Anomaly cause recognition method and system, and related device

Abstract

Provided in the present application are an anomaly cause recognition method and system, and a related device, which may be applied in the technical field of computers. The method comprises: acquiring service data; and outputting a target anomaly cause of the service data, wherein the target anomaly cause is used for indicating an issue present in a service management process of a service system, the target anomaly cause is an anomaly cause chain, which comprises a first anomaly cause and a second anomaly cause, and the second anomaly cause is a cause of the first anomaly cause. Since the anomaly cause chain includes both the first anomaly cause and the cause of the first anomaly cause, that is, the second anomaly cause, when the first anomaly cause is a correct anomaly cause, the second anomaly cause is also a correct anomaly cause; and when the first anomaly cause is not a correct anomaly cause, the second anomaly cause may still be a correct anomaly cause. Therefore, the anomaly cause recognition method provided in the present application can significantly improve the fault tolerance of recognizing an anomaly cause of service data.

Description

Abnormal cause identification method, system and related equipment

[0001] This application claims priority to the Chinese patent application with application number 202410366518.0 filed with the State Intellectual Property Office of China on March 27, 2024, and priority to the Chinese patent application entitled “A method, system and related equipment for identifying abnormal causes”, all contents of which are incorporated by reference into this application. Technical Field

[0002] The present application relates to the field of computer technology, and in particular to a method, system, and related equipment for identifying abnormal causes. Background Art

[0003] Business data is the data generated by business systems when they manage business. Business data is unevenly distributed in business systems, which is reflected in two characteristics: (1) it follows a long-tail distribution; (2) there is a large gap between the proportion of normal and abnormal data.

[0004] Regarding characteristic (1), business systems often generate different types of business data based on different business needs. However, since the amount of different business needs often varies significantly, the amount of business data between different types also varies significantly. Specifically, large amounts of business data (also called head data) are concentrated in a few types, while small amounts of business data (also called tail data) are dispersed across most types.

[0005] Regarding characteristic (2), since business data is generated in most cases during the process of processing and managing business processes in accordance with business policies (such as business specifications and business rules), most business data is normal, and only a small amount of business data is abnormal. Therefore, there is an imbalance in the distribution of normal business data and abnormal business data. Moreover, both normal business data and abnormal business data follow a long-tail distribution, that is, normal business data is divided into two categories: head data and tail data, and abnormal business data is also divided into two categories: head data and tail data.

[0006] These two characteristics present difficulties for the application of artificial intelligence technology in business data anomaly analysis. On the one hand, because artificial intelligence technology requires the analysis and learning of large amounts of business data to construct models (such as decision trees and random forests), when the amount of business data for a minority category is large and the amount of business data for the majority category is small, the model tends to learn more about the minority category and ignore the majority category. This results in insufficient learning of the characteristics of the majority category, resulting in weak recognition of the majority category when the model is used. On the other hand, when there is more normal business data and less abnormal business data, the model also tends to learn more about normal business data and ignore abnormal business data, resulting in insufficient learning of the characteristics of abnormal business data, resulting in weak recognition of abnormal business data when the model is used. Combining these two points, because the features learned by the model are not accurate and comprehensive, the subsequent use of the model to identify the causes of business data anomalies will result in low recognition accuracy. Summary of the Invention

[0007] In order to solve the above technical problems, the present application provides a method, system and related equipment for identifying abnormal causes, which can significantly improve the accuracy of identifying abnormal causes of business data.

[0008] In a first aspect, a method for identifying an exception cause is provided. The method comprises: obtaining business data; and outputting a target exception cause for the business data. The business data is data generated by a business system when managing a business. The target exception cause for the business data indicates a problem encountered by the business system in managing the business. Furthermore, the target exception cause is an exception cause chain, comprising a first exception cause and a second exception cause, wherein the second exception cause is a cause of the first exception cause.

[0009] In the above scheme, since the abnormal cause chain not only includes the first abnormal cause, but also includes the cause of the first abnormal cause - the second abnormal cause, therefore, when the first abnormal cause is the correct abnormal cause, the second abnormal cause is also the correct abnormal cause; when the first abnormal cause is not the correct abnormal cause, the second abnormal cause may still be the correct abnormal cause. Therefore, compared with only identifying one abnormal cause of business data, where the correctness of the abnormal cause directly leads to an identification accuracy rate of only 100% or 0, this technical solution can significantly improve the fault tolerance of identifying abnormal causes of business data by using the abnormal cause chain as the target abnormal cause of business data. In addition, since there is a causal relationship between the first abnormal cause and the second abnormal cause, using the abnormal cause chain containing the first abnormal cause and the second abnormal cause as the target abnormal cause can provide better explainability for subsequent analysis of abnormal situations in business data.

[0010] In some possible implementations, the business data is business data that does not comply with business policies, i.e., suspicious data. Business policies are the rules, guidelines, and constraints for operating and making decisions about the business, including one or more of regulations, processes, standards, and requirements.

[0011] In the above scheme, we first determine whether the business data is suspicious data, and then analyze the abnormal causes of the suspicious data. This can achieve preliminary screening of a large amount of business data, effectively reducing the amount of data that needs to be analyzed for abnormalities, thereby reducing computational complexity and speeding up identification.

