Business anomaly detection method and system, electronic equipment and storage medium

Abstract

The invention discloses a service anomaly detection method and system, electronic equipment and a storage medium. The method comprises the steps of collecting preset service data through a preset data source; performing data preprocessing on the preset business data to obtain to-be-detected business data; performing feature selection through a feature selection processing module according to the to-be-detected business data to obtain target feature data; wherein the feature selection processing module comprises a preset random forest model, and the preset random forest model is obtained by training and constructing an artificial bee colony algorithm and a simulated annealing algorithm; according to the target feature data and a preset feature threshold value, performing service anomaly analysis to obtain a service anomaly detection result; wherein the preset feature threshold is determined by combining a genetic algorithm with the simulated annealing algorithm. According to the embodiment of the invention, the accuracy and efficiency of abnormal business troubleshooting detection can be effectively improved. The method can be widely applied to the technical field of business management.

Description

Technical Field

[0001] The present application relates to the technical field of business management, and in particular, to a method, a system, an electronic device, and a storage medium for detecting business anomalies. Background Art

[0002] In the process of business development, there are often some behaviors of false business development, that is, abnormal businesses. These abnormal businesses will lead to waste of resources and increase in costs, and affect the user experience. For example, in the operator business, some telecom cooperation agents, in order to obtain commissions, carry out operations of dismantling old and installing new for the telecom services of the same existing customer. Although no new business is actually developed, they submit new installation orders to obtain commissions, resulting in problems such as waste of resources and increase in costs. In the related art, the traditional method for investigating abnormal businesses is often inefficient and difficult to accurately detect abnormal business behaviors.

[0003] In summary, the technical problems existing in the related art need to be improved. Summary of the Invention

[0004] The main purpose of the embodiments of the present application is to propose a method, a system, an electronic device, and a storage medium for detecting business anomalies, which can effectively improve the accuracy and efficiency of detecting and investigating abnormal businesses.

[0005] To achieve the above object, on the one hand, an embodiment of the present application proposes a method for detecting business anomalies, and the method includes the following steps:

[0006] Collect preset business data through a preset data source;

[0007] Perform data preprocessing on the preset business data to obtain business data to be detected;

[0008] Perform feature selection on the business data to be detected through a feature selection processing module to obtain target feature data; wherein, the feature selection processing module includes a preset random forest model, and the preset random forest model is trained and constructed by an artificial bee colony algorithm and a simulated annealing algorithm;

[0009] Perform business anomaly analysis on the target feature data and a preset feature threshold to obtain a business anomaly detection result; wherein, the preset feature threshold is determined by a genetic algorithm combined with the simulated annealing algorithm.

[0010] In some embodiments, the performing data preprocessing on the preset business data to obtain business data to be detected includes:

[0011] Perform data cleaning on the preset business data to obtain first preprocessed data;

[0012] Perform normalization processing on the first preprocessed data to obtain second preprocessed data;

[0013] Perform missing value processing on the second preprocessed data through a preset imputation algorithm to obtain the service data to be detected.

[0014] In some embodiments, the performing feature selection on the service data to be detected through a feature selection processing module to obtain target feature data includes:

[0015] Perform dimensionality reduction processing on the service data to be detected through a principal component analysis algorithm to obtain preset dimensionality reduction data;

[0016] Perform clustering processing on the preset dimensionality reduction data to obtain clustering feature data;

[0017] Perform feature importance evaluation on the clustering feature data through the preset random forest model to obtain feature importance data;

[0018] Calculate correlation parameter according to the clustering feature data to obtain preset correlation coefficient data; wherein, the preset correlation coefficient data includes mutual information, maximum information coefficient, Pearson correlation coefficient, and Spearman rank correlation coefficient;

[0019] Calculate the interaction information between feature pairs according to the clustering feature data;

[0020] Determine the target feature data according to the feature importance data, the preset correlation coefficient data, and the interaction information.

[0021] In some embodiments, before performing the performing feature selection on the service data to be detected through a feature selection processing module to obtain target feature data, the method further includes:

[0022] Perform parameter initialization on the artificial bee colony algorithm and randomly generate preset nectar source positions; wherein, each preset nectar source position corresponds to a set of parameter combinations of the preset random forest model;

[0023] Calculate the first fitness value of each preset nectar source position;

[0024] Generate a nectar source position to be updated through a preset nectar source search formula and calculate the second fitness value of the nectar source position to be updated;

[0025] Determine the nectar source acceptance result according to the first fitness value and the second fitness value through the simulated annealing algorithm;

[0026] Update the nectar source location according to the nectar source acceptance result to obtain a preset random forest model; wherein, the imbalance coefficient in the preset random forest model is positively correlated with the minority class sample parameter.

[0027] In some embodiments, after performing the step of updating the nectar source location according to the nectar source acceptance result to obtain a preset random forest model, the method further includes:

[0028] Evaluate the decision trees of the preset random forest model through an ensemble pruning algorithm to obtain decision tree performance data;

[0029] Perform decision tree removal processing according to the decision tree performance data to update the preset random forest model.

[0030] In some embodiments, before performing the step of performing business anomaly analysis based on the target feature data and a preset feature threshold to obtain a business anomaly detection result, the method further includes:

[0031] Randomly generate a set of first feature thresholds; wherein, each of the first feature thresholds corresponds to a preset individual;

[0032] Calculate the third fitness value corresponding to each of the preset individuals;

[0033] Determine parent individuals from the preset individuals according to the third fitness value, and perform crossover and mutation operations on the parent individuals to generate offspring individuals;

[0034] Calculate the fourth fitness value of the offspring individuals;

[0035] Determine an individual acceptance result according to the third fitness value and the fourth fitness value through a simulated annealing algorithm;

[0036] Determine the preset feature threshold through the individual acceptance result.

[0037] In some embodiments, the step of performing business anomaly analysis based on the target feature data and a preset feature threshold to obtain a business anomaly detection result includes:

[0038] Perform business anomaly analysis based on the target feature data, the preset feature threshold, and time series features to obtain the business anomaly detection result.

[0039] To achieve the above object, another aspect of the embodiments of the present application provides a business anomaly detection system, the system includes:

[0040] A first module, configured to collect preset business data through a preset data source;

[0041] A second module, configured to perform data preprocessing on the preset service data to obtain service data to be detected;

[0042] A third module, configured to perform feature selection on the service data to be detected through a feature selection processing module to obtain target feature data; wherein, the feature selection processing module includes a preset random forest model, and the preset random forest model is trained and constructed by an artificial bee colony algorithm and a simulated annealing algorithm;

[0043] A fourth module, configured to perform service anomaly analysis based on the target feature data and a preset feature threshold to obtain a service anomaly detection result; wherein, the preset feature threshold is determined by a genetic algorithm in combination with the simulated annealing algorithm.

[0044] To achieve the above object, another aspect of the embodiments of the present application provides an electronic device, where the electronic device includes:

[0045] At least one processor;

[0046] At least one memory, configured to store at least one program;

[0047] When the at least one program is executed by the at least one processor, the at least one processor implements the above method.

[0048] To achieve the above object, another aspect of the embodiments of the present application provides a computer-readable storage medium, where the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the above method is implemented.

