Abnormity detection method and device of transaction system, storage medium and electronic equipment

Abstract

The invention provides an anomaly detection method and device for a transaction system, a storage medium and electronic equipment, and relates to the technical field of computers, and the method comprises the steps: obtaining log data and transaction data of a target system; feature extraction is conducted on the log data, a log feature set is obtained, and the log feature set comprises a time sequence deviation degree, a sequence anomaly probability and a semantic anomaly cluster proportion; feature extraction is carried out on the transaction data, a transaction feature set is obtained, and the transaction feature set comprises a topology missing degree, a residual error abnormity degree and a frequency deviation degree; fusing the log feature set and the transaction feature set to generate a feature matrix; inputting the feature matrix into a preset fusion decision model, and calculating to obtain an abnormal score of the transaction system; and when the abnormal score is greater than a preset threshold value, determining that the transaction system is in an abnormal state. By applying the method provided by the embodiment of the invention, the abnormity in the transaction system can be accurately identified.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of computers, and in particular to an abnormality detection method and device for a transaction system, a storage medium and an electronic device. BACKGROUND

[0002] Under the modern distributed system architecture, especially in the fields of finance, e-commerce and other core transaction systems, the service components are numerous and the call links are complex, and real-time detection and diagnosis of system abnormalities have always been a technical difficulty in the industry. At present, common monitoring methods mainly rely on threshold monitoring of system performance indicators or simple keyword matching and statistics on application log texts. These methods often start from a single data source and determine the system state by analyzing the changes in a certain type of data in isolation.

[0003] However, the prior art is difficult to effectively distinguish between normal business fluctuations and real system abnormalities. For example, a traffic peak caused by a promotional activity may be misjudged as an abnormality, while some hidden faults caused by deep service dependency faults or code logic defects, which are manifested as multi-dimensional slight abnormalities, are difficult to capture and trace due to the limitations of single data source judgment. This limitation results in a high false positive and false negative rate of the existing methods, which cannot provide accurate and reliable fault location support for operation and maintenance personnel. SUMMARY

[0004] The technical problem to be solved by the present application is to provide an abnormality detection method and device for a transaction system, a storage medium and an electronic device, which can accurately identify abnormalities in the transaction system. The specific scheme is as follows:

[0005] An abnormality detection method for a transaction system, comprising:

[0006] obtaining log data and transaction data of a target system;

[0007] extracting features from the log data to obtain a log feature set, the log feature set including a time series deviation degree, a sequence anomaly probability and a semantic anomaly cluster proportion;

[0008] extracting features from the transaction data to obtain a transaction feature set, the transaction feature set including a topology absence degree, a residual anomaly degree and a frequency deviation degree;

[0009] fusing the log feature set and the transaction feature set to generate a feature matrix;

[0010] inputting the feature matrix into a preset fusion decision model to calculate an abnormality score of the transaction system;

[0011] if the abnormality score is greater than a preset threshold, determining that the transaction system is in an abnormal state.

[0012] Optionally, in the above method, the step of extracting features from the log data to obtain a log feature set includes:

[0013] The frequency of log errors in the log data is statistically analyzed using a sliding window of preset duration to obtain the frequency statistics results;

[0014] Based on the exponentially weighted moving average algorithm, historical statistical data are weighted and calculated to establish a dynamic time-series baseline;

[0015] Based on the dynamic time-series baseline and the preset quantile threshold, the time-series deviation of the frequency statistics results is calculated;

[0016] The log event stream in the log data is scanned using a sequence pattern mining algorithm to obtain event sequences that meet the support threshold.

[0017] The probability of sequence anomaly is calculated by comparing the occurrence frequency of the event sequence with the historical baseline frequency of the event sequence.

[0018] The log text in the log data is converted into a vector representation using a semantic vectorization model, and density clustering is performed on the resulting vectors to obtain the clustering results.

[0019] Based on the clustering results, outlier semantic clusters are identified, and the proportion of logs in the outlier semantic clusters to the total number of logs is calculated as the proportion of semantically abnormal clusters.

[0020] Optionally, in the above method, the step of extracting features from the transaction data to obtain a transaction feature set includes:

[0021] Analyze the system call topology in the transaction data to determine the set of nodes on the critical path of the transaction;

[0022] Compare the actual call path with the node set, and calculate the proportion of key nodes in the node set that were not called, as the topology missing degree;

[0023] Seasonal decomposition is performed on the time series of transaction volume in the transaction data to separate the trend term, seasonal term and residual term;

[0024] Based on the statistical fluctuation characteristics of the residual term, its deviation from the historical normal residual is calculated as the residual abnormality.

[0025] Extract the arrival time interval sequence of transaction requests from the transaction data, and construct the probability distribution of the arrival time interval sequence;

[0026] A nonparametric test method is used to perform a similarity test between the current time interval distribution and the historical baseline distribution, and the frequency deviation is calculated based on the test statistic.

[0027] Optionally, in the above method, the step of inputting the feature matrix into a preset fusion decision model to calculate the anomaly score of the transaction system includes:

[0028] From the pre-configured weight rule library, load the corresponding weight coefficients for each dimension of the feature matrix; based on the weight coefficients, perform a weighted linear summation on the values ​​of each dimension in the feature matrix to obtain the initial anomaly score;

[0029] The initial anomaly score is input into the dynamic calibration module, and calibration is performed by combining the system's real-time load and historical false alarm data.

[0030] The final transaction system anomaly score is output by matching the calibrated score with multiple judgment thresholds in the dynamic threshold rule base.

[0031] Optionally, after determining that the transaction system is in an abnormal state, the above method further includes:

[0032] In the system service call topology graph, the status of each service node is colored according to the preset node health index;

[0033] Based on the call dependencies between nodes and the preset propagation rules, the abnormal state is propagated iteratively along the call edge;

[0034] Once the staining state stabilizes, the initial source node of the abnormal propagation is located based on the staining depth and propagation path of the node.

[0035] Associate the code version control system and obtain the recent code commit records of the services related to the source node of the anomaly propagation;

[0036] Perform a difference analysis on the code commit records to identify critical code changes that are unusual.

[0037] An anomaly detection device for a trading system includes:

[0038] The acquisition unit is used to acquire log data and transaction data from the target system.

[0039] The first feature extraction unit is used to extract features from the log data to obtain a log feature set, which includes time series deviation, sequence anomaly probability, and the proportion of semantic anomaly clusters.

[0040] The second feature extraction unit is used to extract features from the transaction data to obtain a transaction feature set, which includes topological missingness, residual abnormality and frequency deviation.

