Abnormal data detection and model training method and device, equipment, medium and product

Abstract

The invention provides an abnormal data detection method which can be applied to the field of artificial intelligence, and the method comprises the steps: obtaining first time sequence data and second time sequence data, the second time sequence data being future data of the first time sequence data in time sequence, and the second time sequence data comprising at least one time sequence point data; according to the target model and the first time sequence data, a target sequence is generated, and the target sequence represents an error between the time sequence predicted value on each time sequence point and the second time sequence data in a time sequence range corresponding to the second time sequence data; determining abnormal error data in the target sequence according to a super-threshold extreme value method; and taking time sequence point data in the second time sequence data corresponding to the abnormal error data as abnormal data. The invention further provides a target model training method, and a device, equipment, a storage medium and a program product for executing the method.

Description

Technical Field

[0001] The present application relates to the field of artificial intelligence, and more specifically, to a method, device, equipment, medium, and product for abnormal data detection and model training. Background Art

[0002] In modern information systems, data anomaly detection is a critical step in ensuring data quality and stable business operations. This is especially true in multi-source, heterogeneous, and frequently changing business environments. Data anomalies often manifest in unstructured and difficult-to-detect forms, posing serious business risks. To address this, traditional methods typically rely on rule-based analysis or statistical analysis, such as fixed thresholds, year-on-year and month-on-month change assessments, sliding mean detection, and standard deviation control. These methods are simple to implement and highly interpretable, making them suitable for scenarios with stable data structures and fixed patterns. They have been widely integrated into various business monitoring and data processing systems.

[0003] However, with the continuous evolution of data structures and statistical rules, existing detection methods have gradually exposed their limited adaptability. In particular, during actual operation, upstream field adjustments, statistical caliber changes, or processing logic modifications often fail to synchronize in a timely manner, resulting in downstream systems displaying data normally but with values ​​that significantly deviate from the actual business logic. These hidden anomalies—"syntactically correct but semantically incorrect"—often lack obvious characteristics and are difficult to identify using pre-set rules. Localization requires manual intervention or user feedback, severely limiting system response efficiency and data credibility. Summary of the Invention

[0004] In view of this, the present application provides a method, apparatus, device, medium and product for abnormal data detection and model training.

[0005] One aspect of the present application provides an abnormal data detection method, including: acquiring first time series data and second time series data, where the second time series data is future data of the first time series data in the time series, and the second time series data includes at least one time series point data; generating a target sequence based on a target model and the first time series data, where the target sequence represents the error between the time series prediction value at each time series point and the second time series data within the time series range corresponding to the second time series data; confirming abnormal error data in the target sequence based on an over-threshold extreme value method; and treating the time series point data in the second time series data corresponding to the abnormal error data as abnormal data.

[0006] According to an embodiment of the present application, generating a target sequence includes: generating a predicted value of the time series data within a time series range corresponding to the second time series data based on a target model and first time series data; and generating a target sequence based on a residual between the predicted value and the second time series data.

[0007] According to an embodiment of the present application, the target model includes a multi-layer neural network processing unit and a prediction unit, wherein the multi-layer neural network processing unit is used to extract time series features in the first time series data at each time step; wherein the prediction unit is used to generate a prediction value of the corresponding second time series data based on the time series features output by the multi-layer neural network processing unit.

[0008] According to an embodiment of the present application, extracting time series features from first time series data includes: inputting the first time series data into a multi-layer neural network processing unit, and using the hidden state generated by the last layer of neural network processing unit as the time series feature; wherein the latter layer of neural network processing unit uses the hidden information output by the previous layer of neural network processing unit as the received information; wherein the latter layer of neural network processing unit directly fuses at least part of the received information with the cell state at the previous moment at each time step as the basis for state update to generate the cell state at the current moment, and generates output information at the current moment based on the cell state.

[0009] According to an embodiment of the present application, the neural network processing unit does not include a forget gate.

[0010] According to an embodiment of the present application, the abnormal data detection method also includes: obtaining original data, the original data includes at least indicator data associated with financial business; generating initial time series data based on the original data and the time point information corresponding to the original data; obtaining statistical caliber information of each original data, the statistical caliber information represents the statistical standard of the statistical original data; adding statistical caliber information to the time point data corresponding to each time point in the initial time series data; and splitting the initial time series data into first time series data and second time series data.

[0011] According to an embodiment of the present application, confirming abnormal error data in a target sequence includes: selecting an initial threshold based on the data distribution of the target sequence; extracting target error data in the target sequence that is greater than the initial threshold; fitting the target error data using a generalized Pareto distribution to obtain shape parameters and scale parameters; calculating a target threshold based on the shape parameters and the scale parameters; and treating error data in the target sequence that is greater than the target threshold as abnormal error data.

[0012] Another aspect of the present application provides a target model training method, wherein the target model is used to generate a target sequence based on first time series data, wherein the target sequence represents the error between the time series prediction value at each time series point and the second time series data within the time series range corresponding to the second time series data, wherein the second time series data is the future data of the first time series data in the time series, and the target model training method includes: obtaining original sample data, wherein the original sample data at least includes sample indicator data associated with financial business; calculating the coefficient of variation of each sample indicator data in the original sample data, wherein the coefficient of variation represents the fluctuation intensity of the sample indicator data; eliminating sample data whose coefficient of variation is greater than or equal to a preset coefficient threshold to obtain target sample data; and training an initial model based on the target sample data to obtain a target model.

[0013] According to an embodiment of the present application, the target model training method also includes: obtaining statistical caliber information of each original sample data, the statistical caliber information represents the statistical standard of the statistical original data; adding statistical caliber information to the time point data corresponding to each time point in the original sample data; training the initial model, including: in response to detecting a change in the statistical standard, adjusting the parameters of the model, and / or, based on the scope of the change, retraining the initial model.

[0014] Another aspect of the present application provides an abnormal data detection device, including: a first acquisition module, used to acquire first time series data and second time series data, the second time series data is the future data of the first time series data in the time series, and the second time series data includes at least one time series point data; a first generation module, used to generate a target sequence based on a target model and the first time series data, the target sequence representing the error between the time series prediction value at each time series point and the second time series data within the time series range corresponding to the second time series data; a first confirmation module, used to confirm the abnormal error data in the target sequence according to the super-threshold extreme value method; and an abnormality judgment module, used to treat the time series point data in the second time series data corresponding to the abnormal error data as abnormal data.

