Abnormal attribution method and device, electronic equipment and storage medium

Abstract

The invention provides an exception attribution method and device, electronic equipment and a storage medium, and the method comprises the steps: obtaining various types of variable information of a target user, comparing the various types of variable information of the target user with corresponding variable thresholds, obtaining a target exception variable, and when the target exception variable is a variable of other exception types, executing the exception attribution on the target exception variable. And further attributing the target abnormal variables until the target abnormal variables which accord with the number of the target variables and contain interpretable labels are obtained. By applying the embodiment of the invention, attribution can be carried out aiming at various abnormal types, the attribution flexibility and coverage rate are improved, and under the condition that the target abnormal variable obtained by comparison is the variable of other abnormal types, the root cause causing the abnormal target user can be determined through recursive abnormal positioning, so that the attribution accuracy is improved, and the user experience is improved. And the interpretable label is arranged, so that the interpretability of the attribution result is higher, and the attribution quality is improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of attribution, in particular to an abnormal attribution method and device, an electronic device and a storage medium. BACKGROUND

[0002] In credit risk control, intelligent decision-making and other scenarios, attribution analysis of model prediction results is a core requirement to meet regulatory compliance and optimize business strategies, that is, to clarify the contribution logic of variables to the prediction results (such as overdue risk, fraud determination), and to provide an interpretable support for decision-making.

[0003] Existing attribution methods rely on complex algorithms (such as SHAP, LIME), which not only require high modeling knowledge reserves for business personnel, have high understanding thresholds, and are limited by data integrity, variable types (such as high-dimensional embedded features), etc. In actual application, the coverage of various business scenarios and variable types is low, and it is difficult to adapt to large-scale and diversified risk control decision-making needs, and there is an urgent need for a low-threshold and high-coverage attribution solution. SUMMARY

[0004] Therefore, the embodiments of the present application provide an abnormal attribution method, device, electronic device and storage medium to improve the attribution accuracy.

[0005] According to an aspect of the present application, an abnormal attribution method is provided, which comprises: Based on a target abnormal type, target user information to be analyzed is obtained, wherein the target user information comprises target user main model information and sub-model information, wherein the main model information comprises first preset variable information corresponding to the target abnormal type, and the sub-model information comprises second preset variable information corresponding to other types in each abnormal type except the target abnormal type; The target user information is compared with each variable threshold corresponding to the target abnormal type to determine a target abnormal variable in the target user information; In the case where the target abnormal variable belongs to the second preset variable information, the abnormal type corresponding to the target abnormal variable is taken as the target abnormal type, and the step of obtaining the target user information to be analyzed based on the target abnormal type is returned until the target abnormal variable obtained meets the target variable quantity, and the target abnormal variable contains an interpretable label; Based on each target abnormal variable, an abnormal reason of a target user is determined.

[0006] In a possible embodiment, the target user information comprises a target continuous variable and a target discrete variable, and the method further comprises: The target continuous variable is subjected to binning processing to obtain a binning result; calculating a WOE value of the binning result as a variable value of the target continuous variable; The comparing the target user information with the variable threshold corresponding to the target abnormal type comprises: The comparing the variable value of the target continuous variable and the original code of the target discrete variable with the variable threshold corresponding to the target abnormal type.

[0007] In a possible embodiment, the variable threshold corresponding to each abnormal type is determined in advance by the following steps: determining a preset number of variables strongly related to the abnormal type in a variable pool as a feature candidate set corresponding to the abnormal type; determining a plurality of quantiles of the variables contained in the feature candidate set in each user layer according to a preset user layering as the variable threshold corresponding to the abnormal type.

[0008] In a possible embodiment, the determining a preset number of variables strongly related to the abnormal type in a variable pool as a feature candidate set corresponding to the abnormal type comprises: calculating the information value and the coverage of each variable in the variable pool based on the abnormal type; screening each variable in the variable pool based on a preset information value threshold and a preset coverage threshold to obtain each candidate variable; determining a preset number of candidate variables with the highest importance as the feature candidate set corresponding to the abnormal type, wherein the importance is determined based on an XGB tree model.

[0009] In a possible embodiment, the comparing the target user information with the variable threshold corresponding to the target abnormal type to determine the target abnormal variable in the target user information comprises: counting a plurality of quantiles of each target variable contained in the target user information; comparing the plurality of quantiles of each target variable with the variable threshold corresponding to the target abnormal type to determine the target variable corresponding to the quantile exceeding a preset quantile threshold as a target abnormal variable.

[0010] In a possible embodiment, the user layering comprises a high-risk user and a low-risk user, and the comparing the plurality of quantiles of each target variable with the variable threshold corresponding to the target abnormal type to determine the target variable corresponding to the quantile exceeding a preset quantile threshold comprises: comparing the plurality of quantiles of each target variable with the variable threshold corresponding to different user layers of the target abnormal type; If the high percentage quantile of the target variable exceeds the high percentage quantile of the corresponding variable of the low-risk user, the target variable is determined to be a target outlier variable.