[0041] The fusion unit is used to fuse the log feature set and the transaction feature set to generate a feature matrix;

[0042] The calculation unit is used to input the feature matrix into a preset fusion decision model to calculate the anomaly score of the transaction system;

[0043] The determining unit is used to determine that the transaction system is in an abnormal state when the abnormal score is greater than a preset threshold.

[0044] Optionally, in the aforementioned apparatus, the first feature extraction unit includes:

[0045] The statistics subunit is used to perform frequency statistics on log errors in the log data using a sliding window of preset duration, and obtain frequency statistics results.

[0046] The first execution subunit is used to perform weighted calculations on historical statistical data based on the exponentially weighted moving average algorithm to establish a dynamic time-series baseline.

[0047] The calculation subunit is used to calculate the temporal deviation of the frequency statistics results based on the dynamic temporal baseline and the preset quantile threshold.

[0048] The scanning subunit is used to scan the log event stream in the log data using a sequence pattern mining algorithm to obtain event sequences that meet the support threshold.

[0049] The second execution subunit is used to calculate the probability of sequence anomaly based on a comparison between the occurrence frequency of the event sequence and the historical reference frequency of the event sequence.

[0050] The clustering subunit is used to convert the log text in the log data into a vector representation through a semantic vectorization model, and to perform density clustering on the obtained vectors to obtain the clustering results.

[0051] The third execution subunit is used to identify outlier semantic clusters based on the clustering results and calculate the proportion of logs in the outlier semantic clusters to the total number of logs, as the proportion of semantically abnormal clusters.

[0052] Optionally, in the aforementioned apparatus, the second feature extraction unit includes:

[0053] The parsing subunit is used to parse the system call topology in the transaction data and determine the set of nodes on the critical path of the transaction.

[0054] The fourth execution subunit is used to compare the actual call path with the node set and calculate the proportion of key nodes in the node set that have not been called, as the topology missing degree.

[0055] The fifth execution subunit is used to perform seasonal decomposition on the transaction volume time series in the transaction data, separating the trend term, seasonal term and residual term;

[0056] The sixth execution subunit is used to calculate the degree of deviation of the residual term from the historical normal residual based on the statistical fluctuation characteristics of the residual term, as the residual abnormality.

[0057] The seventh execution subunit is used to extract the arrival time interval sequence of transaction requests in the transaction data and construct the probability distribution of the arrival time interval sequence;

[0058] The eighth execution subunit is used to perform a similarity test between the current time interval distribution and the historical baseline distribution using a non-parametric test method, and calculate the frequency deviation based on the test statistic.

[0059] A storage medium comprising stored instructions, wherein, when the instructions are executed, the device in which the storage medium resides executes an anomaly detection method for a transaction system as described above.

[0060] An electronic device includes a memory and one or more instructions, wherein one or more instructions are stored in the memory and configured to be executed by one or more processors as described above in the anomaly detection method for a trading system.

[0061] This application provides an anomaly detection method, apparatus, storage medium, and electronic device for a transaction system. The method includes: acquiring log data and transaction data of a target system; extracting features from the log data to obtain a log feature set, the log feature set including temporal deviation, sequence anomaly probability, and semantic anomaly cluster proportion; extracting features from the transaction data to obtain a transaction feature set, the transaction feature set including topological missingness, residual anomaly, and frequency deviation; fusing the log feature set and the transaction feature set to generate a feature matrix; inputting the feature matrix into a preset fusion decision model to calculate an anomaly score for the transaction system; and determining that the transaction system is in an abnormal state if the anomaly score is greater than a preset threshold. Applying the method provided in this application can accurately identify anomalies in a transaction system. Attached Figure Description

[0062] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of this application. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0063] Figure 1 A flowchart of an anomaly detection method for a trading system provided in this application;

[0064] Figure 2 A flowchart of a process for obtaining a log feature set is provided in this application;

[0065] Figure 3 A flowchart of an anomaly detection process for a trading system is provided in this application;

[0066] Figure 4 A schematic diagram of the structure of an anomaly detection device for a trading system provided in this application;

[0067] Figure 5 This is a schematic diagram of the structure of an electronic device provided in this application. Detailed Implementation

[0068] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of this application.

[0069] In this application, the terms "comprising," "including," or any other variations thereof are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0070] This application provides an anomaly detection method for a trading system. This method can be applied to electronic devices, such as personal computers, servers, smartphones, tablets, smart wearable devices, etc. The method flowchart is shown below. Figure 1 As shown, it specifically includes:

[0071] S101: Obtain log data and transaction data from the target system.

[0072] In this embodiment, the target system can be, but is not limited to, a financial transaction system, an e-commerce order system, or an online payment platform, or other business systems requiring high reliability. For example, log data includes error logs, warning logs, and information logs generated during system runtime. These logs record the operating status of system components and abnormal events. Transaction data includes user-initiated transaction request data, such as transaction logs, service call chain information, and transaction volume time-series data. It is easy to understand that log data and transaction data must be collected synchronously to ensure the temporal consistency of subsequent feature extraction.

[0073] S102: Extract features from the log data to obtain a log feature set, which includes time series deviation, sequence anomaly probability, and the proportion of semantic anomaly clusters.

[0074] In this embodiment, feature extraction of log data mainly involves analysis across three dimensions. Specifically, the calculation process for time-series deviation can be described as follows: first, frequency statistics of log errors are performed using a sliding window of a preset duration; then, a dynamic time-series baseline is established based on an exponentially weighted moving average algorithm; finally, the time-series deviation is calculated by comparing the deviation of the current error frequency from the dynamic baseline. The acquisition process for sequence anomaly probability is exemplified as follows: a sequence pattern mining algorithm is used to scan the log event stream, extracting high-frequency event sequences that meet the support threshold; then, the sequence anomaly probability is calculated based on the comparison between the occurrence frequency of the high-frequency event sequences and their historical baseline frequency. The calculation of the proportion of semantically anomalous clusters includes: converting the log text into a vector representation using a semantic vectorization model, performing density clustering on the obtained vectors, identifying outlier semantic clusters based on the clustering results, and calculating the proportion of logs in outlier semantic clusters to the total number of logs.

[0075] S103: Extract features from the transaction data to obtain a transaction feature set, which includes topological missingness, residual abnormality, and frequency deviation.

[0076] In this embodiment, the calculation process for topology missingness can be described as follows: First, the system call topology is parsed to determine the set of necessary nodes on the critical path of the transaction. Then, the actual call path is compared with the set of necessary nodes, and the proportion of critical nodes that were not called is calculated as the topology missingness. The process for obtaining residual abnormality includes, for example, performing seasonal decomposition on the transaction volume time series to separate the trend term, seasonal term, and residual term. Then, based on the statistical fluctuation characteristics of the residual term, its deviation from historical normal residuals is calculated. The calculation of frequency deviation involves: extracting the arrival time interval sequence of transaction requests and constructing its probability distribution. Then, a non-parametric test method is used to perform a similarity test between the current time interval distribution and the historical benchmark distribution, and the frequency deviation is calculated based on the test statistic.

