An artificial intelligence-based information system operation anomaly detection method

Abstract

This invention relates to the field of information system detection technology, specifically disclosing an artificial intelligence-based method for detecting anomalies in information system operation. The method includes: dividing the historical intelligent decision-making chain of an auctioned property into decision interval categories, statistically analyzing the proportion of anomalous decision points in each interval, calculating the confidence level anomaly probability, setting different detection window lengths, and then using the detection window length as a fixed unit to slide and extract the decision chain to be judged to generate a window to be judged. Continuous anomalies within the judgment window are identified, and new anomalous decision points are marked. The window to be reviewed is identified by combining the interval confidence level anomaly probability. Subsequently, the offline due diligence results chain is linked to compare and verify the validity of the anomalies, distinguishing between misjudgments and genuine anomalies. Finally, the initial detection window length is dynamically adjusted based on the time characteristics of the anomalous decision points to obtain the final detection window length, thus achieving dynamic adjustment of the detection window length and improving the accuracy of anomaly detection and risk control capabilities.

Description

Technical Field

[0001] This invention relates to the field of information system detection technology, and specifically to an artificial intelligence-based method for detecting anomalies in the operation of information systems. Background Technology

[0002] Intelligentization of auction property transactions is one of the core directions of digital transformation in the real estate transaction industry. With the continuous expansion of judicial and commercial auction businesses and the popularization of online transaction platforms, artificial intelligence-based information systems have become a key path to improve the efficiency of auction property transactions, reduce labor costs, and ensure transaction compliance, possessing broad market application prospects and industry promotion value.

[0003] Existing intelligent decision-making systems for auction properties exhibit significant technical flaws and application bottlenecks in practical applications. Among these, the poor adaptability of fixed detection window lengths leads to particularly prominent decision-making errors. Specifically: First, the fixed setting of the decision detection window length, generated based on statistical analysis of all historical anomaly data, fails to adapt to the dynamic risk status of individual properties. This results in high-risk scenarios (such as properties with complex ownership structures or incomplete information) missing consecutive anomaly decision points due to an excessively wide detection window length, while low-risk scenarios (such as properties with clear ownership and complete information) trigger numerous invalid warnings due to an overly strict detection window length, directly causing errors in the intelligent decision-making results. Second, the anomaly detection dimension is singular, only validating isolated decision points and failing to capture the correlation characteristics of consecutive anomalies. This may lead to the identification of anomalies being mixed with a large amount of invalid information, amplifying decision-making errors and ultimately significantly reducing the risk control accuracy of the intelligent decision-making system.

[0004] Therefore, the present invention provides a method for detecting anomalies in the operation of information systems based on artificial intelligence. Summary of the Invention

[0005] The purpose of this invention is to provide an information system operation anomaly detection method based on artificial intelligence to solve the problems mentioned above.

[0006] The objective of this invention can be achieved through the following technical solutions: An artificial intelligence-based method for detecting operational anomalies in information systems includes: Obtain the historical intelligent decision-making chain of auction property business, and identify data anomalies in the historical intelligent decision-making chain, marking abnormal decision points; If an information system malfunction occurs, the decision intervals of the intelligent decision chain are categorized, and the confidence-based anomaly probability of each decision interval is calculated in conjunction with the abnormal decision points. The adaptability analysis of the abnormal decision points is performed through different set detection window lengths to determine the initial detection window length. Through the initial detection window, the intelligent decision-making chain is judged and the window to be reviewed is identified. Based on the confidence anomaly probability of each decision interval, the window warning trigger condition is determined and the trigger judgment of the linkage warning is made. If a linkage warning is triggered, the historical due diligence result chain is obtained, and anomalies and misjudgments in the historical intelligent decision chain are identified. The final detection window length is determined by combining the time characteristics of the new abnormal decision point.

[0007] As a further aspect of the present invention: Furthermore, the process of identifying data anomalies in the historical intelligent decision-making chain and marking abnormal decision points is as follows: The historical intelligent decision-making chain refers to the binary 1 / 0 chain formed by integrating the judgment results of each intelligent decision point according to the process within the historical statistical period, with the unique ID of the property as the core. Intelligent decision points refer to nodes in the decision-making process that have significant implications for judgment. Based on any intelligent decision-making chain in historical intelligent decision-making data, perform data integrity judgment and logical consistency judgment respectively: Calculate the length of a normal intelligent decision-making chain; If the lengths of the intelligent decision-making chain are inconsistent, it indicates that the data integrity judgment has failed. If the valid identifier is 0 or the intelligent invalid identifier is 1, it means that the logical consistency fails. If the data integrity check and the logical consistency check fail, it indicates that the information system is malfunctioning, and the intelligent decision point will be marked as an abnormal decision point.