[0015] Another aspect of the present application provides a target model training device, wherein the target model is used to generate a target sequence based on first time series data, and the target sequence represents the error between the time series prediction value at each time series point and the second time series data within the time series range corresponding to the second time series data, wherein the second time series data is the future data of the first time series data in the time series. The target model training device includes: a second acquisition module, used to obtain original sample data, the original sample data at least includes sample indicator data associated with financial business; a first calculation module, used to calculate the coefficient of variation of each sample indicator data in the original sample data, the coefficient of variation represents the fluctuation intensity of the sample indicator data; a first elimination module, used to eliminate sample data whose coefficient of variation is greater than or equal to a preset coefficient threshold to obtain target sample data; a first training module, used to train an initial model based on the target sample data to obtain a target model.

[0016] Another aspect of the present application provides an electronic device comprising: at least one processor; and a memory connected to the at least one processor; wherein the memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to execute the abnormal data detection method and / or target model training method of any one of the aforementioned embodiments.

[0017] Another aspect of the present application provides a computer-readable storage medium storing computer instructions, wherein the computer instructions are used to enable a computer to execute the abnormal data detection method and / or target model training method according to any one of the aforementioned embodiments.

[0018] Another aspect of the present application provides a computer program product, including a computer program / instruction, characterized in that when the computer program / instruction is executed by a processor, the operation of the abnormal data detection method and / or target model training method of any of the aforementioned embodiments is implemented. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] The above and other objects, features and advantages of the present application will become more apparent through the following description of the embodiments of the present application with reference to the accompanying drawings, in which:

[0020] Figure 1 The following schematically illustrates an application scenario of the abnormal data detection method according to an embodiment of the present application;

[0021] Figure 2 The following schematically shows a flow chart of a method for detecting abnormal data according to an embodiment of the present application;

[0022] Figure 3 The structure diagram of the target model in the abnormal data detection method according to an embodiment of the present application is schematically shown;

[0023] Figure 4 Schematically shows a structural diagram of a neural network processing unit in an abnormal data detection method according to an embodiment of the present application;

[0024] Figure 5 A flowchart of a target model training method according to an embodiment of the present application is schematically shown;

[0025] Figure 6 Schematically shows a block diagram of an abnormal data detection device according to an embodiment of the present application;

[0026] Figure 7 A block diagram schematically illustrates a target model training device according to an embodiment of the present application; and

[0027] Figure 8 A block diagram of an electronic device suitable for implementing the method described above according to an embodiment of the present application is schematically shown. DETAILED DESCRIPTION

[0028] Hereinafter, embodiments of the present application will be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of the present application. In the detailed description below, for ease of explanation, many specific details are set forth to provide a comprehensive understanding of the embodiments of the present application. However, it is apparent that one or more embodiments may also be implemented without these specific details. In addition, in the following description, descriptions of known structures and technologies are omitted to avoid unnecessarily confusing the concepts of the present application.

[0029] The terms used herein are only for describing specific embodiments and are not intended to limit this application. The terms "comprise," "include," etc. used herein indicate the presence of the features, steps, operations, and / or components, but do not exclude the presence or addition of one or more other features, steps, operations, or components.

[0030] All terms used herein (including technical and scientific terms) have the meanings commonly understood by those skilled in the art unless otherwise defined. It should be noted that the terms used herein should be interpreted as having a meaning consistent with the context of this specification and should not be interpreted in an idealized or overly rigid manner.

[0031] When expressions such as "at least one of A, B, and C, etc." are used, they should generally be interpreted in accordance with the meaning commonly understood by those skilled in the art (for example, "a system having at least one of A, B, and C" should include but is not limited to a system having A alone, B alone, C alone, A and B, A and C, B and C, and / or A, B, C, etc.).

[0032] Figure 1The following schematically illustrates an application scenario of the abnormal data detection method according to an embodiment of the present application.

[0033] like Figure 1 As shown, the application scenario 100 of this embodiment includes a network interaction environment between multiple terminal devices (including a first terminal device 101, a second terminal device 102, and a third terminal device 103) and a server 105. A network 104 is used to provide a communication link between the aforementioned devices. Network 104 may include, but is not limited to, a wired network, a wireless communication link, a cellular communication system, the Internet, or other public or private networks.

[0034] The first terminal device 101, the second terminal device 102, and the third terminal device 103 can be any electronic device with communication and display capabilities, such as a smartphone, tablet computer, laptop computer, or desktop computer. These terminal devices can be installed with a business management platform for accessing the legal entity customer marketing system, a data upload tool, an abnormality alarm client, a web management console, or other front-end operating system, allowing users to view and manage data indicators, handle early warning prompts, and manually confirm abnormal events.

[0035] Server 105 is typically deployed in a data center, cloud platform, or dedicated system environment and is equipped with a model calculation module and a data processing module for executing the anomaly detection method described herein. Server 105 is capable of receiving multi-dimensional time-series indicator data related to financial services (e.g., new customers, deposit and loan balances, product coverage ratios, etc., across customer, institution, and managed account dimensions) from various terminal devices and detecting, generating alerts, and providing feedback on any anomaly data contained therein.

[0036] It should be noted that the anomaly detection method provided in the embodiments of the present invention is generally executed by the server 105, and accordingly, the anomaly detection device can be deployed in the server 105. However, in actual applications, the method can also be executed by other servers or server clusters that can communicate with the terminal device and / or the server 105, such as those set in the data governance platform, intelligent operation and maintenance engine, or data lake edge computing node, to support high-frequency, low-latency, and scalable deployment requirements.

[0037] An embodiment of the present application provides an abnormal data detection method, including: acquiring first time series data and second time series data, the second time series data being future data of the first time series data in time series, and the second time series data including at least one time series point data; generating a target sequence based on a target model and the first time series data, the target sequence representing the error between the time series prediction value at each time series point and the second time series data within a time series range corresponding to the second time series data; confirming abnormal error data in the target sequence based on a super-threshold extreme value method; and treating the time series point data in the second time series data corresponding to the abnormal error data as abnormal data.

[0038] The following will be based on Figure 1 The scenario described is described in detail about the abnormal data detection method according to the embodiment of the present application.

[0039] Figure 2 The flowchart of the abnormal data detection method according to an embodiment of the present application is schematically shown.

[0040] like Figure 2 As shown, the abnormal data detection method may at least include operations S210 to S240.

[0041] In operation S210 , first time series data and second time series data are acquired, where the second time series data is future data of the first time series data in time series, and the second time series data includes at least one time point data.

[0042] The first time series data can be a sequence of historical observation data arranged in chronological order, and the second time series data can be subsequent observation data that follows the observation data sequence and is temporally continuous. It should be noted that in practical applications, the first and second time series data can partially overlap, that is, the starting time point of the second time series data can be the same as or partially overlap with the ending time point of the first time series data. Time series point data refers to the multidimensional indicator values ​​collected at a specific time point.

[0043] Specifically, according to business needs, historical business indicator data of specified customers, institutions or related dimensions are retrieved from the database as the first time series data, and data from one or more subsequent consecutive time points are selected as the second time series data, wherein the second time series data may overlap with some time points of the first time series data or may not overlap at all.