[0011] According to another aspect of the present invention, an anomaly attribution device is provided, the device comprising: The acquisition module is used to acquire target user information to be analyzed based on the target anomaly type. The target user information includes target user main model information and sub-model information. The main model information includes first preset variable information corresponding to the target anomaly type, and the sub-model information includes second preset variable information corresponding to other types of anomalies besides the target anomaly type. The comparison module is used to compare the target user information with the threshold values ​​of each variable corresponding to the target anomaly type to determine the target anomaly variable in the target user information; The recursive module is used to, when the target abnormal variable belongs to the second preset variable information, take the abnormal type corresponding to the target abnormal variable as the target abnormal type, and return to the step of obtaining the target user information to be analyzed based on the target abnormal type, until the obtained target abnormal variable meets the target variable quantity and the target abnormal variable contains an interpretable label. The attribution module is used to determine the cause of the anomaly of the target user based on each of the target anomaly variables.

[0012] In one possible embodiment, the target user information includes target continuous variables and target discrete variables, and the device further includes: A linear processing module is used to perform binning on the target continuous variable to obtain binning results; Calculate the WOE value of the binning results and use it as the variable value of the target continuous variable; The step of comparing the target user information with the threshold values ​​of each variable corresponding to the target anomaly type includes: The variable values ​​of the target continuous variable and the original codes of the target discrete variable are compared with the threshold values ​​of each variable corresponding to the target anomaly type. The threshold values ​​for each variable corresponding to each anomaly type are predetermined through the following steps: A predetermined number of variables that are strongly correlated with the anomaly type are identified in the variable pool as the feature candidate set corresponding to the anomaly type; According to the preset user stratification, multiple quantiles of the variables contained in the feature candidate set in each user stratification are determined as thresholds for each variable corresponding to the anomaly type; The step of determining a preset number of variables strongly correlated with the anomaly type in the variable pool as the feature candidate set corresponding to the anomaly type includes: Calculate the information value and coverage of each variable in the variable pool based on the anomaly type; Based on a preset information value threshold and a preset coverage threshold, each variable in the variable pool is filtered to obtain each candidate variable; A preset number of candidate variables with the highest importance are determined to form a feature candidate set corresponding to the anomaly type, wherein the importance is determined based on the XGB tree model; The step of comparing the target user information with the threshold values ​​of each variable corresponding to the target anomaly type to determine the target anomaly variable in the target user information includes: Statistically determine the multiple quantiles of each target variable contained in the target user information; The multiple quantiles of each target variable are compared with the threshold values ​​of each variable corresponding to the target anomaly type, and the target variable corresponding to the quantile that exceeds the preset quantile threshold is determined as the target anomaly variable. The user segmentation includes high-risk users and low-risk users. The step of comparing multiple quantiles of each target variable with threshold values ​​corresponding to each variable of the target anomaly type to determine the target variable corresponding to quantiles exceeding preset quantile thresholds includes: Compare the multiple quantiles of each target variable with the threshold values ​​of each variable for different user strata corresponding to the target anomaly type; If the high percentage quantile of the target variable exceeds the high percentage quantile of the corresponding variable of the low-risk user, the target variable is determined to be a target outlier variable.

[0013] According to another aspect of the present invention, an electronic device is provided, comprising: Processor; and Stored program memory, The program includes instructions that, when executed by the processor, cause the processor to perform any of the above-described exception attribution methods.

[0014] According to another aspect of the present invention, a non-transitory computer-readable storage medium storing computer instructions is provided, wherein the computer instructions are configured to cause a computer to perform any of the above-described anomaly attribution methods.

[0015] The embodiments of this invention provide one or more technical solutions that acquire multiple variable information of a target user and compare this information with corresponding variable thresholds to obtain target anomalous variables. If the target anomalous variable is a variable of another anomalous type, further attribution is performed until a target anomalous variable that meets the required number of target variables and contains interpretable labels is obtained. By applying these embodiments, attribution can be performed for multiple anomaly types, improving attribution flexibility and coverage. If the target anomalous variable obtained through comparison is a variable of another anomalous type, the root cause of the target user's anomaly can be determined through recursive anomaly localization, improving attribution accuracy. Furthermore, setting interpretable labels enhances the interpretability of the attribution results, improving attribution quality. Attached Figure Description

[0016] Further details, features, and advantages of the invention are disclosed in the following description of exemplary embodiments in conjunction with the accompanying drawings, in which: Figure 1 A flowchart illustrating the anomaly attribution method provided by the present invention; Figure 2 A flowchart illustrating a feature candidate set for determining anomaly types in the anomaly attribution method provided by the present invention; Figure 3 A schematic diagram of the attribution device provided by the present invention; Figure 4 A structural block diagram of an exemplary electronic device that can be used to implement embodiments of the present invention is shown. Detailed Implementation

[0017] Embodiments of the present invention will now be described in more detail with reference to the accompanying drawings. While some embodiments of the invention are shown in the drawings, it should be understood that the invention can be implemented in various forms and should not be construed as limited to the embodiments set forth herein. Rather, these embodiments are provided to provide a more thorough and complete understanding of the invention. It should be understood that the accompanying drawings and embodiments are for illustrative purposes only and are not intended to limit the scope of protection of the invention.