[0012] In some possible implementations, before outputting the target exception cause of the business data, the method further includes: using a first processing method to obtain the first exception cause; and using a second processing method to obtain an exception cause chain including the first exception cause, and using the exception cause chain as the target exception cause. The first processing method and the second processing method are different.

[0013] In some possible implementations, the first processing method may be an anomaly recognition model that includes an unsupervised clustering model and a supervised classification model, wherein the number of categories in the unsupervised clustering model is equal to the number in the supervised classification model.

[0014] Therefore, the first processing method is adopted above to obtain the first abnormal cause of the business data, including:

[0015] The business data is input into an unsupervised clustering model to obtain a first category of the business data. The business data is then input into a supervised classification model corresponding to the first category to obtain a second category of the business data, and the second category is used as the first abnormality cause. The first category belongs to the category in the unsupervised clustering model.

[0016] In the above solution, an anomaly recognition model is used to identify the abnormal causes of business data, which can realize automatic identification of the abnormal causes and improve identification efficiency.

[0017] In some possible implementations, the training samples for the supervised classification model are obtained by oversampling or undersampling business data from the same category in an unsupervised clustering model. Specifically, an unsupervised clustering model is first used to classify the business data into multiple categories based on their pure data characteristics, so that each category has only a few labels. The category is then used as the maximum oversampling range, and business data from the same category is oversampled or undersampled based on the type of label. This yields a well-balanced set of training samples corresponding to the category, which is then used as the training samples for the supervised classification model corresponding to the category.

[0018] The advantages of this technical solution will be specifically explained below using oversampling as an example.

[0019] To address the uneven distribution of business data, one technique directly oversamples the unevenly distributed business data to obtain a balanced set of training samples. Due to the large variety of business data labels and the significant disparity in the amount of business data between different labels, this technique results in excessive duplication of training samples, leading to long oversampling times, high memory consumption, and high costs. This also results in long training times when this training sample set containing a large amount of business data is subsequently used to train supervised classification models. Furthermore, because this training sample set contains too many different labels and the training samples for most labels are obtained through extensive duplication and are of poor quality, this can cause the supervised classification model to overfit the training samples, resulting in poor generalization.

[0020] In this technical solution, the broader goal of addressing the uneven distribution of business data is transformed into a smaller goal of addressing the uneven distribution of business data within a single category. By addressing the uneven distribution of business data across all categories, the overall uneven distribution of business data can be overcome. This allows for moderate replication of business data, shortening oversampling time, reducing memory consumption, and lowering costs. Furthermore, by simultaneously oversampling business data from multiple categories according to label type to obtain a balanced set of training samples corresponding to each of these categories, oversampling time and costs can be further reduced.

[0021] Furthermore, when training a supervised classification model using a balanced set of training samples corresponding to each category, the supervised classification model can fully learn the characteristics of each label within that category, making the learned characteristics accurate and comprehensive. Therefore, when using a supervised classification model to identify business data within that category, this supervised classification model has higher accuracy and precision, and the correctness of the anomaly causes obtained is also higher. Furthermore, using multiple training sample sets corresponding to each category to train multiple supervised classification models simultaneously can further shorten training time. Furthermore, because the training sample set contains only a few labels and the training samples are obtained through moderate replication and are of high quality, this can effectively reduce overfitting of the supervised classification model to the training samples and improve the generalization ability of the supervised classification model.

[0022] In some possible implementations, the training samples of the supervised classification model have labels indicating the cause of the anomaly. The labels are obtained by combining multiple semantically similar anomaly causes.

[0023] In the above scheme, multiple semantically similar labels are merged into one label, which allows the supervised classification model to fully learn the features of training samples with the same label, making the learned features more accurate.

[0024] In some possible implementations, the second processing method may be an exception cause tree. The exception cause tree is used to indicate the causal relationship between multiple exception causes. The multiple exception causes include the first exception cause and the second exception cause, and the causal relationship between the multiple exception causes includes the causal relationship between the first exception cause and the second exception cause.

[0025] Therefore, the second processing method is adopted above to obtain the abnormal cause chain including the first abnormal cause, including:

[0026] The first abnormal cause is matched with the abnormal cause tree to determine the abnormal cause chain of the first abnormal cause.

[0027] In the above scheme, the causal relationship between multiple abnormal causes is integrated into an abnormal cause tree in advance, so that the relationship between one abnormal cause and other abnormal causes can be clearly known. It is also convenient to quickly obtain the abnormal cause chain of the first abnormal cause by matching the first abnormal cause with the abnormal cause tree after identifying the first abnormal cause of the business data, thereby improving the identification efficiency.

[0028] In some possible implementations, the multiple exception causes include existing exception causes and new exception causes. The existing exception causes are labels of training samples from a supervised classification model, while the new exception causes are text generated by a large language model that has a causal relationship with the existing exception causes.

[0029] In the above solution, the powerful text generation capability of the large language model is used to expand the abnormal cause tree, so that the abnormal cause tree contains more labels and causal relationships, making the abnormal cause tree more complete and covering a wider range.

