Business anomaly detection method and device, electronic equipment, storage medium and product

Abstract

The invention discloses a service anomaly detection method and device, electronic equipment, a storage medium and a product. The method comprises the steps of obtaining current transaction data corresponding to transactions associated with a to-be-detected business in response to the fact that a business anomaly detection event is triggered; for each piece of current transaction data, performing abnormality diagnosis on the current transaction data through a pre-trained data detection model, and obtaining an abnormality diagnosis result of the current transaction data; performing abnormal alarm detection on the current transaction data based on preset transaction index alarm configuration information, and determining an abnormal alarm detection result of the current transaction data; and judging whether the to-be-detected service is abnormal or not according to the abnormal diagnosis result and the abnormal alarm detection result corresponding to each transaction associated with the to-be-detected service. According to the scheme, business anomaly detection can be carried out more quickly and more accurately, meanwhile, when it is determined that the business is abnormal, abnormal transactions can be positioned quickly, and the manual troubleshooting time is shortened.

Description

Technical Field

[0001] The present invention relates to the field of data processing technology, and in particular to a business anomaly detection method, device, electronic device, storage medium and product. Background Art

[0002] With the continuous development of information technology and the acceleration of enterprise digital transformation, modern financial institutions are increasingly demanding business-level analysis of the overall health of their businesses to ensure the stable operation of their business systems. With increasingly stringent requirements for business risk and compliance, the need for timely and accurate detection of business anomalies is becoming increasingly urgent. This is driving continuous improvement and innovation in business detection technology in terms of real-time performance, accuracy, and interpretability. Therefore, using effective technical means and methods to detect business anomalies, enabling timely response measures, reducing losses, and ensuring stable business operations, has become a critical step in ensuring the secure and stable operation of business systems. Summary of the Invention

[0003] The present invention provides a business anomaly detection method, device, electronic device, storage medium and product, which can perform business anomaly detection faster and more accurately.

[0004] According to one aspect of the present invention, a service anomaly detection method is provided, comprising:

[0005] In response to a business anomaly detection event being triggered, obtaining current transaction data corresponding to each transaction associated with the business to be detected;

[0006] For each of the current transaction data, perform anomaly diagnosis on the current transaction data using a pre-trained data detection model to obtain an anomaly diagnosis result of the current transaction data;

[0007] Performing abnormal alarm detection on the current transaction data based on pre-set transaction indicator alarm configuration information, and determining an abnormal alarm detection result of the current transaction data;

[0008] According to the abnormality diagnosis results and the abnormality alarm detection results corresponding to each transaction associated with the business to be detected, it is determined whether the business to be detected has abnormalities.

[0009] According to another aspect of the present invention, there is provided a service anomaly detection device, comprising:

[0010] A current transaction data acquisition module is used to obtain current transaction data corresponding to each transaction associated with the business to be detected in response to a business anomaly detection event being triggered;

[0011] An abnormality diagnosis result acquisition module is used to perform abnormality diagnosis on each current transaction data using a pre-trained data detection model to obtain an abnormality diagnosis result of the current transaction data;

[0012] An abnormal alarm detection result acquisition module is used to perform abnormal alarm detection on the current transaction data based on pre-set transaction indicator alarm configuration information, and determine the abnormal alarm detection result of the current transaction data;

[0013] The business anomaly detection module is used to determine whether the business to be detected has an anomaly based on the anomaly diagnosis results and the anomaly alarm detection results corresponding to each transaction associated with the business to be detected.

[0014] According to another aspect of the present invention, an electronic device is provided, comprising:

[0015] at least one processor; and

[0016] a memory communicatively connected to the at least one processor; wherein,

[0017] The memory stores a computer program that can be executed by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the service anomaly detection method described in any embodiment of the present invention.

[0018] According to another aspect of the present invention, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the service anomaly detection method according to any embodiment of the present invention when executed.

[0019] According to another aspect of the present invention, a computer program product is provided. The computer program product includes a computer program. When the computer program is executed by a processor, the service anomaly detection method according to any embodiment of the present invention is implemented.

