Data processing method and device, computer equipment, storage medium and program product

Abstract

This application provides a data processing method, apparatus, computer device, storage medium, and program product. The data processing method includes: acquiring business data, which includes N sets of operation data, each set describing a business operation performed by a business object within a first time period; constructing a graph structure among the N business objects based on the data similarity between the N sets of operation data; the graph structure includes N nodes and edges between the N nodes, with each node corresponding to one of the N business objects, and the edges corresponding to the data similarity between the N sets of operation data; performing clustering processing on the graph structure, and determining an abnormal object set from the N business objects based on the clustering results; the abnormal object set including multiple business objects with similar but abnormal business operations. Using this application embodiment can improve the efficiency and accuracy of identifying abnormal object sets.

Description

Technical Field

[0001] This application relates to the field of computer technology, specifically to a data processing method, a data processing apparatus, a computer device, a computer-readable storage medium, and a computer program product. Background Technology

[0002] Traffic fraud refers to the continuous and excessive execution of business operations on specific business objects by a collection of abnormal business objects. For example, continuously and excessively searching for a specific query, continuously and excessively clicking on a specific document (multimedia content, such as articles published by service accounts or videos published by video accounts), or continuously and excessively following specific accounts, etc., thereby continuously fabricating traffic data and improperly improving the search ranking of these specific business objects.

[0003] It's easy to see that identifying anomalous object sets from business objects performing business operations can effectively prevent traffic fraud. Currently, the identification of anomalous object sets relies on manually designed statistical rules. However, with the continuous development of computer technology, traffic fraud has gradually evolved from machine-based traffic fraud (which refers to using automated programs to simulate human operations to commit traffic fraud) to human-sourced traffic fraud (which refers to hiring real people to manually commit traffic fraud). The differences between fraudulent business objects and business objects performing normal business operations are becoming smaller and smaller. Existing manually designed statistical rules are not only labor-intensive and inefficient, but also prone to missing fraudulent business objects, resulting in low accuracy in identifying anomalous object sets. Summary of the Invention

[0004] This application provides a data processing method, apparatus, computer equipment, storage medium, and program product that can improve the efficiency and accuracy of identifying abnormal object sets.

[0005] On one hand, embodiments of this application provide a data processing method, which includes:

[0006] Obtain business data, which includes N sets of operation data. Each set of operation data describes the business operation performed by a business object within a first time period, where N is an integer greater than 1.

[0007] A graph structure is constructed based on the data similarity between N operational data sets. The graph structure includes N nodes and edges between the N nodes. The N nodes correspond one-to-one with the N business objects, and the edges between the N nodes correspond to the data similarity between the N operational data sets.

[0008] Cluster the graph structure and determine the set of abnormal objects from N business objects based on the clustering results. The set of abnormal objects includes multiple business objects with similar and abnormal business operations.

[0009] Accordingly, embodiments of this application provide a data processing apparatus, which includes:

[0010] The acquisition unit is used to acquire business data. The business data includes N sets of operation data. Each set of operation data describes the business operation performed by a business object in the first time period. N is an integer greater than 1.

[0011] The processing unit is used to construct a graph structure based on the data similarity between N operation data sets. The graph structure includes N nodes and edges between the N nodes. The N nodes correspond one-to-one with the N business objects, and the edges between the N nodes correspond to the data similarity between the N operation data sets.

[0012] The processing unit is also used to perform clustering processing on the graph structure and determine the set of abnormal objects from N business objects based on the clustering results of the graph structure. The set of abnormal objects includes multiple business objects with similar and abnormal business operations.

[0013] In one implementation, the processing unit, when constructing a graph structure based on the data similarity among N operational data sets, specifically performs the following steps:

[0014] Obtain the data similarity between any two operation data sets from N operation data sets;

[0015] A graph structure is constructed based on the data similarity between every two sets of operational data.

[0016] In one implementation, any set of operation data includes at least one set of operation data, and any set of operation data describes a business operation performed by a business object within a first time period; the processing unit, when obtaining the data similarity between any two sets of operation data among the N sets of operation data, specifically performs the following steps:

[0017] The operation data in each pair of operation data sets are compared to determine the synchronized operation data in each pair of operation data sets. The two synchronized operation data that describe the business operations in each pair of operation data sets are considered as one synchronized operation data for each other.

[0018] The data similarity between each pair of operation data sets is determined based on the number of synchronized operation data sets and the number of operation data sets in each pair of operation data sets.

[0019] In one implementation, any operation data includes the operation time and operation characteristic information of the corresponding business operation; the i-th operation data set and the j-th operation data set are any two of the N operation data sets, where i and j are integers less than or equal to N, and i is not equal to j; the i-th operation data set includes operation data of Q business operations, and the j-th operation data set includes operation data of R business operations, where Q and R are both positive integers;

[0020] The processing unit, used to compare the operation data in every two operation data sets, specifically performs the following steps to determine the synchronized operation data in each pair of operation data sets:

[0021] Based on the operation time of the qth business operation out of Q business operations, determine the operation time interval between the qth business operation and the rth business operation out of R business operations; q is a positive integer less than or equal to Q, and r is a positive integer less than or equal to R.

[0022] If the operation time interval is less than the time interval threshold, the operation feature information of the q-th business operation is compared with the operation feature information of the r-th business operation.

[0023] If the operation feature information of the q-th business operation matches the operation feature information of the r-th business operation, then the operation data of the q-th business operation and the operation data of the r-th business operation are determined to be a synchronized operation data.

[0024] In one implementation, any operation feature information includes operation type and operation attribute information; the processing unit, when comparing the operation feature information of the q-th business operation with the operation feature information of the r-th business operation, specifically performs the following steps:

[0025] Compare the operation type of the q-th business operation with the operation type of the r-th business operation;

[0026] If the operation type of the q-th business operation is the same as that of the r-th business operation, then the operation attribute information of the q-th business operation and the operation attribute information of the r-th business operation are compared.

[0027] If the operation attribute information of the q-th business operation matches the operation attribute information of the r-th business operation, then the operation feature information of the q-th business operation matches the operation feature information of the r-th business operation.

[0028] In one implementation, any operation feature information includes operation type and operation attribute information; the processing unit, when comparing the operation feature information of the q-th business operation with the operation feature information of the r-th business operation, specifically performs the following steps:

[0029] Compare the operation type of the q-th business operation with the operation type of the r-th business operation;

[0030] If the operation type of the q-th business operation is the same as that of the r-th business operation, then the operation attribute information of the q-th business operation is vectorized to obtain the operation attribute vector of the q-th business operation, and the operation attribute information of the r-th business operation is vectorized to obtain the operation attribute vector of the r-th business operation.

[0031] Calculate the vector similarity between the operation attribute vector of the q-th business operation and the operation attribute vector of the r-th business operation;

[0032] If the vector similarity is greater than the first similarity threshold, then the operation feature information of the q-th business operation is determined to match the operation feature information of the r-th business operation.

[0033] In one implementation, the i-th operation data set and the j-th operation data set are any two of the N operation data sets, where i and j are integers less than or equal to N, and i is not equal to j; the i-th operation data set is used to describe the business operation of the i-th business object among the N business objects, and the j-th operation data set is used to describe the business operation of the j-th business object among the N business objects.

[0034] The processing unit, used to construct the graph structure based on the data similarity between every two sets of operational data, specifically performs the following steps:

[0035] Create the i-th business object as the i-th node in the graph structure, and create the j-th business object as the j-th node in the graph structure;

[0036] If the data similarity between the i-th operation data set and the j-th operation data set is greater than the second similarity threshold, then create an edge ij between the i-th node and the j-th node;

[0037] The data similarity between the i-th and j-th operation data sets is determined as the weight of edge ij.

[0038] In one implementation, the clustering result of the graph structure includes at least one node cluster. Each node cluster is used to determine a set of objects from N business objects, where the set includes multiple business objects with similar business operations. The processing unit, when determining the set of abnormal objects from the N business objects based on the clustering result of the graph structure, specifically performs the following steps:

[0039] Obtain the set operation characteristics of at least one set of objects. The set operation characteristics of any set of objects are obtained by statistical analysis of the operation data set of each business object in the corresponding set of objects according to the operation type.

[0040] The set of objects whose set operation characteristics are greater than the characteristic threshold is identified as the abnormal set of objects.

[0041] In one implementation, the processing unit is further configured to perform the following steps:

[0042] Based on the business object dimension, perform anomaly analysis on the operation data set of each business object in the abnormal object set to obtain the anomaly detection information of the abnormal object set;

[0043] Based on the anomaly detection information, anomaly detection is performed on the first business object;

[0044] If the first business object is detected as an abnormal business object, then business filtering is performed on the business operations of the first business object.

[0045] In one implementation, any set of operation data includes at least one set of operation data, and any set of operation data includes an operation type and an operation object; the processing unit is used to perform anomaly analysis on the set of operation data of each business object in the set of abnormal objects according to the business object dimension, and when obtaining the anomaly detection information of the set of abnormal objects, it is specifically used to perform the following steps:

[0046] In the operation data set of each business object in the abnormal object set, count the number of operation data belonging to a specific operation scenario to obtain the specific operation count of the corresponding business object;

[0047] Business objects whose number of specific operations exceeds a first threshold are identified as specific business objects;

[0048] In the operation data set of a specific business object, the number of operation data for different operation objects under each operation type is counted to obtain the number of operations for different operation objects under each operation type for abnormal business objects.

[0049] Operation objects whose corresponding statistical operation count exceeds the second threshold under each operation type are identified as abnormal operation objects for each operation type.

[0050] The abnormal operation objects of each operation type are identified as the abnormal object set for abnormal detection information.

[0051] In one implementation, the processing unit, when performing anomaly detection on the first business object based on anomaly detection information, specifically executes the following steps:

[0052] Obtain the operation data of the first business object, which includes the first operation type and the first operation object;

[0053] Based on the first operation type of the first business object, determine the abnormal operation object corresponding to the first operation type in the abnormal detection information;

[0054] Based on the abnormal operation object corresponding to the first operation type, perform object detection on the first operation object of the first business object;

[0055] If the abnormal operation object corresponding to the first operation type matches the operation object of the first business object, then it is determined that the first business object is an abnormal business object.

