A data processing method, apparatus, electronic device, and storage medium

Abstract

This invention discloses a data processing method, apparatus, electronic device, and storage medium. The data processing method involves: constructing a graph association structure with transaction entities in a target business scenario as nodes and the relationships between transaction entities as edges; determining the anomaly value corresponding to each node based on the business information of the transaction entity indicated by each node in the graph association structure, the relationships between transaction entities, and preset anomaly analysis rules; each anomaly value is used to indicate the degree of abnormal fluctuation in the transaction of the transaction entity indicated by a node; the degree of abnormal fluctuation is determined based on the transaction entity's own business information and the business information of other transaction entities with which it has a relationship; when the anomaly value corresponding to the first node is greater than a preset threshold, the first node is determined as an anomaly node, and the transaction entity indicated by the first node is determined as an anomaly transaction entity. By utilizing the graph association structure and integrating multiple factors to determine the anomaly value to determine the comparison result, the anomaly node can be determined quickly and accurately.

Description

[Technical Field]

[0001] This invention relates to the field of computer technology, and in particular to a data processing method, apparatus, electronic device and storage medium. [Previous Technology]

[0002] Currently, the vast trading network generates massive amounts of transaction data and complex transaction relationships among trading entities every day. Therefore, when anomalies such as a sudden decrease in the number of transactions appear in the transaction data, it is necessary to identify the trading entity that may be exhibiting abnormal behavior, designate that entity as the abnormal trading entity to be optimized, and then adjust and optimize the specific business strategy for that abnormal trading entity to ensure the normal operation of the trading network.

[0003] Therefore, how to identify the abnormal trading entities to be optimized has become an urgent technical problem to be solved. [Summary of the Invention]

[0004] This invention provides a data processing method, apparatus, electronic device, and storage medium, which improves the efficiency and accuracy of the method for determining abnormal transaction entities to be optimized.

[0005] In a first aspect, embodiments of the present invention provide a data processing method, the data processing method comprising: constructing a graph association structure with transaction entities in a target business scenario as nodes and the relationships between transaction entities as edges; determining an anomaly value corresponding to each node based on the business information of the transaction entity indicated by each node in the graph association structure, the relationships between transaction entities, and preset anomaly analysis rules; wherein each anomaly value is used to indicate the degree of abnormal fluctuation in the transaction of the transaction entity indicated by a node; the degree of abnormal fluctuation is determined based on the transaction entity's own business information and the business information of other transaction entities with which it has a relationship; when the anomaly value corresponding to a first node is greater than a preset threshold, determining the first node as an anomaly node, and determining the transaction entity indicated by the first node as an anomaly transaction entity.

[0006] In one possible implementation, the anomaly value corresponding to each node is determined based on the business information of the transaction entity indicated by each node in the graph association structure, the relationship between the transaction entities, and the preset anomaly analysis rules, including: determining the fluctuation value of each node based on the business information of the transaction entity indicated by each node in the graph association structure and the first sub-rule in the preset anomaly analysis rules; the first sub-rule is used to normalize the initial fluctuation values ​​of nodes obtained based on business information of different magnitudes; determining the impact value of the fluctuation of the business information of each node on other nodes based on the relationship between the transaction entities and the second sub-rule in the preset anomaly analysis rules; the second sub-rule is used to calculate the degree to which the fluctuation of the lower-level node is affected by the fluctuation of the upper-level node, the lower-level node and the upper-level node being determined based on the relationship between the transaction entities; and determining the anomaly value corresponding to each node based on the fluctuation value and the corresponding impact value of each node.

[0007] In one possible implementation, the volatility value of each node is determined based on the business information of the trading entity indicated by each node in the graph association structure and the first sub-rule in the preset anomaly analysis rule, including: inputting the business information of the trading entity indicated by each node into a preset time-series attribution model to obtain the initial volatility value corresponding to each node output by the preset time-series attribution model; the preset time-series attribution model determines the initial volatility value of the trading entity based on the business information of a trading entity within a preset time period and a preset magnitude volatility evaluation rule; the preset magnitude volatility evaluation rule includes multiple mapping relationships, and different mapping relationships include numerical ranges corresponding to different magnitudes of business information, and initial volatility values ​​corresponding to the numerical ranges; normalizing the initial volatility value corresponding to each trading entity to obtain the volatility value of each node.

[0008] In one possible implementation, the normalization process is implemented in the following way: where represents the fluctuation value of the node, represents the initial fluctuation value corresponding to the node, and K is used to represent the total number of nodes in the graph association structure.

[0009] In one possible implementation, the second sub-rule is determined based on the following formula: where represents the influence value of node i relative to node j, represents the change value of the business information value of node i between two time points, represents the change value of the business information value of node j between two time points, represents the business information value of node i at time t, represents the business information value of node i at time t, represents the business information value of node j at time t, and represents the business information value of node j at time t, and node i and node j are any nodes in the graph association structure.

[0010] In one possible implementation, the abnormal value corresponding to each node is determined based on the fluctuation value and the corresponding influence value of each node, including: using the influence value of an associated node that is related to a node as a matrix factor to construct an initial abnormality repetition operation matrix; substituting the initial abnormality repetition operation matrix and the fluctuation value corresponding to each node into the third sub-rule of the preset abnormality analysis rule to determine the abnormal value corresponding to each node respectively; the third sub-rule is used to perform repeated operation optimization on the fluctuation value of the node by combining the influence values ​​corresponding to all nodes that are related to the node.

[0011] In one possible implementation, the third sub-rule is determined based on the following formula: where represents the set of all node anomaly values, n is used to characterize the number of repeated operation rounds, when n equals 1, represents the set of all node fluctuation values, = {, , ...,}, represents the influence value of node i relative to node j, node i and node j are any nodes in the graph association structure, represents the fluctuation value of node k, d is a non-zero adjustment coefficient, and i and j are positive integers.

[0012] In one possible implementation, after determining that the first node is an abnormal node, the data processing method further includes: based on the graph association structure, filtering candidate paths including the first node, and using the candidate paths as abnormal paths; analyzing the abnormal path to obtain abnormal analysis results; the abnormal analysis results are used to indicate the affected nodes associated with the abnormal node, and to optimize the business of the transaction entity corresponding to the affected node based on the business information corresponding to the abnormal node.

[0013] In a second aspect, embodiments of the present invention provide a data processing apparatus, the data processing apparatus comprising: a construction unit, configured to construct a graph association structure with transaction entities in a target business scenario as nodes and the relationships between transaction entities as edges; a determination unit, configured to determine an anomaly value corresponding to each node based on the business information of the transaction entity indicated by each node in the graph association structure, the relationships between transaction entities, and preset anomaly analysis rules; wherein each anomaly value is used to indicate the degree of abnormal fluctuation in the transaction of the transaction entity indicated by a node; the degree of abnormal fluctuation is determined based on the transaction entity's own business information and the business information of other transaction entities with which it has a relationship; and a processing unit, configured to determine the first node as an anomaly node and determine the transaction entity indicated by the first node as an anomaly transaction entity when the anomaly value corresponding to the first node is greater than a preset threshold.