[0077] S104: Merge the log feature set and the transaction feature set to generate a feature matrix.

[0078] In this embodiment, feature values ​​of different dimensions are arranged and combined in a preset order to construct a multi-dimensional feature matrix. For example, the rows of this feature matrix correspond to different detection time points, while the columns correspond to six feature dimensions: temporal deviation, sequence anomaly probability, proportion of semantic anomaly clusters, topological missingness, residual anomaly, and frequency deviation. Specifically, before constructing the feature matrix, the feature values ​​of each dimension can be normalized to eliminate the influence of different feature units.

[0079] S105: Input the feature matrix into the preset fusion decision model to calculate the anomaly score of the trading system.

[0080] In this embodiment, the decision-making process of the fusion decision model includes multiple processing stages. First, a corresponding weight coefficient is loaded for each dimension of the feature matrix from a pre-configured weight rule base. Then, the values ​​of each dimension in the feature matrix are weighted and linearly summed according to the weight coefficients to obtain an initial anomaly score. Next, the initial anomaly score is input to the dynamic calibration module for calibration, combining real-time system load and historical false alarm data. Finally, the calibrated score is matched with multiple judgment thresholds in the dynamic threshold rule base to output the final transaction system anomaly score. It is worth noting that in the weight coefficient configuration, the sequence anomaly probability is usually assigned the highest weight, reflecting the core position of log sequence anomalies in the overall anomaly judgment.

[0081] S106: If the abnormal score is greater than the preset threshold, the transaction system is determined to be in an abnormal state.

[0082] In this embodiment, the preset threshold is set considering both system business characteristics and historical operational data. Specifically, an appropriate percentile can be selected as the judgment threshold based on the distribution of abnormal scores during the system's historical normal operation phases. Furthermore, in practical applications, this threshold can be dynamically adjusted according to business periods; for example, a relatively lenient threshold can be used during peak business periods, while a relatively strict threshold can be used during off-peak periods. When abnormal scores continuously exceed the preset threshold for a set duration, a system alarm mechanism can be triggered to notify maintenance personnel for intervention.

[0083] By applying the method provided in the embodiments of this application, anomalies in the trading system can be accurately identified.

[0084] In one embodiment provided in this application, based on the above implementation process, optionally, feature extraction is performed on the log data to obtain a log feature set, such as... Figure 2 As shown, it includes:

[0085] S201: Use a sliding window of preset duration to count the frequency of log errors in the log data and obtain the frequency statistics results.

[0086] In this embodiment, the sliding window specifically refers to a fixed-duration time interval that can slide forward along the time axis to cover continuous log data. For example, the preset duration can be configured to 5 minutes, meaning that the number of log errors within every 5 minutes will be counted as a data point. In implementation, the step size of the sliding window can be consistent with the window length, or it can be set to a shorter time interval according to the actual detection sensitivity requirements. It is easy to understand that using a sliding window for statistics can effectively avoid interference caused by instantaneous fluctuations, while ensuring the timeliness of the statistical results.

[0087] S202: Based on the exponentially weighted moving average algorithm, historical statistical data are weighted and calculated to establish a dynamic time-series baseline.

[0088] The exponentially weighted moving average (TWMA) algorithm is a commonly used time series smoothing method. Its key feature is that it assigns higher weights to recent data, while the weights of historical data decay exponentially over time. Specifically, the decay factor in the algorithm... This is an important parameter, typically ranging from 0.6 to 0.8. This range has been validated through extensive experimentation, achieving a good balance between maintaining baseline stability and adapting to data changes. In implementation, the process of establishing a dynamic time-series baseline can be described as follows: A weighted average is calculated by combining the frequency statistics of the current window with the baseline value from the previous time point, where the weight of the current data is 1- The weight of the historical baseline is In addition, this baseline establishment method is more robust to sudden anomalies compared to simple moving averages.

[0089] S203: Calculate the temporal deviation of frequency statistics results based on dynamic time-series baseline and preset quantile threshold.

[0090] In this embodiment, the preset quantile threshold specifically refers to the statistical quantile value used for anomaly detection. In an optional implementation, this quantile threshold can be set to the 95th quantile, which means that extreme fluctuations of up to 5% will be ignored, thereby effectively resisting sudden interference. The calculation process of the time series deviation includes, for example, the following steps: first, calculating the absolute difference between the current frequency statistical result and the dynamic time series baseline; then, dividing the difference by a certain metric of the baseline, such as the 95th quantile of the baseline value; and finally, using the resulting ratio as the time series deviation. It is worth noting that using a quantile threshold instead of an average value can significantly improve the robustness of the deviation calculation.

[0091] S204: Scan the log event stream in the log data using a sequence pattern mining algorithm to obtain event sequences that meet the support threshold.

[0092] Specifically, the sequence pattern mining algorithm can employ an improved PrefixSpan algorithm, an optimized version of PrefixSpan, which is highly efficient in processing sequence data such as log event streams. A log event stream is a collection of log events arranged chronologically, with each event containing key information such as event type and timestamp. The support threshold is the minimum frequency required for a sequence to appear in the log event stream; only event sequences with a frequency reaching this threshold are retained. In implementation, the algorithm scanning process can be described as follows: first, identifying all frequent events of length 1; then, gradually expanding to longer event sequences through pattern growth, while pruning candidate sequences that do not meet the support threshold.

[0093] S205: Calculate the probability of sequence anomaly based on the comparison between the occurrence frequency of the event sequence and the historical baseline frequency of the event sequence.

[0094] Optionally, the historical baseline frequency can refer to the statistical value of the occurrence frequency of the corresponding event sequence during normal historical operation. The calculation process for the sequence anomaly probability is exemplified as follows: calculate the actual occurrence frequency of the event sequence within the current time window, compare it with the historical baseline frequency stored in the frequency knowledge base, and finally calculate the anomaly probability based on the relative difference between the two. Specifically, when the occurrence frequency of an event sequence in the current window is significantly lower than its historical baseline, it may indicate that normal business execution processes have been interrupted; this anomaly can be effectively captured using the sequence anomaly probability.

[0095] S206: Convert log text in log data into vector representation through a semantic vectorization model, and perform density clustering on the obtained vectors to obtain clustering results.