[0044] For example, taking corporate customers of a bank as an example, the first time series data may be the indicator sequence such as "daily number of new customers, deposit balance, loan balance" from January 2024 to March 2024, and the second time series data may be the same indicator data from March 25, 2024 to April 3, 2024. At this time, the period from March 25, 2024 to March 31, 2024 is the overlapping part of the two.

[0045] In operation S220, a target sequence is generated according to the target model and the first time series data. The target sequence represents the error between the time series prediction value at each time series point and the second time series data within the time series range corresponding to the second time series data.

[0046] The target model can be a machine learning model for time series prediction, and the target sequence can be an error sequence between the model prediction value generated by the target model based on the first time series data and the actual observation value (that is, the second time series data).

[0047] Specifically, the first time series data is input into the target model. The model outputs the predicted value for each time point within the time range of the second time series data. The difference between the predicted value and the actual observed value (i.e., the second time series data) at each time point is then calculated to form the target sequence. If there is partial overlap between the first and second time series data, the prediction error for the overlapping period is also included in the calculation of the target sequence.

[0048] For example, for the "Deposit Balance" from March 25, 2024, to April 3, 2024, the target model predicts the balances at nine time points as A1 to A9, and the actual observed values ​​are B1 to B9. In this case, the target sequence is the error between A1 and B1, the error between A2 and B2, ..., and the error between A9 and B9. The error values ​​in the target sequence correspond to at least part of the second time series data. That is, the set of time points corresponding to the error values ​​in the target sequence is a subset of the set of time points in the second time series data.

[0049] In operation S230 , abnormal error data in the target sequence is identified according to a super-threshold extreme value method.

[0050] The super-threshold extreme value method is an anomaly detection algorithm based on extreme value theory. It dynamically determines the anomaly discrimination threshold by modeling the extreme value distribution of error data that exceeds the initial threshold.

[0051] Specifically, for the error values ​​in the target sequence, error values ​​that are greater than the abnormality discrimination threshold are identified as abnormal error data.

[0052] In operation S240, the time point data in the second time series data corresponding to the abnormal error data is treated as abnormal data. The time points corresponding to the error data identified as abnormal in the target sequence are mapped back to the second time series data, and the original observation data at these time points are marked as abnormal data. If the second time series data overlaps with the first time series data, anomaly detection is also applied to the overlapping interval.

[0053] For example, if the error of "Deposit Balance" on March 28, 2024 is judged to be abnormal, the original observation value of "Deposit Balance" on March 28, 2024 (that is, the "Deposit Balance" on March 28, 2024 in the second time series data) is marked as abnormal data.

[0054] According to the embodiments of the present application, the abnormal data detection method provided in the embodiments of the present application can realize automated anomaly detection of multi-dimensional time series data, and dynamically score the indicator output that deviates from the expected behavior of the model through the residual analysis module, significantly improving the perception of the problem of "no format error but numerical anomaly". This method improves the accuracy and adaptability of detection by dynamically analyzing the prediction error and identifying abnormal points, reduces manual intervention, and effectively identifies abnormal fluctuations in business data. By using the super-threshold extreme value method, the ability to identify abnormal data is further enhanced, ensuring the efficiency and reliability of anomaly detection.

[0055] Based on the above embodiment, S220 may include operations S310 to S320.

[0056] In operation S310, based on the target model and the first time series data, predicted values ​​for the time series data within the time series range corresponding to the second time series data are generated. The first time series data is input into the target model, which learns the patterns and rules in the historical data and outputs predicted values ​​for the time series range corresponding to the second time series data. These predicted values ​​represent the system's expected estimate of future indicators.

[0057] For example, if the first time series data is the "daily deposit balance" of a bank customer in the past three months, and the second time series data is the actual value of the "daily deposit balance" in the next week, the target model will generate a predicted value for the customer's daily deposit balance in the next week.

[0058] In operation S320, a target sequence is generated based on the residual between the predicted value and the second time series data. The predicted value is compared with the actual observed value of the second time series data, and the error at each time series point is calculated to form the target sequence. The error information can be a residual, and the residual score is defined as a measure of the difference between the predicted value and the true value, for example, an absolute error or a squared error. If the first time series data and the second time series data are multidimensional vectors, the residual of each dimension is calculated separately or the mean square sum is taken as the final residual score.

[0059] For example, if the predicted value is the "daily deposit balance" from April 1 to April 7, 2024, and the actual observed values ​​are B1 to B7, then the target sequence is the residual scores |A1-B1|, |A2-B2|, ..., |A7-B7|, where A1 to A7 are the predicted values.

[0060] According to the embodiments of the present application, in addition to the residual, other methods can also be used for error measurement, such as relative error or deviation rate. Those skilled in the art can select a suitable error calculation method according to different application scenarios and detection requirements.

[0061] According to the embodiments of the present application, by generating a target sequence, the performance of the prediction model can be effectively evaluated, and significant deviations between predicted and actual values ​​can be identified, helping to detect potential anomalies in the data. Using residuals rather than the original predicted values ​​as the final output can more intuitively reflect prediction deviations, making anomaly detection more intuitive and efficient.

[0062] According to an embodiment of the present application, in order to adapt to the time series prediction task, before obtaining the first time series data and the second time series data, it is necessary to first define the input tensor, and then convert the original indicator data into the first time series data and the second time series data that meet the defined input tensor standards.

[0063] Raw data includes at least indicator data related to financial services, such as key business indicator data summarized daily from a bank's corporate customer marketing system. This data is extracted from multiple upstream business systems through a unified scheduling task in the data warehouse and aggregated into standardized indicator thematic tables. Raw data may include time fields, dimension fields, and indicator fields.

[0064] For example, the time field is used to construct a time series structure, such as the statistical day to which the indicator data belongs; the dimension field can be, for example, the institution code, the customer unique identifier, the account manager code, etc.; the indicator field can be the core object of monitoring, such as the number of new customers, the average daily deposit balance, the loan balance, and the product coverage rate, etc.

[0065] The first time series data and the second time series data are obtained using a sliding window technology. A sliding window size T is given, and the time series data from the time point t-T+1 to the time point t of the original data is used as the input of the target model.

[0066] Specifically, suppose an institution has L days of data records, a window length of T, a prediction step of n, and input feature dimensions of D, such as business indicators such as "number of new customers," "deposit and loan balances," and "product coverage." The input-output correspondence for day t can be expressed as:

[0067] X t =[x t-T+1 , x t-T+2 ,……,x t , K]∈R T×D

[0068] Among them, X t Is the input tensor, representing the historical feature data from time t-T+1 to t (that is, the first time series data). i is the eigenvector of time point i, xi=[x i (newCust) 、x i (depBal) 、xi (loanBal) 、x i (cover) , K], where x i (newCust) 、x i (depBal) 、x i (loanBal) 、x i (cover) , K represent the number of new customers, deposit balance, loan balance, product coverage and other characteristics respectively.