[0014] In one possible implementation, the determining unit is specifically configured to: determine the fluctuation value of each node based on the business information of the transaction entity indicated by each node in the graph association structure and the first sub-rule in the preset anomaly analysis rule; the first sub-rule is used to perform magnitude normalization processing on the initial fluctuation values ​​of nodes obtained based on business information of different magnitudes; determine the impact value of the fluctuation of the business information of each node on other nodes based on the association relationship between the transaction entities and the second sub-rule in the preset anomaly analysis rule; the second sub-rule is used to calculate the degree to which the fluctuation of the lower-level node is affected by the fluctuation of the upper-level node, the lower-level node and the upper-level node being determined based on the association relationship between the transaction entities; and determine the anomaly value corresponding to each node based on the fluctuation value and the corresponding impact value of each node.

[0015] In one possible implementation, the determining unit is specifically configured to: input the business information of the transaction entity indicated by each node into a preset time-series attribution model to obtain the initial volatility value corresponding to each node output by the preset time-series attribution model; the preset time-series attribution model determines the initial volatility value of the transaction entity based on the business information of a transaction entity within a preset time period and a preset magnitude volatility evaluation rule; the preset magnitude volatility evaluation rule includes multiple mapping relationships, and different mapping relationships include numerical ranges corresponding to different magnitudes of business information, and initial volatility values ​​corresponding to the numerical ranges; normalize the initial volatility value corresponding to each transaction entity to obtain the volatility value of each node.

[0016] In one possible implementation, the normalization process is implemented in the following way: where represents the fluctuation value of the node, represents the initial fluctuation value corresponding to the node, and K is used to represent the total number of nodes in the graph association structure.

[0017] In one possible implementation, the second sub-rule is determined based on the following formula: where represents the influence value of node i relative to node j, represents the change value of the business information value of node i between two time points, represents the change value of the business information value of node j between two time points, represents the business information value of node i at time t, represents the business information value of node i at time t, represents the business information value of node j at time t, and represents the business information value of node j at time t, and node i and node j are any nodes in the graph association structure.

[0018] In one possible implementation, the determining unit is specifically used to: construct an initial anomaly repetition operation matrix by taking the influence value of an associated node that is related to the node as a matrix factor; and determine the anomaly value corresponding to each node by substituting the initial anomaly repetition operation matrix and the fluctuation value corresponding to each node into the third sub-rule of the preset anomaly analysis rule; the third sub-rule is used to perform repeated operation optimization on the fluctuation value of the node by combining the influence values ​​corresponding to all nodes that are related to the node.

[0019] In one possible implementation, the third sub-rule is determined based on the following formula: where represents the set of all node anomaly values, n is used to characterize the number of repeated operation rounds, when n equals 1, represents the set of all node fluctuation values, = {, , ...,}, represents the influence value of node i relative to node j, node i and node j are any nodes in the graph association structure, represents the fluctuation value of node k, d is a non-zero adjustment coefficient, and i and j are positive integers.

[0020] In one possible implementation, after determining that the first node is an abnormal node, the device further includes an optimization unit, configured to: filter candidate paths including the first node based on the graph association structure, and use the candidate paths as abnormal paths; analyze the abnormal paths to obtain abnormal analysis results; the abnormal analysis results are used to indicate the affected nodes associated with the abnormal node, and optimize the business of the transaction entity corresponding to the affected node based on the business information corresponding to the abnormal node.

[0021] In a third aspect, embodiments of the present invention provide an electronic device, including at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, the instructions being executed by the at least one processor to enable the at least one processor to perform any data processing method provided in the first aspect of the present invention.

[0022] In a fourth aspect, embodiments of the present invention provide a computer storage medium, wherein the computer-readable storage medium stores a computer program for causing a computer to execute any of the data processing methods provided in the first aspect of the present invention.

[0023] In a fifth aspect, embodiments of the present invention provide a computer program product, the computer program product comprising: computer program code, which, when the computer program code is run on a computer, causes the computer to execute any of the data processing methods provided in the first aspect embodiment.

[0024] The beneficial effects of the present invention are as follows: In the embodiments of the present invention, a graph association structure can be constructed with the transaction entities in the target business scenario as nodes and the relationships between the transaction entities as edges; further, based on the business information of the transaction entities indicated by each node in the graph association structure, the relationships between the transaction entities, and the preset anomaly analysis rules, the anomaly value corresponding to each node is determined; wherein, each anomaly value is used to indicate the degree of abnormal fluctuation in the transaction of the transaction entity indicated by a node; the degree of abnormal fluctuation is determined based on the transaction entity's own business information and the business information of other transaction entities with which it has a relationship. It can be seen that, in the embodiments of the present invention, from the perspective of the graph association structure, the anomaly value corresponding to the node is determined, and the determination of the anomaly value considers both the transaction entity's own business information and the business information of other transaction entities with which it has a relationship, thereby improving the accuracy of the attribution analysis of the anomaly performance. In this way, when the anomaly value corresponding to the first node is greater than the preset threshold, the first node is determined to be an anomaly node, and the transaction entity indicated by the first node is determined to be an anomaly transaction entity, thereby accurately and efficiently determining the anomaly transaction entity that caused the anomaly.

[0025] Other features and advantages of the invention will be set forth in the following description, and will be apparent in part from the description, or may be learned by practicing the invention. The objects and other advantages of the invention may be realized and obtained by means of the structures particularly pointed out in the written description, the claims, and the drawings.

Implementation Method

[0027] To make the objectives, technical solutions, and advantages of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without making progressive improvements are within the scope of protection of the present invention. Unless otherwise specified, the embodiments and features in the embodiments of the present invention can be arbitrarily combined with each other. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be performed in a different order than that shown here.

[0028] In the specification and claims of this invention and in the foregoing drawings, terms such as "first," "second," etc., are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such terms can be interchanged where appropriate so that embodiments of the invention described herein can be implemented in sequences other than those illustrated or described herein.

[0029] The term "exemplary" as used in this invention means "serving as an example, embodiment, or illustration". Any embodiment described as "exemplary" is not necessarily to be construed as superior to or better than other embodiments.

[0030] The following description, in conjunction with the accompanying drawings, illustrates exemplary embodiments of the present invention, including various details to aid understanding. These should be considered merely exemplary. Therefore, those skilled in the art should recognize that various changes and modifications can be made to the embodiments described herein without departing from the scope of the invention. Similarly, for clarity and brevity, descriptions of well-known functions and structures are omitted in the following description. It should be noted that in the embodiments of the present invention, certain existing solutions in the industry, such as software, components, and models, may be mentioned. These should be considered exemplary, intended only to illustrate the feasibility of implementing the technical solutions of the present invention, and do not imply that the applicant has already used or necessarily used such solutions.