[0008] Furthermore, the process of classifying the decision intervals of the intelligent decision-making chain is as follows: Position indexing of the intelligent decision-making chain: Starting from the first position i=1 of the intelligent decision-making chain, the index values ​​are recorded from left to right as i=1,2,3,...,n; Where i is the position number of the link in the intelligent decision-making chain, and n is the total number of decision points in the intelligent decision-making chain; Using the link position number as the dividing dimension and setting the interval length benchmark, the intelligent decision-making chain is divided into several continuous and non-overlapping decision interval categories.

[0009] Furthermore, the process of calculating the confidence-based outlier probability for various decision intervals is as follows: Based on any decision interval category in the intelligent decision-making chain: Count the number of anomalous decision points in the historical intelligent decision-making chain within the decision interval category; Calculate the proportion of the number of anomalous decision points in the total number of intelligent decision points to obtain the confidence-based anomalous probability of the decision interval category; The total number of intelligent decision points refers to the total number of decision points in the decision interval category.

[0010] Furthermore, the process of determining the initial detection window length by performing adaptability analysis on anomaly decision points using different set detection window lengths is as follows: Count the number of occurrences of a single anomalous decision point, the number of occurrences of two consecutive anomalous decision points, ... the number of occurrences of n consecutive anomalous decision points in the historical intelligent decision-making chain; The total number of intelligent decision points in the historical intelligent decision-making chain is counted and marked as the total number of frequency analysis points. Calculate the occurrence frequency corresponding to each detection window length: Occurrence frequency = Number of occurrences of abnormal decision points / Total number of frequency analyses; The cumulative percentages for each detection window length are obtained by summing the results in ascending order of detection window length: ; in, This represents the cumulative percentage corresponding to each detection window length, where L is the detection window length. If the cumulative percentage is greater than or equal to the cumulative percentage threshold, then the detection window length corresponding to the cumulative percentage is marked as the initial detection window length.

[0011] Furthermore, the process of performing decision-making and identifying windows to be reviewed within the intelligent decision-making chain is as follows: Based on any intelligent decision-making chain: With the initial detection window length Lmin as the fixed window length, starting from the first i=1 of the intelligent decision chain, the sliding interception is performed sequentially, with each sliding step being 1 decision point, until the end of the chain is intercepted; Each sub-chain segment containing Lmin consecutive decision points is a window to be judged; Based on the intelligent decision point in any window to be judged: If all the smart decision points in the window to be judged are anomalous decision points, then mark the smart decision points in the window to be judged as new anomalous decision points; Extract the confidence-based anomaly probability of the decision interval category to which the window to be judged belongs; If the confidence-based anomaly probability is greater than or equal to the preset anomaly probability, then the window to be judged is marked as the window to be reviewed.

[0012] Furthermore, determine the conditions for triggering window alerts and make decisions on triggering linked alerts: Warning trigger condition 1: A new abnormal decision point exists in the window to be judged; Warning trigger condition two: The window to be judged is a window to be reviewed; If both warning trigger condition one and warning trigger condition two are met simultaneously, a linked warning will be triggered.

[0013] Furthermore, the process of identifying anomalies and misjudgments in the historical intelligent decision-making chain is as follows: Retrieve the historical intelligent decision chain of the housing unit corresponding to the new abnormal decision point in the judgment window triggered by the linkage warning; If the historical due diligence results chain is inconsistent with the historical intelligent decision chain, it is judged as a misjudgment anomaly, and the inconsistent decision points are marked as misjudgment anomaly decision points.

[0014] Furthermore, the process for obtaining the temporal characteristics of the new anomaly decision point is as follows: Obtain the timestamps of the occurrence of misjudged and abnormal decision points in the historical intelligent decision-making chain, and arrange them in chronological order to obtain the sequence of misjudged and abnormal timestamps; Based on any adjacent timestamps in the misjudged anomaly timestamp sequence: Divide the time period between adjacent timestamps into several time periods and count the number of abnormal decision points in each time period. If the number of abnormal decision points increases, then adjacent timestamps will be marked as associated timestamp groups; If the number of abnormal decision points is not increasing, then adjacent timestamps are marked as unrelated timestamp groups; Calculate the proportion of the associated timestamp group in the sum of the associated timestamp group and the non-associated timestamp group to obtain the association determination value; If the correlation judgment value is greater than or equal to the correlation judgment threshold, it indicates that there is a positive correlation between the number of abnormal decision points and the probability of misjudging abnormal decision points.

[0015] Furthermore, considering the temporal characteristics of the new anomaly decision point, the process of determining the final detection window length is as follows: If there is a positive correlation between the number of anomalous decision points and the probability of misjudging anomalous decision points: Real-time acquisition of abnormal decision points, extraction of their timestamps, and chronological arrangement into an abnormal decision point sequence; Processing the difference between adjacent timestamps in the sequence of abnormal decision points; If the timestamp interval decreases, the initial detection window length is reduced by a preset window step to obtain the final detection window length. If the timestamp interval is not decreasing, the initial detection window length will not be adjusted, and the initial detection window length will be used as the final detection window length.

