A business process anomaly detection system and method based on machine learning

Abstract

The present invention discloses a business process anomaly detection system and method based on machine learning, which belongs to the technical field of business process anomaly detection. The present invention comprises: S10: obtaining target abnormal business parameters; S20: optimizing the rules configured for each business process node; S30: using different abnormal event detection methods to detect abnormal events in business process nodes; S40: the target business system performs an early warning response based on the detection results of the abnormal events. The present invention realizes adaptive adjustment of the business process based on the historical performance of the target business system and the business update status of the business process, further improving the detection accuracy and detection efficiency of the detection system. At the same time, in the process of detecting potential abnormal events in the business process through boundary values, the present invention takes into account the impact of the business process progress on the detection results, thereby improving the detection accuracy of potential abnormal events.

Description

Technical Field

[0001] The present invention relates to the technical field of business process anomaly detection, and specifically to a business process anomaly detection system and method based on machine learning. Background Art

[0002] With the growth of enterprise data volume and the complexity of business processes, traditional business monitoring methods can no longer effectively identify and handle abnormal events.

[0003] In the existing technology, new rules generated during business development need to be manually added to the business process anomaly detection system. At the same time, the rules cannot be dynamically updated based on the historical performance of the detection system, resulting in low accuracy and low efficiency of the detection system. In addition, the existing system cannot correctly identify abnormal events, resulting in the detection system having business behaviors where abnormal events are falsely reported. The existing system cannot achieve real-time monitoring and analysis, resulting in delays in the identification and response of abnormal events. Summary of the Invention

[0004] The purpose of the present invention is to provide a business process anomaly detection system and method based on machine learning to solve the problems raised in the above background technology.

[0005] In order to solve the above technical problems, the present invention provides the following technical solution: a business process anomaly detection method based on machine learning, the method comprising:

[0006] S10: Acquire the business process of the target business system. When a user triggers a business request, acquire the business parameters submitted by the user at the business process node in real time. Combined with the rules configured for each business process node, determine whether the business parameters acquired in real time are abnormal business parameters. Based on the judgment result, selectively analyze the deviation of the analyzed business process execution path, and obtain the target abnormal business parameters based on the analysis results.

[0007] S20: Based on the target abnormal business parameters and the business adjustment information of the business process, the decision tree model of the business process is trained to obtain a target decision tree model. The target decision tree model is used to optimize the rules configured for each business process node.

[0008] S30: Analyze the data types of the business parameters submitted by the user to the business process node, including boundary values, abnormal values, and non-boundary values. Based on the analysis results, use different abnormal event detection methods to detect abnormal events in the business process node.

[0009] S40: The target business system performs an early warning response based on the detection result of the abnormal event.

[0010] Furthermore, the S10 includes:

[0011] S101: Acquire the business process of the target business system. The business process includes several business process nodes. When a user triggers a business request, the business parameters submitted by the user at the business process node are acquired in real time. If the business parameters acquired in real time do not meet the rules configured for the corresponding business process node, the business parameters acquired in real time are considered abnormal business parameters. Otherwise, the business parameters acquired in real time are considered normal business parameters.

[0012] S102: Generate multiple business process execution paths based on the rules configured for each business process node. When the business parameters obtained in real time are analyzed to be normal business parameters, determine the execution path of the business process at the next moment, and record the determined execution path as the first execution path.

[0013] S103: Determine the business process node where the normal business parameters are located, obtain historical business parameters submitted to the determined business process node, perform cluster analysis on the obtained historical business parameters using the K-means clustering algorithm, and obtain several historical business parameter data classes, each of which includes a cluster center. Calculate the distance between the normal business parameters and each cluster center using the Euclidean distance formula, and select the historical business parameter data class where the cluster center corresponding to the minimum distance is located as the target data class for the normal business parameters.

[0014] After each historical business parameter stored in the target data class is submitted to a determined business process node, a complete execution path is obtained. When each historical business parameter is submitted to a determined business process node, the execution path of the business process at the next moment is obtained, and the obtained execution path is placed in a set A. The deviation γ of the first execution path is predicted according to γ=1-K / U, where U represents the total number of execution paths stored in set A, and K represents the total number of execution paths stored in set A that are consistent with the first execution path. Since there are dependencies between each business sub-process in the business process, when the business parameters meet the rules configured for the corresponding business process node, the smooth progress of the subsequent business process cannot be guaranteed. In order to ensure the smooth progress of the business process, the user needs to repeatedly run the business process multiple times. The present invention performs cluster analysis on historical business parameters, and when each historical business parameter is submitted to a determined business process node, the execution path of the business process at the next moment is obtained. Based on the obtained information, the deviation of the first execution path is predicted, thereby achieving accurate detection of abnormal business parameters and reducing the time it takes for users to run business processes.

