Business system anomaly detection method and device, computer device and storage medium

Abstract

Embodiments of the present application disclose an abnormality detection method and device for a business system, a computer device and a storage medium. The method comprises: obtaining index data corresponding to a plurality of business indexes in a business system, wherein the index data corresponding to different business indexes correspond to different data window lengths and data aggregation periods; for each business index, selecting at least two abnormality detection algorithms for the business index from a preset algorithm set according to the business type corresponding to the business index, to obtain an algorithm candidate pool corresponding to each business index; for each business index, performing abnormality detection on the corresponding index data by using an abnormality detection algorithm in the corresponding algorithm candidate pool, to obtain a target abnormality score corresponding to each business index; and determining an abnormality detection result of the business system according to a plurality of target abnormality scores. The embodiments of the present application can improve the abnormality detection accuracy of the business system.

Description

Technical Field

[0001] This application relates to the field of data processing technology, and in particular to methods, apparatus, computer equipment and storage media for detecting anomalies in business systems. Background Technology

[0002] The stable operation of financial institutions' business systems is directly related to the normal conduct of business, user experience, and fund security. Therefore, it is necessary to conduct comprehensive and accurate anomaly detection on the business systems.

[0003] However, existing monitoring systems typically use fixed thresholds for metrics to detect anomalies in business systems, failing to identify slow degradation or periodic, sporadic failures. While these issues may not trigger alarms, they continuously harm user experience and business outcomes.

[0004] It is evident that existing monitoring systems cannot meet the actual monitoring needs of business operations. In order to ensure the service quality of business systems, there is an urgent need for a method to improve the accuracy of anomaly detection in business systems. Summary of the Invention

[0005] This application provides an anomaly detection method, apparatus, computer equipment, and storage medium for business systems, which can improve the accuracy of anomaly detection in business systems.

[0006] In a first aspect, embodiments of this application provide an anomaly detection method for a business system, comprising: Obtain the indicator data corresponding to multiple business indicators in the business system. The indicator data corresponding to different business indicators correspond to different data window lengths and data aggregation periods. For each of the aforementioned business metrics, at least two anomaly detection algorithms are selected from a preset algorithm set according to the business type corresponding to the business metrics, thereby obtaining an algorithm candidate pool corresponding to each business metric. For each of the aforementioned business metrics, an anomaly detection algorithm from the corresponding algorithm candidate pool is used to perform anomaly detection on the corresponding metric data, thereby obtaining the target anomaly score corresponding to each of the aforementioned business metrics. The anomaly detection result of the business system is determined based on multiple target anomaly scores.

[0007] In some embodiments, the preset algorithm set includes a period deviation algorithm, a trend emergence algorithm, a pattern disruption algorithm, and a correlation break algorithm. The period deviation algorithm is a period-on-month anomaly detection algorithm; the trend emergence algorithm is a Mann-Kendall trend significance detection algorithm; the pattern disruption algorithm is a Z-score statistical outlier detection algorithm; and the correlation break algorithm is a dual-indicator correlation anomaly detection algorithm. For each business indicator, at least two anomaly detection algorithms are selected from the preset algorithm set according to the business type corresponding to the business indicator, resulting in an algorithm candidate pool for each business indicator, including: If the business type corresponding to the business indicator is real-time synchronization business, then the business indicator selects the pattern destruction algorithm and the correlation breakage algorithm to form the algorithm candidate pool corresponding to the business indicator. If the business type corresponding to the business indicator is an asynchronous long-link business, then the trend emergence algorithm and the same-period deviation algorithm are selected for the business indicator to form the algorithm candidate pool corresponding to the business indicator; If the business type corresponding to the business indicator is a batch-triggered business, then a synchronous deviation algorithm and a pattern disruption algorithm are selected for the business indicator to form the algorithm candidate pool corresponding to the business indicator.

[0008] In some embodiments, before performing anomaly detection on the corresponding indicator data using the anomaly detection algorithm from the corresponding algorithm candidate pool for each of the business indicators to obtain the target anomaly score corresponding to each of the business indicators, the method further includes: Multi-dimensional feature extraction is performed on the indicator data corresponding to each of the aforementioned business indicators to obtain the fluctuation characteristics, data density characteristics, and business rhythm characteristics corresponding to each of the aforementioned business indicators. Based on the fluctuation characteristics and data density characteristics corresponding to each of the business indicators, target anomaly detection algorithms are selected for each of the business indicators from the corresponding algorithm candidate pool. Based on the business rhythm characteristics corresponding to each of the aforementioned business indicators, the detection parameters of the corresponding target anomaly detection algorithms are adjusted to obtain the adjusted target anomaly detection algorithms corresponding to each business indicator. For each of the aforementioned business metrics, an anomaly detection algorithm from the corresponding candidate pool is used to perform anomaly detection on the corresponding metric data, obtaining a target anomaly score for each of the aforementioned business metrics, including: For each of the aforementioned business metrics, the adjusted target anomaly detection algorithm from the corresponding algorithm candidate pool is used to perform anomaly detection on the corresponding metric data, thereby obtaining the target anomaly score corresponding to each of the aforementioned business metrics.

[0009] In some embodiments, the step of selecting a target anomaly detection algorithm from the corresponding algorithm candidate pool for each of the business indicators based on the fluctuation characteristics and data density characteristics corresponding to each of the business indicators includes: Based on the fluctuation characteristics of each business indicator, the optimal candidate algorithm is selected from the corresponding algorithm candidate pool for each business indicator. Based on the data density characteristics corresponding to each of the aforementioned business indicators, determine whether the corresponding candidate optimal algorithm is runnable; If it is runnable, the candidate optimal algorithm is determined as the target anomaly detection algorithm for the corresponding business indicator; If it cannot be run, then the anomaly detection algorithm other than the candidate optimal algorithm in the corresponding algorithm candidate pool will be used as the target anomaly detection algorithm.

[0010] In some embodiments, the step of using an anomaly detection algorithm from the corresponding algorithm candidate pool to perform anomaly detection on the corresponding indicator data for each of the business indicators, and obtaining a target anomaly score for each of the business indicators, includes: For each of the aforementioned business metrics, multiple anomaly detection algorithms from the corresponding algorithm candidate pool are used to perform anomaly detection on the corresponding metric data, and the initial anomaly score corresponding to each anomaly detection algorithm is obtained. For each of the aforementioned business metrics, the initial anomaly scores are weighted and fused to obtain the target anomaly score corresponding to each of the aforementioned business metrics.

[0011] In some embodiments, determining the anomaly detection result of the business system based on multiple target anomaly scores includes: Obtain the weights of the various business metrics respectively; The system anomaly score of the business system is determined based on the multiple target anomaly scores and the corresponding indicator weights for each target anomaly score. The anomaly detection result is determined based on the system anomaly score.

[0012] In some embodiments, before determining the anomaly detection result of the business system based on multiple target anomaly scores, the method further includes: Obtain service metric data corresponding to the third-party services that the business system relies on; Align the service indicator data with the business cycle, and calculate the deviation of the service indicator data from the SLA standard value or the historical benchmark value according to the preset SLA service level agreement standard to obtain the abnormal score of the third-party service. The step of determining the anomaly detection result of the business system based on multiple target anomaly scores includes: The anomaly detection result is determined based on the anomaly scores of the multiple targets and the anomaly scores of the third-party services.

