An exception identification method, device, apparatus and storage medium are provided.

Abstract

The application belongs to the technical field of artificial intelligence, and relates to an execution exception identification method and device, equipment and a storage medium. The method comprises the following steps: obtaining business processing data to be subjected to exception identification; adopting a double-path feature processing model to perform business data feature extraction and identification, and determining time-sequencing exceptions and business logic correlation exceptions, wherein the double-path feature processing model comprises a time-sequencing feature processing branch and a graph neural network processing branch; and outputting exception representation data. The method can avoid the one-sidedness of feature recognition results caused by the use of a single data feature extraction structure, and can be applied to the field of financial business services, for example, in an insurance business exception identification scenario. Two feature processing structures, namely, a time-sequencing feature processing branch and a graph neural network processing branch, are adopted to perform business data feature processing on the input business processing data in a parallel processing mode, without interference and disturbance, so that the confidence and interpretability of the business exception identification result are improved.

Description

Technical Field

[0001] This application relates to the field of artificial intelligence technology and is applied to the scenario of abnormal handling and identification of business processing nodes. It relates to an execution abnormality identification method, device, equipment and storage medium. Background Technology

[0002] Network anomaly behavior refers to abnormal or irregular behaviors or activities occurring in a computer network. These anomalies may include network attacks, network fraud, malware propagation, unauthorized access, and data leaks. Network anomaly behavior detection can promptly identify and, to some extent, prevent these problems from occurring. In existing financial business processing scenarios, such as financial insurance business processing scenarios, multiple business processing stages are often involved, including application, review, underwriting, and claims settlement, which greatly increases the probability of abnormal or irregular behaviors or activities.

[0003] Existing technologies primarily rely on fixed rule engines or traditional machine learning models for anomaly detection. However, rule-based identification schemes can only match pre-defined known anomaly patterns, while traditional machine learning model-based schemes often focus on static features of single users or policies, lacking anomaly detection across the entire business lifecycle. Neither approach can provide anomaly detection results with high confidence and interpretability. Therefore, existing technologies still suffer from low confidence and interpretability in business execution anomaly detection. Summary of the Invention

[0004] The purpose of this application is to provide an execution anomaly identification method, apparatus, device, and storage medium to improve the confidence and interpretability of the prior art in business execution anomaly identification.

[0005] In a first aspect, embodiments of this application provide an execution anomaly identification method, which adopts the following technical solution: An execution anomaly detection method includes the following steps: Obtain the business processing data to be identified for anomaly detection; The business processing data is input into a pre-trained dual-path feature processing model for business data feature extraction and recognition. The pre-trained dual-path feature processing model includes a temporal feature processing branch and a graph neural network processing branch. The temporal feature processing branch is used to extract temporal features and identify anomalies in the business data features, and the graph neural network processing branch is used to extract business logic correlation features and identify anomalies in the business data features. Based on the identification results of business data characteristics, determine whether the business processing data has any time-series anomalies and business logic correlation anomalies; Based on the time-series anomaly determination results, the business logic-related anomaly determination results, and the preset dynamic comprehensive evaluation strategy for anomalies, the anomaly characterization data of the business processing data is output. The anomaly characterization data includes the business logic node location information where the anomaly is located and the dynamic comprehensive evaluation value of the anomaly.

[0006] Secondly, embodiments of this application also provide an execution anomaly identification device, which adopts the following technical solution: An execution anomaly detection device, comprising: The business processing data acquisition module is used to acquire business processing data to be identified for anomaly detection. A dual-path feature processing module is used to input the business processing data into a pre-trained dual-path feature processing model to extract and identify business data features. The pre-trained dual-path feature processing model includes a temporal feature processing branch and a graph neural network processing branch. The temporal feature processing branch is used to extract temporal features and identify anomalies in the business data features, and the graph neural network processing branch is used to extract business logic correlation features and identify anomalies in the business data features. An execution anomaly determination module is used to determine whether the business processing data has temporal anomalies and business logic correlation anomalies based on the identification results of business data characteristics. The anomaly characterization data output module is used to output anomaly characterization data of the business processing data based on the time-series anomaly determination results, the business logic-related anomaly determination results, and the preset dynamic comprehensive evaluation strategy for anomalies. The anomaly characterization data includes the business logic node location information where the anomaly is located and the dynamic comprehensive evaluation value of the anomaly.

[0007] Thirdly, embodiments of this application also provide a computer device that adopts the technical solution described below: A computer device includes a memory and a processor, wherein the memory stores computer-readable instructions, and the processor executes the computer-readable instructions to implement the steps of the above-described execution anomaly identification method.

[0008] Fourthly, embodiments of this application also provide a computer-readable storage medium, which adopts the technical solutions described below: A computer-readable storage medium storing computer-readable instructions, which, when executed by a processor, implement the steps of the execution exception identification method described above.

[0009] Compared with the prior art, the embodiments of this application have the following main advantages: The anomaly identification method described in this application involves: acquiring business processing data to be identified; inputting the business processing data into a pre-trained dual-path feature processing model for feature extraction and identification; wherein the pre-trained dual-path feature processing model includes a temporal feature processing branch and a graph neural network processing branch; the temporal feature processing branch is used to extract and identify temporal features in the business data features, and the graph neural network processing branch is used to extract and identify business logic correlation features in the business data features; based on the identification results of the business data features, determining whether there are temporal anomalies and business logic correlation anomalies in the business processing data; and outputting anomaly representation data of the business processing data based on the temporal anomaly determination results, the business logic correlation anomaly determination results, and a preset dynamic comprehensive evaluation strategy for anomalies. To avoid the one-sidedness of feature recognition results caused by using only a single data feature extraction structure for data feature extraction, this method can be applied to the financial business service field. For example, in the scenario of anomaly identification in insurance business, two feature processing structures are used: a sequential feature processing branch and a graph neural network processing branch. The input business processing data is processed in parallel to perform business data feature processing separately without interference, which improves the confidence and interpretability of the business anomaly identification results. Attached Figure Description

[0010] To more clearly illustrate the solutions in this application, the accompanying drawings used in the description of the embodiments of this application will be briefly introduced below. Obviously, the accompanying drawings described below are some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0011] Figure 1 This is an exemplary system architecture diagram to which this application can be applied; Figure 2 This is a flowchart of an embodiment of an execution anomaly identification method according to this application; Figure 3 This document shows a flowchart of a specific embodiment of the pre-training of the dual-path feature processing model in an execution anomaly detection method according to this application; Figure 4 yes Figure 3 A flowchart of a specific embodiment of step 305 shown; Figure 5 yes Figure 2 A flowchart of a specific embodiment of step 202 shown; Figure 6 yes Figure 5 A flowchart of a specific embodiment of step 502 shown; Figure 7 yes Figure 5 A flowchart of a specific embodiment of step 504 shown; Figure 8 The flowchart illustrates a specific embodiment of the execution anomaly identification method described in this application, which involves fusing and merging the identification results of the dual-path feature processing branches. Figure 9 yes Figure 2 A flowchart of a specific embodiment of step 204 shown; Figure 10 This is a schematic diagram of one embodiment of an execution anomaly detection device according to this application; Figure 11 This is a schematic diagram of the structure of one embodiment of the computer device according to this application. Detailed Implementation