[0020] The business anomaly detection solution provided by the embodiment of the present invention, in response to the triggering of a business anomaly detection event, obtains the current transaction data corresponding to each transaction associated with the business to be detected; for each of the current transaction data, performs anomaly diagnosis on the current transaction data through a pre-trained data detection model to obtain the anomaly diagnosis result of the current transaction data; performs anomaly alarm detection on the current transaction data based on pre-set transaction indicator alarm configuration information to determine the anomaly alarm detection result of the current transaction data; and determines whether the business to be detected has an anomaly based on the anomaly diagnosis result and the anomaly alarm detection result corresponding to each transaction associated with the business to be detected. Through the technical solution provided by the embodiment of the present invention, by fusing the anomaly diagnosis result of the current transaction data corresponding to each transaction associated with the business to be detected by the data detection model and the anomaly alarm detection result of the current transaction data based on the transaction indicator alarm configuration information, business anomaly detection can be performed faster and more accurately. At the same time, when it is determined that a business anomaly has occurred, the abnormal transaction can also be quickly located, shortening the manual investigation time.

[0021] It should be understood that the content described in this section is not intended to identify the key or important features of the embodiments of the present invention, nor is it intended to limit the scope of the present invention. Other features of the present invention will become readily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0023] Figure 1 A flowchart of a service anomaly detection method provided in Example 1 of the present invention;

[0024] Figure 2 A flowchart of a service anomaly detection method provided in Example 2 of the present invention;

[0025] Figure 3 A schematic diagram of the structure of a data detection model provided by an embodiment of the present invention;

[0026] Figure 4 A schematic diagram of the structure of a service anomaly detection device provided in Embodiment 3 of the present invention;

[0027] Figure 5 A schematic diagram of the structure of an electronic device for implementing the service anomaly detection method according to an embodiment of the present invention. DETAILED DESCRIPTION

[0028] In order to enable those skilled in the art to better understand the solutions of the present invention, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the embodiments described are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts should fall within the scope of protection of the present invention.

[0029] It should be noted that the terms "first", "second", etc. in the description and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that the numbers used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0030] Example 1

[0031] Figure 1 This is a flow chart of a service anomaly detection method provided in the first embodiment of the present invention. This embodiment is applicable to the case of detecting service anomalies. The method can be executed by a service anomaly detection device. The service anomaly detection device can be implemented in the form of hardware and / or software. The service anomaly detection device can be configured in an electronic device. Figure 1 As shown, the method includes:

[0032] S110 : In response to a business anomaly detection event being triggered, current transaction data corresponding to each transaction associated with the business to be detected is obtained.

[0033] A business is the sum of a series of related activities, tasks, and processes performed by an organization or individual to achieve a specific goal. Examples include credit card services and investment and wealth management services in the banking system. A transaction is an exchange of value between two parties and is typically a specific activity within a business. For example, in the credit card business, there are transactions such as transfers, repayments, and purchases. Each transaction is associated with a transaction code. A transaction code is a code that identifies a specific transaction type or operation. In the banking system, each different business operation, such as deposits, withdrawals, and transfers, is associated with a specific transaction code.

[0034] In an embodiment of the present invention, upon receiving a user-inputted business anomaly detection instruction, a business anomaly detection event is determined to be triggered. Optionally, a business anomaly detection period may be pre-set, and upon detecting that the current time reaches the time corresponding to the business anomaly detection period, a business anomaly detection event is determined to be triggered. In response to the business anomaly detection event being triggered, current transaction data corresponding to each transaction associated with the business to be detected is obtained. Exemplarily, a pre-stored mapping relationship between businesses and transactions is obtained, where a business can have an association relationship with multiple transactions, i.e., a business can contain multiple transactions. Since data in actual financial enterprises is all based on transaction codes, an association relationship between each transaction and business is established. Responsible transactions can be divided by business stakeholders, and each transaction can be assigned to different businesses, ultimately obtaining a hierarchical relationship between businesses and transactions (i.e., a mapping relationship between businesses and transactions). Based on the mapping relationship between businesses and transactions, each transaction associated with the business to be detected is determined, and the transaction data corresponding to each transaction associated with the business to be detected at the current time (referred to as current transaction data) is obtained.

[0035] S120: For each current transaction data, perform anomaly diagnosis on the current transaction data using a pre-trained data detection model to obtain an anomaly diagnosis result of the current transaction data.