[0015] S104: If 0.4<γ≤1, the attributes of the business parameters obtained in real time are modified. The modification method is: the attributes of the business parameters obtained in real time are modified from normal business parameters to abnormal business parameters. If 0≤γ≤0.4, the attributes of the business parameters obtained in real time are not modified, and the business parameters subjected to the attribute modification operation are used as the target abnormal business parameters.

[0016] Furthermore, the S20 includes:

[0017] S201: Build a decision tree model for the business process based on the rules configured for each business process node, match the business process nodes with internal nodes set in the decision tree model, and determine whether each business process node requires business adjustment. If the business process node requires business adjustment, mark the internal node in the decision tree model that matches the business process node to be adjusted.

[0018] S202: Numbering the various execution paths stored in set A. The numbering result is: i=1, 2, ..., m; m represents the total number of execution path types stored in set A. i =f i / U is calculated based on maxR i The corresponding number, when the target abnormal business parameter is submitted to the determined business process node, the target execution path of the business process at the next moment is determined, where f i Indicates the total number of execution paths of type i stored in set A, and max represents the maximum value symbol;

[0019] S203: Using the business adjustment information of the business process node to be adjusted as input for the marked internal node, training the marked internal node, using (target abnormal business parameter, target execution path) as training data for the internal node that matches the determined business process node, and training the internal node that matches the determined business process node to obtain a target decision tree model;

[0020] S204: Optimize the rules configured for each business process node based on the inputs and outputs of the internal nodes that match each business process node. This process trains the decision tree model based on the business process's historical performance and business updates, enabling dynamic updates to the rules configured for each business process node. This helps improve the accuracy of detecting abnormal events in the business process.

[0021] Furthermore, the specific method of detecting abnormal events in each business process node in S30 is:

[0022] Based on the optimization results of the rules configured by each business process node, the constraint range of each business process node is determined, and whether the business parameters submitted by the user to each business process node belong to the boundary value is judged. The boundary value judgment method is as follows: randomly select a business process node, set the constraint range of the selected business process node as [x, y], and record the business parameter submitted by the user to the selected business process node as h. If x≤h≤x*(1+w) or y*(1-w)≤h≤y, then the business parameter submitted by the user to the selected business process node is considered to be a boundary value; otherwise, the business parameter submitted by the user to the selected business process node is considered not to be a boundary value, where w is a constant and 0<w≤0.2;

[0023] Ⅰ. When it is determined that the business parameter submitted by the user to the business process node numbered j is a boundary value, the constraint range of the business process node numbered j [x j ,y j ], and the business parameter h submitted by the user to the business process node numbered j j To obtain;

[0024] When x j ≤h j ≤x j *(1+w), according to G j ={1-[(h j -x j ) / (x j *w)]}*[1-exp(u j +1-n)] predicts the probability value of an abnormal event occurring in the business process node numbered j;

[0025] When y j *(1-w)≤h j ≤y j When, according to G j ={1-[(h j -y j *(1-w)) / (y j *w)]}*[1-exp(u j +1-n)] predicts the probability value of an abnormal event occurring in the business process node numbered j;

[0026] Among them, j=1,2,…,n, represents the number corresponding to each business process node, n represents the total number of business process nodes in the business process, u j It represents the total number of business process nodes that have been completed when the user executes the business process node numbered j. exp represents the exponential function with the natural constant e as the base, e=2.72;

[0027] When G jWhen it is >0.7, it means that an abnormal event can be detected in the business process node numbered j. The abnormal event detected by the business process node numbered j is that the user submits the business parameter h in the business process node numbered j. j , when G j When ≤0.7, it means that no abnormal event can be detected in the business process node numbered j;

[0028] Ⅱ. When the user submits the business parameter h at the business process node numbered j j When it is an abnormal value, an abnormal event can be detected in the business process node numbered j. The abnormal event detected by the business process node numbered j is that the user submits the business parameter h in the business process node numbered j. j ;

[0029] III. When the user submits the business parameter h to the business process node numbered j j When it is a non-boundary value, no abnormal event can be detected in the business process node numbered j;

[0030] Furthermore, the S40 includes the target business system issuing a warning signal when detecting an abnormal event at each business process node, and feeding back the detected abnormal event to the user terminal. The user handles the abnormal event in a timely manner based on the warning signal and the feedback information received by the user terminal to ensure the smooth execution of subsequent business processes.