[0013] Secondly, embodiments of this application also provide an anomaly detection device for a business system, comprising: The transceiver unit is used to acquire the indicator data corresponding to multiple business indicators in the business system. The indicator data corresponding to different business indicators are respectively associated with different data window lengths and data aggregation periods. The processing unit is configured to, for each of the business indicators, select at least two anomaly detection algorithms from a preset algorithm set for the business indicator according to the business type corresponding to the business indicator, and obtain an algorithm candidate pool corresponding to each business indicator; for each of the business indicators, use the anomaly detection algorithm in the corresponding algorithm candidate pool to perform anomaly detection on the corresponding indicator data, and obtain a target anomaly score corresponding to each of the business indicators; and determine the anomaly detection result of the business system based on multiple target anomaly scores.

[0014] Thirdly, embodiments of this application also provide a computer device, which includes a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the above-described method.

[0015] Fourthly, embodiments of this application also provide a computer-readable storage medium storing a computer program, the computer program including program instructions that, when executed by a processor, can implement the above-described method.

[0016] This application provides an anomaly detection method, apparatus, computer equipment, and storage medium for business systems. Firstly, this solution employs multi-business indicator collaborative detection, comprehensively covering key monitoring dimensions of the business system. This provides a more realistic and comprehensive reflection of the overall operational status of the business system, avoiding the omission of system anomalies due to monitoring a single indicator. Secondly, this solution constructs separate algorithm candidate pools for each business indicator, rather than using a unified fixed algorithm. This ensures that the algorithm is compatible with the business type of each indicator, reducing false alarms and missed alarms caused by mismatches between the algorithm and indicator characteristics. Thirdly, the system anomaly detection result is determined based on the comprehensive scores of multiple target anomalies, achieving the fusion of anomaly information from multiple indicators. This avoids false alarms and missed alarms caused by random fluctuations in a single indicator, significantly improving the accuracy and reliability of anomaly detection in the business system and meeting the monitoring needs of actual business operations. Fourthly, this solution sets different data window lengths and data aggregation periods for the indicator data of different business indicators, avoiding false alarms and missed alarms caused by fixed period settings. For example, short periods are adapted to business indicators of high-frequency businesses, enabling timely detection of instantaneous anomalies; long periods are adapted to business indicators of low-frequency businesses, filtering out invalid fluctuations and focusing on core anomalies, while reducing data processing volume and improving detection efficiency. Attached Figure Description

[0017] To more clearly illustrate the technical solutions of the embodiments of this application, the drawings used in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0018] Figure 1 A flowchart illustrating the anomaly detection method for a business system provided in this application embodiment; Figure 2 A schematic diagram of a sub-process of the anomaly detection method for a business system provided in this application embodiment; Figure 3 Another flowchart illustrating the anomaly detection method for a business system provided in this application embodiment; Figure 4 A schematic block diagram of an anomaly detection device for a business system provided in an embodiment of this application; Figure 5 A schematic block diagram of a computer device provided in an embodiment of this application. Detailed Implementation

[0019] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this application. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0020] It should be noted that any AI models, software tools, or components not belonging to this company appearing in the embodiments of this application are merely illustrative examples and do not represent actual use. All user personal information involved in the embodiments of this application has been obtained by authorized entities (who have known and consented) or fully authorized by all parties through various legal and compliant means. The collection, storage, use, processing, transmission, provision, and disclosure of the information, data, and signals involved all comply with relevant laws and regulations and do not violate public order and good morals.

[0021] It should be understood that, when used in this specification and the appended claims, the terms "comprising" and "including" indicate the presence of the described features, integrals, steps, operations, elements and / or components, but do not exclude the presence or addition of one or more other features, integrals, steps, operations, elements, components and / or collections thereof.

[0022] It should also be understood that the terminology used in this application specification is for the purpose of describing particular embodiments only and is not intended to limit the application. As used in this application specification and the appended claims, the singular forms “a,” “an,” and “the” are intended to include the plural forms unless the context clearly indicates otherwise.

[0023] It should also be further understood that the term “and / or” as used in this application specification and the appended claims means any combination of one or more of the associated listed items and all possible combinations, and includes such combinations.

[0024] This application provides an anomaly detection method, apparatus, computer equipment, and storage medium for business systems.

[0025] The execution subject of the anomaly detection method of the business system can be the anomaly detection device of the business system provided in the embodiments of this application, or a computer device that integrates the anomaly detection device of the business system. The anomaly detection device of the business system can be implemented in hardware or software, and the computer device can be a terminal or a server.

[0026] This application uses a payment system as an example to illustrate the anomaly detection method for a business system provided in this application. It should be noted that the business system in this application can also be other types of business systems, such as clearing and settlement systems, online banking systems, etc. This application does not limit the specific type of business system.

[0027] Figure 1 This is a flowchart illustrating the anomaly detection method for a business system provided in an embodiment of this application. For example... Figure 1 As shown, the method includes the following steps S110-S140.

[0028] S110. Obtain the indicator data corresponding to multiple business indicators in the business system. The indicator data corresponding to different business indicators correspond to different data window lengths and data aggregation periods.

[0029] In this embodiment, a dedicated data window length and data aggregation period are set for each core business indicator of the payment system and other business systems, and the corresponding indicator data is obtained according to the settings, rather than using a uniform period and window for all indicators.

[0030] Among them, the data window length refers to the time range of indicator data used for anomaly detection. Simply put, it is the time period of indicator data to be analyzed. For example, a short window (1 day, 1 week) is used to capture short-term fluctuations in high-frequency business, while a long window (1 month, several months) is used to analyze the long-term trend of low-frequency business, avoiding the defect of relying only on long-term windows and ignoring short windows.

[0031] Data aggregation cycle: refers to the time interval for summarizing and statistically analyzing the original detailed data. Simply put, it is how often the original data is summarized, such as hourly aggregation, daily aggregation, and weekly aggregation. The aggregated data is more concise, reduces interference from invalid data, and adapts to the fluctuation frequency of different business indicators.

[0032] The business metrics for the payment system in this application include payment success rate, payment response time, refund review time, and settlement success rate.

[0033] In one embodiment, the metrics for payment success rate and payment response time are detailed data aggregated hourly on the same day, the refund review time is detailed data aggregated daily on the same day, and the settlement success rate is detailed data aggregated weekly on the same week.

[0034] S120. For each of the business metrics, select at least two anomaly detection algorithms from a preset algorithm set according to the business type corresponding to the business metrics, and obtain an algorithm candidate pool corresponding to each business metric.

[0035] In this embodiment, a number of different types of anomaly detection algorithms are pre-set in the preset algorithm set. Before performing anomaly detection on each business indicator, it is first necessary to determine the algorithm candidate pool corresponding to each business indicator.

[0036] Specifically, based on the pre-set correspondence between business types and anomaly detection algorithms, and the business type of each business indicator, at least two anomaly detection algorithms are selected from the preset algorithm set for each business indicator.

[0037] The business type of each business indicator is predetermined based on the processing method, real-time requirements, and periodic patterns of the business process described by that indicator. In other words, a correspondence between business indicators and business types is pre-set, and based on this correspondence, the business type corresponding to each business indicator can be determined.

