Business exception workflow analysis method and device, equipment and medium

Abstract

The invention relates to the technical field of base frame operation and maintenance, can be applied to business system platforms of financial science and technology, medical health and the like, and discloses a workflow analysis method, device, equipment and medium for business abnormities, and the method comprises the following steps: identifying an abnormal scene of a target business, carrying out business semantic abstraction on a process node of the abnormal scene, and obtaining a business semantic level node; constructing a service node view and a mapping strategy library according to the service semantic level nodes; obtaining a node interaction instruction, and carrying out interaction processing on the business semantic level node; generating a business anomaly detection flow chart according to the business semantic level nodes after interaction processing, and extracting flow metadata in the business anomaly detection flow chart; converting the process metadata into a technical layer analysis result by utilizing a mapping strategy library, and identifying a technical node combination and a process connection relationship according to the technical layer analysis result; and determining the workflow of the abnormal scene according to the technical node combination and the process connection relationship. According to the invention, the accuracy of business anomaly detection workflow construction can be improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of base station operation and maintenance, and particularly relates to a business exception workflow analysis method and device, equipment and a medium. BACKGROUND

[0002] In the business exception detection scenario, a workflow including triggering, data preparation, checking, merging, reporting, etc. needs to be constructed to achieve efficient monitoring. Current mainstream workflow engines (such as n8n, Apache Airflow, Camunda, Zapier, etc.) can construct processes based on technical nodes, and some low-code platforms support visual process design, and some tools also have process templates, node reuse, and JSON import and export functions, providing a basic support for process construction. Therefore, in order to meet the professional and efficient needs of process construction in the business exception detection scenario, the workflow modeling and automatic mapping generation method need to be innovatively designed to improve the accuracy of business exception detection workflow construction.

[0003] In the construction of patient medication exception detection workflow in the medical health field, the staff needs to manually operate technical nodes such as "HTTP request (pull patient medication records)", "condition judgment (check dose standard)", "Webhook (push warning)" and the like with the aid of mainstream workflow engines, or use general visual nodes of mainstream low-code platforms, there is no business semantic node such as "medication compliance check", and the staff also needs to manually splice the process of "triggering → data preparation → multi-dimensional medication checking → result merging → exception reporting", and cannot encapsulate the grouping checking logic of different department medication rules, which finally leads to low accuracy of business exception detection workflow construction.

[0004] In the construction of transaction exception detection workflow in the financial technology field, the staff needs to manually operate technical nodes such as "HTTP request (pull transaction data)", "condition judgment (check risk threshold)", "Webhook (push exception alarm)" and the like with the aid of mainstream workflow engines, or use general visual nodes of mainstream low-code platforms, there is no business semantic node such as "transaction risk check", and the staff also needs to manually splice the process of "triggering → data preparation → multi-dimensional risk checking → result merging → exception reporting", and cannot encapsulate the grouping checking logic of different transaction types, which finally leads to low accuracy of business exception detection workflow construction.

[0005] In the prior art, mainstream workflow engines build processes with "HTTP request", "conditional judgment" and other technical nodes as the core, without semantic-level node abstraction for business exception detection; low-code platforms support visual design, but the nodes are general and do not build a mapping strategy library that adapts to abnormal scenarios. Users need to manually splice processes, cannot automatically generate a business exception detection process diagram and extract process metadata based on interactive instructions, and cannot convert metadata into technical layer analysis results through mapping strategies, need to manually identify node combination and process connection relationship, which is prone to node matching deviation and process logic omission, resulting in low accuracy of business exception detection workflow construction. SUMMARY

[0006] The application provides a business exception workflow analysis method, device, equipment and medium to solve the problem of low accuracy of business exception detection workflow construction.

[0007] In a first aspect, a business exception workflow analysis method is provided, comprising: Identifying an abnormal scenario in a target business, abstracting the business semantics of the process nodes of the abnormal scenario to obtain business semantic-level nodes; Building a business node view and a mapping strategy library of the abnormal scenario according to the business semantic-level nodes; Obtaining node interaction instructions of a target user, and interacting with the business semantic-level nodes in the business node view based on the node interaction instructions; Generating a business exception detection process diagram of the target business according to the business semantic-level nodes after interaction, and extracting process metadata in the business exception detection process diagram; Converting the process metadata into a technical layer analysis result using the mapping strategy library, and identifying the technical node combination and process connection relationship corresponding to the business exception detection process diagram according to the technical layer analysis result; Determining the workflow of the abnormal scenario according to the technical node combination and the process connection relationship.

[0008] In a second aspect, a business exception workflow analysis device is provided, comprising: A business semantic-level node acquisition module for identifying an abnormal scenario in a target business, abstracting the business semantics of the process nodes of the abnormal scenario to obtain business semantic-level nodes; A node view and mapping strategy library construction module for building a business node view and a mapping strategy library of the abnormal scenario according to the business semantic-level nodes; A business semantic-level node interaction processing module for obtaining node interaction instructions of a target user, and interacting with the business semantic-level nodes in the business node view based on the node interaction instructions; The process metadata extraction module is used to generate a business anomaly detection flowchart for the target business based on the business semantic level nodes after interaction processing, and to extract the process metadata in the business anomaly detection flowchart. The business anomaly detection flowchart recognition module is used to convert the process metadata into technical layer parsing results using the mapping strategy library, and to identify the technical node combination and process connection relationship corresponding to the business anomaly detection flowchart based on the technical layer parsing results. The workflow determination module is used to determine the workflow for the abnormal scenario based on the combination of technical nodes and the process connection relationship.

[0009] Thirdly, a computer device is provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the steps of the workflow analysis method for the aforementioned business anomalies.

[0010] Fourthly, a computer-readable storage medium is provided, which stores a computer program that, when executed by a processor, implements the steps of the workflow analysis method for the aforementioned business anomalies.

[0011] In the aforementioned workflow analysis method, apparatus, equipment, and medium for business anomalies, the abnormal scenarios in the target business can be identified through the client. Business semantic abstraction is performed on the process nodes of the abnormal scenarios to obtain business semantic-level nodes. A business node view and mapping strategy library for the abnormal scenarios are constructed based on the business semantic-level nodes. Node interaction instructions from the target user are obtained, and interactive processing is performed on the business semantic-level nodes in the business node view based on these instructions. A business anomaly detection flowchart for the target business is generated based on the processed business semantic-level nodes, and process metadata is extracted from the flowchart. The process metadata is converted into technical layer parsing results using the mapping strategy library, and the abnormal scenarios are identified based on the technical layer parsing results. The invention establishes a business anomaly detection flowchart, which includes combinations of technical nodes and their connections. Based on these connections, the workflow for the anomaly scenario is determined. In this invention, business semantics are abstracted from the process nodes of the target business anomaly scenario to obtain business semantic-level nodes adapted to the scenario, allowing non-technical personnel to participate in process design. An intuitive business node view and a configurable, extensible mapping strategy library are then constructed, supporting hot rule updates and multi-platform adaptation. Subsequently, nodes are processed based on user interaction commands, a business anomaly detection flowchart is generated, and metadata is extracted. The mapping strategy library converts the metadata into technical layer parsing results, automatically identifying combinations of technical nodes and their connections. This reduces redundant modeling and human error, solving the problem of low accuracy in business anomaly detection workflow construction. Attached Figure Description