[0069] Output tensor Y t Represents the prediction target, which is defined as:

[0070] Y t =[y t+1 ,y t+2 ,……,y t+n , K]∈R n

[0071] Among them, Y t Represents the predicted value from time t+1 to t+n, y i is the predicted feature at time point i.

[0072] Among them, R represents the real number domain, indicating that the elements of the input and output tensors are real numbers. T×D Represents a real matrix of dimension T×D, R n represents a real vector of dimension n.

[0073] Taking the sample data t=2024-09-01 as an example, the eigenvector is x 2024-09-01 =[12, 8520000, 3450000, 0.58, K], where the first element 12 represents the number of new customers on that day, the second element 8520000 represents the average daily deposit balance on that day, the third element 3450000 represents the loan balance on that day, the fourth element 0.58 represents the product coverage ratio on that day, and the fifth element K represents other optional additional features.

[0074] According to the embodiments of the present application, by defining and converting input tensors, the standardization and consistency of model input data can be ensured, improving the accuracy and efficiency of time series prediction. Sliding window technology not only enhances data utilization but also provides the model with rich temporal dynamic features, making the prediction results more reliable.

[0075] On this basis, to ensure that the model perceives periodicity, trend, and structural stability, and to adapt to the characteristics of financial scenarios where "abnormal fluctuations are often affected by holidays, the beginning and end of the month, etc.", time feature fields are added to the input tensor (that is, the data format standard of the first time series data and the second time series data), such as whether it is a working day, whether it is the beginning of the month, whether it is two days before or after a holiday, or whether it is the end of a quarter.

[0076] For example, assuming that 2024-09-01 is a Sunday, before a holiday, the added fields could be: {"weekday": 7, "is it a working day": 0, "is it near a holiday": 0, "is it the beginning of the month": 1, "is it the end of the quarter": 0}.

[0077] Based on the above embodiment, abnormal data detection may further include operations S410 to S450.

[0078] In operation S410 , original data is acquired, where the original data at least includes indicator data associated with financial services.

[0079] In operation S420 , initial time series data is generated according to the original data and time point information corresponding to the original data.

[0080] Initial time series data can be a sequence of time series vectors that can be used as model input, reconstructed from the original data at a fixed time granularity (such as daily, weekly, or monthly) and supplemented with missing time points. For example, the original data can be aggregated daily or missing values ​​can be supplemented according to the statistical day field of the indicator to generate an uninterrupted time series with daily units. Each time point corresponds to a D-dimensional indicator vector, and if there is no data for a day, it is padded with 0 or the previous day's value. For example, for the period from March 1, 2025, to March 31, 2025, the deposit balance of each customer uniquely identified at a specific institution is generated, using the statistical day of the indicator as the key, and a daily series of length 31 is generated. If there is no record for a particular day, the deposit balance of the customer from the previous day is padded.

[0081] In operation S430, statistical caliber information of each raw data is obtained, where the statistical caliber information represents a statistical standard for the raw data.

[0082] Statistical scope information can be a version identifier or rule description used to describe differences in the same indicator due to changes in statistical rules or versions. For example, the version ID corresponding to the upgrade of the account opening scope from "Open an account" to "Open and first funds arrive." For example, if the account opening scope is switched from Version 1 to Version 2 on April 15, 2025, the statistical scope information will be marked as 1 for all indicator data with a statistical date before 2025-04-15; the statistical scope information will be marked as 2 for indicator data with a statistical date after 2025-04-15.

[0083] In operation S440, statistical caliber information is added to the time point data corresponding to each time point in the initial time series data. The statistical caliber information is used as a new dimension and is concatenated with the original D-dimensional indicator vector at the same time point to form a (D+1)-dimensional enhanced time series vector.

[0084] For example, for a customer indicator vector [x1, x2, …, x_D] on April 16, 2025, if the statistical caliber information is 2, it becomes [x1, x2, …, x_D, 2] after splicing.

[0085] In operation S450, the initial time series data is split into first time series data and second time series data. For example, the initial time series data can be split into first time series data X and second time series data X for model input according to the history window length T and the prediction step length n. t and the second time series data Y used for label generation t .

[0086] According to an embodiment of the present application, by introducing a statistical caliber version perception field in the time series vector, the prediction residual jump caused by the caliber change can be significantly reduced, thereby effectively avoiding the model from misjudging the caliber switch as a business anomaly, improving the accuracy and stability of anomaly detection, and automatically adapting to the caliber update without manual labeling.

[0087] Figure 3 The structure diagram of the target model in the abnormal data detection method according to an embodiment of the present application is schematically shown.

[0088] like Figure 3As shown, based on the foregoing embodiment, the target model includes a multi-layer neural network processing unit and a prediction unit, wherein the multi-layer neural network processing unit includes multiple neural network processing units, and the neural network processing unit can be a long short-term memory network (Long Short-Term Memory, LSTM), and the multi-layer neural network processing unit is used to extract the time series features in the first time series data at each time step; wherein the prediction unit is used to generate the corresponding prediction value of the second time series data according to the time series features output by the multi-layer neural network processing unit.

[0089] The multi-layer neural network processing unit gradually extracts and encodes the complex temporal features in the first time series data. Each layer is responsible for capturing temporal dynamics and patterns at different levels, generating time series features. These features are then passed to the prediction unit. Based on the received time series features, the prediction unit applies linear or nonlinear transformations and generates predicted values ​​for the second time series data through a fully connected layer or other form of output layer.

[0090] According to the embodiments of the present application, by using a multi-layer neural network processing unit, the model can better capture the complex dynamic changes in time series data, improving the accuracy and stability of predictions. The prediction unit makes predictions based on the extracted time series features, ensuring the model's sensitivity and adaptability to future data changes.

[0091] According to an embodiment of the present application, the process of extracting time series features from first time series data includes: inputting the first time series data into a multi-layer neural network processing unit, and using the hidden state generated by the last layer of neural network processing units as the time series features. The latter layer of neural network processing units uses the hidden information output by the previous layer of neural network processing units as received information. The latter layer of neural network processing units directly fuses at least part of the received information with the cell state at the previous moment at each time step as a basis for state update to generate the cell state at the current moment, and generates output information at the current moment based on the cell state.

[0092] At each time step t, the multi-layer neural network processing unit first calculates the current input vector x t and the previous hidden state h {t-1} Generate candidate cell information ; then and the cell state c at the previous moment {t-1} Direct accumulation and fusion are performed to form a new cell state c t = +c {t-1} ; Finally, by c t Apply nonlinear mapping (such as hyperbolic tangent function) to obtain the hidden output h at the current moment t .

