Key Fault Risk Analysis Method for Financial System Drill Scenarios Based on Tree Model

Abstract

The present application relates to a method for analyzing key fault risks in a financial system exercise scenario based on a tree model. The method includes: collecting fault data of the module to be tested in the financial system during the chaos engineering fault exercise to obtain a fault data set, classifying the fault data set using a Gaussian mixture model and K-means clustering analysis method to determine the fault types to which each fault data in the fault data set belongs, using a decision tree constructed based on a random forest to analyze each fault data in the fault data set to determine the feature importance of each fault data, inputting the feature importance of each fault data into an XGBoost model for predictive analysis to obtain the risk prediction value of each fault data, and performing comprehensive analysis based on the fault types to which each fault data belongs and the risk prediction value to determine the key faults and key fault paths. The accuracy and efficiency of fault risk analysis in the financial system are improved.

Description

Technical Field

[0001] This application relates to the field of computer information processing technologies, and particularly to a method for analyzing key fault risks in a financial system drill scenario based on a tree model. Background Art

[0002] With the rapid development of fintech, financial service platforms play an increasingly important role in providing efficient and convenient financial services. These platforms usually rely on complex financial system codes to support core functions such as data management and service operation. However, the stability and reliability of financial systems face many challenges, such as service outages, network delays, data loss, etc. These faults may lead to service interruptions, degraded user experiences, and even economic losses, seriously affecting the normal operation of the platform. Therefore, financial institutions need to use advanced technical means to predict and analyze potential faults in the operation of financial systems, in order to identify key risk points and optimize system stability.

[0003] Traditional methods for analyzing financial system fault risks lack targeted analysis tools and methods for technical fault risks caused by system codes or infrastructure in financial service platforms. When dealing with such problems, existing technologies often face the following limitations: First, the problem of data islands, which makes it difficult to integrate and analyze fault data; second, insufficient data governance capabilities, making it difficult to extract valuable features from complex system logs; third, existing risk prediction models are insufficient in dealing with the complexity and uncertainty of technical faults, and it is difficult to accurately identify key faults.

[0004] Therefore, the accuracy of current methods for analyzing financial system fault risks is relatively low. Summary of the Invention

[0005] Based on this, in view of the above technical problems, it is necessary to provide a method, device, computer device, and computer-readable storage medium for analyzing key fault risks in a financial system drill scenario based on a tree model, which can improve the accuracy of the financial system fault risk analysis method.

[0006] A method for analyzing key fault risks in a financial system drill scenario based on a tree model, the method includes:

[0007] Collect the log files of the module under test in the financial system during the chaos engineering fault drill, analyze the log files, extract the fault data in the log files, and obtain a fault data set;

[0008] Classify the fault data set using the Gaussian mixture model and the K-means clustering analysis method to determine the fault types to which each fault data in the fault data set belongs;

[0009] Analyze each fault data in the fault dataset using a decision tree constructed based on a random forest to determine the feature importance of each fault data;

[0010] Input the feature importance of each fault data into the XGBoost model for predictive analysis to obtain the risk prediction values of each fault data;

[0011] Conduct a comprehensive analysis based on the fault type and risk prediction value of each fault data to determine the critical faults and output the critical fault path containing the critical faults.

[0012] In one embodiment, classifying the fault dataset using a Gaussian mixture model and K-means clustering analysis method to determine the fault type to which each fault data in the fault dataset belongs, including:

[0013] Fit each fault data in the fault dataset through a Gaussian mixture model to obtain the load vector of each fault data;

[0014] Perform K-means clustering by calculating the distance between the load vector of each fault data and the cluster center to obtain the fault type to which each fault data in the fault dataset belongs.

[0015] In one embodiment, fitting each fault data in the fault dataset through a Gaussian mixture model to obtain the load vector of each fault data, including:

[0016] The total number of fault data in the fault dataset is n. For any fault data i, where i ∈ 1, 2,..., n, denote its number of observations as , and the set of observation records as , where represents the th observation value of fault data i, represents the real number space of observation values or distribution parameters, and d is the dimension of the observation values;

[0017] Assumption 1: There are K potential true distributions , …, , …, . The observation of any fault data is sampled from one of the potential true distributions, where is the kth potential true distribution, used to describe the distribution characteristics of the observation data of the fault data; Let represent the relationship between fault data i and the potential true distribution. If the potential true distribution corresponding to fault data i is , then the observation of this fault data i satisfies , …, ~ , denoted as = k; for any k and k', k' ∈ 1, 2, …, K, k ≠ k', and are different potential true distributions, where is another potential true distribution;

[0018] Hypothesis 2: There are G Gaussian components, and the mean and variance of each Gaussian component g are , , g ∈ 1, 2, …, G; for any two Gaussian components g and g', g' ∈ 1, 2, …, G, g ≠ g', there is ≠ , ≠ ;

[0019] Hypothesis 3: The potential true distributions , …, , …, are in the space spanned by G Gaussian components; for any potential true distribution , the distribution density is expressed as , where = ( , …, ) is the weight vector of the potential true distribution with respect to G Gaussian components, and satisfies , represents the Gaussian distribution density function with , as parameters;

[0020] Considering the joint distribution of samples based on Hypotheses 1 - 3, denote the parameters related to Gaussian components as , for each fault data i (1 ≤ i ≤ n), denote the vector with respect to G Gaussian components as = ( ), satisfying , the distribution of each fault data i is represented by a mixture distribution, and the density function of the mixture distribution is , based on the probability density function of the mixture distribution, the observation corresponding probability of the fault data i is:

[0021] ;

[0022] where represents the probability density function, represents the Gaussian distribution density function;

[0023] Let the set of all failure data coefficient vectors be , then the observed information of n failure data is decomposed into two parts. The first part is the common factor represented in the form of a distribution, which is determined by the parameter Θ; the second part is the load vector represented in the form of a vector, and this second part is described by Φ;

[0024] Based on Assumptions 1 - 3, parametric modeling is performed on the generation mechanism of failure data, and the maximum likelihood estimation method is used to estimate the overall load vector Φ; the log-likelihood function of all failure data observations is:

[0025] ;

[0026] Introduce the latent variable to describe the correspondence between each observation record at the finest granularity and the Gaussian component. For the j-th observation of any failure data i , if comes from the Gaussian component g, then = 0. Denote the set of latent variables of all observations as:

[0027] ;

[0028] After introducing the set of latent variables , the log-likelihood function of all failure data observations is expressed as:

[0029] ;

[0030] where the superscript represents the transpose;

[0031] The EM algorithm is used to perform iterative optimization on . Denote the number of iterations of the EM algorithm as T, and denote the parameter estimates at the t-th iteration as and , t = 0, 1, 2…, T; the initial values of the parameter estimates are and ; In each iteration of the EM algorithm, two steps need to be executed. The first step is to calculate the conditional expectation of the log-likelihood function under the current parameter estimate, and this step is called the E-step; the second step is to find the parameter values that maximize the conditional expectation as the updated parameter estimates, and this step is called the M-step; at the t-th iteration, update the parameter estimates and to and The specific processes of the E-step and M-step that need to be executed in sequence are:

[0032] E-step: Given and find the expectation of the log-likelihood function \(l(\Theta,\Phi,\Psi)\) with respect to the set of latent variables \(\Psi\) as the objective function, which is:

[0033] ;

[0034] where, denotes the expectation;

[0035] Denote the conditional expectation of as , which is calculated through the conditional probability as:

[0036] ;

[0037] where, represents the weight of the failure data \(i\) at the \(g\)-th Gaussian component in the \(t\)-th iteration, represents the mean at the \(g\)-th Gaussian component in the \(t\)-th iteration, represents the variance at the \(g\)-th Gaussian component in the \(t\)-th iteration;

[0038] M-step: Find the parameters that maximize the objective function as the updated parameter estimates and ; The specific update formulas are obtained by solving:

[0039] ,

[0040] ,

[0041] ;

[0042] where, is the new mean of the failure data \(i\) at the \(g\)-th Gaussian component, is the new weight of the failure data \(i\) at the \(g\)-th Gaussian component, and the superscript denotes the transpose;

[0043] Iteratively repeat the E-step and M-step until the estimation converges or reaches the set termination condition, and output the final estimated values , where, is the estimated value of the mean at the \(g\)-th Gaussian component, is the estimated value of the variance at the \(g\)-th Gaussian component, is the relative importance of the failure data \(i\) at the \(g\)-th Gaussian component, and the load vector of each failure data \(i\) is .

[0044] In one embodiment, the number of Gaussian components G is determined using the Bayesian information criterion, where the Bayesian information criterion has the expression:

[0045] :

[0046] where represents the value of the log-likelihood function obtained by substituting the parameter estimates obtained through iterative optimization given that the number of Gaussian components is G, and d is the parameter dimension of each Gaussian component.

[0047] In one embodiment, analyzing each piece of fault data in the fault dataset using a decision tree constructed based on a random forest to determine the feature importance of each piece of fault data includes:

[0048] Suppose there are n pieces of fault data, I decision trees, and C categories. The Gini index of the node q of the α-th decision tree has the calculation formula:

[0049] ;

[0050] where represents the proportion of the category in the node q of the α-th decision tree, represents the proportion of the category in the node q of the α-th decision tree;

[0051] The importance of the fault data i at the node q of the α-th decision tree, that is, the change in the Gini index before and after the branching of the fault data i at the node q of the α-th decision tree is:

[0052] ;

[0053] where and represent the Gini indices of the two new nodes after branching respectively;

[0054] If the nodes where the fault data i appears in the α-th decision tree are the set Q, then the importance of the fault data i in the α-th decision tree is:

[0055] ;

[0056] Assume that there are I decision trees in the random forest. The Gini index of the fault data i in the random forest is:

[0057] ;

[0058] where is the Gini index of fault data i in the random forest;

[0059] Normalize the Gini index of fault data i in the random forest to obtain the feature importance of fault data i:

[0060] ;

[0061] where, is the feature importance of fault data i.

[0062] In one embodiment, the XGBoost model expression is:

[0063] ;

[0064] where, H represents the total number of trees generated by iterative prediction, represents a function in the function space F; is the risk prediction value of fault data i;

[0065] The objective function of the XGBoost model is:

[0066] ;

[0067] where, is the loss function, is the penalty term, and n represents the total number of fault data; the form is:

[0068] ;

[0069] where, M is the number of leaf nodes of the tree, is the weight of leaf node m, γ and τ are pre-designed hyperparameters, is the mathematical model of the t-th iteration;

[0070] The process of iteratively solving the XGBoost model is:

[0071] ;

[0072] where, is the initial risk prediction value of the XGBoost model for fault data i, is the risk prediction value of fault data i after the first iteration of the XGBoost model, is the risk prediction value of fault data i after the second iteration of the XGBoost model, is the risk prediction value of fault data i after the t-th iteration of the XGBoost model, is the mathematical model at the first iteration, is the mathematical model for the second iteration, is the mathematical model for the v-th iteration, is the risk prediction value of the fault data i after the (t - 1)-th iteration of the XGBoost model;

[0073] The objective function of the XGBoost model for the t-th iteration is:

[0074] ;

[0075] where, represents the sum of the risk prediction values of the fault data i for the previous t - 1 iterations, represents the base learning rate of the XGBoost model;

[0076] Approximate the objective function of the XGBoost model for the t-th iteration using the Taylor formula as:

[0077] ,

[0078] ;

[0079] where, is the first-order derivative of the feature importance of the fault data i; represents the second-order derivative of the feature importance of the fault data i.

[0080] In one embodiment, the comprehensive analysis based on the fault type and risk prediction value of each fault data to determine the critical fault and output the critical fault path including the critical fault includes:

[0081] According to the fault type and risk prediction value of each fault data, perform comprehensive analysis using the risk value weighting formula to obtain the final risk value of each fault data;

[0082] According to the final risk value of each fault data, determine the fault data whose final risk value exceeds the threshold, and determine the fault represented by the fault data as the critical fault, and output the critical fault path including the critical fault.

