Transaction link abnormity monitoring method and system
By combining the frequency and time differences of nodes in the transaction type, the monitoring significance and consistency are obtained, which solves the problem of transaction link anomalies being masked in the existing technology and realizes accurate monitoring of transaction link anomalies.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2026-03-03
- Publication Date
- 2026-03-31
AI Technical Summary
Existing technologies for monitoring transaction link anomalies based on a single node dimension and a strategy of equal weighting of nodes cannot identify the sensitivity of nodes under different transaction types or the differences in information contained in node sequences at different scales, thus masking transaction link anomalies.
By combining the frequency of node occurrences and time differences in different transaction types, the monitoring significance is obtained, and the transaction consistency at different scales is integrated to achieve anomaly monitoring of the transaction chain.
It enables accurate monitoring of transaction link anomalies for different transaction types, and can adapt to different transaction types by identifying anomalies in local link structures through multi-scale analysis.
Smart Images
Figure CN121771065A_ABST
Abstract
Description
Technical Field
[0001] This application relates to the field of data processing technology, and in particular to a method and system for monitoring anomalies in a transaction chain. Background Technology
[0002] The rapid development of mobile internet and fintech means that a single transaction often requires the collaborative effort of dozens of microservices and third-party systems, including gateways, authentication, risk control, transaction core, accounts, accounting, channels, clearing, and notifications, forming a complex distributed transaction chain. Existing technologies mainly use methods such as Span time consumption, HTTP status codes, and dynamic p99 thresholds to detect slow links, faulty links, and topology anomalies.
[0003] Existing technologies for monitoring transaction link anomalies based on a single node dimension and a strategy of equal weighting of nodes cannot identify the sensitivity of nodes under different transaction types or the differences in information contained in node sequences at different scales, thus masking transaction link anomalies. Summary of the Invention
[0004] To address the problem that transaction link anomaly monitoring based on single-node dimensions and node weighting strategies cannot identify the sensitivity of nodes under different transaction types and the information differences contained in node sequences at different scales, which can mask transaction link anomalies, this application provides a transaction link anomaly monitoring method and system. By combining the differences in the frequency of occurrence and time consumption of nodes in different transaction types to obtain the monitoring significance and integrating the transaction consistency at different scales to obtain the degree of anomaly in the transaction link, the method achieves accurate monitoring of transaction link anomalies for different transaction types.
[0005] Firstly, this application provides a method for monitoring anomalies in a transaction chain, employing the following technical solution: A method for detecting anomalies in a transaction chain, comprising the following steps: The abnormality level of the transaction link of the transaction process to be monitored is obtained based on the transaction information of the transaction process. The abnormality level of the transaction link of the transaction process to be monitored is normalized. When the normalized abnormality level of the transaction link is greater than the preset value, the abnormal nodes are manually checked and located node by node. Transaction information includes: transaction type, node sequence, time sequence, and log vector of multiple historical transaction processes and the transaction process to be monitored; node sequence is obtained from the transaction nodes of the transaction process, time sequence is obtained from the transaction node time, and log vector is obtained from the transaction node log file; Method for obtaining the degree of anomaly in the transaction chain of the transaction process to be monitored: Based on the transaction type of the transaction process to be monitored, the historical transaction processes are divided into sets of the same type and sets of different types. The monitoring significance of the nodes is obtained based on the frequency difference and time difference of the nodes of the transaction process to be monitored in the sets of the same type and sets of different types. Different scales are selected to divide the node sequence and time-consuming sequence of the transaction process to be monitored into node subsequences and time-consuming subsequences. The differences between the node subsequences and time-consuming subsequences and the historical transaction process are calculated to obtain the transaction consistency degree at each scale. Calculate the standard deviation of the average monitoring significance of all nodes at any scale, and take the mean of the product of the standard deviations at all scales and the corresponding normalized transaction consistency as the transaction link anomaly degree of the transaction process to be monitored.