[0036] In an embodiment of the present invention, for the current transaction data corresponding to each transaction associated with the business to be detected, an abnormality diagnosis is performed on the current transaction data using a pre-trained data detection model to obtain an abnormality diagnosis result for the current transaction data. The abnormality diagnosis result includes abnormality and normality. Exemplarily, when the data detection model is a detection model for detecting whether there are abnormalities in the transaction data, the current transaction data can be input into the pre-trained data detection model, and the abnormality diagnosis result of the current transaction data can be determined based on the output result of the data detection model. For example, when the output result of the data detection model is 1, the current transaction data can be determined to be abnormal, and when the output result of the data detection model is 0, the current transaction data can be determined to be normal.

[0037] S130: Perform abnormal alarm detection on the current transaction data based on pre-set transaction indicator alarm configuration information, and determine an abnormal alarm detection result of the current transaction data.

[0038] In an embodiment of the present invention, transaction indicator alarm configuration information corresponding to the business to be detected is obtained. The transaction indicator alarm configuration information includes each transaction indicator associated with the business to be detected and the corresponding thresholds for each transaction indicator. Specifically, the person in charge of each transaction can configure alarms for each transaction based on the actual transaction conditions to generate the transaction indicator alarm configuration information. Configuration items in the transaction indicator alarm configuration information may include transaction codes, transaction indicators, and corresponding thresholds. Transaction indicators may include transaction success rates, response times, and transaction volumes. Each transaction manager needs to set the threshold based on the actual impact of the transaction. Setting the threshold is an iterative and gradually refined process, ultimately resulting in an optimal value. Based on the transaction indicator alarm configuration information, a determination is made as to whether the transaction indicator data associated with the current transaction data is within the corresponding transaction indicator threshold range. If so, the current transaction data is determined to be normal, and the abnormality alarm detection result for the current transaction data is that no abnormality alarm has been generated. Otherwise, the current transaction data is determined to be abnormal, and the abnormality alarm detection result for the current transaction data is that an abnormality alarm has been generated. It should be noted that when at least one transaction indicator data involved in the current transaction data is outside the threshold range of the corresponding transaction indicator, the current transaction data is determined to be abnormal.

[0039] S140: Determine whether the business to be detected has any abnormality based on the abnormality diagnosis results and the abnormality alarm detection results corresponding to each transaction associated with the business to be detected.

[0040] In an embodiment of the present invention, whether the business to be detected has an abnormality is determined based on the abnormality diagnosis results and abnormality alarm detection results corresponding to each transaction associated with the business to be detected. Exemplarily, when, among the transactions associated with the business to be detected, there is at least one transaction corresponding to the abnormality alarm detection result that generates an abnormality alarm, it is determined that the business to be detected has an abnormality; when the abnormality alarm detection results corresponding to each transaction associated with the business to be detected are all no abnormality alarms, but there is at least one transaction corresponding to the abnormality diagnosis result that is abnormal, it is determined that the business to be detected has an abnormality; when the abnormality alarm detection results corresponding to each transaction associated with the business to be detected are all no abnormality alarms, and the abnormality diagnosis results corresponding to each transaction are all normal, it is determined that the business to be detected has no abnormality. Optionally, when it is determined that the business to be detected has an abnormality, the abnormality level of the business to be detected can also be determined based on the abnormality diagnosis results and abnormality alarm detection results corresponding to each transaction associated with the business to be detected, wherein the more abnormal alarms and abnormality diagnosis results there are in the abnormal alarm detection results, the higher the abnormality level.

[0041] Optionally, the abnormal diagnosis results and abnormal alarm detection results corresponding to each transaction associated with the business to be tested are displayed visually on the page, so that management personnel and operation and maintenance personnel can clearly see the health status of the enterprise's business to be tested on this page, and can quickly locate abnormal transactions when encountering business abnormalities.

[0042] The business anomaly detection solution provided by the embodiment of the present invention, in response to the triggering of a business anomaly detection event, obtains the current transaction data corresponding to each transaction associated with the business to be detected; for each of the current transaction data, performs anomaly diagnosis on the current transaction data through a pre-trained data detection model to obtain the anomaly diagnosis result of the current transaction data; performs anomaly alarm detection on the current transaction data based on pre-set transaction indicator alarm configuration information to determine the anomaly alarm detection result of the current transaction data; and determines whether the business to be detected has an anomaly based on the anomaly diagnosis result and the anomaly alarm detection result corresponding to each transaction associated with the business to be detected. Through the technical solution provided by the embodiment of the present invention, by fusing the anomaly diagnosis result of the current transaction data corresponding to each transaction associated with the business to be detected by the data detection model and the anomaly alarm detection result of the current transaction data based on the transaction indicator alarm configuration information, business anomaly detection can be performed faster and more accurately. At the same time, when it is determined that a business anomaly has occurred, the abnormal transaction can also be quickly located, shortening the manual investigation time.