[0083] In one embodiment, the risk value weighting formula is:

[0084] ,

[0085] ;

[0086] where, is the final risk value of the fault data i, is the risk coefficient of the fault data i, is the number of failure data contained in the cluster to which the failure data i belongs. is the distance between the load vector of the failure data i and the cluster center.

[0087] A key failure risk analysis device for a financial system drill scenario based on a tree model, comprising:

[0088] A data collection module, configured to collect log files of a module under test in a financial system during a chaos engineering failure drill, analyze the log files, extract failure data from the log files, and obtain a failure data set;

[0089] A clustering module, configured to classify the failure data set using a Gaussian mixture model and K-means clustering analysis method to determine the failure types to which each failure data in the failure data set belongs;

[0090] A failure data analysis module, configured to analyze each failure data in the failure data set using a decision tree constructed based on a random forest to determine the feature importance of each failure data;

[0091] A risk prediction module, configured to input the feature importance of each failure data into an XGBoost model for prediction analysis to obtain a risk prediction value of each failure data;

[0092] A key failure analysis module, configured to perform comprehensive analysis based on the failure types and risk prediction values to which each failure data belongs, determine key failures, and output a key failure path including the key failures.

[0093] A computer device, comprising a memory and a processor, where the memory stores a computer program, and the processor implements the steps of the key failure risk analysis method for a financial system drill scenario based on a tree model when executing the computer program.

[0094] A computer-readable storage medium, on which a computer program is stored, and the computer program implements the steps of the key failure risk analysis method for a financial system drill scenario based on a tree model when executed by a processor.

[0095] The above-mentioned key fault risk analysis method, device, computer equipment and computer-readable storage medium for the financial system drill scenario based on the tree model collect the log files of the module under test in the financial system during the chaos engineering fault drill, analyze the log files, extract the fault data in the log files to obtain a fault data set, classify the fault data set using the Gaussian mixture model and the K-means clustering analysis method to determine the fault types to which the fault data in the fault data set belong, use a decision tree constructed based on a random forest to analyze the fault data in the fault data set to determine the feature importance of each fault data, input the feature importance of each fault data into the XGBoost model for predictive analysis to obtain the risk prediction values of each fault data, and perform comprehensive analysis based on the fault types and risk prediction values to which each fault data belongs to determine the key faults and output the key fault paths including the key faults. Thereby, the accuracy and efficiency of the fault risk analysis of the financial system are improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0096] Figure 1 It is a schematic flowchart of a key fault risk analysis method for a financial system drill scenario based on a tree model in an embodiment. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0097] In order to make the objectives, technical solutions and advantages of the present application clearer, the present application will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0098] In one embodiment, as Figure 1 shown, a key fault risk analysis method for a financial system drill scenario based on a tree model is provided, including the following steps:

[0099] Step S220: Collect the log files of the module under test in the financial system during the chaos engineering fault drill, analyze the log files, extract the fault data in the log files to obtain a fault data set.

[0100] Among them, the fault data is represented in a structured manner.

[0101] In one example, during the chaos engineering automated fault drill, the system data and monitoring information during the drill are captured, and the collected fault data is structured to ensure clear insight and maximum value from the fault drill.

[0102] Step S240: Classify the fault data set using the Gaussian mixture model and the K-means clustering analysis method to determine the fault types to which the fault data in the fault data set belong.

[0103] Among them, each piece of fault data in the fault dataset is clustered by K-means into similar groups or clusters, that is, each group or cluster represents a fault type.

[0104] Among them, the fault types can include service outages, network delays, data loss, and so on.

[0105] In one embodiment, the Gaussian mixture model and K-means clustering analysis method are used to classify the fault dataset to determine the fault type to which each piece of fault data in the fault dataset belongs, including:

[0106] Each piece of fault data in the fault dataset is fitted through the Gaussian mixture model to obtain the load vector of each piece of fault data; by performing K-means clustering on the distance between the load vector of each piece of fault data and the cluster center, the fault type to which each piece of fault data in the fault dataset belongs is obtained.

[0107] Among them, for clustering objects represented by distribution functions, in order to achieve the clustering and partitioning of complex data, parametric data modeling can be relied on the Gaussian mixture model. Fault data often has a complex distribution, and a feasible way to model the data distribution is to use a finite mixture model.

[0108] Among them, GMM (Gaussian Mixture Module) not only realizes the modeling of complex distributions, but also provides a vector expression based on Gaussian components for all sample observations. This expression can be further applied to clustering and classification algorithms. Consider modeling a set of independently and identically distributed samples with a GMM containing G Gaussian components, where the parameters of each Gaussian component g (1 ≤ g ≤ G) are: mean , variance , and weight .

[0109] Among them, the fault data has a hierarchical nested structure and does not satisfy the independence assumption. Therefore, on the basis of GMM, it is necessary to further design a clustering algorithm for the distribution function. First, all data observations are fitted through GMM at the observation level to obtain the vector representation of each observation. For each object, the vector representation of the clustering object is indirectly obtained through the average value of the corresponding observation vectors, so as to apply common clustering algorithms such as K-means to partition the clustering object represented by the vector representation. This method is denoted as GMM+K-means.

[0110] Among them, the process of using this clustering analysis method to divide the structured fault data into similar groups or clusters is as follows: 1. Set the fault factor model; 2. Solve the fault factor model; 3. After obtaining the load vector of each fault data according to the iterative estimation, use the K-means clustering method to obtain the clustering and partitioning results of all fault data.

[0111] After obtaining the load vector of each fault data according to the iterative estimation, the clustering division result of all fault data can be obtained through the K-means clustering method. For the k-th cluster, examine the load vectors of all samples assigned to this cluster in this round of iteration, and use the mean value of their estimated values as the vector representation of the cluster center. The cluster center obtained in this way has good representativeness for the vectors within the current cluster. After determining the cluster center in each round of iteration, the cluster center with the smallest Euclidean distance from its load vector can be found for each fault data, and the fault data can be assigned to the corresponding cluster. Repeat the iteration until convergence or the termination condition is reached to obtain the clustering division of all fault data.