[0093] Figure 4 The structure of the neural network processing unit in the abnormal data detection method according to an embodiment of the present application is schematically shown.

[0094] like Figure 4 As shown, based on the above embodiment, the single-layer neural network processing unit includes three sub-modules: input gate, candidate cell state calculation and output gate.

[0095] Let the current input vector be x t ∈R D , the hidden state at the previous moment is h t-1 ∈R H , the cell state at the last moment is c t-1 ∈R H The input gate passes Calculate, where W i ∈R H×D is the input gate weight, U i ∈R H×H is the cycle weight, b i ∈R H is the bias; the candidate cell state is calculated by the following formula:

[0096]

[0097] Where W c ∈R H×D 、U c ∈R H×H 、b c ∈R H .

[0098] The output gate is calculated as follows:

[0099]

[0100] where Wo∈R H×D 、Uo∈R H×H ,bo∈R H .

[0101] Each time step first receives the current input x t With the previous hidden state h t-1 , calculate the input gate i t With candidate status ; then

[0102] (where "⊙" represents element-by-element multiplication) and the cell state c at the previous moment t-1 Directly add and update to the current cell state. The formula is:

[0103]

[0104] Finally, use the output gate o t The updated cell state is filtered and the following formula is used:

[0105]

[0106] Generate the current hidden state h t , the hidden state is the same as c t Pass it to the next time step to extract complete time series features.

[0107] It should be noted that the neural network processing unit does not include a forget gate.

[0108] According to an embodiment of the present application, by directly fusing the received information with the cell state at the previous moment at each time step, it is possible to retain remote timing dependencies and reduce the complexity of the gating structure without the need for a forget gate; thereby reducing the number of model parameters and computational overhead, improving inference efficiency, and ensuring the effective maintenance of long-term memory and the integrity of temporal feature extraction.

[0109] The above-mentioned multi-layer neural network processing unit can be the encoder of the target model, and the decoder of the target model can be a symmetrical multi-layer lightweight long short-term memory network (Light Long Short-Term Memory, LightLSTM) structure. The decoder adopts a symmetrical multi-layer LightLSTM structure, which can gradually generate prediction values ​​based on the hidden state generated by the encoder. The output of the last layer of LSTM processing unit of the encoder is used as the initial input of the decoder. In the decoding stage, after the decoder generates a prediction value, it will use the prediction value as the input of the next moment, thereby generating a series of prediction values ​​of time series data through autoregression. The hidden state generated at each decoding step t Mapped to predicted value through the fully connected layer , output a prediction sequence of length H. This encoder-decoder architecture can capture the long-term dependency of the sequence and improve the prediction effect.

[0110] Based on the above embodiment, operation S230 may include operations S510 to S550.

[0111] In operation S510, an initial threshold is selected based on the target sequence data distribution. The initial threshold is selected based on the statistical distribution of the target sequence error data. For example, the initial threshold can be set based on the mean and standard deviation of the error data. The initial threshold can also be the mean of the error data plus a multiple of the standard deviation.

[0112] For example, assuming that the mean of the target sequence error data is 0.5 and the standard deviation is 0.1, the initial threshold can be set to 0.5 + 2 * 0.1 = 0.7, which means that all data points with an error greater than 0.7 will be considered as abnormal data.

[0113] In operation S520, target error data in the target sequence that are greater than an initial threshold are extracted. For example, if some error data in the target sequence are 0.8, 0.9, and 1.1, and the initial threshold is 0.7, these values ​​will be extracted as potential abnormal data.

[0114] In operation S530 , the target error data is fitted using a generalized Pareto distribution to obtain shape parameters and scale parameters. The extracted target error data exceeding the initial threshold is fitted using a generalized Pareto distribution (GPD) to estimate the shape parameter ξ and the scale parameter σ.

[0115] Specifically, first record the data exceeding the initial threshold as the excess

[0116] , where x i Represents the error data, and u is the initial threshold. Then, the shape parameter ξ and scale parameter σ of the generalized Pareto distribution are calculated using the maximum likelihood estimation method. The specific calculation formula is:

[0117]

[0118] Where n is the number of data points exceeding the threshold, y i is the error data that exceeds the initial threshold.

[0119] Taking partial derivatives of σ and ξ and setting them to zero, we can get the following system of equations:

[0120] Derivative with respect to the scale parameter σ:

[0121]

[0122] Derivative with respect to the shape parameter ξ:

[0123]

[0124] The above two equations are solved simultaneously through numerical optimization methods to obtain parameter estimates ξ and σ.

[0125] In operation S540, a target threshold is calculated based on the shape parameter and scale parameter. The final target threshold is calculated based on the shape parameter ξ and scale parameter σ obtained by fitting the generalized Pareto distribution. The target threshold is obtained by adjusting the anomaly probability threshold q. This anomaly probability threshold can be set based on business needs, for example, a smaller value (such as 0.01 or 0.05). The target threshold is obtained according to the calculation formula and is used to distinguish normal from abnormal data points.

[0126] Specifically, the target threshold z q The calculation formula is:

[0127]

[0128] Among them, q is the set abnormal probability threshold, n is the total number of samples, N u is the number of samples greater than the initial threshold, and are the scale and shape parameters obtained from fitting the generalized Pareto distribution.

[0129] In operation S550 , error data in the target sequence that is greater than a target threshold is treated as abnormal error data.

[0130] According to the embodiments of the present application, by fitting abnormal data in combination with the generalized Pareto distribution, the threshold can be dynamically adjusted according to the distribution characteristics of the data, thereby improving the sensitivity and accuracy of anomaly detection. Especially when processing time series data with high volatility such as financial business data, it can effectively reduce false alarms and improve the actual application effect of the model.

[0131] According to the embodiment of the present application, in order to facilitate the unified measurement, the error data (such as residual) is normalized and the error data is converted into a dimensionless abnormality score, for example, the normalized score is defined as (Only for r i >u is valid, where r i is the i-th error data in the target sequence). The corresponding threshold normalization is The judgment rule is: if the normalized score s of the sample i Exceeding the threshold , it is marked as abnormal; otherwise it is considered normal. In other words, it is a direct comparison of the original residual and the threshold: if r i >z q , then the output is abnormal, if r i ≤z q , the output is normal.

[0132] According to the embodiment of the present application, while confirming the abnormal error data in the target sequence, anomaly detection information can also be output. The anomaly detection information can include a label, a score, and a threshold. Specifically, the anomaly label can be a binary indicator used to indicate whether each data point is abnormal. If the residual r at the current moment is t Greater than the calculated dynamic threshold z q , the label is 1, indicating abnormality; otherwise, the label is 0, indicating normality. The abnormality score can be the normalized score mentioned above, and the abnormality threshold can be the target threshold mentioned above.