[0030] In some possible implementations, the above method further includes:

[0031] The third processing method is used to obtain the solution to the above-mentioned target abnormality cause.

[0032] The above solution can provide users with a reasonable solution to eliminate the risks brought by abnormal business data as soon as possible after identifying the cause of the abnormal business data.

[0033] In a second aspect, a system for identifying an abnormality cause is provided, the system comprising an acquisition unit and a sending unit. The acquisition unit is configured to acquire service data. The sending unit is configured to output a target abnormality cause of the service data.

[0034] The business data is data generated by the business system when managing the business. The target exception cause is used to indicate a problem encountered by the business system in managing the business. Furthermore, the target exception cause is an exception cause chain, including a first exception cause and a second exception cause, where the second exception cause is a cause of the first exception cause.

[0035] In some possible implementations, the business data is business data that does not comply with business policies, i.e., suspicious data. Business policies are the rules, guidelines, and constraints for operating and making decisions about the business, including one or more of regulations, processes, standards, and requirements.

[0036] In some possible implementations, the system further includes a first processing unit and a second processing unit. The first processing unit is configured to employ a first processing method to obtain the first exception cause. The second processing unit is configured to employ a second processing method to obtain an exception cause chain including the first exception cause, and use the exception cause chain as the target exception cause. The first processing method and the second processing method are different.

[0037] In some possible implementations, the first processing method is an anomaly recognition model that includes an unsupervised clustering model and a supervised classification model, and the number of categories in the unsupervised clustering model is equal to the number in the supervised classification model.

[0038] The first processing unit is specifically configured to input the business data into an unsupervised clustering model to obtain a first category of the business data, then input the business data into a supervised classification model corresponding to the first category to obtain a second category of the business data, and use the second category as the first abnormality cause. The first category belongs to a category in the unsupervised clustering model.

[0039] In some possible implementations, the training samples of the supervised classification model are obtained by oversampling or undersampling the business data of the same category in the unsupervised clustering model.

[0040] In some possible implementations, the training samples of the supervised classification model have labels indicating the cause of the anomaly. The labels are obtained by combining multiple semantically similar anomaly causes.

[0041] In some possible implementations, the second processing method is an exception cause tree. The exception cause tree is used to indicate the causal relationship between multiple exception causes. The multiple exception causes include the first exception cause and the second exception cause, and the causal relationship between the multiple exception causes includes the causal relationship between the first exception cause and the second exception cause.

[0042] The second processing unit is specifically configured to match the first abnormality cause with the abnormality cause tree to determine the abnormality cause chain of the first abnormality cause.

[0043] In some possible implementations, the multiple exception causes include existing exception causes and new exception causes. The existing exception causes are labels of training samples from a supervised classification model, while the new exception causes are text generated by a large language model that has a causal relationship with the existing exception causes.

[0044] In some possible implementations, the second processing unit is further configured to adopt a third processing method to obtain a solution to the cause of the target abnormality.

[0045] The third aspect provides an abnormality analysis system, including: an abnormality cause identification system and a risk control platform,

[0046] The above-mentioned abnormality cause identification system is used to perform any method as described in the first aspect;

[0047] The risk control platform is used to receive target abnormal causes of business data from the abnormal cause identification system and output the correct abnormal cause among the target abnormal causes.

[0048] In a fourth aspect, a chip system is provided, comprising a processor and a power supply circuit, wherein the power supply circuit is used to supply power to the processor, and the processor is used to execute any method as described in the first aspect.

[0049] In a fifth aspect, a computing device is provided, comprising a processor and a memory, wherein the memory is used to store instructions, and the processor is used to execute the instructions. When the processor executes the instructions, the method of any one of the first aspects is implemented.

[0050] In a sixth aspect, a computing device cluster is provided, comprising at least one computing device, each computing device comprising a processor and a memory.

[0051] The processor of the at least one computing device is used to execute instructions stored in the memory of the at least one computing device, so that the computing device cluster executes the method as described in any one of the first aspects.

[0052] In a seventh aspect, a computer program product comprising instructions is provided, which, when executed by a computing device, causes the computing device to perform any method as described in the first aspect.

[0053] In an eighth aspect, a computer-readable storage medium is provided, characterized in that it includes computer program instructions. When the computer program instructions are executed by a computing device, the computing device executes the method as described in any one of the first aspects. BRIEF DESCRIPTION OF THE DRAWINGS

[0054] FIG1A is an architecture diagram of an abnormality cause identification system provided in an embodiment of the present application;

[0055] FIG1B is an architecture diagram of another abnormality cause identification system provided in an embodiment of the present application;

[0056] FIG1C is an architecture diagram of another abnormality cause identification system provided in an embodiment of the present application;

[0057] FIG2 is a flow chart of a method for identifying an abnormality cause provided by an embodiment of the present application;

[0058] FIG3 is a flow chart of a method for training an anomaly recognition model provided in an embodiment of the present application;

[0059] FIG4A is a schematic diagram of the distribution results of header data and tail data provided by an embodiment of the present application;

