System anomaly detection method, device and equipment

Abstract

The embodiment of the invention discloses a system anomaly detection method, device and equipment. According to the scheme, the method comprises the steps that after target data and comparison data are obtained, a composite data sequence is generated based on the target data and the comparison data; wherein the target data comprises first abnormal alarm data of the transaction system in a preset time period of a current date; the comparison data comprises second abnormal alarm data of the transaction system in the preset time period of the historical date or the current date; and performing data analysis on the composite data sequence by using a change point detection algorithm to obtain an anomaly detection result for the transaction system.

Description

Technical Field

[0001] The present application relates to the technical field of system anomaly detection, and in particular to a system anomaly detection method, device, and equipment. Background Art

[0002] During the operation of the trading system client, abnormal situations such as white screen and page loading failure may occur. After an abnormal situation occurs, the client usually needs to report these abnormal situations. The abnormality detection server needs to analyze the reported abnormal situations. If the number of abnormal situations increases suddenly in a short period of time, abnormal alarms and abnormal handling are required.

[0003] In view of this, it is necessary to provide a high-accuracy system anomaly detection solution. Summary of the Invention

[0004] In view of this, embodiments of the present application provide a system anomaly detection method, apparatus, and device to provide a highly accurate system anomaly detection solution.

[0005] To solve the above technical problems, the embodiments of this specification provide a system anomaly detection method, including:

[0006] Obtain target data and comparison data; the target data includes first abnormal alarm data of the trading system within a preset time period of the current date; the comparison data includes second abnormal alarm data of the trading system within the preset time period of a historical date or the current date;

[0007] generating a composite data sequence based on the target data and the comparison data;

[0008] The composite data sequence is analyzed using a change point detection algorithm to obtain an anomaly detection result for the trading system.

[0009] The present invention also provides a system anomaly detection device, including:

[0010] A data acquisition module is configured to acquire target data and comparison data; the target data includes first abnormality alarm data of the trading system within a preset time period of the current date; the comparison data includes second abnormality alarm data of the trading system within the preset time period of a historical date or the current date;

[0011] A sequence generation module, configured to generate a composite data sequence based on the target data and the comparison data;

[0012] The data analysis module is used to perform data analysis on the composite data sequence using a change point detection algorithm to obtain an anomaly detection result for the trading system.

[0013] The embodiments of this specification also provide a system anomaly detection device, including:

[0014] at least one processor; and,

[0015] a memory communicatively connected to the at least one processor; wherein,

[0016] The memory stores instructions executable by the at least one processor, the instructions being executed by the at least one processor to enable the at least one processor to:

[0017] Obtain target data and comparison data; the target data includes first abnormal alarm data of the trading system within a preset time period of the current date; the comparison data includes second abnormal alarm data of the trading system within the preset time period of a historical date or the current date;

[0018] generating a composite data sequence based on the target data and the comparison data;

[0019] The composite data sequence is analyzed using a change point detection algorithm to obtain an anomaly detection result for the trading system.

[0020] At least one embodiment provided in this specification can achieve the following beneficial effects:

[0021] In an embodiment of the present specification, after the anomaly detection server obtains target data including the first anomaly alarm data of the trading system within a preset time period of the current date and comparison data including the second anomaly alarm data of the trading system within the preset time period of a historical date or the current date, it can generate a composite data sequence based on the target data and the comparison data, and then use the change point detection algorithm to perform data analysis on the composite data sequence to obtain an anomaly detection result for the trading system. Thus, on the one hand, only analyzing the anomaly alarm data of the trading system within the preset time period is conducive to reducing the workload of data analysis, and is also conducive to reducing the impact of noise data on data analysis, thereby helping to improve the accuracy of system anomaly detection. On the other hand, using the change point detection algorithm to perform data analysis on the composite data sequence can determine the anomaly detection result of the trading system based on the degree of change in the data statistical characteristics of the target data relative to the comparison data, which can effectively avoid the impact of fluctuating data and noise data on the anomaly detection result of the trading system, and is conducive to improving the accuracy of system anomaly detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] In order to more clearly illustrate the embodiments of this specification or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are only some embodiments recorded in this application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0023] Figure 1 A schematic diagram of an application scenario of a system anomaly detection method provided in an embodiment of this specification;

[0024] Figure 2 A flowchart of a system anomaly detection method provided in an embodiment of this specification;

[0025] Figure 3 This is an overall flow chart of a system anomaly detection method provided in an embodiment of this specification;

[0026] Figure 4 The embodiments of this specification provide corresponding Figure 2 A structural diagram of a system anomaly detection device;

[0027] Figure 5 The embodiments of this specification provide corresponding Figure 2 A structural diagram of a system anomaly detection device; DETAILED DESCRIPTION

[0028] The following description sets forth many specific details to facilitate a thorough understanding of the present application. However, the present application can be implemented in many other ways than those described herein, and those skilled in the art can make similar generalizations without violating the scope of the present application. Therefore, the present application is not limited to the specific implementations disclosed below.

[0029] The terms used in one or more embodiments of the present application are for the purpose of describing specific embodiments only and are not intended to limit one or more embodiments of the present application. The singular forms "a", "the" and "the" used in one or more embodiments of the present application and the appended claims are also intended to include plural forms, unless the context clearly indicates otherwise. It should also be understood that the term "and / or" used in one or more embodiments of the present application refers to and includes any or all possible combinations of one or more associated listed items.

[0030] It should be understood that although the terms first, second, etc. may be used to describe various information in one or more embodiments of the present application, such information should not be limited to these terms. These terms are only used to distinguish information of the same type from each other. For example, without departing from the scope of one or more embodiments of the present application, the first may also be referred to as the second, and similarly, the second may also be referred to as the first. Depending on the context, the word "if" as used herein may be interpreted as "at the time of" or "when" or "in response to determining".

[0031] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with the relevant laws, regulations and standards of the relevant regions, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0032] In the prior art, anomaly detection schemes for trading systems are primarily based on the statistical data of historical anomaly reports from the trading system around the clock, determining a fixed threshold. When the number of anomaly reports in a certain time period exceeds the threshold, an anomaly alarm is issued. However, trading systems typically do not operate around the clock. Within a day, trading systems are typically divided into trading time periods and non-trading time periods. Therefore, the thresholds determined based on the statistical data of historical anomaly reports from the trading system around the clock are unreasonable, and the data in the non-trading time period is noise data, resulting in low accuracy in anomaly detection for trading systems. Furthermore, because the anomaly report data from trading systems is typically non-stationary and the frequency of change in the statistical characteristics of the data is typically high, traditional anomaly detection methods that set fixed thresholds cannot effectively filter out random fluctuations and noise in the data, resulting in even a short-term sudden fluctuation triggering an anomaly alarm, which in turn leads to low accuracy in anomaly detection for trading systems.

[0033] In order to solve the defects in the prior art, this solution provides the following embodiments.

[0034] Figure 1 A schematic diagram of an application scenario of a system anomaly detection method provided in an embodiment of this specification.

[0035] like Figure 1 As shown, when an abnormal situation occurs at the client 101 of the trading system, abnormal alarm information can be reported to the server 102 of the trading system. After receiving the abnormal alarm information reported by the client 101 of the trading system, the server 102 of the trading system can store the abnormal alarm information in the database 103.

[0036] When anomaly detection server 104 receives an instruction to perform data anomaly detection on a target version of a trading system, it retrieves multiple anomaly alarm messages from database 103, each of which has a target version and a reporting time point within a preset time period. Based on these multiple anomaly alarm messages, it determines target data and comparison data. A composite data sequence is then generated based on the target data and the comparison data. A change point detection algorithm is then used to analyze the composite data sequence to obtain anomaly detection results for the target version of the trading system.

[0037] The trading system's server 102 and anomaly detection server 104 include, but are not limited to, any device, equipment, platform, server, or server cluster with computing or processing capabilities. Data transmission between the trading system's client 101 and the trading system's server 102 may be accomplished via a local area network (LAN), a wide area network (WAN), the Internet, or other data network connections, or by other means, without specific limitation.

[0038] Figure 1 In the method, after the anomaly detection server obtains target data including first anomaly alarm data of the trading system within a preset time period of the current date and comparison data including second anomaly alarm data of the trading system within the preset time period of a historical date or the current date, it can generate a composite data sequence based on the target data and the comparison data, and then use a change point detection algorithm to perform data analysis on the composite data sequence to obtain an anomaly detection result for the trading system. Therefore, on the one hand, only analyzing the anomaly alarm data of the trading system within the preset time period is conducive to reducing the workload of data analysis and reducing the impact of noise data on data analysis, thereby improving the accuracy of system anomaly detection. On the other hand, using the change point detection algorithm to perform data analysis on the composite data sequence can determine the anomaly detection result of the trading system based on the degree of change in the data statistical characteristics of the target data relative to the comparison data, which can effectively avoid the impact of fluctuating data and noise data on the anomaly detection result of the trading system, and is conducive to improving the accuracy of system anomaly detection.