[0012] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the description of the embodiments of the present invention will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0013] Figure 1 This is a schematic diagram of an application environment for a workflow analysis method for business anomalies according to an embodiment of the present invention; Figure 2 This is a flowchart illustrating a workflow analysis method for business anomalies according to an embodiment of the present invention; Figure 3 yes Figure 2 A flowchart illustrating a specific implementation method of step S3; Figure 4 yes Figure 2 A flowchart illustrating a specific implementation of step S5; Figure 5 This is a schematic diagram of a workflow analysis device for business anomalies in one embodiment of the present invention; Figure 6 This is a schematic diagram of the structure of a computer device according to an embodiment of the present invention; Figure 7 This is another structural schematic diagram of a computer device according to one embodiment of the present invention. Detailed Implementation

[0014] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0015] The workflow analysis method for business anomalies provided in this invention can be applied to, for example... Figure 1In this application environment, the client communicates with the server via a network. The server can identify abnormal scenarios in the target business through the client, perform business semantic abstraction on the process nodes of the abnormal scenarios to obtain business semantic-level nodes; construct a business node view and mapping strategy library for the abnormal scenarios based on the business semantic-level nodes; obtain node interaction instructions from the target user, and perform interactive processing on the business semantic-level nodes based on the node interaction instructions in the business node view; generate a business anomaly detection flowchart for the target business based on the processed business semantic-level nodes, and extract process metadata from the business anomaly detection flowchart; use the mapping strategy library to convert the process metadata into technical layer parsing results, and identify the technology corresponding to the business anomaly detection flowchart based on the technical layer parsing results. The invention involves defining node combinations and process connections. Based on these combinations and connections, the workflow for the abnormal scenario is determined. In this invention, business semantics are abstracted from the process nodes of the target business abnormal scenario to obtain business semantic-level nodes adapted to the scenario, allowing non-technical personnel to participate in process design. An intuitive business node view and a configurable, scalable mapping strategy library are then constructed, supporting hot rule updates and multi-platform adaptation. Subsequently, nodes are processed based on user interaction commands, a business anomaly detection flowchart is generated, and metadata is extracted. The metadata is then converted into technical layer parsing results through the mapping strategy library, automatically identifying the combinations and connections of technical nodes, reducing redundant modeling and human error, and solving the problem of low accuracy in business anomaly detection workflow construction. The client can be, but is not limited to, various personal computers, laptops, smartphones, tablets, and portable wearable devices. The server can be implemented using a standalone server or a server cluster consisting of multiple servers. The invention is described in detail below through specific embodiments.

[0016] Please see Figure 2 As shown, Figure 2 A flowchart illustrating the workflow analysis method for business anomalies provided in this embodiment of the invention includes the following steps: S1. Identify abnormal scenarios in the target business, and perform business semantic abstraction on the process nodes of the abnormal scenarios to obtain business semantic level nodes.

[0017] In this embodiment of the invention, the target business refers to business areas with high complexity such as finance, insurance, and operation and maintenance, which require the construction of large-scale anomaly detection processes; the anomaly scenarios are various anomalies that need to be detected and identified in these target businesses.

[0018] In detail, it focuses on target business areas with high complexity and large-scale anomaly detection processes, such as finance, insurance, and operations and maintenance. It addresses specific anomaly scenarios in these areas, such as detecting host NAS storage anomalies, detecting network ELB changes, checking FKS node availability, detecting process anomalies, and detecting instance cluster aggregation anomalies related to NAS alarms in operations and maintenance.

[0019] In this embodiment of the invention, the process nodes refer to the technical level nodes that support workflow execution in the prior art, including atomic nodes such as "HTTP request", "condition judgment" and "Webhook" in mainstream workflow engines (such as n8n, Apache Airflow, etc.), and execution nodes such as "trigger", "set parameters", "prepare data", "parallel branch" and "merge node" in the converted technical platform (such as n8n); the business semantic level nodes are semantic encapsulation units defined by this invention for anomaly detection scenarios, specifically including "start node", "end node", "check node", "judgment node", "group check start node", "group check end node", etc. These nodes do not directly correspond to technical atomic nodes, but are abstracted with business logic as the core, making it convenient for users to drag and combine them based on business needs, thereby forming a highly readable and easy-to-understand business process diagram.

[0020] In this embodiment of the invention, the step of abstracting the process nodes of the abnormal scenario into business semantic-level nodes includes: Identify the anomaly detection business requirements of the abnormal scenario, and extract the core business logic information in the process nodes of the abnormal scenario based on the anomaly detection business requirements; Identify key node parameters of the process node based on the core business logic information, and determine the node semantic parameter set of the process node based on the key node parameters; The node semantic parameter set is matched with the node types in the preset business node type library to obtain the target business semantic node type corresponding to the process node. The target business semantic node type is semantically encapsulated to obtain the business semantic level node of the abnormal scenario.

[0021] In detail, anomaly detection business requirements refer to the needs of highly complex fields such as finance, insurance, and operations and maintenance for efficiency, maintainability, and standardization in anomaly detection process construction. Specifically, this includes the ability to quickly build complex anomaly detection processes without needing to master technical details, avoiding redundant modeling to achieve process reuse, ensuring process execution consistency to reduce human error, supporting complex logic encapsulation such as "group checks," and adapting to rapid business iterations and interfacing with multiple technology platforms. Core business logic information refers to the key business logic extracted from process nodes in anomaly scenarios, including process initiation, execution of specific anomaly checks, process structure, conditional judgments, and anomaly result reporting—core business logic directly related to anomaly detection. Through the provided upper-level business node view, users can identify the anomaly scenarios to be detected based on the anomaly detection business requirements of their target business, clarify the core objectives the process needs to achieve, and then focus on the key business actions that process nodes need to complete during process design, extracting core business logic information such as initiating the process, executing specific anomaly checks, handling parallel branches, and judging anomaly results.