[0031] In the technical solution of the present invention, the collection, dissemination and use of data all comply with the requirements of relevant national laws and regulations.

[0032] At present, as mentioned above, how to identify the abnormal trading entities to be optimized has become an urgent technical problem to be solved.

[0033] In view of this, embodiments of the present invention provide a data processing method. This method can construct a graph association structure with transaction entities in a target business scenario as nodes and the relationships between transaction entities as edges. Further, based on the business information of the transaction entity indicated by each node in the graph association structure, the relationships between transaction entities, and preset anomaly analysis rules, an anomaly value corresponding to each node is determined. Each anomaly value indicates the degree of abnormal fluctuation in the transaction of the transaction entity indicated by a node. The degree of abnormal fluctuation is determined based on the transaction entity's own business information and the business information of other transaction entities with which it has a relationship. It can be seen that embodiments of the present invention determine the anomaly value corresponding to a node from the perspective of a graph association structure. The determination of the anomaly value considers both the transaction entity's own business information and the business information of other transaction entities with which it has a relationship, thus improving the accuracy of attribution analysis of anomaly performance. In this way, when the anomaly value corresponding to the first node is greater than a preset threshold, the first node is determined as an anomaly node, and the transaction entity indicated by the first node is determined as the anomaly transaction entity, thereby accurately and efficiently identifying the anomaly transaction entity causing the anomaly.

[0034] After introducing the design concept of the embodiments of the present invention, the following is a brief introduction to the application scenarios to which the technical solutions of the embodiments of the present invention are applicable. It should be noted that the application scenarios described below are only for illustrating the embodiments of the present invention and are not intended to limit the scope. In specific implementation, the technical solutions provided by the embodiments of the present invention can be flexibly applied according to actual needs.

[0035] In this embodiment of the invention, the data processing method provided by this embodiment can be applied to any business scenario that requires anomaly attribution analysis, such as a business scenario that performs anomaly attribution analysis on each functional module in the software system of business A, a business scenario that performs anomaly attribution analysis on each functional unit in a network platform, and so on. For example, it can also perform anomaly attribution analysis on each entity in a payment system in the financial field, a business scenario that performs anomaly attribution analysis on each entity in a lending system in the financial field, a business scenario that performs anomaly attribution analysis on each entity in a manufacturing system in the manufacturing field, and a business scenario that performs anomaly attribution analysis on each entity in an enterprise management system in the management field. This embodiment of the invention does not limit the scope of the application.

[0036] Please refer to Figure 1, which illustrates an application scenario to which the technical solution of this embodiment of the invention can be applied. In this schematic diagram, there are devices 101 corresponding to multiple acquiring institutions, devices 102 corresponding to multiple payment subsidiaries, devices 103 corresponding to the payment head office, and devices 104 corresponding to an analysis system used for anomaly attribution analysis of the payment system. It should be noted that acquiring institutions, payment subsidiaries, and the payment head office can all be referred to as transaction entities.

[0037] Each analysis system device 104 may include one or more processors 1041, memory 1042, and I / O interfaces 1043 for interacting with the device. Furthermore, devices 101, 102, 103, and 104, as well as all devices, can be directly or indirectly connected via one or more networks 105.

[0038] It should be noted that, in this embodiment of the invention, using devices 101-1, 101-2, ..., 101-n, objects 1, 2, ..., n (where n is a positive integer) can initiate payment transactions simultaneously. Alternatively, object 1 can initiate a transaction first, followed by object 2. This embodiment of the invention does not impose any restrictions on this. Therefore, the analysis system can receive a large amount of concurrent payment transaction data and perform anomaly attribution analysis on the payment transaction data, i.e., determine whether there are any anomalies in the payment transaction data. The specific scheme for anomaly attribution analysis of payment transaction data can be found in the data processing method provided in this embodiment of the invention, which will be described in detail later and will not be repeated here.

[0039] For example, please refer to Figure 2, which shows another application scenario to which the technical solution of the embodiment of the present invention can be applied. In this scenario diagram, there are devices 201 corresponding to multiple sales agencies, devices 202 corresponding to multiple manufacturing subsidiaries, devices 203 corresponding to the manufacturing headquarters, and devices 104 corresponding to the analysis system used for anomaly attribution analysis of the sales system. It should be noted that the sales agencies, manufacturing subsidiaries, and manufacturing headquarters can all be referred to as transaction entities.

[0040] Each analysis system device 104 may include one or more processors 1041, memory 1042, and I / O interfaces 1043 for interacting with the device. Furthermore, devices 201, 202, 203, and 104, as well as all devices, can be directly or indirectly connected via one or more networks 105.

[0041] It should be noted that, in this embodiment of the invention, the sales agencies 1, 2, ..., n of devices 201-1, 201-2, ..., 201-n, where n is a positive integer, can initiate sales transactions simultaneously. Alternatively, sales agency 1 can initiate a sales transaction first, followed by sales agency 2. This embodiment of the invention does not impose any restrictions on this. Therefore, the analysis system can receive a large amount of concurrent sales transaction data and perform anomaly attribution analysis on the sales transaction data, i.e., determine whether there are any abnormalities in the sales transaction data. The specific scheme for performing anomaly attribution analysis on the sales transaction data can be found in the data processing method provided in this embodiment of the invention, which will be described in detail later and will not be repeated here.

[0042] The devices in Figures 1 and 2 can be mobile phones, tablets (PADs), personal computers (PCs), smart TVs, smartwatches, smart speakers, smart in-vehicle devices, and wearable devices, but are not limited to these. These devices can have the function of logging in and using learning websites.

[0043] Furthermore, the devices in Figures 1 and 2 can be independent physical servers, server clusters or distributed systems composed of multiple physical servers, or cloud servers that provide basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, functional variable name services, security services, content delivery networks (CDN), and big data and artificial intelligence platforms, but are not limited to these.

[0044] The network 105 can be a wired network or a wireless network. For example, the wireless network can be a mobile cellular network or a Wireless-Fidelity (WIFI) network. Of course, it can also be other possible networks. This embodiment of the invention does not limit this.

[0045] Of course, the method provided in the embodiments of the present invention is not limited to the application scenarios shown in Figures 1 and 2, but can also be used in other possible application scenarios. The embodiments of the present invention do not impose any limitations.