[0039] Figure 2 This is a flow chart of a system anomaly detection method provided in an embodiment of this specification. From a hardware perspective, the execution subject of this process can be a server. From a program perspective, the execution subject of this process can be an application installed on the server. Figure 2 As shown, the process may include the following steps:

[0040] Step 202: Obtain target data and comparison data; the target data includes first abnormal alarm data of the trading system within a preset time period of the current date; the comparison data includes second abnormal alarm data of the trading system within the preset time period of a historical date or the current date.

[0041] In the embodiments of this specification, a trading system may refer to a system for providing trading services. The trading services that the trading system may provide may include but are not limited to: fund trading services, stock trading services, commodity trading services, energy trading services, etc.

[0042] In practical applications, a trading system may include a client and a server. The client can collect user operation information and provide it to the server for information processing. When an abnormality occurs in the operation of the trading system at the client, the client can also issue an abnormality alarm and report the abnormality alarm information to the trading system server. The trading system server can store the abnormality alarm information in a database. The abnormality detection server can obtain this abnormality alarm information from the database and count the number of abnormality alarms reported by the client in various time intervals during the operation of the trading system. If the number of abnormal situations reported by the client continues to increase or surges, it may be that there is a problem with the trading system. An alarm can be issued so that the abnormality handling terminal or relevant operation and maintenance personnel can deal with the abnormality of the trading system.

[0043] In an embodiment of the present specification, the target data may include the first abnormality alarm data of the trading system within a preset time period of the current date, and the comparison data may include the second abnormality alarm data of the trading system within the preset time period of a historical date or the current date. The comparison data is relatively stable, without data surges or sudden changes. For example, if the comparison data is the abnormality alarm data of the trading system within a preset time period of a historical date, the abnormality detection result of the trading system within the preset time period of the historical date should be no abnormal data change. If the abnormality detection result of the trading system within the preset time period of the historical date is abnormal data change, the data of the historical date is not used as the comparison data. For example, if the current date is August 7 and the preset time period is 9:30-10:00, if the trading system has an abnormality alarm between 9:30-10:00 on August 6 (the abnormality detection result of the trading system between 9:30-10:00 on August 6 is abnormal data change), the abnormality alarm data between 9:30-10:00 on August 6 is not used as the comparison data. If the trading system does not have any abnormal alarms between 9:30 and 10:00 on August 5 (the trading system does not have any abnormal detection results between 9:30 and 10:00 on August 5, which means abnormal data changes), then the abnormal alarm data between 9:30 and 10:00 on August 5 can be used as comparison data.

[0044] In the embodiments of this specification, when anomaly detection is required for a grayscale version of a trading system, the target data can be the first anomaly alarm data from the grayscale version of the trading system within a preset time period on the current date, while the comparison data can be the second anomaly alarm data from the main version of the trading system within a preset time period on the current date. The grayscale version is the newer, less stable version to be evaluated, while the main version is the more stable version. This allows the grayscale version of the trading system's anomaly alarm data to be tested for data surges or sudden changes, using the more stable main version as a reference.

[0045] Step 204: Generate a composite data sequence based on the target data and the comparison data.

[0046] In the embodiments of this specification, both the target data and the comparison data may be in the form of data sequences, and thus the target data and the comparison data may be concatenated to obtain a composite data sequence. Specifically, the composite data sequence may be obtained by concatenating the tail of the target data with the head of the comparison data, or alternatively, the tail of the comparison data with the head of the target data, without specific limitation.

[0047] For example, if the target data includes 30 data, the comparison data also includes 30 data accordingly, and the composite data sequence generated based on the target data and the comparison data includes 60 data.

[0048] In actual applications, the data included in the target data and the comparison data can be numerical data used to reflect the number of abnormal alarms in the trading system in each time interval within a preset time period, or it can be ratio data used to reflect the ratio of the number of abnormal alarms in the trading system in each time interval within a preset time period to the number of online users.

[0049] Step 206: Analyze the composite data sequence using a change point detection algorithm to obtain an anomaly detection result for the trading system.

[0050] In the embodiments of this specification, change point detection (CPD) is a technique used to identify locations in a time series or data stream where statistical characteristics significantly change. The core goal of CPD is to locate moments (i.e., "change points") when a sudden change occurs in the data distribution, mean, variance, trend, or other statistical characteristics. CPD is commonly used in fields such as anomaly detection, quality control, financial analysis, and industrial monitoring.

[0051] In practical applications, the change point detection algorithm is used to analyze composite data sequences. Based on the degree of change in the statistical characteristics of the target data in the composite data sequence relative to the comparison data, it can be determined whether there are change points in the target data, and then the anomaly detection results of the trading system can be determined. This can effectively avoid the impact of fluctuating data and noise data on the anomaly detection results of the trading system, and is conducive to improving the accuracy of system anomaly detection.

[0052] In practical applications, the anomaly detection results for a trading system may include a first anomaly detection result indicating that the data change in the trading system is abnormal, and a second anomaly detection result indicating that the data change in the trading system is normal. If the first anomaly detection result indicates that the data change in the trading system is abnormal, an anomaly alarm may be issued. Since the anomaly alarm will be explained in detail in subsequent embodiments of this specification, it will not be further described here.

[0053] Figure 2In the method, after the anomaly detection server obtains target data including first anomaly alarm data of the trading system within a preset time period of the current date and comparison data including second anomaly alarm data of the trading system within the preset time period of a historical date or the current date, it can generate a composite data sequence based on the target data and the comparison data, and then use a change point detection algorithm to perform data analysis on the composite data sequence to obtain an anomaly detection result for the trading system. Therefore, on the one hand, only analyzing the anomaly alarm data of the trading system within the preset time period is conducive to reducing the workload of data analysis and reducing the impact of noise data on data analysis, thereby improving the accuracy of system anomaly detection. On the other hand, using the change point detection algorithm to perform data analysis on the composite data sequence can determine the anomaly detection result of the trading system based on the degree of change in the data statistical characteristics of the target data relative to the comparison data, which can effectively avoid the impact of fluctuating data and noise data on the anomaly detection result of the trading system, and is conducive to improving the accuracy of system anomaly detection.

[0054] based on Figure 2 The method in this specification also provides some specific implementation plans of the method, which are described below.

[0055] Optional, Figure 2 In the method, the trading system is provided with a trading time period and a non-trading time period; the non-trading time period is used to indicate a time period during which the trading system is prohibited from being used for trading; the trading time period is used to indicate a time period during which the trading system is allowed to be used for trading; and the preset time period is within the trading time period.

[0056] In the embodiments of this specification, the trading system can be configured with trading time periods and non-trading time periods. Users can use the trading system client to complete transactions during the trading time period, while users cannot use the trading system to conduct transactions during the non-trading time period. The preset time period is a time period within the trading time period of the trading system. Since the trading system is used only during the trading time period, only the data within the trading time period is valuable for statistics and analysis. Abnormal alarm data of the trading system during the non-trading time period is noise data. Therefore, by ensuring that the preset time period is within the trading time period of the trading system, the interference of noise data can be reduced, ensuring the accuracy of abnormality detection of the trading system. Furthermore, by only performing statistics and analysis on the data within the trading time period of the trading system, statistics and analysis of data during the trading time period of the trading system can be avoided, which helps reduce the workload of data analysis and improve detection efficiency.

[0057] For example, if the trading time period set by the trading system is 8:00-18:00, and the remaining time periods are non-trading time periods, then the preset time period is a time period within 8:00-18:00. In actual applications, the length of the preset time period can be set and adjusted according to actual needs. For example, the preset time period can be 30 minutes or 50 minutes, and there is no specific limitation on this.

[0058] Optional, Figure 2 In the method, the time interval between the end time of the preset time period and the current time is less than or equal to the preset duration; the preset duration is in minutes; in step 202, obtaining target data and comparison data may specifically include:

[0059] The target data and comparison data are acquired according to a preset data acquisition cycle; the data acquisition cycle is minute-level.

[0060] In the embodiments of this specification, the preset duration can be set and adjusted according to actual needs, and the preset duration is in minutes. For example, the preset duration can be 1 minute or 2 minutes, and there is no specific limitation on this.