[0012] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application pertains; the terminology used herein in the specification of the application is for the purpose of describing particular embodiments only and is not intended to be limiting of the application; the terms "comprising" and "having," and any variations thereof, in the specification, claims, and foregoing drawings of this application, are intended to cover non-exclusive inclusion. The terms "first," "second," etc., in the specification, claims, or foregoing drawings of this application are used to distinguish different objects, not to describe a particular order.

[0013] In this document, the term "embodiment" means that a particular feature, structure, or characteristic described in connection with an embodiment may be included in at least one embodiment of this application. The appearance of this phrase in various places throughout the specification does not necessarily refer to the same embodiment, nor is it a separate or alternative embodiment mutually exclusive with other embodiments. It will be explicitly and implicitly understood by those skilled in the art that the embodiments described herein can be combined with other embodiments.

[0014] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings.

[0015] like Figure 1 As shown, system architecture 100 may include terminal device 101, network 102, and server 103. Terminal device 101 may be a laptop 1011, tablet 1012, or mobile phone 1013. Network 102 is used as a medium to provide a communication link between terminal device 101 and server 103. Network 102 may include various connection types, such as wired, wireless communication links, or fiber optic cables.

[0016] Users can use terminal device 101 to interact with server 103 via network 102 to receive or send messages, etc. Various communication client applications can be installed on terminal device 101, such as web browser applications, shopping applications, search applications, instant messaging tools, email clients, social media platform software, etc.

[0017] Terminal device 101 can be various electronic devices with a display screen and support web browsing. In addition to laptops 1011, tablets 1012, or mobile phones 1013, terminal device 101 can also be an e-book reader, an MP3 player (Moving Picture Experts Group Audio Layer III), an MP4 player (Moving Picture Experts Group Audio Layer IV), a laptop computer, and a desktop computer, etc.

[0018] Server 103 can be a server that provides various services, such as a backend server that provides support for the pages displayed on terminal device 101.

[0019] It should be noted that the execution anomaly identification method provided in this application embodiment is generally executed by a server, and correspondingly, an execution anomaly identification device is generally set in the server.

[0020] It should be understood that Figure 1 The number of terminal devices, networks, and servers shown is merely illustrative. Depending on implementation needs, any number of terminal devices, networks, and servers can be included.

[0021] Continue to refer to Figure 2 The diagram illustrates a flowchart of an embodiment of an execution anomaly detection method according to this application. The execution anomaly detection method includes the following steps: Step 201: Obtain the business processing data to be identified for anomaly detection.

[0022] In this embodiment, the business processing data to be anomaly identified includes data information to be processed, data being processed, and data information that has been processed by each business processing node involved in the target business processing flow. For example, after business processing node Node-A processes the first input data, it will obtain the processed first output data. The first input data is the data information to be processed, and the first output data is the data information that has been processed.

[0023] Specifically, the business processing data to be identified for anomaly detection can be obtained through user uploads, forwarding or transmission by other data processing components, log recording documents, etc. Applying this execution anomaly detection method to a business processing execution anomaly detection scenario, it includes identifying execution anomalies in the business processing data to be processed before actual execution. This allows for the early identification of potential anomalies before actual business processing, enabling thorough pre-avoidance of business processing anomalies, extracting anomalies from business processing nodes in the avoidance process, and promptly optimizing execution.

[0024] In this embodiment, the business processing data to be identified as anomaly can be business processing data in a financial business processing scenario, such as all business processing data involved in a financial business insurance claims scenario. Accordingly, the business processing nodes include application, review, and approval nodes during insurance processing, application, review, and approval nodes during underwriting, etc.

[0025] It should be understood that, since the actual business domains in which the aforementioned anomaly identification method is applied are different, the business processing data to be identified will also vary considerably due to the different actual business domains.

[0026] Step 202: Input the business processing data into the pre-trained dual-path feature processing model to perform business data feature extraction and recognition.

[0027] The pre-trained dual-path feature processing model includes a temporal feature processing branch and a graph neural network processing branch. The temporal feature processing branch is used to extract temporal features and identify anomalies in the business data features, and the graph neural network processing branch is used to extract business logic correlation features and identify anomalies in the business data features. Specifically, the temporal feature processing branch includes a processing branch based on LSTM (Long Short-Term Memory), while the graph neural network processing branch includes a processing branch based on GNN (Graph Neural Network).

[0028] In this embodiment, the temporal feature processing branch and the graph neural network processing branch included in the pre-trained dual-path feature processing model are two network structures that perform feature processing in parallel. That is, the temporal feature processing branch and the graph neural network processing branch perform business data feature processing on the input business processing data in a parallel processing manner, without interfering with or intervening with each other.

[0029] By inputting the business processing data into a pre-trained dual-path feature processing model, business data feature extraction and recognition are performed. This avoids the one-sided feature recognition results caused by using only a single data feature extraction structure. In this embodiment, at least two feature processing structures are used, namely the temporal feature processing branch and the graph neural network processing branch, to process the input business processing data in parallel without interference, thereby improving the confidence and interpretability of the feature recognition results.

[0030] Step 203: Based on the identification results of business data features, determine whether the business processing data has any time-series anomalies and business logic correlation anomalies.

[0031] In this embodiment, the timing anomaly refers to the processing order between various business processing nodes, while the business logic association anomaly refers to the processing logic step order between various business processing nodes. Generally, the processing order between various business processing nodes is consistent with the processing logic step order between various business processing nodes.

[0032] Step 204: Based on the time-series anomaly determination results, the business logic-related anomaly determination results, and the preset dynamic comprehensive evaluation strategy for anomalies, output the anomaly representation data of the business processing data.

[0033] The anomaly representation data includes the location information of the business logic node where the anomaly is located and the dynamic comprehensive evaluation value of the anomaly.

[0034] The execution anomaly identification method provided in this embodiment can be applied to the financial business service field, such as in the insurance business anomaly identification scenario. It facilitates business anomaly identification based on the business processing data to be identified. It adopts two feature processing structures, namely the temporal feature processing branch and the graph neural network processing branch, to process the input business processing data in parallel, without interference or interference between them, thereby improving the confidence and interpretability of the anomaly identification results.