[0056] Accordingly, embodiments of this application provide a computer device, which includes:

[0057] A processor is a tool for implementing computer programs.

[0058] A computer-readable storage medium storing a computer program adapted to be loaded by a processor and executed by the above-described data processing method.

[0059] Accordingly, embodiments of this application provide a computer-readable storage medium storing a computer program, which, when read and executed by a processor of a computer device, causes the computer device to perform the aforementioned data processing method.

[0060] Accordingly, this application provides a computer program product comprising a computer program stored in a computer-readable storage medium. A processor of a computer device reads the computer program from the computer-readable storage medium and executes the computer program, causing the computer device to perform the data processing method described above.

[0061] In this embodiment, the business data may include N sets of operation data. Each set of operation data can describe the business operation performed by a business object within a first time period. That is, the N sets of operation data can originate from the business operations performed by N business objects, and each set corresponds one-to-one with one of the N business objects, where N is an integer greater than 1. This embodiment analyzes and processes the operation data sets of the N business objects to intelligently identify sets of abnormal objects from among them. Compared to manual statistical rule identification, this improves the efficiency of identifying sets of abnormal objects. Furthermore, this embodiment can construct a graph structure between the N business objects based on the data similarity between the N sets of operation data. The graph structure may include N nodes and edges between the nodes, with each node corresponding one-to-one with one of the N business objects, and the edges corresponding to the data similarity between the N sets of operation data. By converting the data similarity between the N sets of operation data into a graph structure, it is easier to use graph structure algorithms to process the data similarity between the N sets of operation data, thus improving the accuracy of data processing. This application embodiment can perform clustering processing on graph structures and determine an abnormal object set from N business objects based on the clustering results. The abnormal object set can include multiple business objects with similar and abnormal business operations. It is easy to see that this application embodiment can significantly improve the identification accuracy of abnormal object sets by using a graph structure clustering algorithm to cluster and identify abnormal object sets. Therefore, this application embodiment can improve the identification efficiency and accuracy of abnormal object sets. Attached Figure Description

[0062] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0063] Figure 1 This is a schematic diagram of a data structure for operational data provided in an embodiment of this application;

[0064] Figure 2 This is a schematic diagram of a traffic fraud method provided in an embodiment of this application;

[0065] Figure 3 This is a schematic diagram of the architecture of a data processing system provided in an embodiment of this application;

[0066] Figure 4 This is a schematic diagram of the interface of a search function provided in an embodiment of this application;

[0067] Figure 5 This is a flowchart illustrating a data processing method provided in an embodiment of this application;

[0068] Figure 6 This is a schematic diagram illustrating a data similarity calculation method provided in an embodiment of this application;

[0069] Figure 7 This is a schematic diagram illustrating a clustering method for an object set provided in an embodiment of this application;

[0070] Figure 8 This is a flowchart illustrating another data processing method provided in an embodiment of this application;

[0071] Figure 9 This is a schematic diagram of the structure of a data processing device provided in an embodiment of this application;

[0072] Figure 10 This is a schematic diagram of the structure of a computer device provided in an embodiment of this application. Detailed Implementation

[0073] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of this application.

[0074] To better understand the technical solutions provided in the embodiments of this application, the technical terms used in the embodiments of this application will be introduced first:

[0075] I. Business:

[0076] A business refers to a business system that provides business functions. A business system can also be called a business platform. In other words, a business refers to a business platform that provides business functions. The business functions provided by a business may include, for example, instant messaging, payment, search, and multimedia content (e.g., articles, videos) operation functions, and so on.

[0077] II. Business Operations:

[0078] A business operation refers to the operation performed by a business object (a business object is an object that uses the business) on the business. By performing business operations, a business object can use the business functions provided by the business. For example, a business operation performed by business object A on the business could be that it searches for query A at time A, and business object A uses the business's search function through this business operation. As another example, a business operation performed by business object B on the business could be that it clicks on article B at time B, and business object B uses the business's multimedia content operation function through this business operation.

[0079] A business operation of a business object can be abstracted into a set of operation data. Abstraction means that a business operation can be described using a single set of operation data. The operation data obtained from the abstraction of a business operation is a triple, such as... Figure 1 As shown, the operation data may include the object identifier (UID) of the business object, the operation time (Timestamp), and the operation characteristic information (ConstraintList) of the business operation. Among them:

[0080] ① The object identifier of a business object can be used to uniquely identify a business object in a business context.

[0081] ② The operation time of a business operation refers to the timestamp of the business operation.

[0082] ③ Operational characteristic information of business operations can be used to characterize the operational features of business operations from different dimensions, and may include at least one of the following: operation type (action_type) and operation attribute information. Operation type refers to the type to which the business operation belongs; for example, operation type may include search, click, follow, read, and forward, etc. Operation attribute information may include the operational attributes of the business operation in different dimensions; for example, it may include at least one of the following: operation object (action_target), operation device-related attribute information (action_feat), business object-related attribute information (uin_feat), and operation object-related attribute information (target_feat), etc. Wherein:

[0083] The operation object refers to the object operated on by the business operation, such as query statements, service accounts, articles published by service accounts, video accounts, and videos published by video accounts, etc.; the operation device's attached attribute information refers to the device attribute information of the operation device used to perform the business operation, such as the device IP (Internet Protocol) address, device identifier (device ID), and device model, etc.; the business object's attached attribute information refers to the object attribute information of the business object performing the business operation, such as registration information, regional information, and instant messaging status information (e.g., the number of recent instant messaging messages), etc.; the operation object's attached attribute information refers to the object attribute information of the operation object, such as registration time, authentication type, number of followers, and number of views, etc.

[0084] Based on the above description of technical terms such as business and business operations, this application proposes a data processing method that can efficiently and accurately identify a set of abnormal objects involved in traffic fraud from business objects performing business operations. Traffic fraud methods include... Figure 2 As shown, crowdsourced tasks are published on third-party platforms. Business users can perform business operations such as searching, clicking, following, and providing positive reviews on specific targets within a specified time, according to the instructions of the crowdsourced task. This results in an abnormal surge in traffic to specific targets within a short period, thereby improving their search ranking. For businesses with search functionality, the quality of search results greatly affects the search experience. When specific targets (such as service accounts) that have achieved high rankings through traffic manipulation are found, but these service accounts cannot provide the corresponding services, it will severely impact the search experience. Therefore, identifying abnormal sets of targets involved in traffic manipulation is particularly important.

[0085] The data processing method proposed in this application takes into account the characteristics of traffic fraud (the characteristics of traffic fraud include: traffic fraud is a large-scale or fixed operation within a specified time range, and the business operations performed by the business objects participating in traffic fraud within the specified time range are similar). It can obtain the operation data of multiple business objects that perform business operations within the same time period. After calculating the data similarity between the operation data of multiple business objects, a graph structure can be constructed based on the data similarity. Then, the clustering algorithm of the graph structure can be applied to efficiently and accurately identify the abnormal object set from multiple business objects, thereby achieving the purpose of identifying the abnormal object set by combining time series and graph structure.

[0086] Furthermore, after identifying the set of anomalous objects, this data processing method can filter out the business operations of the anomalous object set from the business logic, thus reducing the interference and adverse effects of these operations on the business. In addition, after identifying the set of anomalous objects, this data processing method can further identify newly emerging anomalous business objects during business operation based on the set of anomalous objects. If the business operations of these newly emerging anomalous business objects are similar to those of the set of anomalous objects, their operations can also be filtered out, further reducing the interference and adverse effects of these new anomalous business object operations on the business.

[0087] In this application embodiment, the collection and processing of relevant data (e.g., operational data) should strictly comply with the requirements of relevant laws and regulations when applied in practice, obtain the informed consent or separate consent (or have a legal basis) of the personal information subject (e.g., business object), and carry out subsequent data use and processing within the scope of laws and regulations and the authorization of the personal information subject.

[0088] The data processing method provided in this application can be applied to computer equipment, which can be a server. The server mentioned in this application can be an independent physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, CDN (Content Delivery Network), and big data and artificial intelligence platforms, etc.

[0089] This application also provides a data processing system, such as... Figure 3 As shown, the data processing system may include at least one business client 301 and a server 302. This application embodiment does not limit the connection method between the business client 301 and the server 302. The business client 301 and the server 302 may establish a direct communication connection through wired communication, or the business client 301 and the server 302 may establish an indirect communication connection through wireless communication.

[0090] In this embodiment, the business client 301 refers to a program that communicates with the server 302 in a computer network. The business client 301 can provide a service interface for business objects, and business objects can interact with the business through the service interface provided by the business client 301, perform business operations on the business through the service interface provided by the business client 301, and use the business functions provided by the business. This application embodiment does not limit the type of business client. The business client may include, for example, any of the following: application, Web (World Wide Web) application, cloud application, and applet, etc. The server 302 can be used to provide technical service support to the business client.

[0091] In a data processing system consisting of business client 301 and server 302:

[0092] For business client 301:

[0093] The business client can receive business operations performed by the business object and send operation data describing the business operations to the server.

[0094] For server 302:

[0095] ① The server can preprocess the data being processed. Preprocessing can include pruning, grouping, and intra-group classification. Specifically:

[0096] Pruning can be used to delete operational data that does not meet data processing requirements. Incomplete data elements in the operational data can be a problem; for example, it may include at least one of the following: the operational data does not contain the operation time, the operation type, or the operation object, etc.

[0097] Grouping refers to dividing received operation data into different groups. Grouping is done along a time dimension using a sliding time window approach. Specifically, a time window defines a time period. Each slide of the time window defines a time period. The starting point of the time window can be used as the sliding point. The time window slides once at fixed intervals to define a time period. Operation data for business operations whose operation times belong to the same time period can be grouped together to obtain the business data for that time period. For example, using a two-hour time window and sliding every hour, operation data for business operations whose operation times belong to the time period [00:00-02:00] can be grouped together; operation data for business operations whose operation times belong to the time period [01:00-03:00] can be grouped together; and operation data for business operations whose operation times belong to the time period [02:00-04:00] can be grouped together.

