Abnormity detection method and device for transaction object

Abstract

The embodiment of the invention provides a transaction object anomaly detection method and device, which can be applied to the technical field of computers, and in the method, M transaction elements are divided into N transaction dimensions, the transaction elements contained in the N transaction dimensions are combined to obtain L transaction objects, and for each selected transaction object, the transaction elements contained in the N transaction dimensions are combined to obtain L transaction objects. And determining an anomaly detection result of the transaction object based on the respective target transaction data of the transaction object in the plurality of detection periods. The different transaction objects are refined based on the transaction dimensions and the transaction elements, the anomaly detection result is obtained based on the target transaction data of the different transaction objects, and compared with an anomaly detection method in which the same alarm threshold is adopted for all the transaction objects, the method is more targeted, and the detection efficiency is improved. In this way, the accuracy of anomaly detection of small-transaction-volume transaction objects is ensured, meanwhile, the anomaly detection result is obtained in combination with the target transaction data of the multiple detection time periods, and the accuracy of anomaly detection is further improved.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of computer technology, and in particular, to a method and device for detecting anomalies of trading objects. Background Art

[0002] In the daily operation of trading institutions, especially in trading scenarios after production changes, in order to maintain the stability of trading objects, it is usually necessary to detect anomalies of trading objects, specifically involving the detection of various aspects such as trading volume, success rate, and trading latency of trading objects. In related technologies, the trading platform periodically collects the overall trading volume of all trading objects in a fixed time period, and then takes the difference from the overall trading volume of the previous period. Then, based on the difference, the change rate is calculated, and the obtained change rate is compared with the alarm threshold to determine whether to trigger an alarm and emergency processing.

[0003] However, for some inactive trading objects, such as the low-frequency trading scenario in the early morning period; the trading volume of these trading objects is low, then the proportion of the trading volume of these trading objects in the overall trading volume is low, so it is difficult to detect the anomalies of such trading objects using the above anomaly detection method, thereby reducing the accuracy of anomaly detection of trading objects. Summary of the Invention

[0004] The embodiments of the present invention provide a method and device for detecting anomalies of trading objects, which are used to improve the accuracy of anomaly detection of trading objects and ensure the stability of the daily operation of trading institutions.

[0005] On the one hand, the embodiments of the present application provide a method for detecting anomalies of trading objects, and the method includes:

[0006] Obtain M trading elements, divide the M trading elements into N trading dimensions, each trading dimension includes at least one trading element, N and M are positive integers, and N is less than M;

[0007] Combine the trading elements included in the N trading dimensions to obtain L trading objects, each trading object includes N trading elements, and the N trading elements are obtained from the N trading dimensions, and L is a positive integer;

[0008] For each selected trading object, obtain the anomaly detection result of the trading object based on the target trading data of the trading object in multiple detection periods.

[0009] Optionally, the obtaining the anomaly detection result of the trading object based on the target trading data of the trading object in multiple detection periods includes:

[0010] For each of the multiple detection periods, the following operations are performed respectively: Based on the historical transaction data of the transaction object within one detection period, determine the alarm threshold corresponding to the one detection period; Based on the target transaction data of the transaction object within the one detection period and the alarm threshold corresponding to the one detection period, obtain the sub-detection result of the transaction object within the one detection period;

[0011] Based on the sub-detection results corresponding to each of the multiple detection periods, obtain the anomaly detection result of the transaction object.

[0012] Optionally, the determining the alarm threshold corresponding to the one detection period based on the historical transaction data of the transaction object within the one detection period includes:

[0013] Determine the standard deviation of the historical transaction data of the transaction object within one detection period;

[0014] Based on the standard deviation and a preset dynamic coefficient, determine the alarm threshold corresponding to the one detection period.

[0015] Optionally, the obtaining the sub-detection result of the transaction object within the one detection period includes:

[0016] If the target transaction data of the transaction object within the one detection period is greater than the alarm threshold corresponding to the one detection period, the sub-detection result is locally abnormal;

[0017] If the target transaction data of the transaction object within the one detection period is not greater than the alarm threshold corresponding to the one detection period, the sub-detection result is locally normal.

[0018] Optionally, the obtaining the anomaly detection result of the transaction object based on the sub-detection results corresponding to each of the multiple detection periods includes:

[0019] For the sub-detection results corresponding to each of the multiple detection periods, calculate the anomaly ratio of the transaction object within the multiple detection periods;

[0020] If the anomaly ratio is greater than or equal to a preset threshold, the anomaly detection result of the transaction object is abnormal; otherwise, the anomaly detection result of the transaction object is normal.

[0021] Optionally, the target transaction data is at least one of the following:

[0022] The number of failed transactions, the number of successful transactions, the transaction success rate, the transaction delay.