[0018] It should be understood that the various steps described in the method embodiments of the present invention may be performed in different orders and / or in parallel. Furthermore, the method embodiments may include additional steps and / or omit the steps shown. The scope of the present invention is not limited in this respect.

[0019] The term "comprising" and its variations as used herein are open-ended, meaning "including but not limited to". The term "based on" means "at least partially based on". The term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one additional embodiment"; the term "some embodiments" means "at least some embodiments". Definitions of other terms will be given in the following description. It should be noted that the concepts of "first", "second", etc., mentioned in this invention are used only to distinguish different devices, modules, or units, and are not intended to limit the order of functions performed by these devices, modules, or units or their interdependencies.

[0020] It should be noted that the terms "a" and "a plurality of" used in this invention are illustrative rather than restrictive. Those skilled in the art should understand that, unless otherwise expressly indicated in the context, they should be understood as "one or more".

[0021] The names of the messages or information exchanged between the multiple devices in the embodiments of the present invention are for illustrative purposes only and are not intended to limit the scope of these messages or information.

[0022] Existing model attribution methods mainly include: Feature importance attribution: such as SHAP values ​​(SHapley Additive ex Planations, a game theory-based machine learning model interpretability method used to quantify the contribution of each feature to the model's prediction results) and the built-in importance of tree models, which rely on mathematical quantification but lack business interpretation. Local sample interpretation: visualizing the contribution of single-sample features (such as force-directed graphs), but struggling to support group analysis. Deep learning attribution: gradient integral or attention mechanisms, highly specialized and disconnected from risk control logic; Hybrid attribution: combining business rules for group interpretation, but rule extraction is complex and has low coverage.

[0023] These methods have the following problems: High comprehension threshold: They rely on mathematical terminology, making them difficult for business personnel to apply directly; Weak quantitative support: The attribution conclusions lack data verification such as distribution statistics; Poor business adaptability: They are not combined with risk control layering logic, and the explanation is disconnected from the decision-making process.

[0024] Based on this, the present invention provides an anomaly attribution method, apparatus, electronic device, and storage medium. The anomaly attribution method provided by the present invention can be applied to any electronic device with attribution function, such as a server, computer, or mobile terminal. The following describes the solution of the present invention with reference to the accompanying drawings: Figure 1 A flowchart illustrating the anomaly attribution method provided by the present invention may include the following steps: S101. Based on the target anomaly type, obtain the target user information to be analyzed, wherein the target user information includes target user main model information and sub-model information, wherein the main model information includes first preset variable information corresponding to the target anomaly type, and the sub-model information includes second preset variable information corresponding to other types among the anomaly types besides the target anomaly type; S102. Compare the target user information with the threshold values ​​of each variable corresponding to the target anomaly type to determine the target anomaly variable in the target user information; S103. If the target abnormal variable belongs to the second preset variable information, take the abnormal type corresponding to the target abnormal variable as the target abnormal type, and return to the step of obtaining the target user information to be analyzed based on the target abnormal type, until the obtained target abnormal variable meets the target variable quantity, and the target abnormal variable contains an interpretable label. S104. Determine the cause of the target user's anomaly based on each of the aforementioned target anomaly variables.

[0025] In this embodiment of the invention, multiple variable information of the target user is obtained, and this information is compared with corresponding variable thresholds to identify target anomalous variables. If the target anomalous variable is another type of anomalous variable, further attribution is performed until a target anomalous variable that meets the required number of target variables and contains interpretable labels is obtained. Applying this embodiment of the invention allows for attribution to multiple anomaly types, improving attribution flexibility and coverage. When the identified target anomalous variable is another type of anomalous variable, recursive anomaly localization can determine the root cause of the target user's anomaly, improving attribution accuracy. Furthermore, setting interpretable labels enhances the interpretability of the attribution results, improving attribution quality.

[0026] The following provides an exemplary description of S101-S104: The anomaly attribution method provided by this invention can be applied to any APP that needs to perform attribution, such as video APP, credit APP, etc. The following uses a credit APP as an example to illustrate the anomaly attribution method provided by this invention.