[0098] Intra-group classification refers to categorizing operational data within the same group of business data according to business objects. Specifically, operational data for business operations belonging to the same business object can be added to the same set, resulting in an operational data set. Through intra-group classification, operational data belonging to the same group can be categorized into operational data sets for different business objects. In other words, through intra-group classification, the business data for each time period can include operational data sets for different business objects. For example, the business data for time period A may include operational data A1 for business object A, operational data B1 for business object B, operational data A2 for business object A, operational data B2 for business object B, and operational data B3 for business object B. After intra-group classification, we obtain the operational data set {operation data A1, operation data A2} for business object A, and the operational data set {operation data B1, operation data B2, operation data B3} for business object B.

[0099] ② For any given time period of business data (taking an operational data set containing N business objects as an example), the server can analyze and process the business data to identify a set of abnormal objects from the N business objects. Specifically, the server can construct a graph structure based on the data similarity between the operational data sets of the N business objects, use a graph clustering algorithm to cluster the graph structure, and determine the set of abnormal objects from the N business objects based on the clustering results.

[0100] ③ The server can filter operation data of abnormal object sets from the business logic.

[0101] ④ The server can detect newly emerging abnormal business objects in the business based on the abnormal object set.

[0102] ⑤ The server can filter the operation data of abnormal business objects from the business logic.

[0103] It is easy to see that by pruning, grouping, and classifying the data, we can reduce data complexity, thereby reducing the complexity of calculating data similarity and improving the efficiency of data similarity calculation, which in turn helps to improve the identification efficiency of abnormal object sets.

[0104] Figure 3 The data processing system shown in the embodiments is intended to more clearly illustrate the technical solutions of the embodiments of this application, and does not constitute a limitation on the technical solutions provided by the embodiments of this application. As those skilled in the art will know, with the evolution of system architecture and the emergence of new business scenarios, the technical solutions provided by the embodiments of this application are also applicable to similar technical problems.

[0105] The data processing method provided in this application can be applied to the search function of a business. The search function of the business will be described below, such as... Figure 4 As shown, the service interface 40 of the business client may include an entry point 401 for the search function. In response to the triggering operation of the entry point 401 for the search function, the function interface 41 for the search function can be displayed. Business operations can be performed on the search function in the function interface 41 for the search function. For example, a query statement can be entered in the search bar 411 to perform a search operation, and operations such as clicking, following, reading, and forwarding can be performed on the searched multimedia content.

[0106] The application of the data processing method provided in this application's embodiments in the search function is mainly reflected in the following two aspects: First, the data processing method provided in this application's embodiments can identify a set of abnormal objects among the business objects performing business operations on the search function, and can filter the business operations performed by the abnormal object set on the search function from the search function, avoiding interference and adverse effects of the abnormal object set on the search function. Second, after identifying the abnormal object set, the data processing method provided in this application's embodiments can detect newly emerging abnormal business objects among the business objects performing business operations on the search function based on the abnormal object set, and can filter the business operations of the newly emerging abnormal business objects from the search function, avoiding interference and adverse effects of the newly emerging abnormal business objects on the search function.

[0107] The data processing method provided in the embodiments of this application will be described in detail below.

[0108] This application provides a data processing method, which includes: a method for calculating data similarity, a method for constructing graph structures, clustering of graph structures, and a method for determining the set of outlier objects based on the clustering results. Figure 5 As shown, the data processing method may include, but is not limited to, the following steps S501-S503:

[0109] S501, Obtain business data. The business data includes N sets of operation data. Each set of operation data describes the business operation performed by a business object in the first time period. N is an integer greater than 1.

[0110] In step S501, business data refers to business data within a first time period. The first time period refers to any time period determined based on a time window during the aforementioned grouping process. Business data may include N sets of operation data. Each set of operation data can be used to describe the business operation performed by a business object within the first time period. That is, an operation data set can originate from a business object. Business data may include the operation data set of each of the N business objects, where N is an integer greater than 1.

[0111] Each set of operation data can include at least one set of operation data. One set of operation data can be used to describe a business operation performed by a business object within a first time period. In other words, each set of operation data can be used to describe a sequence of business operations performed by a business object within a first time period (a sequence of business operations consists of at least one business operation).

[0112] S502, construct a graph structure based on the data similarity between N operation data sets; the graph structure includes N nodes and edges between N nodes, the N nodes correspond one-to-one with N business objects, and the edges between N nodes correspond to the data similarity between N operation data sets.

[0113] In step S502, the data similarity between N operation data sets can be used to characterize the operation similarity between N business objects. The operation similarity between N business objects refers to the similarity between the business operations performed by the N business objects on the business. A graph structure is a data structure composed of nodes and edges between nodes. Nodes can also be called vertices or intersections, and edges can also be called links. Edges can have weights, and a graph structure with weights can be called a weighted graph structure. In this embodiment, a graph structure (specifically, a weighted graph structure) can be constructed based on the data similarity between N operation data sets. The graph structure can include N nodes and N edges between nodes. The N nodes can correspond one-to-one with the N business objects, and the edges between the N nodes can correspond to the data similarity between the N operation data sets. By constructing a graph structure, graph structure algorithms can be used to process the data similarity between the N operation data sets, improving data processing efficiency.

[0114] The process of constructing a graph structure may include the following sub-steps s11-s12:

[0115] s11, obtain the data similarity between every two operation data sets in N operation data sets.

[0116] In sub-step s11, the data similarity among the N operation data sets can include the data similarity between any pair of operation data sets (i.e., between every two operation data sets). Each operation data set can include at least one operation data, and any operation data can be used to describe a business operation performed by a business object within a first time period. In other words, any operation data set can be used to describe a sequence of business operations performed by a business object within a first time period (the sequence of business operations can include at least one business operation).

[0117] In detail, the calculation method for the data similarity between any two sets of data can include:

[0118] ① Compare the operation data in each pair of operation data sets to determine the synchronous operation data in each pair of operation data sets.

[0119] Two synchronized operation data sets describing business operations within any two operation data sets constitute a single synchronized operation data set. These two operation data sets originate from different operation data sets. Synchronization of business operations means that the operation times are close and the operation characteristics match. In other words, synchronized operation data sets within any two operation data sets refer to two operation data sets whose operation times are close and whose operation characteristics match. The business operations corresponding to two synchronized operation data sets are considered synchronous operations. The definition of a synchronous operation can include: the time difference between the two business operations is within a time interval threshold (e.g., within one hour), and the operation characteristics of the two business operations match.

[0120] The following section uses the i-th and j-th operation data sets out of N operation data sets as examples to illustrate the process of determining the synchronous operation data in the i-th and j-th operation data sets. The i-th and j-th operation data sets are any two of the N operation data sets, where i and j are integers less than or equal to N, and i is not equal to j. The i-th operation data set may include operation data for Q business operations, and the j-th operation data set may include operation data for R business operations, where Q and R are both positive integers. Each operation data set may include operation time and operation characteristic information.

[0121] In detail, the process of determining the synchronized operation data in the i-th and j-th operation data sets can include: determining the operation time interval between the q-th and r-th business operations based on the operation time of the q-th business operation in the Q business operations and the operation time of the r-th business operation in the R business operations; where q is a positive integer less than or equal to Q and r is a positive integer less than or equal to R; if the operation time interval is less than the time interval threshold, the operation feature information of the q-th business operation can be compared with the operation feature information of the r-th business operation; if the operation feature information of the q-th business operation matches the operation feature information of the r-th business operation, then the operation data of the q-th business operation and the operation data of the r-th business operation can be determined to be synchronized operation data.

[0122] Optionally, any operation feature information may include operation type and operation attribute information. The process of comparing the operation feature information of the q-th business operation with the operation feature information of the r-th business operation may include any of the following:

[0123] The first method is self-comparison of information:

[0124] Information self-comparison refers to comparing information with its original form. Specifically, the operation type of the q-th business operation can be compared with the operation type of the r-th business operation. If the operation types of the q-th and r-th business operations are the same, then the operation attribute information of the q-th business operation can be compared with the operation attribute information of the r-th business operation. If the operation attribute information of the q-th and r-th business operations matches, then the operation feature information of the q-th business operation matches the operation feature information of the r-th business operation. If the operation types of the q-th and r-th business operations are different, or if the operation attribute information of the q-th and r-th business operations does not match, then the operation feature information of the q-th and r-th business operations does not match.

[0125] Wherein, matching the operation attribute information of the q-th business operation with the operation attribute information of the r-th business operation means that the operation attribute information of the q-th business operation is the same or similar to that of the r-th business operation; mismatching the operation attribute information of the q-th business operation with the operation attribute information of the r-th business operation means that the operation attribute information of the q-th business operation is different or dissimilar to that of the r-th business operation.

[0126] To illustrate, taking operation data including operation type (action_type), operation time (Timestamp), and operation target (action_target) as an example, if the time interval between the operation time of the q-th business operation and the operation time of the r-th business operation is within 1 hour, and the operation type of the q-th business operation and the operation type of the r-th business operation are both search, and the query searched by the q-th business operation is the same as or similar to the query searched by the r-th business operation, then it can be determined that the q-th business operation and the r-th business operation are synchronous operations, and the operation data of the q-th business operation and the operation data of the r-th business operation are synchronous operation data.

[0127] The second method involves comparing information after vectorization:

[0128] Information vectorization comparison refers to comparing information with its vectorized results. Specifically, the operation type of the q-th business operation can be compared with the operation type of the r-th business operation. If the operation types of the q-th and r-th business operations are the same, the operation attribute information of the q-th business operation can be vectorized to obtain the operation attribute vector of the q-th business operation. This operation attribute vector can be used to represent the operation attribute information of the q-th business operation. Similarly, the operation attribute information of the r-th business operation can be vectorized to obtain the operation attribute vector of the r-th business operation. The vector similarity between the operation attribute vectors of the q-th and r-th business operations can be calculated. If the vector similarity is greater than a first similarity threshold (which can be determined based on empirical values), then the operation feature information of the q-th business operation is considered to match the operation feature information of the r-th business operation. If the operation type of the q-th business operation is different from that of the r-th business operation, or if the vector similarity is less than or equal to the first similarity threshold, then it can be determined that the operation feature information of the q-th business operation does not match the operation feature information of the r-th business operation.