[0023] On the one hand, an embodiment of the present application provides an anomaly detection device for a transaction object, and the device includes:

[0024] An acquisition module, configured to acquire M trading elements, divide the M trading elements into N trading dimensions, each trading dimension includes at least one trading element, N and M are positive integers, and N is less than M;

[0025] Combine the trading elements included in the N trading dimensions to obtain L trading objects, each trading object includes N trading elements, and the N trading elements are obtained from the N trading dimensions, and L is a positive integer;

[0026] A processing module, configured to obtain an anomaly detection result of each selected trading object based on the target trading data of the trading object in multiple detection periods.

[0027] Optionally, the processing module is specifically configured to:

[0028] For each of the multiple detection periods, perform the following operations respectively: determine an alarm threshold corresponding to the one detection period based on the historical trading data of the trading object in the one detection period; obtain a sub-detection result of the trading object in the one detection period based on the target trading data of the trading object in the one detection period and the alarm threshold corresponding to the one detection period;

[0029] Obtain an anomaly detection result of the trading object based on the sub-detection results corresponding to the multiple detection periods.

[0030] Optionally, the processing module is specifically configured to:

[0031] Determine the standard variance of the historical trading data of the trading object in one detection period;

[0032] Determine the alarm threshold corresponding to the one detection period based on the standard variance and a preset dynamic coefficient.

[0033] Optionally, the processing module is specifically configured to:

[0034] If the target trading data of the trading object in the one detection period is greater than the alarm threshold corresponding to the one detection period, the sub-detection result is locally abnormal;

[0035] If the target trading data of the trading object in the one detection period is not greater than the alarm threshold corresponding to the one detection period, the sub-detection result is locally normal.

[0036] Optionally, the processing module is specifically configured to:

[0037] Calculate the abnormal ratio of the trading object in the multiple detection periods for the sub-detection results corresponding to the multiple detection periods respectively;

[0038] If the abnormal ratio is greater than or equal to a preset threshold, the abnormal detection result of the trading object is abnormal; otherwise, the abnormal detection result of the trading object is normal.

[0039] On the one hand, an embodiment of the present application provides a computer device, including:

[0040] A memory for storing program instructions;

[0041] A processor for calling the program instructions stored in the memory and executing the steps of the above-mentioned abnormal detection method of the trading object according to the obtained program.

[0042] On the one hand, an embodiment of the present application provides a computer-readable storage medium storing a computer program executable by a computer device. When the program runs on the computer device, the computer is enabled to execute the steps of the above-mentioned abnormal detection method of the trading object.

[0043] On the one hand, an embodiment of the present application provides a computer program product, including a computer program stored on a computer-readable storage medium. The computer program includes program instructions. When the program instructions are executed by a computer device, the computer device is enabled to execute the steps of the above-mentioned abnormal detection method of the trading object.

[0044] In the embodiment of the present application, by dividing M trading elements into N trading dimensions, combining the trading elements included in the N trading dimensions to obtain L trading objects, and for each selected trading object, determining the abnormal detection result of the trading object based on the target trading data of the trading object in multiple detection periods respectively. The present application refines different trading objects based on trading dimensions and trading elements, and obtains abnormal detection results based on the target trading data of different trading objects respectively. Compared with the prior art's abnormal detection method that uses the same set of warning thresholds for all trading objects, the present application is more targeted, which ensures the accuracy of abnormal detection of trading objects with small trading volumes. At the same time, by setting multiple detection periods and obtaining abnormal detection results based on the target trading data of multiple detection periods, the accuracy of abnormal detection is further improved. Secondly, the present application first divides M trading elements into N trading dimensions, and then combines the N trading dimensions to obtain L trading objects. Compared with directly combining a large number of trading elements, it avoids the explosion of the number of trading objects, reduces the number of detection results, is more convenient to maintain, and ensures the stability of the daily operation of trading institutions. Description of the Drawings

[0045] To more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for description in the embodiments. Obviously, the drawings in the following description are only some embodiments of the present invention. For those of ordinary skill in the art, without creative efforts, other drawings can be obtained based on these drawings.

[0046] Figure 1 It is a schematic structural diagram of a system architecture provided by an embodiment of the present application;

[0047] Figure 2 It is a schematic flowchart of a method for detecting anomalies of a transaction object provided by an embodiment of the present application;

[0048] Figure 3 It is a schematic flowchart of a method for detecting anomalies of a transaction object provided by an embodiment of the present application;

[0049] Figure 4 It is a schematic structural diagram of a device for detecting anomalies of a transaction object provided by an embodiment of the present application;

[0050] Figure 5 It is a schematic structural diagram of a computer device provided by an embodiment of the present application. Detailed implementation manners

[0051] In order to make the objectives, technical solutions and beneficial effects of the present invention clearer and more understandable, the present invention will be further described in detail below in conjunction with the drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention. All other embodiments obtained by those of ordinary skill in the art based on the embodiments of the present invention without creative efforts fall within the scope of protection of the present invention.

[0052] It should be noted that the brief description of the terms in the present application is only for the convenience of understanding the following described embodiments, rather than intending to limit the embodiments of the present application. Unless otherwise specified, these terms should be understood in their ordinary and general meanings.