[0016] The beneficial effects of this invention are as follows: It solves the problems of missed detection and false alarms caused by fixed detection window length. First, by calibrating the chain link position index and setting the interval length benchmark, the intelligent decision-making chain is divided into continuous and non-overlapping decision interval categories. Then, the proportion of abnormal decision points in each interval is counted, and the confidence-based anomaly probability at different decision stages is calculated. Subsequently, the offline due diligence result chain is linked, and by comparing it with the historical intelligent decision chain one by one, the false anomalies and real anomalies are clearly distinguished, and invalid judgment interference is eliminated. Finally, combined with the time characteristics of new abnormal decision points, the initial detection window length is dynamically adjusted or maintained, so that the detection window length can match the dynamic risk status of a single property at different decision stages in real time. In high-risk scenarios, the detection window length is adjusted to improve the early warning sensitivity, and in low-risk scenarios, invalid early warnings caused by an overly strict detection window length are avoided. This solves the technical defect that a fixed detection window length cannot adapt to the individual risk differences of properties, realizes accurate identification of system operation anomalies and dynamic detection window length adaptation, and improves the risk control accuracy of the auction house intelligent decision-making system. Attached Figure Description

[0017] The invention will now be further described with reference to the accompanying drawings.

[0018] Figure 1 A flowchart illustrating the steps of an artificial intelligence-based information system anomaly detection method. Figure 2 This is a logic judgment diagram for an information system operation anomaly detection method based on artificial intelligence. Detailed Implementation

[0019] To make the technical means, creative features, objectives and effects of this invention easier to understand, the invention will be further described below in conjunction with specific embodiments.

[0020] Please see Figures 1-2 As shown, the present invention provides an information system operation anomaly detection method based on artificial intelligence. This method primarily addresses the poor adaptability of fixed detection window lengths used in intelligent decision-making processes in auction house operations, which may lead to errors. It marks abnormal decision points based on the integrity and logical consistency of the intelligent decision-making chain itself, then divides decision intervals according to node positions and calculates the confidence-based anomaly probability. An initial detection window length is set based on the cumulative proportion of consecutive anomaly combinations. Subsequently, the chain to be judged is slidably truncated using this initial detection window length as the analysis unit. A linked early warning is triggered by new abnormal decision points and high-risk intervals. Finally, the offline due diligence results are linked to distinguish between misjudgments and genuine anomalies. The final detection window length is dynamically adjusted based on the anomaly time characteristics, achieving accurate identification and prevention of continuous anomaly risks in auction house intelligent decision-making. Specifically, it includes the following modules: Step 1: Obtain the historical intelligent decision-making chain of the auction property business, and identify data anomalies in the historical intelligent decision-making chain, marking abnormal decision points; In step one, the historical intelligent decision chain refers to the binary 1 / 0 chain formed by integrating the judgment results of all corresponding intelligent decision points in the order of the process within the historical statistical period, with the unique ID of each property as the core identifier (example format: 1-1-1-1-1-0-1-1). The historical statistics period refers to the time period from the start of operation of the current auction property business platform to the current point in time. The definition of an intelligent decision point is: a node in the intelligent decision-making process that has judgment significance, including but not limited to: the information validity judgment node when integrating housing resources, the compliance judgment node before optimizing the display of housing resources, and the matching degree judgment node when customers select housing resources. It should be noted that each intelligent decision point corresponds to a position in the chain. 1 represents that the intelligent judgment is valid (the housing information is valid, the housing is compliant, and the demand matches, etc.), and 0 represents that the intelligent judgment is invalid (the housing information is invalid, the housing is non-compliant, and the demand does not match, etc.).

[0021] In some embodiments, the process of obtaining the historical intelligent decision chain is as follows: through the platform's online data collection module, the unique ID of each property and the judgment result of the corresponding intelligent decision point are captured synchronously and integrated into binary 1 / 0 links (i.e., the historical intelligent decision chain) in the order of the process. Definition of abnormal decision points: In the intelligent decision-making chain, decision points that fail to reflect the true status of the property or the normal output of the decision-making process due to problems such as data collection errors, transmission distortion, and abnormal format. Definition of a normal decision point: In the intelligent decision-making chain, a decision point where the data is complete and the format is compliant; In step one, the process of identifying data anomalies in the historical intelligent decision-making chain is as follows: Based on any intelligent decision-making chain from historical intelligent decision-making data: Data integrity assessment: The length of a normal intelligent decision-making chain is calculated, which is the number of intelligent decision points in the normal intelligent decision-making chain. Compare the length of the intelligent decision-making chain at the intelligent decision-making point with the length of the normal intelligent decision-making chain: If the lengths of the intelligent decision-making chains are consistent, it indicates that the data integrity check has passed. If the lengths of the intelligent decision-making chain are inconsistent, it indicates that the data integrity judgment has failed. Logical consistency check: Perform logical checks on the decision point data: If the valid identifier is 1 and the intelligent invalid identifier is 0, then the logical consistency is successful. If the valid identifier is 0 or the intelligent invalid identifier is 1, it means that the logical consistency fails. For example: if the normal chain length is 10 and the chain length to be judged is 8, mark the positions of the two missing chain links as abnormal; if the length is 12, mark the two redundant chain links as abnormal.

