: Optimizing the rules configured for the corresponding business process nodes according to the input and output of the internal nodes matching the business process nodes.

4. The method for detecting business process anomalies based on machine learning according to claim 3, characterized in that: The specific method of detecting abnormal events in each business process node in S30 is: According to the optimization results of the rules configured by each business process node, the constraint range of each business process node is determined, and whether the business parameters submitted by the user to each business process node belong to the boundary value is judged. The boundary value judgment method is: randomly select a business process node, set the constraint range of the selected business process node as [x, y], and record the business parameter submitted by the user to the selected business process node as h. If x≤h≤x*(1+w) or y*(1-w)≤h≤y, then the business parameter submitted by the user to the selected business process node is considered to belong to the boundary value. Otherwise, it is considered that the business parameter submitted by the user to the selected business process node does not belong to the boundary value, where w is a constant and 0<w≤0.2; Ⅰ. When it is determined that the business parameter submitted by the user to the business process node numbered j belongs to the boundary value, the constraint range [x j ,y j ], and the business parameter h submitted by the user to the business process node numbered j j To obtain; When x j ≤h j ≤x j *(1+w), according to G j ={1-[(h j -x j ) / (x j *w)]}*[1-exp(u j +1-n)] predicts the probability value of abnormal events in the business process node numbered j; When j *(1-w)≤h j ≤y j When, according to G j ={1-[(h j -y j *(1-w)) / (y j *w)]}*[1-exp(u j +1-n)] predicts the probability value of abnormal events in the business process node numbered j; Where j = 1, 2, ..., n, represents the number corresponding to each business process node, n represents the total number of business process nodes in the business process, u j It indicates the total number of business process nodes that have been executed when the user executes the business process node numbered j. exp indicates an exponential function with the natural constant e as the base, e=2.72; When G j >0.7, it means that an abnormal event can be detected in the business process node numbered j. The abnormal event detected by the business process node numbered j is that the user submits the business parameter h in the business process node numbered j. j , when G j When ≤0.7, it means that no abnormal event can be detected in the business process node numbered j; Ⅱ. When the user submits the business parameter h to the business process node numbered j j When it is an abnormal value, an abnormal event can be detected in the business process node numbered j. The abnormal event detected by the business process node numbered j is that the user submits the business parameter h in the business process node numbered j. j ; III. When the user submits the business parameter h to the business process node numbered j j When it is a non-boundary value, no abnormal event can be detected in the business process node numbered j.

5. The method for detecting business process anomalies based on machine learning according to claim 4, characterized in that: The S40 includes the target business system sending out a warning signal when an abnormal event is detected at each business process node, and feeding back the detected abnormal event to the user terminal.

6. A business process anomaly detection system based on machine learning applied to the business process anomaly detection method based on machine learning according to any one of claims 1 to 5, characterized in that: The system includes a target abnormal business parameter analysis module, a rule optimization module, an abnormal event detection module and an early warning response module; The target abnormal business parameter analysis module is used to determine whether the business parameters acquired in real time are abnormal business parameters, and based on the judgment result, selectively analyze the deviation of the analyzed business process execution path, and determine the target abnormal business parameters according to the analysis result; The rule optimization module is used to train the decision tree model of the business process according to the target abnormal business parameters and the business adjustment information of the business process, and optimize the rules configured for each business process node according to the trained target decision tree model; The abnormal event detection module is used to detect abnormal events in business process nodes using different abnormal event detection methods; The early warning response module is used to perform an early warning response according to the detection result of the abnormal event.

7. The business process anomaly detection system based on machine learning according to claim 6 is characterized in that: The target abnormal business parameter analysis module includes a business parameter judgment unit, a first execution path determination unit, a path deviation prediction unit and a target abnormal business parameter determination unit; The business parameter judgment unit judges whether the business parameter obtained in real time is a normal business parameter or an abnormal business parameter according to the judgment result of whether the business parameter obtained in real time satisfies the rule configured for the corresponding business process node; When the business parameter determination unit determines that the business parameter acquired in real time is a normal business parameter, the first execution path determination unit determines the execution path of the business process at the next moment according to the rules configured by each business process node to generate a plurality of business process execution paths, and the determined execution path is the first execution path; When the business parameter judgment unit judges that the business parameter obtained in real time is a normal business parameter, the path deviation prediction unit analyzes the historical business parameters submitted to the determined business process node through the K-means clustering algorithm, determines the target data class of the normal business parameter, obtains the execution path of the business process at the next moment in combination with the obtained completed execution path, and predicts the deviation of the first execution path through the constructed mathematical model; The target abnormal service parameter determination unit determines the target abnormal service parameter according to the prediction result of the path deviation prediction unit.

8. The business process anomaly detection system based on machine learning according to claim 7 is characterized in that: The rule optimization module includes an internal node marking unit, a target execution path determination unit, a decision tree model training unit and a rule optimization unit; The internal node marking unit constructs a decision tree model of the business process according to the rules configured for each business process node, matches the business process node with the internal nodes set in the decision tree model, and marks the internal nodes matching the business process nodes to be adjusted in the decision tree model according to the adjustment of the business of each business process node; The target execution path determination unit determines the target execution path of the business process at the next moment when the target abnormal business parameter is submitted to the determined business process node according to the constructed mathematical formula; The decision tree model training unit uses the business adjustment information of the business process node to be adjusted as the input of the marked internal node, trains the marked internal node, uses (target abnormal task parameter, target execution path) as the training data of the internal node matching the determined business process node, trains the internal node matching the determined business process node, and obtains the target decision tree model; The rule optimization unit optimizes the rules configured for the corresponding business process nodes according to the input and output of the internal nodes matching the business process nodes.

9. The business process anomaly detection system based on machine learning according to claim 8, characterized in that: The abnormal event detection module includes a boundary value analysis unit, a first abnormal event detection unit and a second abnormal event detection unit; The boundary value analysis unit determines the constraint range of each business process node according to the optimization result of the rules configured by each business process node, and analyzes whether the business parameters submitted by the user to each business process node belong to the boundary value; The first abnormal event detection unit detects abnormal events in each business process node according to the probability value of the existence of abnormal events in each business process node; The second abnormal event detection unit detects abnormal events in each business process node according to the data type of the business parameter submitted by the user to each business process node.

10. The business process anomaly detection system based on machine learning according to claim 9, characterized in that: When an abnormal event is detected at each business process node, the early warning response module sends an early warning signal through the target business system, and feeds back the detected abnormal event to the user end through the target business system.

Images