[0129] To illustrate, taking operation data including operation type (action_type), operation time (Timestamp), operation target (action_target), and operation target-related attribute information (target_feat) as an example, if the time interval between the operation time of the q-th business operation and the operation time of the r-th business operation is within 1 hour, and the operation type of both the q-th and r-th business operations is click, and the vector similarity between the first vector of the article clicked by the q-th business operation (e.g., the first vector is obtained by vectorizing the article identifier and article-related attribute information of the article clicked by the q-th business operation) and the second vector of the article clicked by the r-th business operation (e.g., the second vector is obtained by vectorizing the article identifier and article-related attribute information of the article clicked by the r-th business operation) is greater than the first similarity threshold, then it can be determined that the q-th and r-th business operations are synchronous operations, and the operation data of the q-th and r-th business operations are synchronous operation data.

[0130] In the method of comparing information after vectorization, the comparison can be carried out by converting two operational attribute information into corresponding vectors and then calculating the vector similarity. This can reduce the difficulty of information comparison and improve the comparison efficiency between two operational attribute information.

[0131] ② Determine the data similarity between each pair of operation data sets based on the number of synchronized operation data sets and the number of operation data sets in each pair of operation data sets.

[0132] In this embodiment, the Jaccard similarity is used to calculate the data similarity between any two sets of data. Jaccard similarity is a statistical measure used to compare the similarity between two sets. Given two sets A... i and A j Jaccard similarity can be defined as the ratio between the size of the intersection of two sets and the size of the union of the two sets, as shown in Formula 1 below:

[0133]

[0134] In Formula 1 above, sim(A) i A j ) represents the Jaccard similarity, |A i ∩A j | represents two sets A i and A j The intersection between them, |A i ∪A j | represents two sets A i and A j The union of the two.

[0135] In the embodiments of this application, the calculation method for the data similarity between each pair of operation data sets may include: determining a first quantity based on the difference between the number of operation data in each pair of operation data sets and the number of synchronous operation data, wherein the first quantity is equal to the number of operation data in each pair of operation data sets minus the number of synchronous operation data; the first quantity corresponds to the union between each pair of operation data sets, and the number of synchronous operation data corresponds to the intersection between each pair of operation data sets; the quotient obtained by dividing the number of synchronous operation data by the first quantity is determined as the data similarity between each pair of operation data sets.

[0136] like Figure 6 As shown, the operation data in operation data set A of business object A can be represented by triangle symbols, and the operation data in operation data set B of business object B can be represented by square symbols. The lines connecting the triangle symbols and the square symbols indicate that the operation data represented by the triangle symbols and the operation data represented by the square symbols are synchronized operation data. If it is stipulated that the same operation data can only be synchronized with one other operation data, then the number of synchronized operation data in operation data set A and operation data set B can be 2.

[0137] The intersection of operation data set A and operation data set B is the number of synchronous operation data in operation data set A and operation data set B, and the intersection = min(3,2) = 2; the union = cnt(triangle symbol) + cnt(square symbol) - cnt(intersection) = 6 + 5 - 2 = 9, where cnt(triangle symbol) represents the number of operation data in operation data set A, cnt(square symbol) represents the number of operation data in operation data set B, and cnt(intersection) represents the number of synchronous operation data in operation data set A and operation data set B; the Jaccard similarity = intersection / union = 2 / 9 = 0.220, that is, the data similarity between operation data set A and operation data set B is 0.220.

[0138] This application embodiment takes calculating the data similarity between operation data sets within a first time period as an example. In actual business scenarios, for each time period determined by the time window, it is necessary to calculate the data similarity between every two operation data sets in the business data of the corresponding time period. Table 1 below shows the data similarity between the operation data sets of two business objects in three time periods (specifically, the data similarity between the operation data sets of two business objects in the time periods of [06:00-08:00], [08:00-10:00], and [10:00-12:00] of a day):

[0139] Table 1

[0140] Time period Business Object 1 Business Object 2 Data similarity [06:00-08:00) Business object A Business object B 0.065 [08:00-10:00) Business object C Business object D 0.117 [10:00-12:00) Business object E Business object F 0.333

[0141] s12, constructs a graph structure based on the data similarity between every two sets of operational data.

[0142] In sub-step s12, the construction process of the graph structure is introduced using the i-th and j-th operation data sets among the N operation data sets as examples. The i-th and j-th operation data sets are any two of the N operation data sets, where i and j are integers less than or equal to N, and i is not equal to j. The i-th operation data set can be used to describe the business operation of the i-th business object among the N business objects, and the j-th operation data set can be used to describe the business operation of the j-th business object among the N business objects.

[0143] The process of constructing the graph structure can include: creating the i-th business object as the i-th node in the graph structure, and creating the j-th business object as the j-th node in the graph structure; if the data similarity between the i-th and j-th operation data sets is greater than a second similarity threshold (the second similarity threshold can be determined based on empirical values), then an edge ij can be created between the i-th and j-th nodes, and the data similarity between the i-th and j-th operation data sets can be determined as the weight of edge ij; if the data similarity between the i-th and j-th operation data sets is less than or equal to the second similarity threshold, then there is no edge between the i-th and j-th nodes; and so on, traversing every two operation data sets in the N operation data sets, performing the similarity construction process with the i-th and j-th operation data sets, to obtain the graph structure.

[0144] S503, perform clustering on the graph structure, and determine the set of abnormal objects from N business objects based on the clustering results of the graph structure. The set of abnormal objects includes multiple business objects with similar and abnormal business operations.

[0145] In step S503, this application embodiment does not limit the clustering processing algorithm for graph structures. This application embodiment takes the Louvain community detection algorithm as an example to introduce the clustering processing process for graph structures. Louvain is a community detection algorithm based on modularity, which can be used to divide the nodes in the graph structure into several communities.

[0146] Specifically, the clustering process for graph structures can include: dividing each node in the graph structure into a community; performing iterative community division on the graph structure multiple times; and determining at least one community in the graph structure after the iteration terminates as at least one node cluster, where one community can correspond to one node cluster. The clustering result of the graph structure can include at least one node cluster. A node cluster can be used to determine a set of objects from N business objects. Business objects corresponding to multiple nodes in the same node cluster can be determined as a set of objects, which can include multiple business objects with similar business operations.

[0147] The process of community partitioning can include: traversing each node in the graph structure and calculating the change in modularity of the graph structure after moving each node to its neighboring communities; one change in modularity corresponds to one neighboring community, and the change in modularity can be used to indicate the quality of community partitioning in the graph structure; if the change in modularity of each neighboring community is greater than or equal to the first change, then each node can be moved to the neighboring community corresponding to the largest change in modularity, updating the graph structure. The updating methods for the graph structure can include: defining the entire community with moved nodes as a special node in the graph structure; merging the weights of all edges in the community with moved nodes into the self-loop weight of the special node; and merging the weights of edges between communities with moved nodes into the weights of edges between special nodes.

[0148] The iteration termination condition may include the change in modularity being less than a first change and greater than a second change, or the change in modularity being less than or equal to the second change; wherein the first change and the second change can be set based on empirical values, for example, the first change can be set to 0.0001 and the second change can be set to 0.

[0149] In step S503, at least one node cluster in the clustering result can be used to determine at least one set of objects from N business objects. The process of determining the abnormal set of objects from N business objects may include: obtaining the set operation features of at least one set of objects, and determining the set of objects whose set operation features are greater than a feature threshold (here, the feature threshold refers to the first feature threshold, which can be set according to an empirical value) as the abnormal set of objects.

[0150] The set operation characteristics of any object set can be obtained by statistically analyzing the operation data sets of each business object in the corresponding object set according to the operation type. This application embodiment does not limit the operation type used for statistical analysis and may include at least one of the following: statistical analysis based on a single operation type, and statistical analysis based on combinations of operation types. Statistical analysis based on a single operation type may include at least one of the following: counting the total number of searches for the object set, counting the total number of clicks for the object set, counting the total number of views for the object set, counting the top M (M is a positive integer) search queries in the object set, and counting the top M clicked multimedia content in the object set, etc. Statistical analysis based on combinations of operation types may include at least one of the following: counting the search click-through rate of the object set (the search click-through rate of the object set can be equal to the total number of clicks of the object set divided by the total number of searches of the object set), and counting the click-through view rate of the object set (the click-through view rate of the object set can be equal to the total number of views of the object set divided by the total number of clicks of the object set), etc.

[0151] This application embodiment takes determining the set of abnormal objects within a first time period as an example. In actual business scenarios, for each time period determined by the time window, it is necessary to determine the set of abnormal objects. Therefore, it is necessary to statistically analyze the set operation characteristics of the object sets. Table 2 below shows the set operation characteristics of the object sets determined in four time periods (specifically, the set operation characteristics of the object sets determined in the time periods [22:00-00:00], [05:00-07:00], [11:00-13:00], and [21:00-23:00] of a day):

[0152] Table 2

[0153]

[0154]

[0155] Optionally, within the at least one object set determined based on the clustering results, the at least one object set can be filtered based on the number of objects in the set or the set operation characteristics to obtain a filtered object set. Specifically, object sets with a number of objects less than an object count threshold or a set operation characteristic less than a second characteristic threshold can be filtered. The object count threshold and the second characteristic threshold can be set based on empirical values. Object sets within the filtered object set whose set operation characteristics are greater than a first characteristic threshold can be identified as abnormal object sets. The second characteristic threshold is different from the first characteristic threshold. For example, object sets with fewer than 10 objects or fewer than 10 total clicks can be filtered out of the at least one object set. It is easy to see that object sets with fewer than the object count threshold or a set operation characteristic less than the second characteristic threshold have a small number of objects, which does not conform to the characteristics of traffic fraud. By filtering out object sets that do not conform to the characteristics of traffic fraud, the accuracy of identifying abnormal object sets can be improved.