[0031] A business process anomaly detection system based on machine learning, comprising a target abnormal business parameter analysis module, a rule optimization module, an abnormal event detection module, and an early warning response module;

[0032] The target abnormal business parameter analysis module is used to determine whether the business parameters obtained in real time are abnormal business parameters, and based on the judgment result, selectively analyze the deviation of the analyzed business process execution path, and determine the target abnormal business parameters according to the analysis result;

[0033] The rule optimization module is used to train the decision tree model of the business process based on the target abnormal business parameters and the business adjustment information of the business process, and optimize the rules configured for each business process node based on the trained target decision tree model;

[0034] The abnormal event detection module is used to detect abnormal events in business process nodes using different abnormal event detection methods;

[0035] The early warning response module is used to perform early warning response according to the detection results of abnormal events.

[0036] Furthermore, the target abnormal business parameter analysis module includes a business parameter judgment unit, a first execution path determination unit, a path deviation prediction unit and a target abnormal business parameter determination unit;

[0037] The business parameter judgment unit judges whether the business parameter obtained in real time is a normal business parameter or an abnormal business parameter according to the judgment result of whether the business parameter obtained in real time meets the rules configured for the corresponding business process node;

[0038] When the business parameter determination unit determines that the business parameter obtained in real time is a normal business parameter, the first execution path determination unit determines an execution path of the business process at the next moment according to a plurality of business process execution paths generated by the rules configured by each business process node, and the determined execution path is the first execution path;

[0039] When the business parameter judgment unit determines that the business parameter obtained in real time is a normal business parameter, the path deviation prediction unit analyzes the historical business parameters submitted to the determined business process node using a K-means clustering algorithm, determines the target data class of the normal business parameter, obtains the execution path of the business process at the next moment based on the obtained completed execution path, and predicts the deviation of the first execution path using the constructed mathematical model;

[0040] The target abnormal service parameter determination unit determines the target abnormal service parameter according to the prediction result of the path deviation prediction unit.

[0041] Furthermore, the rule optimization module includes an internal node marking unit, a target execution path determination unit, a decision tree model training unit and a rule optimization unit;

[0042] The internal node marking unit constructs a decision tree model of the business process according to the rules configured for each business process node, matches the business process nodes with the internal nodes set in the decision tree model, and marks the internal nodes that match the business process nodes to be adjusted in the decision tree model according to the adjustment status of the business of each business process node;

[0043] The target execution path determination unit determines the target execution path of the business process at the next moment when the target abnormal business parameter is submitted to the determined business process node according to the constructed mathematical formula;

[0044] The decision tree model training unit uses the business adjustment information of the business process node to be adjusted as the input of the marked internal node, trains the marked internal node, uses (target abnormal business parameter, target execution path) as the training data of the internal node matching the determined business process node, trains the internal node matching the determined business process node, and obtains the target decision tree model;

[0045] The rule optimization unit optimizes the rules configured for the corresponding business process nodes according to the input and output of the internal nodes that match the business process nodes.

[0046] Furthermore, the abnormal event detection module includes a boundary value analysis unit, a first abnormal event detection unit, and a second abnormal event detection unit;

[0047] The boundary value analysis unit determines the constraint range of each business process node based on the optimization result of the rules configured by each business process node, and analyzes whether the business parameters submitted by the user to each business process node belong to the boundary value;

[0048] The first abnormal event detection unit detects abnormal events in each business process node based on the probability value of the abnormal event in each business process node;

[0049] The second abnormal event detection unit detects abnormal events in each business process node according to the data type of the business parameter submitted by the user to each business process node.

[0050] Furthermore, when the early warning response module detects an abnormal event at each business process node, it sends an early warning signal through the target business system, and feeds back the detected abnormal event to the user end through the target business system.

[0051] Compared with the prior art, the present invention has the following beneficial effects:

[0052] 1. The present invention performs cluster analysis on historical business parameters. When each historical business parameter is submitted to a determined business process node, the execution path of the business process at the next moment is obtained. Based on the obtained information, the deviation of the first execution path is predicted to realize the identification of target abnormal business parameters. The decision tree model of the business process is trained through the identified target abnormal business parameters and the business adjustment information of each business process node to obtain the target decision tree model, and realize the dynamic update of the rules configured for each business process node. This process realizes the adaptive adjustment of the business process according to the historical performance of the target business system and the business update status of the business process, further improving the detection accuracy and efficiency of the detection system.

[0053] 2. The present invention analyzes whether the business parameters submitted by the user belong to the boundary values, and selects a suitable abnormal event detection method to detect potential abnormal events in the business process based on the analysis results, thereby further reducing the probability of abnormal events being falsely reported. In the process of detecting potential abnormal events in the business process through boundary values, the impact of the business process progress on the detection results is taken into account, which is conducive to improving the detection accuracy of potential abnormal events.