[0038] Specifically, the business types include: real-time synchronous business, asynchronous long-chain business, and batch-triggered business, among which: The business types in this application embodiment are uniquely categorized based on business execution latency, processing link length, triggering method (real-time triggering by external events, timed triggering by internal systems, or automatic batch triggering by the system), and data aggregation cycle. The specific definitions are as follows: Real-time synchronization services: short latency (second-level completion), short processing links (such as single links), triggered by external events in real time, and data aggregation cycle is less than or equal to the first preset cycle length (such as 5 minutes). Asynchronous long-link business: long latency (time ≥ 1 hour), long processing link (multi-step flow), triggered by external event and executed asynchronously, and the data aggregation period is greater than or equal to the second preset period length (e.g., 1 hour). Batch-triggered business: executed in a concentrated period of time (with variable latency), with centralized processing links (batch processing), triggered by internal system timed triggering or automatic system batch triggering, and the data aggregation period is greater than or equal to the length of the third preset period (e.g., 12 hours). Specifically: Real-time synchronous business: such as payment success rate, payment response time and other indicators, the corresponding business process indicators are characterized by high real-time, high frequency and instant return of results; Asynchronous long-link business: such as refund review time, abnormal transaction investigation time, etc., the corresponding data flow links of the business process are long, and there are characteristics of manual or multi-system asynchronous processing and delayed return of results. Batch-triggered business: such as the clearing success rate, the corresponding indicator data of the business process has the characteristics of non-real-time, batch-based centralized execution at fixed time.

[0039] In some embodiments, the preset algorithm set includes a synchronous deviation algorithm, a trend emergence algorithm, a pattern breaking algorithm, and a correlation break algorithm. Please refer to [link to relevant documentation]. Figure 2 Step S120 includes: S1201. If the business type corresponding to the business indicator is real-time synchronization business, then the business indicator selection pattern destruction algorithm and correlation breakage algorithm are used to form the algorithm candidate pool corresponding to the business indicator. S1202. If the business type corresponding to the business indicator is an asynchronous long-link business, then select the trend initial appearance algorithm and the same-period deviation algorithm for the business indicator to form the algorithm candidate pool corresponding to the business indicator. S1203. If the business type corresponding to the business indicator is a batch-triggered business, then select the synchronous deviation algorithm and the pattern destruction algorithm for the business indicator to form the algorithm candidate pool corresponding to the business indicator.

[0040] Among them, the synchronous deviation algorithm is used to compare the degree of deviation between the current data and the historical data of the same period; the trend emergence algorithm is used to detect the continuous changing trend of the data; the pattern destruction algorithm is used to detect sudden jumps, sudden increases and decreases in the data; and the correlation break algorithm is used to detect abnormal breaks in the correlation between multiple indicators.

[0041] In this embodiment, payment success rate is an instantaneous business indicator, and the corresponding algorithm candidate pool includes: pattern disruption algorithm and correlation breakage algorithm; payment response time is an instantaneous business indicator, and the corresponding algorithm candidate pool includes: pattern disruption algorithm and correlation breakage algorithm; refund review time is an asynchronous long-link business indicator, and the corresponding algorithm candidate pool includes: trend emergence algorithm and synchronous deviation algorithm; settlement success rate is a batch-triggered business indicator, and the corresponding algorithm candidate pool includes: synchronous deviation algorithm and pattern disruption algorithm.

[0042] The following explains the same-period deviation algorithm, trend emergence algorithm, pattern destruction algorithm, and correlation break algorithm of this application. Specifically, the same-period deviation algorithm is a same-period month-on-month anomaly detection algorithm; the trend emergence algorithm is a Mann-Kendall trend significance detection algorithm; the pattern destruction algorithm is a Z-score statistical outlier detection algorithm; and the correlation break algorithm is a dual-index correlation anomaly detection algorithm. Synchronous deviation algorithm: Calculation formula: ; Wherein, Vnow is the actual value of the indicator in the current detection period, Vhist is the historical value of the corresponding indicator in the previous detection period, Ratio is the absolute value of the target anomaly score of the corresponding business indicator, and there are also detection parameters, such as 20%. If the target anomaly score is greater than 20%, the indicator is determined to be abnormal.

[0043] For example, if a settlement is performed every Friday, the aggregation cycle is every Friday. The settlement success rate of this Friday is the actual value of the indicator in the current detection cycle, and the settlement success rate of last Friday is the historical value of the indicator in the previous detection cycle. The data window length is from last Friday to this Friday. Here, this Friday specifically means the Friday closest to the current anomaly detection cycle of the business system.

[0044] Trend emergence algorithm: Calculation formula: ; Symbol explanation: Vcurrent is the indicator value for the current period; Vprev1 and Vprev2 are the indicator values ​​for the previous 1 and 2 detection periods, respectively; P is the P-value for the trend significance test (p<0.05 indicates that the trend is statistically significant, excluding random fluctuations). If the current business indicator conforms to the calculation formula of the trend emergence algorithm, it will alert you that the indicator is abnormal.

[0045] Among them, the anomaly score of the trend emergence algorithm is related to the specific values ​​of Vcurrent, Vprev1, Vprev2 and P. The more obvious the trend of Vcurrent, Vprev1 and Vprev2 continuously rising or falling (such as the larger the difference between two adjacent values), and the smaller the value of P, the larger the anomaly score.

[0046] For example, if a certain indicator shows a step-like increase for three consecutive testing periods, and this trend passes the significance test (P<0.05), it is determined to be a trend of system performance degradation, providing an early warning of potential performance bottlenecks.

[0047] The P-value is calculated using time-series data of the indicator within the corresponding data window length as a sample, and is obtained using the Mann-Kendall trend test or linear regression significance test.

[0048] In this algorithm, the detection parameters are the change amplitude of the indicators in adjacent periods and the warning thresholds corresponding to the P-values.

[0049] Pattern violation algorithm: Calculation formula: ; Where Vnow is the current actual value of the indicator, Muhist is the mean of the indicator's historical data (the historical normal fluctuation benchmark), Sigmahist is the standard deviation of the indicator's historical data (measuring the historical fluctuation amplitude), and p is the target anomaly score obtained based on the pattern destruction algorithm.

[0050] For example, if p exceeds the preset detection parameter (e.g., twice the standard deviation, p > 2), it falls outside the historical normal fluctuation range and is considered a statistical outlier. This algorithm is most effective for real-time transaction scenarios, enabling minute-level detection and quickly identifying sudden failures such as a precipitous drop in payment success rate or a sudden increase in payment response time.

[0051] Correlation breakage algorithm: Calculation formula: ; Where r is the correlation coefficient between payment success rate and average payment latency, and its value ranges from [-1, 1]. For example, in normal business scenarios, a longer average payment time will lead to a lower payment success rate (the two are significantly negatively correlated, and the absolute value of the correlation coefficient is usually greater than the detection parameter (e.g., 0.3)). If no significant change is detected in the payment time, but the payment success rate drops sharply, it indicates that the inherent correlation between the two has disappeared (e.g., correlation coefficient r < 0.3), which is judged as an anomaly in the code logic or an error in the parameter configuration. The link logic needs to be checked in detail. In this case, a higher anomaly score is assigned to the corresponding indicator.