[0006] Furthermore, the method of obtaining the monitoring significance of nodes based on the frequency and time differences of nodes appearing in the same type set and different type set of the transaction process to be monitored includes: Select any node in the node sequence of the transaction process to be monitored as the target node, and calculate the first generality of the target node within the same type set and the second generality of the target node within the different type set; Calculate the first time sensitivity of the target node in any historical transaction process containing the target node within the same type set, and the second time sensitivity of the target node in any historical transaction process containing the target node within the different type set; The frequency difference of the target node is obtained based on the first generality and the second generality; the time difference of the target node is obtained based on the first time sensitivity and the second time sensitivity. Similarly, the monitoring significance of all nodes within the node sequence of the transaction process to be monitored is obtained.
[0007] Furthermore, the first generality is represented by the ratio of the number of historical transaction processes containing the target node within the same type set to the total number of historical transaction processes within the same type set; The second generality is represented by the ratio of the number of historical transaction processes containing the target node in the heterogeneous set to the total number of historical transaction processes in the heterogeneous set.
[0008] Furthermore, the first time consumption sensitivity is represented by the sum of squares of the differences in time consumption between the target node and other nodes in any historical transaction process containing the target node within the same type set; The second time-consuming sensitivity is represented by the sum of squares of the time-consuming differences between the target node and other nodes in any historical transaction process within the heterogeneous set containing the target node.
[0009] Furthermore, the step of selecting different scales to divide the node sequence and time-consuming sequence of the transaction process to be monitored into node subsequences and time-consuming subsequences includes: selecting a length as the target scale for the node sequence of the transaction process to be monitored and performing sliding division of the node sequence to obtain multiple node subsequences; similarly, the time-consuming sequence is divided to obtain multiple time-consuming subsequences.
[0010] Furthermore, obtaining the degree of transaction consistency at each scale by comparing the computation node subsequence and the time-consuming subsequence with the historical transaction process includes: selecting any scale as the target scale; The degree of transaction consistency at the target scale is obtained by measuring the monitoring significance of all nodes in any subsequence of nodes included in the target scale, and the overlap, first similarity, and second similarity of nodes between the transaction process to be monitored and any historical transaction process in the same type set in any subsequence of nodes included in the target scale. Similarly, the degree of transaction consistency at other scales can be obtained.
[0011] Furthermore, any node subsequence is selected as the target node subsequence, and the target time-consuming subsequence corresponding to the target node subsequence is the target time-consuming subsequence; The node overlap is represented by the Jaccard coefficient between the target node subsequence of the transaction process to be monitored and the target node subsequence of any historical transaction process. The first similarity is represented by calculating the absolute value of the cosine similarity between the target time-consuming subsequence of the transaction process to be monitored and any historical transaction process; The second similarity is represented by the sum of the absolute values of the cosine similarity between the log vectors of the target node subsequence of the transaction process to be monitored and any historical transaction process.
[0012] Secondly, this application provides a transaction link anomaly monitoring system, which adopts the following technical solution: A transaction link anomaly monitoring system includes a processor and a memory, wherein the memory stores computer program instructions, and when the computer program instructions are executed by the processor, a transaction link anomaly monitoring method as described above is implemented.
[0013] This application has the following technical advantages: This application can obtain the monitoring significance of nodes under each transaction type by the frequency difference of target nodes in different transaction types and the time sensitivity of target nodes, and can adapt to the accurate monitoring of transaction link anomalies for different transaction types; This application can analyze different local link structures by dividing the node sequence at different scales, and accurately monitor multi-scale anomalies in the transaction link based on the dual-dimensional verification of node time consumption and log files under the local link structure. Attached Figure Description
[0014] The above and other objects, features, and advantages of the present invention will become readily apparent from the following detailed description of exemplary embodiments, accompanied by the accompanying drawings. In the drawings, several embodiments of the invention are illustrated by way of example and not limitation, and like or corresponding reference numerals denote like or corresponding parts, wherein: Figure 1 This is a flowchart of a transaction link anomaly monitoring method provided in an embodiment of this application; Figure 2 This is a flowchart of a method for obtaining the degree of anomaly in the transaction link of a transaction process to be monitored, provided in an embodiment of this application. Detailed Implementation
[0015] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.