[0049] The embodiments of the present application at least include the following beneficial effects: The present application provides a method, system, electronic device, and storage medium for detecting service anomalies. This solution collects preset service data through a preset data source and performs data preprocessing on the preset service data to obtain service data to be detected. Then, according to the service data to be detected, the embodiments of the present invention perform feature selection through a feature selection processing model to obtain target feature data, and further perform service anomaly analysis based on the target feature data and a preset feature threshold to obtain a service anomaly detection result, realizing service anomaly detection. It is easy to understand that the embodiments of the present invention perform data preprocessing on the preset service data to improve the fineness of data processing. At the same time, the embodiments of the present invention use the artificial bee colony algorithm and the simulated annealing algorithm to construct a preset random forest model to alleviate the problem of falling into a local optimal solution during the search process, improving the accuracy and efficiency of the model. In addition, the embodiments of the present invention determine the preset feature threshold by combining the genetic algorithm and the simulated annealing algorithm, and then perform service anomaly analysis based on the target feature data and the preset feature threshold, thereby effectively improving the accuracy of finding the preset feature threshold to adapt to different data distributions and abnormal service behavior patterns, and further improving the accuracy and efficiency of detecting abnormal services. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] Figure 1 is a flowchart of the steps of the service anomaly detection method provided by the embodiments of the present invention;

[0051] Figure 2 is a flowchart of the steps of performing data preprocessing on preset service data to obtain service data to be detected provided by the embodiments of the present invention;

[0052] Figure 3 is a schematic diagram of the data processing flow within the data preprocessing module provided by the embodiments of the present invention;

[0053] Figure 4 is a flowchart of the steps of performing feature selection on the service data to be detected through a feature selection processing module to obtain target feature data provided by the embodiments of the present invention;

[0054] Figure 5 is a flowchart of the steps of constructing a preset random forest model provided by the embodiments of the present invention;

[0055] Figure 6 is a schematic diagram of the logical process of constructing a preset random forest model provided by the embodiments of the present invention;

[0056] Figure 7 is a flowchart of the steps of optimizing a preset random forest model provided by the embodiments of the present invention;

[0057] Figure 8It is a flowchart of steps for determining a preset feature threshold provided by an embodiment of the present invention;

[0058] Figure 9 It is a flowchart of steps for performing service anomaly analysis based on target feature data and a preset feature threshold to obtain a service anomaly detection result provided by an embodiment of the present invention;

[0059] Figure 10 It is a schematic diagram of the module algorithm logic flow of a service anomaly detection method provided by an embodiment of the present invention;

[0060] Figure 11 It is a schematic diagram of the structure of a service anomaly detection system provided by an embodiment of the present invention;

[0061] Figure 12 It is a schematic diagram of the hardware structure of an electronic device provided by an embodiment of the present invention. Detailed implementation manners

[0062] In order to make the objectives, technical solutions and advantages of the present application clearer, the present application will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application. When the following description refers to the accompanying drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The implementation manners described in the following exemplary embodiments do not represent all implementation manners consistent with the embodiments of the present application. They are only examples of devices and methods consistent with some aspects of the embodiments of the present application described in detail in the appended claims.

[0063] It can be understood that the terms "first", "second", etc. used in the present application may be used herein to describe various concepts, but unless otherwise specified, these concepts are not limited by these terms. These terms are only used to distinguish one concept from another. For example, without departing from the scope of the embodiments of the present application, the first information may also be referred to as the second information, and similarly, the second information may also be referred to as the first information. Depending on the context, the words "if", "when" as used herein may be interpreted as "when...", "while...", or "in response to determining".

[0064] The terms "at least one", "a plurality of", "each", "any one", etc. used in the present application, at least one includes one, two or more than two, a plurality of includes two or more than two, each refers to each of the corresponding plurality, and any one refers to any one of the plurality.

[0065] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by those skilled in the technical field to which the present application belongs. The terms used herein are only for the purpose of describing the embodiments of the present application and are not intended to limit the present application.

[0066] Before elaborating on the embodiments of the present application in detail, some nouns and terms involved in the embodiments of the present application are first explained, and the nouns and terms involved in the embodiments of the present application are applicable to the following explanations.

[0067] Demolishing the old and installing the new to pocket the commission: Telecom cooperation agents conduct operations such as demolishing the old and installing the new or seizing orders for the telecom services of the same existing customer to pocket the relevant commission, without actually developing new business.

[0068] Random Forest: It is an ensemble learning method based on decision trees. By constructing multiple decision trees and voting or averaging their prediction results, the accuracy of classification or regression is improved.

[0069] AUC (Area Under Curve): It is defined as the area enclosed by the ROC curve and the coordinate axes.

[0070] Seizing orders: If there are cancellation or postponed installation orders after the installation of the newly installed broadband in the last two months, and there are cases of the same grid or the same ID number, and if the new installation solicitation unit is different from the old order solicitation unit, it is determined as a suspected order seizure. Confirm whether the work order event is a qualitative violation through means such as customer return visits.

[0071] Artificial Bee Colony (ABC) algorithm: It is a swarm intelligence optimization algorithm that simulates the foraging behavior of a bee colony. Among them, through the division of labor and cooperation of three roles (employed bees, observing bees, and scout bees), combined with local search and global information sharing mechanisms, the optimal solution to the problem is found.

[0072] Simulated Annealing (SA) algorithm: It is a single-point iterative optimization algorithm inspired by the metal annealing process. Among them, by simulating the thermal motion of atoms during the cooling process, inferior solutions are accepted with a certain probability, and gradually converge to the global optimal solution.

[0073] During the process of business development, there are often some behaviors of false business development, that is, abnormal businesses. These abnormal businesses will lead to waste of resources and increase in costs, and affect the user experience. For example, in the business of operators, some telecom cooperation agents, in order to pocket the commission, conduct operations of demolishing the old and installing the new for the telecom services of the same existing customer. Although no new business is actually developed, they obtain the commission by submitting new installation orders, resulting in problems such as waste of resources and increase in costs. In related technologies, traditional abnormal business detection methods are often inefficient and difficult to accurately detect abnormal business behaviors.

[0074] In view of this, the embodiments of the present application provide a service anomaly detection method, system, electronic device and storage medium. This solution preprocesses the preset service data to improve the fineness of data processing. At the same time, the embodiments of the present invention construct a preset random forest model through the artificial bee colony algorithm and the simulated annealing algorithm to alleviate the problem of falling into a local optimal solution during the search process, improving the accuracy and efficiency of the model. In addition, the embodiments of the present invention determine the preset feature threshold by combining the genetic algorithm and the simulated annealing algorithm, and then perform service anomaly analysis based on the target feature data and the preset feature threshold, thereby effectively improving the accuracy of finding the preset feature threshold to adapt to different data distributions and abnormal service behavior patterns, and further improving the accuracy and efficiency of abnormal service troubleshooting and detection.

[0075] The service anomaly detection method provided by the embodiments of the present application relates to the technical field of service management. The service anomaly detection method provided by the embodiments of the present application can be applied to a terminal, a server, or software running on a terminal or a server. In some embodiments, the terminal can be a smart phone, a tablet computer, a laptop computer, a desktop computer, a smart speaker, a smart watch, a vehicle-mounted terminal, etc., but is not limited thereto; the server side can be configured as an independent physical server, or can be configured as a server cluster or distributed system composed of multiple physical servers, or can be configured as a cloud server providing basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN, and big data and artificial intelligence platforms. The server can also be a node server in a blockchain network; the software can be an application that implements the service anomaly detection method, etc., but is not limited to the above forms.

[0076] The present application can be used in many general or special computer system environments or configurations. For example: personal computers, server computers, handheld or portable devices, tablet devices, multi-processor systems, microprocessor-based systems, set-top boxes, programmable consumer electronic devices, network PCs, minicomputers, mainframe computers, distributed computing environments including any of the above systems or devices, and so on. The present application can be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform specific tasks or implement specific abstract data types. The present application can also be practiced in a distributed computing environment where tasks are performed by remote processing devices connected through a communication network. In a distributed computing environment, program modules can be located in local and remote computer storage media including storage devices.