[0096] Specifically, the semantic vectorization model can employ a pre-trained language model based on BERT, which can transform the semantic information in log text into a numerical representation in a high-dimensional vector space. In practice, the vector transformation process includes word segmentation of the log text, followed by inputting the resulting data into the BERT model to obtain the corresponding semantic vectors. The density clustering algorithm can specifically employ the DBSCAN algorithm, which can automatically identify cluster structures based on the density distribution of vectors in space, without requiring a pre-specified number of clusters. It is worth noting that compared to traditional K-means clustering, DBSCAN can effectively identify clusters of arbitrary shapes and automatically label noise points.

[0097] S207: Identify outlier semantic clusters based on clustering results, and calculate the proportion of logs in outlier semantic clusters to the total number of logs, as the proportion of semantically abnormal clusters.

[0098] In this embodiment, the criteria for identifying outlier semantic clusters can be determined based on the cluster size and cluster density in the clustering results. For example, clusters containing fewer than a set threshold of log entries can be identified as outlier semantic clusters, or clusters whose distance from other cluster centers exceeds a set threshold can be identified as outlier semantic clusters. The calculation process for the percentage of semantically anomalous clusters specifically includes: first, counting the total number of log entries in all identified outlier semantic clusters, and then dividing this number by the total number of log entries within the current time window to obtain the percentage of semantically anomalous clusters. It is easy to understand that when a system malfunctions, it often generates some semantically anomalous log information. These log entries form outliers in the semantic space, far removed from normal log clusters. By calculating the proportion of these outliers, semantic-level anomalies in the system can be effectively captured.

[0099] In one embodiment provided in this application, based on the above implementation process, optionally, feature extraction is performed on the transaction data to obtain a transaction feature set, including:

[0100] Analyze the system call topology in the transaction data to determine the set of nodes on the critical path of the transaction;

[0101] Compare the actual call path with the node set, and calculate the proportion of key nodes in the node set that were not called, as the topology missing degree;

[0102] Seasonal decomposition is performed on the time series of transaction volume data to separate the trend component, seasonal component, and residual component.

[0103] Based on the statistical fluctuation characteristics of the residual term, its deviation from the historical normal residual is calculated as the residual abnormality.

[0104] Extract the arrival time interval sequence of transaction requests from the transaction data and construct the probability distribution of the arrival time interval sequence;

[0105] A nonparametric test method is used to perform a similarity test between the current time interval distribution and the historical baseline distribution, and the frequency deviation is calculated based on the test statistic.

[0106] In this embodiment, the system call topology specifically refers to the topology diagram reflecting the call relationships between services within the system. This topology diagram can be constructed by parsing distributed link tracing data, where nodes represent individual microservice instances and edges represent the call relationships between services. The critical path of a transaction refers to the service call path that must be traversed to complete a core transaction. For example, for a payment transaction, its critical path may sequentially include order service, risk control service, payment service, and accounting service. In implementation, the process of determining the node set can be described as follows: first, the core transaction type is identified through the business rule engine; then, the necessary service nodes for this transaction type are extracted based on historical call chain data analysis; finally, the set of these service nodes is determined as the node set on the critical path of the transaction.

[0107] Optionally, the actual call path refers to the service call sequence actually collected by the distributed link tracing system. The calculation process for the topology missingness includes, for example, comparing the service nodes in the actual call path with the set of nodes on the critical path, counting the number of service nodes in the node set that were not actually called, and then dividing this number by the total number of nodes in the set of nodes on the critical path to obtain the topology missingness. It is worth noting that when the topology missingness is greater than zero, it indicates that some necessary services on the critical path have not been called. This situation may mean that the transaction execution process has been abnormally interrupted or that key risk control steps have been bypassed.

[0108] Transaction volume time series refers to time series data formed by statistically analyzing the number of transactions or transaction amounts at fixed time intervals. Seasonal decomposition is a time series decomposition technique that can decompose the original series into three components: a trend term, a seasonal term, and a residual term. The trend term reflects the long-term direction of change in the series, the seasonal term reflects the periodic fluctuation pattern of the series, and the residual term represents the random fluctuation component after removing trend and seasonal factors. In implementation, the STL (Seasonal-Trend decomposition using Loess) decomposition algorithm can be used for decomposition processing. This algorithm has strong robustness to outliers. In addition, the period parameter of the seasonal term can be dynamically configured according to business characteristics. For example, financial systems are usually configured with a 24-hour period, while e-commerce systems can be configured with a 7-day period.

[0109] In this embodiment, historical normal residuals refer to the statistical distribution characteristics of residual terms during the system's historical normal operation. The calculation process of residual constant can be described as follows: First, calculate the ratio of the standard deviation of the current residual term to the standard deviation of the historical normal residuals; then, perform a logarithmic transformation on this ratio to enhance numerical stability; finally, map the transformed value to the 0-1 interval using the sigmoid function as the residual constant. For example, a small constant term is also introduced into the denominator during the calculation to prevent division by zero errors. It is easy to understand that when the residual constant is close to 1, it indicates a significant difference between the current trading volume fluctuation pattern and the historical normal pattern, which may be caused by system anomalies or malicious attacks.

[0110] Optionally, the arrival time interval sequence of transaction requests specifically refers to the sequence data formed by the time difference between the arrival times of adjacent transaction requests. In implementation, the extraction process includes parsing the arrival timestamp of each transaction request from the transaction log records, and then calculating the difference between adjacent timestamps to obtain the time interval sequence. The probability distribution can be constructed using a kernel density estimation method, which does not require prior assumptions about the data distribution shape and can adaptively fit a continuous probability density function. Alternatively, a histogram-based statistical method can be used to construct a discrete probability distribution, but the distribution curve obtained by the kernel density estimation method is smoother and less sensitive to outliers.

[0111] One non-parametric test method is the Kolmogorov-Smirnov test, which uses the maximum vertical distance between two empirical distribution functions as the test statistic. The historical baseline distribution refers to the probability distribution of transaction request arrival time intervals during the system's historical normal operation. The calculation process for frequency deviation is exemplified as follows: first, calculate the KS statistic between the current time interval distribution and the historical baseline distribution; then, multiply this statistic by a scaling factor; finally, use a logistic function to convert the scaled value into a frequency deviation within the range of 0-1. It is worth noting that the KS test does not require any assumptions about the data distribution pattern, making it particularly suitable for scenarios where the distribution pattern of transaction request arrival time intervals may change over time.

[0112] In one embodiment provided in this application, based on the above implementation process, optionally, the feature matrix is ​​input into a preset fusion decision model to calculate the anomaly score of the transaction system, including:

[0113] From the pre-configured weight rule library, load the corresponding weight coefficients for each dimension of the feature matrix; based on the weight coefficients, perform a weighted linear summation on the values ​​of each dimension in the feature matrix to obtain the initial anomaly score;

[0114] The initial anomaly score is input into the dynamic calibration module, and calibration is performed by combining the system's real-time load and historical false alarm data.