[0043] Example 2

[0044] Figure 2 This is a flowchart of a service anomaly detection method provided in Example 2 of the present invention, such as Figure 2 As shown, the method includes:

[0045] S210 : In response to a business anomaly detection event being triggered, obtain current transaction data corresponding to each transaction associated with the business to be detected.

[0046] S220: For each current transaction data, obtain historical transaction time series data of the transaction corresponding to the current transaction data within a preset historical time period.

[0047] In an embodiment of the present invention, for each current transaction data, historical transaction time series data for the transaction corresponding to the current transaction data within a preset historical time period is obtained. Historical transaction time series data refers to a data set formed by arranging transaction data for the same statistical indicator in chronological order of their occurrence. For example, historical transaction time series data for the transaction corresponding to the current transaction data at the current time (i.e., the time when the current transaction data was collected) over a seven-day period can be obtained. It should be noted that the embodiment of the present invention does not limit the length of the preset historical time period.

[0048] S230: Filter the transaction data that meets the preset filtering conditions in the historical transaction time series data and the current transaction data using a pre-trained data quality filtering model.

[0049] In an embodiment of the present invention, since the acquired historical transaction time series data and current historical data may be of poor quality, the historical transaction time series data and current transaction data are respectively input into a pre-trained data quality filtering model. The data quality filtering model then filters the transaction data in the historical transaction time series data and current transaction data that meet preset filtering conditions. Transaction data that meets the preset filtering conditions can be understood as data of poor quality, such as data with severe missing values, unstable data fluctuations, and variable data frequencies. This arrangement has the advantage of effectively reducing the occurrence of inaccurate business anomaly detection results due to poor data quality.

[0050] S240: Perform abnormality diagnosis on the filtered current transaction data based on the filtered historical transaction time series data and the pre-trained data detection model to obtain abnormality diagnosis results for the current transaction data.

[0051] In an embodiment of the present invention, the filtered historical transaction time series data and the current transaction data can be input into a pre-trained data detection model, and the abnormal diagnosis result of the current transaction data can be determined based on the output result of the data detection model. Optionally, the current transaction data is diagnosed for abnormality based on the historical transaction time series data and the pre-trained data detection model to obtain the abnormal diagnosis result of the current transaction data, including: inputting the historical transaction time series data into a pre-trained data detection model to obtain the reconstructed data output by the data detection model; performing a similarity comparison on the current transaction data and the reconstructed data to determine the similarity comparison result; and determining the abnormal diagnosis result of the current transaction data based on the similarity comparison result. The advantage of such a setting is that the current transaction data can be diagnosed for abnormality in combination with the historical transaction time series data, which can effectively improve the accuracy of abnormal diagnosis of the current transaction data.

[0052] Exemplarily, the historical transaction time series data is input into a pre-trained data detection model to obtain the reconstructed data output by the data detection model, wherein the data detection model can be understood as a machine learning model for data reconstruction. It should be noted that the embodiment of the present invention does not limit the network structure of the data detection model. Optionally, the data detection model includes an encoder, a decoder and a long short-term memory (LSTM) network; the historical transaction time series data is input into the pre-trained data detection model to obtain the reconstructed data output by the data detection model, including: inputting the historical transaction time series data into the encoder in the pre-trained data detection model to obtain the transaction time series code output by the encoder; inputting the transaction time series code into the LSTM network to obtain the reconstructed data code output by the LSTM network; inputting the reconstructed data code into the decoder to obtain the reconstructed data output by the decoder. The advantage of this setting is that the reconstructed data corresponding to the historical transaction time series data can be obtained quickly and accurately.

[0053] Figure 3 A structural diagram of a data detection model provided by an embodiment of the present invention is shown in FIG. Figure 3 As shown, historical transaction time series data is input into the encoder (also known as the encoder) in the data detection model in the form of a data stream. The encoder encodes the historical transaction time series data to generate a transaction time series code, and then inputs the transaction time series code into the LSTM network. The LSTM network analyzes the transaction time series code and generates a reconstructed data code, where the reconstructed data code can also be understood as a predicted data code generated based on the transaction time series code. The LSTM network then inputs the output reconstructed data code into the decoder (also known as the decoder), which decodes the reconstructed data code to generate reconstructed data. The reconstructed data can also be understood as the current transaction data predicted by the data detection model based on the historical transaction time series data.