[0112] In one embodiment, each fault data in the fault data set is fitted through a Gaussian mixture model to obtain the load vector of each fault data, including:

[0113] The total number of fault data in the fault data set is n. For any fault data i, i ∈ 1, 2, …, n, denote its number of observations as , and the set of observation records is , where represents the -th observation value of fault data i, represents the real number space of observation values or distribution parameters, and d is the dimension of the observation values;

[0114] Assumption 1: There are K potential true distributions , …, , …, . The observation of any fault data is sampled from one of the potential true distributions, where is the k-th potential true distribution, which is used to describe the distribution characteristics of the observed data of the fault data; let represent the relationship between fault data i and the potential true distribution. If the potential true distribution corresponding to fault data i is , then the observation of this fault data i satisfies , …, ~ , denoted as = k; for any k and k', k' ∈ 1, 2, …, K, k ≠ k', and are different potential true distributions, where is another potential true distribution;

[0115] Assumption 2: There are G Gaussian components, and the mean and variance of each Gaussian component g are , , where \(g\in1, 2, \cdots, G\); for any two Gaussian components \(g\) and \(g'\), \(g'\in1, 2, \cdots, G\), \(g\neq g'\), there is \(\neq\) , \(\neq\) ;

[0116] Hypothesis 3: The latent true distribution , \(\cdots\), , \(\cdots\), is in the space spanned by \(G\) Gaussian components; for any latent true distribution , the distribution density is expressed as , where \(=\) , \(\cdots\), is the weight vector of the latent true distribution with respect to \(G\) Gaussian components, and satisfies , represents the Gaussian distribution density function with , as parameters;

[0117] Considering the sample joint distribution based on Hypotheses 1 - 3, denote the relevant parameters of the Gaussian components as , for each fault data \(i(1\leq i\leq n)\), denote the vector with respect to \(G\) Gaussian components as \(=\) ), which satisfies , the distribution of each fault data \(i\) is represented by a mixture distribution, and the density function of the mixture distribution is , based on the probability density function of the mixture distribution, the observation corresponding probability of the fault data \(i\) is:

[0118] ;

[0119] where represents the probability density function, represents the Gaussian distribution density function;

[0120] Denote the set of all fault data coefficient vectors as , then the observation information of \(n\) fault data is decomposed into two parts. The first part is the common factor represented in the form of a distribution, and the first part is determined by the parameter \(\Theta\); the second part is the load vector represented in the form of a vector, and this second part is described by \(\varPhi\).

[0121] Among them, since this application uses the method of parametric statistics to handle the clustering problem of the distribution function, it is necessary to make assumptions about the data structure, etc., and construct a suitable clustering method based on the assumptions.

[0122] It should be understood that without considering the hierarchy between objects and observations, Hypotheses 1 and 2 are basically consistent with the general GMM hypotheses. Combining Hypothesis 1 and Hypothesis 3, it is required that the potential true distribution function is identifiable. Specifically, for any 1 ≤ k ≠ k' ≤ K, the corresponding weight vectors and are not exactly the same. The model under this hypothesis is called the fault factor model. In this fault factor model, the observation of each object (i.e., fault data) is generated by the combined action of a common factor represented by Gaussian components and a loading vector. Therefore, estimating the fault factor model can decompose the fault data information into a common factor and a loading vector, where the loading vector contains the personalized characteristics of each fault and is suitable for clustering division.

[0123] Among them, based on Hypothesis 1, for any fault data i, we can obtain . When Φ is known, for any 1 ≤ i ≠ j ≤ n, if and only if . Therefore, within the framework of the fault factor model, the core objective is to estimate the loading vector Φ of all clustering objects using the observation information. After obtaining the estimate of the loading vector, objects with similar vector representations are grouped into the same cluster, and objects with dissimilar vectors are grouped into different clusters. Since the dimension of any vector in Φ is fixed at G, after obtaining the estimate of Φ, traditional clustering methods such as K-means can be used for rapid clustering division.

[0124] Based on Hypotheses 1 - 3, parameterize the generation mechanism of fault data for modeling, and use the maximum likelihood estimation method to estimate the overall loading vector Φ; the log-likelihood function of all fault data observations is:

[0125] ;

[0126] Introduce the latent variable to describe the correspondence between each observation record at the finest granularity and Gaussian components. For the j-th observation of any fault data i, if comes from Gaussian component g, then = 0. Denote the set of latent variables of all observations as:

[0127] ;

[0128] After introducing the set of latent variables , the log-likelihood function of all fault data observations is expressed as:

[0129] ;

[0130] Among them, the superscript represents transpose;

[0131] The EM algorithm is used to perform iterative optimization. Denote the number of iterations of the EM algorithm as T, and denote the parameter estimation at the t-th iteration as and , where t = 0, 1, 2, …, T; the initial values of the parameter estimation are and ; Each iteration of the EM algorithm needs to perform two steps. The first step is to calculate the conditional expectation of the log-likelihood function under the current parameter estimation, and this step is called the E-step; the second step is to find the parameter values that maximize the conditional expectation as the updated parameter estimation, and this step is called the M-step; At the t-th iteration, update the parameter estimation and to and The specific processes of the E-step and M-step that need to be executed in sequence are as follows:

[0132] E-step: Given and , find the expectation of the log-likelihood function l(Θ, Φ, Ψ) with respect to the set of latent variables Ψ as the objective function, and this objective function is:

[0133] ;

[0134] Among them, represents expectation;

[0135] Denote the conditional expectation of as , and it is calculated through conditional probability:

[0136] ;

[0137] Among them, represents the weight of the failure data i at the t-th iteration on the g-th Gaussian component, represents the mean on the g-th Gaussian component at the t-th iteration, represents the variance on the g-th Gaussian component at the t-th iteration;

[0138] M-step: Find the parameters that maximize the objective function as the updated parameter estimation and ; The specific update formula obtained by solving is:

[0139] ,

[0140] ,

[0141] ;

[0142] wherein, is the new mean of the fault data i on the g-th Gaussian component, is the new weight of the fault data i on the g-th Gaussian component, and the superscript represents transpose;

[0143] Iteratively repeat the E-step and M-step until the estimation converges or reaches the set termination condition, and output the final estimated value , wherein, is the estimated value of the mean on the g-th Gaussian component, is the estimated value of the variance on the g-th Gaussian component, is the relative importance of the fault data i on the g-th Gaussian component, and the load vector of each fault data i .