[0133] On the other hand, the present application also provides a target model training method, including: obtaining original sample data, the original sample data at least including sample indicator data associated with financial business; calculating the coefficient of variation of each sample indicator data in the original sample data, the coefficient of variation characterizing the fluctuation intensity of the sample indicator data; eliminating sample data with a coefficient of variation greater than or equal to a preset coefficient threshold to obtain target sample data; training an initial model based on the target sample data to obtain a target model.

[0134] Figure 5 A flowchart of a target model training method according to an embodiment of the present application is schematically shown.

[0135] like Figure 5 As shown, based on the aforementioned embodiment, the target model is used to generate a target sequence based on first time series data. The target sequence represents the error between the time series prediction value at each time series point and the second time series data within the time series range corresponding to the second time series data, where the second time series data is the future data of the first time series data in the time series. The target model training method may include operations S610 to S640.

[0136] In operation S610 , original sample data is acquired, where the original sample data at least includes sample indicator data associated with financial services.

[0137] In operation S620, the coefficient of variation of each sample indicator data in the original sample data is calculated. The coefficient of variation represents the intensity of fluctuation of the sample indicator data. The coefficient of variation can be calculated by calculating the ratio of the standard deviation (σ) of the indicator to the mean (μ), using the formula CV = σ / μ. A larger coefficient of variation indicates greater volatility of the indicator.

[0138] In operation S630, sample data with a coefficient of variation greater than or equal to a preset coefficient threshold is removed to obtain target sample data. Specifically, if the coefficient of variation (CV) of a particular sample indicator data is greater than or equal to a preset threshold (e.g., 0.02), the indicator is considered unstable and removed from the training sample to prevent interference with model learning. Only indicator data with a small (stable) coefficient of variation is retained as the target sample data for model training.

[0139] In operation S640 , an initial model is trained based on the target sample data to obtain a target model.

[0140] According to the embodiments of the present application, by eliminating unstable indicators with excessively large coefficients of variation, noise interference in the data can be effectively reduced, and the target model can focus more on financial business indicators with smaller fluctuations and stability, thereby reducing the risk of misjudgment or missing anomalies due to unstable factors.

[0141] Based on the foregoing embodiment, the target model training method may further include operation S710.

[0142] In operation S710, statistical caliber information is added to the time point data corresponding to each time point in the original sample data. Specifically, adding statistical caliber information is similar to adding statistical caliber information to the original data in the above embodiment, and will not be repeated here.

[0143] Operation S640 may include operation S720.

[0144] In operation S720, in response to detecting a change in the statistical standard, model parameters are adjusted and / or the initial model is retrained based on the extent of the change. If a change in statistical caliber information is detected during training (i.e., the statistical caliber version at a certain moment is different from the previous moment), it is considered a change in the statistical standard. In this case, the model parameters can be adjusted or the model can be retrained based on the extent of the change to ensure that the model can adapt to the new statistical caliber and improve its robustness under different statistical standards.

[0145] For example, suppose a bank adopts a new statistical methodology for customer deposit balance data during a certain period of time, resulting in a change in the statistical caliber of the data. In this case, the statistical caliber information jumps, marked as 1. Upon recognizing this change, this marker is added to the model's input data as an additional input. The model then mitigates or adjusts the impact of the residual error prediction at that point in time, or retrains the model based on the scope of the change, to ensure that the model can still accurately predict and identify data anomalies under the new statistical caliber.

[0146] Figure 6The following schematically shows a block diagram of an abnormal data detection device according to an embodiment of the present application.

[0147] like Figure 6 As shown, the abnormal data detection device 800 may include a first acquisition module 810 , a first generation module 820 , a first confirmation module 830 , and an abnormality judgment module 850 .

[0148] The first acquisition module 810 is configured to acquire first time series data and second time series data, where the second time series data is future data of the first time series data in a time series, and the second time series data includes at least one time series point. In some embodiments, the first acquisition module 810 can be configured to perform operation S210 in the above-described abnormal data detection method, which is not further described herein.

[0149] The first generation module 820 is configured to generate a target sequence based on the target model and the first time series data. The target sequence represents the error between the time series prediction value and the second time series data at each time series point within the time series range corresponding to the second time series data. In some embodiments, the first generation module 820 can be configured to perform operation S220 in the above-described abnormal data detection method, which is not further described here.

[0150] The first confirmation module 830 is used to confirm the abnormal error data in the target sequence according to the super-threshold extreme value method. In some embodiments, the first confirmation module 830 can be used to perform operation S230 in the above-mentioned abnormal data detection method, which will not be described in detail here.

[0151] The abnormality determination module 820 is configured to treat the time point data in the second time series data corresponding to the abnormal error data as abnormal data. In some embodiments, the abnormality determination module 820 can be configured to perform operation S240 in the above abnormal data detection method, which will not be described in detail here.

[0152] Figure 7 A block diagram of a target model training device according to an embodiment of the present application is schematically shown.

[0153] like Figure 7 As shown, the target model training device 900 may include a second acquisition module 910 , a first calculation module 920 , a first elimination module 930 , and a first training module 940 .

[0154] The second acquisition module 910 is used to obtain original sample data, which includes at least sample indicator data associated with financial services. In some embodiments, the second acquisition module 910 can be used to perform operation S610 in the above-mentioned target model training method, which will not be described in detail here.

[0155] The first calculation module 920 is used to calculate the coefficient of variation of each of the sample index data in the original sample data, where the coefficient of variation represents the fluctuation intensity of the sample index data. In some embodiments, the first calculation module 920 can be used to perform operation S620 in the above-mentioned target model training method, which is not described in detail here.

[0156] The first elimination module 930 is used to eliminate the sample data whose coefficient of variation is greater than or equal to a preset coefficient threshold to obtain target sample data. In some embodiments, the first elimination module 930 can be used to perform operation S630 in the above-mentioned target model training method, which will not be described in detail here.

[0157] The first training module 920 is used to train the initial model based on the target sample data to obtain the target model. In some embodiments, the first training module 920 can be used to perform operation S640 in the above-mentioned target model training method, which will not be described in detail here.