[0060] FIG4B is a schematic diagram of distribution results of normal business data and abnormal business data provided by an embodiment of the present application;

[0061] FIG4C is a schematic diagram of a clustering result of business data provided in an embodiment of the present application;

[0062] FIG4D is a schematic diagram of a plurality of categories of training samples provided in an embodiment of the present application;

[0063] FIG4E is a schematic diagram of multiple trained supervised classification models provided in an embodiment of the present application;

[0064] FIG5 is a flow chart of a method for generating an abnormality cause tree according to an embodiment of the present application;

[0065] FIG6 is a schematic diagram of the structure of a tag tree provided in an embodiment of the present application;

[0066] FIG7 is a flow chart of another abnormality cause identification method provided in an embodiment of the present application;

[0067] FIG8 is a schematic diagram of the structure of a computing device provided in an embodiment of the present application;

[0068] FIG9 is a schematic diagram of the structure of a computing device cluster provided in an embodiment of the present application;

[0069] FIG10 is a schematic diagram of the structure of another computing device cluster provided in an embodiment of the present application. DETAILED DESCRIPTION

[0070] The following will describe the technical solutions in the embodiments of this application in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of this application, not all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of this application.

[0071] In order to solve the problem of low recognition accuracy when determining the abnormal cause of current business data, the present application provides an abnormal cause identification system, which can output the target abnormal cause of the business data after obtaining the business data. The target abnormal cause is used to indicate the problems existing in the business process of the business system managing the business. In addition, the target abnormal cause is an abnormal cause chain, including a first abnormal cause and a second abnormal cause, and the second abnormal cause is the cause of the first abnormal cause. Since the abnormal cause chain not only includes the first abnormal cause, but also includes the cause of the first abnormal cause - the second abnormal cause, therefore, when the first abnormal cause is the correct abnormal cause, the second abnormal cause is also the correct abnormal cause; when the first abnormal cause is not the correct abnormal cause, the second abnormal cause may still be the correct abnormal cause. Therefore, the system can improve the fault tolerance of identifying abnormal causes of business data.

[0072] See Figure 1A, which is an architecture diagram of an abnormality cause identification system provided in an embodiment of the present application. As shown in Figure 1A, the architecture includes a business system 100, a storage system 200, an abnormality cause identification system 300, a risk control platform (RCP) 400, and a client 500. Furthermore, any two of the business system 100, storage system 200, abnormality cause identification system 300, risk control platform 400, and client 500 can communicate with each other via wired or wireless means.

[0073] The business system 100 is used to generate, store, process and manage business data.

[0074] The storage system 200 is used to store business data with labels. The business data comes from the business system 100. The label of the business data is used to identify whether the business data is abnormal and the specific cause of the abnormality. The cause of the abnormality is used to indicate problems existing in the business management process of the business system. For example, the label is L0, which means that the business data is normal; the label is L1, which means that the cause of the abnormality of the business data is L1; the label is L2, which means that the cause of the abnormality of the business data is L2. Alternatively, the label is 1, which means that the business data is normal; the label is 2+L1, which means that the business data is abnormal and the cause of the abnormality is L1; the label is 2+L2, which means that the business data is abnormal and the cause of the abnormality is L2.

[0075] Optionally, the label of the business data in the above-mentioned storage system 200 can be obtained by the business personnel labeling the business data in the storage system 200 after the storage system 200 receives the business data sent by the business system 100; it can also be obtained by the business personnel labeling the business data in the business system 100 and sending it to the storage system 200; it can also be obtained by the storage system 200 receiving the business data and its correct abnormality cause sent by the risk control platform 400 and using the correct abnormality cause as the label of the business data.

[0076] The abnormality cause identification system 300 is used to calculate the abnormality cause chain of the business data based on the business data, and transmit the business data and its abnormality cause chain to the risk control platform 400 or the client 500. The business data can come from the business system 100, the storage system 200, or be input by the user through the client 500. The process of calculating the abnormality cause chain of the business data based on the business data can be seen in Figure 7 and the description of the abnormality cause identification process (III) below.

[0077] The risk control platform 400 is configured to determine the correct exception cause from the exception cause chain of the business data and send the business data and the correct exception cause to the storage system 200 or the client 500. In one specific implementation, a business person or user may manually determine the correct exception cause from the exception cause chain of the business data on the risk control platform 400.

[0078] Client 500 is used to input business data into abnormality cause identification system 300 and receive the abnormality cause chain calculated by abnormality cause identification system 300 based on the business data. Client 500 is also used to receive business data and its correct abnormality cause from risk control platform 400. Client 500 is also used to display business data and its abnormality cause chain, and / or business data and its correct abnormality cause.

[0079] In some possible implementations, the business system 100, storage system 200, abnormality cause identification system 300, risk control platform 400, and client 500 can all be deployed on a computing device. A computing device is an electronic device used for computing, processing, and storing data, including servers, supercomputers, personal computers, workstations, mobile devices, and the like.