[0061] In practice, the preset duration can usually be set to 1 minute. When the preset duration is set to 1 minute, the time interval between the end time of the preset time period and the current time should be less than or equal to 1 minute. For example, if the current time is 10:00:00, the end time of the preset time period should be within the time interval of 9:59:00-10:00:00.

[0062] In an embodiment of the present specification, by limiting the time interval between the end time of the preset time period and the current time to be less than or equal to the preset duration, it can be ensured that the target data including the first abnormal alarm data of the trading system within the preset time period of the current date is data closer to the current time, thereby ensuring the timeliness of the abnormality detection results for the trading system obtained by performing data analysis on the composite data sequence containing the target data and the comparison data using the change point detection algorithm.

[0063] In the embodiments of this specification, the preset data acquisition period can be set and adjusted according to actual needs, and the data acquisition period is at the minute level, for example, the data acquisition period can be 1 minute or 2 minutes, and there is no specific limitation on this.

[0064] In practical applications, the data acquisition cycle can usually be set to 1 minute. When the data acquisition cycle is set to 1 minute, target data and comparison data are acquired every minute. For example, if the current date is August 5th and the current time is 10:00:08, the target data acquired are 30 data points from 9:30 to 10:00 on August 5th (one data point per minute), and the comparison data acquired are 30 data points from 9:30 to 10:00 on August 4th. One minute later (when the current time reaches 10:01:08), the target data and comparison data are acquired again. The target data acquired are 30 data points from 9:31 to 10:01 on August 5th, and the comparison data acquired are 30 data points from 9:31 to 10:01 on August 4th.

[0065] In the embodiments of this specification, by limiting the data acquisition cycle for acquiring target data and comparison data to minutes, it is possible to ensure that new data is acquired in a timely manner for data analysis, which in turn helps ensure the timeliness of the anomaly detection results obtained for the trading system, helps to timely discover anomalies in the trading system, and helps to ensure the normal operation of the trading system.

[0066] Optional, Figure 2 In the method, in step 202, obtaining target data and comparison data may specifically include:

[0067] Acquire multiple abnormal alarm information according to the version detection requirement of the trading system; the trading system version corresponding to the multiple abnormal alarm information is the target version, and the reporting time points corresponding to the multiple abnormal alarm information are within the preset time period;

[0068] Based on the plurality of abnormal alarm information, the target data and the comparison data are generated.

[0069] In practice, when a trading system client experiences an abnormality such as a white screen, page load failure, or network anomalies, an abnormality alarm message can be reported to the trading system server. This abnormality alarm message can include the reporting time and trading system version information. The reporting time information indicates the time when the abnormality alarm message was reported, while the trading system version information indicates the trading system version corresponding to the client.

[0070] In practice, trading system version information may include grayscale versions and main versions. A grayscale version refers to a special version during the system or software development and release process. It is used for limited testing and verification of new features or updates before their full release, mitigating release risks and ensuring the stability and compatibility of the new version. The main version refers to the most widely used major version of the system or software. For trading systems, the number of online users of the main version is typically much higher than that of the grayscale version.

[0071] Because the number of online users of a primary version trading system is typically much higher than that of a grayscale version, the number of anomaly alerts from a primary version trading system is also typically much higher than that of a grayscale version. Conventional techniques for detecting anomalies in trading systems do not differentiate between trading system versions. Instead, anomaly alert data for trading systems is combined with that of the primary version and the grayscale version. However, this approach, due to the lower absolute number of anomaly alerts for the grayscale version, makes it difficult to accurately and promptly detect anomalies in the grayscale version of the trading system.

[0072] In actual applications, after the server of the trading system obtains the abnormal alarm information of the trading system reported by the client, it can first store these abnormal alarm information in the database. When these abnormal alarm information need to be used, the abnormal detection server can obtain the trading system version information as the target version from the database according to the version detection requirements of the trading system, and multiple abnormal alarm information with the reporting time point information within the preset time period. Among them, the version detection requirements of the trading system can be pre-set by the detection personnel, or determined by the server of the trading system according to the received version detection instructions, or determined by other means, which are not specifically limited. Among them, the target version can be a main version or a gray version, and the target version can be determined according to the version detection requirements of the trading system. For example: if the version detection requirement of the trading system is: it is necessary to perform abnormal detection on the gray version of the trading system, then the abnormal detection server can obtain the trading system version information as the gray version from the database, and multiple abnormal alarm information with the reporting time point information within the preset time period.

[0073] In actual applications, the anomaly detection server can generate target data and comparison data based on the transaction system version information obtained from the database as the target version, and multiple anomaly alarm messages whose reporting time point information is within a preset time period. Specifically, the preset time period can include multiple time intervals. For example, if the preset time period is 9:30-10:00, the duration of each time interval can be one minute, and the preset time period includes 30 time intervals. Since each anomaly alarm message corresponds to specific reporting time point information, the number of anomaly alarms in each time interval within the preset time period can be determined based on the reporting time point information corresponding to each anomaly alarm message, and the target data and comparison data can be determined based on the number of anomaly alarms in each time interval within the preset time period. For example: when performing anomaly detection on the grayscale version of the trading system, the preset time period is 9:30-10:00, which includes 30 time intervals, each of which is 1 minute. In the first time interval of 9:30-9:31 within the preset time period of the current date, there are 5 abnormal alarm messages reported by the client of the grayscale version of the trading system. It can be determined that in the data sequence composed of 30 data included in the target data (each data corresponds to the number of abnormal alarm messages reported in a time interval), the first data is 5. In this way, the remaining 29 data in the target data can be determined, and the target data can be finally obtained.

[0074] In the embodiments of this specification, when performing anomaly detection on a trading system, by differentiating trading system versions based on the trading system's version detection requirements, anomalies in both the primary and grayscale versions of the trading system can be specifically detected. This detailed differentiation of primary and grayscale version data not only improves the accuracy of anomaly detection for the trading system, but also allows for the accurate and timely detection of data anomalies in either grayscale or primary versions of the trading system.

[0075] Optional, Figure 2 In the method, the abnormal alarm information further includes statistical dimension information; the statistical dimension information includes at least one of abnormality type information, operating system information of the client, and trading institution information; in step 202, obtaining target data and comparison data may specifically include:

[0076] The target data and the comparison data are obtained according to the target dimension information in the statistical dimension information.

[0077] Correspondingly, Figure 2 In the method, in step 206, using a change point detection algorithm to perform data analysis on the composite data sequence to obtain an anomaly detection result for the trading system may specifically include:

[0078] The composite data sequence is analyzed using a change point detection algorithm to obtain an anomaly detection result corresponding to the transaction system and the target dimension information.

[0079] In the embodiments of this specification, the abnormality alarm information reported by the client to the server may also include statistical dimension information such as the abnormality type, the client's operating system information, and transaction institution information. The abnormality type information can be used to reflect the type of abnormality that occurred, and may include, but is not limited to, white screen, page load failure, network anomalies, etc. The client's operating system information may include, but is not limited to, Android, Apple, etc. The transaction institution information may include, for example, the name or code of the institution involved in the transaction.

[0080] In actual applications, since the abnormal alarm information reported by the client to the server includes statistical dimension information, when the abnormal detection server performs abnormal detection analysis on the trading system, it can perform more detailed drill-down analysis on the abnormal type information, the operating system information of the client, and the trading institution information. For example, abnormal detection analysis can be performed only on abnormal situations such as white screen, abnormal detection analysis can be performed only on operating systems such as Android systems, and abnormal detection analysis can be performed only on the data of a certain trading institution.

[0081] In the embodiments of this specification, the anomaly detection server can obtain target data and comparison data related to the target dimension information based on the target dimension information in the statistical dimension information, thereby ultimately obtaining an anomaly detection result for the transaction system corresponding to the target dimension information. For example, if the target dimension information is an anomaly type of "white screen," the target data and comparison data obtained are for an anomaly type of "white screen," and the resulting anomaly detection result is also for the transaction system corresponding to the anomaly alarm information for the anomaly type of "white screen."

[0082] In the embodiments of this specification, the abnormal alarm information reported by the client to the server may include multiple statistical dimension information, so that the abnormality detection server can perform more refined classification based on these statistical dimension information, and then refine the abnormality detection of the trading system from various angles, and achieve more refined abnormality detection of the trading system, which is conducive to improving the comprehensiveness and accuracy of abnormality detection of the trading system.