[0054] The current transaction data is compared with the reconstructed data output by the data detection model for similarity, and a similarity comparison result is determined. The similarity comparison result may include a similarity value. An abnormality diagnosis result for the current transaction data is determined based on the similarity comparison result. For example, if the similarity value is less than a preset similarity threshold, the current transaction data is determined to be abnormal; if the similarity value is greater than the preset similarity threshold, the current transaction data is determined to be normal.

[0055] S250: Perform abnormal alarm detection on the current transaction data based on pre-set transaction indicator alarm configuration information, and determine an abnormal alarm detection result of the current transaction data.

[0056] S260: Determine whether the business to be detected has an abnormality based on the abnormality diagnosis results and the abnormality alarm detection results corresponding to each transaction associated with the business to be detected.

[0057] Because before determining the abnormality diagnosis result of the current transaction data through the data detection model, the data with poor quality in the current transaction data and the historical transaction time series data are filtered, however, these data may also be a manifestation of business abnormalities. Therefore, it is impossible to accurately detect whether there is an abnormality in the business only through the abnormality diagnosis result of the current transaction data. In an embodiment of the present invention, the abnormality diagnosis result of the current transaction data and the abnormal alarm detection result are combined to accurately detect business anomalies.

[0058] The business anomaly detection method provided by the embodiments of the present invention, by integrating the anomaly diagnosis results of the current transaction data corresponding to each transaction associated with the business to be detected with the anomaly alarm detection results of the current transaction data based on transaction indicator alarm configuration information, can perform business anomaly detection more quickly and accurately. Furthermore, when determining that a business anomaly has occurred, it can also quickly locate the abnormal transaction, shortening manual investigation time. Furthermore, when determining the anomaly diagnosis results of the current transaction data, combining the anomaly diagnosis of the current transaction data with historical transaction time series data can effectively improve the accuracy of anomaly diagnosis of the current transaction data.

[0059] In some embodiments, before obtaining the historical transaction time series data of the transaction corresponding to the current transaction data within a preset historical time period, it also includes: determining the transaction time type corresponding to the current transaction data; obtaining the historical transaction time series data of the transaction corresponding to the current transaction data within a preset historical time period, including: obtaining the historical transaction time series data of the transaction corresponding to the current transaction data within a preset historical time period that matches the transaction time type; performing anomaly diagnosis on the current transaction data based on the historical transaction time series data and a pre-trained data detection model, and obtaining anomaly diagnosis results of the current transaction data, including: obtaining a pre-trained data detection model corresponding to the transaction time type; performing anomaly diagnosis on the current transaction data based on the historical transaction time series data and the data detection model, and obtaining anomaly diagnosis results of the current transaction data. The advantage of this setting is that data detection models are constructed separately for transaction data on working days and non-working days, which solves the problem that financial enterprises have less business data on non-working days than on working days, resulting in inaccurate anomaly diagnosis of transaction data.

[0060] Since the scale of business data on working days and non-working days is quite different, the business data on non-working days is usually much less than that on working days. If the abnormality diagnosis of non-working day transaction data is performed based on the historical transaction time series data of working days, or the abnormality diagnosis of working day transaction data is performed based on the historical transaction time series data of non-working days, the abnormality diagnosis result will be inaccurate. Therefore, before obtaining the historical transaction time series data of the transaction corresponding to the current transaction data within the preset historical time period, it also includes: determining the transaction time type corresponding to the current transaction data, wherein the transaction time type includes working days and non-working days. Obtain the historical transaction time series data of the transaction corresponding to the current transaction data within the preset historical time period that matches the transaction time type. For example, the acquisition time of the current transaction data is Tuesday (such as May 20). When obtaining the historical transaction time series data of the transaction corresponding to the current transaction data at the current time compared with the previous 7 days, the historical transaction time series data is the transaction data of May 9, May 12-May 16, and May 19. Obtain a pre-trained data detection model corresponding to the transaction time type. It can be understood that a data detection model corresponding to working days is pre-built based on the historical transaction data set of working days (such as can be called the first data detection model), and a data detection model corresponding to non-working days is pre-built based on the historical transaction data set of non-working days (such as can be called the second data detection model). Then, based on the transaction time type corresponding to the current transaction data, obtain the data detection model corresponding to the transaction time type. For example, if the transaction time type corresponding to the current transaction data is a working day, obtain the first data detection model; if the transaction time type corresponding to the current transaction data is a non-working day, obtain the second data detection model. Then, based on the historical transaction time series data and the data detection model, perform anomaly diagnosis on the current transaction data to obtain the anomaly diagnosis results of the current transaction data.