[0080] Among them, the business system 100, storage system 200, abnormal cause identification system 300, risk control platform 400, and client 500 can be deployed on different computing devices, or deployed on the same computing device. When the business system 100, storage system 200, abnormal cause identification system 300, risk control platform 400, and client 500 are deployed on different computing devices, at least two of the business system 100, storage system 200, abnormal cause identification system 300, risk control platform 400, and client 500 are deployed on different computing devices in the same computing device cluster, or deployed on different computing devices in different computing clusters. Among them, the computing device cluster may include multiple of the above-mentioned computing devices. The specific deployment situation can be determined according to the actual application scenario and is not specifically limited in this application.

[0081] In a specific implementation, see Figure 1B, which is an architectural diagram of another abnormality cause identification system provided in an embodiment of the present application. As shown in Figure 1B, the business system 100, storage system 200, risk control platform 400, and client 500 are deployed on different computing devices, and the abnormality cause identification system 300 is built into the risk control platform 400. Specifically, the business system 100, storage system 200, risk control platform 400, and client 500 are deployed on computing devices 100A, 200A, 400A, and 500A, respectively.

[0082] Compared with the solution of deploying the abnormal cause identification system 300 and the risk control platform 400 on different computing devices respectively, so that users need to obtain different identification results (such as abnormal cause chain, correct abnormal cause) from different computing devices, the solution of embedding the abnormal cause identification system 300 in the risk control platform 400 in Figure 1B above can facilitate business personnel or users to directly quickly obtain and centrally process different identification results of business data, such as summarizing the business data and related information containing the correct abnormal cause in the abnormal cause chain into one table, and summarizing the business data and related information that do not contain the correct abnormal cause in the abnormal cause chain into another table.

[0083] In a specific implementation, the client 500 may also be deployed on a terminal device, which is an electronic device used to access a computing device, including a personal computer, a smart phone, a handheld processing device, a tablet computer, a mobile notebook, an all-in-one handheld device, a smart conference device, a smart advertising device, and the like.

[0084] Optionally, in order to input business data into the abnormal cause identification system 300 and receive the abnormal cause chain calculated by the abnormal cause identification system 300 based on the business data, the client 500 can be a software, plug-in or cloud platform console.

[0085] When the client 500 is software, the client 500 can be an independent software specifically used for abnormality cause identification. The user can use the abnormality cause identification system 300 of FIG. 1A or FIG. 1B by downloading and installing the abnormality cause identification software.

[0086] When client 500 is a plug-in, it can be built into an application tool. For example, as an abnormality cause identification plug-in for business system 100, it can identify business data in the business system in real time or periodically to determine whether the business data is abnormal and the specific cause of the abnormality. Users can use abnormality cause identification system 300 in Figure 1A by upgrading the application tool.

[0087] When the client 500 is a console, the client 500 can access a cloud service that provides an abnormality cause identification function, including a World Wide Web (web)-based client, an application client, an application programming interface (API), etc. A user can use the abnormality cause identification system 300 of FIG. 1A or FIG. 1B by purchasing the cloud service.

[0088] In some possible implementations, the abnormality cause identification system 300 includes multiple units. For example, referring to FIG1C , FIG1C is an architecture diagram of another abnormality cause identification system provided in an embodiment of the present application.

[0089] In FIG. 1C , the abnormality cause identification system 300 includes an acquisition unit 310 , a screening unit 320 , a first processing unit 330 , a second processing unit 340 , a sending unit 350 , a training unit 360 , and a generation unit 370 .

[0090] The acquisition unit 310, screening unit 320, first processing unit 330, second processing unit 340, sending unit 350, training unit 360, and generation unit 370 can be implemented via software or hardware. For example, the implementation of the training unit 360 will be described below using the training unit 360 as an example. Similarly, the implementation of the acquisition unit 310, screening unit 320, first processing unit 330, second processing unit 340, sending unit 350, and generation unit 370 can refer to the implementation of the training unit 360.

[0091] The training unit 360 is an example of a software functional unit. The training unit 360 may include code running on a computing instance. The computing instance may include at least one of a physical host (computing device), a virtual machine, and a container. Furthermore, the computing instance may be one or more. For example, the training unit 360 may include code running on multiple hosts / virtual machines / containers. It should be noted that the multiple hosts / virtual machines / containers used to run the code may be distributed in the same region or in different regions. Furthermore, the multiple hosts / virtual machines / containers used to run the code may be distributed in the same availability zone (AZ) or in different AZs, each AZ including one data center or multiple geographically close data centers. Typically, a region may include multiple AZs.

[0092] Similarly, multiple hosts / virtual machines / containers running the code can be distributed within the same virtual private cloud (VPC) or across multiple VPCs. Typically, a VPC is set up within a region. Cross-region communication between two VPCs within the same region, or between VPCs in different regions, requires a communication gateway within each VPC to interconnect the VPCs.

[0093] The training unit 360 is an example of a hardware functional unit, and the training unit 360 may include at least one computing device, such as a server. Alternatively, the training unit 360 may be a device implemented using an application-specific integrated circuit (ASIC) or a programmable logic device (PLD). The PLD may be a complex programmable logical device (CPLD), a field-programmable gate array (FPGA), a generic array logic (GAL), a data processing unit (DPU), a neural network processing unit (NPU), a system on chip (SoC), an offload card, an accelerator card, or any combination thereof.