[0083] Optional, Figure 2 In the method, in step 202, obtaining target data and comparison data may specifically include:

[0084] Obtaining a first alarm quantity sequence; each value in the first alarm quantity sequence corresponds to the number of abnormal alarms of the trading system of the main version in each time interval within the preset time period of the current date;

[0085] A second alarm quantity sequence is obtained; each value in the second alarm quantity sequence corresponds to the number of abnormal alarms of the trading system of the main version in each time interval within the preset time period of the historical date.

[0086] Correspondingly, Figure 2 In the method, in step 204, generating a composite data sequence based on the target data and the comparison data may specifically include:

[0087] The first alarm quantity sequence and the second alarm quantity sequence are spliced ​​together to obtain the composite data sequence.

[0088] In actual applications, when anomaly detection is required for the main version of the trading system, since the main version is usually a relatively stable version that has been released and run for a period of time and thus has a large amount of historical data, comparative data can be determined based on the relatively stable historical data without data surges or data mutations.

[0089] In actual applications, obtaining the first alarm quantity sequence can specifically involve obtaining the abnormal alarm information of the main version trading system within a preset time period on the current date from a database, and counting the number of abnormal alarms in each time interval within the preset time period to obtain the first alarm quantity sequence. Each value in the obtained first alarm quantity sequence corresponds to the number of abnormal alarms of the main version trading system within each time interval within the preset time period on the current date. The first alarm quantity sequence can be used as target data. For example, when performing abnormality detection on the main version trading system, the preset time period is 9:30-10:00, and the preset time period includes 30 time intervals, each of which is 1 minute (each time interval being 1 minute is only an example, and the length of the time interval can be set and adjusted according to actual needs and is not specifically limited to this). In the first time interval of 9:30-9:31 within the preset time period on the current date, the number of abnormal alarms reported by the client of the main version trading system is 8. Then, the first data in the first alarm quantity sequence can be determined to be 8. In this way, the remaining 29 data in the first alarm quantity sequence can be determined, and the first alarm quantity sequence is finally obtained.

[0090] In practical applications, the second alarm quantity sequence can be obtained by obtaining, from a database, abnormal alarm information for the main version of the trading system within a preset time period of a historical date (the abnormality detection result of the trading system within the preset time period of the historical date is that there is no abnormal data change), and counting the number of abnormal alarms in each time interval within the preset time period to obtain the second alarm quantity sequence. Each value in the obtained second alarm quantity sequence corresponds to the number of abnormal alarms for the main version of the trading system in each time interval within the preset time period of the historical date. The second alarm quantity sequence can be used as comparison data.

[0091] In practical applications, after determining the first alarm quantity sequence and the second alarm quantity sequence, the first alarm quantity sequence and the second alarm quantity sequence can be spliced ​​to obtain a composite data sequence. This application does not specifically limit the sequence splicing method and splicing means.

[0092] In the embodiment of this specification, when performing anomaly detection on the primary version of the trading system, the determination of whether the trading system data has changed abnormally is based on an analysis of the absolute value of the number of abnormal alarms within each time interval within a preset time period. In other embodiments, the determination of whether the trading system data has changed abnormally can also be based on an analysis of the ratio of the number of abnormal alarms to the number of online users within each time interval within a preset time period.

[0093] Based on this, Figure 2 In the method, in step 202, obtaining target data and comparison data may specifically include:

[0094] Obtain a first alarm quantity sequence and a first user quantity sequence; each value in the first alarm quantity sequence corresponds to the number of abnormal alarms of the main version of the trading system in each time interval within the preset time period of the current date; each value in the first user quantity sequence corresponds to the number of online users of the main version of the trading system in each time interval within the preset time period of the current date;

[0095] Determining a first alarm ratio sequence based on the first alarm quantity sequence and the first user quantity sequence; each value in the first alarm ratio sequence corresponds to a ratio of the number of abnormal alarms to the number of online users in each time interval within the preset time period on the current date for the trading system of the primary version;

[0096] Obtain a second alarm quantity sequence and a second user quantity sequence; each value in the second alarm quantity sequence corresponds to the number of abnormal alarms of the trading system of the main version in each time interval within the preset time period of the historical date; each value in the second user quantity sequence corresponds to the number of online users of the trading system of the main version in each time interval within the preset time period of the historical date;

[0097] Determining a second alarm ratio sequence based on the second alarm quantity sequence and the second user quantity sequence; each value in the second alarm ratio sequence corresponds to a ratio of the number of abnormal alarms to the number of online users in each time interval within the preset time period of the historical date for the trading system of the primary version;

[0098] Correspondingly, Figure 2 In the method, in step 204, generating a composite data sequence based on the target data and the comparison data may specifically include:

[0099] The first alarm ratio sequence and the second alarm ratio sequence are spliced ​​together to obtain the composite data sequence.

[0100] In the embodiment of this specification, since the aforementioned content has already described in detail the process of obtaining the first alarm quantity sequence and the second alarm quantity sequence, it will not be repeated here.

[0101] In actual applications, the anomaly detection server can monitor the number of online users of the trading system in each time interval within a preset time period in real time, and then determine a first user quantity sequence and a second user quantity sequence based on the monitoring results. Specifically, the anomaly detection server can determine the number of online users of the main version of the trading system in each time interval within the preset time period of the current date based on the monitoring results of the number of online users of the main version of the trading system in each time interval within the preset time period of the current date, and obtain the first user quantity sequence. The anomaly detection server can determine the number of online users of the main version of the trading system in each time interval within the preset time period of historical dates based on the monitoring results of the number of online users of the main version of the trading system in each time interval within the preset time period of historical dates, and obtain the second user quantity sequence.

[0102] For example, when performing anomaly detection on the main version of the trading system, the preset time period is 9:30-10:00, which includes 30 time intervals, each of which is 1 minute. In the first time interval of 9:30-9:31 within the preset time period of the current date, the average number of online users monitored is 10,000. Then, the first data in the first user quantity sequence can be determined to be 10,000. In this way, the remaining 29 data in the first user quantity sequence can be determined, and the first user quantity sequence is finally obtained.

[0103] In practical applications, after obtaining the first alarm quantity sequence and the first user quantity sequence, a first alarm ratio sequence can be determined based on the first alarm quantity sequence and the first user quantity sequence. Specifically, the value corresponding to a certain time interval in the first alarm quantity sequence can be divided by the value corresponding to the time interval in the first user quantity sequence to obtain the value corresponding to the time interval in the first alarm ratio sequence. Each value in the resulting first alarm ratio sequence corresponds to the ratio of the number of abnormal alarms to the number of online users in each time interval within a preset time period on the current date for the main version of the trading system. For example: when performing anomaly detection on the main version of the trading system, the preset time period is 9:30-10:00, which includes 30 time intervals, each time interval is 1 minute. In the first time interval of 9:30-9:31 within the preset time period of the current date, the number of abnormal alarms reported by the client of the main version of the trading system is 100, and the average number of online users monitored is 10,000. Then the first data in the first alarm quantity sequence is 100, and the first data in the first user quantity sequence is 10,000. 100 / 10,000=0.01, so the first data in the first alarm ratio sequence is 0.01. In this way, the remaining 29 data in the first alarm ratio sequence can be determined, and finally the first alarm ratio sequence is obtained.

[0104] In the embodiments of this specification, the method for determining the second alarm ratio sequence based on the second alarm quantity sequence and the second user quantity sequence can be the same as the method for determining the first alarm ratio sequence based on the first alarm quantity sequence and the first user quantity sequence, and therefore, it will not be further described here. The first alarm ratio sequence can be used as the target data, and the second alarm ratio sequence can be used as the comparison data.

[0105] In practical applications, after determining the first alarm ratio sequence and the second alarm ratio sequence, the first alarm ratio sequence and the second alarm ratio sequence can be spliced ​​to obtain a composite data sequence. This application does not specifically limit the sequence splicing method and splicing means.

[0106] In practical applications, an analysis of the absolute value of the number of abnormal alarms within each time interval within a preset time period can be used to determine whether the trading system data has changed abnormally, and an alarm can be issued if so. Alternatively, an analysis of the ratio of the number of abnormal alarms within each time interval within a preset time period to the number of online users can be used to determine whether the trading system data has changed abnormally, and an alarm can be issued if so. Alternatively, an alarm can be issued only when both of the above analyses indicate abnormal changes in the trading system data, and this is not specifically limited.