[0035] The execution anomaly identification method provided in this embodiment acquires the business processing data to be identified; inputs the business processing data into a pre-trained dual-path feature processing model for business data feature extraction and identification. The pre-trained dual-path feature processing model includes a temporal feature processing branch and a graph neural network processing branch. The temporal feature processing branch is used to extract and identify temporal features in the business data features, while the graph neural network processing branch is used to extract and identify business logic-related features in the business data features. Based on the identification results of the business data features, it is determined whether there are temporal anomalies and business logic-related anomalies in the business processing data. Based on the temporal anomaly determination results, the business logic-related anomaly determination results, and a preset dynamic comprehensive evaluation strategy for anomalies, the method outputs anomaly representation data of the business processing data. To avoid the one-sidedness of feature recognition results caused by using only a single data feature extraction structure for data feature extraction, this method can be applied to the financial business service field. For example, in the scenario of anomaly identification in insurance business, two feature processing structures are used: a sequential feature processing branch and a graph neural network processing branch. The input business processing data is processed in parallel to perform business data feature processing separately without interference, which improves the confidence and interpretability of the business anomaly identification results.

[0036] Continue to refer to Figure 3 Before step 202, Figure 3 This document illustrates a flowchart of a specific embodiment of the pre-training of the dual-path feature processing model in an anomaly detection method according to this application, including the following steps: Step 301: Receive historical processing data of non-abnormal business uploaded from multiple data sources; Specifically, receiving historical processing data of non-abnormal business uploaded from multiple data sources includes obtaining recorded historical insurance business processing data of non-abnormality from multiple financial institutions.

[0037] It should be understood that the abnormal business history processing data can be data that has been pre-marked as abnormal. When receiving data uploaded from multiple sources, abnormal business history processing data can be filtered out simply by using the corresponding abnormality marker.

[0038] Step 302: Analyze the business processing nodes and processing steps of the historical processing data of the business without anomalies, and identify the business processing nodes and processing steps between each business processing node contained in all the historical processing data of the business without anomalies. Specifically, before pre-training the dual-path feature processing model, an analytical method is first used to parse the historical processing data of the non-abnormal business, identifying the business processing nodes and processing steps contained in each of the historical processing data of the non-abnormal business. This allows the business processing nodes and the processing steps between each business processing node to be used as learning knowledge in the pre-training process, enabling the dual-path feature processing model to learn this knowledge and use it to identify anomalies in newly input business processing data to be identified.

[0039] Step 303: Based on the business processing nodes and the processing steps between each business processing node, generate a business knowledge graph, wherein graph nodes are generated according to the business processing nodes, and edge relationship pointers between graph nodes are generated according to the processing steps. Step 304: Transmit the abnormal business history processing data to a preset time-series feature extraction network to extract business time-series features and generate a structured time-series feature dataset. Specifically, for the two parallel feature processing network structures, namely the temporal feature processing branch and the graph neural network processing branch, different learning knowledge is constructed respectively. For the temporal feature processing branch, a preset temporal feature extraction network, such as an LSTM temporal feature extraction network, is used to extract business temporal features and generate a structured temporal feature dataset. Subsequently, the structured temporal feature dataset is used to train the temporal feature processing branch. For the graph neural network processing branch, the processing steps between the business processing nodes are used to generate a business knowledge graph. Subsequently, the business knowledge graph is used to train the graph neural network processing branch.

[0040] Step 305: Using the business knowledge graph and the temporal feature dataset as training data, pre-train the dual-path feature processing model, which includes a temporal feature processing branch and a graph neural network processing branch, to obtain the pre-trained dual-path feature processing model.

[0041] Specifically, the dual-path feature processing model, which includes a temporal feature processing branch and a graph neural network processing branch, is pre-trained using training data to obtain a pre-trained dual-path feature processing model, which can then be directly used for anomaly identification in business processing.

[0042] Continue to refer to Figure 4 , Figure 4 yes Figure 3 A flowchart of a specific embodiment of step 305 shown includes: Step 401: Based on the input interface information corresponding to the time-series feature processing branch and the graph neural network processing branch, set input differentiation identifiers for the business knowledge graph and the time-series feature dataset respectively; In this embodiment, input differentiation identifiers are first set for the business knowledge graph and the time-series feature dataset based on the input interface information corresponding to the time-series feature processing branch and the graph neural network processing branch, respectively. This facilitates subsequent pre-training for the time-series feature processing branch and the graph neural network processing branch, avoids knowledge confusion during learning and training, and improves learning and training efficiency.

[0043] Specifically, when setting the input differentiation identifier, the business knowledge graph corresponds to the input interface corresponding to the graph neural network processing branch, while the time-series feature dataset corresponds to the input interface corresponding to the time-series feature processing branch.

[0044] Step 402: Based on the input distinguishing identifier corresponding to the business knowledge graph, input the business knowledge graph into the graph neural network processing branch to extract and learn business logic association features, and obtain the pre-trained graph neural network processing branch; In this embodiment, the business logic association feature refers to all the business processing nodes included, and the order of processing logic steps between each business processing node.

[0045] Step 403: Based on the input distinguishing identifier corresponding to the time series feature dataset, input the time series feature dataset into the time series feature processing branch for business time series feature extraction and learning, and obtain the pre-trained time series feature processing branch.

[0046] In this embodiment, the business timing feature refers to all the business processing nodes included, and the order in which each business processing node is processed in terms of processing time.

[0047] Continue to refer to Figure 5 , Figure 5 yes Figure 2 A flowchart of a specific embodiment of step 202 shown includes: Step 501: Use the pre-trained graph neural network processing branch to extract business logic association features from the business processing data, and extract all business processing nodes and processing steps between each business processing node contained in the business processing data. Step 502: Take all the business processing nodes and the processing steps between each business processing node as the first verification data, use the business knowledge graph as the verification domain to verify the graph node connection relationship and edge relationship of the first verification data, and output the verification result as the first identification result. Specifically, step 501 involves using the graph neural network processing branch to extract business logic-related features from the business processing data. Then, in step 502, anomaly verification is performed using the business knowledge graph, thereby obtaining the anomaly identification result obtained by the graph neural network processing branch. Step 503: Use the pre-trained temporal feature processing branch to extract temporal features from the business processing data, and extract all business processing nodes and the processing timestamp information corresponding to each business processing node contained in the business processing data. Step 504: Use all the business processing nodes and the processing timestamp information corresponding to each business processing node as the second verification data to verify whether the processing timestamp information corresponding to each business processing node conforms to the order of processing steps between each business processing node, and output the verification result as the second identification result.