[0052] S130. For each of the business indicators, an anomaly detection algorithm from the corresponding algorithm candidate pool is used to perform anomaly detection on the corresponding indicator data to obtain the target anomaly score corresponding to each of the business indicators.

[0053] In this embodiment, when determining the algorithm candidate pool corresponding to each business indicator, anomaly detection is performed on the corresponding indicator data based on the anomaly detection algorithm in the algorithm candidate pool to obtain the target anomaly score corresponding to each business indicator. The target anomaly score is used to quantify the degree to which the indicator deviates from the normal pattern. The higher the score, the more serious the anomaly.

[0054] In some embodiments, in order to reduce computational load and eliminate the impact of unsuitable algorithms on anomaly detection, an anomaly detection algorithm that is most suitable for the current metric can be selected from the algorithm candidate pool as the target anomaly detection algorithm to perform anomaly detection on the metric data.

[0055] At this point, after step S120 and before step S130, please refer to... Figure 3 The methods also include: S150. Perform multi-dimensional feature extraction on the indicator data corresponding to each of the business indicators to obtain the fluctuation characteristics, data density characteristics and business rhythm characteristics corresponding to each of the business indicators. Specifically, fluctuation characteristics are statistically calculated based on the magnitude of change, number of sudden changes, and continuous rise and fall trends of the indicators within the corresponding data window. Fluctuation characteristics include stable characteristics, sudden characteristics, drifting characteristics, and periodic characteristics. For example, small fluctuations in payment response time are considered stable; a sudden drop in payment success rate during a major promotion is considered sudden; a gradual increase in refund review time is considered drifting; and fluctuations that conform to periodic characteristics are considered periodic.

[0056] Data density features are determined based on the data aggregation period, or directly by the aggregation period and the data window length. Data density features include high-density features, medium-density features, and low-density features. Among them, the shorter the aggregation period and the more data points per unit time, the higher the data density; the longer the aggregation period and the fewer data points, the lower the data density.

[0057] In one embodiment, the data density feature determination rule is as follows: high-density features correspond to data aggregated at the hourly or minute level; medium-density features correspond to data aggregated at the 2-hour to daily level; and low-density features correspond to data aggregated at the daily or weekly level.

[0058] For example, payment success rate (aggregated hourly) is high density; refund review time (aggregated daily) is medium density; and settlement success rate (aggregated weekly) is low density.

[0059] Business rhythm features are obtained directly through time tag matching: the statistical time corresponding to the indicator data is compared with the preset business rhythm rules. Business rhythm features include: date type dimension features and time period type dimension features. The date type dimension includes weekdays, weekends, holidays, promotional days, month-end closing days, and quarter-end days; the time period type dimension includes end-of-day batch processing periods, daytime peak periods, and nighttime quiet periods. Specific features within the date type dimension and time period type dimension have priority ranking. If an indicator corresponds to several features, the feature with the highest priority is used as the corresponding date type dimension feature or time period type dimension feature. For example, if a feature corresponds to weekdays and promotional days, and the priority of promotional days is higher than that of weekdays, then the corresponding date type dimension feature is the promotional day.

[0060] For example, multi-dimensional features were extracted from the data corresponding to payment success rate, payment response time, refund review time, and settlement success rate. The fluctuation characteristics of payment success rate are sudden (such as sudden fluctuations on major promotional days), medium density (aggregated once per hour), and business rhythm characteristics are major promotional days. The fluctuation characteristics of payment response time are stable (no obvious sudden fluctuations), high density (aggregated once every 10 minutes), and business rhythm characteristics are weekdays. The fluctuation characteristics of refund review time are drifting (slowly increasing), low density (aggregated once per day), and business rhythm characteristics are weekends. The fluctuation characteristics of settlement success rate are stable, low density (aggregated once per week), and business rhythm characteristics are monthly settlement days.

[0061] S160. Based on the fluctuation characteristics and data density characteristics corresponding to each of the business indicators, select target anomaly detection algorithms for each of the business indicators from the corresponding algorithm candidate pool.

[0062] In one embodiment, step a1302 includes: selecting candidate optimal algorithms from the corresponding algorithm candidate pool for each business indicator based on the fluctuation characteristics corresponding to each business indicator; determining whether the corresponding candidate optimal algorithms are runnable based on the data density characteristics corresponding to each business indicator; if runnable, determining the candidate optimal algorithm as the target anomaly detection algorithm for the corresponding business indicator; if not runnable, using an anomaly detection algorithm other than the candidate optimal algorithm in the corresponding algorithm candidate pool as the target anomaly detection algorithm.

[0063] Specifically, in one embodiment, the algorithm for selecting candidate optimal algorithms based on fluctuation characteristics includes: Payment success rate (fluctuation characteristic is sudden): The candidate pool is (pattern violation algorithm, correlation break algorithm). Sudden fluctuations are adapted to the pattern violation algorithm, and the pattern violation algorithm is selected as the candidate optimal algorithm; Payment response time (fluctuation characteristic is stable): The candidate pool is (pattern violation algorithm, correlation break algorithm). Stable fluctuations are adapted to the correlation break algorithm, and the correlation break algorithm is selected as the candidate optimal algorithm. Refund review time (fluctuation characteristics are drifting): The candidate pool is (trend emergence algorithm, same period deviation algorithm). The drifting fluctuation is adapted to the trend emergence algorithm, and the trend emergence algorithm is selected as the candidate optimal algorithm. Liquidation success rate (fluctuation characteristics are stable): The candidate pool consists of (synchronous deviation algorithm and pattern destruction algorithm). Stable fluctuations are adapted to the synchronous deviation algorithm, and the synchronous deviation algorithm is selected as the candidate optimal algorithm.

[0064] It should be noted that if the algorithm that is suitable for the fluctuation characteristics is not in the corresponding candidate pool, the candidate optimal algorithm is selected according to the default priority of each algorithm in the candidate pool. For example, suppose that the sudden fluctuation is suitable for the synchronous deviation algorithm, but there is no such algorithm in the corresponding candidate pool, and the algorithm with the highest default priority in the candidate pool is the correlation break algorithm, then the correlation break algorithm is determined as the candidate optimal algorithm.

[0065] Determining whether a candidate optimal algorithm is runnable based on data density characteristics specifically includes: For example, for payment success rate (medium density), the pattern disruption algorithm can be run on medium density data, and the pattern disruption algorithm is identified as the target anomaly detection algorithm; for payment response time (high density), the correlation break algorithm can be run on high density data, and the correlation break algorithm is identified as the target anomaly detection algorithm; for refund review time (low density), the trend emergence algorithm can be run on low density data, and the trend emergence algorithm is identified as the target anomaly detection algorithm. Regarding the liquidation success rate, assuming that the data density of the liquidation success rate is high, the synchronous deviation algorithm cannot run under high-density data (based on the data density characteristics, the corresponding candidate optimal algorithm cannot run). Another algorithm (pattern violation algorithm) in the candidate pool is selected as the target anomaly detection algorithm. In this example, the target anomaly detection algorithms for the four indicators were finally determined as follows: payment success rate (pattern violation algorithm), payment response time (correlation break algorithm), refund review time (trend emergence algorithm), and settlement success rate (consecutive deviation algorithm).