[0144] wherein, taking the derivative of the above formula with respect to each parameter, an explicit solution of the parameter estimation cannot be obtained. Therefore, the EM algorithm is considered to obtain the parameter estimation by means of iterative optimization. To simplify the calculation of the maximum likelihood estimation, the latent variable is considered to be introduced to describe the correspondence between each observation record at the finest granularity and the Gaussian component. to describe the correspondence between each observation record at the finest granularity and the Gaussian component.

[0145] Among them, regarding the selection of the number G of Gaussian components, when a larger value is assigned to G, the data can be more fully fitted, but it may also bring more redundant parameters. The selection of G actually involves the problem of selecting the fault factor model. To balance the complexity of the fault factor model and the data fitting effect, the Bayesian Information Criterion (BIC) can be considered to help determine the appropriate number of components.

[0146] In one embodiment, the number G of Gaussian components is determined by the Bayesian Information Criterion, wherein the Bayesian Information Criterion has the following expression:

[0147] ;

[0148] wherein, represents the value of the log-likelihood function obtained by substituting the parameter estimation obtained by iterative optimization given that the number of Gaussian components is G, and d is the parameter dimension of each Gaussian component.

[0149] Among them, the smaller the BIC value, the more appropriate the corresponding G is, and a better data fitting effect can be obtained with fewer model parameters.

[0150] Step S260: Analyze each piece of fault data in the fault dataset using a decision tree constructed based on a random forest to determine the feature importance of each piece of fault data.

[0151] Among them, a random forest is a classifier that uses multiple decision trees to train and predict samples.

[0152] Among them, to solve the problem that the traditional single key fault path search algorithm based on cluster analysis is difficult to comprehensively consider in the case of multiple parameters and has poor accuracy and interpretability in complex environments, a decision tree model is also adopted to assist in analyzing fault data.

[0153] Among them, the method of using the Gini index to evaluate is used to obtain the feature importance of each piece of fault data. In a random forest, whenever a node splits, the algorithm calculates the reduction in Gini impurity through this split. The average reduction in Gini impurity of each feature split in all decision trees is used to obtain the Gini importance of this feature.

[0154] In one embodiment, analyzing each piece of fault data in the fault dataset using a decision tree constructed based on a random forest to determine the feature importance of each piece of fault data includes:

[0155] Suppose there are n pieces of fault data, I decision trees, and C categories. The Gini index of node q in the α-th decision tree The calculation formula is:

[0156] ;

[0157] Among them, represents the proportion of category in node q of the α-th decision tree, represents the proportion of category in node q of the α-th decision tree;

[0158] The importance of fault data i in node q of the α-th decision tree, that is, the change in the Gini index of fault data i before and after branching in node q of the α-th decision tree is:

[0159] ;

[0160] Among them, and respectively represent the Gini indices of the two new nodes after branching;

[0161] If the nodes where fault data i appears in the α-th decision tree are in set Q, then the importance of fault data i in the α-th decision tree is:

[0162] ;

[0163] Assume that there are I decision trees in the random forest, and the Gini index of the fault data i in the random forest is:

[0164] ;

[0165] where is the Gini index of the fault data i in the random forest;

[0166] Normalize the Gini index of the fault data i in the random forest to obtain the feature importance of the fault data i:

[0167] ;

[0168] where is the feature importance of the fault data i.

[0169] Step S280, input the feature importance of each fault data into the XGBoost model for predictive analysis to obtain the risk prediction value of each fault data.

[0170] Among them, the XGBoost algorithm of the XGBoost model is in the GBDT algorithm mode and belongs to the category of Boosting iterative and tree-based methods. The idea of this algorithm is to grow a tree through feature analysis and continuously add a tree. For each added tree, each leaf will fall to some corresponding leaf nodes, and each leaf node corresponds to a score. Therefore, the final result only needs to add up the scores corresponding to each leaf, which is the risk prediction value of the fault data.

[0171] Among them, the XGBoost algorithm adopts a step-by-step forward addition mode and does not require recalculating a certain relationship after generating a weak learner in one iteration.

[0172] In one embodiment, the XGBoost model expression is:

[0173] ;

[0174] where H represents the total number of trees generated by iterative prediction, represents a function in the function space F; is the risk prediction value of the fault data i;

[0175] The objective function of the XGBoost model is:

[0176] ;

[0177] Among them, is the loss function, is the penalty term, and n represents the total number of fault data; the form is:

[0178] ;

[0179] Among them, M is the number of leaf nodes of the tree, is the weight of leaf node m, γ and τ are pre-designed hyperparameters, is the mathematical model of the t-th iteration.

[0180] Among them, when introducing a regularization term, the calculation will select a simplified and excellent-performance mode. The rightmost regularization term in the loss function is used to control the overfitting ability of the weakest learner in each iteration, without involving the set of the last module.

[0181] The process of iteratively solving the XGBoost model is as follows:

[0182] ;

[0183] Among them, is the initial risk prediction value of the XGBoost model for fault data i, is the risk prediction value of the XGBoost model for fault data i after the first iteration, is the risk prediction value of the XGBoost model for fault data i after the second iteration, is the risk prediction value of the XGBoost model for fault data i after the t-th iteration, is the mathematical model at the first iteration, is the mathematical model at the second iteration, is the mathematical model at the v-th iteration, is the risk prediction value of the XGBoost model for fault data i after the (t - 1)-th iteration.