[0054] 3. The present invention detects and repairs potential abnormal events in business processes to ensure that an early warning response is made before an abnormal situation in the business process occurs, thereby avoiding delays in identifying abnormal events. Users can handle abnormal events in a timely manner based on early warning signals and feedback information, further improving the use effect of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0055] The accompanying drawings are used to provide a further understanding of the present invention and constitute a part of the specification. Together with the embodiments of the present invention, they are used to explain the present invention and do not constitute a limitation of the present invention. In the accompanying drawings:

[0056] Figure 1 This is a workflow diagram of a business process anomaly detection system and method based on machine learning of the present invention;

[0057] Figure 2 This is a structural diagram of the working principle of a business process anomaly detection system and method based on machine learning in the present invention. DETAILED DESCRIPTION

[0058] See also Figure 1 and Figure 2 The present invention provides a technical solution: a business process anomaly detection method based on machine learning, the method comprising:

[0059] S10: Acquire the business process of the target business system. When a user triggers a business request, acquire the business parameters submitted by the user at the business process node in real time. Combined with the rules configured for each business process node, determine whether the business parameters acquired in real time are abnormal business parameters. Based on the judgment result, selectively analyze the deviation of the analyzed business process execution path, and obtain the target abnormal business parameters based on the analysis results.

[0060] The S10 includes:

[0061] S101: Acquire the business process of the target business system. The business process includes several business process nodes. When a user triggers a business request, the business parameters submitted by the user at the business process node are acquired in real time. If the business parameters acquired in real time do not meet the rules configured for the corresponding business process node, the business parameters acquired in real time are considered abnormal business parameters. Otherwise, the business parameters acquired in real time are considered normal business parameters.

[0062] S102: Generate multiple business process execution paths based on the rules configured for each business process node. When the business parameters obtained in real time are analyzed to be normal business parameters, determine the execution path of the business process at the next moment, and record the determined execution path as the first execution path.

[0063] S103: Determine the business process node where the normal business parameters are located, obtain historical business parameters submitted to the determined business process node, and perform cluster analysis on the obtained historical business parameters using the K-means clustering algorithm (the K-means clustering algorithm is a widely used unsupervised learning algorithm for grouping or clustering data points) to obtain several historical business parameter data classes, each of which includes a cluster center. Use the Euclidean distance formula to calculate the distance between the normal business parameters and each cluster center. The historical business parameter data class containing the cluster center corresponding to the minimum distance value is used as the target data class for the normal business parameters.

[0064] After submitting each historical business parameter stored in the target data class to the determined business process node, the complete execution path is obtained. After submitting the historical business parameters to the determined business process node, if the user can successfully execute the subsequent business process, the user's execution path in the subsequent business process is called the complete execution path. When each historical business parameter is submitted to the determined business process node, the execution path of the business process at the next moment is obtained, and the obtained execution path is placed in set A. The deviation γ of the first execution path is predicted according to γ=1-K / U, where U represents the total number of execution paths stored in set A, and K represents the total number of execution paths stored in set A that are consistent with the first execution path;

[0065] S104: If 0.4 < γ ≤ 1, modify the attributes of the service parameters obtained in real time. The modification method is: modify the attributes of the service parameters obtained in real time from normal service parameters to abnormal service parameters. If 0 ≤ γ ≤ 0.4, do not modify the attributes of the service parameters obtained in real time, and use the service parameters subjected to the attribute modification operation as the target abnormal service parameters.

[0066] S20: Based on the target abnormal business parameters and the business adjustment information of the business process, the decision tree model of the business process is trained to obtain a target decision tree model. The target decision tree model is used to optimize the rules configured for each business process node.

[0067] The S20 includes:

[0068] S201: Based on the rules configured for each business process node, a decision tree model for the business process is constructed. The business process nodes are matched with internal nodes set in the decision tree model. The internal nodes are used to store the rules configured for the business process nodes. The input business parameters are classified or divided according to the stored rules to determine whether each business process node requires business adjustment. If the business process node requires business adjustment, the internal node that matches the business process node to be adjusted is marked in the decision tree model.

[0069] S202: Numbering the various execution paths stored in set A. The numbering result is: i=1, 2, ..., m; m represents the total number of execution path types stored in set A. i =f i / U is calculated based on maxR i The corresponding number, when the target abnormal business parameter is submitted to the determined business process node, the target execution path of the business process at the next moment is determined, and maxR is recorded. i The corresponding number is k, k = 1, 2, ..., m, then the target execution path is the k-th type of execution path stored in set A, where f i Indicates the total number of execution paths of type i stored in set A, and max represents the maximum value symbol;

[0070] S203: Using the business adjustment information of the business process node to be adjusted as input for the marked internal node, training the marked internal node, using (target abnormal business parameter, target execution path) as training data for the internal node that matches the determined business process node, and training the internal node that matches the determined business process node to obtain a target decision tree model;

[0071] S204: Optimizing the rules configured for the corresponding business process nodes based on the inputs and outputs of the internal nodes that match the business process nodes;

[0072] S30: Analyze the data types of business parameters submitted by users to business process nodes. The data types include boundary values, abnormal values, and non-boundary values. Abnormal values ​​refer to business parameters that are not within the constraint range. Based on the analysis results, different abnormal event detection methods are used to detect abnormal events in the business process nodes.