[0046] To further illustrate the technical solutions provided by the embodiments of the present invention, a detailed description is provided below in conjunction with the accompanying drawings and specific implementation methods. Although the embodiments of the present invention provide method operation steps as shown in the following embodiments or drawings, the data processing method may include more or fewer operation steps based on conventional methods or without the need for further improvement. In steps where there is no logically necessary causal relationship, the execution order of these steps is not limited to the execution order provided by the embodiments of the present invention. In the actual processing process or when the device executes the data processing method, it may be executed sequentially or concurrently according to the methods shown in the embodiments or drawings.

[0047] Please refer to Figure 3. Figure 3 is a schematic flowchart of a data processing method in an embodiment of the present invention. The data processing method can be executed by the device 104 in Figures 1 and 2 above, and the device 104 is equipped with an analysis system for anomaly attribution analysis.

[0048] Step 301: Construct a graph association structure with the transaction entities in the target business scenario as nodes and the relationships between the transaction entities as edges.

[0049] In this embodiment of the invention, the electronic device can first determine the target business scenario. The following description uses a payment system in the financial sector as an example. The payment system in the financial sector includes a payment head office, multiple payment subsidiaries, and multiple acquiring institutions. The payment head office, payment subsidiaries, and acquiring institutions can be understood as the entities that generate transaction data; for ease of description, these entities will be referred to as transaction entities. Then, the relationships between the payment head office, multiple payment subsidiaries, and multiple acquiring institutions can be determined based on business information. For example, if the business information is the number of merchants, then it can be determined that there is a relationship between the payment head office and payment subsidiaries in terms of the number of merchants, and a relationship between payment subsidiaries and acquiring institutions in terms of the number of merchants. Similarly, if the business information is the number of transactions, then it can be determined that there is a relationship between the payment head office and payment subsidiaries in terms of the number of transactions, and a relationship between payment subsidiaries and acquiring institutions in terms of the number of transactions.

[0050] Furthermore, a graph association structure can be constructed with the transaction entities in the target business scenario as nodes and the relationships between the transaction entities as edges.

[0051] For example, please refer to Figure 4, which is a schematic diagram of a graph association structure provided by an embodiment of the present invention. In Figure 4, the quadrilateral pattern is used to represent a node where the transaction subject is an acquiring institution, the pentagonal pattern is used to represent a node where the transaction subject is a payment subsidiary, and the hexagonal pattern is used to represent a node where the transaction subject is a payment head office.

[0052] Optionally, the graph association structure can also be expressed mathematically, as follows: where V represents the set of nodes included in the graph association structure, and represents the set of edges of the graph association structure.

[0053] Step 302: Based on the business information of the transaction entity indicated by each node in the graph association structure, the relationship between transaction entities, and the preset anomaly analysis rules, determine the anomaly value corresponding to each node; wherein, each anomaly value is used to indicate the degree of abnormal fluctuation of the transaction of the transaction entity indicated by a node; the degree of abnormal fluctuation is determined based on the transaction entity's own business information and the business information of other transaction entities with which it has a relationship.

[0054] In this embodiment of the invention, the electronic device may adopt, but is not limited to, the following steps for the abnormal value corresponding to each node: Step A: Determine the fluctuation value of each node based on the business information of the transaction subject indicated by each node in the graph association structure and the first sub-rule in the preset abnormal analysis rules; the first sub-rule is used to normalize the initial fluctuation value of the node obtained based on business information of different magnitudes.

[0055] In this embodiment of the invention, the electronic device can input the business information of the transaction entity indicated by each node into a preset time-series attribution model to obtain the initial volatility value corresponding to each node output by the preset time-series attribution model; wherein, the preset time-series attribution model determines the initial volatility value of the transaction entity based on the business information of a transaction entity within a preset time period and a preset magnitude volatility evaluation rule. The preset magnitude volatility evaluation rule includes multiple mapping relationships, and different mapping relationships include numerical ranges corresponding to different magnitudes of business information, and initial volatility values ​​corresponding to those numerical ranges.

[0056] For example, assuming the node is acquiring institution A, and the business information is the number of transactions of acquiring institution A in the two years from 2021 to 2023, the input to the preset time series attribution model is the number of transactions of acquiring institution A in the two years from 2021 to 2023, which is 100. Based on the volatility evaluation rules, the numerical range corresponding to the number of transactions can be determined to be 100 to 200, and the initial volatility value corresponding to the numerical range of 100 to 200 is 120%. Therefore, the initial volatility value of the node in the order of transactions is determined to be 120%.

[0057] Furthermore, since different business values ​​have different scales—for example, the number of transactions is on the order of hundreds of millions, while the number of merchants is on the order of tens of millions—there is a huge difference in the magnitude of the two business values. Therefore, the initial fluctuation value corresponding to each transaction entity can be normalized to achieve a unified assessment of the magnitude. In other words, the initial fluctuation value corresponding to each transaction entity can be normalized to obtain the fluctuation value of each node. The fluctuation value is used to indicate the fluctuation of the value of the business information of the transaction entity indicated by the node (hereinafter referred to as the business information value for convenience).

[0058] Optionally, the normalization process is implemented in the following way: where, represents the fluctuation value of the node, represents the initial fluctuation value corresponding to the node, and K is used to represent the total number of nodes in the graph association structure.

[0059] For example, please refer to Figure 5, which is a schematic diagram of the fluctuation value of nodes in a graph association structure provided by an embodiment of the present invention. In Figure 5, the quadrilateral pattern represents nodes where the transaction entity is an acquiring institution, the pentagonal pattern represents nodes where the transaction entity is a payment subsidiary, and the hexagonal pattern represents nodes where the transaction entity is the payment head office. The fluctuation value of the node where the transaction entity is an acquiring institution, represented by the quadrilateral pattern, is 0.1, where 0.1 = 120% / 1200%, where 120% is the year-on-year increase in business information for the transaction entity where the transaction entity is an acquiring institution, and 1200% is the sum of the year-on-year increase in business information for the transaction entity indicated by all nodes except the node where the transaction entity is the head office.

[0060] Step B: Based on the relationship between the transaction entities and the second sub-rule in the preset anomaly analysis rules, determine the impact value of the fluctuation of business information of each node on the influence of other nodes; The second sub-rule is used to calculate the degree to which the fluctuation of the lower-level node is affected by the fluctuation of the upper-level node, and the lower-level node and the upper-level node are determined based on the relationship between the transaction entities;

[0061] In this embodiment of the invention, the second sub-rule is determined based on the following formula: where, represents the influence value of node i relative to node j, represents the change value of the business information value of node i between two time points, represents the change value of the business information value of node j between two time points, represents the business information value of node i at time t, represents the business information value of node i at time t, represents the business information value of node j at time t, and represents the business information value of node j at time t. Node i and node j are any nodes in the graph association structure.

[0062] In this embodiment of the invention, after the second sub-rule is determined, the influence value of the fluctuation of business information of each node on other nodes can be determined based on the relationship between the transaction entities and the aforementioned second sub-rule.