[0048] Specifically, step 503 involves using the time-series feature processing branch to extract time-series features from the business processing data. Then, in step 504, it is verified whether the processing timestamp information corresponding to each business processing node conforms to the order of processing steps between each business processing node, thereby obtaining the anomaly identification result obtained by the time-series feature processing branch.

[0049] Continue to refer to Figure 6 , Figure 6 yes Figure 5 A flowchart of a specific embodiment of step 502 shown includes: Step 601: Verify whether all the business processing nodes have a unique corresponding graph node in the business knowledge graph; Specifically, since the business knowledge graph is constructed based on a large amount of historical processing data of business without anomalies, theoretically, if the business processing data to be identified in this case is without anomalies, all business processing nodes have a unique graph node in the business knowledge graph. Step 602: Verify whether the processing steps between each business processing node have corresponding graph node connection relationships and edge relationships in the business knowledge graph. Accordingly, since the business knowledge graph is constructed based on a large amount of historical processing data of business without anomalies, theoretically, the unique graph node corresponding to each business processing node has a corresponding graph node connection relationship and edge relationship in the business knowledge graph. Step 603: If all the business processing nodes have a unique graph node in the business knowledge graph, and all graph nodes have corresponding graph node connection relationships and edge relationships in the business knowledge graph, then the verification result is passed without any anomalies. Step 604, otherwise, output the verification result as "failed due to an anomaly" and mark the business processing node that caused the anomaly.

[0050] In this embodiment, if there are missing business processing nodes, inconsistent graph node connection relationships, or inconsistent edge relationships, the verification of the business knowledge graph will fail, and there will be certain business processing execution anomalies.

[0051] In this embodiment, the processing timestamp information includes processing start time information and processing completion time information. (Continue to refer to...) Figure 7 , Figure 7 yes Figure 5 A flowchart of a specific embodiment of step 504 shown includes: Step 701: Obtain the processing start time information and processing completion time information corresponding to each business processing node; Step 702: Serialize and organize all processing start time information and processing completion time information according to the order of processing steps between each business processing node to obtain a processing time sequence; Specifically, since the identification of business processing anomalies involves business processing data within the same business chain, there exists a certain processing sequence when no business processing anomalies are present in the chain. By sequentially organizing all processing start and completion time information through the processing steps between each business processing node, a processing time sequence is obtained, which in turn yields the actual business processing time sequence.

[0052] Step 703: If the processing time series conforms to the preset time sequence, the verification result is output as "passed without anomalies". In this embodiment, the preset time sequence is a reference time sequence. If the actual business processing time sequence is consistent with the reference time sequence, then the business processing nodes identified by the time sequence feature processing branch are all normal.

[0053] Step 704: Otherwise, output the verification result as "failed due to an anomaly" and mark the business processing node that caused the anomaly and the corresponding processing timestamp information.

[0054] Specifically, if the actual business processing time sequence is inconsistent with the reference time sequence, the business processing nodes involved in the inconsistency and the corresponding processing timestamp information are filtered out and output as the identified anomaly information.

[0055] Continue to refer to Figure 8 Before step 203, Figure 8 The flowchart illustrates a specific embodiment of the execution anomaly detection method described in this application, which involves fusing and merging the detection results of the dual-path feature processing branches, including the following steps: Step 801: Merge the first recognition result and the second recognition result to obtain the merged comprehensive recognition result; Specifically, the first identification result is parsed to obtain all business processing nodes contained in the first identification result; the second identification result is parsed to obtain all business processing nodes and corresponding processing timestamp information contained in the second identification result; and the parsing results corresponding to the same business processing node are merged into the same comprehensive identification result according to the business processing node identifier.

[0056] Step 802: Update the comprehensive recognition result to the business data feature recognition result of the pre-trained dual-path feature processing model for the business processing data.

[0057] In this embodiment, the step of determining whether the business processing data has temporal anomalies and business logic correlation anomalies based on the identification results of business data features includes: if the output verification results are all passed and there are no anomalies, then the business processing data does not have temporal anomalies and business logic correlation anomalies; if the output verification results are failed and there are anomalies, and only the business processing nodes that caused the anomalies are marked without corresponding processing timestamp information, then the business processing data only has business logic correlation anomalies; if the output verification results are failed and there are anomalies, and the business processing nodes that caused the anomalies are marked and all the business processing nodes with anomalies have corresponding processing timestamp information, then the business processing data only has temporal anomalies; if the output verification results are failed and there are anomalies, and the marked business processing nodes that caused the anomalies have corresponding processing timestamp information, then the business processing data has both temporal anomalies and business logic correlation anomalies.

[0058] Continue to refer to Figure 9 , Figure 9 yes Figure 2 A flowchart of a specific embodiment of step 204 shown includes: Step 901: Compare the results of the time-series anomaly determination and / or the results of the business logic-related anomaly determination with a preset dedicated anomaly identification form to determine whether there is a target dedicated anomaly. Specifically, based on actual business conditions, specific anomalies corresponding to different business processes were compiled and summarized in advance, and specific anomaly identification forms were created. For example, when identifying anomalies in all business processing data involved in the insurance claims scenario of financial business, the corresponding business processing nodes include the application, review, and approval nodes during insurance processing, and the application, review, and approval nodes during underwriting, etc. The underwriting application node is often a high-incidence node for business anomalies. Therefore, anomalies at the underwriting application node can be set as a specific anomaly.

[0059] Step 902: If a target-specific anomaly exists, then according to the preset dynamic anomaly comprehensive first evaluation strategy, the anomaly representation data of the business processing data is output. In this embodiment, the preset dynamic comprehensive first evaluation strategy for anomalies refers to the evaluation strategy when there is a target-specific anomaly. For example, when the business processing node corresponding to the specific anomaly is removed, the anomaly weight value of other different business processing nodes is set to gradually decrease as the order of business processing nodes changes, the anomaly weight value of the business processing node with the anomaly is accumulated, and the anomaly weight value of the business processing node corresponding to the specific anomaly is additionally recorded as the dynamic comprehensive evaluation value of anomalies in the anomaly representation data.

[0060] Step 903: If there is no target-specific anomaly, then according to the preset dynamic anomaly comprehensive second evaluation strategy, output the anomaly representation data of the business processing data.

[0061] In this embodiment, the preset dynamic comprehensive second evaluation strategy for anomalies refers to the evaluation strategy when there are no target-specific anomalies. For example, as the business processing nodes proceed in sequence, the anomaly weight values ​​of different business processing nodes gradually decrease, and the anomaly weight values ​​of the business processing nodes with anomalies are accumulated to obtain the dynamic comprehensive evaluation value of anomalies in the anomaly representation data.