[0073] The specific method for S30 to detect abnormal events in each business process node is:

[0074] According to the optimization results of the rules configured by each business process node, the constraint range of each business process node is determined. For example, a business process node is randomly selected, and the optimized rule of the selected business process node is: when 10≤the business parameter submitted by the user to the selected business process node≤20, enter the next business process node; otherwise, the business process terminates. It can be seen that the constraint range of the selected business process node is [10,20]. It is judged whether the business parameter submitted by the user to each business process node belongs to the boundary value. The boundary value judgment method is: randomly select a business process node, and set the constraint range of the selected business process node to [x, y], let the business parameter submitted by the user to the selected business process node be h, if x≤h≤x*(1+w) or y*(1-w)≤h≤y, then the business parameter submitted by the user to the selected business process node is considered to be a boundary value, otherwise, the business parameter submitted by the user to the selected business process node is considered to be a non-boundary value, where w is a constant and 0<w≤0.2, non-boundary values ​​refer to business parameters that are within the constraint range and do not satisfy x≤h≤x*(1+w) and y*(1-w)≤h≤y, and boundary values ​​refer to business parameters that are within the constraint range and satisfy x≤h≤x*(1+w) or y*(1-w)≤h≤y;

[0075] Ⅰ. When it is determined that the business parameter submitted by the user to the business process node numbered j is a boundary value, the constraint range of the business process node numbered j [x j ,y j ], and the business parameter h submitted by the user to the business process node numbered j j To obtain;

[0076] When x j ≤h j ≤x j *(1+w), according to G j ={1-[(h j -x j ) / (x j *w)]}*[1-exp(u j +1-n)] predicts the probability value of an abnormal event occurring in the business process node numbered j;

[0077] When y j *(1-w)≤h j ≤y j When, according to G j ={1-[(h j -y j *(1-w)) / (y j*w)]}*[1-exp(u j +1-n)] predicts the probability value of an abnormal event occurring in the business process node numbered j;

[0078] Among them, j=1,2,…,n, represents the number corresponding to each business process node, n represents the total number of business process nodes in the business process, u j It represents the total number of business process nodes that have been completed when the user executes the business process node numbered j. exp represents the exponential function with the natural constant e as the base, e=2.72;

[0079] When G j When it is >0.7, it means that an abnormal event can be detected in the business process node numbered j. The abnormal event detected by the business process node numbered j is that the user submits the business parameter h in the business process node numbered j. j , when G j When ≤0.7, it means that no abnormal event can be detected in the business process node numbered j;

[0080] Ⅱ. When the user submits the business parameter h to the business process node numbered j j When it is an abnormal value, an abnormal event can be detected in the business process node numbered j. The abnormal event detected by the business process node numbered j is that the user submits the business parameter h in the business process node numbered j. j ;

[0081] III. When the user submits the business parameter h to the business process node numbered j j When it is a non-boundary value, no abnormal event can be detected in the business process node numbered j;

[0082] S40: The target business system responds to the warning based on the detection result of the abnormal event;

[0083] S40 includes the target business system sending out an early warning signal when detecting an abnormal event at each business process node, and feeding back the detected abnormal event to the user terminal.

[0084] A business process anomaly detection system based on machine learning, the system includes a target abnormal business parameter analysis module, a rule optimization module, an abnormal event detection module and an early warning response module;

[0085] The target abnormal business parameter analysis module is used to determine whether the business parameters obtained in real time are abnormal business parameters, and based on the judgment results, selectively analyze the deviation of the analyzed business process execution path, and determine the target abnormal business parameters based on the analysis results;

[0086] The target abnormal business parameter analysis module includes a business parameter judgment unit, a first execution path determination unit, a path deviation prediction unit and a target abnormal business parameter determination unit;

[0087] The business parameter judgment unit judges whether the business parameter obtained in real time satisfies the rules configured for the corresponding business process node, and judges whether the business parameter obtained in real time is a normal business parameter or an abnormal business parameter;

[0088] When the business parameter determination unit determines that the business parameter obtained in real time is a normal business parameter, the first execution path determination unit determines an execution path of the business process at the next moment based on a plurality of business process execution paths generated according to the rules configured by each business process node, and the determined execution path is the first execution path;

[0089] When the business parameter judgment unit determines that the business parameters obtained in real time are normal business parameters, the path deviation prediction unit analyzes the historical business parameters submitted to the determined business process node through the K-means clustering algorithm, determines the target data class of the normal business parameters, and obtains the execution path of the business process at the next moment based on the obtained completed execution path. The deviation of the first execution path is predicted using the constructed mathematical model;