[0016] This application discloses a method for monitoring anomalies in a transaction chain, referring to... Figure 1 ,include: S1: Collect transaction information from multiple historical transaction processes and transaction processes to be monitored.
[0017] The transaction information includes the transaction type, node sequence, time sequence, and log vector of multiple historical transaction processes and the transaction process to be monitored; the node sequence is obtained from the transaction nodes of the transaction process, the time sequence is obtained from the transaction node time, and the log vector is obtained from the transaction node log file.
[0018] Specifically, the transaction type and transaction nodes and node duration in the transaction chain are collected by the transaction system. The nodes are one-hot encoded to obtain the node sequence. The duration sequence is obtained based on the node duration. The log files of each node in the transaction chain are collected by the transaction system and the log files are one-hot encoded to obtain the log vector.
[0019] Specifically, the elements contained in the node sequence are the one-hot encoded values of each transaction node in the transaction chain. An exemplary data acquisition in this embodiment is as follows: for one transaction process, the transaction chain of the process has a total of 10 nodes, resulting in a node sequence of length 10, a time consumption sequence of length 10, and 10 log vectors.
[0020] S2: Obtain the degree of anomaly in the transaction link of the transaction process to be monitored based on the transaction information of the transaction process.
[0021] Specifically, in anomaly monitoring of the transaction chain, due to the diversity of transaction types, the nodes in the transaction chain vary significantly, and the complex interaction instructions between nodes result in different execution times and varying importance to the chain for each node. For example, the credit payment limit deduction node only exists in loan transactions such as Alipay and JD Pay Later, while the installment payment processing node only exists in installment payment transactions. Existing technologies directly determine the abnormal state of the transaction chain by whether the total time of all nodes exceeds a threshold or whether the log files are identical, ignoring the relative differences in the time of different nodes and the monitoring significance in different transaction types. This fails to identify timeout anomalies in sensitive nodes, thus masking actual chain anomalies.
[0022] Reference Figure 2 Methods for obtaining the degree of anomaly in the transaction chain of the transaction process to be monitored include: S201: Obtain the monitoring significance of the node.
[0023] It is important to note that in anomaly monitoring of the transaction chain, due to the diversity of transaction types, the nodes in the transaction chain vary significantly. Furthermore, the complex interaction instructions between nodes result in varying execution times and importance to the chain for each node. For example, credit limit deduction nodes only exist in loan transactions such as Alipay and JD Pay Later, while installment payment processing nodes only exist in installment payment transactions. This embodiment analyzes the degree of specialization of a node to a specific transaction type based on the difference in the frequency of the target node's occurrence in sets of similar and dissimilar transaction processes. Combined with the time differences between the target node and other nodes in different transaction processes, the monitoring significance of the target node is determined.
[0024] Specifically, any node in the node sequence of the transaction process to be monitored is selected as the target node. Based on the transaction type, all historical transaction processes are divided into two sets: a set of similar types and a set of dissimilar types. The ratio of the number of historical transaction processes containing the target node in the set of similar types to the total number of historical transaction processes in the set of similar types is calculated as the first generality of the target node. The ratio of the number of historical transaction processes containing the target node in the set of dissimilar types to the total number of historical transaction processes in the set of dissimilar types is calculated as the second generality of the target node. For any historical transaction process containing the target node in the set of similar types, the sum of the squares of the time differences between the target node and other nodes in that historical transaction process is calculated as the first time sensitivity of the target node in that historical transaction process. For any historical transaction process containing the target node in the set of dissimilar types, the sum of the squares of the time differences between the target node and other nodes in that historical transaction process is calculated as the second time sensitivity of the target node in that historical transaction process.