[0022] Specifically, key node parameters refer to the crucial parameters extracted from process nodes that support the implementation of core business logic. Examples include the "inspection item name" corresponding to specific anomaly checks in an "inspection node," the "conditional expression" used for anomaly result determination in a "judgment node," and the identification information of parallel branch sub-inspection processes in a "group inspection start node." The node semantic parameter set is a set of parameters formed by structurally integrating the key node parameters of each process node according to their business semantics. For example, the node semantic parameter set of an "inspection node" might include all key node parameters related to the business semantics of "performing specific anomaly checks," such as "inspection item name," "inspection object," and "inspection result judgment criteria." The node semantic parameter set of a "group inspection start node" might include key node parameters related to the business semantics of "creating multiple anomaly parallel inspection branches," such as "number of parallel branches" and "sub-inspection process association identifier." After identifying the core business logic information of the anomaly scenario, key node parameters are extracted for each process node based on its core business logic. Then, the extracted key node parameters are categorized and organized according to the business semantics of the node to form a node semantic parameter set that can fully support the business functions of that node.

[0023] Furthermore, the preset business node type library is a collection of pre-built, pre-defined business semantic node types and their features for anomaly detection scenarios, stored in this invention. The target business semantic node type refers to a specific business semantic node type selected from the preset business node type library through feature matching that perfectly matches the node semantic parameter set of the process node in terms of business function and parameter features. Based on the node semantic parameter set of the process node, the core business function and required parameter features of the node are determined. This information is then compared with the features of each predefined business semantic node type in the preset business node type library. When the features of a certain predefined business semantic node type in the library perfectly match the node semantic parameter set of the process node, the target business semantic node type corresponding to the process node can be determined.

[0024] Furthermore, based on the business logic of anomaly detection scenarios, for the target business semantic node type matched from the preset business node type library, its corresponding core business functions and key business parameters are integrated and packaged. Moreover, the encapsulation process does not directly associate with atomic nodes of technology platforms such as n8n and Apache Airflow. Instead, it defines node attributes and functions based on business semantics that business personnel can understand. The final result is a business semantic level node that can directly reflect the anomaly detection business logic and supports users to build highly readable flowcharts by dragging and dropping, without requiring users to understand the technical implementation details.

[0025] For example, in a medical setting, for the business requirement of detecting abnormal vital signs in hospitalized patients, the core business logic is extracted as "monitoring start → vital sign data collection → multi-indicator synchronous examination → abnormal result judgment → group treatment → process end". Key node parameters include monitoring object, indicator threshold, treatment subject, record template number, etc., which constitute a set of node semantic parameters. This set is matched with a preset business node type library. "Monitoring start" corresponds to "start node", "multi-indicator synchronous examination" corresponds to "examination node", and "group treatment" corresponds to "group examination start or end node". These target business semantic node types are semantically encapsulated to obtain business semantic level nodes in the medical setting.

[0026] For example, in a financial scenario, for the business requirement of credit card transaction anomaly detection, the core business logic of the process nodes is extracted as "transaction trigger → transaction data collection → multi-dimensional inspection → anomaly result judgment → group handling → process end". Key node parameters include transaction ID, amount threshold, list of commonly used regions, list of risky merchants, user mobile phone number, work order number, etc., and the set of node semantic parameters is determined accordingly. This set is matched with a preset business node type library, where "transaction trigger" corresponds to "start node", "multi-dimensional inspection" corresponds to "inspection node", and "group handling" corresponds to "group inspection start or end node". These target business semantic node types are semantically encapsulated to obtain the business semantic level nodes of the financial transaction anomaly detection scenario.

[0027] S2. Construct the business node view and mapping strategy library for the abnormal scenario based on the business semantic level nodes.

[0028] In this embodiment of the invention, the business node view is the upper-level view in the system's two-layer visual editor. It is based on the business semantic-level nodes for anomaly detection scenarios defined in this invention. The mapping strategy library is the mapping rule library introduced in this invention. It is defined in JSON or DSL format and is the core for realizing the automatic conversion of "business semantics → technical execution". It includes rules such as node type mapping, parameter mapping, and process structure reorganization. It supports dynamic loading, version management, and hot updates, and can be adapted to multiple platforms, providing rule support for the automatic conversion of the business node view to the technical node view.

[0029] In this embodiment of the invention, constructing the business node view and mapping strategy library for the abnormal scenario based on the business semantic level nodes includes: Identify the basic node information of the business semantic level node, and use the basic node information to configure the topology layout of the business semantic level node to obtain the business node view of the abnormal scenario; Based on the basic node information, identify the technical execution logic of the business semantic level node, and determine the node type mapping strategy for the abnormal scenario based on the technical execution logic; A parameter mapping strategy for the business semantic level node is generated based on the business parameter attributes in the node's basic information. The node type mapping strategy and the parameter mapping strategy are structurally integrated to obtain the mapping strategy library for the abnormal scenario.

[0030] In detail, the basic node information refers to the core attributes of the business semantic-level nodes defined for anomaly detection scenarios in this invention, including the business semantic definition, functional attributes, and logical roles of each node. Based on the logical sequence of the anomaly detection business process and the relationships between nodes, the business semantic-level nodes are rationally arranged in the upper area of ​​the visual editor to complete the topology layout configuration, ultimately resulting in a highly readable and easily understandable business node view that intuitively reflects the anomaly detection business logic.

[0031] Specifically, technical execution logic refers to the specific operational processes and execution steps that a business semantic-level node needs to complete at the technical level, derived from its basic node information. The node type mapping strategy is a core component of the mapping rule base, defining the correspondence between business semantic-level nodes and technical atomic nodes. Based on the basic node information of a business semantic-level node, the specific operational processes that the node needs to execute at the technical level to achieve business semantics are parsed out. Then, based on the parsed technical execution logic, it is determined which technical nodes the business semantic-level node should correspond to, thus forming the node type mapping strategy.

[0032] Furthermore, business parameter attributes are parameter information directly related to the anomaly detection business logic contained in the basic information of business semantic-level nodes. Examples include attributes like "inspection item name" corresponding to an "inspection node," which clearly define the specific content of the business operation. Parameter mapping strategies are components of the mapping rule base, defining the correspondence between business parameter attributes of business semantic-level nodes and specific parameter fields of technical nodes. Business parameter attributes related to the anomaly detection business are extracted from the basic information of business semantic-level nodes. Based on these attributes, the specific parameter fields that need to be matched in the technical nodes are determined, thereby generating a parameter mapping strategy to guide the accurate correspondence between business parameters and technical parameters.

[0033] Furthermore, we first clarify the core content of the node type mapping strategy and the parameter mapping strategy, and then organize the two strategies according to the unified structured format of JSON or DSL. We associate and integrate the node type mapping rules and parameter mapping rules corresponding to each business semantic level node, and incorporate features such as rule version management, dynamic loading, hot update and state management to ensure that the two strategies can work together in the library to support the automatic transformation of "business process → technical process", and finally form a mapping strategy library adapted to abnormal scenarios.

[0034] For example, in a medical scenario, basic information such as "patient admission node," "blood routine examination node," and "diagnosis judgment node" is identified, and a business node view is obtained by arranging the logical layout of admission → examination → diagnosis. Based on the basic information, the technical execution logic of the "blood routine examination node" is identified, and the type strategy of mapping it to the combination of "device call + data parsing" technical nodes is determined. Using business parameter attributes such as "examination item name," a mapping strategy for the corresponding technical node "examination code" parameter is generated. The two strategies are structurally integrated to form a mapping strategy library adapted to this medical anomaly detection scenario.