[0077] It should be noted that in each specific embodiment of the present application, when it comes to performing relevant processing based on data related to the user's identity or characteristics, such as user information, user behavior data, user historical data, and user location information, the user's permission or consent will be obtained first. Moreover, the collection, use, and processing of these data will comply with relevant laws, regulations, and standards. In addition, when the embodiments of the present application need to obtain the user's sensitive personal information, the user's separate permission or separate consent will be obtained through methods such as pop-up windows or jumping to a confirmation page. After clearly obtaining the user's separate permission or separate consent, the necessary user-related data for the normal operation of the embodiments of the present application will be obtained.

[0078] Figure 1 is an optional flowchart of the service anomaly detection method provided by the embodiments of the present application. Figure 1 The method in may include, but is not limited to, steps S110 to S140.

[0079] Step S110: Collect preset service data through a preset data source.

[0080] Step S120: Perform data preprocessing on the preset service data to obtain the service data to be detected.

[0081] Step S130: Perform feature selection on the service data to be detected through a feature selection processing module to obtain target feature data. Among them, the feature selection processing module includes a preset random forest model, and the preset random forest model is trained and constructed by an artificial bee colony algorithm and a simulated annealing algorithm.

[0082] Step S140: Perform service anomaly analysis based on the target feature data and a preset feature threshold to obtain a service anomaly detection result. Among them, the preset feature threshold is determined by a genetic algorithm combined with a simulated annealing algorithm.

[0083] During the operation of this specific embodiment, the embodiment of the present invention first collects preset business data through a preset data source. Specifically, in the embodiment of the present invention, the preset data source refers to the data source of relevant business data, such as a business system, an industry database, or a social media database, etc. Exemplarily, the embodiment of the present invention collects data such as device information, installation records, and commission records from the business system of an operator, and collects information related to business behavior from external data sources (such as industry databases, social media, etc.). For example, the embodiment of the present invention obtains data on case data of disassembling and reinstalling old devices for similar services from the database of a telecom auditing system, and collects feedback information from users on the operator's services from work order feedback information. This information may contain potential clues to disassembling and reinstalling old devices. Among them, the embodiment of the present invention enriches the data sources to improve the comprehensiveness and accuracy of the data. Next, the embodiment of the present invention performs data preprocessing on the preset business data to obtain the business data to be detected. Specifically, the embodiment of the present invention improves the data quality through the method of preprocessing the collected preset business data to obtain the business data to be detected, thereby improving the efficiency of subsequent data analysis. Further, the embodiment of the present invention performs feature selection on the business data to be detected through a feature selection processing module to obtain target feature data. Specifically, in the embodiment of the present invention, the feature selection processing module refers to a processing module for performing feature screening, such as screening out features with a relatively high correlation with relevant business behaviors. Among them, the feature selection processing module in the embodiment of the present invention includes a preset random forest model. Correspondingly, the preset random forest model in the embodiment of the present invention is trained and constructed by an artificial bee colony algorithm and a simulated annealing algorithm. Among them, in the embodiment of the present invention, on the basis of the artificial bee colony algorithm, the simulated annealing algorithm is introduced to alleviate the problem that the algorithm is prone to falling into a local optimal solution, thereby improving the accuracy and efficiency of the model. Correspondingly, the embodiment of the present invention performs feature screening through the feature selection processing module provided with the preset random forest model to determine features with a relatively high correlation with abnormal business behaviors and obtain target feature data. Finally, the embodiment of the present invention performs business anomaly analysis based on the target feature data and a preset feature threshold to obtain a business anomaly detection result. Specifically, in the embodiment of the present invention, the preset feature threshold refers to the detection threshold for abnormal business behaviors, such as the behavior of disassembling and reinstalling old devices. Correspondingly, the preset feature threshold in the embodiment of the present invention is determined by a genetic algorithm combined with a simulated annealing algorithm. Among them, in the embodiment of the present invention, by introducing the simulated annealing algorithm into the genetic algorithm, the process of determining the detection threshold for abnormal business behaviors is optimized to detect abnormal business behaviors, thereby further improving the accuracy and efficiency of abnormal business investigation and detection.

[0084] Referring to Figure 2 , in some embodiments of the present invention, performing data preprocessing on the preset business data to obtain the business data to be detected includes, but is not limited to, the following steps:

[0085] Step S210: Clean the preset service data to obtain the first preprocessed data.

[0086] Step S220: Standardize the first preprocessed data to obtain the second preprocessed data.

[0087] Step S230: Process the missing values of the second preprocessed data through a preset interpolation algorithm to obtain the service data to be detected.

[0088] In this specific embodiment, the embodiment of the present invention first cleans the preset service data to obtain the first preprocessed data. Specifically, the embodiment of the present invention adopts strict data screening rules to remove outliers and noise data to obtain the first preprocessed data. For example, for numerical data, the embodiment of the present invention calculates its mean μ and standard deviation σ, and regards the data outside the range of the mean plus or minus three standard deviations as outliers and removes them. That is, for the value x, if |x - μ| > 3σ, then x is regarded as an outlier. Then, the embodiment of the present invention standardizes the first preprocessed data to obtain the second preprocessed data. Specifically, the embodiment of the present invention performs standardization processing according to the data type of the first preprocessed data. For example, as Figure 3 shown, for numerical data, the embodiment of the present invention observes the data distribution, adopts the Z-score standardization method for data subject to normal distribution, and adopts the min-max standardization method for data that needs to be mapped to the [0, 1] interval.

[0089] Among them, the Z-score standardization formula in the embodiment of the present invention is shown in the following formula (1):

[0090]

[0091] At the same time, the min-max standardization formula in the embodiment of the present invention is shown in the following formula (2):

[0092]

[0093] In addition, for date type fields, the embodiment of the present invention first converts them into Unix timestamps and then performs standardization processing. The formula is shown in the following formula (3):

[0094]

[0095] Further, in the embodiments of the present invention, the second preprocessed data is processed for missing values through a preset interpolation algorithm to obtain the service data to be detected. Specifically, the preset interpolation algorithm in the embodiments of the present invention includes the multiple imputation method. Correspondingly, the embodiments of the present invention combine the multiple imputation method with the exponentially weighted moving average method to improve the accuracy and reliability of missing value filling. For example, first, for numerical missing values, the exponentially weighted moving average method is used for filling, and the formula is shown in the following formula (4):

[0096] MissingValue=α×PreviousValue+(1-α)×CurrentValue (4)

[0097] Where, in the formula, α is the weight coefficient, which is adjusted according to the time series characteristics of the data.

[0098] Next, for non-numerical missing values, the embodiments of the present invention adopt the multiple imputation method, estimate the missing values by establishing multiple prediction models, and then combine multiple estimated values to obtain the final filled value. At the same time, the embodiments of the present invention calculate specific fields according to the business logic to better identify abnormal patterns. For example, calculate fields such as the installation times of the broadband at the same address within a specific time, and the installation time intervals of different installers.

[0099] Refer to Figure 4 , in some embodiments of the present invention, feature selection is performed on the service data to be detected through a feature selection processing module to obtain target feature data, including but not limited to the following steps:

[0100] Step S310: Perform dimensionality reduction processing on the service data to be detected through the principal component analysis algorithm to obtain preset dimensionality reduction data.

[0101] Step S320: Perform clustering processing on the preset dimensionality reduction data to obtain clustering feature data.