[0027] In this invention, the target user typically refers to an abnormal user, which can be a user deemed high-risk, such as someone whose credit application has been rejected or whose credit limit increase application has been rejected. The reason why an abnormal user is deemed high-risk is the corresponding abnormal type. For example, if a user is judged to have a high risk of overdue payments and their application is rejected, then the abnormal type corresponding to the abnormal user is overdue payments. If a user is judged to be a fraudulent user and their credit application is rejected, then the abnormal type corresponding to the abnormal user is fraud.

[0028] In one possible embodiment, user attribution can begin immediately upon detecting an abnormal user. Accordingly, in step S101, user variable information can be obtained according to the abnormal user's corresponding abnormality type. In other possible embodiments, batch attribution can be performed periodically for different abnormality types. For example, batch attribution can be performed for overdue abnormal users, and the variable information of the corresponding users can be obtained according to the users included in the abnormality type.

[0029] The target user information obtained according to the target anomaly type can contain various variables. These variables can include main model variables and sub-model variables. The main model refers to the judgment model used for the target anomaly type, while the sub-models are the models used for other anomaly types. This model can be a neural network model, a large model, etc. Main model variables are those used by the main model in anomaly identification, such as age, gender, and target user behavior. Sub-model variables can be the user judgment results output by the sub-models. For example, if the main model is an overdue payment judgment model, sub-model variables could include the target user's income score, fraud score, etc.

[0030] The variables corresponding to the target anomaly type and their corresponding thresholds can be preset. In one possible embodiment, the variables and their corresponding thresholds for each anomaly type can be determined by following these steps: S121. Determine a preset number of variables in the variable pool that are strongly correlated with the anomaly type as the feature candidate set corresponding to the anomaly type; S122. Determine multiple quantiles of variables included in the feature candidate set in each user segment according to the preset user segmentation, and use them as thresholds for each variable corresponding to the anomaly type.

[0031] Different variables contribute differently to the identification of different anomaly types. For example, variables such as user occupation and income contribute significantly to the identification of overdue payments, while user identity information contributes significantly to the identification of fraud. Therefore, the variable type corresponding to the anomaly type can be determined based on the contribution of variables to the anomaly type.

[0032] In one possible embodiment, such as Figure 2 As shown, the feature candidate set corresponding to each anomaly type can be determined by following these steps: S1211. Calculate the information value and coverage of each variable in the variable pool based on the anomaly type; S1212. Based on a preset information value threshold and a preset coverage threshold, each variable in the variable pool is filtered to obtain each candidate variable; S1213. Determine a preset number of candidate variables with the highest importance to form a feature candidate set corresponding to the anomaly type, wherein the importance is determined based on the XGB tree model.

[0033] As one possible implementation, the information value and coverage of each variable in the variable pool for each anomaly type can be calculated. The information value measures the variable's explanatory power for the target anomaly type, while the coverage measures the variable's completeness. To ensure variable reliability, information value thresholds and coverage thresholds can be set; for example, variables with IV > 0.1 and coverage > 90% can be selected as candidate variables for anomaly types.

[0034] To control the amount of data that needs to be processed during model recognition, the number of variables corresponding to each anomaly type can be preset. This preset number can be set to a uniform value for each anomaly type, or different values ​​can be set for each anomaly type model. This invention does not impose specific limitations on this. For example, the number of variables can be set to ≤100.

[0035] In practical applications, the number of variables that meet the information value threshold and coverage threshold may exceed the preset number of variables set for each anomaly type. Therefore, candidate variables can be further filtered. As one possible implementation, a preset number of variables with the highest importance can be determined as the variables corresponding to each anomaly type.

[0036] The importance of a variable can specifically be its input importance, which can be obtained through a tree model, such as XGBoost or LightGBM. The core of calculating the importance of a tree model is the variable's contribution to the decision tree split; the more a variable reduces the impurity of a node, the higher its importance. As one possible implementation, a binary classification model can be trained separately for each anomaly type using a tree model. The feature importance output by the model directly reflects the variable's contribution to that anomaly type.

[0037] In one possible implementation, interpretable labels can be assigned to each variable. These labels identify the logic by which the variable influences the prediction result, and whether it can be understood and explained by humans using common sense, causal relationships, or explicit rules. To ensure that highly interpretable variables are selected as candidate anomaly types, variables with interpretable labels can be prioritized as feature candidates for anomaly types during the variable selection process. For example, if the importance difference between two variables is less than a preset difference threshold, but one variable contains an interpretable label while the other does not, and only one variable can enter the feature candidate set, the variable with the interpretable label can be selected. The interpretable labels for variables can be configured differently for different anomaly types.

[0038] The variables corresponding to anomaly types can include both continuous and discrete variables. Since the correlation between continuous variables and the prediction results corresponding to anomaly types may not be monotonically positive, for example, the relationship between delinquency risk and user age is not monotonically increasing or decreasing. Instead, delinquency risk decreases as the user ages, but increases after a certain age threshold. To transform this non-linear relationship between variables and prediction results into a linear one, the feature candidate sets for each anomaly type can be further transformed.