[0062] The execution anomaly identification provided in this embodiment obtains the business processing data to be identified; inputs the business processing data into a pre-trained dual-path feature processing model for business data feature extraction and identification. The pre-trained dual-path feature processing model includes a temporal feature processing branch and a graph neural network processing branch. The temporal feature processing branch is used to extract and identify temporal features from the business data features, while the graph neural network processing branch is used to extract and identify business logic-related features from the business data features. Based on the identification results of the business data features, it is determined whether there are temporal anomalies and business logic-related anomalies in the business processing data. Based on the temporal anomaly determination results, the business logic-related anomaly determination results, and a preset dynamic comprehensive evaluation strategy for anomalies, anomaly representation data of the business processing data is output. To avoid the one-sidedness of feature recognition results caused by using only a single data feature extraction structure for data feature extraction, this method can be applied to the financial business service field. For example, in the scenario of anomaly identification in insurance business, two feature processing structures are used: a sequential feature processing branch and a graph neural network processing branch. The input business processing data is processed in parallel to perform business data feature processing separately without interference, which improves the confidence and interpretability of the business anomaly identification results.

[0063] The embodiments of this application can acquire and process relevant data based on artificial intelligence technology. Artificial intelligence (AI) refers to the theories, methods, technologies, and application systems that use digital computers or machines controlled by digital computers to simulate, extend, and expand human intelligence, perceive the environment, acquire knowledge, and use that knowledge to obtain optimal results.

[0064] Foundational technologies for artificial intelligence generally include sensors, dedicated AI chips, cloud computing, distributed storage, big data processing, operating / interactive systems, and mechatronics. AI software technologies mainly encompass computer vision, robotics, biometrics, speech processing, natural language processing, and machine learning / deep learning.

[0065] The execution anomaly identification provided in this embodiment obtains the business processing data to be identified; inputs the business processing data into a pre-trained dual-path feature processing model for business data feature extraction and identification. The pre-trained dual-path feature processing model includes a temporal feature processing branch and a graph neural network processing branch. The temporal feature processing branch is used to extract and identify temporal features from the business data features, while the graph neural network processing branch is used to extract and identify business logic-related features from the business data features. Based on the identification results of the business data features, it is determined whether there are temporal anomalies and business logic-related anomalies in the business processing data. Based on the temporal anomaly determination results, the business logic-related anomaly determination results, and a preset dynamic comprehensive evaluation strategy for anomalies, anomaly representation data of the business processing data is output. To avoid the one-sidedness of feature recognition results caused by using only a single data feature extraction structure for data feature extraction, this method can be applied to the financial business service field. For example, in the scenario of anomaly identification in insurance business, two feature processing structures are used: a sequential feature processing branch and a graph neural network processing branch. The input business processing data is processed in parallel to perform business data feature processing separately without interference, which improves the confidence and interpretability of the business anomaly identification results.

[0066] Further reference Figure 10 As a response to the above Figure 2 To implement the method shown, this application provides an embodiment of an execution anomaly detection device, which is similar to... Figure 2 Corresponding to the method embodiments shown, this device can be specifically applied to various electronic devices.

[0067] like Figure 10 As shown, the execution anomaly identification device 10 described in this embodiment includes: a business processing data acquisition module 10a, a dual-path feature processing module 10b, an execution anomaly determination module 10c, and an anomaly characterization data output module 10d. Wherein: The business processing data acquisition module 10a is used to acquire business processing data to be identified for anomaly detection. The dual-path feature processing module 10b is used to input the business processing data into a pre-trained dual-path feature processing model to extract and identify business data features. The pre-trained dual-path feature processing model includes a temporal feature processing branch and a graph neural network processing branch. The temporal feature processing branch is used to extract temporal features and identify anomalies in the business data features, and the graph neural network processing branch is used to extract business logic correlation features and identify anomalies in the business data features. The execution anomaly determination module 10c is used to determine whether there are time-series anomalies and business logic correlation anomalies in the business processing data based on the identification results of business data characteristics. The anomaly characterization data output module 10d is used to output anomaly characterization data of the business processing data based on the time-series anomaly determination results, the business logic-related anomaly determination results, and the preset dynamic comprehensive evaluation strategy for anomalies. The anomaly characterization data includes the business logic node location information where the anomaly is located and the dynamic comprehensive evaluation value of the anomaly.

[0068] This application acquires business processing data for anomaly identification; inputs the business processing data into a pre-trained dual-path feature processing model for business data feature extraction and identification. The pre-trained dual-path feature processing model includes a temporal feature processing branch and a graph neural network processing branch. The temporal feature processing branch is used to extract and identify temporal features from the business data features, while the graph neural network processing branch is used to extract and identify business logic-related features from the business data features. Based on the identification results of the business data features, it determines whether temporal anomalies and business logic-related anomalies exist in the business processing data. Based on the temporal anomaly determination results, the business logic-related anomaly determination results, and a pre-set dynamic comprehensive evaluation strategy for anomalies, it outputs anomaly representation data of the business processing data. To avoid the one-sidedness of feature recognition results caused by using only a single data feature extraction structure for data feature extraction, this method can be applied to the financial business service field. For example, in the scenario of anomaly identification in insurance business, two feature processing structures are used: a sequential feature processing branch and a graph neural network processing branch. The input business processing data is processed in parallel to perform business data feature processing separately without interference, which improves the confidence and interpretability of the business anomaly identification results.

[0069] In this embodiment, the execution anomaly identification device 10 further includes an anomaly-free historical data acquisition module, an anomaly-free historical data parsing module, a business knowledge graph generation module, a time-series feature data generation module, and a model pre-training module. Wherein: The module for acquiring historical data without anomalies is used to receive historical processing data of business without anomalies uploaded from multiple data sources. The abnormal historical data parsing module is used to parse the abnormal business historical processing data, and identify the business processing nodes and processing steps contained in all the abnormal business historical processing data and the processing steps between each business processing node. The business knowledge graph generation module is used to generate a business knowledge graph based on the business processing nodes and the processing steps between each business processing node, wherein graph nodes are generated according to the business processing nodes, and edge relationship pointers between graph nodes are generated according to the processing steps. The time-series feature data generation module is used to transmit the abnormal business historical processing data to a preset time-series feature extraction network to extract business time-series features and generate a structured time-series feature dataset. The model pre-training module is used to pre-train a dual-path feature processing model, which includes a temporal feature processing branch and a graph neural network processing branch, using the business knowledge graph and the temporal feature dataset as training data, to obtain a pre-trained dual-path feature processing model.