[0156] In the embodiments of this application, such as Figure 7As shown, for N business objects that performed business operations within the same time period (e.g., the first time period), a single business operation of a business object can be described by a single operation data set. The sequence of business operations performed by each business object within the first time period, consisting of at least one operation, can be described by a set of operation data sets. A graph structure can be constructed based on the data similarity between the operation data sets of each pair of business objects among the N business objects. A graph clustering algorithm can then be used to cluster the graph structure, identifying sets of objects with similar business operations among the N business objects. Sets of objects whose set operation characteristics exceed a certain threshold can be identified as anomalous object sets. Therefore, introducing graph clustering into the identification of anomalous object sets allows for similarity clustering, which is suitable for accurately identifying sets of multiple business objects with similar business operations among the N business objects. This further enables more accurate identification of anomalous object sets within these sets, improving the accuracy of anomalous object identification.

[0157] This application provides a data processing method, which includes: an anomaly detection process based on a set of abnormal objects, and business filtering of business operations on detected abnormal business objects. For example... Figure 8 As shown, the data processing method may include, but is not limited to, the following steps S801-S806:

[0158] S801, Obtain business data. The business data includes N sets of operation data. Each set of operation data describes the business operation performed by a business object in the first time period. N is an integer greater than 1.

[0159] In this embodiment of the application, the execution process of step S801 is the same as described above. Figure 5 The execution process of step S501 in the illustrated embodiment is the same; please refer to the above for details. Figure 5 The relevant description of step S501 in the illustrated embodiment will not be repeated here.

[0160] S802, construct a graph structure based on the data similarity between N operation data sets; the graph structure includes N nodes and edges between N nodes, the N nodes correspond one-to-one with N business objects, and the edges between N nodes correspond to the data similarity between N operation data sets.

[0161] In this embodiment, the execution process of step S802 is the same as described above. Figure 5 The execution process of step S502 in the illustrated embodiment is the same; please refer to the above for details. Figure 5 The relevant description of step S502 in the illustrated embodiment will not be repeated here.

[0162] S803 performs clustering on the graph structure and determines the set of abnormal objects from N business objects based on the clustering results of the graph structure. The set of abnormal objects includes multiple business objects with similar and abnormal business operations.

[0163] In this embodiment, the execution process of step S803 is the same as described above. Figure 5 The execution process of step S503 in the illustrated embodiment is the same; please refer to the above for details. Figure 5 The relevant description of step S503 in the illustrated embodiment will not be repeated here.

[0164] Optionally, after identifying the set of abnormal objects, business data of the business objects in the set can be filtered. Business filtering refers to removing the operation data of the business objects in the set from the business logic, specifically deleting the operation data of the business objects in the set from the operation log. The operation log records the operation data of business objects. By deleting the operation data from the set of abnormal objects, it is possible to prevent the operation data of certain business objects in the set from causing improper search rankings for certain operation objects, thereby helping the business to provide accurate search functionality.

[0165] Optionally, after identifying the set of abnormal objects, newly emerging abnormal business objects in the business can be detected based on the set of abnormal objects, and the newly emerging abnormal business objects in the business can be recalled to realize the diffusion of the set of abnormal objects. The detection method for newly emerging abnormal business objects can be found in the following steps S804-S806:

[0166] S804, according to the business object dimension, performs anomaly analysis on the operation data set of each business object in the abnormal object set to obtain the anomaly detection information of the abnormal object set.

[0167] In step S804, anomaly analysis can be used to analyze the operation data of each business object in the set of anomalies, analyze the anomaly characteristics of the set of anomalies, and use the anomaly characteristics as anomaly detection information of the set of anomalies. The anomaly detection information can be used to detect anomalies in the business and detect newly appearing abnormal business objects in the business.

[0168] In detail, the anomaly analysis process may include: counting the number of operation data belonging to a specific operation scenario in the operation data set of each business object in the anomaly object set to obtain the specific operation quantity of the corresponding business object; identifying business objects whose specific operation quantity is greater than a first threshold as specific business objects, where the first threshold can be set based on experience; counting the number of operation data for different operation objects under each operation type in the operation data set of specific business objects to obtain the statistical operation quantity of the anomaly business object for different operation objects under each operation type; identifying operation objects whose corresponding statistical operation quantity under each operation type is greater than a second threshold as anomaly operation objects of each operation type, where the second threshold can be set based on experience; and identifying the anomaly operation objects of each operation type as anomaly detection information of the anomaly object set. In other words, the anomaly detection information of anomaly object detection may include anomaly operation objects of each operation type.

[0169] For example, the number of operation data for a specific search scenario or the number of operation data for clicking specific multimedia content can be counted within the operation data set of each business object in the abnormal object set to obtain the specific operation count. Taking the count of operation data for a specific search scenario as an example, if the specific operation count of business object A in the abnormal object set is greater than a first threshold, then business object A can be identified as a specific business object. The number of different search queries and the number of different multimedia content clicks can be counted within the operation data set of business object A. Query queries with a search count greater than a second threshold can be identified as abnormal operation objects corresponding to the search type, and multimedia content clicks with a click count greater than the second threshold can be identified as abnormal operation objects corresponding to the click type. The abnormal operation objects corresponding to the search type and the abnormal operation objects corresponding to the click type can be identified as the abnormal detection information of the abnormal object set.

[0170] In the above anomaly analysis process, we can first filter out specific business objects that have been operated on frequently under specific operational scenarios from the set of anomaly objects. This is because the set of anomaly objects obtained through clustering may contain some noise. Noise refers to business objects that are not originally intended to be cheating being clustered into the set of anomaly objects. These noisy business objects have fewer operations under specific operational scenarios. By filtering out specific business objects and removing those that are not originally intended to be cheating from the set of anomaly objects, the accuracy of the set of anomaly business objects can be improved.

[0171] In the above anomaly analysis process, the anomaly detection information of the set of anomalous objects can be identified by identifying the operation objects with the most frequent operations under various operation types for specific high-precision business objects. For example, the query statements with the most frequent searches for specific high-precision business objects, and the multimedia content with the most frequent clicks for specific high-precision business objects, can be identified as the anomaly detection information of the set of anomalous objects for newly accessed business objects. It is easy to see that the anomaly detection information includes operation objects with a high number of operations. Such operation objects have typical abnormal characteristics. Anomaly detection based on such anomaly detection information is beneficial to improving the accuracy and precision of anomaly detection.

[0172] S805, perform anomaly detection on the first business object based on the anomaly detection information.

[0173] In step S805, anomaly detection can be performed on the first business object performing the business operation based on the anomaly detection information. The anomaly detection process may include: obtaining the operation data of the first business object, which may include a first operation type and a first operation object; determining the abnormal operation object corresponding to the first operation type in the anomaly detection information based on the first operation type of the first business object; performing object detection on the operation object of the first business object based on the abnormal operation object corresponding to the first operation type; if the abnormal operation object corresponding to the first operation type matches the operation object of the first business object, it can be determined that the first business object is detected as an abnormal business object.

[0174] For example, the operation data of the first business object includes the search type and the search query statement. Based on the search type, the abnormal operation object corresponding to the search type can be determined in the anomaly detection information, that is, the abnormal query statement corresponding to the search type. If the search query statement of the first business object is the same as or similar to the abnormal query statement corresponding to the search type, then the first business object can be determined to be an abnormal business object.

[0175] S806 If the first business object is detected as an abnormal business object, then the business operations of the first business object are filtered.

[0176] In step S806, if the first business object is detected as an abnormal business object, business filtering can be performed on the abnormal object's operation data. Business filtering refers to filtering the operation data of the abnormal business object from the business, specifically deleting the operation data of the abnormal business object from the operation log. The operation log can be used to record the operation data of business objects on the business. Deleting the operation data of abnormal business objects from the operation log can prevent the operation data of abnormal business objects from causing certain specific objects in the business to generate improper search rankings, thereby helping the business to provide accurate search functions.

[0177] Optionally, the operation data of abnormal business objects can be filtered immediately upon detection. Immediate filtering means that if an abnormal business object is detected, its operation data can be immediately deleted from the operation log, thus quickly preventing the adverse impact of the abnormal business object's operation data on the business.

[0178] Alternatively, the operation data of abnormal business objects can be filtered in batches according to a period. Batch filtering according to a period means that if an abnormal business object is detected within each period, its operation data can be written offline to a database table. At the end of each period, all operation data in the database table can be deleted in batches from the operation log, and the database table can be cleared after the batch deletion. Periods can include, for example, one hour, six hours, half a day, one day, three days, and one week, etc. Taking a one-day period as an example, the operation data of abnormal business objects can be filtered in batches at the daily level. If an abnormal business object is detected within a day, its operation data can be written offline to a database table. At midnight each day, all operation data in the database table can be deleted in batches from the operation log. After the batch deletion, the database table can be cleared, and batch filtering can begin for the next day. Batch filtering improves the efficiency of filtering the operation data of abnormal business objects.

[0179] This application uses an SQL table as an example of a database table. An SQL table is a logical structure used to store data in a relational database management system, but this does not constitute a limitation on the embodiments of this application.

[0180] In this embodiment, graph-based clustering is introduced during the identification of abnormal object sets. Clustering can be used for similarity clustering, which meets the requirement of identifying multiple business objects with similar business operations. Through similarity clustering, a set of objects containing multiple business objects with similar business operations can be accurately identified from N business objects. This allows for the accurate identification of abnormal object sets within the object set, improving the accuracy of abnormal object identification. After identifying the abnormal object set, specific business objects with a high number of operations under specific operational scenarios can be filtered out. Based on these specific business objects and the high number of operations under their respective operation types, the business operations are detected, accurately identifying newly emerging abnormal business objects.

[0181] The methods of the embodiments of this application have been described in detail above. In order to facilitate better implementation of the above solutions of the embodiments of this application, the apparatus of the embodiments of this application is provided below.