[0066] As can be seen, this embodiment clarifies the specific selection process for target anomaly detection algorithms. First, candidate optimal algorithms are selected based on fluctuation characteristics, and then the runnability of the algorithms is judged by combining data density characteristics. This ensures that the selected algorithms not only adapt to the fluctuation characteristics of the indicators but also to the density characteristics of the data, avoiding the inability of the algorithms to run or the failure of detection due to data density mismatch. At the same time, a mechanism is set up to select other algorithms from the candidate pool when the candidate optimal algorithm cannot run, ensuring that each indicator has a suitable target anomaly detection algorithm, avoiding detection interruption caused by the inability of the algorithm to run, and improving the stability and reliability of detection.

[0067] S170. Based on the business rhythm characteristics corresponding to each of the business indicators, the detection parameters of the corresponding target anomaly detection algorithms are adjusted to obtain the adjusted target anomaly detection algorithms corresponding to each business indicator.

[0068] For example, regarding payment success rate (on major promotional days): increase the fluctuation tolerance threshold of the pattern disruption algorithm (to avoid normal traffic fluctuations on major promotional days being misjudged as abnormal); regarding payment response time (weekdays): adopt the default detection threshold of the pattern disruption algorithm; regarding refund review time (weekends): increase the anomaly judgment threshold of the trend emergence algorithm by 30% (due to decreased manual processing efficiency on weekends, a slight increase in review time is normal). Regarding the settlement success rate (monthly closing date): Increase the tolerance for deviations in the same period deviation algorithm (a small deviation is normal due to the large volume of settlement data on the monthly closing date). At this point, step S130 specifically includes: for each of the business indicators, using the adjusted target anomaly detection algorithm in the corresponding algorithm candidate pool to perform anomaly detection on the corresponding indicator data, and obtaining the target anomaly score corresponding to each of the business indicators.

[0069] This embodiment comprehensively captures the operational characteristics of various indicators through multi-dimensional feature extraction, providing a precise basis for algorithm selection and parameter adjustment; based on the target anomaly detection algorithm adapted to feature selection, the adaptability of the algorithm and indicators is further improved; combined with the business rhythm characteristics, the algorithm parameters are adjusted to fit the actual business scenarios such as promotional days, weekends, and monthly settlement days, avoiding false alarms and missed alarms caused by differences in business scenarios, significantly improving the accuracy of anomaly detection, and making the algorithm more in line with the actual business operation rules.

[0070] The previous embodiment described selecting a target anomaly detection algorithm for each business indicator to calculate the anomaly score. In another embodiment, the anomaly score can be calculated by weighted fusion based on all anomaly detection algorithms in the algorithm candidate pool. In this case, specifically, step 130 includes: for each business indicator, using multiple anomaly detection algorithms in the corresponding algorithm candidate pool to perform anomaly detection on the corresponding indicator data to obtain the initial anomaly score corresponding to each anomaly detection algorithm; for each business indicator, weighted fusion of the multiple initial anomaly scores to obtain the target anomaly score corresponding to each business indicator.

[0071] In this embodiment, for each candidate pool of algorithms, corresponding weights are set for each algorithm in the pool, and then the abnormal scores obtained by the corresponding algorithms are weighted and fused based on the set weights to obtain the target abnormal score.

[0072] In this embodiment, the algorithm weights of each algorithm in the candidate pool are determined based on business type characteristics and indicator sensitivity. Among them, business type characteristics represent the business's tolerance to different anomaly types and risk priority; indicator sensitivity represents the indicator's response strength and identification accuracy to various anomalies. Anomaly detection algorithms with high business risk and strong indicator response are given higher weights to improve detection accuracy and reduce false alarm rate.

[0073] For example, for the algorithm corresponding to payment success rate, the pattern violation algorithm has a weight of 60% and a corresponding anomaly score of 8; the correlation break algorithm has a weight of 40% and a corresponding anomaly score of 10. The target anomaly score = 8 × 60% + 10 × 40% = 8.8 points. For the algorithm corresponding to the refund review time: the trend emergence algorithm has a weight of 70%, corresponding to an anomaly score of 10; the same period deviation algorithm has a weight of 30%, corresponding to an anomaly score of 12; the target anomaly score = 10 × 70% + 12 × 30% = 10.6 points. As can be seen, this embodiment obtains multiple initial anomaly scores through multiple algorithms, and then performs weighted fusion to avoid the limitations of single algorithm detection. By combining the algorithm with the weights of the indicators' adaptability, the target anomaly score can more accurately reflect the actual degree of anomaly of the indicator, reducing the impact of misjudgment by a single algorithm. At the same time, the weighted fusion method improves the reliability of the target anomaly score, providing a more accurate basis for subsequent overall anomaly judgment of the system.

[0074] S140. Determine the anomaly detection result of the business system based on the multiple target anomaly scores.

[0075] In this embodiment, the weights of each business indicator can be preset according to their importance in the payment system, such as payment success rate (40%), payment response time (25%), refund review time (20%), and settlement success rate (15%). Then, the system anomaly score of the payment system is calculated based on the target anomaly score and corresponding weight of each indicator. The system anomaly score is used to characterize the degree of degradation of the overall service quality of the business system.

[0076] Finally, the anomaly detection result is determined based on the system anomaly score. Specifically, the anomaly detection result includes the system anomaly score, the system anomaly level, and the anomaly scores corresponding to each business indicator. The system anomaly level is determined based on the system anomaly score and a preset system anomaly level threshold. For example, a system anomaly score of 0-20 is normal, 21-40 is slightly abnormal, 41-70 is moderately abnormal, and 71-100 is severely abnormal.

[0077] As can be seen, this embodiment clarifies the specific process for determining system anomaly detection results, reflects the business importance of each indicator through indicator weights, and makes the system anomaly score more closely match actual business needs; it presets clear anomaly level thresholds, making the system anomaly detection results more intuitive and interpretable, and facilitating maintenance personnel to quickly grasp the degree of system anomaly; at the same time, the quantified system anomaly score and clear anomaly level solve the problem that existing technologies cannot accurately judge the severity of system anomalies, and improve the practicality and guidance of anomaly detection results.

[0078] Furthermore, before determining the anomaly detection result of the business system based on multiple target anomaly scores, the method further includes: Obtain service indicator data corresponding to the third-party services on which the business system depends; align the service indicator data with the business cycle, and calculate the deviation of the service indicator data from the SLA standard value or the historical benchmark value according to the preset SLA service level agreement standard to obtain the abnormal score of the third-party service. At this point, determining the anomaly detection result of the business system based on multiple target anomaly scores includes: The anomaly detection result is determined based on the anomaly scores of the multiple targets and the anomaly scores of the third-party services.

[0079] For example, select two third-party services (bank interface and payment channel) on which the payment system depends, and obtain their service indicator data: response time and call success rate of the bank interface; response time and availability of the payment channel. Then, align the service indicator data with the business cycle, that is, ensure that the indicator data of the third-party services (bank interface, payment channel, etc.) are consistent with the business indicators of the business system itself in terms of statistical period, time granularity, and start and end times, so that both are on the same time scale. Then, calculate the deviation based on the SLA service level agreement standard. For example, if the preset bank interface response time SLA standard is ≤200ms, and the daily average bank interface response time is 260ms, the deviation = (260-200) / 200×100% = 30%; if the preset payment channel availability SLA standard is ≥99.9%, and the daily availability is 99.7%, the deviation = (99.9%-99.7%) / 99.9%×100%. ≈0.2%; Finally, based on the deviation measurement, the anomaly score is quantified (the higher the deviation, the higher the score). The bank interface anomaly score is 30 points, the payment channel anomaly score is 2 points, and the overall anomaly score of the third-party service is 30×60% + 2×40% = 18.8 points (the weights are allocated according to the importance of the third-party service). Finally, the system anomaly score is recalculated by combining the target anomaly scores of the four business metrics and the anomaly scores of third-party services (e.g., third-party services have a weight of 20%, and the total weight of business metrics is 80%).