[0107] Optional, Figure 2 In the method, the version of the trading system includes a gray version and a main version; in step 202, obtaining target data and comparison data may specifically include:

[0108] Obtain a third alarm quantity sequence and a third user quantity sequence; each value in the third alarm quantity sequence corresponds to the number of abnormal alarms of the grayscale version of the trading system in each time interval within the preset time period of the current date; each value in the third user quantity sequence corresponds to the number of online users of the grayscale version of the trading system in each time interval within the preset time period of the current date;

[0109] Determining a third alarm ratio sequence based on the third alarm quantity sequence and the third user quantity sequence; each value in the third alarm ratio sequence corresponds to a ratio of the number of abnormal alarms to the number of online users in each time interval of the grayscale version of the trading system within the preset time period on the current date;

[0110] Obtain a fourth alarm quantity sequence and a fourth user quantity sequence; each value in the fourth alarm quantity sequence corresponds to the number of abnormal alarms of the trading system of the main version in each time interval within the preset time period of the current date; each value in the fourth user quantity sequence corresponds to the number of online users of the trading system of the main version in each time interval within the preset time period of the current date;

[0111] Determining a fourth alarm ratio sequence based on the fourth alarm quantity sequence and the fourth user quantity sequence; each value in the fourth alarm ratio sequence corresponds to a ratio of the number of abnormal alarms to the number of online users in each time interval within the preset time period of the current date for the trading system of the main version;

[0112] Correspondingly, Figure 2 In the method, in step 204, generating a composite data sequence based on the target data and the comparison data may specifically include:

[0113] The third alarm ratio sequence and the fourth alarm ratio sequence are spliced ​​together to obtain the composite data sequence.

[0114] In practical applications, when anomaly detection is required for a grayscale version of a trading system, since grayscale versions are newly released and may not have stable historical data, the more stable data from the main version can be used as comparison data. Furthermore, since the absolute number of anomaly alarms in a grayscale version of a trading system is typically much smaller than that in a main version of the trading system, an analysis of the ratio of the number of anomaly alarms to the number of online users within each time interval within a preset time period can be used to determine whether the data in the grayscale version of the trading system has experienced abnormal changes.

[0115] In practical applications, the third alarm quantity sequence can be obtained by obtaining abnormal alarm information of the grayscale version of the trading system within a preset time period on the current date from a database, and counting the number of abnormal alarms in each time interval within the preset time period to obtain the third alarm quantity sequence. Each value in the obtained third alarm quantity sequence corresponds to the number of abnormal alarms of the grayscale version of the trading system in each time interval within the preset time period on the current date.

[0116] In practical applications, the fourth alarm quantity sequence can be obtained by obtaining abnormal alarm information of the main version trading system within a preset time period on the current date from a database, and counting the number of abnormal alarms in each time interval within the preset time period to obtain the fourth alarm quantity sequence. Each value in the obtained fourth alarm quantity sequence corresponds to the number of abnormal alarms of the main version trading system in each time interval within the preset time period on the current date.

[0117] In actual applications, the anomaly detection server can monitor the number of online users of the trading system in each time interval within a preset time period in real time, and then determine the third user number sequence and the fourth user number sequence based on the monitoring results. Specifically, the anomaly detection server can determine the number of online users of the grayscale version of the trading system in each time interval within the preset time period of the current date based on the monitoring results of the number of online users of the grayscale version of the trading system in each time interval within the preset time period of the current date, and obtain the third user number sequence. The anomaly detection server can determine the number of online users of the main version of the trading system in each time interval within the preset time period of the current date based on the monitoring results of the number of online users of the main version of the trading system in each time interval within the preset time period of the current date, and obtain the fourth user number sequence.

[0118] In practical applications, after obtaining the third alarm quantity sequence and the third user quantity sequence, a third alarm ratio sequence can be determined based on the third alarm quantity sequence and the third user quantity sequence. Specifically, the value corresponding to a certain time interval in the third alarm quantity sequence can be divided by the value corresponding to the time interval in the third user quantity sequence to obtain the value corresponding to the time interval in the third alarm ratio sequence. Each value in the resulting third alarm ratio sequence corresponds to the ratio of the number of abnormal alarms to the number of online users in each time interval within a preset time period on the current date in the grayscale version of the trading system.

[0119] In the embodiments of this specification, the method for determining the fourth alarm ratio sequence based on the fourth alarm quantity sequence and the fourth user quantity sequence can be the same as the method for determining the third alarm ratio sequence based on the third alarm quantity sequence and the third user quantity sequence. Therefore, this description is not repeated here. The third alarm ratio sequence can serve as target data, and the fourth alarm ratio sequence can serve as comparison data.

[0120] In practical applications, after determining the third alarm ratio sequence and the fourth alarm ratio sequence, the third alarm ratio sequence and the fourth alarm ratio sequence can be spliced ​​to obtain a composite data sequence. This application does not specifically limit the sequence splicing method and splicing means.

[0121] Optional, Figure 2 In the method, in step 206, using a change point detection algorithm to perform data analysis on the composite data sequence to obtain an anomaly detection result for the trading system may specifically include:

[0122] Performing data analysis on the composite data sequence using a cumulative sum algorithm to determine whether a cumulative sum of data deviations in the composite data sequence is greater than or equal to a preset threshold, and obtaining a determination result;

[0123] If the judgment result indicates that the cumulative sum of data deviations in the composite data sequence is greater than or equal to the preset threshold, a first anomaly detection result indicating that data changes in the trading system are abnormal is obtained;

[0124] If the judgment result indicates that the cumulative sum of data deviations in the composite data sequence is less than the preset threshold, a second anomaly detection result is obtained, indicating that there is no anomaly in the data change of the trading system.

[0125] In the examples of this specification, the Cumulative Sum Control Chart (CUSUM) algorithm is a statistical process control method used to detect mean shifts in data sequences. By accumulating the deviations of observed values ​​from a target mean, the CUSUM algorithm can sensitively capture small but persistent mean changes. It is widely used in fields such as quality control, financial monitoring, and industrial sensor analysis.

[0126] In the embodiments of this specification, a cumulative sum algorithm is used to analyze the composite data sequence. A baseline mean value can be determined based on the comparison data in the composite data sequence, and a cumulative sum of data deviations can be determined based on the deviations of each data value in the target data in the composite data sequence from the baseline mean. If the cumulative sum of data deviations is greater than or equal to a preset threshold, an abnormal data change in the trading system is determined. The preset threshold value can be an empirical value or can be set based on actual needs.

[0127] Optional, Figure 2 In the method, in step 206, after performing data analysis on the composite data sequence using a change point detection algorithm to obtain an anomaly detection result for the trading system, the method may further include:

[0128] If the anomaly detection result indicates that the data change of the trading system is abnormal, an alarm message is generated; the alarm message includes at least one of abnormality type information, abnormal time point information, abnormal data information, and abnormal handling suggestion information;

[0129] The alarm information is sent to an exception handling terminal so that the exception handling terminal handles the abnormal situation of the trading system based on the alarm information.

[0130] In an embodiment of the present specification, if the anomaly detection server detects an abnormal data change in the trading system, it is necessary to generate an alarm message to issue an alarm, so as to prompt the exception handling terminal or the exception handling personnel to handle the abnormal situation of the trading system. The alarm message may include at least one of the following information: abnormal type information, abnormal time point information, abnormal data information, and abnormal handling suggestion information, wherein the abnormal type information can be used to indicate which type of abnormality this alarm is targeting. For example: when the abnormal type information in the alarm message is "page loading failure", it indicates that the abnormal type targeted by this alarm is "page loading failure". Among them, the abnormal data information can be data related to this alarm, and the abnormal data information can include but is not limited to: version information of this detection, target data, comparison data, composite data sequence, etc.

[0131] In practical applications, after generating an alarm, the anomaly detection server may transmit the alarm to an anomaly handling terminal, so that personnel at the anomaly handling terminal can address the abnormality in the trading system based on the alarm. Alternatively, the anomaly detection server may directly display the alarm to the personnel, or prompt them to address the abnormality through voice notification, without specific limitation.

[0132] Optionally, after sending the alarm information to the exception handling terminal, the following steps may also be included:

[0133] Acquire alarm processing information corresponding to the alarm information fed back by the exception processing terminal; the alarm processing information includes at least one of information about a person who handles the alarm information, information about a processing progress of the alarm information, and information about a processing result of the alarm information;

[0134] The alarm information and the alarm processing information are entered into an alarm management system.

[0135] In an embodiment of the present specification, the exception handling terminal can feedback alarm handling information corresponding to the alarm information to the exception detection server during or after handling the exception of the trading system based on the alarm information. The alarm handling information may include at least one of information about the person who handled the alarm information, information about the progress of handling the alarm information, and information about the processing result of the alarm information. The information about the person who handled the alarm information may include information such as the name of the person who handled the alarm information and the person's job number; the information about the progress of handling the alarm information may include information such as processing not started, processing in progress, or processing completed; and the information about the processing result of the alarm information may include information such as the abnormality repaired or abnormality repair failed.