[0035] For example, in a financial scenario, basic information such as "transaction trigger node," "risk control rule check node," and "anomaly alarm node" is identified, and a business node view is obtained by arranging the logic of transaction trigger → risk control check → anomaly alarm. Based on the basic information, the technical execution logic of the "risk control rule check node" is identified, and its mapping to a combination of "database query + rule matching" technical nodes is determined. Using business parameter attributes such as "risk control rule ID," a parameter mapping strategy for the "rule parameter field" of its corresponding technical node is generated. The two strategies are then structurally integrated to obtain a mapping strategy library adapted to the financial transaction anomaly detection scenario.

[0036] S3. Obtain the node interaction instructions of the target user, and perform interactive processing on the business semantic level node based on the node interaction instructions in the business node view.

[0037] In this embodiment of the invention, the target user is a business person who needs to build a business anomaly detection workflow, does not need to have in-depth knowledge of the technical node details of mainstream workflow engines such as n8n and Apache Airflow, and is more concerned with the implementation of business logic; the node interaction instructions are the drag-and-drop, combination and other operation instructions performed by the target user on the business semantic nodes defined for the anomaly detection scenario in the upper-level business node view provided by the system, thereby completing the design of a highly readable and easy-to-understand business anomaly detection process.

[0038] In detail, the upper-level business node view contains business semantic level nodes such as "start node", "end node", "check node", "group check start node", and "group check end node" defined for anomaly detection scenarios. Target users drag and drop and combine these business semantic level nodes in this view to construct anomaly detection business processes. The system captures these drag and drop operations of users in real time, thereby obtaining the node interaction instructions of the target users.

[0039] In this embodiment of the invention, reference is made to Figure 3 As shown, the step of interacting with the business semantic-level node based on the node interaction command in the business node view includes: S31. Use the node interaction command to identify the node operation type identifier corresponding to the business semantic level node; S32. Identify the target business semantic level node in the business node view based on the node operation type identifier; S33. Perform interactive actions on the target business semantic level node according to the node operation type identifier.

[0040] In detail, the node operation type identifier is used to distinguish the specific types of various business semantic level nodes defined in this invention for anomaly detection scenarios, and corresponds to the core functional attributes of different business semantic nodes. When a target user performs node interaction commands such as dragging and combining in the upper-level business node view provided by the system, the system will identify the specific type of the business semantic level node operated by the user based on these user interaction behaviors and in combination with the preset business semantic level node definition for anomaly detection scenarios, thereby determining the node operation type identifier corresponding to the node. For example, if a user drags the interaction command "Group check start node", the system will identify the node operation type identifier corresponding to the business semantic level node as the "Group check start" type identifier.

[0041] Specifically, a target business semantic level node refers to the specific business semantic level node in the upper-level business node view that corresponds to the identified node operation type identifier and is targeted by the user during process design. First, the node operation type identifier is determined through the user's node interaction commands. Then, based on this identifier, a match is made in the business node view to find the specific business semantic level node that matches the node type represented by the identifier.

[0042] Furthermore, based on the user's operations in the business node view, the node operation type identifier is identified, and then the corresponding target business semantic level node in the business node view is matched with the identifier. Subsequently, according to the preset interaction rules corresponding to the node operation type identifier, the user's required interactive actions are executed on the target business semantic level node, thereby completing the deployment and functional association of the target business semantic level node in the anomaly detection business process.

[0043] For example, in a medical scenario, hospital pharmacy staff can drag and drop "Medication Record Import Node," "Allergy History Check Node," and "Dosage Compliance Judgment Node" in the upper-level business node view of the system to form node interaction commands. The system uses these commands to identify the "Allergy History Check Node" corresponding to the "Allergy History Verification" type node operation type identifier. Based on this identifier, the system accurately locates the target business semantic level node "Allergy History Check Node" in the business node view. Then, according to the preset rules corresponding to the "Allergy History Verification" identifier, the system performs interactive actions such as connecting the target node with the "Medication Record Import Node" and triggering automatic comparison of patient allergy history data with current medication data, thus establishing a business process for medication anomaly detection.

[0044] For example, in a financial scenario, bank risk control personnel can drag and drop "Transaction Data Access Node," "Large Transaction Inspection Node," and "Risk Alarm Trigger Node" in the upper-level business node view of the system to form node interaction commands. Using these commands, they can identify the "Large Transaction Verification" type node operation type identifier corresponding to the "Large Transaction Inspection Node." Then, based on this identifier, they can locate the target business semantic level node "Large Transaction Inspection Node" in the business node view. Subsequently, according to the preset rules corresponding to this identifier, they can perform interactive actions such as connecting the process with the "Transaction Data Access Node" and automatically configuring the large transaction judgment threshold for this node, thus establishing the basic process for transaction anomaly detection.

[0045] S4. Generate a business anomaly detection flowchart for the target business based on the business semantic level nodes after interaction processing, and extract the process metadata in the business anomaly detection flowchart.

[0046] In this embodiment of the invention, the business anomaly detection flowchart refers to a highly readable and easy-to-understand diagram formed by users dragging and combining business semantic-level nodes defined in this invention for anomaly detection scenarios through interactive processing.

[0047] In this embodiment of the invention, generating a business anomaly detection flowchart for the target business based on the business semantic-level nodes after interaction processing includes: Type determination is performed on the business semantic-level nodes after interaction processing to obtain the business function type; Extract the logical association information between the business semantic-level nodes after the interaction processing based on the business function type; The logical association information is used to arrange the topological structure of the business semantic-level nodes after the interaction processing to obtain a business anomaly detection process framework. In the business anomaly detection process framework, create a parallel branch structure and branch merging logic corresponding to the business function type; A business anomaly detection flowchart for the target business is generated based on the parallel branch structure and the branch merging logic.

[0048] In detail, the business function type refers to the core function category directly related to the anomaly detection business logic, corresponding to the business semantic-level node defined by this invention for anomaly detection scenarios. Based on a pre-built abstract model of business semantic-level nodes for anomaly detection scenarios, and combined with the correspondence between node types and business function categories defined in the mapping rule base, the business semantic-level nodes, after interactive processing such as user drag-and-drop combinations, are matched with node types in the rule base by identifying their preset semantic identifiers, node attributes, or business logic descriptions, thereby determining the specific business function type to which the node belongs.