[0061] Example 3

[0062] Figure 4 This is a structural diagram of a service anomaly detection device provided in Example 3 of the present invention.

[0063] like Figure 4 As shown, the device includes:

[0064] The current transaction data acquisition module 410 is configured to acquire the current transaction data corresponding to each transaction associated with the business to be detected in response to a business anomaly detection event being triggered;

[0065] The abnormality diagnosis result acquisition module 420 is configured to perform abnormality diagnosis on each current transaction data using a pre-trained data detection model to obtain an abnormality diagnosis result of the current transaction data;

[0066] The abnormal alarm detection result acquisition module 430 is used to perform abnormal alarm detection on the current transaction data based on the preset transaction indicator alarm configuration information, and determine the abnormal alarm detection result of the current transaction data;

[0067] The business anomaly detection module 440 is configured to determine whether the business to be detected has an anomaly based on the anomaly diagnosis results and the anomaly alarm detection results corresponding to each transaction associated with the business to be detected.

[0068] Optionally, also include:

[0069] a historical transaction time series data acquisition module, configured to acquire historical transaction time series data of transactions corresponding to the current transaction data within a preset historical time period before performing anomaly diagnosis on the current transaction data using a pre-trained data detection model and obtaining an anomaly diagnosis result for the current transaction data;

[0070] The abnormal diagnosis result acquisition module includes:

[0071] The abnormality diagnosis result acquisition unit is used to perform abnormality diagnosis on the current transaction data based on the historical transaction time series data and a pre-trained data detection model to obtain the abnormality diagnosis result of the current transaction data.

[0072] Optionally, the abnormal diagnosis result acquisition unit includes:

[0073] a reconstructed data acquisition subunit, configured to input the historical transaction time series data into a pre-trained data detection model and obtain reconstructed data output by the data detection model;

[0074] A similarity comparison result subunit is used to perform a similarity comparison on the current transaction data and the reconstructed data to determine a similarity comparison result;

[0075] The abnormality diagnosis result determining subunit is used to determine the abnormality diagnosis result of the current transaction data according to the similarity comparison result.

[0076] Optionally, the data detection model includes an encoder, a decoder, and a long short-term memory (LSTM) network;

[0077] The reconstructed data acquisition subunit is used to:

[0078] Inputting the historical transaction time series data into an encoder in a pre-trained data detection model to obtain a transaction time series code output by the encoder;

[0079] Inputting the transaction timing code into the LSTM network to obtain the reconstructed data code output by the LSTM network;

[0080] The reconstructed data is encoded and inputted into the decoder to obtain the reconstructed data outputted by the decoder.

[0081] Optionally, also include:

[0082] A data filtering module is used to perform anomaly diagnosis on the current transaction data based on the historical transaction time series data and a pre-trained data detection model, and before obtaining the anomaly diagnosis result of the current transaction data, filter the transaction data in the historical transaction time series data and the current transaction data that meet the preset filtering conditions through a pre-trained data quality filtering model.

[0083] Optionally, also include:

[0084] a transaction time type determination module, configured to determine the transaction time type corresponding to the current transaction data before obtaining historical transaction time series data of the transaction corresponding to the current transaction data within a preset historical time period;

[0085] The module for acquiring historical transaction time series data is used to:

[0086] Acquire historical transaction time series data of the transaction corresponding to the current transaction data within a preset historical time period matching the transaction time type;

[0087] The abnormal diagnosis result acquisition unit is used to:

[0088] Obtaining a pre-trained data detection model corresponding to the transaction time type;

[0089] Anomaly diagnosis is performed on the current transaction data based on the historical transaction time series data and the data detection model to obtain an anomaly diagnosis result of the current transaction data.