[0102] Step S330: Evaluate the feature importance of the clustering feature data through a preset random forest model to obtain feature importance data.

[0103] Step S340: Calculate the correlation parameter according to the clustering feature data to obtain preset correlation coefficient data. Among them, the preset correlation coefficient data includes mutual information, maximum information coefficient, Pearson correlation coefficient, and Spearman rank correlation coefficient.

[0104] Step S350: Calculate the interaction information between feature pairs according to the clustering feature data.

[0105] Step S360: Determine the target feature data according to the feature importance data, the preset correlation coefficient data, and the interaction information.

[0106] In this specific embodiment, the embodiment of the present invention first performs dimensionality reduction processing on the service data to be detected through the principal component analysis algorithm to obtain preset dimensionality-reduced data, and then performs clustering processing on the preset dimensionality-reduced data to obtain clustering feature data. Specifically, the embodiment of the present invention uses the principal component analysis (PCA) algorithm to assist clustering. For example, before performing deep learning autoencoder dimensionality reduction and traditional clustering algorithms, the embodiment of the present invention first uses the principal component analysis (PCA) algorithm to perform preliminary dimensionality reduction on the data to obtain preset dimensionality-reduced data. Among them, the principal component analysis (PCA) algorithm projects high-dimensional data into a low-dimensional space through linear transformation, retaining the main variance information of the data, thereby further reducing the dimension of the data and improving the efficiency and accuracy of subsequent clustering algorithms. Exemplarily, let the original data be X ∈ R n×d , first calculate the covariance matrix of the data Then perform eigenvalue decomposition on the covariance matrix to obtain eigenvalues and eigenvectors. Correspondingly, select the eigenvectors corresponding to the largest k eigenvalues to form a projection matrix P ∈ R d×k , project the original data into the low-dimensional space Z = XP, where Z ∈ R n×k .

[0107] Next, the embodiment of the present invention evaluates the feature importance of the clustering feature data through a preset random forest model to obtain feature importance data. Specifically, the embodiment of the present invention expands the evaluation of the importance of features based on a deep learning model. Among them, the embodiment of the present invention constructs a deep learning model, such as a preset random forest model, to evaluate the feature importance of each feature in the clustering feature data to obtain feature importance data. Exemplarily, in addition to using the gradient boosting method to evaluate feature importance, the embodiment of the present invention also introduces a deep learning model based on the attention mechanism. By constructing a neural network with an attention layer, the model can automatically learn the importance weights of different features. Among them, the attention mechanism can dynamically adjust the weights according to the contribution degree of the features to the prediction result, thereby more accurately evaluating the feature importance. For example, add an attention layer to the middle layer of the neural network. For the input feature vector X ∈ R d Calculate the weight vector a ∈ R through the attention mechanism d , where a i represents the importance weight of the i-th feature. The output of the attention layer is During the training process, optimize the parameters of the neural network and the attention weights simultaneously through the backpropagation algorithm.

[0108] Meanwhile, the embodiment of the present invention calculates the correlation parameter according to the clustering feature data to obtain the preset correlation coefficient data. Specifically, the embodiment of the present invention fuses multiple correlation metrics, not only using mutual information, the maximum information coefficient (MIC), and the Pearson correlation coefficient, but also introducing the Spearman rank correlation coefficient. Therefore, the preset correlation coefficient data in the embodiment of the present invention includes mutual information, the maximum information coefficient, the Pearson correlation coefficient, and the Spearman rank correlation coefficient. Among them, the Spearman rank correlation coefficient is suitable for measuring the monotonic relationship between variables and has a good performance in some cases where the data distribution does not satisfy the linear hypothesis. For example, for two variables X and Y, first convert their values into ranks, and then calculate the Spearman rank correlation coefficient as shown in the following formula (5):

[0109]

[0110] where, in the formula, R(X i ) and R(T i ) are the ranks of X i and Y i respectively, and are the mean ranks of X and Y respectively.

[0111] Correspondingly, the embodiment of the present invention calculates the mutual information between feature pairs according to the clustering feature data. Specifically, the embodiment of the present invention considers the influence of the interaction between features on the classification result. Among them, the embodiment of the present invention calculates the mutual information between feature pairs and screens out the feature combinations with strong interaction. These feature combinations may be of great significance for the detection of the behavior of disassembling and reinstalling, while the role of individual features may be ignored when considering them alone. For example, for two features X and Y, calculate their mutual information as shown in the following formula (6):

[0112] I(X,Y;C) = I(X,Y) - I(X;C) - I(Y;C) + I(X,Y,C) (6)

[0113] where, in the formula, I(X,Y) is the joint entropy of X and Y, I(X;C) and I(Y;C) are the conditional entropies of X and Y given C respectively, and I(X,Y;C) is the joint entropy of X and Y given C. Correspondingly, the embodiment of the present invention selects the feature pairs with larger mutual information for further analysis and consideration.

[0114] Finally, the embodiment of the present invention determines the target feature data according to the feature importance data, the preset correlation coefficient data, and the interaction information. Specifically, the embodiment of the present invention adjusts the feature sequence by combining the feature importance data, the preset correlation coefficient data, and the interaction information, so as to determine the target feature data. Correspondingly, the embodiment of the present invention dynamically adjusts the feature sequence according to the change of the real-time data and the feedback of the model. When new data is added or the importance of some features changes during the actual application of the model, the feature selection process is re-performed to update the feature sequence in a timely manner. For example, the embodiment of the present invention sets a timing task to re-perform the feature selection process on the data every once in a while (such as one week). Or, when the accuracy of the model drops to a certain extent, the update mechanism of the feature selection is triggered. During the update process, new data and the previous feature selection results are combined, and various factors are comprehensively considered for adjustment.

[0115] Referring to Figure 5 , in some embodiments of the present invention, before performing feature selection on the to-be-detected service data through the feature selection processing module to obtain the target feature data, the service anomaly detection method provided by the embodiment of the present invention further includes but is not limited to the following steps:

[0116] Step S410: Initialize the parameters of the artificial bee colony algorithm and randomly generate the preset nectar source positions. Among them, each preset nectar source position corresponds to a set of parameter combinations of the preset random forest model.

[0117] Step S420: Calculate the first fitness value of each preset nectar source position.

[0118] Step S430: Generate the to-be-updated nectar source positions through the preset nectar source search formula and calculate the second fitness value of the to-be-updated nectar source positions.

[0119] Step S440: Determine the nectar source acceptance result according to the first fitness value and the second fitness value through the simulated annealing algorithm.

[0120] Step S450: Update the nectar source positions according to the nectar source acceptance result to obtain the preset random forest model. Among them, the imbalance coefficient in the preset random forest model is positively correlated with the minority class sample parameters.