[0022] If the data integrity check passes and the logical consistency check passes, it means that no abnormality has occurred in the operation of the information system. If either data integrity or logical consistency fails, it indicates an abnormality in the operation of the information system. In step one, the process of marking abnormal decision points and true decision points is as follows: Based on any intelligent decision point: If no abnormalities are found in the operation of the information system, the intelligent decision point will be marked as the real decision point; If an information system malfunctions, the intelligent decision point will be marked as an abnormal decision point. It should be noted that the process of marking intelligent decision points as abnormal decision points can be as follows: if an anomaly is caused by a failure to pass the data integrity check, the intelligent decision chain is matched one by one with the normal intelligent decision chain based on the data category of the intelligent decision point (the category to which the intelligent decision point belongs), and decision points with mismatched, missing, or redundant data categories are marked as abnormal decision points; if an anomaly is caused by a failure to pass the logical consistency check, intelligent decision points with inconsistent data at the corresponding index positions of the two chains are marked as abnormal decision points.

[0023] Step 2: If an information system malfunction occurs, classify the decision intervals of the intelligent decision chain, and calculate the confidence-based anomaly probability of each decision interval based on the abnormal decision points. Perform an adaptability analysis on the abnormal decision points using different set detection window lengths to determine the initial detection window length. In step two, the process of dividing the intelligent decision-making chain into decision intervals is as follows: Position indexing of the intelligent decision-making chain: Starting from the first position (i=1) of the intelligent decision-making chain, the index values ​​are recorded from left to right as i=1,2,3,...,n; Where i is the position number of the link in the intelligent decision-making chain; Using the position number of the link in the historical intelligent decision-making chain as the dividing dimension, and setting the interval length benchmark (preferably 3), a complete intelligent decision-making chain is divided into several continuous and non-overlapping sets of sub-links. Each set of sub-links is an independent decision interval category (Category 1, Category 2, Category 3... Category a). Where a is , It is a rounding function; It should be noted that when the length of the last sub-chain is less than the interval length benchmark, it is treated as a separate decision interval category.

[0024] For example: Intelligent decision chain: 1-1-1-1-1-0-1-1-1-1, with an interval length benchmark of 3. Then, the position index is marked for the binary bits corresponding to each intelligent decision point according to the arrangement order of the chain links. The index values ​​are recorded from left to right as i=1,2,3,...,9,10. Based on the interval length benchmark, the intelligent decision chain is divided into Class 1 decision intervals (1-1-1), Class 2 decision intervals (1-1-0), Class 3 decision intervals (1-1-1), and Class 4 decision intervals (1).

[0025] In step two, the process of calculating the confidence-based outlier probability for each decision interval is as follows: Based on any decision interval category in the intelligent decision-making chain: The number of anomalous decision points in the historical intelligent decision chain within the decision interval category is counted, and the proportion of the number of anomalous decision points in the total number of intelligent decision points is calculated to obtain the confidence-based anomalous probability of the decision interval category. Among them, the total number of intelligent decision points refers to the total number of decision points in the decision interval category in the historical intelligent decision chain; It should be noted that the beneficial effect of calculating the confidence anomaly probability of various decision intervals is that: Benefit 1: Enables interval-based location of abnormal risks, providing a data foundation for subsequent adaptability analysis of abnormal decision points, and avoiding deviations caused by the initial detection window length setting relying on rough assessments; Benefit 2: It can be deeply integrated with intelligent decision-making and judgment, the process of identifying windows to be reviewed, and the dynamic adjustment mechanism of the final detection window length. It can assign higher priority to manual review for high anomaly probability intervals and simplify the review process for low anomaly probability intervals, thereby improving the accuracy of anomaly risk prevention and control throughout the entire process.