[0115] The final transaction system anomaly score is output by matching the calibrated score with multiple judgment thresholds in the dynamic threshold rule base.

[0116] Optionally, the weight rule base is actually a configuration library storing the weight values ​​for each feature dimension. These weight coefficients are pre-set based on the analysis of a large number of historical anomaly cases. The applicable weight configuration version can be determined according to the business type of the current trading system, and then the weight coefficient values ​​corresponding to each feature dimension under that version can be queried from the weight rule base. In some embodiments, the log sequence anomaly probability feature is usually assigned the highest weight coefficient, mainly because sequence anomalies often more directly reflect the disorder of the system's operating logic.

[0117] In this embodiment, the value of each feature dimension in the feature matrix can be multiplied by its corresponding weight coefficient, and then all the product results can be summed. Specifically, assuming the feature matrix contains six feature values, the initial anomaly score is calculated as the sum of the six product terms. The advantage of this calculation method is its low computational complexity, which meets the response requirements of real-time anomaly detection. Furthermore, to ensure the uniformity of the dimensions of different feature dimensions during implementation, each feature value is usually normalized before weighted summation, for example, using min-max normalization or z-score standardization.

[0118] The dynamic calibration module can be used to correct the initial anomaly score, specifically adjusting the anomaly score judgment criteria according to changes in the system operating environment. Real-time system load refers to the system's resource usage at the current moment, such as CPU utilization, memory utilization, and network throughput. Historical false alarm data refers to records of cases incorrectly judged as anomalies over a past period. When the system is under high load, the anomaly judgment criteria are appropriately relaxed, and the initial anomaly score is lowered accordingly; conversely, for characteristic patterns that have frequently generated false alarms in the past, the initial anomaly score calculated for the relevant features is appropriately lowered.

[0119] Optionally, the dynamic threshold rule base stores multiple sets of anomaly judgment thresholds, which are dynamically adjusted based on factors such as time period and business type. For example, this rule base may contain multiple threshold configurations for different time periods, such as weekdays and holidays, daytime and nighttime. Applicable judgment threshold sets can be selected from the dynamic threshold rule base based on the current timestamp and business scenario, and the calibrated anomaly score can be compared with these thresholds. It is worth noting that the final anomaly score of the transaction system is not necessarily a specific numerical value, but may also be a discrete level identifier, such as a three-level classification result like "normal," "suspicious," and "abnormal."

[0120] In one embodiment provided in this application, based on the above implementation process, optionally, after determining that the transaction system is in an abnormal state, the method further includes:

[0121] In the system service call topology graph, the status of each service node is colored according to the preset node health index;

[0122] Based on the call dependencies between nodes and the preset propagation rules, the abnormal state is propagated iteratively along the call edge;

[0123] Once the staining state stabilizes, the initial source node of the abnormal propagation is located based on the staining depth and propagation path of the node.

[0124] Associate with the code version control system to obtain the recent code commit records of services related to the source node of the anomaly propagation;

[0125] Perform discrepancy analysis on code commit records to identify critical code changes that are unusual.

[0126] In this embodiment, the system service call topology graph specifically refers to the topology graph that reflects the call relationship between services within the system. This topology graph can be constructed by parsing distributed link tracing data, where nodes represent each microservice instance and edges represent the call relationship between services.

[0127] It should be noted that state coloring is actually a node state marking mechanism, which assigns different color identifiers to nodes based on their health status. Preset node health metrics can include multiple dimensions of measurement parameters, for example, including but not limited to key operational metrics such as service response time, error rate, CPU utilization, and memory usage.

[0128] Optionally, the coloring process can be as follows: calculate a comprehensive health score for each service node, and then assign a corresponding color identifier to the node based on the numerical range of the score, such as green for healthy, yellow for sub-healthy, and red for abnormal. It is worth noting that the threshold for red nodes is configurable, and this threshold configuration directly affects the sensitivity of root cause localization.

[0129] In this embodiment, the call dependency relationship specifically refers to the call direction and call intensity information between service nodes obtained by analyzing the system call topology graph. The propagation rules are a set of logical conditions defining how abnormal states propagate in the call graph; these rules can be summarized based on historical abnormal propagation patterns.

[0130] In this embodiment, starting from a node already marked as abnormal, potentially affected neighboring nodes are determined based on the direction of the calling edge. Then, the probability of abnormal state propagation is calculated by combining the weight coefficient of the calling edge. When this probability exceeds a preset threshold, the neighboring node is marked as abnormal. This propagation process continues iteratively until no new nodes are marked as abnormal. Furthermore, the propagation rules also consider the impact of call type; for example, synchronous and asynchronous calls have significantly different abnormal propagation mechanisms.

[0131] Optionally, stable coloring refers to the state where, after several rounds of iterative propagation, no new node states change in the system. Coloring depth specifically refers to the number of propagation rounds a node has gone through before being marked as an abnormal state; this number reflects the node's position in the abnormal propagation chain. The propagation path refers to the complete path from the source node, along the call relationships, to each node sequentially. In this embodiment, the coloring depth of all abnormal nodes can be counted, then the nodes with the highest coloring depth can be identified. Combined with reverse tracing of the abnormal propagation path, the source node that first triggered the abnormal state can be determined. It's easy to understand that this source node is likely the root cause of the system abnormality.

[0132] Specifically, a code version control system refers to a tool system used to manage source code versions, such as Git and SVN. Recent code commit records refer to all modification operations performed on the source code repository within a certain time frame. This time frame can be flexibly configured according to actual needs, such as being set to the last 24 hours or the last week. Specifically, the process involves first parsing the service identifier corresponding to the anomaly propagation source node, and then querying the code version control system for the corresponding code repository based on the service identifier, extracting all commit records for that repository within the specified time window. It should be noted that the commit records should include key information such as commit time, commit author, list of changed files, and code differences.

[0133] Optionally, difference analysis refers to identifying code modifications that may introduce problems by comparing the code before and after the change. Critical code changes refer to code modifications that are strongly correlated with abnormal system behavior; these modifications may involve core business logic or key algorithm implementations.

[0134] Specifically, code differences in commit logs can be analyzed to identify all modified lines of code and their modification types. Then, a comprehensive analysis is performed, considering factors such as the timing of the exception and the functional importance of the modified code. Finally, the most likely critical code changes to cause system anomalies are identified. For example, code changes committed shortly before an anomaly, involving modifications to core business logic, and not adequately tested, often have a high suspicion of causing anomalies. This analysis provides clear technical guidance for subsequent problem remediation.

[0135] See Figure 3 The flowchart provided in this application illustrates an anomaly detection process for a trading system, including the following steps:

[0136] Step 1: Modeling log patterns.