[0053] The terms "first", "second", "third", etc. in the description, claims and the above drawings of the present application are used to distinguish similar or like objects or entities, and do not necessarily mean to limit a specific order or sequence, unless otherwise noted. It should be understood that such terms can be interchanged under appropriate circumstances.

[0054] The terms "comprising" and "having" and any variations thereof are intended to cover inclusion without exclusivity. For example, a product or device comprising a series of components need not be limited to all the components clearly listed, but may include other components not clearly listed or inherent to such product or device.

[0055] The term "module" refers to any known or later-developed hardware, software, firmware, artificial intelligence, fuzzy logic, or a combination of hardware and / or software code that can perform functions related to that element.

[0056] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of this application and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that they can still modify the technical solutions described in the foregoing embodiments, or perform equivalent replacements for some or all of the technical features. And these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of this application.

[0057] The following briefly introduces the system architecture diagram applicable to the technical solutions of the embodiments of this application. It should be noted that the following introduced processes are only used to illustrate the embodiments of this application and are not intended to limit them.

[0058] Reference Figure 1 , which is a system architecture diagram applicable to the embodiments of this application. The system architecture at least includes a terminal device 101 and a server 102. The number of terminal devices 101 can be one or more, and the number of servers 102 can also be one or more. This application does not make specific limitations on the number of terminal devices 101 and servers 102.

[0059] The terminal device 101 is pre-installed with an application with an anomaly detection function. The application can be a client application, a web application, a mini-program application, etc. The terminal device 101 can be a smart phone, a tablet computer, a laptop computer, a desktop computer, a smart home appliance, a smart voice interaction device, a smart vehicle-mounted device, etc., but is not limited thereto.

[0060] The server 102 is the background server of the application. The server 102 can be an independent physical server, or a server cluster or distributed system composed of multiple physical servers. It can also be a cloud server providing basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, Content Delivery Network (CDN), and big data and artificial intelligence platforms, but is not limited thereto.

[0061] It should be noted that the method in the embodiments of the present application can be executed independently by the terminal device 101 or the server 102, or can be jointly executed by the terminal device 101 and the server 102.

[0062] In the embodiments of the present application, the terminal device 101 and the server 102 can be directly or indirectly communicatively connected through one or more networks. The network can be a wired network or a wireless network. For example, the wireless network can be a mobile cellular network or a Wireless-Fidelity (WIFI) network. Of course, it can also be other possible networks, and the embodiments of the present application do not limit this.

[0063] Based on Figure 1 the system architecture diagram shown below, the embodiments of the present application provide a process of an abnormal detection method for trading objects. The process of this method can be executed by Figure 1 the terminal device 101 shown below, or can be executed by the server 102, or can also be executed by the interaction between the terminal device 101 and the server 102. As Figure 2 shown below, it includes the following steps:

[0064] Step 201, obtain M trading elements, and divide the M trading elements into N trading dimensions. Each trading dimension includes at least one trading element. N and M are positive integers, and N is less than M.

[0065] Specifically, trading elements refer to the key components or conditions in multiple aspects such as the buyer and seller, trading object, price, payment method, etc. involved in the trading process. The M trading elements are divided into the following five trading dimensions: central identifier, institution identifier, transaction type, response code, and other elements.

[0066] Among them, the central identifier includes: subsystem identifier; the institution identifier includes: acceptance institution identification code, sending institution identification code, receiving institution identification code, routing institution identification code, issuing institution identification code, acquiring bank identification code, foreign card acquiring bank identification code, affiliated branch code, etc.; the transaction type includes: system transaction code, institution access type, transaction channel, transaction mode; the response code includes: internal error reason code, issuing institution response code, requesting party response code, internal response code; other elements include: merchant type, card type, card nature, acceptance area code, default currency code, card medium, card organization code, country code, service point input method code, service point pin acquisition code, etc.

[0067] In the present application, it is found through testing that adopting 4 out of 5 trading dimensions can ensure the successful execution of the abnormal detection method for trading objects. Therefore, the present application takes four trading dimensions as an example to elaborate the technical solution. It should be noted that the following introduced process is only used to illustrate the embodiments of the present application rather than limit them.

[0068] Step 202: Combine the transaction elements included in N transaction dimensions to obtain L transaction objects. Each transaction object includes N transaction elements, and the N transaction elements are obtained from the N transaction dimensions. L is a positive integer.

[0069] Specifically, select one transaction element from each transaction dimension, so that N transaction elements can be obtained. Combining the N transaction elements is a transaction object.

[0070] Step 203: For each selected transaction object, obtain the anomaly detection result of the transaction object based on the target transaction data of the transaction object in multiple detection periods.

[0071] Specifically, among the L transaction objects, there are transaction objects in high-frequency trading scenarios, transaction objects in low-frequency trading scenarios (i.e., transaction objects with small trading volumes), and may also include transaction objects in other trading scenarios.