[0026] In step two, the adaptation analysis of abnormal decision points refers to the process of using the abnormal data of historical intelligent decision chains as a basis, calculating the frequency and cumulative proportion of various misjudgment combinations by counting the number of occurrences of individual abnormal decision points and continuous abnormal decision points of different lengths, quantitatively analyzing the distribution characteristics of misjudgment scenarios, and finally determining the initial detection window length by comparing it with the cumulative proportion threshold. In step two, the process of determining the initial detection window length by performing an adaptability analysis on anomaly decision points using different set detection window lengths is as follows: Based on the historical intelligent decision-making chain of auction property business: Count the occurrence of a single anomalous decision point, the occurrence of two consecutive anomalous decision points, ... the occurrence of k consecutive anomalous decision points, respectively; Set the detection window length to 1: Calculate the frequency of occurrence of individual anomaly decision points. Set the detection window length to 2: Calculate the frequency of occurrence of two consecutive abnormal decision points. Set the detection window length to k: Calculate the frequency of occurrence of k consecutive abnormal decision points. ; The frequency of occurrence is calculated as follows: The total number of intelligent decision points in the historical intelligent decision-making chain is counted and marked as the total number of frequency analysis points. Frequency of occurrence = Number of occurrences of abnormal decision points / Total number of frequency analyses; The cumulative percentages are calculated by summing the values ​​in ascending order of window length. : ; in, The cumulative percentage corresponding to the detection window length is L, where L is the detection window length (b out of b consecutive abnormal decision points). The frequency of occurrence of k consecutive abnormal decision points; Calculate the cumulative percentage corresponding to each detection window length; Based on any cumulative percentage: Compare the cumulative percentage with the cumulative percentage threshold: Preferably, the cumulative percentage threshold is 95% (covering the vast majority of abnormal risk scenarios), which can be adjusted according to actual operational needs; If the cumulative percentage is greater than or equal to the cumulative percentage threshold, then the detection window length corresponding to the cumulative percentage is marked as the initial detection window length. If the cumulative percentage is less than the cumulative percentage threshold, the comparison of the cumulative percentage corresponding to the remaining detection window length will continue. It should be noted that, since the cumulative percentage threshold ranges from [0,1], the cumulative percentage... It monotonically increases with the increase of window length L, and when L=0, =0, when L=n =1, therefore, there must exist an initial detection window length, which must be greater than or equal to the cumulative percentage threshold.

[0027] Step 3: Through the initial detection window, perform decision discrimination on the intelligent decision chain, identify the window to be reviewed, combine the confidence anomaly probability of each decision interval, determine the window warning trigger condition, and make a trigger judgment for the linkage warning; In step three, the decision discrimination of the intelligent decision chain through the initial detection window refers to: using the length of the initial detection window as a fixed analysis unit, performing location indexing, sliding window truncation, interval category matching, and preliminary verification of anomalies on the new intelligent decision chain of the property to be judged, and locking in new abnormal decision points in the chain that meet the marking rules; In step three, the process of identifying the window to be reviewed is as follows: Based on any intelligent decision-making chain: With the initial detection window length Lmin as the fixed window length, starting from the first position (position i=1) of the intelligent decision chain, the sliding interception is performed sequentially, with each sliding step being 1 decision point, until the end of the chain is intercepted; Each sub-chain segment containing Lmin consecutive decision points is a window to be judged; For example: if the initial detection window length is 2 and the intelligent decision chain is 1-0-0-1-1-0, then the intercepted windows to be judged are (1-0), (0-0), (0-1), (1-1), (1-0) in sequence.

[0028] Based on the intelligent decision point in any window to be judged, perform anomaly / misjudgment judgment: If all the smart decision points in the window to be judged are anomalous decision points, then mark the smart decision points in the window to be judged as new anomalous decision points; If there are real decision points among the intelligent decision points in the decision window, no marking process will be performed; Based on any window to be judged, extract the decision interval category to which it belongs, and retrieve the confidence anomaly probability of the decision interval for that category; It should be noted that when the window to be judged belongs to two decision interval categories, the average confidence anomaly probability of the two decision intervals is retrieved as the confidence anomaly probability of the window to be judged (if other calculation methods such as weighting by interval coverage length are used, the result is very different from the average calculation, but it will greatly increase the complexity of the calculation logic). For example, the interval length benchmark is 3, and i=1-3 is divided into Class 1 intervals (confidence anomaly probability 20%) and i=4-6 is divided into Class 2 intervals (confidence anomaly probability 40%). The initial detection window length is 2, and the window to be judged covers i=3-4, which is exactly at the intersection of the two intervals. The window length (2) is less than the interval length benchmark (3) in step 2, which belongs to the cross-interval window unit. At this time, the average probability of the two intervals (20%+40%) / 2=30% is taken as the confidence anomaly probability of the window unit.

[0029] If the confidence-based anomaly probability is greater than or equal to the preset anomaly probability, then the window to be judged is marked as the window to be reviewed. If the confidence anomaly probability is less than the preset anomaly probability, the window to be judged will be marked as a low-risk pass unit; In step three, the process of determining the window warning trigger conditions is as follows: Warning trigger condition 1: A new abnormal decision point exists in the window to be judged; Warning trigger condition two: The window to be judged is a window to be reviewed; In step three, the process of triggering the linkage warning is as follows: If both warning trigger condition one and warning trigger condition two are met simultaneously, a linked warning will be triggered. If both warning trigger condition one and warning trigger condition two are not met simultaneously, the linked warning will not be triggered. Step 4: If a linkage warning is triggered, obtain the historical due diligence result chain, identify the abnormal misjudgments in the historical intelligent decision chain, and determine the final detection window length by combining the time characteristics of the new abnormal decision point; In step four, the historical due diligence result chain refers to: after conducting offline investigations on each property, generating binary 1 / 0 links of equal length for each property's historical intelligent decision chain; In this chain, 1 represents a valid due diligence result (information is true, compliance is passed, needs are met, there are no potential risks, etc.), and 0 represents an invalid due diligence result (information is false, compliance is not passed, needs are not met, etc.).