[0121] In this specific embodiment, the embodiment of the present invention is based on the Adaptive Step Size Artificial Bee Colony (ASSABC) algorithm and introduces the idea of the simulated annealing algorithm. When the artificial bee colony algorithm gets stuck in a local optimum during the search process, it accepts a worse solution with a certain probability to increase the ability of the algorithm to jump out of the local optimum. First, the embodiment of the present invention initializes the parameters of the artificial bee colony algorithm and randomly generates the preset nectar source positions. Specifically, the embodiment of the present invention initializes the parameters of the artificial bee colony algorithm, including the colony size N, the maximum number of iterations T max , the number of nectar sources M, etc. Correspondingly, the preset nectar source position in the embodiment of the present invention refers to the initial nectar source position. Among them, each preset nectar source position in the embodiment of the present invention corresponds to a set of parameter combinations of the preset random forest model, that is, each nectar source position corresponds to a set of parameter combinations of the random forest algorithm. For example, in the embodiment of the present invention, the parameter combination of the random forest is set as (n estimators , max d epth, min s amples s plit, …), where n estimators represents the number of decision trees, max d epth represents the maximum depth of the decision tree, and min s amples s plit represents the minimum number of samples required for node splitting, etc. Then, the embodiment of the present invention calculates the first fitness value of each preset nectar source position. Specifically, the fitness value of each nectar source position in the embodiment of the present invention can be measured by the AUC value of the random forest algorithm on the validation set. For example, let the validation set be D val , for the random forest model RF corresponding to the nectar source position, its AUC value calculation formula on the validation set is shown as the following formula (7):

[0122]

[0123] Among them, in the formula, M positive and M negative respectively represent the number of positive samples and negative samples, and rank i represents the sorting position of the i-th positive sample among all samples.

[0124] Next, the embodiment of the present invention generates the honey source position to be updated through a preset honey source search formula, and calculates the second fitness value of the honey source position to be updated. Specifically, the embodiment of the present invention enters the iterative process, and the bees search according to the formula to generate a new honey source position. Based on the current honey source position, more effective exploration is carried out to generate new possible random forest parameter combinations. Further, the embodiment of the present invention determines the honey source acceptance result through the simulated annealing algorithm according to the first fitness value and the second fitness value, and then updates the honey source position according to the honey source acceptance result to obtain a preset random forest model. Specifically, the embodiment of the present invention calculates the fitness value of the new honey source. If the fitness value of the new honey source is better than that of the original honey source, the original honey source position is updated; otherwise, it is decided whether to accept the new honey source according to the probability acceptance criterion of the simulated annealing algorithm. Among them, the probability acceptance criterion formula in the embodiment of the present invention is shown in the following formula (8):

[0125]

[0126] Wherein, in the formula, f(new solution ) and f(current solution ) are the fitness values of the new solution and the current solution respectively, T is the temperature parameter, which gradually decreases with the increase of the number of iterations, and the formula T = T0α t can be used, where T0 is the initial temperature, α is the temperature reduction coefficient, and t is the current iteration number.

[0127] Correspondingly, the embodiment of the present invention selects the honey source with a higher fitness value for search according to the information shared by the forager bees to generate a new honey source position. Then, as Figure 6 shown, the embodiment of the present invention repeats the above steps until the stop condition is met, such as reaching the maximum number of iterations or the temperature drops to a certain extent. In addition, the imbalance coefficient in the preset random forest model in the embodiment of the present invention is positively correlated with the minority class sample parameters. Correspondingly, the embodiment of the present invention optimizes the calculation of the imbalance coefficient E in the Unbalanced Accuracy Weighted Random Forest (UAW_RF) algorithm, considers the distribution characteristics of different types of data, and improves the processing ability of unbalanced data. For example, the calculation formula of the imbalance coefficient E in the embodiment of the present invention is adjusted to the following formula (9):

[0128]

[0129] Wherein, in the formula, F min is the number of minority class samples, F maxis the number of majority class samples, and ω is the weight coefficient determined according to the characteristics of data distribution. Correspondingly, if the distribution of minority class samples in the data is relatively scattered, the value of ω is increased to improve the weight of minority class samples in the sampling process. Among them, assuming the variance of minority class samples is Var min , and the variance of majority class samples is Var max , then the weight coefficient is shown in the following formula (10):

[0130]

[0131] Referring to Figure 7 , in some embodiments of the present invention, after performing the honey source position update according to the honey source acceptance result to obtain the preset random forest model, the service anomaly detection method provided by the present invention example further includes but is not limited to the following steps:

[0132] Step S510: Evaluate the decision trees of the preset random forest model through the ensemble pruning algorithm to obtain decision tree performance data.

[0133] Step S520: Perform decision tree removal processing according to the decision tree performance data to update the preset random forest model.

[0134] In this specific embodiment, the embodiment of the present invention first evaluates the decision trees of the preset random forest model through the ensemble pruning algorithm to obtain decision tree performance data, and then performs decision tree removal processing according to the decision tree performance data to update the preset random forest model. Specifically, as Figure 6 shown, after constructing the preset random forest model, the embodiment of the present invention improves the robustness of the model by introducing the ensemble pruning algorithm to delete decision trees. Among them, after the random forest is constructed, the embodiment of the present invention evaluates the performance of each decision tree in the random forest through the ensemble pruning algorithm, and then removes the decision trees with poor performance (for example, the decision trees whose decision tree performance data does not meet the preset performance threshold), and retains the decision trees that contribute more to the detection of the behavior of disassembling and reinstalling old parts, thereby improving the accuracy and efficiency of the model.

[0135] Referring to Figure 8 , in some embodiments of the present invention, before performing service anomaly analysis according to the target feature data and the preset feature threshold to obtain the service anomaly detection result, the service anomaly detection method provided by the embodiment of the present invention further includes but is not limited to the following steps:

[0136] Step S610: Randomly generate a set of first feature thresholds. Among them, each first feature threshold corresponds to a preset individual.

[0137] Step S620: Calculate the third fitness value corresponding to each preset individual.

[0138] Step S630: Determine the parental individuals from the preset individuals according to the third fitness value, and perform crossover and mutation operations on the parental individuals to generate offspring individuals.

[0139] Step S640: Calculate the fourth fitness value of the offspring individuals.

[0140] Step S650: Determine the individual acceptance result through the simulated annealing algorithm according to the third fitness value and the fourth fitness value.

[0141] Step S660: Determine the preset feature threshold through the individual acceptance result.

[0142] In this specific embodiment, the embodiment of the present invention first randomly generates a set of first feature thresholds, each first feature threshold corresponding to a preset individual, and then calculates the third fitness value corresponding to each preset individual. Specifically, the embodiment of the present invention first initializes the population and randomly generates a set of thresholds as the initial population, and each threshold is represented as a preset individual. For example, assume that the population size in the embodiment of the present invention is N pop , then the population can be expressed as where t i represents the i-th preset individual, that is, a threshold. Then, for each preset individual, the embodiment of the present invention calculates its fitness value. Correspondingly, the fitness function in the embodiment of the present invention can be set as the F1 score, and the calculation formula is shown in the following formula (11):

[0143]

[0144] where, in the formula TP represents the number of true positives, FP represents the number of false positives, and FN represents the number of false negatives.

[0145] Furthermore, the embodiment of the present invention determines the parental individuals from the preset individuals according to the third fitness value, and performs crossover and mutation operations on the parental individuals to generate offspring individuals. Specifically, according to the calculated third fitness value, the embodiment of the present invention selects a part of the preset individuals as the parental individuals for crossover and mutation operations. For example, the roulette wheel selection method can be adopted in the embodiment of the present invention, that is, the probability of an individual being selected is proportional to its fitness value. Among them, assume that the fitness value of the individual t i is f(t i ), then the probability of the individual t i being selected is shown in the following formula (12):

[0146]

[0147] Accordingly, in the embodiment of the present invention, two parent individuals are randomly selected for crossover operation to generate two offspring individuals. For example, the embodiment of the present invention may adopt single-point crossover, that is, a position is randomly selected in the threshold strings of the two parent individuals, and the parts of the two parent individuals after this position are exchanged to generate two offspring individuals. Accordingly, assuming the parent individuals are t i and t j , and the randomly selected crossover position is k, then the offspring individuals t′ i and t′ j are respectively t′ i =t i [1:k]+t j [k + 1:], t′ j =t j [1:k]+t i [k + 1:].