[0136] In practical applications, entering alarm information and alarm processing information into the alarm management system facilitates subsequent query and management. For example, when performing anomaly detection on a primary version of a trading system, when determining comparison data, the alarm management system can be used to query whether an alarm message was present within a preset time period on a specific historical date. If so, the abnormal alarm data within the preset time period on that historical date can be avoided as comparison data.

[0137] Figure 3 This is an overall flow chart of a system anomaly detection method provided in the embodiment of this specification. Figure 3 As shown, the system anomaly detection method may specifically include the following steps:

[0138] Step 302: According to the version detection requirement of the trading system, multiple abnormal alarm information is obtained from the database; the trading system version corresponding to the multiple abnormal alarm information is the target version, and the reporting time points corresponding to the multiple abnormal alarm information are within the preset time period.

[0139] Step 304: Generate target data and comparison data based on the multiple abnormality alarm information. The target data includes the first abnormality alarm data of the trading system within a preset time period on the current date; the comparison data includes the second abnormality alarm data of the trading system within the preset time period on a previous date or the current date.

[0140] Step 306: Generate a composite data sequence based on the target data and the comparison data.

[0141] Step 308: Perform data analysis on the composite data sequence using a cumulative sum algorithm.

[0142] Step 310: Determine whether the cumulative sum of the data deviations in the composite data sequence is greater than or equal to a preset threshold. If the cumulative sum of the data deviations in the composite data sequence is greater than or equal to the preset threshold, then jump to step 312; if the cumulative sum of the data deviations in the composite data sequence is less than the preset threshold, then jump to step 320.

[0143] Step 312: Obtain a first anomaly detection result indicating an abnormal data change in the transaction system.

[0144] Step 314: Generate alarm information and send the alarm information to the exception handling terminal. The alarm information may include at least one of the following: exception type information, exception time point information, exception data information, and exception handling suggestion information.

[0145] Step 316: Acquire alarm processing information corresponding to the alarm information fed back by the exception processing terminal, wherein the alarm processing information may include at least one of information about the person who processed the alarm information, information about the processing progress of the alarm information, and information about the processing result of the alarm information.

[0146] Step 318: Enter the alarm information and alarm processing information into the alarm management system.

[0147] Step 320: Obtain a second anomaly detection result indicating that there is no anomaly in the data change of the trading system.

[0148] Figure 3In the method, after the anomaly detection server obtains target data including first anomaly alarm data of the trading system within a preset time period of the current date and comparison data including second anomaly alarm data of the trading system within the preset time period of a historical date or the current date, it can generate a composite data sequence based on the target data and the comparison data, and then use a change point detection algorithm to perform data analysis on the composite data sequence to obtain an anomaly detection result for the trading system. Therefore, on the one hand, only analyzing the anomaly alarm data of the trading system within the preset time period is conducive to reducing the workload of data analysis and reducing the impact of noise data on data analysis, thereby improving the accuracy of system anomaly detection. On the other hand, using the change point detection algorithm to perform data analysis on the composite data sequence can determine the anomaly detection result of the trading system based on the degree of change in the data statistical characteristics of the target data relative to the comparison data, which can effectively avoid the impact of fluctuating data and noise data on the anomaly detection result of the trading system, and is conducive to improving the accuracy of system anomaly detection.

[0149] Based on the same idea, the embodiments of this specification also provide a device corresponding to the above method.

[0150] Figure 4 The embodiments of this specification provide corresponding Figure 2 A structural diagram of a system anomaly detection device. Figure 4 As shown, the device may include:

[0151] The data acquisition module 402 is used to acquire target data and comparison data; the target data includes the first abnormal alarm data of the trading system within a preset time period of the current date; the comparison data includes the second abnormal alarm data of the trading system within the preset time period of a historical date or the current date.

[0152] The sequence generation module 404 is configured to generate a composite data sequence based on the target data and the comparison data.

[0153] The data analysis module 406 is configured to perform data analysis on the composite data sequence using a change point detection algorithm to obtain an anomaly detection result for the trading system.

[0154] based on Figure 4 The present specification also provides some specific implementation plans of the device, which are described below.

[0155] Optionally, the trading system is provided with a trading time period and a non-trading time period; the non-trading time period is used to indicate a time period during which the trading system is prohibited from being used for trading; the trading time period is used to indicate a time period during which the trading system is allowed to be used for trading; the preset time period is within the trading time period.

[0156] Optionally, the time interval between the end time of the preset time period and the current time is less than or equal to a preset duration; the preset duration is in minutes. The data acquisition module 402 may specifically include:

[0157] The data acquisition unit is used to acquire target data and comparison data according to a preset data acquisition cycle; the data acquisition cycle is at the minute level.

[0158] Optionally, the data acquisition module 402 may specifically include:

[0159] The abnormal alarm information acquisition unit is used to obtain multiple abnormal alarm information according to the version detection requirements of the trading system; the trading system version corresponding to the multiple abnormal alarm information is the target version, and the reporting time points corresponding to the multiple abnormal alarm information are within the preset time period.

[0160] A data generating unit is configured to generate the target data and the comparison data based on the plurality of abnormal alarm information.

[0161] Optionally, the abnormal alarm information also includes statistical dimension information; the statistical dimension information includes at least one of abnormal type information, operating system information of the client, and transaction institution information. Correspondingly, the data acquisition module 402 may specifically include:

[0162] A data acquisition unit is used to acquire the target data and the comparison data according to the target dimension information in the statistical dimension information.

[0163] Correspondingly, the data analysis module 406 may specifically include:

[0164] A data analysis unit is used to perform data analysis on the composite data sequence using a change point detection algorithm to obtain an anomaly detection result corresponding to the transaction system and the target dimension information.

[0165] Optionally, the data acquisition module 402 may specifically include:

[0166] The first acquisition unit is used to acquire a first alarm quantity sequence; each value in the first alarm quantity sequence corresponds to the number of abnormal alarms in each time interval of the main version of the trading system within the preset time period of the current date.

[0167] The second acquisition unit is used to acquire a second alarm quantity sequence; each value in the second alarm quantity sequence corresponds to the number of abnormal alarms of the trading system of the main version in each time interval within the preset time period of the historical date.

[0168] Correspondingly, the sequence generation module 404 may specifically include:

[0169] The first sequence splicing unit is used to splice the first alarm quantity sequence and the second alarm quantity sequence to obtain the composite data sequence.

[0170] Optionally, the data acquisition module 402 may specifically include:

[0171] The third acquisition unit is used to obtain a first alarm quantity sequence and a first user quantity sequence; each value in the first alarm quantity sequence corresponds to the number of abnormal alarms of the main version of the trading system in each time interval within the preset time period of the current date; each value in the first user quantity sequence corresponds to the number of online users of the main version of the trading system in each time interval within the preset time period of the current date.

[0172] The first alarm ratio sequence determination unit is used to determine the first alarm ratio sequence based on the first alarm quantity sequence and the first user quantity sequence; each value in the first alarm ratio sequence corresponds to the ratio of the number of abnormal alarms to the number of online users in each time interval within the preset time period of the main version of the trading system on the current date.

[0173] The fourth acquisition unit is used to obtain a second alarm quantity sequence and a second user quantity sequence; each value in the second alarm quantity sequence corresponds to the number of abnormal alarms of the trading system of the main version in each time interval within the preset time period of the historical date; each value in the second user quantity sequence corresponds to the number of online users of the trading system of the main version in each time interval within the preset time period of the historical date.

[0174] A second alarm ratio sequence determination unit is used to determine a second alarm ratio sequence based on the second alarm quantity sequence and the second user quantity sequence; each value in the second alarm ratio sequence corresponds to the ratio of the number of abnormal alarms to the number of online users in each time interval within the preset time period of the historical date of the trading system of the main version.

[0175] Correspondingly, the sequence generation module 404 may specifically include:

[0176] The second sequence splicing unit is used to splice the first alarm ratio sequence and the second alarm ratio sequence to obtain the composite data sequence.

[0177] Optionally, the version of the trading system includes a gray version and a main version; the data acquisition module 402 may specifically include:

[0178] The fifth acquisition unit is used to obtain a third alarm quantity sequence and a third user quantity sequence; each value in the third alarm quantity sequence corresponds to the number of abnormal alarms of the grayscale version of the trading system in each time interval within the preset time period of the current date; each value in the third user quantity sequence corresponds to the number of online users of the grayscale version of the trading system in each time interval within the preset time period of the current date.