[0039] In one possible implementation, continuous variables can be binned, and the WOE (Weight of Evidence) value of the binning results can be calculated as the variable value of the continuous variable. Binning refers to dividing the continuous variable, such as according to the variable's value range or according to the sample size, resulting in multiple binning results. WOE is used to measure the discriminative power of binning on the prediction results, and can be calculated as bin i WOE using the following formula. i : WOE i =

[0040] The WOE value of a bin can be used as the variable value within that bin. For discrete variables, their original codes can be retained as the corresponding variable values; for example, for a gender variable, the value for male is 0, and the value for female is 1.

[0041] Through the above steps, both continuous and discrete variables can be converted into variable values ​​that are linearly correlated with the prediction results of the anomaly type. Then, threshold values ​​for each variable of the anomaly type can be calculated based on these variable values. In one possible embodiment, users can be pre-stratified, for example, according to their risk probability, dividing them into low-risk users (top 30% of application approval rate), medium-risk users, and high-risk users (bottom 30% of application approval rate). For each user stratification, various quantiles of different variables can be calculated, such as P10, P50, and P90, as corresponding variable thresholds for subsequent judgment.

[0042] In one possible embodiment, the difference in quantile distribution between high-risk users and all users can also be visualized to enhance the interpretability of quantile thresholds, lower the understanding threshold, and thus improve attribution convenience.

[0043] In S101, the obtained user information may include target continuous variables and target discrete variables. Therefore, the linear transformation method used when calculating variable thresholds can be used to perform linear transformation on the target user information. Specifically, the above method may also include: S1011. Perform binning on the target continuous variable to obtain the binning result; S1012. Calculate the WOE value of the binning result and use it as the variable value of the target continuous variable; The step of comparing the target user information with the threshold values ​​of each variable corresponding to the target anomaly type includes: The values ​​of the target continuous variable and the original codes of the target discrete variable are compared with the threshold values ​​of each variable corresponding to the target anomaly type.

[0044] Specifically, multiple quantiles of each target variable contained in the target user information can be counted; and the multiple quantiles of each target variable can be compared with the threshold values ​​of each variable corresponding to the target anomaly type to determine the target variable corresponding to the quantile that exceeds the preset quantile threshold, which is then used as the target anomaly variable.

[0045] User segmentation can include high-risk users and low-risk users. Therefore, multiple quantiles of each target variable can be compared with the threshold values ​​of each variable in different user segments corresponding to the target anomaly type. If the high-proportional quantile of the target variable exceeds the high-proportional quantile of the corresponding variable for the low-risk user, the target variable is determined to be a target anomaly variable. The aforementioned high-proportional quantile can be P90, P80, etc.

[0046] In one possible embodiment, the top 10 most important features can be extracted in batches from the feature candidate set corresponding to the target anomaly type, and the sample values ​​can be compared with multiple quantiles of the customer group. Features exceeding the P90 / P10 threshold are marked as anomalous variables. If the target anomalous variable contains second preset variable information, the anomaly type corresponding to the target anomalous variable is taken as the target anomaly type, and the step of obtaining the target user information to be analyzed based on the target anomaly type is returned until the obtained target anomalous variables meet the target variable quantity and the target anomalous variables contain interpretable labels.

[0047] For example, if the anomalous variable is a sub-model (such as "repayment ability score"), its underlying features can be recursively analyzed until 3-5 significant anomalous variables are accumulated and the business can interpret them. If the target anomalous variable is a main model variable, it can be directly used as one of the attribution results.

[0048] Based on each target anomaly variable, the corresponding cause can be determined to generate target attribution results. Each target anomaly variable contains a corresponding cause. A significantly abnormal credit card usage rate corresponds to excessive credit card use, and an abnormal debt-to-income ratio corresponds to high debt, etc. For example, explaining "the reason for user rejection" → it is found that "debt-to-income ratio" is located at the rejection layer P95. Recursively analyzing its sub-subject "credit card usage rate" is also abnormal → it is attributed to "high debt and excessive credit card use".

[0049] By applying the embodiments of this invention, key variables are screened based on risk control objectives (such as overdue risk), and risk correlation is visualized through linear transformations such as WOE; the differences in variable distribution are analyzed in conjunction with the risk control business layering logic (such as pass / reject customer groups) to locate abnormal characteristics; and quantifiable and easy-to-understand attribution conclusions are generated through top-down recursive analysis of sub-model characteristics.