[0137] In this stage, the system establishes a complete log behavior characteristic model by performing multi-dimensional analysis of log data.

[0138] The time-series baseline algorithm uses a sliding window mechanism to frequency-based log errors. Statistics, including sliding window The default duration is 5 minutes. The dynamic baseline is calculated using an exponentially weighted moving average method.

[0139]

[0140] in, , which is the historical data decay factor; This represents the 95th percentile.

[0141] This method balances the influence of historical and current data by introducing a historical data attenuation factor. In practice, the 95th percentile is used instead of the traditional mean to calculate the deviation, significantly enhancing the baseline's resilience to sudden disturbances. The deviation calculation process is as follows:

[0142]

[0143] In this embodiment, the sequence pattern mining uses an improved PrefixSpan algorithm to extract high-frequency event sequences:

[0144]

[0145] Sequence anomaly probability:

[0146]

[0147] Deviation metric:

[0148]

[0149] Semantic clustering models are based on BERT's semantic vectorization:

[0150]

[0151] Abnormal semantic cluster identification (DBSCAN clustering):

[0152]

[0153] In this embodiment, the improved algorithm can quickly identify frequent patterns in log event streams by optimizing sequence mining efficiency. The calculation of sequence anomaly probability is based on a comparative analysis of the current sequence occurrence frequency and the historical baseline frequency, and the degree of anomaly in sequence behavior is assessed through deviation quantification.

[0154] The semantic clustering model uses the BERT architecture to semantically vectorize log text. This model converts log text into a high-dimensional vector representation, preserving rich semantic information. Anomaly semantic cluster identification employs the DBSCAN density clustering algorithm, which automatically identifies log clusters with anomalous semantic features and calculates the proportion of semantically anomalous clusters based on the ratio of logs within each cluster.

[0155] Step 2: Transaction feature extraction.

[0156] In this embodiment, the set of critical path nodes for topology integrity detection Completeness score:

[0157]

[0158] Anomaly value:

[0159]

[0160] STL decomposition of trading volume sequence with magnitude fluctuation characteristics :

[0161]

[0162] Residual abnormality coefficient:

[0163]

[0164] Frequency distribution test Kolmogorov-Smirnov statistic:

[0165]

[0166] Anomaly value:

[0167]

[0168] In this embodiment, multi-dimensional feature mining can be performed on transaction data to construct a complete transaction behavior feature system.

[0169] Topology integrity testing analyzes the system call topology to determine the set of necessary nodes on the critical path of a transaction. The integrity score is obtained by calculating the matching degree between the actual call path and the critical path; the corresponding topology missing value is derived from the integrity score.

[0170] The magnitude fluctuation characteristic analysis employs the STL decomposition algorithm to decompose the trading volume sequence. This algorithm decomposes the trading volume sequence into three components: a trend term, a seasonal term, and a residual term. The period of the seasonal term can be dynamically configured; the default configuration for financial systems is 24 hours, and for e-commerce systems, it is 7 days. In the calculation of the residual abnormality coefficient, a minimal constant term is introduced into the denominator to effectively prevent division by zero errors.

[0171] The frequency distribution test employs the Kolmogorov-Smirnov nonparametric test method, which quantifies the degree of anomaly in the frequency distribution of transaction requests by calculating the statistics of the current distribution and the historical baseline distribution. Based on these statistics, the frequency distribution anomaly value is further calculated to complete a comprehensive characterization of the transaction frequency features.

[0172] Step 3: Integrate decision-making models to make decisions.

[0173] In this embodiment, as shown in Table 1, the multi-dimensional feature matrix provided in this application embodiment is as follows:

[0174] Table 1

[0175] dimension symbol weight coefficient log timing deviation degree log sequence anomaly semantic anomaly cluster proportion transaction topology loss magnitude residual anomaly frequency distribution deviation

[0176] In this embodiment, the fusion decision formula is:

[0177]

[0178] The code representation of the threshold rule library is as follows:

[0179] if RiskScore > 0.7:

[0180] if ΔL_seq > 0.6 and ΔT_vol > 0.5:

[0181] return "Business logic error", root cause = code change tracking (ΔL_sem)

[0182] elif ΔT_topo > 0.3 and ΔL_time < 0.2:

[0183] return "Service dependency interrupted", root cause = topology coloring(S_topo)

[0184] In this embodiment, a multi-dimensional feature matrix is ​​constructed to organically integrate log features and transaction features. The feature matrix specifically includes six dimensions: log time-series deviation, log sequence anomalies, percentage of semantic anomaly clusters, transaction topology missing, magnitude residual anomalies, and frequency distribution deviation.

[0185] The fusion decision formula uses a weighted linear summation method to comprehensively evaluate features across various dimensions. Regarding weighting coefficients, log sequence anomalies are assigned the highest weight, reflecting their central role in overall anomaly detection; frequency distribution deviations are assigned the lowest weight, taking into account that frequency anomalies are easily affected by normal business fluctuations.

[0186] The threshold rule base stores multiple sets of anomaly detection thresholds, which are dynamically adjusted according to business scenarios and time periods to ensure the accuracy and adaptability of anomaly detection.

[0187] Step 4: Root cause identification.

[0188] In this embodiment, the root cause localization technique is as follows:

[0189] Topological staining algorithm defines infection propagation rules:

[0190]

[0191] Code change tracking is based on version control correlation analysis:

[0192]

[0193] The topology coloring algorithm defines the rules for the propagation of abnormal states. The algorithm first colors service nodes according to their health indicators, with the threshold for red nodes being dynamically configurable. The propagation of abnormal states depends on the edge weights of the call graph, and an iterative propagation mechanism spreads the abnormal state along the call chain.

[0194] Code change tracing is based on correlation analysis using a version control system. Once the source node of the anomaly propagation is located, the system automatically associates it with the code repository, obtains the recent code commit records of the relevant services, and identifies key code changes that may have caused the anomaly through difference analysis.

[0195] In this embodiment, comprehensive detection of system anomalies is achieved through parallel processing of log and transaction data. The adaptive update mechanism of the dynamic baseline algorithm effectively distinguishes between normal business fluctuations and genuine anomalies, significantly reducing the false alarm rate. The improved sequence pattern mining algorithm enhances the extraction efficiency of high-frequency event sequences, while BERT-based semantic clustering enhances the understanding of semantic anomalies.

[0196] In terms of feature fusion, a weighting scheme highlights the importance of core features, while dynamic adjustment of the threshold rule base ensures the adaptability of the detection system under different business scenarios. Root cause localization technology achieves full-link coverage from anomaly detection to root cause analysis through the organic combination of topology coloring and code change tracing.