[0182] Please see Figure 9 , Figure 9 This is a schematic diagram of the structure of a data processing device provided in an embodiment of this application. The data processing device can be installed in the computer equipment provided in the embodiment of this application, and the computer equipment can be a server. Figure 9 The data processing device shown can be a computer program running on a computer device, which can be used to execute... Figure 5 or Figure 8 Some or all of the steps in the method embodiments shown. Please refer to [link / reference]. Figure 9 The data processing apparatus may include the following units:

[0183] Acquisition unit 901 is used to acquire business data. The business data includes N operation data sets. Each operation data set is used to describe the business operation performed by a business object in the first time period. N is an integer greater than 1.

[0184] Processing unit 902 is used to construct a graph structure based on the data similarity between N operation data sets; the graph structure includes N nodes and edges between N nodes, the N nodes correspond one-to-one with N business objects, and the edges between N nodes correspond to the data similarity between N operation data sets;

[0185] The processing unit 902 is also used to perform clustering processing on the graph structure and determine the abnormal object set from N business objects based on the clustering results of the graph structure. The abnormal object set includes multiple business objects with similar and abnormal business operations.

[0186] In one implementation, when processing unit 902 constructs a graph structure based on the data similarity among N operational data sets, it specifically performs the following steps:

[0187] Obtain the data similarity between any two operation data sets from N operation data sets;

[0188] A graph structure is constructed based on the data similarity between every two sets of operational data.

[0189] In one implementation, any set of operation data includes at least one set of operation data, and any set of operation data is used to describe a business operation performed by a business object within a first time period; the processing unit 902, when obtaining the data similarity between every two sets of operation data in the N sets of operation data, specifically performs the following steps:

[0190] The operation data in each pair of operation data sets are compared to determine the synchronized operation data in each pair of operation data sets. The two synchronized operation data that describe the business operations in each pair of operation data sets are considered as one synchronized operation data for each other.

[0191] The data similarity between each pair of operation data sets is determined based on the number of synchronized operation data sets and the number of operation data sets in each pair of operation data sets.

[0192] In one implementation, any operation data includes the operation time and operation characteristic information of the corresponding business operation; the i-th operation data set and the j-th operation data set are any two of the N operation data sets, where i and j are integers less than or equal to N, and i is not equal to j; the i-th operation data set includes operation data of Q business operations, and the j-th operation data set includes operation data of R business operations, where Q and R are both positive integers;

[0193] Processing unit 902 is used to compare the operation data in every two operation data sets and determine the synchronous operation data in every two operation data sets. Specifically, it performs the following steps:

[0194] Based on the operation time of the qth business operation out of Q business operations, determine the operation time interval between the qth business operation and the rth business operation out of R business operations; q is a positive integer less than or equal to Q, and r is a positive integer less than or equal to R.

[0195] If the operation time interval is less than the time interval threshold, the operation feature information of the q-th business operation is compared with the operation feature information of the r-th business operation.

[0196] If the operation feature information of the q-th business operation matches the operation feature information of the r-th business operation, then the operation data of the q-th business operation and the operation data of the r-th business operation are determined to be a synchronized operation data.

[0197] In one implementation, any operation feature information includes operation type and operation attribute information; the processing unit 902, when comparing the operation feature information of the q-th business operation with the operation feature information of the r-th business operation, specifically performs the following steps:

[0198] Compare the operation type of the q-th business operation with the operation type of the r-th business operation;

[0199] If the operation type of the q-th business operation is the same as that of the r-th business operation, then the operation attribute information of the q-th business operation and the operation attribute information of the r-th business operation are compared.

[0200] If the operation attribute information of the q-th business operation matches the operation attribute information of the r-th business operation, then the operation feature information of the q-th business operation matches the operation feature information of the r-th business operation.

[0201] In one implementation, any operation feature information includes operation type and operation attribute information; the processing unit 902, when comparing the operation feature information of the q-th business operation with the operation feature information of the r-th business operation, specifically performs the following steps:

[0202] Compare the operation type of the q-th business operation with the operation type of the r-th business operation;

[0203] If the operation type of the q-th business operation is the same as that of the r-th business operation, then the operation attribute information of the q-th business operation is vectorized to obtain the operation attribute vector of the q-th business operation, and the operation attribute information of the r-th business operation is vectorized to obtain the operation attribute vector of the r-th business operation.

[0204] Calculate the vector similarity between the operation attribute vector of the q-th business operation and the operation attribute vector of the r-th business operation;

[0205] If the vector similarity is greater than the first similarity threshold, then the operation feature information of the q-th business operation is determined to match the operation feature information of the r-th business operation.

[0206] In one implementation, the i-th operation data set and the j-th operation data set are any two of the N operation data sets, where i and j are integers less than or equal to N, and i is not equal to j; the i-th operation data set is used to describe the business operation of the i-th business object among the N business objects, and the j-th operation data set is used to describe the business operation of the j-th business object among the N business objects.

[0207] Processing unit 902, when constructing a graph structure based on the data similarity between every two operational data sets, specifically performs the following steps:

[0208] Create the i-th business object as the i-th node in the graph structure, and create the j-th business object as the j-th node in the graph structure;

[0209] If the data similarity between the i-th operation data set and the j-th operation data set is greater than the second similarity threshold, then create an edge ij between the i-th node and the j-th node;

[0210] The data similarity between the i-th and j-th operation data sets is determined as the weight of edge ij.

[0211] In one implementation, the clustering result of the graph structure includes at least one node cluster. Each node cluster is used to determine a set of objects from N business objects, where the set includes multiple business objects with similar business operations. The processing unit 902, when determining the set of abnormal objects from the N business objects based on the clustering result of the graph structure, specifically performs the following steps:

[0212] Obtain the set operation characteristics of at least one set of objects. The set operation characteristics of any set of objects are obtained by statistical analysis of the operation data set of each business object in the corresponding set of objects according to the operation type.

[0213] The set of objects whose set operation characteristics are greater than the characteristic threshold is identified as the abnormal set of objects.

[0214] In one implementation, the processing unit 902 is further configured to perform the following steps:

[0215] Based on the business object dimension, perform anomaly analysis on the operation data set of each business object in the abnormal object set to obtain the anomaly detection information of the abnormal object set;

[0216] Based on the anomaly detection information, anomaly detection is performed on the first business object;

[0217] If the first business object is detected as an abnormal business object, then business filtering is performed on the business operations of the first business object.

[0218] In one implementation, any set of operation data includes at least one set of operation data, and any set of operation data includes an operation type and an operation object; the processing unit 902 is used to perform anomaly analysis on the set of operation data of each business object in the set of abnormal objects according to the business object dimension, and when obtaining the anomaly detection information of the set of abnormal objects, it is specifically used to perform the following steps:

[0219] In the operation data set of each business object in the abnormal object set, count the number of operation data belonging to a specific operation scenario to obtain the specific operation count of the corresponding business object;

[0220] Business objects whose number of specific operations exceeds a first threshold are identified as specific business objects;

[0221] In the operation data set of a specific business object, the number of operation data for different operation objects under each operation type is counted to obtain the number of operations for different operation objects under each operation type for abnormal business objects.

[0222] Operation objects whose corresponding statistical operation count exceeds the second threshold under each operation type are identified as abnormal operation objects for each operation type.

[0223] The abnormal operation objects of each operation type are identified as the abnormal object set for abnormal detection information.

[0224] In one implementation, when processing unit 902 performs anomaly detection on the first business object based on anomaly detection information, it specifically executes the following steps:

[0225] Obtain the operation data of the first business object, which includes the first operation type and the first operation object;

[0226] Based on the first operation type of the first business object, determine the abnormal operation object corresponding to the first operation type in the abnormal detection information;

[0227] Based on the abnormal operation object corresponding to the first operation type, perform object detection on the first operation object of the first business object;

[0228] If the abnormal operation object corresponding to the first operation type matches the operation object of the first business object, then it is determined that the first business object is an abnormal business object.

[0229] According to one embodiment of this application, Figure 9The data processing apparatus shown can be constructed by combining each unit individually or entirely into one or more other units, or one or more of the units can be further divided into multiple functionally smaller units. This achieves the same operation without affecting the technical effects of the embodiments of this application. The above-mentioned units are based on logical function division. In practical applications, the function of one unit can be implemented by multiple units, or the function of multiple units can be implemented by one unit. In other embodiments of this application, the data processing apparatus may also include other units. In practical applications, these functions can also be implemented with the assistance of other units, and can be implemented collaboratively by multiple units.

[0230] According to another embodiment of this application, the following can be achieved by running on a general-purpose computing device, such as a computer, which includes processing elements and storage elements such as a central processing unit (CPU), random access memory (RAM), and read-only memory (ROM), a device capable of performing operations such as... Figure 5 or Figure 8 Computer programs for the steps involved in some or all of the methods shown, to construct, for example... Figure 9 The data processing apparatus shown herein, and the data processing method for implementing the embodiments of this application, are described. A computer program may be recorded on, for example, a computer-readable storage medium, loaded onto the aforementioned computing device via the computer-readable storage medium, and executed therein.

[0231] In this embodiment, the business data may include N sets of operation data. Each set of operation data can describe the business operation performed by a business object within a first time period. That is, the N sets of operation data can originate from the business operations performed by N business objects, and each set corresponds one-to-one with one of the N business objects, where N is an integer greater than 1. This embodiment analyzes and processes the operation data sets of the N business objects to intelligently identify sets of abnormal objects from among them. Compared to manual statistical rule identification, this improves the efficiency of identifying sets of abnormal objects. Furthermore, this embodiment can construct a graph structure between the N business objects based on the data similarity between the N sets of operation data. The graph structure may include N nodes and edges between the nodes, with each node corresponding one-to-one with one of the N business objects, and the edges corresponding to the data similarity between the N sets of operation data. By converting the data similarity between the N sets of operation data into a graph structure, it is easier to use graph structure algorithms to process the data similarity between the N sets of operation data, thus improving the accuracy of data processing. This application embodiment can perform clustering processing on graph structures and determine an abnormal object set from N business objects based on the clustering results. The abnormal object set can include multiple business objects with similar and abnormal business operations. It is easy to see that this application embodiment can significantly improve the identification accuracy of abnormal object sets by using a graph structure clustering algorithm to cluster and identify abnormal object sets. Therefore, this application embodiment can improve the identification efficiency and accuracy of abnormal object sets.