[0050] Based on the same inventive concept, according to another aspect of the present invention, an anomaly attribution device is provided, such as... Figure 3 As shown, the device 300 may include: The acquisition module 301 is used to acquire target user information to be analyzed based on the target anomaly type. The target user information includes target user main model information and sub-model information. The main model information includes first preset variable information corresponding to the target anomaly type, and the sub-model information includes second preset variable information corresponding to other types of anomalies besides the target anomaly type. The comparison module 302 is used to compare the target user information with the threshold values ​​of each variable corresponding to the target anomaly type to determine the target anomaly variable in the target user information; The recursive module 303 is used to, when the target abnormal variable belongs to the second preset variable information, take the abnormal type corresponding to the target abnormal variable as the target abnormal type, and return the step of obtaining the target user information to be analyzed based on the target abnormal type, until the obtained target abnormal variable meets the target variable quantity, and the target abnormal variable contains an interpretable label. Attribution module 304 is used to determine the cause of the anomaly of the target user based on each of the target anomaly variables.

[0051] In one possible embodiment, the target user information includes target continuous variables and target discrete variables, and the device further includes: A linear processing module is used to perform binning on the target continuous variable to obtain binning results; Calculate the WOE value of the binning results and use it as the variable value of the target continuous variable; The step of comparing the target user information with the threshold values ​​of each variable corresponding to the target anomaly type includes: The variable values ​​of the target continuous variable and the original codes of the target discrete variable are compared with the threshold values ​​of each variable corresponding to the target anomaly type. The threshold values ​​for each variable corresponding to each anomaly type are predetermined through the following steps: A predetermined number of variables that are strongly correlated with the anomaly type are identified in the variable pool as the feature candidate set corresponding to the anomaly type; According to the preset user stratification, multiple quantiles of the variables contained in the feature candidate set in each user stratification are determined as thresholds for each variable corresponding to the anomaly type; The step of determining a preset number of variables strongly correlated with the anomaly type in the variable pool as the feature candidate set corresponding to the anomaly type includes: Calculate the information value and coverage of each variable in the variable pool based on the anomaly type; Based on a preset information value threshold and a preset coverage threshold, each variable in the variable pool is filtered to obtain each candidate variable; A preset number of candidate variables with the highest importance are determined to form a feature candidate set corresponding to the anomaly type, wherein the importance is determined based on the XGB tree model; The step of comparing the target user information with the threshold values ​​of each variable corresponding to the target anomaly type to determine the target anomaly variable in the target user information includes: Statistically determine the multiple quantiles of each target variable contained in the target user information; The multiple quantiles of each target variable are compared with the threshold values ​​of each variable corresponding to the target anomaly type, and the target variable corresponding to the quantile that exceeds the preset quantile threshold is determined as the target anomaly variable. The user segmentation includes high-risk users and low-risk users. The step of comparing multiple quantiles of each target variable with threshold values ​​corresponding to each variable of the target anomaly type to determine the target variable corresponding to quantiles exceeding preset quantile thresholds includes: Compare the multiple quantiles of each target variable with the threshold values ​​of each variable for different user strata corresponding to the target anomaly type; If the high percentage quantile of the target variable exceeds the high percentage quantile of the corresponding variable of the low-risk user, the target variable is determined to be a target outlier variable.

[0052] The collection, storage, use, processing, transmission, provision, and disclosure of user personal information involved in this invention comply with relevant laws and regulations and do not violate public order and good morals.

[0053] An exemplary embodiment of the present invention also provides an electronic device, including: at least one processor; and a memory communicatively connected to the at least one processor. The memory stores a computer program executable by the at least one processor, the computer program being executed by the at least one processor to cause the electronic device to perform a method according to an embodiment of the present invention.

[0054] An exemplary embodiment of the present invention also provides a non-transitory computer-readable storage medium storing a computer program, wherein the computer program, when executed by a computer's processor, is used to cause the computer to perform a method according to an embodiment of the present invention.

[0055] An exemplary embodiment of the present invention also provides a computer program product, including a computer program, wherein, when executed by a computer's processor, the computer program is used to cause the computer to perform a method according to an embodiment of the present invention.

[0056] refer to Figure 4 The present invention will now be described in the form of a structural block diagram of an electronic device 400 that can serve as a server or client of the present invention, which is an example of a hardware device that can be applied to various aspects of the present invention. The electronic device is intended to represent various forms of digital electronic computer devices, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the invention described and / or claimed herein.

[0057] like Figure 4 As shown, the electronic device 400 includes a computing unit 401, which can perform various appropriate actions and processes according to a computer program stored in a read-only memory (ROM) 402 or a computer program loaded from a storage unit 408 into a random access memory (RAM) 403. The RAM 403 may also store various programs and data required for the operation of the electronic device 400. The computing unit 401, ROM 402, and RAM 403 are interconnected via a bus 404. An input / output (I / O) interface 405 is also connected to the bus 404.