[0070] In this embodiment, the model pre-training module includes an input discrimination identifier setting unit, a graph neural network processing branch learning and training unit, and a temporal feature processing branch learning and training unit. Wherein: The input differentiation identifier setting unit is used to set input differentiation identifiers for the business knowledge graph and the time-series feature dataset according to the input interface information corresponding to the time-series feature processing branch and the graph neural network processing branch, respectively. The graph neural network processing branch learning and training unit is used to input the business knowledge graph into the graph neural network processing branch based on the input distinguishing identifier corresponding to the business knowledge graph to perform business logic association feature extraction and learning, and obtain the pre-trained graph neural network processing branch; The temporal feature processing branch learning and training unit is used to input the temporal feature dataset into the temporal feature processing branch based on the input distinguishing identifier corresponding to the temporal feature dataset to perform business temporal feature extraction and learning, and obtain the pre-trained temporal feature processing branch.

[0071] In this embodiment, the dual-path feature processing module 10b includes a business logic-related feature extraction unit, a first verification unit, a temporal feature extraction unit, and a second verification unit. Wherein: The business logic association feature extraction unit is used to extract business logic association features from the business processing data using the pre-trained graph neural network processing branch, and to extract all business processing nodes and processing steps between each business processing node contained in the business processing data. The first verification unit is used to take all the business processing nodes and the processing steps between each business processing node as the first verification data, use the business knowledge graph as the verification domain to verify the graph node connection relationship and edge relationship of the first verification data, and output the verification result as the first identification result. The temporal feature extraction unit is used to extract temporal features from the business processing data using the pre-trained temporal feature processing branch, and to extract all business processing nodes and processing timestamp information corresponding to each business processing node contained in the business processing data. The second verification unit is used to use all the business processing nodes and the processing timestamp information corresponding to each business processing node as the second verification data, to verify whether the processing timestamp information corresponding to each business processing node conforms to the order of processing steps between each business processing node, and to output the verification result as the second identification result.

[0072] In this embodiment, the first verification unit is further configured to verify whether all business processing nodes correspond to a unique graph node in the business knowledge graph; to verify whether the processing steps between each business processing node correspond to corresponding graph node connection relationships and edge relationships in the business knowledge graph; to output a verification result of "passed without anomaly" if all business processing nodes correspond to a unique graph node in the business knowledge graph, and all graph nodes correspond to corresponding graph node connection relationships and edge relationships in the business knowledge graph; and to output a verification result of "failed with an anomaly" and mark the business processing node that caused the anomaly.

[0073] In this embodiment, the second verification unit is further configured to acquire the processing start time information and processing completion time information corresponding to each business processing node; further configured to serialize and organize all the processing start time information and processing completion time information according to the order of processing steps between each business processing node to obtain a processing time sequence; further configured to output the verification result as "passed without anomaly" if the processing time sequence conforms to the preset time sequence; and further configured to output the verification result as "failed with an anomaly" and mark the business processing node that caused the anomaly and the corresponding processing timestamp information.

[0074] In this embodiment, the execution anomaly identification device 10 further includes an identification result fusion and merging module and an identification result updating module. Wherein: The recognition result fusion and merging module is used to fuse and merge the first recognition result and the second recognition result to obtain the fused and merged comprehensive recognition result; The recognition result update module is used to update the comprehensive recognition result to the business data feature recognition result of the pre-trained dual-path feature processing model for the business processing data.

[0075] In this embodiment, the execution exception determination module 10c includes a first determination unit, a second determination unit, a third determination unit, and a fourth determination unit. Wherein: The first determining unit is configured to determine that if all output verification results are passed without any anomalies, then the business processing data does not have any time-series anomalies or business logic correlation anomalies. The second determining unit is used to determine if the output verification result is that there is an anomaly and only the business processing node that caused the anomaly is marked, without corresponding processing timestamp information, then the business processing data only has a business logic association anomaly. The third determining unit is used to determine if the output verification result is that there is an anomaly and the business processing node that caused the anomaly is marked and all the business processing nodes with anomalies have corresponding processing timestamp information, then the business processing data only has a time-series anomaly. The fourth determining unit is used to determine if the output verification result is that the business processing data has a time-series anomaly and a business logic association anomaly if the marked business processing node that caused the anomaly has a corresponding processing timestamp information.

[0076] In this embodiment, the anomaly characterization data output module 10d includes a dedicated anomaly comparison and identification unit, a first evaluation unit, and a second evaluation unit. Wherein: A dedicated anomaly comparison and identification unit is used to compare the time-series anomaly determination result and / or the business logic-related anomaly determination result with a preset dedicated anomaly identification form to determine whether a target dedicated anomaly exists. The first evaluation unit is used to output the abnormal characterization data of the business processing data according to the preset abnormal dynamic comprehensive first evaluation strategy if there is a target-specific abnormality. The second evaluation unit is used to output the anomaly representation data of the business processing data according to the preset anomaly dynamic comprehensive second evaluation strategy if there is no target-specific anomaly.

[0077] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by instructing related hardware through computer-readable instructions. These computer-readable instructions can be stored in a computer-readable storage medium. When the program is executed, it can include the processes of the embodiments of the methods described above. The aforementioned storage medium can be a non-volatile storage medium such as a magnetic disk, optical disk, or read-only memory (ROM), or random access memory (RAM).

[0078] It should be understood that although the steps in the flowcharts of the accompanying figures are shown sequentially as indicated by the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the accompanying figures may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily completed at the same time, but can be executed at different times, and their execution order is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the sub-steps or stages of other steps.

[0079] To address the aforementioned technical problems, embodiments of this application also provide a computer device. Please refer to [link / reference needed]. Figure 11 , Figure 11 This is a basic structural block diagram of the computer device in this embodiment.

[0080] The computer device 11 includes a memory 11a, a processor 11b, and a network interface 11c, which are interconnected via a system bus. It should be noted that... Figure 11 Only a computer device 11 with component memory 11a, processor 11b, and network interface 11c is shown in the illustration. However, it should be understood that it is not required to implement all of the shown components, and more or fewer components may be implemented instead. Those skilled in the art will understand that the computer device described herein is a device capable of automatically performing numerical calculations and / or information processing according to pre-set or stored instructions. Its hardware includes, but is not limited to, microprocessors, application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), digital signal processors (DSPs), embedded devices, etc.

[0081] The computer device can be a desktop computer, laptop, handheld computer, or cloud server, etc. The computer device can interact with the user via a keyboard, mouse, remote control, touchpad, or voice control.