[0030] In some embodiments, the process of obtaining the historical due diligence result chain is as follows: through the offline service archiving system, extract the offline due diligence records of the property, generate a 1 / 0 due diligence result chain of the same length as the intelligent decision chain, and associate and match it with the historical intelligent decision chain according to the same property. In step four, the process of identifying anomalies and misjudgments in the historical intelligent decision-making chain is as follows: Retrieve the historical intelligent decision chain of the housing unit corresponding to the new abnormal decision point in the judgment window triggered by the linkage warning; The historical due diligence results chain is compared with the historical intelligent decision-making chain one by one: If the historical due diligence results chain is inconsistent with the historical intelligent decision chain, it is judged as a misjudgment anomaly, and the inconsistent decision points are marked as misjudgment anomaly decision points; If the historical due diligence results chain is consistent with the historical intelligent decision chain, it is judged as a real anomaly, marked and included in the high-risk review queue, and the system data collection and transmission module fault investigation is triggered simultaneously. It should be noted that the logic for identifying anomalies lies in the following: the generation of intelligent decision-making data is based on historical due diligence results data as the core basis, and whether it consistently reflects the accuracy of the information system's transmission and processing of housing data and decision-making processes; the due diligence results data are benchmark data that have undergone on-site verification and multi-dimensional validation, and anomalies at the system operation level can be located by using this as a reference.

[0031] In step four, the process of obtaining the temporal characteristics of the new anomaly decision point is as follows: The time characteristic refers to the correlation between the number of abnormal decision points and the probability of misjudging abnormal decision points. Obtain the timestamps of the occurrence of misjudged and abnormal decision points in the historical intelligent decision-making chain, and arrange them in chronological order to obtain the sequence of misjudged and abnormal timestamps; Based on any adjacent timestamps in the misjudged anomaly timestamp sequence: Divide the time period between adjacent timestamps evenly (preferably into 10 time periods) and count the number of abnormal decision points in each time period. If the number of abnormal decision points increases, then adjacent timestamps will be marked as associated timestamp groups; The increasing number of abnormal decision points refers to the overall upward trend of the number of abnormal decision points in a time period. A small amount of non-increasing data deviation is allowed. The specific judgment standard is: within a certain statistical time period, the proportion of time periods with increasing number of abnormal points is greater than or equal to the increasing proportion standard (preferably 80%), which is considered to be increasing. If the number of abnormal decision points is not increasing, then adjacent timestamps are marked as unrelated timestamp groups; Calculate the proportion of the associated timestamp group in the sum of the associated timestamp group and the non-associated timestamp group to obtain the association determination value; If the correlation judgment value is greater than or equal to the correlation judgment threshold, it indicates that there is a positive correlation between the number of abnormal decision points and the probability of misjudging abnormal decision points. Preferably, the correlation determination threshold is 80% (set to be statistically significant), which can be adjusted according to actual operational needs; If the correlation judgment value is less than the correlation judgment threshold, it means that there is no positive correlation between the number of abnormal decision points and the probability of misjudged abnormal decision points. The correlation analysis should be performed again by expanding the historical statistical period. In step four, the process of determining the final detection window length is as follows: If there is a positive correlation between the number of anomalous decision points and the probability of misjudging anomalous decision points: Real-time acquisition of abnormal decision points, extraction of their timestamps, and chronological arrangement into an abnormal decision point sequence; Processing the difference between adjacent timestamps in the sequence of abnormal decision points; If the timestamp interval decreases, the initial detection window length is reduced by a preset window step (preferably 1 decision point) to obtain the final detection window length. The warning level of the window unit to which the abnormal decision point belongs is increased by one level (e.g., mild warning) to the moderate warning level, and the abnormal point is pushed to the manual review queue. If the timestamp interval is not decreasing, the initial detection window length will not be adjusted, and the initial detection window length will be used as the final detection window length. It should be noted that the logic for determining the final detection window length is as follows: First, the core basis for reducing the initial detection window length is the positive correlation between the number of anomalies and the probability of misjudgment, plus the decreasing timestamp interval. In this scenario, the frequency of anomalies increases and the risk of continuous misjudgment rises. Reducing the window length can improve the accuracy of capturing decision points of continuous anomalies in a small range and avoid missing high-risk anomaly combinations due to an excessively large window. Second, selecting one decision point as the adjustment step size can avoid the window length being excessively reduced due to an excessively large step size (such as two or more), which would trigger a large number of invalid warnings, increase the workload of manual review, and improve the accuracy of capturing continuous anomaly decision points.