[0094] The multiple computing devices included in the training unit 360 can be distributed in the same region or in different regions. The multiple computing devices included in the training unit 360 can be distributed in the same AZ or in different AZs. Similarly, the multiple computing devices included in the training unit 360 can be distributed in the same VPC or in multiple VPCs. The multiple computing devices can be any combination of computing devices such as servers, ASICs, PLDs, CPLDs, FPGAGALs, DPUs, NPUs, SoCs, offload cards, and accelerator cards.

[0095] The functions of each unit in the abnormality cause identification system 300 are described below.

[0096] The acquisition unit 310 is used to acquire business data and input the business data into the screening unit 320 or the first processing unit 330. The business data may come from the business system 100, the storage system 200, or may be input by a user through the client 500.

[0097] Screening unit 320 is configured to determine whether business data is suspicious and send the suspicious business data (hereinafter referred to as "suspicious data") to first processing unit 330. Suspicious data refers to business data that does not comply with business policies. Business policies are the rules, guidelines, and constraints for business operations and decision-making, and can include one or more of regulations, processes, standards, and requirements. The process of determining whether business data is suspicious can be seen in the execution of step S401 in Figure 7 below.

[0098] The first processing unit 330 is configured to determine a first anomaly cause of the suspicious data using a first processing method and transmit the suspicious data and the first anomaly cause to the second processing unit 340. Specifically, the first processing unit 330 inputs the suspicious data into an anomaly recognition model and receives the first anomaly cause calculated by the anomaly recognition model based on the suspicious data. The process of calculating the first anomaly cause based on the suspicious data by the anomaly recognition model can be seen in the execution process of step S402 in FIG. 7 .

[0099] The first processing unit 330 is further configured to determine a first anomaly cause of the business data using the first processing method and transmit the business data and the first anomaly cause to the second processing unit 340. Specifically, the first processing unit 330 directly receives the business data from the acquisition unit 310, inputs the business data into the anomaly identification model, and receives the first anomaly cause calculated by the anomaly identification model based on the business data. The process by which the anomaly identification model calculates the first anomaly cause based on the business data is similar to the process by which the anomaly identification model calculates the first anomaly cause based on the suspicious data described above, and for the sake of brevity, this description will not be further elaborated here.

[0100] The second processing unit 340 is configured to determine an exception cause chain for the first exception cause using the second processing method, and transmit the exception cause chain as the exception cause chain for the service data to the transmitting unit 350. Specifically, the second processing unit 340 inputs the first exception cause into an exception cause tree and receives the exception cause chain derived from the exception cause tree based on the first exception cause. The process of deriving the exception cause chain from the first exception cause from the exception cause tree can be seen in the execution process of step S403 in FIG. 7 .

[0101] The sending unit 350 is used to send the business data and its abnormality cause chain to the risk control platform 400 or the client 500.

[0102] The training unit 360 is used to train the anomaly recognition model used by the first processing unit 330. The anomaly recognition model is trained based on the labeled business data in the storage system 200. This process can be seen in Figure 3 and the introduction of the training process of the anomaly recognition model (I) below.

[0103] The generating unit 370 is used to generate an abnormality cause tree used by the second processing unit 340. The abnormality cause tree is trained based on the labeled business data in the storage system 200. This process can be seen in FIG. 5 and the description of the abnormality cause tree generation process (II).

[0104] It should be noted that the abnormality recognition model trained by the training unit 360 and the abnormality cause tree generated by the generation unit 370 can be stored in the same storage device 380 (as shown in FIG1C ), or stored in different storage devices 380. The storage device 380 can be a file system, a storage system, a database, etc., which is not specifically limited in this application. In addition, referring to the foregoing content, it can be seen that the abnormality cause identification system 300 can be deployed in a single computing device or a computing device cluster. When the abnormality cause identification system 300 is deployed in a single computing device, the storage device 380 can be deployed in the memory of the computing device. When the abnormality cause identification system 300 is deployed in a computing device cluster, the storage device 380 can be deployed on the same or different computing devices as other units, which is not specifically limited in this application.

[0105] It should be understood that the units in the above-mentioned abnormal cause identification system 300 are illustrated by taking the acquisition unit 310 to the generation unit 370 of the abnormal cause identification system 300 in Figure 1C as an example. In actual applications, the abnormal cause identification system 300 can also include more or fewer units, and this application does not make specific limitations.

[0106] It should be understood that the architecture of the abnormal cause identification system in Figure 1A, Figure 1B or Figure 1C above is illustrated by taking the business system 100, storage system 200, risk control platform 400, and client 500 that communicate with the abnormal cause identification system 300 as an example. In actual applications, the number of business systems 100, storage systems 200, risk control platforms 400 and clients 500 can be one or more, and this application does not make specific limitations.

[0107] To sum up, the abnormal cause identification system 300 provided in the present application determines whether the business data is suspicious data, and if the business data is suspicious data, first adopts the first processing method to obtain the first abnormal cause of the suspicious data, and then adopts the second processing method to obtain the abnormal cause chain of the first abnormal cause, and then uses the abnormal cause chain as the target abnormal cause of the suspicious data, thereby realizing the identification of the abnormal cause of the business data.