[0025] Specifically, the expression for calculating the significance level is as follows: in, Indicates the monitoring significance of the target node. Indicates the first degree of generality of the target node. This represents the second degree of generality of the target node. This represents the average first time sensitivity of all historical transaction processes containing the target node within the same type of set. This represents the average second time-sensitivity of all historical transaction processes containing the target node within the heterogeneous set.
[0026] Specifically, the first generality measures the frequency of occurrence of target nodes within the same transaction type, while the second generality measures the frequency of occurrence of target nodes within different transaction types. When the first generality is greater than the second generality, it indicates that the target node is more specific to that transaction type; when it is less, it indicates that the target node belongs to other transaction types. The first and second time-consuming sensitivity measures the difference between the time consumption of the target node and that of other nodes. The greater the time-consuming difference, the easier it is for the time consumption changes of this node to be smoothed out by the time consumption changes of other nodes, and the more attention should be paid to the time consumption changes of this node.
[0027] S202: Obtain the degree of transaction consistency at different scales.
[0028] It is important to note that in anomaly monitoring of the transaction chain, due to the complexity of interactions between instructions and transaction nodes, different node combinations may produce similar execution times when executing the same instruction or different instructions within the same node combination. For example, WeChat Pay node combinations may have similar execution times when executing H5 payments or QR code payments. This makes it difficult to identify anomalies in a single execution time or log file within a complex chain. Existing technologies analyze transaction chain anomalies only through differences in log files or node execution times on a single dimension, ignoring the differences in node execution times and log file values across different combinations of node numbers. This embodiment obtains multiple node subsequences by sliding partitioning the node sequence of the transaction process to be monitored. It then analyzes the local similarity with the corresponding node subsequences in historical transactions across two dimensions—execution time and log vector—to determine the degree of transaction consistency at the target scale.
[0029] Specifically, for the node sequence of the transaction process to be monitored, a target length is selected as the target scale to perform sliding partitioning of the node sequence to obtain multiple node subsequences. Similarly, the time-consuming sequence is partitioned to obtain multiple time-consuming subsequences. Any node subsequence is selected as the target node subsequence, and the corresponding time-consuming subsequence is selected as the target time-consuming subsequence. The Jaccard coefficient between the target node subsequence of the transaction process to be monitored and the target node subsequence of any historical transaction process is calculated as the node overlap. The absolute value of the cosine similarity between the target time-consuming subsequence of the transaction process to be monitored and the target time-consuming subsequence of any historical transaction process is calculated as the first similarity. The sum of the absolute values of the cosine similarity between the log vectors of the target node subsequences of the transaction process to be monitored and any historical transaction process is calculated as the second similarity. The same principle applies when other node subsequences are used as target node subsequences.
[0030] Specifically, the expression for calculating the degree of transaction consistency at the target scale is as follows: in, This indicates the degree of transaction consistency at the target scale. Indicates the number of subsequences of a node. Indicates the first The sum of the monitoring significance of all nodes in a subsequence of nodes, This indicates the number of historical transaction processes contained in a set of the same type. This indicates that the transaction process to be monitored is compared with the first one in the same type set. The historical transaction process in the first The degree of node overlap on a subsequence of nodes. This indicates that the transaction process to be monitored is compared with the first one in the same type set. The historical transaction process in the first The first similarity on the subsequence of each node This indicates that the transaction process to be monitored is compared with the first one in the same type set. The historical transaction process in the first The second similarity is obtained on the subsequence of each node. Similarly, the transaction consistency at other scales is obtained.
[0031] In another implementation, the expression for calculating the degree of transaction consistency at the target scale is: in, This indicates the degree of transaction consistency at the target scale. Indicates the number of subsequences of a node. This indicates the number of historical transaction processes contained in a set of the same type. This indicates that the transaction process to be monitored is compared with the first one in the same type set. The historical transaction process in the first The degree of node overlap on a subsequence of nodes. This indicates the transaction process to be monitored and the first in the heterogeneous set. The historical transaction process in the first The average overlap of nodes across a subsequence of nodes. This indicates that the transaction process to be monitored is compared with the first one in the same type set. The historical transaction process in the first The first similarity on the subsequence of each node This indicates that the transaction process to be monitored is compared with the first one in the same type set. The historical transaction process in the first The second similarity on the subsequence of each node.