[0063] For example, please refer to Figure 6, which is a schematic diagram of the influence value of nodes in a graph association structure provided by an embodiment of the present invention. In Figure 6, the quadrilateral pattern represents nodes where the transaction entity is an acquiring institution, the pentagonal pattern represents nodes where the transaction entity is a payment subsidiary, and the hexagonal pattern represents nodes where the transaction entity is the payment head office. The influence value of the node represented by the pentagonal pattern, where the transaction entity is a payment subsidiary, is 0.2, where 0.2 = 30 million / 150 million. Here, 30 million is the change in the number of transactions where the transaction entity is a payment subsidiary, and 150 million is the change in the number of transactions where the transaction entity is the head office.

[0064] Step C: Determine the abnormal value corresponding to each node based on the fluctuation value and the corresponding impact value of each node.

[0065] In this embodiment of the invention, the electronic device can use the influence value of an associated node that has a relationship with a given node as the basis for constructing an initial anomaly repetition operation matrix. For example, the initial anomaly repetition operation matrix can be expressed as: where θ represents the initial anomaly repetition operation matrix, is a matrix factor in θ, and represents the influence value of node i relative to node j, where node i and node j are any nodes in the graph association structure, i.e., i, j. Furthermore, when node i and node j do not have a relationship, the electronic device can further substitute the initial anomaly repetition operation matrix and the fluctuation value corresponding to each node into the third sub-rule of the preset anomaly analysis rule to determine the anomaly value corresponding to each node; the third sub-rule is used to perform repeated operations to optimize the fluctuation value of the node by combining the influence values ​​corresponding to all nodes that have a relationship with the node.

[0066] Optionally, the third sub-rule is determined based on the following formula: ...where H represents the intermediate variable in the iterative operation process, represents the result of the nth round of iterative operation, and the size of n is determined by the Euclidean distance between and . Generally, the iterative operation can be stopped when the Euclidean distance between and is < 0.0001. represents the initial anomaly iterative operation matrix, represents the set of fluctuation values ​​of all nodes, = { , , ...,}, d is a non-zero adjustment coefficient, and i and j are positive integers.

[0067] The distribution of the anomaly values ​​of the final nodes is {,,,,,}, where the anomaly value of node 1 is the first element of the vector.

[0068] Optionally, the electronic device can also sort the anomaly values ​​corresponding to all nodes from largest to smallest to obtain the sorted anomaly values ​​of all nodes. For example, please refer to Figure 7, which is a schematic diagram of calculating the anomaly values ​​corresponding to nodes provided by an embodiment of the present invention. In Figure 7, the quadrilateral pattern is used to represent nodes where the transaction subject is an acquiring institution, the pentagonal pattern is used to represent nodes where the transaction subject is a payment subsidiary, and the hexagonal pattern is used to represent nodes where the transaction subject is the payment head office.

[0069] Step 303: When the abnormal value corresponding to the first node is greater than the preset threshold, the first node is determined to be an abnormal node, and the transaction subject indicated by the first node is determined to be an abnormal transaction subject.

[0070] In this embodiment of the invention, after obtaining the anomaly values ​​corresponding to all nodes, a preset threshold can be determined based on historical experience. This preset threshold is, for example, 0.5. Alternatively, the median value of the top four anomaly values ​​can be used as the preset threshold based on the sorting information of all the obtained anomaly values. Of course, the preset threshold can also be determined based on other methods, and this embodiment of the invention does not limit this approach.

[0071] In this embodiment of the invention, after the electronic device determines the preset threshold, it can filter out the first node whose corresponding abnormal value is greater than the preset threshold and use the first node as the abnormal node. That is to say, the first node can be a single node or a group of nodes.

[0072] In this embodiment of the invention, after the abnormal node is determined, the abnormal node can be put back into the constructed graph association structure for restoration, so as to obtain a clear association tracing path and improve the convenience of transaction subject attribution analysis.

[0073] In this embodiment of the invention, the electronic device can filter candidate paths including the first node based on the graph association structure, and use the candidate paths as abnormal paths; analyze the abnormal paths to obtain abnormal analysis results; the abnormal analysis results are used to indicate the affected nodes associated with the abnormal nodes, and optimize the business of the transaction entity corresponding to the affected nodes based on the business information corresponding to the abnormal nodes.

[0074] For example, referring to Figure 8, Figure 8 is a schematic diagram of an anomaly path provided by an embodiment of the present invention. In Figure 8, the quadrilateral pattern represents a node where the transaction entity is an acquiring institution, the pentagonal pattern represents a node where the transaction entity is a payment subsidiary, and the hexagonal pattern represents a node where the transaction entity is a payment headquarters. The node represented by the fully filled quadrilateral pattern in Figure 8 is the first node, and this node, along with the nodes represented by the fully filled pentagonal pattern and the fully filled hexagonal pattern, forms an anomaly path.

[0075] In this embodiment of the invention, the advantages of graph association structure are used to further restore the association tracing path of attribution analysis, that is, the anomaly path, which improves the convenience of transaction entities to conduct anomaly attribution analysis, thereby improving the strategy optimization effect on actual business.

[0076] Based on the same inventive concept, this embodiment of the invention also provides a data processing device. As shown in FIG9, which is a structural schematic diagram of a data processing device 900, it may include: a construction unit 901, used to construct a graph association structure with transaction entities in the target business scenario as nodes and the association relationships between transaction entities as edges; a determination unit 902, used to determine the abnormality value corresponding to each node based on the business information of the transaction entity indicated by each node in the graph association structure, the association relationships between transaction entities, and preset abnormality analysis rules; wherein, each abnormality value is used to indicate the degree of abnormal fluctuation of the transaction of the transaction entity indicated by a node; the degree of abnormal fluctuation is determined based on the transaction entity's own business information and the business information of other transaction entities with which it has an association relationship; a processing unit 903, used to determine the first node as an abnormal node when the abnormality value corresponding to the first node is greater than a preset threshold, and determine the transaction entity indicated by the first node as an abnormal transaction entity.

[0077] In one possible implementation, the determining unit 902 is specifically used to: determine the fluctuation value of each node based on the business information of the transaction entity indicated by each node in the graph association structure and the first sub-rule in the preset anomaly analysis rule; the first sub-rule is used to perform magnitude normalization processing on the initial fluctuation values ​​of nodes obtained based on business information of different magnitudes; determine the impact value of the fluctuation of the business information of each node on other nodes based on the association relationship between the transaction entities and the second sub-rule in the preset anomaly analysis rule; the second sub-rule is used to calculate the degree to which the fluctuation of the lower-level node is affected by the fluctuation of the upper-level node, the lower-level node and the upper-level node being determined based on the association relationship between the transaction entities; and determine the anomaly value corresponding to each node based on the fluctuation value and the corresponding impact value of each node.