[0158] According to the embodiments of the present application, any number of modules, submodules, units, and subunits, or at least part of the functions of any number of them, can be implemented in one module. According to the embodiments of the present application, any one or more of the modules, submodules, units, and subunits can be split into multiple modules for implementation. According to the embodiments of the present application, any one or more of the modules, submodules, units, and subunits can be at least partially implemented as a hardware circuit, such as a field programmable gate array (FPGA), a programmable logic array (PLA), a system on a chip, a system on a substrate, a system on a package, an application-specific integrated circuit (ASIC), or can be implemented by hardware or firmware in any other reasonable way of integrating or packaging the circuit, or can be implemented in any one of the three implementation methods of software, hardware, and firmware, or in any appropriate combination of any of them. Alternatively, according to the embodiments of the present application, one or more of the modules, submodules, units, and subunits can be at least partially implemented as a computer program module, which can perform the corresponding functions when the computer program module is executed.

[0159] For example, any multiple of the first acquisition module 810, the first generation module 820, the first confirmation module 830, the abnormality judgment module 850, and / or the second acquisition module 910, the first calculation module 920, the first elimination module 930, and the first training module 940 can be combined into one module / unit / sub-unit for implementation, or any one of these modules / units / sub-units can be split into multiple modules / units / sub-units. Alternatively, at least part of the functionality of one or more of these modules / units / sub-units can be combined with at least part of the functionality of other modules / units / sub-units and implemented in one module / unit / sub-unit. According to an embodiment of the present application, at least one of the first generation module 820, the first confirmation module 830, the anomaly determination module 850, and / or the second acquisition module 910, the first calculation module 920, the first elimination module 930, and the first training module 940 can be at least partially implemented as a hardware circuit, such as a field programmable gate array (FPGA), a programmable logic array (PLA), a system on a chip, a system on a substrate, a system on a package, an application-specific integrated circuit (ASIC), or can be implemented by hardware or firmware through any other reasonable means of circuit integration or packaging, or implemented in any one of the three implementation methods of software, hardware, and firmware, or in any appropriate combination of any of them. Alternatively, at least one of the first generation module 820, the first confirmation module 830, the anomaly determination module 850, and / or the second acquisition module 910, the first calculation module 920, the first elimination module 930, and the first training module 940 can be at least partially implemented as a computer program module, which can perform the corresponding function when executed.

[0160] It should be noted that the data processing system part in the embodiments of the present application corresponds to the data processing method part in the embodiments of the present application. The description of the data processing system part specifically refers to the data processing method part and will not be repeated here.

[0161] Figure 8 A block diagram of an electronic device suitable for implementing the method described above according to an embodiment of the present application is schematically shown. Figure 8 The electronic device shown is merely an example and should not limit the functions and scope of use of the embodiments of the present application.

[0162] like Figure 8As shown, the electronic device 1000 according to an embodiment of the present application includes a processor 1001, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 1002 or a program loaded from a storage portion 1008 into a random access memory (RAM) 1003. The processor 1001 may include, for example, a general-purpose microprocessor (e.g., a CPU), an instruction set processor and / or a related chipset and / or a special-purpose microprocessor (e.g., an application-specific integrated circuit (ASIC)), etc. The processor 1001 may also include onboard memory for caching purposes. The processor 1001 may include a single processing unit or multiple processing units for performing different actions of the method flow according to the embodiment of the present application.

[0163] Various programs and data required for the operation of the electronic device 1000 are stored in the RAM 1003. The processor 1001, the ROM 1002, and the RAM 1003 are connected to each other via a bus 1004. The processor 1001 performs various operations of the method flow according to the embodiment of the present application by executing the programs in the ROM 1002 and / or the RAM 1003. It should be noted that the programs may also be stored in one or more memories other than the ROM 1002 and the RAM 1003. The processor 1001 may also perform various operations of the method flow according to the embodiment of the present application by executing the programs stored in the one or more memories.

[0164] According to an embodiment of the present application, electronic device 1000 may further include an input / output (I / O) interface 1005, which is also connected to bus 1004. Electronic device 1000 may also include one or more of the following components connected to I / O interface 1005: an input section 1006 including a keyboard, mouse, etc.; an output section 1007 including devices such as a cathode ray tube (CRT), liquid crystal display (LCD), and speakers; a storage section 1008 including a hard disk; and a communication section 1009 including a network interface card such as a LAN card or modem. Communication section 1009 performs communication processing via a network such as the Internet. A drive 1010 is also connected to I / O interface 1005 as needed. Removable media 1011, such as a magnetic disk, optical disk, magneto-optical disk, semiconductor memory, etc., is installed in drive 1010 as needed, so that computer programs read from the removable media can be installed into storage section 1008 as needed.

[0165] According to an embodiment of the present application, the method flow according to the embodiment of the present application can be implemented as a computer software program. For example, an embodiment of the present application includes a computer program product, which includes a computer program carried on a computer-readable storage medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 1009, and / or installed from the removable medium 1011. When the computer program is executed by the processor 1001, the above-mentioned functions defined in the system of the embodiment of the present application are executed. According to an embodiment of the present application, the system, equipment, device, module, unit, etc. described above can be implemented by a computer program module.

[0166] This application also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments, or may exist independently and not be incorporated into the device / apparatus / system. The computer-readable storage medium carries one or more programs, and when the one or more programs are executed, the method according to the embodiments of this application is implemented.

[0167] According to embodiments of the present application, a computer-readable storage medium may be a non-volatile computer-readable storage medium. Examples include, but are not limited to, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In the present application, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device.

[0168] For example, according to an embodiment of the present application, the computer-readable storage medium may include the ROM 1002 and / or the RAM 1003 described above and / or one or more memories other than the ROM 1002 and the RAM 1003 .

[0169] An embodiment of the present application also includes a computer program product, which includes a computer program, which contains program code for executing the method provided by the embodiment of the present application. When the computer program product is run on an electronic device, the program code is used to enable the electronic device to implement the abnormal data detection method or target model training method provided by the embodiment of the present application.

[0170] When the computer program is executed by the processor 1001, the above functions defined in the system / device of the embodiment of the present application are performed. According to the embodiment of the present application, the system, device, module, unit, etc. described above can be implemented by a computer program module.

[0171] In one embodiment, the computer program can rely on tangible storage media such as optical storage devices and magnetic storage devices. In another embodiment, the computer program can also be transmitted and distributed in the form of a signal on a network medium, and downloaded and installed through the communication part 1009, and / or installed from a removable medium 1011. The program code contained in the computer program can be transmitted using any appropriate network medium, including but not limited to: wireless, wired, etc., or any suitable combination of the above. According to an embodiment of the present application, the program code for executing the computer program provided by the embodiment of the present application can be written in any combination of one or more programming languages. Specifically, these computer programs can be implemented using high-level procedural and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages ​​include but are not limited to Java, C++, Python, "C" language or similar programming languages. The program code can be executed entirely on the user computing device, partially on the user device, partially on the remote computing device, or entirely on the remote computing device or server. Where a remote computing device is involved, the remote computing device may be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computing device (e.g., through the Internet using an Internet service provider).