[0232] Based on the above methods and apparatus embodiments, this application provides a computer device. Please refer to... Figure 10 , Figure 10 This is a schematic diagram of the structure of a computer device provided in an embodiment of this application. Figure 10 The computer device shown includes at least a processor 1001, an input interface 1002, an output interface 1003, and a computer-readable storage medium 1004. The processor 1001, input interface 1002, output interface 1003, and computer-readable storage medium 1004 can be connected via a bus or other means.

[0233] The computer-readable storage medium 1004 can be stored in the memory of a computer device. The computer-readable storage medium 1004 is used to store computer programs, which include computer instructions. The processor 1001 is used to execute the computer program stored in the computer-readable storage medium 1004. The processor 1001 (or CPU (Central Processing Unit)) is the computing and control core of the computer device. It is suitable for implementing computer programs, specifically for loading and executing computer programs to achieve corresponding methods or functions.

[0234] This application also provides a computer-readable storage medium (Memory), which is a memory device in a computer device used to store programs and data. It is understood that the computer-readable storage medium here can include both built-in storage media in the computer device and extended storage media supported by the computer device. The computer-readable storage medium provides storage space for storing the operating system of the computer device. Furthermore, the storage space also stores computer programs suitable for loading and execution by a processor. It should be noted that the computer-readable storage medium here can be high-speed RAM or non-volatile memory, such as at least one disk storage device; optionally, it can also be at least one computer-readable storage medium located remotely from the aforementioned processor.

[0235] The computer device can be a server. In a specific implementation, the processor 1001 can load and execute the computer program stored in the computer-readable storage medium 1004 to achieve the aforementioned... Figure 5 or Figure 8 The corresponding steps in the method shown. In a specific implementation, the computer program in the computer-readable storage medium 1004 is loaded by the processor 1001 and executed as follows:

[0236] Obtain business data, which includes N sets of operation data. Each set of operation data describes the business operation performed by a business object within a first time period, where N is an integer greater than 1.

[0237] A graph structure is constructed based on the data similarity between N operational data sets. The graph structure includes N nodes and edges between the N nodes. The N nodes correspond one-to-one with the N business objects, and the edges between the N nodes correspond to the data similarity between the N operational data sets.

[0238] Cluster the graph structure and determine the set of abnormal objects from N business objects based on the clustering results. The set of abnormal objects includes multiple business objects with similar and abnormal business operations.

[0239] In one implementation, the processing unit, when constructing a graph structure based on the data similarity among N operational data sets, specifically performs the following steps:

[0240] Obtain the data similarity between any two operation data sets from N operation data sets;

[0241] A graph structure is constructed based on the data similarity between every two sets of operational data.

[0242] In one implementation, any set of operation data includes at least one set of operation data, and any set of operation data is used to describe a business operation performed by a business object within a first time period.

[0243] When the computer program in the computer-readable storage medium 1004 is loaded and executed by the processor 1001 to obtain the data similarity between every two operational data sets out of N operational data sets, it specifically performs the following steps:

[0244] The operation data in each pair of operation data sets are compared to determine the synchronized operation data in each pair of operation data sets. The two synchronized operation data that describe the business operations in each pair of operation data sets are considered as one synchronized operation data for each other.

[0245] The data similarity between each pair of operation data sets is determined based on the number of synchronized operation data sets and the number of operation data sets in each pair of operation data sets.

[0246] In one implementation, any set of operation data includes the operation time and operation characteristic information of the corresponding business operation; the i-th set of operation data and the j-th set of operation data are any two of the N sets of operation data, where i and j are integers less than or equal to N, and i is not equal to j; the i-th set of operation data includes operation data of Q business operations, and the j-th set of operation data includes operation data of R business operations, where Q and R are both positive integers;

[0247] The computer program in the computer-readable storage medium 1004, loaded and executed by the processor 1001, compares the operational data in every two sets of operational data to determine the synchronization operational data in every two sets of operational data. Specifically, it performs the following steps:

[0248] Based on the operation time of the qth business operation out of Q business operations, determine the operation time interval between the qth business operation and the rth business operation out of R business operations; q is a positive integer less than or equal to Q, and r is a positive integer less than or equal to R.

[0249] If the operation time interval is less than the time interval threshold, the operation feature information of the q-th business operation is compared with the operation feature information of the r-th business operation.

[0250] If the operation feature information of the q-th business operation matches the operation feature information of the r-th business operation, then the operation data of the q-th business operation and the operation data of the r-th business operation are determined to be a synchronized operation data.

[0251] In one implementation, any operation feature information includes operation type and operation attribute information; when the computer program in the computer-readable storage medium 1004 is loaded and executed by the processor 1001 to compare the operation feature information of the q-th business operation with the operation feature information of the r-th business operation, it is specifically used to perform the following steps:

[0252] Compare the operation type of the q-th business operation with the operation type of the r-th business operation;

[0253] If the operation type of the q-th business operation is the same as that of the r-th business operation, then the operation attribute information of the q-th business operation and the operation attribute information of the r-th business operation are compared.

[0254] If the operation attribute information of the q-th business operation matches the operation attribute information of the r-th business operation, then the operation feature information of the q-th business operation matches the operation feature information of the r-th business operation.

[0255] In one implementation, any operation feature information includes operation type and operation attribute information; when the computer program in the computer-readable storage medium 1004 is loaded and executed by the processor 1001 to compare the operation feature information of the q-th business operation with the operation feature information of the r-th business operation, it is specifically used to perform the following steps:

[0256] Compare the operation type of the q-th business operation with the operation type of the r-th business operation;

[0257] If the operation type of the q-th business operation is the same as that of the r-th business operation, then the operation attribute information of the q-th business operation is vectorized to obtain the operation attribute vector of the q-th business operation, and the operation attribute information of the r-th business operation is vectorized to obtain the operation attribute vector of the r-th business operation.

[0258] Calculate the vector similarity between the operation attribute vector of the q-th business operation and the operation attribute vector of the r-th business operation;

[0259] If the vector similarity is greater than the first similarity threshold, then the operation feature information of the q-th business operation is determined to match the operation feature information of the r-th business operation.

[0260] In one implementation, the i-th operation data set and the j-th operation data set are any two of the N operation data sets, where i and j are integers less than or equal to N, and i is not equal to j; the i-th operation data set is used to describe the business operation of the i-th business object among the N business objects, and the j-th operation data set is used to describe the business operation of the j-th business object among the N business objects.

[0261] When the computer program in the computer-readable storage medium 1004 is loaded and executed by the processor 1001 to construct a graph structure based on the data similarity between every two sets of operational data, it specifically performs the following steps:

[0262] Create the i-th business object as the i-th node in the graph structure, and create the j-th business object as the j-th node in the graph structure;

[0263] If the data similarity between the i-th operation data set and the j-th operation data set is greater than the second similarity threshold, then create an edge ij between the i-th node and the j-th node;

[0264] The data similarity between the i-th and j-th operation data sets is determined as the weight of edge ij.

[0265] In one implementation, the clustering result of the graph structure includes at least one node cluster. Each node cluster is used to determine a set of objects from N business objects, where the set includes multiple business objects with similar business operations. When the computer program in the computer-readable storage medium 1004 is loaded and executed by the processor 1001 to determine the set of anomalous objects from the N business objects based on the clustering result of the graph structure, it specifically performs the following steps:

[0266] Obtain the set operation characteristics of at least one set of objects. The set operation characteristics of any set of objects are obtained by statistical analysis of the operation data set of each business object in the corresponding set of objects according to the operation type.

[0267] The set of objects whose set operation characteristics are greater than the characteristic threshold is identified as the abnormal set of objects.

[0268] In one implementation, the computer program in the computer-readable storage medium 1004 is loaded by the processor 1001 and is also used to perform the following steps:

[0269] Based on the business object dimension, perform anomaly analysis on the operation data set of each business object in the abnormal object set to obtain the anomaly detection information of the abnormal object set;

[0270] Based on the anomaly detection information, anomaly detection is performed on the first business object;

[0271] If the first business object is detected as an abnormal business object, then business filtering is performed on the business operations of the first business object.

[0272] In one implementation, any set of operation data includes at least one set of operation data, and any set of operation data includes an operation type and an operation object; when the computer program in the computer-readable storage medium 1004 is loaded and executed by the processor 1001 to perform anomaly analysis on the operation data sets of each business object in the set of abnormal objects according to the business object dimension, and obtains the anomaly detection information of the set of abnormal objects, it is specifically used to perform the following steps:

[0273] In the operation data set of each business object in the abnormal object set, count the number of operation data belonging to a specific operation scenario to obtain the specific operation count of the corresponding business object;

[0274] Business objects whose number of specific operations exceeds a first threshold are identified as specific business objects;

[0275] In the operation data set of a specific business object, the number of operation data for different operation objects under each operation type is counted to obtain the number of operations for different operation objects under each operation type for abnormal business objects.

[0276] Operation objects whose corresponding statistical operation count exceeds the second threshold under each operation type are identified as abnormal operation objects for each operation type.

[0277] The abnormal operation objects of each operation type are identified as the abnormal object set for abnormal detection information.

[0278] In one implementation, when the computer program in the computer-readable storage medium 1004 is loaded and executed by the processor 1001 to perform anomaly detection on the first business object based on anomaly detection information, it specifically performs the following steps:

[0279] Obtain the operation data of the first business object, which includes the first operation type and the first operation object;

[0280] Based on the first operation type of the first business object, determine the abnormal operation object corresponding to the first operation type in the abnormal detection information;

[0281] Based on the abnormal operation object corresponding to the first operation type, perform object detection on the first operation object of the first business object;

[0282] If the abnormal operation object corresponding to the first operation type matches the operation object of the first business object, then it is determined that the first business object is an abnormal business object.