[0080] As can be seen, this embodiment incorporates third-party service anomalies into the anomaly detection of the business system, which solves the shortcomings of existing technologies that only detect the business system's own indicators and ignore the impact of third-party services. By calculating the deviation degree through SLA standards, the degree of anomaly of third-party services is quantified, making the system anomaly detection more comprehensive. Combining the anomaly score of third-party services to determine the system detection result can identify potential system risks caused by third-party services in advance, avoid business system failures caused by third-party service anomalies, and further improve the comprehensiveness and reliability of business system anomaly detection.

[0081] Furthermore, in one embodiment, after obtaining the anomaly detection results from the business system, the anomaly detection results are also synchronized to the front-end display and a closed-loop feedback is provided. For example, anomaly icons generated based on the anomaly detection results are pushed to the front-end "problem board". Users can manually review the problems: confirm the problem, and then enter the problem tracking process. If a false alarm is found, the system records it for algorithm model optimization. If the result needs further observation, it is retained for the next round of analysis, and the review results are fed back to the data processing module to dynamically optimize the detection threshold and algorithm weight, forming a closed loop.

[0082] This embodiment provides a custom chart-driven proactive anomaly detection technology. By proposing the design concept of charts as probes, it allows users to configure time ranges, business cycle types, indicator combinations (such as "payment success rate + third-party delay"), and chart types (cycle-overlay line charts, heatmap calendars, etc.) through a visual interface. The system can automatically run multi-dimensional anomaly detection algorithms (same-period deviation, emerging trend, pattern disruption, correlation breakage) and highlight anomalies (color + animation + text description). At the same time, it generates diagnostic suggestion cards, upgrading the existing "passive data playback" technology to "proactive problem identification," significantly improving the efficiency of anomaly identification.

[0083] In summary, firstly, this solution employs multi-business indicator collaborative detection, which comprehensively covers the key monitoring dimensions of the business system, providing a more realistic and comprehensive reflection of the overall operational status of the business system and avoiding the omission of system anomalies due to monitoring of a single indicator. Secondly, this solution constructs separate algorithm candidate pools for each business indicator, rather than using a unified fixed algorithm, ensuring that the algorithm is compatible with the business type of each indicator and reducing false alarms and missed alarms caused by the mismatch between the algorithm and indicator characteristics. Thirdly, the system anomaly detection result is determined based on the comprehensive score of multiple target anomalies, realizing the fusion of anomaly information from multiple indicators and avoiding false alarms and missed alarms caused by random fluctuations of a single indicator, significantly improving the accuracy and reliability of anomaly detection in the business system and meeting the monitoring needs of actual business. Fourthly, this solution sets different data window lengths and data aggregation periods for the indicator data of different business indicators, avoiding false alarms and missed alarms caused by fixed period settings. For example, short periods are adapted to business indicators of high-frequency businesses, which can promptly detect instantaneous anomalies; long periods are adapted to business indicators of low-frequency businesses, which can filter invalid fluctuations and focus on core anomalies, while reducing data processing volume and improving detection efficiency.

[0084] Figure 4 This is a schematic block diagram of an anomaly detection device for a business system provided in an embodiment of this application. Figure 4As shown, corresponding to the above-described anomaly detection method for business systems, this application also provides an anomaly detection device 400 for business systems. This anomaly detection device 400 includes a unit for executing the above-described anomaly detection method for business systems, and can be configured in a terminal or server. Specifically, please refer to... Figure 4 The anomaly detection device 400 of the business system includes a transceiver unit 401 and a processing unit 402, wherein: The transceiver unit 401 is used to acquire indicator data corresponding to multiple business indicators in the business system. The indicator data corresponding to different business indicators correspond to different data window lengths and data aggregation periods. The processing unit 402 is configured to, for each of the business indicators, select at least two anomaly detection algorithms from a preset algorithm set for the business indicator according to the business type corresponding to the business indicator, and obtain an algorithm candidate pool corresponding to each business indicator; for each of the business indicators, use the anomaly detection algorithm in the corresponding algorithm candidate pool to perform anomaly detection on the corresponding indicator data, and obtain a target anomaly score corresponding to each of the business indicators; and determine the anomaly detection result of the business system based on multiple target anomaly scores.

[0085] In some embodiments, the preset algorithm set includes a synchronous deviation algorithm, a trend emergence algorithm, a pattern disruption algorithm, and a correlation breakage algorithm; when the processing unit 402 performs the step of selecting at least two anomaly detection algorithms from the preset algorithm set for each business indicator according to the business type corresponding to the business indicator, and obtaining an algorithm candidate pool corresponding to each business indicator, it is specifically used for: If the business type corresponding to the business indicator is real-time synchronization business, then the business indicator selects the pattern destruction algorithm and the correlation breakage algorithm to form the algorithm candidate pool corresponding to the business indicator. If the business type corresponding to the business indicator is an asynchronous long-link business, then the trend emergence algorithm and the same-period deviation algorithm are selected for the business indicator to form the algorithm candidate pool corresponding to the business indicator; If the business type corresponding to the business indicator is a batch-triggered business, then a synchronous deviation algorithm and a pattern disruption algorithm are selected for the business indicator to form the algorithm candidate pool corresponding to the business indicator.

[0086] In some embodiments, before executing the step of performing anomaly detection on the corresponding indicator data using the anomaly detection algorithm in the corresponding algorithm candidate pool for each of the business indicators, and obtaining the target anomaly score corresponding to each of the business indicators, the processing unit 402 is further configured to: Multi-dimensional feature extraction is performed on the indicator data corresponding to each of the aforementioned business indicators to obtain the fluctuation characteristics, data density characteristics, and business rhythm characteristics corresponding to each of the aforementioned business indicators. Based on the fluctuation characteristics and data density characteristics corresponding to each of the business indicators, target anomaly detection algorithms are selected for each of the business indicators from the corresponding algorithm candidate pool. Based on the business rhythm characteristics corresponding to each of the aforementioned business indicators, the detection parameters of the corresponding target anomaly detection algorithms are adjusted to obtain the adjusted target anomaly detection algorithms corresponding to each business indicator. At this time, when the processing unit 402 executes the step of performing anomaly detection on the corresponding indicator data using the anomaly detection algorithm in the corresponding algorithm candidate pool for each of the business indicators, and obtaining the target anomaly score corresponding to each of the business indicators, it is specifically used for: For each of the aforementioned business metrics, the adjusted target anomaly detection algorithm from the corresponding algorithm candidate pool is used to perform anomaly detection on the corresponding metric data, thereby obtaining the target anomaly score corresponding to each of the aforementioned business metrics.