[0148] In addition, in the embodiment of the present invention, each offspring individual generated by the crossover operation is mutated with a certain probability. For example, the embodiment of the present invention may randomly select a position and make a slight adjustment to the threshold at this position. Among them, assuming the mutation probability is P m , for the offspring individual t′ i , a number r between [0, 1] is randomly generated. If r < P m , then a position l is randomly selected to mutate t′ i [l], and the mutated t i ′ [l]=t i ′ [l]+δ, where δ is a small random number.

[0149] Furthermore, in the embodiment of the present invention, the fourth fitness value of each offspring individual is calculated, and then the individual acceptance result is determined through the simulated annealing algorithm according to the third fitness value and the fourth fitness value, so as to determine the preset feature threshold through the individual acceptance result. Specifically, in each generation of evolution, for the newly generated individual, if its fitness value is not as good as the current optimal individual, the embodiment of the present invention decides whether to accept this individual according to the probability acceptance criterion of the simulated annealing algorithm. Among them, the probability acceptance criterion formula in the embodiment of the present invention is shown as the following formula (13):

[0150]

[0151] Among them, in the formula, f(new individual ) and f(current best ) are the fitness values of the new individual and the current optimal individual respectively, T is the temperature parameter, which gradually decreases as the number of evolution generations increases, and the formula T = T0α g, where T0 is the initial temperature, α is the temperature reduction coefficient, and g is the current generation of evolution.

[0152] It is easy to understand that the probability acceptance method in the embodiments of the present invention enables the algorithm to jump out of the local optimal solution to a certain extent during the search process, increasing the robustness and search ability of the algorithm. As the temperature decreases, the algorithm gradually converges to a better solution.

[0153] Combined with Figure 1 , referring to Figure 9 , in some embodiments of the present invention, business anomaly analysis is performed based on target feature data and a preset feature threshold to obtain a business anomaly detection result, including but not limited to the following steps:

[0154] Step S710: Perform business anomaly analysis based on the target feature data characteristics, the preset feature threshold, and the time series characteristics to obtain a business anomaly detection result.

[0155] In this specific embodiment, the embodiments of the present invention perform business anomaly analysis based on the target feature data, the preset feature threshold, and the time series characteristics to obtain a business anomaly analysis result. Specifically, the embodiments of the present invention analyze the change trend of user behavior in different time periods by introducing the time series characteristics. For example, when it is determined that the business of a certain agent shows frequent abnormal changes in a short period of time, such as a large number of new installation orders followed by a large number of order cancellations or delayed installations, and this behavior pattern repeats within a specific time period, it is regarded as a clue to potential abnormal business behavior (such as the behavior of demolishing the old and installing the new). Correspondingly, the embodiments of the present invention can effectively improve the detection accuracy of abnormal business by combining the target feature data, the preset feature threshold, and the time series characteristics.

[0156] Next, combined with specific application examples of business anomaly detection, the solutions of the embodiments of the present invention will be introduced and described in detail:

[0157] Exemplarily, as Figure 10 shown, Figure 10It is a schematic diagram of the module algorithm logic flow of the service exception detection method provided by the embodiments of the present invention. Specifically, in the scenario of detecting the behavior of taking commissions by disassembling old and installing new ones and the behavior of grabbing orders, the embodiments of the present invention first obtain the data of disassembling old and installing new cases of similar services from the database of the telecommunications auditing system, and collect the feedback information of users on the operator's services from the work order feedback information, so as to improve the comprehensiveness and accuracy of the data by enriching the data sources. Then, the embodiments of the present invention perform data preprocessing such as data cleaning, data standardization, and data feature extraction on the collected data. By adopting more stringent data screening rules in the processes of data cleaning, standardization, and feature extraction, adding multiple standardization methods in the process of standardization processing, establishing a prediction model for estimation in the process of dealing with missing values, and calculating specific fields according to business logic, the embodiments of the present invention can better identify abnormal patterns and improve the fineness of dealing with complex data types and dealing with missing values. Further, in view of the characteristics of high-dimensional data, the embodiments of the present invention introduce new feature selection methods and integration strategies. For example, a feature selection method based on mutual information is adopted to screen out the features with higher correlation with the behavior of disassembling old and installing new ones, reducing the data dimension. At the same time, when constructing a random forest, a dynamic integration method is adopted to dynamically adjust the weights according to the performance of different decision trees, improving the accuracy and generalization ability of the model.

[0158] It should be noted that before improving the feature selection process, in the clustering process, only traditional clustering algorithms are used, which may not be able to fully process high-dimensional data, resulting in poor clustering effects and difficult to accurately divide feature clusters. At the same time, the feature importance calculation method is relatively single, mainly based on the random forest multi-feature permutation to measure the feature importance. In the face of complex data and various behavior patterns of disassembling old and installing new ones, it may not be able to comprehensively and accurately evaluate the importance degree of features. In addition, only the Pearson correlation coefficient is used for feature correlation calculation, and the correlation between features with non-linear relationships and classification information may not be effectively measured, thus affecting the accuracy of feature selection. When selecting the final feature sequence, only simple correlation thresholds are used for screening, which may miss some potentially important features or be not flexible enough when dealing with complex data. Correspondingly, the embodiments of the present invention can further reduce the data dimension and improve the efficiency and accuracy of subsequent clustering algorithms by introducing the principal component analysis algorithm to assist clustering. At the same time, the embodiments of the present invention expand the feature importance evaluation based on deep learning, fuse multiple correlation metrics, and combine the feature interaction information to dynamically adjust the feature sequence and determine the target feature data, effectively improving the accuracy of feature selection and being able to comprehensively evaluate the importance degree of features.

[0159] Furthermore, in the process of training and optimizing the random forest model in the embodiments of the present invention, on the basis of the adaptive step artificial bee colony algorithm, the simulated annealing algorithm is introduced to alleviate the problem that the artificial bee colony algorithm is prone to falling into local optimal solutions during the search process, accept solutions with worse quality with a certain probability, and increase the ability of the algorithm to jump out of local optima. In addition, the embodiments of the present invention use the genetic algorithm combined with the simulated annealing algorithm to optimize the determination process of the threshold for detecting the replacement of old installations with new ones and detect the behavior of replacing old installations with new ones. First, a group of initial thresholds is randomly generated as the population, and then the population is continuously evolved through the selection, crossover, and mutation operations of the genetic algorithm. At the same time, the probability acceptance criterion of the simulated annealing algorithm is introduced in each generation of evolution to avoid falling into local optima. The fitness function can be set to the F1 score or other metrics that comprehensively consider accuracy and recall. Through this method, the embodiments of the present invention can find the optimal threshold more quickly and accurately to adapt to different data distributions and behavior patterns of replacing old installations with new ones.

[0160] In addition, in the module for detecting the behavior of replacing old installations with new ones, in addition to optimizing the threshold determination method, the embodiments of the present invention introduce a similar intelligent diagnosis idea. Among them, for the determination of the behavior of replacing old installations with new ones, the embodiments of the present invention establish a more refined multi-dimensional evaluation system and analyze the changing trend of user behavior in different time periods by introducing time series features. For example, when it is found that the business of a certain agent has abnormal frequent changes in a short period of time, such as a large number of new installation orders followed by a large number of order cancellations or delayed installations, and this behavior pattern repeats within a specific time period, then it can be regarded as a potential clue for the behavior of replacing old installations with new ones. At the same time, the embodiments of the present invention further refine the determination criteria for order snatching behavior. For example, in addition to the existing situation where a user cancels or delays an order after a new installation of broadband and similar products by the first installer and is then reaccepted and completed by the second installer, the embodiments of the present invention make a comprehensive judgment by combining geographical location information and user behavior patterns. When multiple users in the same area show a similar order snatching behavior pattern and the business characteristics of these users have a certain similarity, it is determined as order snatching behavior.