[0108] The above describes the abnormality cause identification system 300 provided in the embodiment of the present application in conjunction with Figure 1A, Figure 1B and Figure 1C. Next, a flow chart of an abnormality cause identification method provided in the embodiment of the present application is described.

[0109] Referring to Figure 2, Figure 2 is a flow chart of a method for identifying an abnormality cause provided by an embodiment of the present application. As shown in Figure 2, the method for identifying an abnormality cause provided by an embodiment of the present application includes:

[0110] S101: The client sends business data to the abnormality cause identification system.

[0111] Accordingly, the abnormality cause identification system receives business data from the client.

[0112] The client may be the client 500 in Figure 1A, Figure 1B, or Figure 1C. The abnormality cause identification system may be the abnormality cause identification system 300 in Figure 1A, Figure 1B, or Figure 1C.

[0113] In a specific implementation, the service data of the client may be input by the user through the client.

[0114] S102: The abnormality cause identification system calculates the abnormality cause chain of the business data based on the business data.

[0115] The execution process of step S102 can refer to the following FIG. 7 and the introduction of the abnormality cause identification process (III).

[0116] S103: The abnormality cause identification system sends the business data and its abnormality cause chain to the risk control platform.

[0117] Accordingly, the risk control platform receives business data and its abnormal cause chain from the abnormal cause identification system.

[0118] The risk control platform may be the risk control platform 400 in FIG. 1A , FIG. 1B , or FIG. 1C .

[0119] S104: The risk control platform determines the correct exception cause from the exception cause chain of the business data.

[0120] In a specific implementation, a business person or user may manually determine the correct exception cause from the exception cause chain of business data on the risk control platform.

[0121] S105: The risk control platform sends the business data and its correct abnormality cause to the storage system.

[0122] Accordingly, the storage system receives business data and its abnormality cause chain from the risk control platform.

[0123] The storage system may be the storage system 200 in FIG. 1A , FIG. 1B , or FIG. 1C .

[0124] It should be understood that the business data in FIG. 2 above, which comes from the client, is merely an example. The business data may also come from a business system (such as business system 100 in FIG. 1A , FIG. 1B , or FIG. 1C ), or from a storage system, and this application does not specifically limit this. In addition, the risk control platform in FIG. 2 above, which sends the business data and its correct abnormality reason to the storage system, is merely an example. The risk control platform may also send the business data and its correct abnormality reason to the client, and this application does not specifically limit this.

[0125] The following will describe in detail the training process of the abnormality recognition model by the training unit 360 in the abnormality cause recognition system 300 in FIG1C, the generation process of the abnormality cause tree by the generation unit 370, and the identification process of the abnormality cause of the business data by the screening unit 320, the first processing unit 330, and the second processing unit 340.

[0126] The training process of the abnormality recognition model by the training unit 360 can be referred to FIG. 3 and the introduction of the training process of the abnormality recognition model (I).

[0127] The generation process of the abnormality cause tree by the generation unit 370 can refer to FIG. 5 and the introduction of (2) the generation process of the abnormality cause tree.

[0128] The process of identifying the abnormal cause of the business data by the screening unit 320, the first processing unit 330 and the second processing unit 340 can refer to FIG. 7 and the introduction of the abnormal cause identification process (III).

[0129] (1) Training process of anomaly recognition model

[0130] In some possible implementations, the anomaly identification model includes an unsupervised clustering model and a supervised classification model. Therefore, the anomaly identification model training process includes the unsupervised clustering model training process and the supervised classification model training process. The unsupervised clustering model is used to determine a first category of the business data. The supervised classification model corresponding to the first category is used to determine a first cause of the anomaly in the business data.

[0131] The following will use an anomaly recognition model including an unsupervised clustering model and multiple supervised classification models as an example to specifically introduce the training process of the anomaly recognition model.

[0132] Referring to Figure 3, Figure 3 is a flow chart of a method for training an anomaly recognition model provided in an embodiment of the present application. As shown in Figure 3, the method for training an anomaly recognition model provided in an embodiment of the present application includes:

[0133] S201: Convert the labeled business data to obtain a vector of the business data.

[0134] The business data with labels comes from the storage system 200 in FIG. 1A , FIG. 1B or FIG. 1C .

[0135] In some possible implementations, only the business data may be converted so that the converted vector contains the features of the business data; or the business data and its label may be converted together so that the converted vector contains the features of the business data and the features of the label.

[0136] In some possible implementations, the above process of converting the labeled business data to obtain the vector of the business data can refer to the process of representing the original data as a feature vector or matrix using feature representation methods such as one-hot encoding (one-hot), bag of words (BOW) model or word vector model (Word2Vec), weight of evidence encoding (WOE), etc.

[0137] Among them, the above business data has the problem of uneven distribution, which is reflected in two characteristics: (1) it obeys the long-tail distribution; (2) there is a large gap between the proportion of normal and abnormal classes.