[0072] For low-frequency trading scenarios, transaction objects with trading volumes and / or trading frequencies lower than a preset threshold can be determined from the L transaction objects according to the transaction dimension of transaction type or the time period when the transaction occurs.

[0073] For example, in the transaction dimension of transaction type, if the transaction element of transaction channel is an external card channel (such as cross-border payment) for a transaction object, then the transaction object is a transaction object in a low-frequency trading scenario. Another example is that if the trading volume of a transaction object is small during the early morning period, such as 01:00 - 05:00, it can also be classified as a transaction object in a low-frequency trading scenario.

[0074] Subsequently, transaction objects in low-frequency trading scenarios can be selected from the L transaction objects for anomaly detection, or the L transaction objects can be subjected to anomaly detection.

[0075] In the embodiments of the present application, representative transaction elements are combined according to multiple transaction dimensions, transaction elements, and transaction time, reducing unnecessary transaction dimensions. Moreover, by specifically selecting transaction objects for anomaly detection, blindly performing anomaly detection on all transaction objects is avoided, effectively improving the accuracy and efficiency of anomaly detection for transaction objects with small trading volumes. For each selected transaction object, check the target transaction data of each transaction object in multiple detection periods, and obtain the anomaly detection result of each transaction object according to the anomaly situation of the transaction data.

[0076] Specifically, the duration of the detection period can be set according to the actual situation. For example, the multiple detection periods can be 1 hour, 2 hours,..., 24 hours, and the present application does not make specific limitations.

[0077] In some embodiments, the target transaction data is at least one of the following: the number of failed transactions, the number of successful transactions, the transaction success rate, and the transaction latency.

[0078] Specifically, the transaction latency refers to the time delay experienced from the initiation of a transaction request to the completion of the transaction when conducting a transaction, and is used to measure the response time and processing time during the transaction process.

[0079] In the actual anomaly detection process of the technical solution of this application, for transaction objects with small trading volumes, anomaly detection is performed on all four types of target transaction data: the number of failed transactions, the number of successful transactions, the transaction success rate, and the transaction latency. It is found that during peak trading periods such as 09:00 - 10:00, 10:00 - 11:00, 11:00 - 12:00, 12:00 - 13:00, 14:00 - 15:00, 15:00 - 16:00, 16:00 - 17:00, the anomaly detection results of the three target transaction data: the number of successful transactions, the transaction success rate, and the transaction latency are all normal, while the anomaly of the target transaction data of the number of failed transactions can be detected in a timely manner. This shows that compared with other target transaction data, the anomaly detection effect of the number of failed transactions is more obvious, and it can better predict and prevent potential risks of transaction objects with small trading volumes.

[0080] However, in different financial operations, the number of successful transactions, the transaction success rate, and the transaction latency are still important indicators for measuring transaction objects. Therefore, in the actual application process of the technical solution of this application, analyzing the patterns and trends of the occurrence of anomalies in the number of failed transactions is conducive to improving the detection accuracy and timeliness of anomalies in the number of failed transactions; comprehensively considering factors such as the number of successful transactions, the transaction success rate, and the transaction latency of multiple target transaction data, and continuously optimizing the anomaly inspection methods and processes to improve the level of risk management.

[0081] In some embodiments, for multiple detection periods, the following operations are respectively performed: based on the historical transaction data of a transaction object within a detection period, determine the alarm threshold corresponding to a detection period; based on the target transaction data of a transaction object within a detection period and the alarm threshold corresponding to a detection period, obtain the sub - detection result of the transaction object within a detection period; based on the sub - detection results corresponding to each of the multiple detection periods, obtain the anomaly detection result of the transaction object.

[0082] Specifically, a detection period of a transaction object can be a time interval with a relatively small time span such as 10 minutes or 15 minutes. The historical transaction data of a transaction object within a detection period can be set according to the actual situation, such as the historical transaction data of the past 20 days or 30 days, and this application does not make specific limitations.

[0083] For example, assume a detection period is 10 minutes (which can be selected as 10:00 - 10:10), then obtain the historical transaction data of the trading object during the detection period of 10:00 - 10:10 in the past 30 days to determine the alarm threshold corresponding to this detection period; based on the alarm threshold of this detection period and the target transaction data of the trading object, determine the sub-detection result of the trading object during this detection period.

[0084] In some embodiments, determine the standard deviation of the historical transaction data of the trading object during a detection period; based on the standard deviation and a preset dynamic coefficient, determine the alarm threshold corresponding to a detection period.

[0085] Specifically, the calculation formula of the standard deviation is shown in the following formula (1):

[0086]

[0087] Where s represents the standard deviation of the historical transaction data during a detection period; N represents the number of historical transaction data; x i represents the i-th historical transaction data; represents the average value of N historical transaction data.

[0088] It is also possible to calculate the average value, variance, etc. of the historical transaction data of the trading object during a detection period, and determine the alarm threshold based on the average value / variance and a preset dynamic coefficient. If it is found that there are errors in the historical transaction data of the trading object during the calculation process, the incorrect transaction data can be excluded.