[0058] Multiple components in electronic device 400 are connected to I / O interface 405, including: input unit 406, output unit 407, storage unit 408, and communication unit 409. Input unit 406 can be any type of device capable of inputting information to electronic device 400. Input unit 406 can receive input digital or character information and generate key signal inputs related to user settings and / or function control of electronic device. Output unit 407 can be any type of device capable of presenting information and may include, but is not limited to, a display, speaker, video / audio output terminal, vibrator, and / or printer. Storage unit 408 may include, but is not limited to, disks and optical discs. Communication unit 409 allows electronic device 400 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks, and may include, but is not limited to, modems, network cards, infrared communication devices, wireless communication transceivers, and / or chipsets, such as Bluetooth™ devices, WiFi devices, WiMax devices, cellular communication devices, and / or the like.

[0059] The computing unit 401 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of the computing unit 401 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. The computing unit 401 performs the various methods and processes described above. For example, in some embodiments, any of the above-described anomaly attribution methods can be implemented as a computer software program tangibly contained in a machine-readable medium, such as storage unit 408. In some embodiments, part or all of the computer program can be loaded and / or installed on the electronic device 400 via ROM 402 and / or communication unit 409. In some embodiments, the computing unit 401 can be configured to perform any of the above-described anomaly attribution methods by any other suitable means (e.g., by means of firmware).

[0060] The program code used to implement the methods of the present invention can be written in any combination of one or more programming languages. This program code can be provided to a processor or controller of a general-purpose computer, special-purpose computer, or other programmable data processing device, such that when executed by the processor or controller, the program code causes the functions / operations specified in the flowcharts and / or block diagrams to be implemented. The program code can be executed entirely on the machine, partially on the machine, as a standalone software package partially on the machine and partially on a remote machine, or entirely on a remote machine or server.

[0061] In the context of this invention, a machine-readable medium can be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, apparatus, or device. A machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. Machine-readable media can include, but are not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination of the foregoing. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0062] As used herein, the terms "machine-readable medium" and "computer-readable medium" refer to any computer program product, device, and / or apparatus (e.g., disk, optical disk, memory, programmable logic device (PLD)) for providing machine instructions and / or data to a programmable processor, including machine-readable media that receive machine instructions as machine-readable signals. The term "machine-readable signal" refers to any signal for providing machine instructions and / or data to a programmable processor.

[0063] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device for displaying information to the user (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor); and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the computer. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0064] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as a data server), or computing systems that include middleware components (e.g., an application server), or computing systems that include frontend components (e.g., a user computer with a graphical user interface or web browser through which a user can interact with implementations of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., a communication network). Examples of communication networks include local area networks (LANs), wide area networks (WANs), and the Internet.

[0065] Computer systems can include clients and servers. Clients and servers are generally located far apart and typically interact through communication networks. Client-server relationships are created by computer programs running on the respective computers and having a client-server relationship with each other.

Claims

1. An anomaly attribution method, characterized in that, The method includes: Based on the target anomaly type, obtain the target user information to be analyzed, wherein the target user information includes target user main model information and sub-model information, wherein the main model information includes first preset variable information corresponding to the target anomaly type, and the sub-model information includes second preset variable information corresponding to other types among the anomaly types besides the target anomaly type; The target user information is compared with the threshold values ​​of each variable corresponding to the target anomaly type to determine the target anomaly variable in the target user information; If the target abnormal variable belongs to the second preset variable information, the abnormal type corresponding to the target abnormal variable is taken as the target abnormal type, and the step of obtaining the target user information to be analyzed based on the target abnormal type is returned until the obtained target abnormal variable meets the target variable quantity and the target abnormal variable contains an interpretable label. The cause of the anomaly for the target user is determined based on each of the aforementioned target anomaly variables.

2. The method according to claim 1, characterized in that, The target user information includes target continuous variables and target discrete variables, and the method further includes: The target continuous variable is binned to obtain the binning results; Calculate the WOE value of the binning results and use it as the variable value of the target continuous variable; The step of comparing the target user information with the threshold values ​​of each variable corresponding to the target anomaly type includes: The values ​​of the target continuous variable and the original codes of the target discrete variable are compared with the threshold values ​​of each variable corresponding to the target anomaly type.

3. The method according to claim 1, characterized in that, The threshold values ​​for each variable corresponding to each anomaly type are predetermined through the following steps: A predetermined number of variables that are strongly correlated with the anomaly type are identified in the variable pool as the feature candidate set corresponding to the anomaly type; According to the preset user stratification, multiple quantiles of the variables included in the feature candidate set in each user stratification are determined as thresholds for each variable corresponding to the anomaly type.