[0090] The target abnormal service parameter determination unit determines the target abnormal service parameter according to the prediction result of the path deviation prediction unit;

[0091] The rule optimization module is used to train the decision tree model of the business process based on the target abnormal business parameters and the business adjustment information of the business process, and optimize the rules configured for each business process node based on the trained target decision tree model;

[0092] The rule optimization module includes an internal node marking unit, a target execution path determination unit, a decision tree model training unit and a rule optimization unit;

[0093] The internal node marking unit constructs a decision tree model of the business process according to the rules configured for each business process node, matches the business process nodes with the internal nodes set in the decision tree model, and marks the internal nodes that match the business process nodes to be adjusted in the decision tree model according to the adjustment status of the business of each business process node;

[0094] The target execution path determination unit determines the target execution path of the business process at the next moment when the target abnormal business parameter is submitted to the determined business process node according to the constructed mathematical formula;

[0095] The decision tree model training unit uses the business adjustment information of the business process node to be adjusted as the input of the marked internal node, trains the marked internal node, uses (target abnormal business parameter, target execution path) as the training data of the internal node matching the determined business process node, trains the internal node matching the determined business process node, and obtains the target decision tree model;

[0096] The rule optimization unit optimizes the rules configured for the corresponding business process nodes based on the input and output of the internal nodes that match each business process node;

[0097] The abnormal event detection module is used to detect abnormal events in business process nodes using different abnormal event detection methods;

[0098] The abnormal event detection module includes a boundary value analysis unit, a first abnormal event detection unit and a second abnormal event detection unit;

[0099] The boundary value analysis unit determines the constraint range of each business process node based on the optimization results of the rules configured through each business process node, and analyzes whether the business parameters submitted by the user to each business process node belong to the boundary value;

[0100] The first abnormal event detection unit detects abnormal events in each business process node according to the probability value of the abnormal event in each business process node;

[0101] The second abnormal event detection unit detects abnormal events in each business process node according to the data type of the business parameter submitted by the user to each business process node.

[0102] The early warning response module is used to respond to early warnings based on the detection results of abnormal events;

[0103] When an abnormal event is detected at each business process node, the early warning response module sends an early warning signal through the target business system and feeds back the detected abnormal event to the user end through the target business system.

[0104] Example 1: Assume that the business parameter h3 submitted by the user to the business process node numbered 3 is 19, the constraint range of the business process node numbered 3 is [x3, y3] = [10, 20], and w = 0.1;

[0105] Since y3*(1-w)=18≤h3≤y3=20 and the business parameter h3 is within the constraint range, it can be seen that h3 is the boundary value. In this case, model G is selected. j ={1-[(h j -x j ) / (x j *w)]}*[1-exp(uj +1-n)] predicts the probability value of an abnormal event occurring in the business process node numbered 3;

[0106] Assume that there are 10 business process nodes in the business process. When the user executes the business process node numbered 3, the total number of business process nodes that have been executed is u3=2. Then:

[0107] G3={1-[(h3-y3*(1-w)) / (y3*w)]}*[1-exp(u3+1-n)]

[0108] ={1-[(19-20*(1-0.1)) / (20*0.1)]}*[1-exp(2+1-10)]=0.5;

[0109] Since G3=0.5<0.7, it is considered that no abnormal event can be detected in the business process node numbered 3.

[0110] It should be noted that, in this document, relational terms such as first and second, etc., are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations. Moreover, the terms "comprises," "comprising," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that includes a list of elements includes not only those elements but also other elements not explicitly listed, or elements inherent to such process, method, article, or apparatus.

[0111] Finally, it should be noted that the above descriptions are merely preferred embodiments of the present invention and are not intended to limit the present invention. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art will be able to modify the technical solutions described in the aforementioned embodiments or substitute equivalents for some of the technical features. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the present invention shall be included within the scope of protection of the present invention.