[0089] For example, collect the number of historical transaction failures of the trading object every day from 10:00 - 10:10 (i.e., the detection period) in the past 30 days, then calculate the standard deviation of the collected number of historical transaction failures, and take the product of the standard deviation and the preset dynamic coefficient as the alarm threshold corresponding to the number of transaction failures during the detection period of 10:00 - 10:10. Among them, the preset dynamic coefficient is set according to the actual situation, and this application does not make specific limitations.

[0090] In some embodiments, if the target transaction data of the trading object during a detection period is greater than the alarm threshold corresponding to a detection period, the sub-detection result is locally abnormal; if the target transaction data of the trading object during a detection period is not greater than the alarm threshold corresponding to a detection period, the sub-detection result is locally normal.

[0091] For example, if the alarm threshold for the number of failed transactions of a trading object with a small trading volume obtained through calculation is 1 during the detection period from 10:00 to 10:10, but the target number of failed transactions of the trading object during the detection period from 10:00 to 10:10 is 5, which is greater than the alarm threshold 1 for the corresponding detection period, it is considered that the sub-detection result of the trading object during the detection period from 10:00 to 10:10 is locally abnormal; if the target number of failed transactions of the trading object during the detection period from 10:00 to 10:10 is 0, which is less than the alarm threshold 1 for the corresponding detection period, it is considered that the sub-detection result of the trading object during the detection period from 10:00 to 10:10 is locally normal.

[0092] In some embodiments, for the sub-detection results corresponding to multiple detection periods respectively, calculate the abnormal ratio of the trading object in multiple detection periods; if the abnormal ratio is greater than or equal to the preset threshold, the abnormal detection result of the trading object is abnormal; otherwise, the abnormal detection result of the trading object is normal.

[0093] Specifically, the multiple detection periods and the preset threshold are set according to the actual situation, and the present application does not make specific limitations. After determining the multiple detection periods of each of the L trading objects, first calculate the abnormal ratio of each trading object in its respective multiple detection periods, and then set the preset threshold according to the actual situation. If the abnormal ratio of the trading object is greater than or equal to the corresponding preset threshold, it is considered that the abnormal detection result of the trading object is abnormal.

[0094] For example, set the preset threshold to 90%. The multiple detection periods selected are 36 detection periods, and one detection period is 10 minutes, so the multiple detection periods are 6 hours. According to the sub-detection results of the trading object in 36 10-minute detection periods, calculate the abnormal ratio of the trading object in 36 10-minute detection periods. For example, if the sub-detection results of the trading object in 36 10-minute detection periods are all locally abnormal, the abnormal ratio is 100%, which is greater than the preset threshold 90%, then it is considered that the abnormal detection result of the trading object is abnormal; the abnormal detection results of trading objects with an abnormal ratio lower than 90% are normal.

[0095] In addition, each of the 36 10-minute detection periods has its corresponding alarm threshold, and for each 10-minute detection period, it is necessary to calculate its corresponding alarm threshold.

[0096] In the embodiments of the present application, for the abnormal ratio of multiple trading objects in multiple detection periods, if the abnormal ratio is greater than or equal to the preset threshold, it is considered that the abnormal detection result of the trading object is abnormal. In this way, a relative balance can be achieved between detecting abnormalities and controlling the number of abnormal trading objects, which is beneficial to flexibly handling trading objects with low trading volumes and / or trading frequencies, improving the level of risk management, and at the same time ensuring the stability of the daily operation of the trading institution.

[0097] In the embodiments of the present application, by dividing M transaction elements into N transaction dimensions, combining the transaction elements included in the N transaction dimensions to obtain L transaction objects, and for each selected transaction object, based on the target transaction data of the transaction object in multiple detection periods, determining the anomaly detection result of the transaction object. The present application refines different transaction objects based on transaction dimensions and transaction elements, and obtains the anomaly detection result based on the target transaction data of different transaction objects. Compared with the prior art anomaly detection method that uses a unified set of alarm thresholds for all transactions, the present application is more targeted, ensuring the accuracy of anomaly detection for transaction objects with small transaction volumes. At the same time, by setting multiple detection periods and obtaining the anomaly detection result based on the target transaction data of multiple detection periods, it is convenient to manage the number of abnormal transaction objects. Secondly, the present application first divides M transaction elements into N transaction dimensions, and then combines the N transaction dimensions to obtain L transaction objects. Compared with directly combining a large number of transaction elements, it avoids the explosion of the number of transaction objects, reduces the number of detection results, is more convenient to maintain, and ensures the stability of the daily operation of the trading institution.

[0098] To better explain the embodiments of the present application, the following introduces an anomaly detection method for a transaction object provided by the embodiments of the present application in combination with an actual scenario. The process of this method is executed by the Figure 1 server shown in the following, including the following steps, as Figure 3 shown:

[0099] Step 301: Divide M transaction elements into N transaction dimensions, and combine the transaction elements included in the N transaction dimensions to obtain L transaction objects.