[0049] Specifically, logical association information refers to the relationships between various business semantic-level nodes after interactive processing, which embody business logic within the anomaly detection business process. This includes the execution order, parallel branching relationships, and merging / aggregating relationships between nodes. These relationships directly correspond to the complete business logic chain of the anomaly detection process, from triggering, data preparation, and inspection to reporting. Based on a pre-defined business semantic-level node abstract model for anomaly detection scenarios, and combined with the definition of process structure reorganization in the mapping rule base, the system identifies the connection methods of business semantic-level nodes formed by user drag-and-drop combinations, matches the process logic requirements corresponding to the business function types of each node, and thus extracts the association information between nodes that conforms to the anomaly detection business logic, such as the execution order, parallel branching, and merging / aggregating relationships.

[0050] Furthermore, the business anomaly detection process framework refers to a framework diagram that clearly presents the complete process structure of the target business anomaly detection, based on the business semantic-level nodes after interactive processing and combined with the extracted logical relationship information between nodes, through topological arrangement. This framework clarifies the position, connection method, and overall business logic flow of each business semantic-level node in the anomaly detection process. Relying on the pre-defined business semantic-level node abstract model for anomaly detection scenarios and the definition of process structure reorganization in the mapping rule library, and based on the extracted logical relationship information, the interactively processed business semantic-level nodes are arranged in a structured manner according to the topological arrangement rules that conform to the anomaly detection business logic, ultimately forming a business anomaly detection process framework that intuitively reflects the overall architecture of the business anomaly detection process.

[0051] Furthermore, the parallel branch structure refers to a structure created within the business anomaly detection process framework. For the "Group Check Start" business function type node, it is based on the structural reorganization rules in the mapping rule base, which are "Group Check Start Node → Generate Parallel Branches, Each Sub-Node Corresponds to an Inspection Process." This structure contains multiple parallel sub-inspection processes. Each sub-inspection process can nest and call business semantic-level nodes such as inspection nodes and condition judgment nodes to simultaneously handle anomaly detection tasks of different dimensions. The branch merging logic refers to the logic of uniformly connecting the ends of all parallel sub-inspection processes in the aforementioned parallel branch structure to the "Group Check End" node for the "Group Check End" business function type node, thereby achieving the aggregation and integration of the results of multiple parallel sub-inspection processes. In the business anomaly detection process framework, relying on the preset mapping rule library and business semantic level node abstract model, when the user-added "Group check start" business semantic level node is detected, a parallel branch structure containing multiple nestable business nodes is automatically created according to the rules. When the user-added "Group check end" business semantic level node is detected, all created parallel branches are automatically connected to this node to build branch merging logic. The whole process is completed automatically by the system based on rules, without the need for the user to manually splice or adjust the process structure, ensuring that it meets the encapsulation requirements of complex business logic in anomaly detection scenarios.

[0052] In addition, based on the pre-defined business semantic-level node abstract model and mapping rule library for anomaly detection scenarios, the existing parallel branch structure and branch merging logic are combined with other business semantic-level nodes and their logical association information in the target business. The structure is automatically integrated and arranged through the visual editor of the upper-level business node view of the system, and finally a business anomaly detection flowchart that can intuitively present the complete anomaly detection process of the target business, is highly readable and easy to understand.

[0053] In this embodiment of the invention, the process metadata refers to data extracted from the business anomaly detection flowchart that describes the core structure and logical characteristics of the flowchart.

[0054] In detail, relying on the pre-set business semantic-level node abstract model and mapping rule library for anomaly detection scenarios, the business anomaly detection flowchart is parsed, each business semantic-level node in the flowchart is automatically identified and its business function type is determined, the attribute parameters corresponding to each node are extracted, and the logical association type between nodes is identified. This information describing the core structure and logical characteristics of the flowchart is integrated to finally obtain the process metadata.

[0055] S5. Use the mapping strategy library to convert the process metadata into technical layer parsing results, and identify the technical node combinations and process connection relationships corresponding to the business anomaly detection flowchart based on the technical layer parsing results.

[0056] In this embodiment of the invention, the technical layer parsing result refers to the executable technical layer result that is adapted to the target technical platform and obtained by converting the process metadata of the business layer after processing by the mapping rule base.

[0057] In this embodiment of the invention, reference is made to Figure 4 As shown, the process metadata is converted into technical layer parsing results using the mapping strategy library, including: S41. Use the node type mapping strategy in the mapping strategy library to perform type conversion on the business semantic node type in the process metadata to obtain the technical node type; S42. Determine the technical parameter information of the process metadata according to the technical node type; S43. Using the process structure reorganization strategy in the mapping strategy library, the technical node type and the technical parameter information are integrated into the process structure to obtain the technical layer parsing result.

[0058] In detail, the node type mapping strategy is a pre-defined rule in the mapping strategy library that maps business semantic node types to target technology platform technology node types for anomaly detection scenarios. Business semantic node types are semantic encapsulation units defined in this solution for anomaly detection scenarios; technology node types are atomic or composite nodes of the target technology platform. The pre-defined mapping rules between business semantic node types and technology node types are obtained from the mapping strategy library. Then, the specific business semantic node types included when the user constructs the process based on business semantic nodes are extracted from the process metadata. Finally, according to the aforementioned mapping rules, each extracted business semantic node type is matched and converted into a corresponding technology node type that can be recognized and executed by the target technology platform, ultimately resulting in technology node types that conform to the technology platform specifications.

[0059] Specifically, technical parameter information refers to the specific parameter fields and values ​​that are adapted to the target technology platform and correspond to the technology node type obtained through node type mapping. It represents the configuration information required for the technology node to execute normally on the technology platform. After obtaining the technology node type corresponding to the process metadata through the node type mapping strategy in the mapping strategy library, business parameter information associated with the business semantic node is extracted from the process metadata according to the preset parameter mapping rules in the mapping strategy library. This business parameter information is then converted into the parameter fields and corresponding parameter values ​​required by the technology node of the target technology platform according to the parameter mapping rules, thereby determining the technical parameter information that allows the technology node type to execute normally on the target technology platform.

[0060] Furthermore, the process structure reorganization strategy is a set of pre-defined rules in the mapping strategy library used to adjust the process structure at the business semantic level to conform to the process specifications of the target technology platform. First, based on the process structure reorganization strategy in the mapping strategy library, the technical process structure form that the original business semantic process structure in the process metadata should correspond to on the target technology platform is determined. Then, the technical node types obtained through node type mapping are arranged according to this technical process structure form. Simultaneously, the determined technical parameter information is configured into the parameter fields of the corresponding arranged technical node types, so that the technical node types and technical parameter information form a complete process structure that conforms to the execution specifications of the target technology platform. Finally, a technical layer parsing result of an executable workflow form adapted to the target technology platform is obtained.

[0061] In this embodiment of the invention, the technical node combination refers to a set of atomic or composite nodes that are adapted to the target technical platform and constitute the technical implementation of the business anomaly detection process after being mapped by the node type of the mapping strategy library and reorganized by the process structure; the process connection relationship refers to the association between these technical node combinations in accordance with the process specifications of the target technical platform and the logical requirements of business anomaly detection.