[0032] It should be noted that the beneficial effects of obtaining the final detection window length are as follows: It transforms the initial detection window length from a general benchmark to a personalized fit, overcoming the limitations of the initial detection window length—which is generated based on the statistical analysis of all historical anomaly data and can only provide a unified analysis unit benchmark, failing to adapt to dynamic characteristics such as the real-time anomaly frequency and the strength of false positive correlations for individual properties; the final detection window length, combined with the false positive judgment results and time characteristics of the linked early warning scenario, dynamically calibrates the detection window length to accurately match the current risk status of the property, solving the problem of high-risk missed detections and low-risk false alarms caused by the absolute nature of the initial detection window length, and enabling dynamic adjustment of the detection window length.

[0033] The working principle of this invention is as follows: The historical intelligent decision-making chain of the auctioned property is divided into decision interval categories. The proportion of abnormal decision points in each interval is statistically analyzed, and the confidence level anomaly probability is calculated. Different detection window lengths are set. Then, using the detection window length as a fixed unit, the decision chain to be judged is slidably truncated to generate a window to be judged. Continuous anomalies within the judgment window are identified, and new abnormal decision points are marked. The window to be reviewed is identified by combining the interval confidence level anomaly probability. Subsequently, the offline due diligence results chain is linked to compare and verify the validity of the anomalies, distinguishing between misjudgments and real anomalies. Finally, the initial detection window length is dynamically adjusted based on the time characteristics of the abnormal decision points to obtain the final detection window length. This achieves accurate anomaly identification and dynamic detection window length adaptation, improving the risk control accuracy of the auctioned property intelligent decision-making system.

[0034] The foregoing has provided a detailed description of one embodiment of the present invention, but this description is merely a preferred embodiment and should not be construed as limiting the scope of the invention. All equivalent variations and modifications made within the scope of the present invention should still fall within the scope of the present invention.

Claims

1. A method for detecting operational anomalies in an information system based on artificial intelligence, characterized in that: include: Obtain the historical intelligent decision-making chain of auction property business, and identify data anomalies in the historical intelligent decision-making chain, marking abnormal decision points; If an information system malfunction occurs, the decision intervals of the intelligent decision chain are categorized, and the confidence-based anomaly probability of each decision interval is calculated in conjunction with the abnormal decision points. The adaptability analysis of the abnormal decision points is performed through different set detection window lengths to determine the initial detection window length. Through the initial detection window, the intelligent decision-making chain is judged and the window to be reviewed is identified. Based on the confidence anomaly probability of each decision interval, the window warning trigger condition is determined and the trigger judgment of the linkage warning is made. If a linkage warning is triggered, the historical due diligence result chain is obtained, and anomalies and misjudgments in the historical intelligent decision chain are identified. The final detection window length is determined by combining the time characteristics of the new abnormal decision point.

2. The method for detecting anomalies in the operation of an information system based on artificial intelligence according to claim 1, characterized in that: The process of identifying data anomalies in the historical intelligent decision-making chain and marking abnormal decision points is as follows: The historical intelligent decision-making chain refers to the binary 1 / 0 chain formed by integrating the judgment results of each intelligent decision point according to the process within the historical statistical period, with the unique ID of the property as the core. Intelligent decision points refer to nodes in the decision-making process that have significant implications for judgment. Based on any intelligent decision-making chain in historical intelligent decision-making data, perform data integrity judgment and logical consistency judgment respectively: Calculate the length of a normal intelligent decision-making chain; If the lengths of the intelligent decision-making chain are inconsistent, it indicates that the data integrity judgment has failed. If the valid identifier is 0 or the intelligent invalid identifier is 1, it means that the logical consistency fails. If the data integrity check and the logical consistency check fail, it indicates that the information system is malfunctioning, and the intelligent decision point will be marked as an abnormal decision point.

3. The method for detecting operational anomalies in an information system based on artificial intelligence according to claim 1, characterized in that: The process of classifying the decision intervals of the intelligent decision-making chain is as follows: Position indexing of the intelligent decision-making chain: Starting from the first position i=1 of the intelligent decision-making chain, the index values ​​are recorded from left to right as i=1,2,3,...,n; Where i is the position number of the link in the intelligent decision-making chain, and n is the total number of decision points in the intelligent decision-making chain; Using the link position number as the dividing dimension and setting the interval length benchmark, the intelligent decision-making chain is divided into several continuous and non-overlapping decision interval categories.

4. The method for detecting anomalies in the operation of an information system based on artificial intelligence according to claim 1, characterized in that: The process of calculating the confidence-based outlier probability for various decision intervals is as follows: Based on any decision interval category in the intelligent decision-making chain: Count the number of anomalous decision points in the historical intelligent decision-making chain within the decision interval category; Calculate the proportion of the number of anomalous decision points in the total number of intelligent decision points to obtain the confidence-based anomalous probability of the decision interval category; The total number of intelligent decision points refers to the total number of decision points in the decision interval category.