[0078] In one possible implementation, the determining unit 902 is specifically used to: input the business information of the transaction entity indicated by each node into a preset time-series attribution model to obtain the initial volatility value corresponding to each node output by the preset time-series attribution model; the preset time-series attribution model determines the initial volatility value of the transaction entity based on the business information of a transaction entity within a preset time period and a preset magnitude volatility evaluation rule; the preset magnitude volatility evaluation rule includes multiple mapping relationships, and different mapping relationships include numerical ranges corresponding to different magnitudes of business information, and initial volatility values ​​corresponding to the numerical ranges; normalize the initial volatility value corresponding to each transaction entity to obtain the volatility value of each node.

[0079] In one possible implementation, the normalization process is implemented in the following way: where represents the fluctuation value of the node, represents the initial fluctuation value corresponding to the node, and K is used to represent the total number of nodes in the graph association structure.

[0080] In one possible implementation, the second sub-rule is determined based on the following formula: where represents the influence value of node i relative to node j, represents the change value of the business information value of node i between two time points, represents the change value of the business information value of node j between two time points, represents the business information value of node i at time t, represents the business information value of node i at time t, represents the business information value of node j at time t, and represents the business information value of node j at time t, and node i and node j are any nodes in the graph association structure.

[0081] In one possible implementation, the determining unit 902 is specifically used to: construct an initial anomaly repetition operation matrix by taking the influence value of an associated node that is related to a node as a matrix factor; and determine the anomaly value corresponding to each node by substituting the initial anomaly repetition operation matrix and the fluctuation value corresponding to each node into the third sub-rule of the preset anomaly analysis rule; the third sub-rule is used to perform repeated operation optimization on the fluctuation value of the node by combining the influence values ​​corresponding to all nodes that are related to the node.

[0082] In one possible implementation, the third sub-rule is determined based on the following formula: where represents the set of all node anomaly values, n is used to characterize the number of repetition rounds, when n equals 1, represents the set of all node fluctuation values, = {, , ...,}, represents the initial anomaly repetition operation matrix, is the matrix factor in , represents the influence value of node i relative to node j, node i and node j are any nodes in the graph association structure, represents the fluctuation value of node k, d is a non-zero adjustment coefficient, and i and j are positive integers.

[0083] In one possible implementation, after determining that the first node is an abnormal node, the device further includes an optimization unit, configured to: filter candidate paths including the first node based on the graph association structure, and use the candidate paths as abnormal paths; analyze the abnormal path to obtain abnormal analysis results; the abnormal analysis results are used to indicate the affected nodes associated with the abnormal node, and optimize the business of the transaction entity corresponding to the affected node based on the business information corresponding to the abnormal node.

[0084] For ease of description, the above parts are divided into modules (or units) according to their functions and described separately. Of course, in implementing this invention, the functions of each module (or unit) can be implemented in one or more software or hardware.

[0085] Having introduced the data processing method and apparatus according to exemplary embodiments of the present invention, we will now introduce an electronic device according to another exemplary embodiment of the present invention.

[0086] As will be understood by those skilled in the art, various aspects of the present invention can be implemented as systems, methods, or program products. Therefore, various aspects of the present invention can be specifically implemented in the following forms: a completely hardware implementation, a completely software implementation (including firmware, microcode, etc.), or an implementation combining hardware and software aspects, which can be collectively referred to herein as "circuit", "module" or "system".

[0087] Regarding the apparatus in the above embodiments, the specific execution methods of each module have been described in detail in the embodiments related to the method, and will not be elaborated here.

[0088] Based on the same inventive concept as the above-described method embodiments of the present invention, the present invention also provides an electronic device. The principle of the electronic device in solving the problem is similar to that of the above-described method. Therefore, the implementation of the electronic device can refer to the implementation of the above-described method, and the repeated parts will not be described again.

[0089] Referring to FIG10, FIG10 is a block diagram of an electronic device 1000 according to an exemplary embodiment. The electronic device in this embodiment includes at least one processor 1001 and a memory 1002 connected to at least one processor 1001. In this embodiment, the specific connection medium between the processor 1001 and the memory 1002 is not limited. FIG10 shows the connection between the processor 1001 and the memory 1002 via a bus as an example. The bus is represented by a thick line in FIG10. The connection methods between other components are only for illustrative purposes and are not intended to be limiting. Buses can be divided into address buses, data buses, control buses, etc. For ease of representation, only one thick line is used in FIG10, but this does not mean that there is only one bus or one type of bus.

[0090] In this embodiment of the invention, memory 1002 stores instructions that can be executed by at least one processor 1001. At least one processor 1001 can execute the steps included in the aforementioned data processing method by executing the instructions stored in memory 1002.

[0091] The processor 1001 is the control center of the electronic device. It can connect various parts of the fault detection device through various interfaces and lines. By running or executing instructions stored in the memory 1002 and calling data stored in the memory 1002, it monitors the various functions and processing data of the electronic device as a whole. Optionally, the processor 1001 may include one or more processing units. The processor 1001 may integrate an application processor and a modem processor. The processor 1001 mainly handles the operating system, user interface, and applications, while the modem processor mainly handles wireless communication. It is understood that the modem processor may not be integrated into the processor 1001. In some embodiments, the processor 1001 and the memory 1002 may be implemented on the same chip. In some embodiments, they may also be implemented on separate chips.

[0092] The processor 1001 can be a general-purpose processor, such as a central processing unit (CPU), a digital signal processor, a dedicated integrated circuit, a field-programmable gate array (FPGA), or other programmable logic elements, discrete gates or transistor logic elements, or discrete hardware components, capable of implementing or executing the methods, steps, and logic block diagrams disclosed in the embodiments of this invention. The general-purpose processor can be a microprocessor or any conventional processor, etc. The steps of the methods disclosed in the embodiments of this invention can be directly manifested as being executed by a hardware processor, or being executed by a combination of hardware and software modules in the processor.

[0093] Memory 1002, as a non-volatile computer-readable storage medium, can be used to store non-volatile software programs, non-volatile computer-executable programs, and modules. Memory 1002 may include at least one type of storage medium, such as flash memory, hard disk, multimedia card, card-type memory, random access memory (RAM), static random access memory (SRAM), programmable read-only memory (PROM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), magnetic memory, magnetic disk, optical disk, etc. Memory 1002 can be any other medium capable of carrying or storing desired program code having an instruction or data structure form and accessible by a computer, but is not limited thereto. The memory 1002 in this embodiment of the invention can also be a circuit or any other device capable of performing storage functions, used to store program instructions and / or data.