4. The method according to claim 3, characterized in that, The step of determining a preset number of variables strongly correlated with the anomaly type in the variable pool as the feature candidate set corresponding to the anomaly type includes: Calculate the information value and coverage of each variable in the variable pool based on the anomaly type; Based on a preset information value threshold and a preset coverage threshold, each variable in the variable pool is filtered to obtain each candidate variable; A preset number of candidate variables with the highest importance are determined to form a feature candidate set corresponding to the anomaly type, wherein the importance is determined based on the XGB tree model.

5. The method according to claim 4, characterized in that, The step of comparing the target user information with the threshold values ​​of each variable corresponding to the target anomaly type to determine the target anomaly variable in the target user information includes: Statistically determine the multiple quantiles of each target variable contained in the target user information; The multiple quantiles of each target variable are compared with the threshold values ​​of each variable corresponding to the target anomaly type. The target variable corresponding to the quantile that exceeds the preset quantile threshold is determined as the target anomaly variable.

6. The method according to claim 5, characterized in that, The user segmentation includes high-risk users and low-risk users. The step of comparing multiple quantiles of each target variable with threshold values ​​corresponding to each variable of the target anomaly type to determine the target variable corresponding to quantiles exceeding preset quantile thresholds includes: The multiple quantiles of each target variable are compared with the threshold values ​​of each variable for different user strata corresponding to the target anomaly type; If the high percentage quantile of the target variable exceeds the high percentage quantile of the corresponding variable of the low-risk user, the target variable is determined to be a target outlier variable.

7. An anomaly attribution device, characterized in that, The device includes: The acquisition module is used to acquire target user information to be analyzed based on the target anomaly type. The target user information includes target user main model information and sub-model information. The main model information includes first preset variable information corresponding to the target anomaly type, and the sub-model information includes second preset variable information corresponding to other types of anomalies besides the target anomaly type. The comparison module is used to compare the target user information with the threshold values ​​of each variable corresponding to the target anomaly type to determine the target anomaly variable in the target user information; The recursive module is used to, when the target abnormal variable belongs to the second preset variable information, take the abnormal type corresponding to the target abnormal variable as the target abnormal type, and return to the step of obtaining the target user information to be analyzed based on the target abnormal type, until the obtained target abnormal variable meets the target variable quantity and the target abnormal variable contains an interpretable label. The attribution module is used to determine the cause of the anomaly of the target user based on each of the target anomaly variables.

8. The apparatus according to claim 7, characterized in that, The target user information includes target continuous variables and target discrete variables, and the device further includes: A linear processing module is used to perform binning on the target continuous variable to obtain binning results; Calculate the WOE value of the binning results and use it as the variable value of the target continuous variable; The step of comparing the target user information with the threshold values ​​of each variable corresponding to the target anomaly type includes: The variable values ​​of the target continuous variable and the original codes of the target discrete variable are compared with the threshold values ​​of each variable corresponding to the target anomaly type. The threshold values ​​for each variable corresponding to each anomaly type are predetermined through the following steps: A predetermined number of variables that are strongly correlated with the anomaly type are identified in the variable pool as the feature candidate set corresponding to the anomaly type; According to the preset user stratification, multiple quantiles of the variables contained in the feature candidate set in each user stratification are determined as thresholds for each variable corresponding to the anomaly type; The step of determining a preset number of variables strongly correlated with the anomaly type in the variable pool as the feature candidate set corresponding to the anomaly type includes: Calculate the information value and coverage of each variable in the variable pool based on the anomaly type; Based on a preset information value threshold and a preset coverage threshold, each variable in the variable pool is filtered to obtain each candidate variable; A preset number of candidate variables with the highest importance are determined to form a feature candidate set corresponding to the anomaly type, wherein the importance is determined based on the XGB tree model; The step of comparing the target user information with the threshold values ​​of each variable corresponding to the target anomaly type to determine the target anomaly variable in the target user information includes: Statistically determine the multiple quantiles of each target variable contained in the target user information; The multiple quantiles of each target variable are compared with the threshold values ​​of each variable corresponding to the target anomaly type, and the target variable corresponding to the quantile that exceeds the preset quantile threshold is determined as the target anomaly variable. The user segmentation includes high-risk users and low-risk users. The step of comparing multiple quantiles of each target variable with threshold values ​​corresponding to each variable of the target anomaly type to determine the target variable corresponding to quantiles exceeding preset quantile thresholds includes: The multiple quantiles of each target variable are compared with the threshold values ​​of each variable for different user strata corresponding to the target anomaly type; If the high percentage quantile of the target variable exceeds the high percentage quantile of the corresponding variable of the low-risk user, the target variable is determined to be a target outlier variable.

9. An electronic device, comprising: processor; as well as Stored program memory, The program includes instructions that, when executed by the processor, cause the processor to perform the method according to any one of claims 1-6.

10. A non-transitory computer-readable storage medium storing computer instructions, wherein, The computer instructions are used to cause the computer to perform the method according to any one of claims 1-6.

Images