[0184] Among them, one iteration of the XGBoost model will form a new decision tree. The decision tree is established according to the residual with the actual value, and the established decision tree will predict the result of the first time. Thus, the prediction result of the t-th tree can be obtained, which is numerically equal to the prediction results of the previous t - 1 trees plus the performance of the t-th tree.

[0185] The objective function of the XGBoost model for the t-th iteration is:

[0186] ;

[0187] Among them, represents the sum of the risk prediction values of the previous t - 1 iterations for fault data i, Represents the base learning rate of the XGBoost model;

[0188] Approximate the objective function of the t-th iteration of the XGBoost model using Taylor's formula as:

[0189] ,

[0190] ;

[0191] Among them, is the first derivative of the feature importance of fault data i; represents the second derivative of the feature importance of fault data i.

[0192] Among them, when calculating the t-th tree of the model, the results and model structures of the previous t - 1 trees are fixed. Therefore, it can be seen that the objective function is transformed into a function about and . During the operation of the results, the accuracy of the results is determined by the error function of the samples. During the process of obtaining the final results, the regression processes are similar, and this process ends when reaching the selected values of the model structure parameters.

[0193] Step S300, perform comprehensive analysis based on the fault types and risk prediction values of each fault data, determine the key faults, and output the key fault path containing the key faults.

[0194] Among them, the key faults can be determined as the key monitoring objects under the tested module of the financial system, improving the stability of the financial system.

[0195] In one embodiment, performing comprehensive analysis based on the fault types and risk prediction values of each fault data, determining the key faults, and outputting the key fault path containing the key faults includes:

[0196] Perform comprehensive analysis according to the fault types and risk prediction values of each fault data using the risk value weighting formula to obtain the final risk value of each fault data;

[0197] According to the final risk values of each fault data, determine the fault data whose final risk value exceeds the threshold, and determine the fault represented by the fault data as the key fault, and output the key fault path containing the key fault.

[0198] Among them, the key fault is a certain fault directly locked in the log file; the key fault path is a complete fault chain with the key fault, which may include the log data before the occurrence of the key fault and the subsequent chain log data.

[0199] In one embodiment, the risk value weighting formula is:

[0200] ,

[0201] ;

[0202] Among them, is the final risk value of the fault data i, is the risk coefficient of the fault data i, is the number of fault data included in the cluster to which the fault data i belongs, is the distance between the load vector of the fault data i and the cluster center.

[0203] The above key fault risk analysis method for the financial system drill scenario based on the tree model collects the log files of the modules under test in the financial system during the chaos engineering fault drill, analyzes the log files, extracts the fault data in the log files to obtain a fault data set, classifies the fault data set using the Gaussian mixture model and the K-means clustering analysis method to determine the fault types to which each fault data in the fault data set belongs, uses the decision tree constructed based on the random forest to analyze each fault data in the fault data set to determine the feature importance of each fault data, inputs the feature importance of each fault data into the XGBoost model for predictive analysis to obtain the risk prediction value of each fault data, and conducts a comprehensive analysis based on the fault type and risk prediction value to which each fault data belongs to determine the key faults and output the key fault path including the key faults. Thus, the accuracy and efficiency of the fault risk analysis of the financial system are improved.

[0204] It should be understood that although Figure 1 the steps in the flowchart of Figure 1 are shown in sequence according to the arrows, these steps do not necessarily execute in the order indicated by the arrows. Unless otherwise clearly stated in this article, there is no strict order restriction for the execution of these steps, and these steps can be executed in other orders. Moreover,

[0205] At least a part of the steps in

[0206] A data collection module, which is used to collect the log files of the module under test in the financial system during the chaos engineering fault drill, analyze the log files, extract the fault data in the log files, and obtain a fault data set.

[0207] A clustering module, which is used to classify the fault data set by using the Gaussian mixture model and the K-means clustering analysis method, and determine the fault types to which each fault data in the fault data set belongs.

[0208] A fault data analysis module, which is used to analyze each fault data in the fault data set by using a decision tree constructed based on a random forest, and determine the feature importance of each fault data.

[0209] A risk prediction module, which is used to input the feature importance of each fault data into the XGBoost model for predictive analysis, and obtain the risk prediction values of each fault data.

[0210] A critical fault analysis module, which is used to perform comprehensive analysis according to the fault types to which each fault data belongs and the risk prediction values, determine the critical faults, and output a critical fault path including the critical faults.

[0211] The above-mentioned critical fault risk analysis device for the financial system drill scenario based on the tree model collects the log files of the module under test in the financial system during the chaos engineering fault drill, analyzes the log files, extracts the fault data in the log files, obtains a fault data set, classifies the fault data set by using the Gaussian mixture model and the K-means clustering analysis method, determines the fault types to which each fault data in the fault data set belongs, analyzes each fault data in the fault data set by using a decision tree constructed based on a random forest, determines the feature importance of each fault data, inputs the feature importance of each fault data into the XGBoost model for predictive analysis, obtains the risk prediction values of each fault data, performs comprehensive analysis according to the fault types to which each fault data belongs and the risk prediction values, determines the critical faults, and outputs a critical fault path including the critical faults. Thereby, the accuracy and efficiency of the fault risk analysis of the financial system are improved.

[0212] For the specific limitations of the above-mentioned critical fault risk analysis device for the financial system drill scenario based on the tree model, reference can be made to the limitations of the critical fault risk analysis method for the financial system drill scenario based on the tree model in the above text, which will not be elaborated here. Each module in the above-mentioned critical fault risk analysis device for the financial system drill scenario based on the tree model can be implemented in whole or in part by software, hardware and their combinations. The above-mentioned modules can be embedded in the processor of the computer device in the form of hardware or be independent of it, or can be stored in the memory of the computer device in the form of software, so that the processor can call and execute the operations corresponding to the above-mentioned modules.

[0213] In one embodiment, a computer device is provided, including a memory and a processor. The memory stores a computer program, and when the processor executes the computer program, the steps of the above-mentioned key fault risk analysis method for the financial system drill scenario based on the tree model are implemented.