5. The method for detecting anomalies in the operation of an information system based on artificial intelligence according to claim 1, characterized in that: The process of determining the initial detection window length by performing adaptability analysis on anomaly decision points using different set detection window lengths is as follows: Count the number of occurrences of a single anomalous decision point, the number of occurrences of two consecutive anomalous decision points, ... the number of occurrences of n consecutive anomalous decision points in the historical intelligent decision-making chain; The total number of intelligent decision points in the historical intelligent decision-making chain is counted and marked as the total number of frequency analysis points. Calculate the occurrence frequency corresponding to each detection window length: Occurrence frequency = Number of occurrences of abnormal decision points / Total number of frequency analyses; The cumulative percentages for each detection window length are obtained by summing the results in ascending order of detection window length: ; in, This represents the cumulative percentage corresponding to each detection window length, where L is the detection window length. The frequency of occurrence of k consecutive abnormal decision points; If the cumulative percentage is greater than or equal to the cumulative percentage threshold, then the detection window length corresponding to the cumulative percentage is marked as the initial detection window length.

6. The method for detecting anomalies in the operation of an information system based on artificial intelligence according to claim 1, characterized in that: The process of performing decision-making and identifying windows to be reviewed in the intelligent decision-making chain is as follows: Based on any intelligent decision-making chain: With the initial detection window length Lmin as the fixed window length, starting from the first i=1 of the intelligent decision chain, the sliding interception is performed sequentially, with each sliding step being 1 decision point, until the end of the chain is intercepted; Each sub-chain segment containing Lmin consecutive decision points is a window to be judged; Based on the intelligent decision point in any window to be judged: If all the smart decision points in the window to be judged are anomalous decision points, then mark the smart decision points in the window to be judged as new anomalous decision points; Extract the confidence-based anomaly probability of the decision interval category to which the window to be judged belongs; If the confidence-based anomaly probability is greater than or equal to the preset anomaly probability, then the window to be judged is marked as the window to be reviewed.

7. The method for detecting operational anomalies in an information system based on artificial intelligence according to claim 1, characterized in that: Determine the conditions for triggering window alerts and make decisions on triggering linked alerts: Warning trigger condition 1: A new abnormal decision point exists in the window to be judged; Warning trigger condition two: The window to be judged is a window to be reviewed; If both warning trigger condition one and warning trigger condition two are met simultaneously, a linked warning will be triggered.

8. The method for detecting anomalies in the operation of an information system based on artificial intelligence according to claim 1, characterized in that: The process of identifying anomalies and misjudgments in the historical intelligent decision-making chain is as follows: Retrieve the historical intelligent decision chain of the housing unit corresponding to the new abnormal decision point in the judgment window triggered by the linkage warning; If the historical due diligence results chain is inconsistent with the historical intelligent decision chain, it is judged as a misjudgment anomaly, and the inconsistent decision points are marked as misjudgment anomaly decision points.

9. The method for detecting operational anomalies in an information system based on artificial intelligence according to claim 1, characterized in that: The process for obtaining the time characteristics of new anomaly decision points is as follows: Obtain the timestamps of the occurrence of misjudged and abnormal decision points in the historical intelligent decision-making chain, and arrange them in chronological order to obtain the sequence of misjudged and abnormal timestamps; Based on any adjacent timestamps in the misjudged anomaly timestamp sequence: Divide the time period between adjacent timestamps into several time periods and count the number of abnormal decision points in each time period. If the number of abnormal decision points increases, then adjacent timestamps will be marked as associated timestamp groups; If the number of abnormal decision points is not increasing, then adjacent timestamps are marked as unrelated timestamp groups; Calculate the proportion of the associated timestamp group in the sum of the associated timestamp group and the non-associated timestamp group to obtain the association determination value; If the correlation judgment value is greater than or equal to the correlation judgment threshold, it indicates that there is a positive correlation between the number of abnormal decision points and the probability of misjudging abnormal decision points.

10. The method for detecting operational anomalies in an information system based on artificial intelligence according to claim 1, characterized in that: The process of determining the final detection window length by considering the temporal characteristics of the new anomaly decision point is as follows: If there is a positive correlation between the number of anomalous decision points and the probability of misjudging anomalous decision points: Real-time acquisition of abnormal decision points, extraction of their timestamps, and chronological arrangement into an abnormal decision point sequence; Processing the difference between adjacent timestamps in the sequence of abnormal decision points; If the timestamp interval decreases, the initial detection window length is reduced by a preset window step to obtain the final detection window length. If the timestamp interval is not decreasing, the initial detection window length will not be adjusted, and the initial detection window length will be used as the final detection window length.

Images