[0179] A third alarm ratio sequence determination unit is used to determine a third alarm ratio sequence based on the third alarm quantity sequence and the third user quantity sequence; each value in the third alarm ratio sequence corresponds to the ratio of the number of abnormal alarms to the number of online users in each time interval within the preset time period of the grayscale version of the trading system on the current date.

[0180] The sixth acquisition unit is used to obtain the fourth alarm quantity sequence and the fourth user quantity sequence; each value in the fourth alarm quantity sequence corresponds to the number of abnormal alarms of the main version of the trading system in each time interval within the preset time period of the current date; each value in the fourth user quantity sequence corresponds to the number of online users of the main version of the trading system in each time interval within the preset time period of the current date.

[0181] The fourth alarm ratio sequence determination unit is used to determine the fourth alarm ratio sequence based on the fourth alarm quantity sequence and the fourth user quantity sequence; each value in the fourth alarm ratio sequence corresponds to the ratio of the number of abnormal alarms to the number of online users in each time interval within the preset time period of the main version of the trading system on the current date.

[0182] Correspondingly, the sequence generation module 404 may specifically include:

[0183] The third sequence splicing unit is used to splice the third alarm ratio sequence and the fourth alarm ratio sequence to obtain the composite data sequence.

[0184] Optionally, the data analysis module 406 may specifically include:

[0185] The judgment unit is used to perform data analysis on the composite data sequence using a cumulative sum algorithm, determine whether the cumulative sum of data deviations in the composite data sequence is greater than or equal to a preset threshold, and obtain a judgment result.

[0186] The first anomaly detection result determination unit is configured to obtain a first anomaly detection result indicating that a data change of the trading system is abnormal if the judgment result indicates that the cumulative sum of data deviations in the composite data sequence is greater than or equal to the preset threshold.

[0187] The second abnormality detection result determination unit is configured to obtain a second abnormality detection result indicating that there is no abnormality in the data change of the trading system if the judgment result indicates that the cumulative sum of the data deviations in the composite data sequence is less than the preset threshold.

[0188] Optionally, the device may further include:

[0189] An alarm information generation module is used to generate an alarm message if the abnormality detection result indicates that the data change of the trading system is abnormal; the alarm information includes at least one of abnormality type information, abnormal time point information, abnormal data information, and abnormal processing suggestion information.

[0190] The alarm information sending module is used to send the alarm information to the exception handling terminal so that the exception handling terminal can handle the abnormal situation of the trading system based on the alarm information.

[0191] Correspondingly, the device may further include:

[0192] An alarm processing information acquisition module is used to obtain the alarm processing information corresponding to the alarm information fed back by the exception processing terminal; the alarm processing information includes at least one of the processing personnel information for the alarm information, the processing progress information for the alarm information and the processing result information for the alarm information.

[0193] The information entry module is used to enter the alarm information and the alarm processing information into the alarm management system.

[0194] It is understood that the above modules refer to computer programs or program segments for performing one or more specific functions. In addition, the distinction between the above modules does not mean that the actual program codes must also be separated.

[0195] Based on the same idea, the embodiments of this specification also provide devices corresponding to the above methods.

[0196] Figure 5 The embodiments of this specification provide corresponding Figure 2 A structural diagram of a system anomaly detection device. Figure 5 As shown, the device 500 may include:

[0197] at least one processor 510; and,

[0198] A memory 530 in communication with the at least one processor; wherein,

[0199] The memory 530 stores instructions 520 executable by the at least one processor 510. The instructions are executed by the at least one processor 510 to enable the at least one processor 510 to:

[0200] Obtain target data and comparison data; the target data includes first abnormal alarm data of the trading system within a preset time period of the current date; the comparison data includes second abnormal alarm data of the trading system within the preset time period of a historical date or the current date;

[0201] generating a composite data sequence based on the target data and the comparison data;

[0202] The composite data sequence is analyzed using a change point detection algorithm to obtain an anomaly detection result for the trading system.

[0203] The various embodiments in this specification are described in a progressive manner. The same or similar parts between the various embodiments can be referred to each other. Each embodiment focuses on the differences from other embodiments. Figure 5 As for the device shown, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0204] The foregoing description of this specification describes specific embodiments. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recited in the claims can be performed in an order different from that described in the embodiments and still achieve the desired results. Furthermore, the processes depicted in the accompanying drawings do not necessarily require the specific order shown or the sequential order to achieve the desired results. In certain embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0205] In the 1990s, technological improvements could be clearly distinguished as either hardware improvements (for example, improvements to circuit structures such as diodes, transistors, and switches) or software improvements (improvements to process flows). However, with the advancement of technology, many process flow improvements today can now be considered direct improvements to hardware circuit structures. Designers almost always create the corresponding hardware circuit structure by programming the improved process flow into the hardware circuit. Therefore, it cannot be said that a process flow improvement cannot be implemented using hardware modules. For example, a programmable logic device (PLD), such as a field programmable gate array (FPGA), is an integrated circuit whose logical function is determined by user programming. Designers can "integrate" a digital system on a PLD by programming it themselves, without having to hire a chip manufacturer to design and produce a dedicated integrated circuit chip. Moreover, nowadays, instead of manually fabricating integrated circuit chips, this programming is mostly done using "logic compiler" software. This is similar to the software compiler used when developing programs. Before compilation, the original code must also be written in a specific programming language, called a hardware description language (HDL). There is not just one HDL, but many, such as ABEL (Advanced Boolean Expression Language), AHDL (Altera Hardware Description Language), Confluence, CUPL (Cornell University Programming Language), HDCal, JHDL (Java Hardware Description Language), Lava, Lola, MyHDL, PALASM, RHDL (Ruby Hardware Description Language), etc. The most commonly used ones are VHDL (Very-High-Speed ​​Integrated Circuit Hardware Description Language) and Verilog. Those skilled in the art will also understand that by simply programming the method flow in one of these hardware description languages ​​and then programming it into an integrated circuit, a hardware circuit that implements the logic method flow can be easily obtained.

[0206] The controller can be implemented in any suitable manner. For example, the controller can take the form of a microprocessor or processor and a computer-readable medium storing computer-readable program code (e.g., software or firmware) executable by the (micro)processor, logic gates, switches, application-specific integrated circuits (ASICs), programmable logic controllers, and embedded microcontrollers. Examples of controllers include, but are not limited to, the following microcontrollers: ARC 625D, Atmel AT91SAM, Microchip PIC18F26K20, and Silicone Labs C8051F320. The memory controller can also be implemented as part of the control logic of the memory. Those skilled in the art will also know that in addition to implementing the controller in a purely computer-readable program code format, the controller can be implemented in the form of logic gates, switches, application-specific integrated circuits, programmable logic controllers, and embedded microcontrollers by logically programming the method steps. Therefore, such a controller can be considered a hardware component, and the devices included therein for implementing various functions can also be considered as structures within the hardware component. Or even, the devices for implementing various functions can be considered as both software modules that implement the method and structures within the hardware component.

[0207] The systems, devices, modules, or units described in the above embodiments may be implemented by computer chips or entities, or by products having certain functions. A typical implementation device is a computer. Specifically, the computer may be, for example, a personal computer, a laptop computer, a cellular phone, a camera phone, a smartphone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or a combination of any of these devices.

[0208] For the convenience of description, the above devices are described as being divided into various units according to their functions. Of course, when implementing this specification, the functions of each unit can be implemented in the same or multiple software and / or hardware.

[0209] It will be understood by those skilled in the art that embodiments of the present invention may be provided as methods, systems, or computer program products. Thus, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware. Furthermore, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0210] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowcharts and / or block diagrams, as well as combinations of processes and / or blocks in the flowcharts and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowcharts and / or block diagrams. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0211] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0212] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing the instructions executed on the computer or other programmable device for implementing the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0213] In a typical configuration, a computing device includes one or more processors (CPUs), input / output interfaces, network interfaces, and memory.

[0214] Memory may include non-permanent storage in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. Memory is an example of a computer-readable medium.

[0215] Computer-readable media includes permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. The information can be computer-readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassettes, magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer-readable media does not include transitory computer-readable media (transitory media), such as modulated data signals and carrier waves.

[0216] It should also be noted that the terms "comprises," "includes," or any other variations thereof are intended to encompass non-exclusive inclusion, such that a process, method, commodity, or apparatus that includes a series of elements includes not only those elements but also other elements not explicitly listed, or includes elements inherent to such process, method, commodity, or apparatus. In the absence of further limitations, an element defined by the phrase "comprises a ..." does not exclude the presence of other identical elements in the process, method, commodity, or apparatus that includes the element.