[0161] Correspondingly, for the penalty regulations for the behavior of replacing old installations with new ones and order snatching, grading treatment can be carried out according to the severity of the behavior. For minor non-subjective behaviors, warning and education methods can be adopted to require the agent to make rectifications. For malicious and repeated behaviors, the penalty intensity can be increased, such as suspending cooperation for a period of time, deducting more commissions or points, or even terminating the cooperation relationship.

[0162] In summary, by comprehensively applying the improved random forest algorithm and the improved algorithm, it is possible to more accurately detect the behavior of obtaining commissions by replacing old equipment with new ones and the behavior of grabbing orders in telecom cooperation agents, improve the efficiency and fairness of operator business management, protect the interests of operators, and maintain good market order. At the same time, after the matching is completed, the matching results are evaluated. The effectiveness of the matching can be evaluated by collecting information such as performance data and customer satisfaction feedback in actual work. For example, statistical indicators such as the business completion volume and customer complaint rate of each matching combination within a certain period of time can be used. Correspondingly, if it is found that the matching effect is not ideal, such as the low business completion volume or high customer complaint rate of certain combinations, the evaluation scale or algorithm parameters can be optimized and adjusted to improve the accuracy of the matching.

[0163] It is easy to understand that in the embodiment of the present invention, the random forest model training and optimization module introduces the idea of the simulated annealing algorithm on the basis of the adaptive step size artificial bee colony algorithm (ASSABC). When the artificial bee colony algorithm falls into a local optimum during the search process, it accepts a worse solution with a certain probability, increasing the ability of the algorithm to jump out of the local optimum and improving the convergence speed during the parameter optimization process. At the same time, by introducing the method of ensemble pruning, the robustness of the model is improved. After the random forest is constructed, the decision trees are evaluated, and the decision trees with poor performance are removed, while the decision trees that contribute more to the detection of the behavior of replacing old equipment with new ones are retained, thereby improving the accuracy and efficiency of the model. In addition, in the embodiment of the present invention, the feature selection processing module uses the principal component analysis algorithm to assist clustering, then expands based on the feature importance evaluation of deep learning, then performs a variety of correlation measure fusions, and adjusts the dynamic feature sequence according to the changes of real-time data and the feedback of the model. Finally, considering the influence of the interaction between features on the classification result, feature interaction analysis is carried out, which can fully process complex data and high-dimensional data, improve the clustering effect, accurately divide feature clusters, and can further accurately evaluate the importance of features when facing complex data and various behavior patterns of replacing old equipment with new ones. At the same time, it can also effectively measure the correlation between features with non-linear relationships and classification information, thus affecting the accuracy of feature selection.

[0164] At the same time, in the embodiment of the present invention, the behavior detection module for replacing old equipment with new ones can avoid falling into a local optimum by using a genetic algorithm combined with a simulated annealing algorithm to optimize the determination process of the detection threshold for replacing old equipment with new ones. At the same time, it can be set to the F1 score or other indicators that comprehensively consider accuracy and recall rate, so as to find the optimal threshold more quickly and accurately. Furthermore, the algorithm can jump out of the local optimum solution to a certain extent during the search process, increasing the robustness and search ability of the algorithm, and adapting to different data distributions and behavior patterns of replacing old equipment with new ones.

[0165] Please refer to Figure 11, An embodiment of the present application further provides a service anomaly detection system, which can implement the above service anomaly detection method. The system includes:

[0166] A first module 810, configured to collect preset service data through a preset data source.

[0167] A second module 820, configured to perform data preprocessing on the preset service data to obtain service data to be detected.

[0168] A third module 830, configured to perform feature selection on the service data to be detected through a feature selection processing module to obtain target feature data. Among them, the feature selection processing module includes a preset random forest model, and the preset random forest model is trained and constructed by an artificial bee colony algorithm and a simulated annealing algorithm.

[0169] A fourth module 840, configured to perform service anomaly analysis based on the target feature data and a preset feature threshold to obtain a service anomaly detection result. Among them, the preset feature threshold is determined by a genetic algorithm combined with a simulated annealing algorithm.

[0170] It can be understood that the content in the above method embodiments is applicable to the system embodiments of the present application. The functions specifically implemented by the system embodiments of the present application are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those of the above method embodiments.

[0171] An embodiment of the present application further provides an electronic device. The electronic device includes a memory and a processor. The memory stores a computer program, and when the processor executes the computer program, it implements the above service anomaly detection method. The electronic device can be any intelligent terminal including a tablet computer, an in-vehicle computer, etc.

[0172] It can be understood that the content in the above method embodiments is applicable to the device embodiments of the present application. The functions specifically implemented by the device embodiments of the present application are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those of the above method embodiments.

[0173] Please refer to Figure 12 , Figure 12 , which schematically shows the hardware structure of an electronic device in another embodiment. The electronic device includes:

[0174] A processor 910, which can be implemented in a general-purpose CPU (Central Processing Unit), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits, etc., and is configured to execute relevant programs to implement the technical solutions provided by the embodiments of the present application;

[0175] The memory 920 can be implemented in the form of a read-only memory (ROM), a static storage device, a dynamic storage device, or a random access memory (RAM), etc. The memory 920 can store an operating system and other application programs. When implementing the technical solutions provided in the embodiments of this specification through software or firmware, the relevant program codes are stored in the memory 920, and the processor 910 is used to call and execute the business exception detection method of the embodiments of this application;

[0176] The input / output interface 930 is used to implement information input and output;

[0177] The communication interface 940 is used to implement communication and interaction between this device and other devices. It can communicate through wired means (such as USB, network cable, etc.) or wireless means (such as mobile network, WIFI, Bluetooth, etc.);

[0178] The bus 950 transmits information between various components of the device (such as the processor 910, the memory 920, the input / output interface 930, and the communication interface 940);

[0179] Among them, the processor 910, the memory 920, the input / output interface 930, and the communication interface 940 are communicatively connected to each other inside the device through the bus 950.

[0180] The embodiments of this application also provide a computer-readable storage medium. The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the above-mentioned business exception detection method is implemented.

[0181] It can be understood that the content in the above method embodiments is applicable to the embodiments of this storage medium. The functions specifically implemented by the embodiments of this storage medium are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those of the above method embodiments.

[0182] As a non-transitory computer-readable storage medium, the memory can be used to store non-transitory software programs and non-transitory computer-executable programs. In addition, the memory can include high-speed random access memory, and can also include non-transitory memory, such as at least one magnetic disk storage device, a flash memory device, or other non-transitory solid-state storage devices. In some embodiments, the memory optionally includes a memory remotely set relative to the processor, and these remote memories can be connected to the processor through a network. Examples of the above network include but are not limited to the Internet, an enterprise intranet, a local area network, a mobile communication network, and combinations thereof.

[0183] The embodiments described in the embodiments of the present application are to more clearly illustrate the technical solutions of the embodiments of the present application, and do not constitute a limitation on the technical solutions provided by the embodiments of the present application. Those skilled in the art will know that with the evolution of technology and the emergence of new application scenarios, the technical solutions provided by the embodiments of the present application are equally applicable to similar technical problems.