[0032] Specifically, node overlap measures the degree of basic structural overlap in the transaction links of two transaction processes, while first similarity and second similarity measure the content similarity of node time and log files in the local transaction links of two transaction processes.
[0033] S203: Obtain the degree of anomaly in the transaction chain of the transaction process to be monitored.
[0034] Specifically, in the anomaly monitoring of the transaction chain, due to the strong logical connection and correlation between different nodes in the transaction chain, this embodiment analyzes the transaction similarity and relative monitoring significance of local node chains at different fine-grained levels to obtain the overall anomaly level of the transaction chain by dividing the transaction chain at different scales.
[0035] Specifically, the expression for calculating the degree of anomaly in the transaction chain of the transaction process to be monitored is as follows: in, This indicates the degree of anomaly in the transaction chain of the transaction process to be monitored. Indicates the number of node scales selected. Indicates the transaction process to be monitored in the 1st... The standard deviation of the average monitoring significance of all node subsequences at each scale Indicates the transaction process to be monitored in the 1st... The degree of consistency in transactions across different scales; Indicates the first The consistency of transactions across different scales is normalized.
[0036] Specifically, the standard deviation measures the difference between the average monitoring significance of different node subsequences at a scale. The greater the difference, the more diverse the information patterns contained in the node subsequence, the greater the uniqueness of its local node chain, and the greater the weight of the transaction consistency at the corresponding scale.
[0037] S3: Normalize the abnormality level of the transaction link in the transaction process to be monitored. When the normalized abnormality level of the transaction link is greater than the preset value, manually check and locate the abnormal node node by node.
[0038] Specifically, the normalized anomaly level of the transaction link to be monitored is returned to the transaction system. When the normalized anomaly level is greater than a preset value (0.4 in this embodiment), technical personnel are arranged to perform node-by-node verification to locate the abnormal node according to the transaction link.
[0039] This application also discloses a transaction link anomaly monitoring system, including a processor and a memory. The memory stores computer program instructions, and when the computer program instructions are executed by the processor, a transaction link anomaly monitoring method according to this application is implemented.
[0040] The system also includes other components well known to those skilled in the art, such as communication buses and communication interfaces, the settings and functions of which are known in the art and will not be described in detail here.
[0041] In this application, the aforementioned memory can be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. For example, a computer-readable storage medium can be any suitable magnetic or magneto-optical storage medium, such as resistive random access memory (DRAM), dynamic random access memory (DRAM), static random access memory (SRAM), or any other medium that can be used to store required information and can be accessed by an application program, module, or both. Any such computer storage medium can be part of a device or accessible to or connected to a device.
[0042] The above are all preferred embodiments of this application, and are not intended to limit the scope of protection of this application. Therefore, all equivalent changes made in accordance with the structure, shape and principle of this application should be covered within the scope of protection of this application.
Claims
1. A method for monitoring anomalies in a transaction chain, characterized by the following steps: include: The abnormality level of the transaction link of the transaction process to be monitored is obtained based on the transaction information of the transaction process. The abnormality level of the transaction link of the transaction process to be monitored is normalized. When the normalized abnormality level of the transaction link is greater than the preset value, the abnormal nodes are manually checked and located node by node. Transaction information includes: transaction type, node sequence, time sequence, and log vector of multiple historical transaction processes and the transaction process to be monitored; node sequence is obtained from the transaction nodes of the transaction process, time sequence is obtained from the transaction node time, and log vector is obtained from the transaction node log file; Method for obtaining the degree of anomaly in the transaction chain of the transaction process to be monitored: Based on the transaction type of the transaction process to be monitored, the historical transaction processes are divided into sets of the same type and sets of different types. The monitoring significance of the nodes is obtained based on the frequency difference and time difference of the nodes of the transaction process to be monitored in the sets of the same type and sets of different types. Different scales are selected to divide the node sequence and time-consuming sequence of the transaction process to be monitored into node subsequences and time-consuming subsequences. The differences between the node subsequences and time-consuming subsequences and the historical transaction process are calculated to obtain the transaction consistency degree at each scale. Calculate the standard deviation of the average monitoring significance of all nodes at any scale, and take the mean of the product of the standard deviations at all scales and the corresponding normalized transaction consistency as the transaction link anomaly degree of the transaction process to be monitored.