[0214] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps of the above-mentioned key fault risk analysis method for the financial system drill scenario based on the tree model are implemented.

[0215] Those of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing relevant hardware through a computer program. The computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned various methods. Among them, any reference to a memory, storage, database, or other medium used in the various embodiments provided in the present application can include non-volatile and / or volatile memories. Non-volatile memories can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memories can include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in many forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDR SDRAM), enhanced SDRAM (ESDRAM), synchronous link DRAM (SLDRAM), Rambus direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and Rambus dynamic RAM (RDRAM), etc.

[0216] The technical features of the above embodiments can be combined arbitrarily. For the sake of brevity of description, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, it should be considered as the scope described in this specification.

[0217] The above-described embodiments merely represent several implementation manners of the present application. Their descriptions are relatively specific and detailed, but they should not be construed as limiting the scope. It should be noted that for those of ordinary skill in the art, without departing from the concept of the present application, several modifications and improvements can still be made, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the appended claims.

Claims

1. A key fault risk analysis method for financial system drill scenarios based on a tree model, characterized in that The key fault risk analysis method for the financial system drill scenario based on the tree model includes: Collect the log files of the module under test in the financial system during the chaos engineering fault drill, analyze the log files, extract the fault data from the log files, and obtain a fault data set; Classify the fault data set using the Gaussian mixture model and the K-means clustering analysis method to determine the fault types to which each fault data in the fault data set belongs; Analyze each fault data in the fault data set using a decision tree constructed based on a random forest to determine the feature importance of each fault data; Input the feature importance of each fault data into the XGBoost model for predictive analysis to obtain the risk prediction value of each fault data; Conduct a comprehensive analysis based on the fault types and risk prediction values to which each fault data belongs, determine the key faults, and output the key fault path containing the key faults; The comprehensive analysis based on the fault types and risk prediction values to which each fault data belongs, determining the key faults, and outputting the key fault path containing the key faults includes: Conduct a comprehensive analysis using the risk value weighting formula based on the fault types and risk prediction values to which each fault data belongs to obtain the final risk value of each fault data; Based on the final risk values of each fault data, determine the fault data whose final risk value exceeds the threshold, and determine the fault represented by the fault data as the key fault, and output the key fault path containing the key fault; The risk value weighting formula is: ， ； Among them, is the final risk value of the fault data i, is the risk coefficient of the fault data i, is the number of fault data included in the cluster to which the fault data i belongs, is the distance between the load vector of the fault data i and the cluster center.

2. The key fault risk analysis method for the financial system drill scenario based on the tree model according to claim 1, characterized in that The classification of the fault data set using the Gaussian mixture model and the K-means clustering analysis method to determine the fault types to which each fault data in the fault data set belongs includes: Fit each fault data in the fault data set through the Gaussian mixture model to obtain the load vector of each fault data; Perform K-means clustering on the distance between the load vector of each fault data and the cluster center to obtain the fault types to which each fault data in the fault data set belongs.

3. The key fault risk analysis method for the financial system drill scenario based on the tree model according to claim 2, wherein The fitting of each fault data in the fault data set through the Gaussian mixture model to obtain the load vector of each fault data includes: The total number of fault data in the fault data set is n. For any fault data i, where i ∈ 1, 2, …, n, let its number of observations be , and the set of observation records be , where represents the -th observation value of the fault data i, represents the real number space of the observation value or distribution parameter, and d is the dimension of the observation value; Hypothesis 1: There exist K potential true distributions , …, …, . The observation of any fault data is sampled from one of these potential true distributions. Among them, is the k-th potential true distribution, which is used to describe the distribution characteristics of the observed data of the fault data. Let represent the relationship between fault data i and the potential true distribution. If the potential true distribution corresponding to fault data i is , then the observation of this fault data i satisfies ,…, ~ , denoted as = k. For any k and k', k' ∈ 1, 2, …, K, k ≠ k', and are different potential true distributions. Among them, is another potential true distribution; Hypothesis 2: There exist G Gaussian components, and the mean and variance of each Gaussian component g are , , where g ∈ 1, 2, …, G; for any two Gaussian components g and g', with g' ∈ 1, 2, …, G and g ≠ g', we have ≠ , ≠ ; Hypothesis 3: Latent True Distribution , …, …, in the space spanned by G Gaussian components; for any latent true distribution , the distribution density is denoted as , where =( ,…, ) is the weight vector of the latent true distribution with respect to G Gaussian components and satisfies , denotes the Gaussian distribution density function with , as parameters; Considering the sample joint distribution based on Hypotheses 1 - 3, let the Gaussian component - related parameters be , for each fault data \(i\) (\(1\leq i\leq n\)), let the vector regarding \(G\) Gaussian components be = (\( \)), satisfying . The distribution of each fault data \(i\) is represented by a mixture distribution, and the probability density function of the mixture distribution is . Based on the probability density function of the mixture distribution, the corresponding probability of the observation of fault data \(i\) is: ； Among them, represents a probability density function, represents a Gaussian distribution density function; Let the set of all failure data coefficient vectors be , then the observed information of n failure data is decomposed into two parts. The first part is the common factor represented in a distribution form, and the first part is determined by the parameter Θ; the second part is the load vector represented in a vector form, and the second part is described by Φ; Based on Hypotheses 1 to 3, parametric modeling of the failure data generation mechanism is carried out, and the maximum likelihood estimation method is used to estimate the overall load vector Φ; the log-likelihood function of all failure data observations is as follows: ； Introduce latent variables to describe the correspondence between each observation record at the finest granularity and Gaussian components. For the j-th observation of any fault data i , if comes from Gaussian component g, then = 0. Denote the set of latent variables of all observations as: ； Introduce a set of latent variables After that, the log-likelihood function of all failure data observations Is expressed as: ； Among them, the superscript represents transpose; Use the EM algorithm to perform iterative optimization. Denote the number of iterations of the EM algorithm as T, and denote the parameter estimates at the t-th iteration as and , where t = 0, 1, 2, …, T; the initial values of the parameter estimates are and ; Each iteration of the EM algorithm needs to perform two steps. The first step is to calculate the conditional expectation of the log-likelihood function under the current parameter estimates. This step is called the E-step; the second step is to find the parameter values that maximize the conditional expectation as the updated parameter estimates. This step is called the M-step; At the t-th iteration, update the parameter estimates and to and The specific processes of the E-step and M-step that need to be executed in sequence are as follows: E-step: Given and when, find the expectation of the log-likelihood function \(l(\Theta,\Phi,\Psi)\) with respect to the set of latent variables \(\Psi\) as the objective function, and this objective function is: ； Among them, is expressed as expected; Denote the conditional expectation of as , which is calculated through conditional probability as follows: ； Among them, represents the weight of the failure data i at the t-th iteration on the g-th Gaussian component, represents the mean on the g-th Gaussian component at the t-th iteration, represents the variance on the g-th Gaussian component at the t-th iteration; M-step: Find the parameters that maximize the objective function as the updated parameter estimates and ; The specific update formula obtained by solving is: ， ， ； wherein, is the new mean of the fault data i on the g-th Gaussian component, is the new weight of the fault data i on the g-th Gaussian component, and the superscript represents transpose; Iteratively repeat the E-step and M-step until the estimation converges or reaches the set termination condition, and output the final estimated value , where is the estimated value of the mean on the g-th Gaussian component, is the estimated value of the variance on the g-th Gaussian component, is the relative importance of the fault data i on the g-th Gaussian component, and the load vector of each fault data i .