[0082] The memory 11a includes at least one type of readable storage medium, including flash memory, hard disk, multimedia card, card-type memory (e.g., SD or DX memory), random access memory (RAM), static random access memory (SRAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), programmable read-only memory (PROM), magnetic memory, magnetic disk, optical disk, etc. In some embodiments, the memory 11a may be an internal storage unit of the computer device 11, such as the hard disk or memory of the computer device 11. In other embodiments, the memory 11a may also be an external storage device of the computer device 11, such as a plug-in hard disk, smart media card (SMC), secure digital (SD) card, flash card, etc. Of course, the memory 11a may include both internal storage units and external storage devices of the computer device 11. In this embodiment, the memory 11a is typically used to store the operating system and various application software installed on the computer device 11, such as computer-readable instructions for executing anomaly detection methods. In addition, the memory 11a can also be used to temporarily store various types of data that have been output or will be output.

[0083] In some embodiments, the processor 11b may be a central processing unit (CPU), a controller, a microcontroller, a microprocessor, or other data processing chip. The processor 11b is typically used to control the overall operation of the computer device 11. In this embodiment, the processor 11b is used to execute computer-readable instructions stored in the memory 11a or to process data, for example, to execute computer-readable instructions for performing the anomaly detection method.

[0084] The network interface 11c may include a wireless network interface or a wired network interface, which is typically used to establish communication connections between the computer device 11 and other electronic devices.

[0085] The computer device proposed in this embodiment belongs to the field of artificial intelligence technology and is applied in the scenario of anomaly handling and identification in business processing nodes. This application acquires business processing data to be identified; inputs the business processing data into a pre-trained dual-path feature processing model for feature extraction and identification. The pre-trained dual-path feature processing model includes a temporal feature processing branch and a graph neural network processing branch. The temporal feature processing branch is used to extract and identify temporal features in the business data features, while the graph neural network processing branch is used to extract and identify business logic-related features in the business data features. Based on the identification results of the business data features, it is determined whether there are temporal anomalies and business logic-related anomalies in the business processing data. Based on the temporal anomaly determination results, the business logic-related anomaly determination results, and a preset dynamic comprehensive evaluation strategy for anomalies, anomaly representation data of the business processing data is output. To avoid the one-sidedness of feature recognition results caused by using only a single data feature extraction structure for data feature extraction, this method can be applied to the financial business service field. For example, in the scenario of anomaly identification in insurance business, two feature processing structures are used: a sequential feature processing branch and a graph neural network processing branch. The input business processing data is processed in parallel to perform business data feature processing separately without interference, which improves the confidence and interpretability of the business anomaly identification results.

[0086] This application also provides another embodiment, namely, providing a computer-readable storage medium storing computer-readable instructions that can be executed by a processor to cause the processor to perform the steps of the above-described method for executing anomaly identification.

[0087] The computer-readable storage medium proposed in this embodiment belongs to the field of artificial intelligence technology and is applied to the scenario of anomaly handling and identification in business processing nodes. This application acquires business processing data to be identified; inputs the business processing data into a pre-trained dual-path feature processing model for feature extraction and identification. The pre-trained dual-path feature processing model includes a temporal feature processing branch and a graph neural network processing branch. The temporal feature processing branch is used to extract and identify temporal features in the business data features, while the graph neural network processing branch is used to extract and identify business logic-related features in the business data features. Based on the identification results of the business data features, it is determined whether there are temporal anomalies and business logic-related anomalies in the business processing data. Based on the temporal anomaly determination results, the business logic-related anomaly determination results, and a preset dynamic comprehensive evaluation strategy for anomalies, anomaly representation data of the business processing data is output. To avoid the one-sidedness of feature recognition results caused by using only a single data feature extraction structure for data feature extraction, this method can be applied to the financial business service field. For example, in the scenario of anomaly identification in insurance business, two feature processing structures are used: a sequential feature processing branch and a graph neural network processing branch. The input business processing data is processed in parallel to perform business data feature processing separately without interference, which improves the confidence and interpretability of the business anomaly identification results.

[0088] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) and includes several instructions to cause a terminal device (which may be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in the various embodiments of this application.

[0089] Obviously, the embodiments described above are only some embodiments of this application, not all embodiments. The accompanying drawings show preferred embodiments of this application, but do not limit the patent scope of this application. This application can be implemented in many different forms; rather, the purpose of providing these embodiments is to make the disclosure of this application more thorough and comprehensive. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art can still modify the technical solutions described in the foregoing specific embodiments, or make equivalent substitutions for some of the technical features. Any equivalent structures made using the content of this application's specification and drawings, directly or indirectly applied to other related technical fields, are similarly within the scope of patent protection of this application. Software tools or components not belonging to this company that appear in the embodiments of this application are merely illustrative examples and do not represent actual use.

[0090] It should be noted that if any AI model software tools or components not belonging to this company appear in the embodiments of this application, they are merely illustrative examples and do not represent actual use. All user personal information involved in the embodiments of this application is authorized (with the knowledge and consent) by the relevant parties or fully authorized by all parties, and the executing entity may obtain it through various legal and compliant means. The collection, storage, use, transmission, provision, and disclosure of the information, data, and signals involved all comply with relevant laws and regulations and do not violate public order and good morals.

Claims

1. A method for identifying execution anomalies, characterized in that, Includes the following steps: Obtain the business processing data to be identified for anomaly detection; The business processing data is input into a pre-trained dual-path feature processing model for business data feature extraction and recognition. The pre-trained dual-path feature processing model includes a temporal feature processing branch and a graph neural network processing branch. The temporal feature processing branch is used to extract temporal features and identify anomalies in the business data features, and the graph neural network processing branch is used to extract business logic correlation features and identify anomalies in the business data features. Based on the identification results of business data characteristics, determine whether the business processing data has any time-series anomalies and business logic correlation anomalies; Based on the time-series anomaly determination results, the business logic-related anomaly determination results, and the preset dynamic comprehensive evaluation strategy for anomalies, the anomaly characterization data of the business processing data is output. The anomaly characterization data includes the business logic node location information where the anomaly is located and the dynamic comprehensive evaluation value of the anomaly.

2. The execution anomaly identification method according to claim 1, characterized in that, Before performing the step of inputting the business processing data into the pre-trained dual-path feature processing model for business data feature extraction and recognition, the method further includes: Receive historical processing data of non-abnormal business uploaded from multiple data sources; The business processing nodes and processing steps of the historical processing data of the business without anomalies are parsed to identify the business processing nodes contained in all the historical processing data of the business without anomalies and the processing steps between each business processing node. Based on the business processing nodes and the processing steps between each business processing node, a business knowledge graph is generated, wherein graph nodes are generated according to the business processing nodes, and edge relationships between graph nodes are generated according to the processing steps. The abnormal business history processing data is transmitted to a preset time-series feature extraction network for business time-series feature extraction, generating a structured time-series feature dataset. Using the business knowledge graph and the temporal feature dataset as training data, a dual-path feature processing model, including a temporal feature processing branch and a graph neural network processing branch, is pre-trained to obtain a pre-trained dual-path feature processing model.