[0087] In some embodiments, when the processing unit 402 performs the step of selecting a target anomaly detection algorithm from the corresponding algorithm candidate pool for each of the business indicators based on the fluctuation characteristics and data density characteristics corresponding to each of the business indicators, it is specifically used for: Based on the fluctuation characteristics of each business indicator, the optimal candidate algorithm is selected from the corresponding algorithm candidate pool for each business indicator. Based on the data density characteristics corresponding to each of the aforementioned business indicators, determine whether the corresponding candidate optimal algorithm is runnable; If it is runnable, the candidate optimal algorithm is determined as the target anomaly detection algorithm for the corresponding business indicator; If it cannot be run, then the anomaly detection algorithm other than the candidate optimal algorithm in the corresponding algorithm candidate pool will be used as the target anomaly detection algorithm.

[0088] In some embodiments, when the processing unit 402 performs the step of performing anomaly detection on the corresponding indicator data using the anomaly detection algorithm in the corresponding algorithm candidate pool for each of the business indicators, and obtaining the target anomaly score corresponding to each of the business indicators, it is specifically used for: For each of the aforementioned business metrics, multiple anomaly detection algorithms from the corresponding algorithm candidate pool are used to perform anomaly detection on the corresponding metric data, and the initial anomaly score corresponding to each anomaly detection algorithm is obtained. For each of the aforementioned business metrics, the initial anomaly scores are weighted and fused to obtain the target anomaly score corresponding to each of the aforementioned business metrics.

[0089] In some embodiments, when the processing unit 402 performs the step of determining the anomaly detection result of the business system based on the plurality of target anomaly scores, it is specifically used for: Obtain the weights of the various business metrics respectively; The system anomaly score of the business system is determined based on the multiple target anomaly scores and the corresponding indicator weights for each target anomaly score. The anomaly detection result is determined based on the system anomaly score.

[0090] In some embodiments, before performing the step of determining the anomaly detection result of the business system based on the plurality of target anomaly scores, the processing unit 402 is further configured to: Obtain service metric data corresponding to the third-party services that the business system relies on; Align the service indicator data with the business cycle, and calculate the deviation of the service indicator data from the SLA standard value or the historical benchmark value according to the preset SLA service level agreement standard to obtain the abnormal score of the third-party service. The step of determining the anomaly detection result of the business system based on multiple target anomaly scores includes: The anomaly detection result is determined based on the anomaly scores of the multiple targets and the anomaly scores of the third-party services.

[0091] In summary, firstly, this solution employs multi-business indicator collaborative detection, which comprehensively covers the key monitoring dimensions of the business system, providing a more realistic and comprehensive reflection of the overall operational status of the business system and avoiding the omission of system anomalies due to monitoring of a single indicator. Secondly, this solution constructs separate algorithm candidate pools for each business indicator, rather than using a unified fixed algorithm, ensuring that the algorithm is compatible with the business type of each indicator and reducing false alarms and missed alarms caused by the mismatch between the algorithm and indicator characteristics. Thirdly, the system anomaly detection result is determined based on the comprehensive score of multiple target anomalies, realizing the fusion of anomaly information from multiple indicators and avoiding false alarms and missed alarms caused by random fluctuations of a single indicator, significantly improving the accuracy and reliability of anomaly detection in the business system and meeting the monitoring needs of actual business. Fourthly, this solution sets different data window lengths and data aggregation periods for the indicator data of different business indicators, avoiding false alarms and missed alarms caused by fixed period settings. For example, short periods are adapted to business indicators of high-frequency businesses, which can promptly detect instantaneous anomalies; long periods are adapted to business indicators of low-frequency businesses, which can filter invalid fluctuations and focus on core anomalies, while reducing data processing volume and improving detection efficiency.

[0092] It should be noted that those skilled in the art can clearly understand that the specific implementation process of the anomaly detection device and each unit of the above-mentioned business system can be referred to the corresponding description in the foregoing method embodiments. For the sake of convenience and brevity, it will not be repeated here.

[0093] The anomaly detection device for the aforementioned business system can be implemented as a computer program, which can, for example... Figure 5 It runs on the computer device shown.

[0094] Please see Figure 5 , Figure 5 This is a schematic block diagram of a computer device provided in an embodiment of this application. The computer device 500 can be a terminal or a server. The terminal can be an electronic device with communication functions, such as a smartphone, tablet, laptop, desktop computer, personal digital assistant, or wearable device. The server can be a standalone server or a server cluster composed of multiple servers.

[0095] See Figure 5 The computer device 500 includes a processor 502, a memory, and a network interface 505 connected via a system bus 501. The memory may include a non-volatile storage medium 503 and internal memory 504.

[0096] The non-volatile storage medium 503 may store an operating system 5031 and a computer program 5032. The computer program 5032 includes program instructions that, when executed, cause the processor 502 to perform an anomaly detection method for a business system.

[0097] The processor 502 provides computing and control capabilities to support the operation of the entire computer device 500.

[0098] The internal memory 504 provides an environment for the execution of the computer program 5032 in the non-volatile storage medium 503. When the computer program 5032 is executed by the processor 502, the processor 502 can execute an anomaly detection method for a business system.

[0099] This network interface 505 is used for network communication with other devices. Those skilled in the art will understand that... Figure 5 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device 500 to which the present application is applied. The specific computer device 500 may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0100] The processor 502 is used to run a computer program 5032 stored in the memory to perform the following steps: Obtain the indicator data corresponding to multiple business indicators in the business system. The indicator data corresponding to different business indicators correspond to different data window lengths and data aggregation periods. For each of the aforementioned business metrics, at least two anomaly detection algorithms are selected from a preset algorithm set according to the business type corresponding to the business metrics, thereby obtaining an algorithm candidate pool corresponding to each business metric. For each of the aforementioned business metrics, an anomaly detection algorithm from the corresponding algorithm candidate pool is used to perform anomaly detection on the corresponding metric data, thereby obtaining the target anomaly score corresponding to each of the aforementioned business metrics. The anomaly detection result of the business system is determined based on multiple target anomaly scores.

[0101] It should be understood that in the embodiments of this application, the processor 502 may be a central processing unit (CPU), or it may be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor or any conventional processor.

[0102] It will be understood by those skilled in the art that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program includes program instructions and can be stored in a storage medium, which is a computer-readable storage medium. The program instructions are executed by at least one processor in the computer system to implement the process steps of the embodiments of the above methods.

[0103] Therefore, this application also provides a storage medium. This storage medium can be a computer-readable storage medium. The storage medium stores a computer program, wherein the computer program includes program instructions. When executed by a processor, the program instructions cause the processor to perform the following steps: Obtain the indicator data corresponding to multiple business indicators in the business system. The indicator data corresponding to different business indicators correspond to different data window lengths and data aggregation periods. For each of the aforementioned business metrics, at least two anomaly detection algorithms are selected from a preset algorithm set according to the business type corresponding to the business metrics, thereby obtaining an algorithm candidate pool corresponding to each business metric. For each of the aforementioned business metrics, an anomaly detection algorithm from the corresponding algorithm candidate pool is used to perform anomaly detection on the corresponding metric data, thereby obtaining the target anomaly score corresponding to each of the aforementioned business metrics. The anomaly detection result of the business system is determined based on multiple target anomaly scores.

[0104] The storage medium can be any computer-readable storage medium capable of storing program code, such as a USB flash drive, portable hard drive, read-only memory (ROM), magnetic disk, or optical disk.