[0197] It is worth noting that the configuration of each technical parameter in this solution has undergone extensive experimental verification, ensuring detection accuracy while providing sufficient flexibility to adapt to different business needs. This is especially true for the core parameters of the dynamic baseline algorithm. The key parameters, such as the range of values, the period configuration of STL decomposition, and the weight allocation of fusion decision, have all demonstrated good technical results in practical applications.

[0198] and Figure 1 Corresponding to the method described above, this application also provides an anomaly detection device for a transaction system, applied to a data processing node in a blockchain, specifically for detecting... Figure 1 The specific implementation of the method is shown in the following structural diagram. Figure 4 As shown, it includes:

[0199] Acquisition unit 401 is used to acquire log data and transaction data of the target system;

[0200] The first feature extraction unit 402 is used to extract features from the log data to obtain a log feature set, the log feature set including time series deviation, sequence anomaly probability and semantic anomaly cluster ratio.

[0201] The second feature extraction unit 403 is used to extract features from the transaction data to obtain a transaction feature set, which includes topological missing degree, residual abnormality degree and frequency deviation degree.

[0202] The fusion unit 404 is used to fuse the log feature set and the transaction feature set to generate a feature matrix;

[0203] The calculation unit 405 is used to input the feature matrix into a preset fusion decision model to calculate the anomaly score of the transaction system;

[0204] The determining unit 406 is used to determine that the transaction system is in an abnormal state when the abnormal score is greater than a preset threshold.

[0205] In one embodiment provided in this application, based on the above implementation process, optionally, the first feature extraction unit includes:

[0206] The statistics subunit is used to perform frequency statistics on log errors in the log data using a sliding window of preset duration, and obtain frequency statistics results.

[0207] The first execution subunit is used to perform weighted calculations on historical statistical data based on the exponentially weighted moving average algorithm to establish a dynamic time-series baseline.

[0208] The calculation subunit is used to calculate the temporal deviation of the frequency statistics results based on the dynamic temporal baseline and the preset quantile threshold.

[0209] The scanning subunit is used to scan the log event stream in the log data using a sequence pattern mining algorithm to obtain event sequences that meet the support threshold.

[0210] The second execution subunit is used to calculate the probability of sequence anomaly based on a comparison between the occurrence frequency of the event sequence and the historical reference frequency of the event sequence.

[0211] The clustering subunit is used to convert the log text in the log data into a vector representation through a semantic vectorization model, and to perform density clustering on the obtained vectors to obtain the clustering results.

[0212] The third execution subunit is used to identify outlier semantic clusters based on the clustering results and calculate the proportion of logs in the outlier semantic clusters to the total number of logs, as the proportion of semantically abnormal clusters.

[0213] In one embodiment provided in this application, based on the above implementation process, optionally, the second feature extraction unit includes:

[0214] The parsing subunit is used to parse the system call topology in the transaction data and determine the set of nodes on the critical path of the transaction.

[0215] The fourth execution subunit is used to compare the actual call path with the node set and calculate the proportion of key nodes in the node set that have not been called, as the topology missing degree.

[0216] The fifth execution subunit is used to perform seasonal decomposition on the transaction volume time series in the transaction data, separating the trend term, seasonal term and residual term;

[0217] The sixth execution subunit is used to calculate the degree of deviation of the residual term from the historical normal residual based on the statistical fluctuation characteristics of the residual term, as the residual abnormality.

[0218] The seventh execution subunit is used to extract the arrival time interval sequence of transaction requests in the transaction data and construct the probability distribution of the arrival time interval sequence;

[0219] The eighth execution subunit is used to perform a similarity test between the current time interval distribution and the historical benchmark distribution using a non-parametric test method, and calculate the frequency deviation based on the test statistic. The specific principles and execution processes of each unit and module in the anomaly detection device of the trading system disclosed in the above embodiments of this application are the same as those in the anomaly detection method of the trading system disclosed in the above embodiments of this application. Please refer to the corresponding parts of the anomaly detection method of the trading system provided in the above embodiments of this application; further details will not be repeated here.

[0220] This application also provides a storage medium, which includes stored instructions, wherein the device where the storage medium is located is controlled to execute the above-mentioned anomaly detection method of the transaction system when the instructions are executed.

[0221] This application also provides an electronic device, the structural schematic diagram of which is shown below. Figure 5 As shown, it specifically includes a memory 501 and one or more instructions 502, wherein one or more instructions 502 are stored in the memory 501 and are configured to be executed by one or more processors 503 to perform the above-mentioned abnormal detection method of the transaction system.

[0222] It is understood that before using the technical solutions disclosed in the various embodiments of the present invention, users should be informed of the types, scope of use, and usage scenarios of the personal information involved in the present invention and their authorization should be obtained in accordance with relevant laws and regulations through appropriate means.

[0223] For example, upon receiving a user's active request, a prompt message is sent to the user to explicitly inform them that the requested operation will require the acquisition and use of the user's personal information. This allows the user to independently choose whether to provide personal information to the software or hardware, such as the electronic device, application program, server, or storage medium executing the operation of this invention, based on the prompt message.

[0224] As an optional but non-limiting implementation, in response to a user's active request, sending a prompt message to the user can be done via a pop-up window, where the prompt message can be presented in text format. Furthermore, the pop-up window can also include a selection control allowing the user to choose "agree" or "disagree" to provide personal information to the electronic device.

[0225] It is understood that the above notification and user authorization process is merely illustrative and does not constitute a limitation on the implementation of the present invention. Other methods that comply with relevant laws and regulations may also be applied to the implementation of the present invention.

[0226] It is understood that the data involved in this technical solution (including but not limited to the data itself, the acquisition or use of the data) shall comply with the requirements of relevant laws, regulations and related provisions.

[0227] It should be noted that the various embodiments in this specification are described in a progressive manner, with each embodiment focusing on the differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For apparatus embodiments, since they are basically similar to method embodiments, the description is relatively simple; relevant parts can be referred to the descriptions in the method embodiments.

[0228] Finally, it should be noted that in this paper, relational terms such as first and second are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations.

[0229] For ease of description, the above devices are described separately by function as various units. Of course, in implementing this application, the functions of each unit can be implemented in one or more software and / or hardware.

[0230] As can be seen from the above description of the embodiments, those skilled in the art can clearly understand that this application can be implemented by means of software plus necessary general-purpose hardware platforms. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in various embodiments or some parts of the embodiments of this application.

[0231] The above provides a detailed description of an anomaly detection method for a trading system provided by this application. Specific examples have been used to illustrate the principles and implementation methods of this application. The descriptions of the above embodiments are only for the purpose of helping to understand the method and core ideas of this application. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of this application. Therefore, the content of this specification should not be construed as a limitation of this application.