[0094] Based on the same inventive concept, this embodiment of the invention also provides another schematic diagram of an electronic device. Referring to FIG11, the electronic device 104 includes a display unit 1140, a processor 1180, and a memory 1120. The display unit 1140 includes a display panel 1141, which is used to display information input by the user or information provided to the user, as well as various object selection interfaces of the electronic device 104. In this embodiment of the invention, it is mainly used to display the relevant operation interface and shortcut windows of the analysis system installed in the electronic device 104. Optionally, the display panel 1141 can be configured in the form of LCD (Liquid Crystal Display) or OLED (Organic Light-Emitting Diode).

[0095] The processor 1180 is used to read computer programs and then execute the methods defined by the computer programs. For example, the processor 1180 reads the application program of the analysis system, thereby running the analysis system on the electronic device 104 and displaying the relevant operation interface of the analysis system on the display unit 1140. The processor 1180 may include one or more general-purpose processors, and may also include one or more DSPs (Digital Signal Processors) for performing related operations to implement the technical solutions provided in the embodiments of the present invention.

[0096] The memory 1120 generally includes main memory and secondary storage. The main memory can be random access memory (RAM), read-only memory (ROM), and cache memory, etc. The secondary storage can be a hard drive, optical disk, USB flash drive, floppy disk, or tape drive, etc. The memory 1120 is used to store computer programs and other data. The computer programs include application programs corresponding to various software, etc. The other data may include data generated after the operating system or application programs are run, including system data (such as the configuration parameters of the operating system) and user data. In this embodiment of the invention, the program instructions are stored in the memory 1120, and the processor 1180 executes the program instructions stored in the memory 1120 to implement the functions of the data processing method described above.

[0097] In addition, the electronic device 104 may also include a display unit 1140 for receiving input digital information, character information, or contact touch operations / non-contact gestures, and generating signal inputs related to user settings and function control of the electronic device 104. Specifically, in this embodiment of the invention, the display unit 1140 may include a display panel 1141. The display panel 1141, for example, is a touch screen, which can collect touch operations performed by the user on or near it (such as the operation of a target object using a finger, stylus, or any suitable object or accessory on or near the display panel 1141), and drive the corresponding connection device according to a pre-set program. Optionally, the display panel 1141 may include two parts: a touch detection device and a touch controller. The touch detection device detects the user's touch position and detects the signal generated by the touch operation, and transmits the signal to the touch controller; the touch controller receives touch information from the touch detection device, converts it into touch point coordinates, sends it to the processor 1180, and can receive and execute commands sent by the processor 1180. In this embodiment of the invention, if a user selects an associated subprogram, the touch detection device in the display panel 1141 detects the touch operation and sends the signal corresponding to the detected touch operation to the touch controller. The touch controller converts the signal into touch point coordinates and sends them to the processor 1180. The processor 1180 determines the target business scenario selected by the user based on the received touch point coordinates and controls the display panel 1141 to display the transaction entity in the target business scenario.

[0098] The display panel 1141 can be implemented using various types such as resistive, capacitive, infrared, and surface acoustic wave. In addition to the display unit 1140, the electronic device 104 may also include an input unit 1130, which may include, but is not limited to, one or more of the following: a physical keyboard, function keys (such as volume control buttons, power buttons, etc.), a trackball, a mouse, and a joystick. Figure 11 shows an example where the input unit 1130 includes an image input device 1131 and other input devices 1132.

[0099] In addition to the above, the electronic device 104 may also include a power supply 1190 for powering other modules, an audio circuit 1160, a near-field communication module 1170, and an RF circuit 1110. The electronic device 104 may also include one or more sensors 1150, such as an accelerometer, a light sensor, a pressure sensor, etc. The audio circuit 1160 specifically includes a speaker 1161 and a microphone 1162, etc. For example, the user can use voice control. The electronic device 104 can collect the user's voice through the microphone 1162, use the user's voice for control, and play a corresponding prompt tone through the speaker 1161 when it is necessary to prompt the user that there is an abnormality in the business information.

[0100] In an exemplary embodiment, a storage medium comprising operations, such as memory 1002 comprising operations, may be performed by processor 1001 of the electronic device 1000 to accomplish the above method. Optionally, the storage medium may be a non-temporary computer-readable storage medium, for example, the non-temporary computer-readable storage medium may be a ROM, random access memory (RAM), CD-ROM, tape, floppy disk, and optical data storage device.

[0101] With the above method embodiments Based on the same inventive conception, various aspects of the data processing method provided by the invention may also be implemented as a form of a program product comprising code used to enable the electronic device to perform steps in a data processing method according to various exemplary embodiments of the invention described above when the program product is run on an electronic device, e.g.

[0102] Program products may employ any combination of one or more readable media. The readable medium can be a readable signal medium or a readable storage medium. A readable storage medium may, for example, be, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or component, or any combination of the above. More specific examples of readable storage media (a nonexhaustive list) include: electrical connections with one or more conductors, portable disks, hard drives, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), fiber optics, portable compact disk read-only memory (CD-ROM), optical memory parts, or any combination of the above-mentioned magnetic memory parts.

[0103] Program products of embodiments of the present invention may employ portable compact disk read-only memory (CD-ROM) and include program code and can run on a server. However, the program products of the invention are not limited to this, and in the present file the readable storage medium may be any tangible medium containing or storing a program that may be used by or in combination with a command-executing system, device, or component.

[0104] A readable signal medium may include a data signal propagated in a baseband or as part of a carrier, which carries a readable code. Such propagated data signals may take a variety of forms, including, but not limited to, electromagnetic signals, light signals, or any suitable combination of the foregoing. The readable signaling medium may also be any readable medium other than a readable storage medium that may be sent, propagated, or transmitted for programs used by or in conjunction with a command execution system, device, or component.

[0105] The code contained on the readable medium may be transmitted using any suitable medium, including but not limited to wireless, wired, optical fiber, RF, etc., or any suitable combination thereof.

[0106] Although preferred embodiments of the invention have been described, those skilled in the art, upon learning the basic progressive concepts, can make other changes and modifications to these embodiments. Therefore, the claims are intended to be interpreted as including the preferred embodiments as well as all changes and modifications falling within the scope of the invention.