[0090] The service anomaly detection device provided in the embodiment of the present invention can execute the service anomaly detection method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0091] Example 4

[0092] Figure 5A schematic diagram of the structure of an electronic device 10 that can be used to implement an embodiment of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or claimed herein.

[0093] like Figure 5 As shown, the electronic device 10 includes at least one processor 11 and a memory, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc., which is communicatively connected to the at least one processor 11. The memory stores a computer program that can be executed by the at least one processor. The processor 11 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 12 or the computer program loaded from the storage unit 18 into the random access memory (RAM) 13. Various programs and data required for the operation of the electronic device 10 can also be stored in the RAM 13. The processor 11, ROM 12, and RAM 13 are connected to each other via a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0094] Multiple components in the electronic device 10 are connected to the I / O interface 15, including an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a magnetic disk, an optical disk, etc.; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information / data with other devices via a computer network such as the Internet and / or various telecommunication networks.

[0095] The processor 11 can be any general-purpose and / or specialized processing component with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various specialized artificial intelligence (AI) computing chips, various processors that run machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. The processor 11 executes the various methods and processes described above, such as the service anomaly detection method.

[0096] In particular, according to an embodiment of the present invention, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present invention includes a computer program product that includes a computer program carried on a non-transitory computer-readable medium, the computer program containing program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network via the communication unit 19, or installed from the storage unit 18, or installed from the ROM 12. When the computer program is executed by the processor 11, the above-mentioned functions defined in the method of the embodiment of the present invention are performed.

[0097] In some embodiments, the service anomaly detection method may be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 10 via the ROM 12 and / or the communication unit 19. When the computer program is loaded into the RAM 13 and executed by the processor 11, one or more steps of the service anomaly detection method described above may be performed. Alternatively, in other embodiments, the processor 11 may be configured to execute the service anomaly detection method in any other appropriate manner (e.g., by means of firmware).

[0098] Various embodiments of the systems and techniques described above can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on a chip (SOCs), complex programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments can include being implemented in one or more computer programs that are executable and / or interpreted on a programmable system that includes at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0099] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, such that when the computer program is executed by the processor, the functions / operations specified in the flowcharts and / or block diagrams are implemented. The computer program may be executed entirely on the machine, partially on the machine, as a stand-alone software package, partially on the machine and partially on a remote machine, or entirely on a remote machine or server.

[0100] In the context of the present invention, computer-readable storage media can be tangible media that can contain or store a computer program for use with an instruction execution system, device or equipment or used in combination with an instruction execution system, device or equipment. Computer-readable storage media can include but are not limited to electronic, magnetic, optical, electromagnetic, infrared or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, computer-readable storage media can be machine-readable signal media. More specific examples of machine-readable storage media can include electrical connections based on one or more lines, portable computer disks, hard disks, random access memories (RAM), read-only memories (ROM), erasable programmable read-only memories (EPROM or flash memory), optical fibers, portable compact disk read-only memories (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0101] To provide interaction with a user, the systems and techniques described herein can be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices can also be used to provide interaction with the user; for example, the feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including acoustic input, voice input, or tactile input).

[0102] The systems and techniques described herein can be implemented in a computing system that includes back-end components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes front-end components (e.g., a user computer with a graphical user interface or web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such back-end components, middleware components, or front-end components. The components of the system can be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0103] A computing system may include clients and servers. The clients and servers are typically remote from each other and typically interact via a communication network. This client-server relationship arises through computer programs running on the respective computers, creating a client-server relationship. The server may be a cloud server, also known as a cloud computing server or cloud host. This server is a hosting product within the cloud computing service ecosystem that addresses the management difficulties and limited scalability of traditional physical hosting and VPS services.

[0104] It should be understood that the various forms of the processes shown above can be used to reorder, add, or delete steps. For example, the steps described in the present invention can be performed in parallel, sequentially, or in a different order, as long as the desired results of the technical solution of the present invention can be achieved. This is not limited herein.

[0105] The above specific embodiments do not limit the scope of protection of the present invention. Those skilled in the art will appreciate that various modifications, combinations, sub-combinations, and substitutions may be made based on design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the present invention are intended to be included within the scope of protection of the present invention.