[0062] In detail, the process first relies on the technical layer parsing results generated by the mapping rule base to extract the set of atomic or composite nodes of the target technical platform obtained by node type mapping. Then, the process analyzes the association between these technical node combinations according to the process specifications and business anomaly detection logic requirements of the target technical platform. At the same time, the process combines the before-and-after conversion comparison, log recording and debugging functions supported by the technical layer view to assist in the confirmation, thereby completing the identification of the technical node combinations and process connection relationships corresponding to the business anomaly detection flowchart.

[0063] S6. Determine the workflow for the abnormal scenario based on the combination of technical nodes and the connection relationship of the process.

[0064] In this embodiment of the invention, the workflow refers to a process where, for anomaly detection scenarios, the user first drags and drops business semantic-level nodes such as "start node," "check node," and "group check start or end node" to establish process connection relationships to form a business-level flowchart through the business node view at the upper layer of the system. Then, the system mapping rule engine parses the business flowchart and automatically converts it into an anomaly detection process that is composed of combinations of technical nodes and corresponding process connection relationships and can be executed on the technical platform.

[0065] In this embodiment of the invention, determining the workflow for the abnormal scenario based on the combination of technical nodes and the process connection relationship includes: Extract the node functional features of the technology node combination and the logical association features of the process connection relationship; Based on the functional characteristics of the nodes and the logical association characteristics, a correlation analysis is performed on the degree of collaborative matching between the combination of technical nodes and the process connection relationship to obtain the collaborative matching result. The scene adaptability of the collaborative matching result is verified based on the scene requirement characteristics of the abnormal scene to obtain the adaptation verification result. Based on the adaptation verification results, the combination of technical nodes and the process connection relationship are structurally integrated to obtain the workflow for the abnormal scenario.

[0066] In detail, node functional characteristics refer to the semantic encapsulation functions of business semantic-level nodes for anomaly detection scenarios and the specific execution functions of the corresponding technical nodes after transformation by the mapping rule engine; logical association characteristics refer to the logic reflected in the process connection relationships built between business semantic-level nodes and the corresponding execution logic associations between the transformed technical nodes. Extracting these two types of features requires users to drag and drop business semantic-level nodes in the upper-level business node view and establish process connection relationships, clarifying the semantic encapsulation functions of each business node and the logical relationships between nodes.

[0067] Specifically, the degree of synergistic matching refers to the degree of compatibility between the functional characteristics of the combination of technical nodes and the logical association characteristics of the process connection relationship, ensuring they can jointly meet the execution requirements of the anomaly detection process. The synergistic matching result is a conclusion drawn after correlation analysis regarding whether the combination of technical nodes and the process connection relationship are compatible in terms of functional support and logical execution, and to what extent they are compatible. Based on a pre-set mapping rule base, the logical association characteristics of the functional characteristics of the combination of technical nodes and the process connection relationship are first extracted. Then, according to the correspondence standard between business semantics and technical implementation in the rule base, it is analyzed whether the functions of the technical nodes can accurately support the logical requirements of the process connection, and whether the logic of the process connection can be smoothly executed through the functional combination of the technical nodes. This is used to conduct correlation analysis on the degree of synergistic matching between the two, ultimately yielding the synergistic matching result.

[0068] Furthermore, scenario requirement characteristics refer to specific business requirements under anomaly detection scenarios, such as the encapsulation requirements for complex logic like "group check start or end," the process execution requirements of "trigger → data preparation → multiple check nodes → merging → reporting," and business-level requirements for anomaly detection such as parallel branch processing and anomaly result aggregation. Adaptation verification results refer to the conclusions drawn after verification regarding whether the combination of technical nodes and the process connection relationships after collaborative matching meet the specific requirements of the anomaly detection scenario. Based on the scenario requirement characteristics of the anomaly detection scenario, and comparing them with the collaborative matching results obtained through correlation analysis, it is determined whether the combination of technical nodes and the process connection relationships after collaborative matching can meet the business execution requirements under the anomaly detection scenario. This process verifies the scenario adaptability of the collaborative matching results, ultimately yielding the adaptation verification results.

[0069] Furthermore, based on the adaptation verification results, and combined with the node type mapping, parameter mapping, and process structure reorganization rules defined in the mapping rule base, the logic of the functional combination of technical nodes and the process connection relationship is regulated to ensure that the execution function of the technical nodes can accurately carry the process logic requirements. At the same time, relying on the technical view of the two-layer editor, the integrated technical node combination and process connection relationship are transformed into a structure that conforms to the execution standards of technical platforms such as n8n, and finally a workflow that meets the requirements of anomaly detection scenarios is obtained. Throughout the process, the dynamic loading and version management of the rule base also provide support for the accuracy and adaptability of the structured integration.

[0070] As can be seen, in the above solution, business semantic abstraction is performed on the process nodes of the target business anomaly scenario to obtain business semantic level nodes adapted to the scenario, allowing non-technical personnel to participate in process design; based on this, an intuitive business node view and a configurable and extensible mapping strategy library are constructed, supporting hot rule updates and multi-platform adaptation; subsequently, nodes are processed according to user interaction commands, a business anomaly detection flowchart is generated and metadata is extracted, and the metadata is converted into technical layer parsing results through the mapping strategy library, automatically identifying the combination and connection relationship of technical nodes, reducing redundant modeling and human bias, and solving the problem of low accuracy in business anomaly detection workflow construction.

[0071] It should be understood that the sequence number of each step in the above embodiments does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present invention.

[0072] In one embodiment, a workflow analysis device for business anomalies is provided, which corresponds one-to-one with the workflow analysis method for business anomalies described in the above embodiments. For example... Figure 5As shown, the workflow analysis device 100 for business anomalies includes a business semantic-level node acquisition module 101, a node view and mapping strategy library construction module 102, a business semantic-level node interaction processing module 103, a process metadata extraction module 104, a business anomaly detection flowchart recognition module 105, and a workflow determination module 106. Detailed descriptions of each functional module are as follows: The business semantic level node acquisition module 101 is used to identify abnormal scenarios in the target business, perform business semantic abstraction on the process nodes of the abnormal scenarios, and obtain business semantic level nodes. The node view and mapping strategy library construction module 102 is used to construct the business node view and mapping strategy library of the abnormal scenario based on the business semantic level node. The business semantic level node interaction processing module 103 is used to obtain the node interaction instructions of the target user and perform interaction processing on the business semantic level node based on the node interaction instructions in the business node view. The process metadata extraction module 104 is used to generate a business anomaly detection flowchart of the target business based on the business semantic level nodes after interaction processing, and to extract the process metadata in the business anomaly detection flowchart. The business anomaly detection flowchart recognition module 105 is used to convert the process metadata into technical layer parsing results using the mapping strategy library, and to identify the technical node combination and process connection relationship corresponding to the business anomaly detection flowchart based on the technical layer parsing results. The workflow determination module 106 is used to determine the workflow of the abnormal scenario based on the combination of technical nodes and the process connection relationship.