[0217] This specification may be described in the general context of computer-executable instructions, such as program modules, executed by a computer. Generally, program modules include routines, programs, objects, components, data structures, and the like that perform specific tasks or implement specific abstract data types. This specification may also be practiced in distributed computing environments where tasks are performed by remote processing devices connected through a communications network. In a distributed computing environment, program modules may be located in both local and remote computer storage media, including storage devices.

[0218] The foregoing is merely an example of the present invention and is not intended to limit the present invention. Various modifications and variations are possible within the scope of the present invention. Any modifications, equivalent substitutions, or improvements made within the spirit and principles of the present invention are intended to be included within the scope of the claims of the present invention.

Claims

1. A system anomaly detection method, comprising: Obtaining target data and comparison data; the target data includes the first abnormal alarm data of the trading system within a preset time period on the current date; The comparison data includes second abnormal alarm data of the trading system within the preset time period on a historical date or the current date; generating a composite data sequence based on the target data and the comparison data; The composite data sequence is analyzed using a change point detection algorithm to obtain an anomaly detection result for the trading system.

2. According to the method as claimed in claim 1, the trading system is provided with a trading time period and a non-trading time period; the non-trading time period is used to indicate a time period during which the trading system is prohibited from being used for trading; the trading time period is used to indicate a time period during which the trading system is allowed to be used for trading; and the preset time period is within the trading time period.

3. The method according to claim 1, wherein the time interval between the end time of the preset time period and the current time is less than or equal to the preset time length; The preset duration is in minutes; The obtaining of target data and comparison data specifically includes: Acquire target data and comparison data according to the preset data acquisition cycle; The data acquisition cycle is at the minute level.

4. The method according to claim 1, wherein obtaining target data and comparison data specifically comprises: Obtain multiple abnormal alarm information based on the version detection requirements of the trading system; The transaction system version corresponding to the multiple abnormal alarm information is the target version, and the reporting time points corresponding to the multiple abnormal alarm information are within the preset time period; Based on the plurality of abnormal alarm information, the target data and the comparison data are generated.

5. The method according to claim 4, wherein the abnormality alarm information further includes statistical dimension information; the statistical dimension information includes at least one of abnormality type information, operating system information of the client, and trading institution information; and obtaining target data and comparison data specifically includes: Acquire the target data and the comparison data according to the target dimension information in the statistical dimension information; The method of performing data analysis on the composite data sequence using a change point detection algorithm to obtain an anomaly detection result for the trading system specifically includes: The composite data sequence is analyzed using a change point detection algorithm to obtain an anomaly detection result corresponding to the transaction system and the target dimension information.

6. The method according to claim 1, wherein obtaining target data and comparison data specifically comprises: Obtaining a first alarm quantity sequence; each value in the first alarm quantity sequence corresponds to the number of abnormal alarms of the trading system of the main version in each time interval within the preset time period of the current date; Obtaining a second alarm quantity sequence; each value in the second alarm quantity sequence corresponds to the number of abnormal alarms of the trading system of the main version in each time interval within the preset time period of the historical date; The generating of a composite data sequence based on the target data and the comparison data specifically includes: The first alarm quantity sequence and the second alarm quantity sequence are spliced ​​together to obtain the composite data sequence.

7. The method according to claim 1, wherein obtaining target data and comparison data specifically comprises: Obtain a first alarm quantity sequence and a first user quantity sequence; each value in the first alarm quantity sequence corresponds to the number of abnormal alarms of the main version of the trading system in each time interval within the preset time period of the current date; each value in the first user quantity sequence corresponds to the number of online users of the main version of the trading system in each time interval within the preset time period of the current date; Determining a first alarm ratio sequence based on the first alarm quantity sequence and the first user quantity sequence; each value in the first alarm ratio sequence corresponds to a ratio of the number of abnormal alarms to the number of online users in each time interval within the preset time period on the current date for the trading system of the primary version; Obtain a second alarm quantity sequence and a second user quantity sequence; each value in the second alarm quantity sequence corresponds to the number of abnormal alarms of the trading system of the main version in each time interval within the preset time period of the historical date; each value in the second user quantity sequence corresponds to the number of online users of the trading system of the main version in each time interval within the preset time period of the historical date; Determining a second alarm ratio sequence based on the second alarm quantity sequence and the second user quantity sequence; each value in the second alarm ratio sequence corresponds to a ratio of the number of abnormal alarms to the number of online users in each time interval within the preset time period of the historical date for the trading system of the primary version; The generating of a composite data sequence based on the target data and the comparison data specifically includes: The first alarm ratio sequence and the second alarm ratio sequence are spliced ​​together to obtain the composite data sequence.

8. The method according to claim 1, wherein the version of the trading system includes a grayscale version and a main version; and obtaining target data and comparison data specifically includes: Obtain a third alarm quantity sequence and a third user quantity sequence; each value in the third alarm quantity sequence corresponds to the number of abnormal alarms of the grayscale version of the trading system in each time interval within the preset time period of the current date; each value in the third user quantity sequence corresponds to the number of online users of the grayscale version of the trading system in each time interval within the preset time period of the current date; Determining a third alarm ratio sequence based on the third alarm quantity sequence and the third user quantity sequence; each value in the third alarm ratio sequence corresponds to a ratio of the number of abnormal alarms to the number of online users in each time interval of the grayscale version of the trading system within the preset time period on the current date; Obtain a fourth alarm quantity sequence and a fourth user quantity sequence; each value in the fourth alarm quantity sequence corresponds to the number of abnormal alarms of the trading system of the main version in each time interval within the preset time period of the current date; each value in the fourth user quantity sequence corresponds to the number of online users of the trading system of the main version in each time interval within the preset time period of the current date; Determining a fourth alarm ratio sequence based on the fourth alarm quantity sequence and the fourth user quantity sequence; each value in the fourth alarm ratio sequence corresponds to a ratio of the number of abnormal alarms to the number of online users in each time interval within the preset time period of the current date for the trading system of the main version; The generating of a composite data sequence based on the target data and the comparison data specifically includes: The third alarm ratio sequence and the fourth alarm ratio sequence are spliced ​​together to obtain the composite data sequence.

9. The method according to claim 1, wherein the step of analyzing the composite data sequence using a change point detection algorithm to obtain an anomaly detection result for the trading system comprises: Performing data analysis on the composite data sequence using a cumulative sum algorithm to determine whether a cumulative sum of data deviations in the composite data sequence is greater than or equal to a preset threshold, and obtaining a determination result; If the judgment result indicates that the cumulative sum of data deviations in the composite data sequence is greater than or equal to the preset threshold, a first anomaly detection result indicating that data changes in the trading system are abnormal is obtained; If the judgment result indicates that the cumulative sum of data deviations in the composite data sequence is less than the preset threshold, a second anomaly detection result is obtained, indicating that there is no anomaly in the data change of the trading system.

10. The method according to claim 1, further comprising: If the abnormality detection result indicates that the data change of the transaction system is abnormal, an alarm message is generated; The warning information includes at least one of abnormality type information, abnormality time point information, abnormal data information, and abnormality handling suggestion information; The alarm information is sent to an exception handling terminal so that the exception handling terminal handles the abnormal situation of the trading system based on the alarm information.

11. The method according to claim 10, further comprising, after sending the alarm information to the exception handling terminal: Acquire alarm processing information corresponding to the alarm information fed back by the exception processing terminal; The alarm processing information includes at least one of information about a person who processes the alarm information, information about a progress of processing the alarm information, and information about a result of processing the alarm information; The alarm information and the alarm processing information are entered into an alarm management system.

12. A system anomaly detection device, comprising: A data acquisition module is used to acquire target data and comparison data; the target data includes the first abnormal alarm data of the trading system within a preset time period on the current date; The comparison data includes second abnormal alarm data of the trading system within the preset time period on a historical date or the current date; A sequence generation module, configured to generate a composite data sequence based on the target data and the comparison data; The data analysis module is used to perform data analysis on the composite data sequence using a change point detection algorithm to obtain an anomaly detection result for the trading system.

13. A system anomaly detection device comprising: at least one processor; as well as, a memory communicatively connected to the at least one processor; wherein, The memory stores instructions executable by the at least one processor, the instructions being executed by the at least one processor to enable the at least one processor to: Obtain target data and comparison data; the target data includes first abnormal alarm data of the trading system within a preset time period of the current date; the comparison data includes second abnormal alarm data of the trading system within the preset time period of a historical date or the current date; generating a composite data sequence based on the target data and the comparison data; The composite data sequence is analyzed using a change point detection algorithm to obtain an anomaly detection result for the trading system.

Images