Claims

1. A method for detecting business anomalies, characterized in that: include: In response to a business anomaly detection event being triggered, obtaining current transaction data corresponding to each transaction associated with the business to be detected; For each of the current transaction data, perform anomaly diagnosis on the current transaction data using a pre-trained data detection model to obtain an anomaly diagnosis result of the current transaction data; Performing abnormal alarm detection on the current transaction data based on pre-set transaction indicator alarm configuration information, and determining an abnormal alarm detection result of the current transaction data; According to the abnormality diagnosis results and the abnormality alarm detection results corresponding to each transaction associated with the business to be detected, it is determined whether the business to be detected has abnormalities.

2. The method according to claim 1, characterized in that Before performing abnormality diagnosis on the current transaction data using a pre-trained data detection model to obtain an abnormality diagnosis result of the current transaction data, the method further includes: Obtaining historical transaction time series data of the transaction corresponding to the current transaction data within a preset historical time period; Performing anomaly diagnosis on the current transaction data using a pre-trained data detection model to obtain an anomaly diagnosis result of the current transaction data includes: Anomaly diagnosis is performed on the current transaction data based on the historical transaction time series data and a pre-trained data detection model to obtain an anomaly diagnosis result of the current transaction data.

3. The method according to claim 2, characterized in that Performing anomaly diagnosis on the current transaction data based on the historical transaction time series data and a pre-trained data detection model to obtain an anomaly diagnosis result of the current transaction data includes: Inputting the historical transaction time series data into a pre-trained data detection model to obtain reconstructed data output by the data detection model; Performing a similarity comparison on the current transaction data and the reconstructed data to determine a similarity comparison result; An abnormality diagnosis result of the current transaction data is determined according to the similarity comparison result.

4. The method according to claim 3, characterized in that The data detection model includes an encoder, a decoder and a long short-term memory (LSTM) network; Inputting the historical transaction time series data into a pre-trained data detection model to obtain reconstructed data output by the data detection model includes: Inputting the historical transaction time series data into an encoder in a pre-trained data detection model to obtain a transaction time series code output by the encoder; Inputting the transaction timing code into the LSTM network to obtain the reconstructed data code output by the LSTM network; The reconstructed data is encoded and inputted into the decoder to obtain the reconstructed data outputted by the decoder.

5. The method according to claim 2, characterized in that Before performing abnormality diagnosis on the current transaction data based on the historical transaction time series data and the pre-trained data detection model to obtain the abnormality diagnosis result of the current transaction data, the method further includes: The transaction data that meets the preset filtering conditions in the historical transaction time series data and the current transaction data are filtered respectively through the pre-trained data quality filtering model.

6. The method according to claim 2, characterized in that Before obtaining the historical transaction time series data of the transaction corresponding to the current transaction data within a preset historical time period, the method further includes: Determining a transaction time type corresponding to the current transaction data; Obtaining historical transaction time series data of the transaction corresponding to the current transaction data within a preset historical time period, including: Acquire historical transaction time series data of the transaction corresponding to the current transaction data within a preset historical time period matching the transaction time type; Performing anomaly diagnosis on the current transaction data based on the historical transaction time series data and a pre-trained data detection model to obtain an anomaly diagnosis result of the current transaction data includes: Obtaining a pre-trained data detection model corresponding to the transaction time type; Anomaly diagnosis is performed on the current transaction data based on the historical transaction time series data and the data detection model to obtain an anomaly diagnosis result of the current transaction data.

7. A service anomaly detection device, characterized in that: include: A current transaction data acquisition module is used to obtain current transaction data corresponding to each transaction associated with the business to be detected in response to a business anomaly detection event being triggered; An abnormality diagnosis result acquisition module is used to perform abnormality diagnosis on each current transaction data using a pre-trained data detection model to obtain an abnormality diagnosis result of the current transaction data; An abnormal alarm detection result acquisition module is used to perform abnormal alarm detection on the current transaction data based on pre-set transaction indicator alarm configuration information, and determine the abnormal alarm detection result of the current transaction data; The business anomaly detection module is used to determine whether the business to be detected has an anomaly based on the anomaly diagnosis results and the anomaly alarm detection results corresponding to each transaction associated with the business to be detected.

8. An electronic device, characterized in that: The electronic device comprises: at least one processor; and a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the service anomaly detection method according to any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the service anomaly detection method according to any one of claims 1 to 6 when executed.

10. A computer program product, characterized in that The computer program product comprises a computer program, and when the computer program is executed by a processor, the computer program implements the service anomaly detection method according to any one of claims 1 to 6.

Images