[0100] Step 302: For each selected transaction object with a small transaction volume, obtain the corresponding standard deviation according to the historical transaction data of the transaction object in a detection period, and determine the alarm threshold corresponding to a detection period according to the standard deviation and a preset dynamic coefficient.

[0101] Step 303: If the target transaction data of the transaction object in a detection period is greater than the alarm threshold corresponding to a detection period, the sub-detection result is locally abnormal; otherwise, the sub-detection result of the transaction object is locally normal.

[0102] Step 304: Calculate the anomaly ratio of the transaction object in multiple detection periods according to the sub-detection results corresponding to the transaction object in multiple detection periods.

[0103] Step 305: If the anomaly ratio of the transaction object in multiple detection periods is greater than or equal to the preset threshold, the anomaly detection result of the transaction object is abnormal; otherwise, the anomaly detection result of the transaction object is normal.

[0104] In the actual abnormal detection process of the technical solution of this application, for trading objects with small trading volumes, when the total duration of multiple detection periods is set to 1 hour and the preset threshold is 10%, among these multiple detection periods, there are as many as 220 trading objects with an abnormal ratio exceeding 10%; while when the total duration of multiple detection periods is set to 6 hours and the preset threshold is 90%, among these multiple detection periods, there are 4 trading objects with an abnormal ratio exceeding 90%. Thus, it can be seen that when the preset threshold is relatively high and the duration of multiple detection periods is relatively long, the number of abnormal trading objects drops significantly. Therefore, the number of abnormal trading objects can be controlled by setting the preset threshold and the duration of multiple detection periods.

[0105] Among them, when the preset threshold is set to 90%, regardless of the value of multiple detection periods, the change value of the number of abnormal trading objects is the smallest, that is, setting the preset threshold to 90% is the optimal preset threshold for current trading objects with small trading volumes. When the trading volume of the trading object increases or the trading mode changes, adaptively adjust the appropriate range of the preset threshold; for trading objects with relatively high trading volume and / or trading frequency, a shorter time span can ensure timely detection of abnormalities, while for trading objects with relatively low trading volume and / or trading frequency, a longer time span is more appropriate.

[0106] In the embodiment of this application, by dividing M trading elements into N trading dimensions, combining the trading elements included in the N trading dimensions to obtain L trading objects, and for each selected trading object, determining the abnormal detection result of the trading object based on the target trading data of the trading object in multiple detection periods. This application refines different trading objects based on trading dimensions and trading elements, and obtains abnormal detection results based on the target trading data of different trading objects. Compared with the abnormal detection method in the prior art that uses a unified set of alarm thresholds for all transactions, this application is more targeted, ensuring the accuracy of abnormal detection of trading objects with small trading volumes. At the same time, by setting multiple detection periods and obtaining abnormal detection results based on the target trading data of multiple detection periods, it is convenient to manage the number of abnormal trading objects. Secondly, this application first divides M trading elements into N trading dimensions, and then combines the N trading dimensions to obtain L trading objects. Compared with directly combining a large number of trading elements, it avoids the explosion of the number of trading objects, reduces the number of detection results, is more convenient for maintenance, and at the same time ensures the stability of the daily operation of the trading institution.

[0107] Based on the same technical concept, the embodiment of this application provides a structural schematic diagram of an abnormal detection device for trading objects, as Figure 4 shown, the abnormal detection device 400 for trading objects includes:

[0108] An acquisition module 401, configured to acquire M trading elements, divide the M trading elements into N trading dimensions, where each trading dimension includes at least one trading element, N and M are positive integers, and N is less than M;

[0109] Combine the trading elements included in the N trading dimensions to obtain L trading objects, where each trading object includes N trading elements, and the N trading elements are obtained from the N trading dimensions, and L is a positive integer;

[0110] A processing module 402, configured to obtain an anomaly detection result of each selected trading object based on the target trading data of the trading object in multiple detection periods.

[0111] Optionally, the processing module 402 is specifically configured to:

[0112] For each of the multiple detection periods, perform the following operations respectively: determine an alarm threshold corresponding to the one detection period based on the historical trading data of the trading object in the one detection period; obtain a sub-detection result of the trading object in the one detection period based on the target trading data of the trading object in the one detection period and the alarm threshold corresponding to the one detection period;

[0113] Obtain an anomaly detection result of the trading object based on the sub-detection results corresponding to the multiple detection periods respectively.

[0114] Optionally, the processing module 402 is specifically configured to:

[0115] Determine the standard variance of the historical trading data of the trading object in one detection period;

[0116] Determine the alarm threshold corresponding to the one detection period based on the standard variance and a preset dynamic coefficient.

[0117] Optionally, the processing module 402 is specifically configured to:

[0118] If the target trading data of the trading object in the one detection period is greater than the alarm threshold corresponding to the one detection period, the sub-detection result is locally abnormal;

[0119] If the target trading data of the trading object in the one detection period is not greater than the alarm threshold corresponding to the one detection period, the sub-detection result is locally normal.