4. The key fault risk analysis method for the financial system drill scenario based on the tree model according to claim 1, wherein The analysis of each fault data in the fault data set using a decision tree constructed based on a random forest to determine the feature importance of each fault data includes: There are n fault data, I decision trees, and C categories. The Gini index of node q in the α-th decision tree is calculated by the formula: ； Among them, represents the proportion of class in node q of the α-th decision tree, represents the proportion of class in node q of the α-th decision tree; The importance of fault data i at node q of the α-th decision tree, that is, the change in the Gini index before and after the branch of fault data i at node q of the α-th decision tree is: ； Among them, and respectively represent the Gini indices of the two new nodes after branching; If the nodes where the fault data i appears in the α-th decision tree are the set Q, then the importance of the fault data i in the α-th decision tree is as follows: ； Assume that there are I decision trees in the random forest, and the Gini index of fault data i in the random forest is: ； Among them, is the Gini index of the fault data i in the random forest; Normalize the Gini index of fault data i in the random forest to obtain the feature importance of fault data i: ； Among them, is the feature importance of the fault data i.

5. The key fault risk analysis method for the financial system drill scenario based on the tree model according to claim 4, wherein The XGBoost model expression is: ； where H represents the total number of trees generated by iterative prediction, represents a function in the function space F; is the risk prediction value of the fault data i; The objective function of the XGBoost model is as follows: ； Among them, is the loss function, is the penalty term, and n represents the total number of fault data; the form is: ； where M is the number of leaf nodes of the tree, is the weight of leaf node m, and γ and τ are pre-designed hyperparameters, is the mathematical model at the t-th iteration; The process of iteratively solving the XGBoost model is: ； Among them, is the initial risk prediction value of the XGBoost model for fault data i, is the risk prediction value of the XGBoost model for fault data i after the first iteration, is the risk prediction value of the XGBoost model for fault data i after the second iteration, is the risk prediction value of the XGBoost model for fault data i after the t-th iteration, is the mathematical model at the first iteration, is the mathematical model at the second iteration, is the mathematical model at the v-th iteration, is the risk prediction value of the XGBoost model for fault data i after the (t - 1)-th iteration; The objective function of the XGBoost model for the t-th iteration is as follows: ； Among them, represents the sum of the risk prediction values of the fault data i in the previous t−1 iterations, represents the base learning rate of the XGBoost model; Approximate the objective function of the t-th iteration of the XGBoost model using the Taylor formula as: ， ； Among them, is the first derivative of the feature importance of fault data i; represents the second derivative of the feature importance of fault data i.

6. A key fault risk analysis device for a financial system drill scenario based on a tree model, characterized in that, Including: A data collection module, which is used to collect the log files of the module under test in the financial system during the chaos engineering fault drill, analyze the log files, extract the fault data in the log files, and obtain a fault data set; A clustering module, which is used to classify the fault data set by using the Gaussian mixture model and the K-means clustering analysis method, and determine the fault types to which each fault data in the fault data set belongs; A fault data analysis module, which is used to analyze each fault data in the fault data set by using a decision tree constructed based on a random forest to determine the feature importance of each fault data; A risk prediction module, which is used to input the feature importance of each fault data into an XGBoost model for predictive analysis to obtain the risk prediction value of each fault data; A critical fault analysis module, which is used to comprehensively analyze according to the fault types and risk prediction values to which each fault data belongs, determine the critical faults, and output a critical fault path including the critical faults; The comprehensive analysis according to the fault types and risk prediction values to which each fault data belongs, determining the critical faults, and outputting a critical fault path including the critical faults includes: According to the fault types and risk prediction values to which each fault data belongs, a risk value weighting formula is used for comprehensive analysis to obtain the final risk value of each fault data; According to the final risk value of each fault data, determine the fault data whose final risk value exceeds the threshold, and determine the fault represented by the fault data as a critical fault, and output a critical fault path including the critical fault; The risk value weighting formula is: ， ； Among them, is the final risk value of the fault data i, is the risk coefficient of the fault data i, is the number of fault data included in the cluster to which the fault data i belongs, is the distance between the load vector of the fault data i and the cluster center.

7. A computer device, comprising a memory and a processor, the memory storing a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the key fault risk analysis method for the financial system drill scenario based on the tree model according to any one of claims 1 to 5.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the steps of the key fault risk analysis method for the financial system drill scenario based on the tree model according to any one of claims 1 to 5.

Images