Claims

1. A business process anomaly detection method based on machine learning, characterized by: The method comprises: S10: Acquire the business process of the target business system. When a user triggers a business request, acquire the business parameters submitted by the user at the business process node in real time. Combined with the rules configured for each business process node, determine whether the business parameters acquired in real time are abnormal business parameters. Based on the judgment result, selectively analyze the deviation of the analyzed business process execution path, and obtain the target abnormal business parameters based on the analysis results. S20: Based on the target abnormal business parameters and the business adjustment information of the business process, the decision tree model of the business process is trained to obtain a target decision tree model. The target decision tree model is used to optimize the rules configured for each business process node. S30: Analyze the data types of the business parameters submitted by the user to the business process node. The data types include boundary values, abnormal values, and non-boundary values. Based on the analysis results, different abnormal event detection methods are used to detect abnormal events in the business process node. The specific methods are as follows: Based on the optimization results of the rules configured by each business process node, the constraint range of each business process node is determined, and whether the business parameters submitted by the user to each business process node belong to the boundary value is judged. The boundary value judgment method is as follows: randomly select a business process node, set the constraint range of the selected business process node as [x, y], and record the business parameter submitted by the user to the selected business process node as h. If x≤h≤x*(1+w) or y*(1-w)≤h≤y, then the business parameter submitted by the user to the selected business process node is considered to be a boundary value; otherwise, the business parameter submitted by the user to the selected business process node is considered not to be a boundary value, where w is a constant and 0<w≤0.2; Ⅰ. When it is determined that the business parameter submitted by the user to the business process node numbered j is a boundary value, the constraint range of the business process node numbered j [x j ,y j ], and the business parameter h submitted by the user to the business process node numbered j j To obtain; When x j ≤h j ≤x j *(1+w), according to G j ={1-[(h j -x j ) / (x j *w)]}*[1-exp(u j +1-n)] predicts the probability value of an abnormal event occurring in the business process node numbered j; When y j *(1-w)≤h j ≤y j When, according to G j ={1-[(h j -y j *(1-w)) / (y j *w)]}*[1-exp(u j +1-n)] predicts the probability value of an abnormal event occurring in the business process node numbered j; Among them, j=1,2,…,n, represents the number corresponding to each business process node, n represents the total number of business process nodes in the business process, u j It represents the total number of business process nodes that have been completed when the user executes the business process node numbered j. exp represents the exponential function with the natural constant e as the base, e=2.72; When G j When it is >0.7, it means that an abnormal event can be detected in the business process node numbered j. The abnormal event detected by the business process node numbered j is that the user submits the business parameter h in the business process node numbered j. j , when G j When ≤0.7, it means that no abnormal event can be detected in the business process node numbered j; Ⅱ. When the user submits the business parameter h to the business process node numbered j j When it is an abnormal value, an abnormal event can be detected in the business process node numbered j. The abnormal event detected by the business process node numbered j is that the user submits the business parameter h in the business process node numbered j. j ; III. When the user submits the business parameter h to the business process node numbered j j When it is a non-boundary value, no abnormal event can be detected in the business process node numbered j; S40: The target business system performs an early warning response based on the detection result of the abnormal event.

2. The method for detecting business process anomalies based on machine learning according to claim 1, characterized in that: The S10 includes: S101: Acquire the business process of the target business system. The business process includes several business process nodes. When a user triggers a business request, the business parameters submitted by the user at the business process node are acquired in real time. If the business parameters acquired in real time do not meet the rules configured for the corresponding business process node, the business parameters acquired in real time are considered abnormal business parameters. Otherwise, the business parameters acquired in real time are considered normal business parameters. S102: Generate multiple business process execution paths based on the rules configured for each business process node. When the business parameters obtained in real time are analyzed to be normal business parameters, determine the execution path of the business process at the next moment, and record the determined execution path as the first execution path. S103: Determine the business process node where the normal business parameters are located, obtain historical business parameters submitted to the determined business process node, perform cluster analysis on the obtained historical business parameters using the K-means clustering algorithm, and obtain several historical business parameter data classes, each of which includes a cluster center. Calculate the distance between the normal business parameters and each cluster center using the Euclidean distance formula, and select the historical business parameter data class where the cluster center corresponding to the minimum distance is located as the target data class for the normal business parameters. After each historical business parameter stored in the target data class is submitted to the determined business process node, the complete execution path is obtained. When each historical business parameter is submitted to the determined business process node, the execution path of the business process at the next moment is obtained, and the obtained execution path is placed in set A. The deviation γ of the first execution path is predicted according to γ=1-K / U, where U represents the total number of execution paths stored in set A, and K represents the total number of execution paths stored in set A that are consistent with the first execution path; S104: If 0.4<γ≤1, the attributes of the business parameters obtained in real time are modified. The modification method is: the attributes of the business parameters obtained in real time are modified from normal business parameters to abnormal business parameters. If 0≤γ≤0.4, the attributes of the business parameters obtained in real time are not modified, and the business parameters subjected to the attribute modification operation are used as the target abnormal business parameters.