2. The method for monitoring transaction chain anomalies according to claim 1, characterized in that, The significance of node monitoring, based on the frequency and time differences of nodes appearing in the same and different types of transaction processes, includes: Select any node in the node sequence of the transaction process to be monitored as the target node, and calculate the first generality of the target node within the same type set and the second generality of the target node within the different type set; Calculate the first time sensitivity of the target node in any historical transaction process containing the target node within the same type set, and the second time sensitivity of the target node in any historical transaction process containing the target node within the different type set; The frequency difference of the target node is obtained based on the first generality and the second generality; the time difference of the target node is obtained based on the first time sensitivity and the second time sensitivity. Similarly, the monitoring significance of all nodes within the node sequence of the transaction process to be monitored is obtained.
3. The method for monitoring transaction chain anomalies according to claim 2, characterized in that, The first generality is represented by the ratio of the number of historical transaction processes containing the target node in the same type set to the total number of historical transaction processes in the same type set. The second generality is represented by the ratio of the number of historical transaction processes containing the target node in the heterogeneous set to the total number of historical transaction processes in the heterogeneous set.
4. The method for monitoring transaction chain anomalies according to claim 2, characterized in that, The first time consumption sensitivity is represented by the sum of squares of the differences in time consumption between the target node and other nodes in any historical transaction process within the same type set that contains the target node; The second time-consuming sensitivity is represented by the sum of squares of the time-consuming differences between the target node and other nodes in any historical transaction process within the heterogeneous set containing the target node.
5. The method for monitoring transaction chain anomalies according to claim 1, characterized in that, The step of selecting different scales to divide the node sequence and time-consuming sequence of the transaction process to be monitored into node subsequences and time-consuming subsequences includes: selecting a length as the target scale for the node sequence of the transaction process to be monitored and performing sliding division of the node sequence to obtain multiple node subsequences; similarly, dividing the time-consuming sequence to obtain multiple time-consuming subsequences.
6. The method for monitoring transaction chain anomalies according to claim 1, characterized in that, The difference between the computation node subsequence and the time consumption subsequence and the historical transaction process is used to obtain the transaction consistency degree at each scale, which includes: selecting any scale as the target scale; The degree of transaction consistency at the target scale is obtained by measuring the monitoring significance of all nodes in any subsequence of nodes included in the target scale, and the overlap, first similarity, and second similarity of nodes between the transaction process to be monitored and any historical transaction process in the same type set in any subsequence of nodes included in the target scale. Similarly, the degree of transaction consistency at other scales can be obtained.
7. The method for monitoring transaction link anomalies according to claim 6, characterized in that, Select any node subsequence as the target node subsequence, and the target time subsequence corresponding to the target node subsequence is the target time subsequence; The node overlap is represented by the Jaccard coefficient between the target node subsequence of the transaction process to be monitored and the target node subsequence of any historical transaction process. The first similarity is represented by calculating the absolute value of the cosine similarity between the target time-consuming subsequence of the transaction process to be monitored and any historical transaction process; The second similarity is represented by the sum of the absolute values of the cosine similarity between the log vectors of the target node subsequence of the transaction process to be monitored and any historical transaction process.
8. A transaction link anomaly monitoring system, characterized in that, include: A processor and a memory, wherein the memory stores computer program instructions that, when executed by the processor, implement a transaction link anomaly monitoring method according to any one of claims 1-7.