[0107] Obviously, those skilled in the art can make various modifications and variations to this invention without departing from the spirit and scope of the invention. Therefore, if these modifications and variations of the invention fall within the scope of the claims of this invention and their equivalents, this invention also intends to include these modifications and variations. [Simplified Explanation of the Diagram]

[0026] To more clearly illustrate the technical solutions in the embodiments of the present invention or related technologies, the drawings used in the description of the embodiments or related technologies will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the provided drawings without making progressive improvements. Figure 1 is a schematic diagram of an optional application scenario in an embodiment of the present invention. Figure 2 is a schematic diagram of an optional application scenario in an embodiment of the present invention. Figure 3 is a schematic diagram of a data processing method in an embodiment of the present invention. Figure 4 is a schematic diagram of a graph association structure in an embodiment of the present invention. Figure 5 is a schematic diagram of the fluctuation value of a node in a graph association structure in an embodiment of the present invention. Figure 6 is a schematic diagram of the influence value of a node in a graph association structure in an embodiment of the present invention. Figure 7 is a schematic diagram of the anomaly value corresponding to a calculation node in an embodiment of the present invention. Figure 8 is a schematic diagram of an anomaly path in an embodiment of the present invention. Figure 9 is a schematic diagram of the composition structure of a data processing device in an embodiment of the present invention. Figure 10 is a schematic diagram of the structure of an electronic device in an embodiment of the present invention. Figure 11 is a schematic diagram of another structure of an electronic device in an embodiment of the present invention.

Claims

1. A data processing method applied to an electronic device corresponding to an analysis system for performing anomaly attribution analysis on a payment system, the electronic device comprising a processor and a memory, the memory storing instructions executable by the processor, wherein, The data processing method includes: the processor executing instructions stored in the memory to construct a graph association structure with transaction entities in the target business scenario as nodes and the relationships between transaction entities as edges; based on the business information of the transaction entity indicated by each node in the graph association structure, the relationships between transaction entities, and preset anomaly analysis rules, determining the anomaly value corresponding to each node; wherein each anomaly value is used to indicate the degree of abnormal fluctuation in the transaction of the transaction entity indicated by a node; the degree of abnormal fluctuation is determined based on the transaction entity's own business information and the business information of other transaction entities with which it has a relationship; when the anomaly value corresponding to the first node is greater than a preset threshold, the first node is determined to be an anomaly node, and the transaction entity indicated by the first node is determined to be an anomaly transaction entity.

2. The data processing method as described in claim 1, wherein, Based on the business information of the transaction entity indicated by each node in the graph's association structure, the relationships between transaction entities, and the preset anomaly analysis rules, the anomaly value corresponding to each node is determined, including: Determining the fluctuation value of each node based on the business information of the transaction entity indicated by each node in the graph's association structure and the first sub-rule in the preset anomaly analysis rules; the first sub-rule is used to normalize the initial fluctuation values ​​of nodes obtained based on business information of different magnitudes; Determining the impact value of the fluctuation of the business information of each node on other nodes based on the relationships between transaction entities and the second sub-rule in the preset anomaly analysis rules; the second sub-rule is used to calculate the degree to which lower-level nodes are affected by the fluctuations of upper-level nodes, where the lower-level nodes and upper-level nodes are determined based on the relationships between transaction entities; Determining the anomaly value corresponding to each node based on its fluctuation value and corresponding impact value.

3. The data processing method as described in claim 2, wherein, Based on the business information of the trading entity indicated by each node in the graph association structure and the first sub-rule in the preset anomaly analysis rules, the volatility value of each node is determined, including: inputting the business information of the trading entity indicated by each node into a preset time-series attribution model to obtain the initial volatility value corresponding to each node output by the preset time-series attribution model; the preset time-series attribution model determines the initial volatility value of a trading entity based on the business information of a trading entity within a preset time period and a preset magnitude volatility evaluation rule; the preset magnitude volatility evaluation rule includes multiple mapping relationships, and different mapping relationships include numerical ranges corresponding to different magnitudes of business information, and initial volatility values ​​corresponding to the numerical ranges; normalizing the initial volatility value corresponding to each trading entity to obtain the volatility value of each node.

4. The data processing method as described in claim 3, wherein, The normalization process is implemented in the following way: where represents the fluctuation value of the node, represents the initial fluctuation value corresponding to the node, and K is used to represent the total number of nodes in the graph association structure.

5. The data processing method as described in claim 2, wherein, The second sub-rule is determined based on the following formula: where represents the influence value of node i relative to node j, represents the change in the business information value of node i between two time points, represents the change in the business information value of node j between two time points, represents the business information value of node i at time t, represents the business information value of node i at time t, represents the business information value of node j at time t, and represents the business information value of node j at time t. Node i and node j are any nodes in the graph association structure.

6. The data processing method as described in any of claims 2 to 5, wherein, Based on the fluctuation value and corresponding influence value of each node, the anomaly value corresponding to each node is determined, including: using the influence value of a related node that is associated with a node as a matrix factor to construct an initial anomaly repetition operation matrix; substituting the initial anomaly repetition operation matrix and the fluctuation value corresponding to each node into the third sub-rule of the preset anomaly analysis rule to determine the anomaly value corresponding to each node; the third sub-rule is used to perform repeated operations to optimize the fluctuation value of the node by combining the influence values ​​corresponding to all nodes that are associated with the node.

7. The data processing method as described in claim 6, wherein, The third sub-rule is determined based on the following formula: where represents the set of all node anomaly values, n is used to characterize the number of rounds of repeated operations, when n equals 1, represents the set of all node fluctuation values, = {, , ...,}, represents the initial anomaly repeated operation matrix, is the matrix factor in , represents the influence value of node i relative to node j, node i and node j are any nodes in the graph association structure, represents the fluctuation value of node k, d is a non-zero adjustment coefficient, and i and j are positive integers.

8. The data processing method as described in claim 1, wherein, After determining that the first node is the abnormal node, the data processing method further includes: based on the graph association structure, screening candidate paths that include the first node, and taking the candidate path as the abnormal path; analyzing the abnormal path to obtain the abnormal analysis result; the abnormal analysis result is used to indicate the affected nodes associated with the abnormal node, and to optimize the business of the transaction entity corresponding to the affected node based on the business information corresponding to the abnormal node.

9. A data processing apparatus, wherein, The data processing device includes: a construction unit for constructing a graph association structure with transaction entities in the target business scenario as nodes and the relationships between transaction entities as edges; a determination unit for determining the anomaly value corresponding to each node based on the business information of the transaction entity indicated by each node in the graph association structure, the relationships between transaction entities, and preset anomaly analysis rules; wherein each anomaly value is used to indicate the degree of abnormal fluctuation in the transaction of the transaction entity indicated by a node; the degree of abnormal fluctuation is determined based on the transaction entity's own business information and the business information of other transaction entities with which it has a relationship; and a processing unit for determining the first node as an anomaly node and determining the transaction entity indicated by the first node as an anomaly transaction entity when the anomaly value corresponding to the first node is greater than a preset threshold.

10. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein, When the processor executes the computer program, it implements the steps of the data processing method described in any of requests 1 to 8.

11. A computer-readable storage medium, wherein, It includes code that, when the program product is run on an electronic device, causes the electronic device to perform the steps of any of the data processing methods described in request items 1 to 8.

12. A computer program product, wherein, The computer program product includes: computer program code that, when run on a computer, causes the computer to perform the steps of the data processing method described in any of claims 1 to 8.

Images