3. The method for detecting business process anomalies based on machine learning according to claim 2, characterized in that: The S20 includes: S201: Build a decision tree model for the business process based on the rules configured for each business process node, match the business process nodes with internal nodes set in the decision tree model, and determine whether each business process node requires business adjustment. If the business process node requires business adjustment, mark the internal node in the decision tree model that matches the business process node to be adjusted. S202: Numbering the various execution paths stored in set A. The numbering result is: i=1, 2, ..., m; m represents the total number of execution path types stored in set A. i =f i / U is calculated based on maxR i The corresponding number, when the target abnormal business parameter is submitted to the determined business process node, the target execution path of the business process at the next moment is determined, where f i Indicates the total number of execution paths of type i stored in set A, and max represents the maximum value symbol; S203: Using the business adjustment information of the business process node to be adjusted as input for the marked internal node, training the marked internal node, using the target abnormal business parameter and the target execution path as training data for the internal node matching the determined business process node, and training the internal node matching the determined business process node to obtain a target decision tree model; S204: Optimizing the rules configured for the corresponding business process nodes according to the input and output of the internal nodes that match the business process nodes.

4. The method for detecting business process anomalies based on machine learning according to claim 3, characterized in that: The S40 includes the target business system sending out an early warning signal when detecting an abnormal event at each business process node, and feeding back the detected abnormal event to the user terminal.

5. A machine learning-based business process anomaly detection system applied to the machine learning-based business process anomaly detection method according to any one of claims 1 to 4, characterized in that: The system includes a target abnormal business parameter analysis module, a rule optimization module, an abnormal event detection module and an early warning response module; The target abnormal business parameter analysis module is used to determine whether the business parameters obtained in real time are abnormal business parameters, and based on the judgment result, selectively analyze the deviation of the analyzed business process execution path, and determine the target abnormal business parameters according to the analysis result; The rule optimization module is used to train the decision tree model of the business process based on the target abnormal business parameters and the business adjustment information of the business process, and optimize the rules configured for each business process node based on the trained target decision tree model; The abnormal event detection module is used to detect abnormal events in business process nodes using different abnormal event detection methods; The early warning response module is used to perform early warning response according to the detection results of abnormal events.

6. The business process anomaly detection system based on machine learning according to claim 5, characterized in that: The target abnormal business parameter analysis module includes a business parameter judgment unit, a first execution path determination unit, a path deviation prediction unit and a target abnormal business parameter determination unit; The business parameter judgment unit judges whether the business parameter obtained in real time is a normal business parameter or an abnormal business parameter according to the judgment result of whether the business parameter obtained in real time meets the rules configured for the corresponding business process node; When the business parameter determination unit determines that the business parameter obtained in real time is a normal business parameter, the first execution path determination unit determines an execution path of the business process at the next moment according to a plurality of business process execution paths generated by the rules configured by each business process node, and the determined execution path is the first execution path; When the business parameter judgment unit determines that the business parameter obtained in real time is a normal business parameter, the path deviation prediction unit analyzes the historical business parameters submitted to the determined business process node using a K-means clustering algorithm, determines the target data class of the normal business parameter, obtains the execution path of the business process at the next moment based on the obtained completed execution path, and predicts the deviation of the first execution path using the constructed mathematical model; The target abnormal service parameter determination unit determines the target abnormal service parameter according to the prediction result of the path deviation prediction unit.

7. The business process anomaly detection system based on machine learning according to claim 6, characterized in that: The rule optimization module includes an internal node marking unit, a target execution path determination unit, a decision tree model training unit and a rule optimization unit; The internal node marking unit constructs a decision tree model of the business process according to the rules configured for each business process node, matches the business process nodes with the internal nodes set in the decision tree model, and marks the internal nodes that match the business process nodes to be adjusted in the decision tree model according to the adjustment status of the business of each business process node; The target execution path determination unit determines the target execution path of the business process at the next moment when the target abnormal business parameter is submitted to the determined business process node according to the constructed mathematical formula; The decision tree model training unit uses the business adjustment information of the business process node to be adjusted as the input of the marked internal node, trains the marked internal node, uses the target abnormal business parameter and the target execution path as the training data of the internal node matching the determined business process node, trains the internal node matching the determined business process node, and obtains the target decision tree model; The rule optimization unit optimizes the rules configured for the corresponding business process nodes according to the input and output of the internal nodes that match the business process nodes.

8. The business process anomaly detection system based on machine learning according to claim 7, characterized in that: The abnormal event detection module includes a boundary value analysis unit, a first abnormal event detection unit and a second abnormal event detection unit; The boundary value analysis unit determines the constraint range of each business process node based on the optimization result of the rules configured by each business process node, and analyzes whether the business parameters submitted by the user to each business process node belong to the boundary value; The first abnormal event detection unit detects abnormal events in each business process node based on the probability value of the abnormal event in each business process node; The second abnormal event detection unit detects abnormal events in each business process node according to the data type of the business parameter submitted by the user to each business process node.

9. The business process anomaly detection system based on machine learning according to claim 8, characterized in that: When an abnormal event is detected at each business process node, the early warning response module sends an early warning signal through the target business system, and feeds back the detected abnormal event to the user end through the target business system.

Images