[0283] In this embodiment, the business data may include N sets of operation data. Each set of operation data can describe the business operation performed by a business object within a first time period. That is, the N sets of operation data can originate from the business operations performed by N business objects, and each set corresponds one-to-one with one of the N business objects, where N is an integer greater than 1. This embodiment analyzes and processes the operation data sets of the N business objects to intelligently identify sets of abnormal objects from among them. Compared to manual statistical rule identification, this improves the efficiency of identifying sets of abnormal objects. Furthermore, this embodiment can construct a graph structure between the N business objects based on the data similarity between the N sets of operation data. The graph structure may include N nodes and edges between the nodes, with each node corresponding one-to-one with one of the N business objects, and the edges corresponding to the data similarity between the N sets of operation data. By converting the data similarity between the N sets of operation data into a graph structure, it is easier to use graph structure algorithms to process the data similarity between the N sets of operation data, thus improving the accuracy of data processing. This application embodiment can perform clustering processing on graph structures and determine an abnormal object set from N business objects based on the clustering results. The abnormal object set can include multiple business objects with similar and abnormal business operations. It is easy to see that this application embodiment can significantly improve the identification accuracy of abnormal object sets by using a graph structure clustering algorithm to cluster and identify abnormal object sets. Therefore, this application embodiment can improve the identification efficiency and accuracy of abnormal object sets.

[0284] This application also provides a computer program product, which includes a computer program stored in a computer-readable storage medium. A processor of a computer device reads the computer program from the computer-readable storage medium and executes the computer program, causing the computer device to perform the data processing method described above.

[0285] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed in this application can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0286] In this application embodiment, the terms "module" or "unit" refer to a computer program or part of a computer program that has a predetermined function and works with other related parts to achieve a predetermined goal, and can be implemented wholly or partially using software, hardware (such as processing circuitry or memory), or a combination thereof. Similarly, a processor (or multiple processors or memory) can be used to implement one or more modules or units. Furthermore, each module or unit can be part of an overall module or unit that includes the functionality of that module or unit.

[0287] In the above embodiments, implementation can be achieved, in whole or in part, through software, hardware, firmware, or any combination thereof. When implemented in software, it can be implemented, in whole or in part, as a computer program product. A computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the flow or function according to the embodiments of this application is generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in or transmitted through a computer-readable storage medium. The computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.). The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that integrates one or more available media. The available medium can be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium (e.g., solid-state disk (SSD)).

[0288] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A data processing method, characterized in that, include: Obtain business data, which includes N sets of operation data. Each set of operation data describes the business operation performed by a business object within a first time period, where N is an integer greater than 1. A graph structure is constructed based on the data similarity between the N operation data sets; the graph structure includes N nodes and edges between the N nodes, the N nodes correspond one-to-one with the N business objects, and the edges between the N nodes correspond to the data similarity between the N operation data sets; Clustering is performed on the graph structure, and an abnormal object set is determined from the N business objects based on the clustering results of the graph structure. The abnormal object set includes multiple business objects with similar and abnormal business operations.

2. The method as described in claim 1, characterized in that, The construction of the graph structure based on the data similarity among the N operational data sets includes: Obtain the data similarity between any two operation data sets in the N operation data sets; The graph structure is constructed based on the data similarity between each pair of operational data sets.

3. The method as described in claim 2, characterized in that, Each of the operation data sets includes at least one operation data, and each of the operation data describes a business operation performed by a business object within the first time period; obtaining the data similarity between every two operation data sets among the N operation data sets includes: The operation data in each pair of operation data sets are compared to determine the synchronized operation data in each pair of operation data sets. Two synchronized operation data sets describing business operations in each pair of operation data sets are one synchronized operation data set. The data similarity between each pair of operation data sets is determined based on the number of synchronized operation data sets and the number of operation data sets in each pair of operation data sets.

4. The method as described in claim 3, characterized in that, Each of the operation data includes the operation time and operation feature information of the corresponding business operation; the i-th operation data set and the j-th operation data set are any two of the N operation data sets, where i and j are integers less than or equal to N, and i is not equal to j; the i-th operation data set includes operation data of Q business operations, and the j-th operation data set includes operation data of R business operations, where Q and R are both positive integers; The step of comparing the operation data in every two operation data sets to determine the synchronous operation data in every two operation data sets includes: Based on the operation time of the qth business operation out of the Q business operations, and the operation time of the rth business operation out of the R business operations, the operation time interval between the qth business operation and the rth business operation is determined; q is a positive integer less than or equal to Q, and r is a positive integer less than or equal to R. If the operation time interval is less than the time interval threshold, then the operation feature information of the q-th service operation is compared with the operation feature information of the r-th service operation; If the operation feature information of the q-th service operation matches the operation feature information of the r-th service operation, then the operation data of the q-th service operation and the operation data of the r-th service operation are determined to be synchronized operation data.

5. The method as described in claim 4, characterized in that, Each of the operation feature information includes operation type and operation attribute information; the comparison of the operation feature information of the q-th service operation with the operation feature information of the r-th service operation includes: The operation type of the q-th business operation is compared with the operation type of the r-th business operation; If the operation type of the q-th business operation is the same as the operation type of the r-th business operation, then the operation attribute information of the q-th business operation and the operation attribute information of the r-th business operation are compared. If the operation attribute information of the q-th service operation matches the operation attribute information of the r-th service operation, then it is determined that the operation feature information of the q-th service operation matches the operation feature information of the r-th service operation.

6. The method as described in claim 4, characterized in that, Each of the operation feature information includes operation type and operation attribute information; the comparison of the operation feature information of the q-th service operation with the operation feature information of the r-th service operation includes: The operation type of the q-th business operation is compared with the operation type of the r-th business operation; If the operation type of the q-th business operation is the same as the operation type of the r-th business operation, then the operation attribute information of the q-th business operation is vectorized to obtain the operation attribute vector of the q-th business operation, and the operation attribute information of the r-th business operation is vectorized to obtain the operation attribute vector of the r-th business operation. Calculate the vector similarity between the operation attribute vector of the q-th business operation and the operation attribute vector of the r-th business operation; If the vector similarity is greater than the first similarity threshold, then the operation feature information of the q-th business operation is determined to match the operation feature information of the r-th business operation.

7. The method as described in claim 2, characterized in that, The i-th operation data set and the j-th operation data set are any two of the N operation data sets, where i and j are integers less than or equal to N, and i is not equal to j; the i-th operation data set is used to describe the business operation of the i-th business object among the N business objects, and the j-th operation data set is used to describe the business operation of the j-th business object among the N business objects. The construction of the graph structure based on the data similarity between every two operational data sets includes: The i-th business object is created as the i-th node in the graph structure, and the j-th business object is created as the j-th node in the graph structure; If the data similarity between the i-th operation data set and the j-th operation data set is greater than the second similarity threshold, then an edge ij is created between the i-th node and the j-th node; The data similarity between the i-th operation data set and the j-th operation data set is determined as the weight of the edge ij.

8. The method as described in claim 1, characterized in that, The clustering result of the graph structure includes at least one node cluster, and one node cluster is used to determine an object set from the N business objects, the object set including multiple business objects with similar business operations; determining the abnormal object set from the N business objects based on the clustering result of the graph structure includes: Obtain the set operation characteristics of at least one set of objects. The set operation characteristics of any set of objects are obtained by statistical analysis of the operation data set of each business object in the corresponding set of objects according to the operation type. The set of objects whose set operation characteristics are greater than the characteristic threshold is determined as the abnormal object set.

9. The method according to any one of claims 1-8, characterized in that, The method further includes: Based on the business object dimension, perform anomaly analysis on the operation data set of each business object in the abnormal object set to obtain the anomaly detection information of the abnormal object set; Based on the anomaly detection information, anomaly detection is performed on the first business object; If the first business object is detected as an abnormal business object, then business filtering is performed on the business operations of the first business object.

10. The method as described in claim 9, characterized in that, Each of the operation data sets includes at least one operation data, and each operation data includes an operation type and an operation object; the step of performing anomaly analysis on the operation data sets of each business object in the abnormal object set according to the business object dimension to obtain the anomaly detection information of the abnormal object set includes: In the operation data set of each business object in the abnormal object set, the number of operation data belonging to a specific operation scenario is counted to obtain the specific operation quantity of the corresponding business object; Business objects whose number of specific operations exceeds a first threshold are identified as specific business objects; In the operation data set of the specific business object, the number of operation data for different operation objects under each operation type is counted to obtain the number of operations of the abnormal business object for different operation objects under each operation type. Operation objects whose corresponding statistical operation count under each operation type is greater than the second threshold are identified as abnormal operation objects of each operation type. The abnormal operation objects of each of the aforementioned operation types are identified as the abnormal detection information of the abnormal object set.

11. The method as described in claim 10, characterized in that, The step of performing anomaly detection on the first business object based on the anomaly detection information includes: Obtain the operation data of the first business object, wherein the operation data of the first business object includes a first operation type and a first operation object; Based on the first operation type of the first business object, determine the abnormal operation object corresponding to the first operation type in the abnormal detection information; Based on the abnormal operation object corresponding to the first operation type, perform object detection on the first operation object of the first business object; If the abnormal operation object corresponding to the first operation type matches the operation object of the first business object, then it is determined that the first business object is an abnormal business object.

12. A data processing apparatus, characterized in that, include: The acquisition unit is used to acquire business data, which includes N sets of operation data. Each set of operation data is used to describe the business operation performed by a business object in a first time period, where N is an integer greater than 1. The processing unit is used to construct a graph structure based on the data similarity between the N operation data sets; the graph structure includes N nodes and edges between the N nodes, the N nodes correspond one-to-one with the N business objects, and the edges between the N nodes correspond to the data similarity between the N operation data sets; The processing unit is further configured to perform clustering processing on the graph structure and determine an abnormal object set from the N business objects based on the clustering results of the graph structure. The abnormal object set includes multiple business objects with similar and abnormal business operations.

13. A computer device, characterized in that, The computer device includes: A processor is a tool for implementing computer programs. A computer-readable storage medium storing a computer program adapted to be loaded by the processor and executed as described in any one of claims 1-11.

14. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program adapted to be loaded by a processor and executed as described in any one of claims 1-11.

15. A computer program product, characterized in that, The computer program product includes a computer program that, when executed by a processor, implements the data processing method as described in any one of claims 1-11.

Images