[0184] Those skilled in the art can understand that the technical solutions shown in the figures do not constitute a limitation on the embodiments of the present application, and may include more or fewer steps than shown in the figures, or combine certain steps, or different steps.

[0185] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separated, that is, they may be located in one place, or may be distributed to multiple network units. Some or all of the modules can be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0186] Those of ordinary skill in the art can understand that all or some of the steps in the methods disclosed above, and the functional modules / units in the systems and devices, can be implemented as software, firmware, hardware, and their appropriate combinations.

[0187] The terms "first", "second", "third", "fourth", etc. (if any) in the specification of the present application and the above drawings are used to distinguish similar objects, and do not necessarily need to be used to describe a specific order or sequence. It should be understood that such data can be interchanged under appropriate circumstances, so that the embodiments of the present application described here can be implemented in an order other than those illustrated or described here. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusion. For example, a process, method, system, product, or device that includes a series of steps or units does not necessarily have to be limited to those steps or units clearly listed, but may include other steps or units not clearly listed or inherent to these processes, methods, products, or devices.

[0188] It should be understood that in this application, "at least one (item)" means one or more, and "a plurality" means two or more. "And / or" is used to describe the association relationship of associated objects and indicates that three relationships can exist. For example, "A and / or B" can mean: only A exists, only B exists, and both A and B exist at the same time. Among them, A and B can be singular or plural. The character " / " generally indicates that the associated objects before and after are in an "or" relationship. "At least one (one) of the following" or its similar expression refers to any combination of these items, including any combination of single item (one) or plural items (ones). For example, at least one (one) of a, b, or c can mean: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, c can be single or plural.

[0189] In several embodiments provided in this application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are merely illustrative. For example, the above division of units is only a logical function division. In actual implementation, there may be other division methods. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the displayed or discussed coupling or direct coupling or communication connection to each other can be through some interfaces. The indirect coupling or communication connection of devices or units can be in electrical, mechanical or other forms.

[0190] The units described above as separate components may or may not be physically separated. The components displayed as units may or may not be physical units, that is, they can be located in one place, or they can be distributed to multiple network units. Some or all of the units can be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0191] In addition, each functional unit in various embodiments of this application can be integrated in a processing unit, or each unit can exist physically alone, or two or more units can be integrated in one unit. The above integrated unit can be implemented in the form of hardware or in the form of a software functional unit.

[0192] When the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on such understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of this technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes multiple instructions for causing a computer device (which may be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods of various embodiments of this application. The foregoing storage medium includes: various media that can store programs, such as USB flash drives, mobile hard disks, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical discs.

[0193] The preferred embodiments of the embodiments of this application have been described above with reference to the accompanying drawings, and thus do not limit the scope of the rights of the embodiments of this application. Any modifications, equivalent replacements, and improvements made by those skilled in the art without departing from the scope and essence of the embodiments of this application shall be within the scope of the rights of the embodiments of this application.

Claims

1. A method for detecting business anomalies, characterized in that: The method comprises the following steps: Collect preset business data through preset data sources; Performing data preprocessing on the preset service data to obtain service data to be detected; Performing feature selection through a feature selection processing module according to the service data to be detected to obtain target feature data; wherein the feature selection processing module includes a preset random forest model, and the preset random forest model is constructed by training an artificial bee colony algorithm and a simulated annealing algorithm; Business anomaly analysis is performed according to the target feature data and a preset feature threshold to obtain a business anomaly detection result; wherein the preset feature threshold is determined by a genetic algorithm combined with the simulated annealing algorithm.

2. The method according to claim 1, characterized in that The preprocessing of the preset service data to obtain the service data to be detected includes: Performing data cleaning on the preset business data to obtain first preprocessed data; Performing standardization processing on the first preprocessed data to obtain second preprocessed data; The second preprocessed data is processed for missing values ​​using a preset interpolation algorithm to obtain the business data to be detected.

3. The method according to claim 1, characterized in that The step of performing feature selection by a feature selection processing module according to the service data to be detected to obtain target feature data includes: Performing dimensionality reduction processing on the service data to be detected by using a principal component analysis algorithm to obtain preset dimensionality reduction data; Performing clustering processing on the preset dimension reduction data to obtain cluster feature data; Performing feature importance evaluation on the cluster feature data by using the preset random forest model to obtain feature importance data; Calculating correlation parameters according to the clustering feature data to obtain preset correlation coefficient data; wherein the preset correlation coefficient data includes mutual information, maximum information coefficient, Pearson correlation coefficient and Spearman rank correlation coefficient; Calculating the interaction information between feature pairs according to the cluster feature data; The target feature data is determined according to the feature importance data, the preset correlation coefficient data and the interaction information.

4. The method according to claim 1, characterized in that: Before performing feature selection by a feature selection processing module according to the service data to be detected to obtain target feature data, the method further includes: Initializing the parameters of the artificial bee colony algorithm and randomly generating preset nectar source locations; wherein each of the preset nectar source locations corresponds to a set of parameter combinations of the preset random forest model; Calculating a first fitness value of each of the preset nectar source locations; Generate a nectar source position to be updated by using a preset nectar source search formula, and calculate a second fitness value of the nectar source position to be updated; Determine the nectar source acceptance result by using the simulated annealing algorithm according to the first fitness value and the second fitness value; The nectar source position is updated according to the nectar source acceptance result to obtain a preset random forest model; wherein the imbalance coefficient in the preset random forest model is positively correlated with the minority class sample parameter.

5. The method according to claim 4, characterized in that After performing the updating of the nectar source location according to the nectar source acceptance result to obtain a preset random forest model, the method further includes: Performing decision tree evaluation on the preset random forest model by using an integrated pruning algorithm to obtain decision tree performance data; Decision tree removal processing is performed according to the decision tree performance data to update the preset random forest model.

6. The method according to claim 1, characterized in that Before performing the business anomaly analysis according to the target feature data and the preset feature threshold to obtain the business anomaly detection result, the method further includes: Randomly generate a set of first feature thresholds; wherein each of the first feature thresholds corresponds to a preset individual; Calculating the third fitness value corresponding to each of the preset individuals; Determine a parent individual from the preset individuals according to the third fitness value, perform a crossover mutation operation on the parent individual, and generate a child individual; Calculating a fourth fitness value of the offspring individual; Determine the individual acceptance result by using a simulated annealing algorithm according to the third fitness value and the fourth fitness value; The preset characteristic threshold is determined by the individual acceptance result.

7. The method according to claim 1, characterized in that The performing of business anomaly analysis according to the target feature data and the preset feature threshold to obtain a business anomaly detection result includes: Business anomaly analysis is performed based on the target feature data, the preset feature threshold and the time series feature to obtain the business anomaly detection result.

8. A business anomaly detection system, characterized in that: The system comprises: The first module is used to collect preset business data through a preset data source; The second module is used to perform data preprocessing on the preset service data to obtain the service data to be detected; The third module is used to perform feature selection through a feature selection processing module according to the service data to be detected to obtain target feature data; wherein the feature selection processing module includes a preset random forest model, and the preset random forest model is constructed by training an artificial bee colony algorithm and a simulated annealing algorithm; The fourth module is used to perform business anomaly analysis based on the target feature data and the preset feature threshold to obtain a business anomaly detection result; wherein the preset feature threshold is determined by a genetic algorithm combined with the simulated annealing algorithm.

9. An electronic device, characterized in that: include: at least one processor; at least one memory for storing at least one program; When the at least one program is executed by the at least one processor, the at least one processor implements the method according to any one of claims 1 to 7.

10. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the method according to any one of claims 1 to 7 is implemented.

Images