[0105] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of this application.

[0106] In the several embodiments provided in this application, it should be understood that the disclosed apparatus and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative. For example, the division of each unit is merely a logical functional division, and there may be other division methods in actual implementation. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed.

[0107] The steps in the methods of this application embodiment can be adjusted, merged, or deleted according to actual needs. The units in the apparatus of this application embodiment can be merged, divided, or deleted according to actual needs. Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0108] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, a terminal, or a network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application.

[0109] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any person skilled in the art can easily conceive of various equivalent modifications or substitutions within the technical scope disclosed in this application, and these modifications or substitutions should all be covered within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. An anomaly detection method for a business system, characterized in that, include: Obtain the indicator data corresponding to multiple business indicators in the business system. The indicator data corresponding to different business indicators have different data window lengths and data aggregation periods. For each of the aforementioned business metrics, at least two anomaly detection algorithms are selected from a preset algorithm set according to the business type corresponding to the business metrics, thereby obtaining an algorithm candidate pool corresponding to each business metric. For each of the aforementioned business metrics, an anomaly detection algorithm from the corresponding algorithm candidate pool is used to perform anomaly detection on the corresponding metric data, thereby obtaining the target anomaly score corresponding to each of the aforementioned business metrics. The anomaly detection result of the business system is determined based on multiple target anomaly scores.

2. The method according to claim 1, characterized in that, The preset algorithm set includes a period deviation algorithm, a trend emergence algorithm, a pattern disruption algorithm, and a correlation break algorithm. The period deviation algorithm is a period-to-month anomaly detection algorithm; the trend emergence algorithm is a Mann-Kendall trend significance detection algorithm; the pattern disruption algorithm is a Z-score statistical outlier detection algorithm; and the correlation break algorithm is a dual-indicator correlation anomaly detection algorithm. For each business indicator, at least two anomaly detection algorithms are selected from the preset algorithm set according to the business type corresponding to the business indicator, resulting in an algorithm candidate pool for each business indicator, including: If the business type corresponding to the business indicator is real-time synchronization business, then the business indicator selects the pattern destruction algorithm and the correlation breakage algorithm to form the algorithm candidate pool corresponding to the business indicator. If the business type corresponding to the business indicator is an asynchronous long-link business, then the trend emergence algorithm and the same-period deviation algorithm are selected for the business indicator to form the algorithm candidate pool corresponding to the business indicator; If the business type corresponding to the business indicator is a batch-triggered business, then a synchronous deviation algorithm and a pattern disruption algorithm are selected for the business indicator to form the algorithm candidate pool corresponding to the business indicator.

3. The method according to claim 1, characterized in that, Before performing anomaly detection on the corresponding indicator data using the anomaly detection algorithm from the corresponding algorithm candidate pool for each of the aforementioned business indicators, and obtaining the target anomaly score corresponding to each of the aforementioned business indicators, the method further includes: Multi-dimensional feature extraction is performed on the indicator data corresponding to each of the aforementioned business indicators to obtain the fluctuation characteristics, data density characteristics, and business rhythm characteristics corresponding to each of the aforementioned business indicators. Based on the fluctuation characteristics and data density characteristics corresponding to each of the business indicators, target anomaly detection algorithms are selected from the corresponding algorithm candidate pools for each of the business indicators. Based on the business rhythm characteristics corresponding to each of the aforementioned business indicators, the detection parameters of the corresponding target anomaly detection algorithms are adjusted to obtain the adjusted target anomaly detection algorithms corresponding to each business indicator. For each of the aforementioned business metrics, an anomaly detection algorithm from the corresponding candidate pool is used to perform anomaly detection on the corresponding metric data, obtaining a target anomaly score for each of the aforementioned business metrics, including: For each of the aforementioned business metrics, the adjusted target anomaly detection algorithm from the corresponding algorithm candidate pool is used to perform anomaly detection on the corresponding metric data, thereby obtaining the target anomaly score corresponding to each of the aforementioned business metrics.

4. The method according to claim 3, characterized in that, The step of selecting a target anomaly detection algorithm for each business indicator from the corresponding algorithm candidate pool based on the fluctuation characteristics and data density characteristics corresponding to each business indicator includes: Based on the fluctuation characteristics of each business indicator, the optimal candidate algorithm is selected from the corresponding algorithm candidate pool for each business indicator. Based on the data density characteristics corresponding to each of the aforementioned business indicators, determine whether the corresponding candidate optimal algorithm is runnable; If it is runnable, the candidate optimal algorithm is determined as the target anomaly detection algorithm for the corresponding business indicator; If it cannot be run, then the anomaly detection algorithm other than the candidate optimal algorithm in the corresponding algorithm candidate pool will be used as the target anomaly detection algorithm.

5. The method according to claim 1, characterized in that, For each of the aforementioned business metrics, an anomaly detection algorithm from the corresponding candidate pool is used to perform anomaly detection on the corresponding metric data, obtaining a target anomaly score for each of the aforementioned business metrics, including: For each of the aforementioned business metrics, multiple anomaly detection algorithms from the corresponding algorithm candidate pool are used to perform anomaly detection on the corresponding metric data, and the initial anomaly score corresponding to each anomaly detection algorithm is obtained. For each of the aforementioned business metrics, the initial anomaly scores are weighted and fused to obtain the target anomaly score corresponding to each of the aforementioned business metrics.

6. The method according to claim 1, characterized in that, The step of determining the anomaly detection result of the business system based on multiple target anomaly scores includes: Obtain the weights of the various business metrics respectively; The system anomaly score of the business system is determined based on the multiple target anomaly scores and the corresponding indicator weights for each target anomaly score. The anomaly detection result is determined based on the system anomaly score.

7. The method according to claim 1, characterized in that, Before determining the anomaly detection result of the business system based on multiple target anomaly scores, the method further includes: Obtain service metric data corresponding to the third-party services that the business system relies on; Align the service indicator data with the business cycle, and calculate the deviation of the service indicator data from the SLA standard value or the historical benchmark value according to the preset SLA service level agreement standard to obtain the abnormal score of the third-party service. The step of determining the anomaly detection result of the business system based on multiple target anomaly scores includes: The anomaly detection result is determined based on the anomaly scores of the multiple targets and the anomaly scores of the third-party services.

8. An anomaly detection device for a business system, characterized in that, include: The transceiver unit is used to acquire the indicator data corresponding to multiple business indicators in the business system. The indicator data corresponding to different business indicators are respectively associated with different data window lengths and data aggregation periods. The processing unit is configured to, for each of the business indicators, select at least two anomaly detection algorithms from a preset algorithm set for the business indicator according to the business type corresponding to the business indicator, and obtain an algorithm candidate pool corresponding to each business indicator; for each of the business indicators, use the anomaly detection algorithm in the corresponding algorithm candidate pool to perform anomaly detection on the corresponding indicator data, and obtain a target anomaly score corresponding to each of the business indicators; and determine the anomaly detection result of the business system based on multiple target anomaly scores.

9. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the anomaly detection method for the business system as described in any one of claims 1-7.

10. A storage medium, characterized in that, The storage medium stores a computer program, which includes program instructions that, when executed by a processor, cause the processor to perform the anomaly detection method of the business system as described in any one of claims 1-7.

Images