[0073] In one embodiment, the business semantic level node acquisition module 101, when performing business semantic abstraction on the process nodes of the abnormal scenario to obtain business semantic level nodes, is used to: Identify the anomaly detection business requirements of the abnormal scenario, and extract the core business logic information in the process nodes of the abnormal scenario based on the anomaly detection business requirements; Identify key node parameters of the process node based on the core business logic information, and determine the node semantic parameter set of the process node based on the key node parameters; The node semantic parameter set is matched with the node types in the preset business node type library to obtain the target business semantic node type corresponding to the process node. The target business semantic node type is semantically encapsulated to obtain the business semantic level node of the abnormal scenario.

[0074] In one embodiment, the node view and mapping strategy library construction module 102, when executing the construction of the business node view and mapping strategy library for the abnormal scenario based on the business semantic level nodes, is used to: Identify the basic node information of the business semantic level node, and use the basic node information to configure the topology layout of the business semantic level node to obtain the business node view of the abnormal scenario; Based on the basic node information, identify the technical execution logic of the business semantic level node, and determine the node type mapping strategy for the abnormal scenario based on the technical execution logic; A parameter mapping strategy for the business semantic level node is generated based on the business parameter attributes in the node's basic information. The node type mapping strategy and the parameter mapping strategy are structurally integrated to obtain the mapping strategy library for the abnormal scenario.

[0075] In one embodiment, the business semantic level node interaction processing module 103, when performing interaction processing on the business semantic level node based on the node interaction instruction in the business node view, is configured to: The node operation type identifier corresponding to the business semantic level node is identified using the node interaction command. Identify the target business semantic level node in the business node view based on the node operation type identifier; The target business semantic level node is executed with an interactive action based on the node operation type identifier.

[0076] In one embodiment, the process metadata extraction module 104, when executing the process to generate a business anomaly detection flowchart for the target business based on the business semantic-level nodes after interaction processing, is used to: Type determination is performed on the business semantic-level nodes after interaction processing to obtain the business function type; Extract the logical association information between the business semantic-level nodes after the interaction processing based on the business function type; The logical association information is used to arrange the topological structure of the business semantic-level nodes after the interaction processing to obtain a business anomaly detection process framework. In the business anomaly detection process framework, create a parallel branch structure and branch merging logic corresponding to the business function type; A business anomaly detection flowchart for the target business is generated based on the parallel branch structure and the branch merging logic.

[0077] In one embodiment, the business anomaly detection flowchart recognition module 105, when executing the conversion of the process metadata into a technical layer parsing result using the mapping strategy library, is used to: The business semantic node types in the process metadata are converted using the node type mapping strategies in the mapping strategy library to obtain the technical node types. The technical parameter information of the process metadata is determined based on the technical node type; By utilizing the process structure reorganization strategy in the mapping strategy library, the technical node type and the technical parameter information are integrated into the process structure to obtain the technical layer parsing result.

[0078] In one embodiment, the workflow determination module 106, when executing a workflow to determine the abnormal scenario based on the combination of technical nodes and the process connection relationship, is configured to: Extract the node functional features of the technology node combination and the logical association features of the process connection relationship; Based on the functional characteristics of the nodes and the logical association characteristics, a correlation analysis is performed on the degree of collaborative matching between the combination of technical nodes and the process connection relationship to obtain the collaborative matching result. The scene adaptability of the collaborative matching result is verified based on the scene requirement characteristics of the abnormal scene to obtain the adaptation verification result. Based on the adaptation verification results, the combination of technical nodes and the process connection relationship are structurally integrated to obtain the workflow for the abnormal scenario.

[0079] This invention provides a workflow analysis device for business anomalies. It performs business semantic abstraction on the process nodes of the target business anomaly scenario to obtain business semantic-level nodes adapted to the scenario, allowing non-technical personnel to participate in process design. Based on this, it constructs an intuitive business node view and a configurable and extensible mapping strategy library, supporting hot rule updates and multi-platform adaptation. Subsequently, it processes nodes according to user interaction commands, generates a business anomaly detection flowchart, and extracts metadata. Through the mapping strategy library, the metadata is converted into technical layer parsing results, automatically identifying the combination and connection relationship of technical nodes, reducing redundant modeling and human bias, and solving the problem of low accuracy in business anomaly detection workflow construction.

[0080] Specific limitations regarding the workflow analysis device for business anomalies can be found in the limitations of the workflow analysis method for business anomalies described above, and will not be repeated here. Each module in the aforementioned workflow analysis device for business anomalies can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in the computer device in hardware form, or stored in the memory of the computer device in software form, so that the processor can call and execute the operations corresponding to each module.

[0081] In one embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be as follows:Figure 6 As shown, the computer device includes a processor, memory, network interface, and database connected via a system bus. The processor provides computing and control capabilities. The memory includes non-volatile and / or volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and database. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The network interface is used to communicate with external clients via a network connection. When the computer program is executed by the processor, it implements the functions or steps of a business anomaly workflow analysis method on the server side.

[0082] In one embodiment, a computer device is provided, which may be a client, and its internal structure diagram may be as follows: Figure 7 As shown, the computer device includes a processor, memory, network interface, display screen, and input devices connected via a system bus. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The network interface is used to communicate with an external server via a network connection. When the computer program is executed by the processor, it implements client-side functions or steps of a workflow analysis method for business anomalies.

[0083] In one embodiment, a computer device is provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to perform the following steps: Identify abnormal scenarios in the target business, and perform business semantic abstraction on the process nodes of the abnormal scenarios to obtain business semantic level nodes; Construct a business node view and mapping strategy library for the abnormal scenario based on the business semantic level nodes; Obtain the node interaction instructions of the target user, and perform interactive processing on the business semantic level node based on the node interaction instructions in the business node view; Based on the business semantic level nodes after interaction processing, a business anomaly detection flowchart for the target business is generated, and process metadata in the business anomaly detection flowchart is extracted. The process metadata is converted into technical layer parsing results using the mapping strategy library, and the combination of technical nodes and process connection relationships corresponding to the business anomaly detection flowchart are identified based on the technical layer parsing results. The workflow for the abnormal scenario is determined based on the combination of technical nodes and the connection relationship of the process.

[0084] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon, the computer program performing the following steps when executed by a processor: Identify abnormal scenarios in the target business, and perform business semantic abstraction on the process nodes of the abnormal scenarios to obtain business semantic level nodes; Construct a business node view and mapping strategy library for the abnormal scenario based on the business semantic level nodes; Obtain the node interaction instructions of the target user, and perform interactive processing on the business semantic level node based on the node interaction instructions in the business node view; Based on the business semantic level nodes after interaction processing, a business anomaly detection flowchart for the target business is generated, and process metadata in the business anomaly detection flowchart is extracted. The process metadata is converted into technical layer parsing results using the mapping strategy library, and the combination of technical nodes and process connection relationships corresponding to the business anomaly detection flowchart are identified based on the technical layer parsing results. The workflow for the abnormal scenario is determined based on the combination of technical nodes and the connection relationship of the process.