[0120] Optionally, the processing module 402 is specifically configured to:

[0121] Calculate the anomaly ratio of the trading object during the multiple detection periods based on the sub-detection results corresponding to each of the multiple detection periods;

[0122] If the anomaly ratio is greater than or equal to a preset threshold, the anomaly detection result of the trading object is abnormal; otherwise, the anomaly detection result of the trading object is normal.

[0123] In the embodiments of the present application, by dividing M trading elements into N trading dimensions, combining the trading elements included in the N trading dimensions to obtain L trading objects, and for each selected trading object, based on the target trading data of the trading object during multiple detection periods, determining the anomaly detection result of the trading object. The present application refines different trading objects based on trading dimensions and trading elements, and obtains the anomaly detection result based on the target trading data of different trading objects. Compared with the prior art's anomaly detection method that uses a unified set of alarm thresholds for all transactions, the present application is more targeted, ensuring the accuracy of anomaly detection for trading objects with small trading volumes. At the same time, by setting multiple detection periods and obtaining the anomaly detection result based on the target trading data of multiple detection periods, it is convenient to manage the number of abnormal trading objects. Secondly, the present application first divides M trading elements into N trading dimensions, and then combines the N trading dimensions to obtain L trading objects. Compared with directly combining a large number of trading elements, it avoids the explosion of the number of trading objects, reduces the number of detection results, is more convenient to maintain, and ensures the stability of the daily operation of the trading institution.

[0124] Based on the same technical concept, the embodiments of the present application provide a computer device, which can be Figure 1 the server shown in Figure 5 as shown, including at least one processor 501 and a memory 502 connected to at least one processor. In the embodiments of the present application, the specific connection medium between the processor 501 and the memory 502 is not limited. Figure 5 Taking the example where the processor 501 and the memory 502 are connected through a bus. The bus can be divided into an address bus, a data bus, a control bus, etc.

[0125] In the embodiments of the present application, the memory 502 stores instructions executed by at least one processor 501. By executing the instructions stored in the memory 502, at least one processor 501 can execute the steps of the above-mentioned anomaly detection method for trading objects.

[0126] Among them, the processor 501 is the control center of the computer device. It can connect various parts of the computer device through various interfaces and circuits, and by running or executing instructions stored in the memory 502 and calling data stored in the memory 502, it can realize the anomaly detection of the transaction object. Optionally, the processor 501 may include one or more processing modules. The processor 501 may integrate an application processor and a modem processor. Among them, the application processor mainly processes the operating system, user interface, application programs, etc., and the modem processor mainly processes wireless communication. It can be understood that the above-mentioned modem processor may not be integrated into the processor 501. In some embodiments, the processor 501 and the memory 502 may be implemented on the same chip, and in some embodiments, they may also be separately implemented on independent chips.

[0127] The processor 501 may be a general-purpose processor, such as a central processing unit (CPU), a digital signal processor, an application specific integrated circuit (ASIC), a field programmable gate array, or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, which can implement or execute the various methods, steps, and logic block diagrams disclosed in the embodiments of the present application. The general-purpose processor may be a microprocessor or any conventional processor, etc. The steps of the method disclosed in combination with the embodiments of the present application may be directly embodied as being executed by a hardware processor, or executed by a combination of hardware and software modules in the processor.

[0128] The memory 502, as a non-volatile computer-readable storage medium, can be used to store non-volatile software programs, non-volatile computer-executable programs, and modules. The memory 502 can include at least one type of storage medium. For example, it can include flash memory, hard disks, multimedia cards, card-type memories, random access memory (RAM), static random access memory (SRAM), programmable read-only memory (PROM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), magnetic memories, magnetic disks, optical disks, and so on. The memory 502 is any other medium that can be used to carry or store the desired program code in the form of instructions or data structures and can be accessed by a computer device, but is not limited to this. The memory 502 in the embodiments of the present application can also be a circuit or any other device capable of implementing a storage function, for storing program instructions and / or data.

[0129] Based on the same inventive concept, embodiments of the present application provide a computer-readable storage medium that stores a computer program executable by a computer device. When the program runs on the computer device, it causes the computer device to execute the steps of the above-mentioned method for detecting anomalies in transaction objects.

[0130] Based on the same inventive concept, embodiments of the present application provide a computer program product, including a computer program stored on a computer-readable storage medium. The computer program includes program instructions that, when executed by a computer device, cause the computer device to execute the steps of the above-mentioned method for detecting anomalies in transaction objects.

[0131] Those skilled in the art should understand that the embodiments of the present application can be provided as a method, a system, or a computer program product. Therefore, the present application can take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware aspects. Moreover, the present application can take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk memories, CD-ROMs, optical memories, etc.) containing computer-usable program code.