3. The execution anomaly identification method according to claim 2, characterized in that, The step of using the business knowledge graph and the temporal feature dataset as training data to pre-train a dual-path feature processing model, including a temporal feature processing branch and a graph neural network processing branch, to obtain a pre-trained dual-path feature processing model includes: Based on the input interface information corresponding to the time-series feature processing branch and the graph neural network processing branch, input differentiation identifiers are set for the business knowledge graph and the time-series feature dataset, respectively. Based on the input distinguishing identifier corresponding to the business knowledge graph, the business knowledge graph is input into the graph neural network processing branch for business logic association feature extraction and learning, thereby obtaining the pre-trained graph neural network processing branch; Based on the input distinguishing identifier corresponding to the time series feature dataset, the time series feature dataset is input into the time series feature processing branch for business time series feature extraction and learning, thereby obtaining the pre-trained time series feature processing branch.

4. The execution anomaly identification method according to any one of claims 1 to 3, characterized in that, The step of inputting the business processing data into a pre-trained dual-path feature processing model for business data feature extraction and recognition includes: The pre-trained graph neural network processing branch is used to extract business logic association features from the business processing data, and to extract all business processing nodes and processing steps between each business processing node contained in the business processing data. All business processing nodes and the processing steps between each business processing node are used as the first verification data. The business knowledge graph is used as the verification domain to verify the graph node connection relationship and edge relationship of the first verification data, and the verification result is output as the first identification result. The time-series feature processing branch, which has been pre-trained, is used to extract time-series features from the business processing data, thereby extracting all business processing nodes and the processing timestamp information corresponding to each business processing node contained in the business processing data. The processing timestamp information corresponding to all the business processing nodes and each business processing node is used as the second verification data to verify whether the processing timestamp information corresponding to each business processing node conforms to the order of processing steps between each business processing node, and the verification result is output as the second identification result.

5. The execution anomaly identification method according to claim 4, characterized in that, The step of using all the business processing nodes and the processing steps between each business processing node as the first verification data, using the business knowledge graph as the verification domain to verify the graph node connection relationship and edge relationship of the first verification data, and outputting the verification result as the first recognition result includes: Verify whether each of the aforementioned business processing nodes has a unique corresponding graph node in the business knowledge graph; Verify whether the processing steps between each business processing node have corresponding graph node connection relationships and edge relationships in the business knowledge graph; If all the business processing nodes have a unique graph node in the business knowledge graph, and all graph nodes have corresponding graph node connection relationships and edge relationships in the business knowledge graph, then the output verification result is "passed without anomalies". Otherwise, the output verification result will be "failed due to an anomaly", and the business processing node that caused the anomaly will be marked.

6. The execution anomaly identification method according to claim 4, characterized in that, The processing timestamp information includes processing start time information and processing completion time information. The step of using all business processing nodes and the processing timestamp information corresponding to each business processing node as second verification data to verify whether the processing timestamp information corresponding to each business processing node conforms to the order of processing steps between each business processing node, and outputting the verification result as the second identification result, includes: Obtain the processing start time and processing completion time information corresponding to each business processing node; Based on the sequential order of processing steps among various business processing nodes, all processing start time information and processing completion time information are serialized and organized to obtain a processing time sequence. If the processed time series conforms to the preset time sequence, the output verification result is "passed without anomalies". Otherwise, the output verification result will be "failed due to an anomaly", and the business processing node that caused the anomaly and the corresponding processing timestamp information will be marked.

7. The execution anomaly identification method according to claim 4, characterized in that, Before performing the step of determining whether the business processing data has temporal anomalies and business logic correlation anomalies based on the identification results of business data characteristics, the method further includes: The first identification result and the second identification result are merged to obtain a combined identification result. The comprehensive recognition result is updated to the business data feature recognition result of the pre-trained dual-path feature processing model for the business processing data; The step of determining whether the business processing data has temporal anomalies and business logic correlation anomalies based on the identification results of business data characteristics includes: If all output verification results are "pass" without any anomalies, then the business processing data does not have any time-series anomalies or business logic association anomalies. If the output verification result is "failed" and there is an anomaly, only the business processing node that caused the anomaly is marked, without corresponding processing timestamp information, then the business processing data only has a business logic association anomaly. If the output verification result is "failed" and the business processing node that caused the error is marked, and all the business processing nodes with errors have corresponding processing timestamp information, then the business processing data only has a time-series error. If the output verification result is "failed" and there is an anomaly, and the marked business processing node that caused the anomaly has corresponding processing timestamp information, then the business processing data has a time-series anomaly and a business logic association anomaly. The step of outputting anomaly representation data of the business processing data based on the time-series anomaly determination results, the business logic-related anomaly determination results, and the preset dynamic comprehensive anomaly evaluation strategy includes: By using a pre-set dedicated anomaly identification form, compare the results of the time-series anomaly determination and / or the results of the business logic-related anomaly determination to see if there is a target dedicated anomaly. If a target-specific anomaly exists, the anomaly representation data of the business processing data will be output according to the preset dynamic anomaly comprehensive first evaluation strategy. If no target-specific anomaly exists, then according to the preset dynamic anomaly comprehensive second evaluation strategy, the anomaly representation data of the business processing data is output.

8. An execution anomaly detection device, characterized in that, include: The business processing data acquisition module is used to acquire business processing data to be identified for anomaly detection. A dual-path feature processing module is used to input the business processing data into a pre-trained dual-path feature processing model to extract and identify business data features. The pre-trained dual-path feature processing model includes a temporal feature processing branch and a graph neural network processing branch. The temporal feature processing branch is used to extract temporal features and identify anomalies in the business data features, and the graph neural network processing branch is used to extract business logic correlation features and identify anomalies in the business data features. An execution anomaly determination module is used to determine whether the business processing data has temporal anomalies and business logic correlation anomalies based on the identification results of business data characteristics. The anomaly characterization data output module is used to output anomaly characterization data of the business processing data based on the time-series anomaly determination results, the business logic-related anomaly determination results, and the preset dynamic comprehensive evaluation strategy for anomalies. The anomaly characterization data includes the business logic node location information where the anomaly is located and the dynamic comprehensive evaluation value of the anomaly.

9. A computer device, characterized in that, The device includes a memory and a processor, wherein the memory stores computer-readable instructions, and the processor executes the computer-readable instructions to implement the steps of executing the anomaly identification method as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-readable instructions, which, when executed by a processor, implement the steps of the execution anomaly identification method as described in any one of claims 1 to 7.

Images