Claims

1. An anomaly detection method for a trading system, characterized in that, include: Obtain log data and transaction data from the target system; The log data is subjected to feature extraction to obtain a log feature set, which includes time series deviation, sequence anomaly probability, and the proportion of semantic anomaly clusters. Feature extraction is performed on the transaction data to obtain a transaction feature set, which includes topological missingness, residual abnormality, and frequency deviation. The log feature set and the transaction feature set are fused to generate a feature matrix; The feature matrix is ​​input into a preset fusion decision model to calculate the anomaly score of the transaction system; If the abnormal score is greater than a preset threshold, the transaction system is determined to be in an abnormal state.

2. The method according to claim 1, characterized in that, The step of extracting features from the log data to obtain a log feature set includes: The frequency of log errors in the log data is statistically analyzed using a sliding window of preset duration to obtain the frequency statistics results; Based on the exponentially weighted moving average algorithm, historical statistical data are weighted and calculated to establish a dynamic time-series baseline; Based on the dynamic time-series baseline and the preset quantile threshold, the time-series deviation of the frequency statistics results is calculated; The log event stream in the log data is scanned using a sequence pattern mining algorithm to obtain event sequences that meet the support threshold. The probability of sequence anomaly is calculated by comparing the occurrence frequency of the event sequence with the historical baseline frequency of the event sequence. The log text in the log data is converted into a vector representation using a semantic vectorization model, and density clustering is performed on the resulting vectors to obtain the clustering results. Based on the clustering results, outlier semantic clusters are identified, and the proportion of logs in the outlier semantic clusters to the total number of logs is calculated as the proportion of semantically abnormal clusters.

3. The method according to claim 1, characterized in that, The step of extracting features from the transaction data to obtain a transaction feature set includes: Analyze the system call topology in the transaction data to determine the set of nodes on the critical path of the transaction; Compare the actual call path with the node set, and calculate the proportion of key nodes in the node set that were not called, as the topology missing degree; Seasonal decomposition is performed on the time series of transaction volume in the transaction data to separate the trend term, seasonal term and residual term; Based on the statistical fluctuation characteristics of the residual term, its deviation from the historical normal residual is calculated as the residual abnormality. Extract the arrival time interval sequence of transaction requests from the transaction data, and construct the probability distribution of the arrival time interval sequence; A nonparametric test method is used to perform a similarity test between the current time interval distribution and the historical baseline distribution, and the frequency deviation is calculated based on the test statistic.

4. The method according to claim 1, characterized in that, The step of inputting the feature matrix into a preset fusion decision model to calculate the anomaly score of the transaction system includes: From the pre-configured weight rule library, load the corresponding weight coefficients for each dimension of the feature matrix; based on the weight coefficients, perform a weighted linear summation on the values ​​of each dimension in the feature matrix to obtain the initial anomaly score; The initial anomaly score is input into the dynamic calibration module, and calibration is performed by combining the system's real-time load and historical false alarm data. The final transaction system anomaly score is output by matching the calibrated score with multiple judgment thresholds in the dynamic threshold rule base.

5. The method according to claim 1, characterized in that, After determining that the transaction system is in an abnormal state, the process also includes: In the system service call topology graph, the status of each service node is colored according to the preset node health index; Based on the call dependencies between nodes and the preset propagation rules, the abnormal state is propagated iteratively along the call edge; Once the staining state stabilizes, the initial source node of the abnormal propagation is located based on the staining depth and propagation path of the node. Associate the code version control system and obtain the recent code commit records of the services related to the source node of the anomaly propagation; Perform a difference analysis on the code commit records to identify critical code changes that are unusual.

6. An anomaly detection device for a trading system, characterized in that, include: The acquisition unit is used to acquire log data and transaction data from the target system. The first feature extraction unit is used to extract features from the log data to obtain a log feature set, which includes time series deviation, sequence anomaly probability, and the proportion of semantic anomaly clusters. The second feature extraction unit is used to extract features from the transaction data to obtain a transaction feature set, which includes topological missingness, residual abnormality and frequency deviation. The fusion unit is used to fuse the log feature set and the transaction feature set to generate a feature matrix; The calculation unit is used to input the feature matrix into a preset fusion decision model to calculate the anomaly score of the transaction system; The determining unit is used to determine that the transaction system is in an abnormal state when the abnormal score is greater than a preset threshold.

7. The apparatus according to claim 6, characterized in that, The first feature extraction unit includes: The statistics subunit is used to perform frequency statistics on log errors in the log data using a sliding window of preset duration, and obtain frequency statistics results. The first execution subunit is used to perform weighted calculations on historical statistical data based on the exponentially weighted moving average algorithm to establish a dynamic time-series baseline. The calculation subunit is used to calculate the temporal deviation of the frequency statistics results based on the dynamic temporal baseline and the preset quantile threshold. The scanning subunit is used to scan the log event stream in the log data using a sequence pattern mining algorithm to obtain event sequences that meet the support threshold. The second execution subunit is used to calculate the probability of sequence anomaly based on a comparison between the occurrence frequency of the event sequence and the historical reference frequency of the event sequence. The clustering subunit is used to convert the log text in the log data into a vector representation through a semantic vectorization model, and to perform density clustering on the obtained vectors to obtain the clustering results. The third execution subunit is used to identify outlier semantic clusters based on the clustering results and calculate the proportion of logs in the outlier semantic clusters to the total number of logs, as the proportion of semantically abnormal clusters.

8. The apparatus according to claim 6, characterized in that, The second feature extraction unit includes: The parsing subunit is used to parse the system call topology in the transaction data and determine the set of nodes on the critical path of the transaction. The fourth execution subunit is used to compare the actual call path with the node set and calculate the proportion of key nodes in the node set that have not been called, as the topology missing degree. The fifth execution subunit is used to perform seasonal decomposition on the transaction volume time series in the transaction data, separating the trend term, seasonal term and residual term; The sixth execution subunit is used to calculate the degree of deviation of the residual term from the historical normal residual based on the statistical fluctuation characteristics of the residual term, as the residual abnormality. The seventh execution subunit is used to extract the arrival time interval sequence of transaction requests in the transaction data and construct the probability distribution of the arrival time interval sequence; The eighth execution subunit is used to perform a similarity test between the current time interval distribution and the historical benchmark distribution using a non-parametric test method, and calculate the frequency deviation based on the test statistic.

9. A storage medium, characterized in that, The storage medium includes stored instructions, wherein, when the instructions are executed, the device containing the storage medium is controlled to perform the anomaly detection method of the transaction system as described in any one of claims 1 to 5.

10. An electronic device, characterized in that, It includes a memory, and one or more instructions, wherein one or more instructions are stored in the memory and configured to be executed by one or more processors using the anomaly detection method of the trading system as described in any one of claims 1 to 5.

Images