[0132] This application is described with reference to the flowcharts and / or block diagrams of methods, apparatus (systems), and computer program products according to the application. It should be understood that each flow and / or block in the flowchart and / or block diagram, and the combination of flows and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to the processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing device to generate a machine, such that the instructions executed by the processor of the computer or other programmable data processing device produce means for implementing the functions specified in the flow Figure 1 one or more flows and / or blocks Figure 1 or means for implementing the functions specified in a block or multiple blocks.

[0133] These computer program instructions can also be stored in a computer-readable memory that can direct a computer or other programmable data processing device to work in a specific manner, such that the instructions stored in the computer-readable memory produce a manufactured article including instruction means that implement the functions specified in the flow Figure 1 one or more flows and / or blocks Figure 1 or means for implementing the functions specified in a block or multiple blocks.

[0134] These computer program instructions can also be loaded onto a computer or other programmable data processing device, such that a series of operational steps are executed on the computer or other programmable device to generate a computer-implemented process, and thus the instructions executed on the computer or other programmable device provide steps for implementing the functions specified in the flow Figure 1 one or more flows and / or blocks Figure 1 or means for implementing the functions specified in a block or multiple blocks.

[0135] Obviously, those skilled in the art can make various changes and modifications to this application without departing from the spirit and scope of this application. Thus, if these modifications and variations of this application fall within the scope of the claims of this application and their equivalent technologies, this application is also intended to include these changes and modifications.

Claims

1. A method for detecting anomalies of a transaction object, characterized in that: include: Obtain M transaction elements, divide the M transaction elements into N transaction dimensions, each transaction dimension includes at least one transaction element, N and M are positive integers, and N is less than M; The transaction elements included in the N transaction dimensions are combined to obtain L transaction objects, each transaction object includes N transaction elements, the N transaction elements are obtained from the N transaction dimensions, and L is a positive integer; For each selected transaction object, an abnormality detection result of the transaction object is obtained based on the target transaction data of the transaction object in multiple detection time periods.

2. The method according to claim 1, characterized in that The obtaining, based on the target transaction data of each of the transaction objects in a plurality of detection periods, an abnormality detection result of the transaction object includes: For the multiple detection time periods, the following operations are respectively performed: based on the historical transaction data of the transaction object in one detection time period, an alarm threshold corresponding to the one detection time period is determined; based on the target transaction data of the transaction object in the one detection time period and the alarm threshold corresponding to the one detection time period, a sub-detection result of the transaction object in the one detection time period is obtained; Based on the sub-detection results corresponding to the multiple detection time periods, an abnormality detection result of the transaction object is obtained.

3. The method according to claim 2, characterized in that The determining, based on the historical transaction data of the transaction object within a detection period, an alarm threshold corresponding to the detection period includes: Determine the standard deviation of the historical transaction data of the transaction object within a detection period; Based on the standard deviation and a preset dynamic coefficient, an alarm threshold corresponding to the one detection period is determined.

4. The method according to claim 2, characterized in that The obtaining of the sub-detection result of the transaction object within the detection period includes: If the target transaction data of the transaction object in the detection period is greater than the alarm threshold corresponding to the detection period, the sub-detection result is a local abnormality; If the target transaction data of the transaction object within the detection period is not greater than the alarm threshold corresponding to the detection period, the sub-detection result is partially normal.

5. The method according to claim 2, characterized in that The obtaining, based on the sub-detection results corresponding to the multiple detection time periods, an abnormality detection result of the transaction object includes: Calculating the abnormality ratio of the transaction object in the multiple detection periods for the sub-detection results corresponding to the multiple detection periods; If the abnormality ratio is greater than or equal to a preset threshold, the abnormality detection result of the transaction object is abnormal; otherwise, the abnormality detection result of the transaction object is normal.

6. The method according to any one of claims 1 to 5, characterized in that: The target transaction data is at least one of the following: Number of failed transactions, number of successful transactions, transaction success rate, and transaction delay.

7. A device for detecting abnormality of a transaction object, characterized in that: include: an acquisition module, configured to acquire M transaction elements, divide the M transaction elements into N transaction dimensions, each transaction dimension includes at least one transaction element, N and M are positive integers, and N is less than M; The transaction elements included in the N transaction dimensions are combined to obtain L transaction objects, each transaction object includes N transaction elements, the N transaction elements are obtained from the N transaction dimensions, and L is a positive integer; The processing module is used to obtain, for each selected transaction object, an abnormality detection result of the transaction object based on the target transaction data of each transaction object in multiple detection time periods.

8. A computer device, characterized in that: include: A memory for storing program instructions; A processor is used to call the program instructions stored in the memory and execute the steps of any one of the methods of claims 1 to 6 according to the obtained program.

9. A computer-readable storage medium, characterized in that: It stores a computer program executable by a computer device. When the program is run on the computer device, the computer device executes the steps of any method described in claims 1 to 6.

10. A computer program product, characterized in that The computer program product comprises a computer program stored on a computer-readable storage medium, wherein the computer program comprises program instructions, and when the program instructions are executed by a computer device, the computer device is caused to execute the steps of the method according to any one of claims 1 to 6.

Images