[0085] It should be noted that the functions or steps that can be implemented by the computer-readable storage medium or computer device described above can be referred to the relevant descriptions on the server side and client side in the foregoing method embodiments. To avoid repetition, they will not be described one by one here.

[0086] Those skilled in the art will understand that all or part of the processes in the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium. When executed, the computer program can include the processes of the embodiments of the above methods. Any references to memory, storage, databases, or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory may include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory may include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in a variety of forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), dual data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link DRAM (SLDRAM), RAMbus direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

[0087] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the above-described division of functional units and modules is used as an example. In practical applications, the above functions can be assigned to different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above.

[0088] It should be noted that if any software tools or components not belonging to our company appear in the embodiments of this application, they are merely for illustrative purposes and do not represent actual use.

[0089] The above-described embodiments are only used to illustrate the technical solutions of the present invention, and are not intended to limit it. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should all be included within the protection scope of the present invention.

Claims

1. A workflow analysis method for business anomalies, characterized in that, include: Identify abnormal scenarios in the target business, and perform business semantic abstraction on the process nodes of the abnormal scenarios to obtain business semantic level nodes; Construct a business node view and mapping strategy library for the abnormal scenario based on the business semantic level nodes; Obtain the node interaction instructions of the target user, and perform interactive processing on the business semantic level node based on the node interaction instructions in the business node view; Based on the business semantic level nodes after interaction processing, a business anomaly detection flowchart for the target business is generated, and process metadata in the business anomaly detection flowchart is extracted. The process metadata is converted into technical layer parsing results using the mapping strategy library, and the combination of technical nodes and process connection relationships corresponding to the business anomaly detection flowchart are identified based on the technical layer parsing results. The workflow for the abnormal scenario is determined based on the combination of technical nodes and the connection relationship of the process.

2. The workflow analysis method for business anomalies as described in claim 1, characterized in that, The process nodes of the abnormal scenario are abstracted using business semantics to obtain business semantic level nodes, including: Identify the anomaly detection business requirements of the abnormal scenario, and extract the core business logic information in the process nodes of the abnormal scenario based on the anomaly detection business requirements; Identify key node parameters of the process node based on the core business logic information, and determine the node semantic parameter set of the process node based on the key node parameters; The node semantic parameter set is matched with the node types in the preset business node type library to obtain the target business semantic node type corresponding to the process node. The target business semantic node type is semantically encapsulated to obtain the business semantic level node of the abnormal scenario.

3. The workflow analysis method for business anomalies as described in claim 1, characterized in that, The step of constructing the business node view and mapping strategy library for the abnormal scenario based on the business semantic level nodes includes: Identify the basic node information of the business semantic level node, and use the basic node information to configure the topology layout of the business semantic level node to obtain the business node view of the abnormal scenario; Based on the basic node information, identify the technical execution logic of the business semantic level node, and determine the node type mapping strategy for the abnormal scenario based on the technical execution logic; A parameter mapping strategy for the business semantic level node is generated based on the business parameter attributes in the node's basic information. The node type mapping strategy and the parameter mapping strategy are structurally integrated to obtain the mapping strategy library for the abnormal scenario.

4. The workflow analysis method for business anomalies as described in claim 1, characterized in that, The step of interacting with the business semantic-level node based on the node interaction instructions in the business node view includes: The node operation type identifier corresponding to the business semantic level node is identified using the node interaction command. Identify the target business semantic level node in the business node view based on the node operation type identifier; The target business semantic level node is executed with an interactive action based on the node operation type identifier.

5. The workflow analysis method for business anomalies as described in claim 1, characterized in that, The process of generating a business anomaly detection flowchart for the target business based on the business semantic-level nodes after interaction processing includes: Type determination is performed on the business semantic-level nodes after interaction processing to obtain the business function type; Extract the logical association information between the business semantic-level nodes after the interaction processing based on the business function type; The logical association information is used to arrange the topological structure of the business semantic-level nodes after the interaction processing to obtain a business anomaly detection process framework. In the business anomaly detection process framework, create a parallel branch structure and branch merging logic corresponding to the business function type; A business anomaly detection flowchart for the target business is generated based on the parallel branch structure and the branch merging logic.

6. The workflow analysis method for business anomalies as described in claim 1, characterized in that, The process metadata is converted into technical layer parsing results using the mapping strategy library, including: The business semantic node types in the process metadata are converted using the node type mapping strategies in the mapping strategy library to obtain the technical node types. The technical parameter information of the process metadata is determined based on the technical node type; By utilizing the process structure reorganization strategy in the mapping strategy library, the technical node type and the technical parameter information are integrated into the process structure to obtain the technical layer parsing result.

7. The workflow analysis method for business anomalies as described in claim 1, characterized in that, The process of determining the workflow for the abnormal scenario based on the combination of technical nodes and the connection relationship of the process includes: Extract the node functional features of the technology node combination and the logical association features of the process connection relationship; Based on the functional characteristics of the nodes and the logical association characteristics, a correlation analysis is performed on the degree of collaborative matching between the combination of technical nodes and the process connection relationship to obtain the collaborative matching result. Based on the scenario requirement characteristics of the abnormal scenario, the scenario adaptability of the collaborative matching result is verified to obtain the adaptation verification result. Based on the adaptation verification results, the combination of technical nodes and the process connection relationship are structurally integrated to obtain the workflow for the abnormal scenario.

8. A workflow analysis device for business anomalies, characterized in that, include: The business semantic level node acquisition module is used to identify abnormal scenarios in the target business, perform business semantic abstraction on the process nodes of the abnormal scenarios, and obtain business semantic level nodes. The node view and mapping strategy library construction module is used to construct the business node view and mapping strategy library for the abnormal scenario based on the business semantic level node. A business semantic level node interaction processing module is used to obtain node interaction instructions from the target user and perform interaction processing on the business semantic level node based on the node interaction instructions in the business node view. The process metadata extraction module is used to generate a business anomaly detection flowchart for the target business based on the business semantic level nodes after interaction processing, and to extract the process metadata in the business anomaly detection flowchart. The business anomaly detection flowchart recognition module is used to convert the process metadata into technical layer parsing results using the mapping strategy library, and to identify the technical node combination and process connection relationship corresponding to the business anomaly detection flowchart based on the technical layer parsing results. The workflow determination module is used to determine the workflow for the abnormal scenario based on the combination of technical nodes and the process connection relationship.

9. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the workflow analysis method for business anomalies as described in any one of claims 1 to 7.

10. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by the processor, it implements the workflow analysis method for business anomalies as described in any one of claims 1 to 7.

Images