[0172] The flowcharts and block diagrams in the accompanying drawings illustrate the possible implementation architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present application. In this regard, each box in the flowchart or block diagram can represent a module, program segment, or part of the code, and the above-mentioned module, program segment, or part of the code contains one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in an order different from that marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flowchart, and the combination of boxes in the block diagram or flowchart, can be implemented with a dedicated hardware-based system that performs the specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions. It will be understood by those skilled in the art that the features described in the various embodiments of the present application can be combined and / or combined in various ways, even if such combinations or combinations are not explicitly described in the present application. In particular, without departing from the spirit and teachings of the present application, the features described in the various embodiments of the present application may be combined and / or coupled in various ways, and all of these combinations and / or couplings fall within the scope of the present application.

[0173] The embodiments of the present application have been described above. However, these embodiments are for illustrative purposes only and are not intended to limit the scope of the present application. Although each embodiment has been described separately above, this does not mean that the measures in each embodiment cannot be advantageously used in combination. Without departing from the scope of the present application, those skilled in the art may make various substitutions and modifications, and these substitutions and modifications should all fall within the scope of the present application.

Claims

1. A method for detecting abnormal data, characterized in that: The method comprises: Acquire first time series data and second time series data, where the second time series data is future data of the first time series data in time series, and the second time series data includes at least one time point data; Generate a target sequence based on the target model and the first time series data, where the target sequence represents the error between the time series prediction value at each time series point and the second time series data within the time series range corresponding to the second time series data; confirming abnormal error data in the target sequence according to the super-threshold extreme value method; The time series point data in the second time series data corresponding to the abnormal error data is used as abnormal data.

2. The method according to claim 1, characterized in that Generating a target sequence comprises: Generate a predicted value of the time series data within a time series range corresponding to the second time series data according to the target model and the first time series data; The target sequence is generated based on the residual between the predicted value and the second time series data.

3. The method according to claim 2, characterized in that The target model includes a multi-layer neural network processing unit and a prediction unit, The multi-layer neural network processing unit is used to extract time series features from the first time series data at each time step; Among them, the prediction unit is used to generate a prediction value of the corresponding second time series data based on the time series features output by the multi-layer neural network processing unit.

4. The method according to claim 3, characterized in that The process of extracting the time series features from the first time series data includes: Inputting the first time series data into the multi-layer neural network processing unit, and using the hidden state generated by the last layer of neural network processing unit as the time series feature; The neural network processing unit of the latter layer uses the hidden information output by the neural network processing unit of the former layer as received information; Among them, the neural network processing unit in the latter layer directly fuses at least part of the received information with the cell state at the previous moment at each time step as a basis for state update to generate the cell state at the current moment, and generates output information at the current moment based on the cell state.

5. The method according to claim 3, characterized in that The neural network processing unit does not include a forget gate.

6. The method according to claim 1, characterized in that The method further comprises: Acquiring original data, where the original data includes at least indicator data associated with financial business; generating initial time series data according to the original data and time point information corresponding to the original data; Obtaining statistical caliber information of each raw data, wherein the statistical caliber information represents a statistical standard for counting the raw data; Adding the statistical caliber information to the time point data corresponding to each time point in the initial time series data; The initial time series data is split into the first time series data and the second time series data.

7. The method according to claim 1, characterized in that The confirming abnormal error data in the target sequence includes: Selecting an initial threshold value according to the data distribution of the target sequence; Extracting target error data greater than the initial threshold value in the target sequence; Fitting the target error data using a generalized Pareto distribution to obtain shape parameters and scale parameters; Calculating a target threshold based on the shape parameter and the scale parameter; The error data in the target sequence that is greater than the target threshold is regarded as the abnormal error data.

8. A target model training method, characterized in that: The target model is used to generate a target sequence based on the first time series data, wherein the target sequence represents the error between the time series prediction value at each time series point and the second time series data within the time series range corresponding to the second time series data, wherein the second time series data is the future data of the first time series data in time series; The method comprises: Acquiring original sample data, where the original sample data includes at least sample indicator data associated with financial services; Calculating the coefficient of variation of each of the sample indicator data in the original sample data, where the coefficient of variation represents the fluctuation intensity of the sample indicator data; Eliminate sample data whose coefficient of variation is greater than or equal to a preset coefficient threshold to obtain target sample data; Based on the target sample data, an initial model is trained to obtain the target model.

9. The method according to claim 8, characterized in that The method further comprises: Obtaining statistical caliber information of each of the original sample data, wherein the statistical caliber information represents a statistical standard for counting the original data; Adding the statistical caliber information to the time point data corresponding to each time point in the original sample data; The training initial model includes: In response to detecting a change in the statistical criterion, parameters of the model are adjusted, and / or the initial model is retrained based on the extent of the change.

10. An abnormal data detection device, characterized in that: The device comprises: A first acquisition module is configured to acquire first time series data and second time series data, where the second time series data is future data of the first time series data in time series, and the second time series data includes at least one time series point data; A first generating module is configured to generate a target sequence based on a target model and the first time series data, wherein the target sequence represents an error between a time series prediction value at each time series point and the second time series data within a time series range corresponding to the second time series data; A first confirmation module is configured to confirm abnormal error data in the target sequence according to a super-threshold extreme value method; and The abnormality judgment module is used to take the time series point data in the second time series data corresponding to the abnormal error data as abnormal data.

11. A target model training device, characterized in that: The target model is used to generate a target sequence based on the first time series data, wherein the target sequence represents the error between the time series prediction value at each time series point and the second time series data within the time series range corresponding to the second time series data, wherein the second time series data is the future data of the first time series data in time series; The device comprises: A second acquisition module is configured to acquire original sample data, wherein the original sample data at least includes sample indicator data associated with financial services; A first calculation module is configured to calculate a coefficient of variation of each of the sample index data in the original sample data, wherein the coefficient of variation represents a fluctuation intensity of the sample index data; A first elimination module is configured to eliminate sample data whose coefficient of variation is greater than or equal to a preset coefficient threshold to obtain target sample data; and The first training module is used to train an initial model based on the target sample data to obtain the target model.

12. An electronic device comprising: one or more processors; a memory for storing one or more computer programs, It is characterized in that the one or more processors execute the one or more computer programs to implement the steps of the method according to any one of claims 1 to 7 and / or claims 8 to 9.

13. A computer-readable storage medium having a computer program or instruction stored thereon, characterized in that: When the computer program or instructions are executed by a processor, the steps of the method according to any one of claims 1 to 7 and / or claims 8 to 9 are implemented.

14. A computer program product comprising a computer program or instructions, characterized in that When the computer program or instructions are executed by a processor, the steps of the method according to any one of claims 1 to 7 and / or claims 8 to 9 are implemented.

Images