[0138] Regarding feature (1), business systems often generate different types of business data based on the business needs of the organization. However, since different business demand amounts often differ significantly, the amount of business data between different types also differs significantly, specifically manifested as: only a few types have more business data, while other types have less business data. In the embodiment of the present application, the business data in the types with large amounts of business data can be referred to as head data, and the business data in the types with small amounts of business data can be referred to as tail data. The business data in the business system can be described as: the head data is concentrated in a few types, while the tail data is dispersed in most types.

[0139] The distribution result corresponding to the above-mentioned feature (1) can be seen in FIG4A , which is a schematic diagram of the distribution result of the header data and the tail data provided in an embodiment of the present application. FIG4A is illustrated using the business data X1-X45 as an example of the business data.

[0140] In Figure 4A , the business data X1-X45 follows a long-tail distribution and falls into eight categories (Category A-Category H). Only Category A and Category B have more than 10 business data items, while the other categories have no more than 5. Therefore, in Figure 4A , the business data of Category A and Category B (including X1-X24) can be referred to as head data, while the business data of other categories (including Category C-Category H) (including X25-X45) can be referred to as tail data.

[0141] The above feature (1) and FIG. 4A are further explained below in conjunction with actual scenarios.

[0142] For example, the business system of the procurement department needs to enter a variety of business data based on material requirements. When the material requirement is to purchase materials, the business system needs to enter a purchase list and a purchase contract (such as a one-time purchase contract, a long-term purchase contract, a service purchase contract, and a material purchase contract). When the material requirement is to regularly distribute office supplies, the business system needs to enter an item distribution list (office supplies category). When the material requirement is to issue laboratory consumables, the business system needs to enter business data related to the review process of laboratory consumables applications (such as laboratory consumables application form, audit result notification form (laboratory consumables category), and item distribution list (laboratory consumables category)). When the material requirement is to issue fixed assets, the business system needs to enter business data related to the review process of fixed asset applications (such as fixed asset application form, audit result notification form (fixed asset category), and fixed asset registration form).

[0143] The demand for the various materials listed above often differs significantly, which leads to significant differences in the amount of business data corresponding to different material demands. Specifically, purchasing materials occurs frequently, so the purchase list and purchase contract are header data, such as the business data (X1-X14) of category A in Figure 4A; the allocation of office supplies occurs occasionally, so the item allocation list (office supplies category) is tail data, such as the business data (X35-X37) of category E in Figure 4A; laboratory consumables are frequently applied for, so the laboratory consumables application form, audit result notification form (laboratory consumables category), and item allocation list (laboratory consumables category) are header data, such as the business data (X15-X24) of category B in Figure 4A; fixed assets are occasionally applied for, so the fixed asset application form, audit result notification form (fixed assets category), and fixed asset registration form are tail data, such as the business data (X25-X29) of category C in Figure 4A.

[0144] It should be understood that FIG4A is an example of 45 business data belonging to 8 categories. In actual applications, the number and types of business data may be more or less, and this application does not make specific limitations.

[0145] Regarding characteristic (2), since business data is generated by business personnel in the process of processing and managing business processes according to business specifications in most cases, most business data is normal, and only a small amount of business data is abnormal. Therefore, there is an imbalance in the distribution of normal business data and abnormal business data. Moreover, both normal business data and abnormal business data follow a long-tail distribution, that is, normal business data is divided into two categories: head data and tail data, and abnormal business data is also divided into two categories: head data and tail data.

[0146] The distribution results corresponding to the above-mentioned feature (2) can be seen in FIG4B , which is a schematic diagram of the distribution results of normal business data and abnormal business data provided by an embodiment of the present application. FIG4B is a schematic diagram of the distribution results of business data obtained based on the distribution of business data X1-X45 in categories A-H in FIG4A .

[0147] As shown in Figure 4B, the business data X1-X45 are divided into normal business data and abnormal business data. Among them, there are 35 normal business data and 10 abnormal business data. Therefore, in Figure 4A, the normal business data and the abnormal business data are unevenly distributed.

[0148] Moreover, among normal business data, only business data of category A and category B exceed (inclusive) 5, while business data of other categories do not exceed 5. Therefore, normal business data obeys a long-tail distribution, and the business data belonging to category A and category B (including X1-X10, X15-X21) can be called head data, and business data of other categories (including category C-category H) (including X25-X28, X30-X33, X35-X36, X38-X40, X41-X43, X44-X45) can be called tail data.

[0149] Among the abnormal business data, only business data of category A and category B exceed (inclusive of) 3, while business data of category C, category D and category E each have 1. Therefore, the abnormal business data obeys a long-tail distribution, and the business data belonging to category A and category B (including X11-X14, X22-X24) can be called head data, and business data X29, X34 and X37 can be called tail data.

[0150] It should be understood that the above Figure 4B is illustrated by taking 45 business data belonging to 2 categories (normal and abnormal) as an example. In actual applications, the number and types of business data may be more or less, and this application does not make specific limitations.

[0151] S202: Using the vector of the business data as input data, training an unsupervised clustering model, and obtaining the trained unsupervised clustering model and categories corresponding to the business data.

[0152] In some possible implementations, the unsupervised clustering model can be a clustering algorithm such as the K-means algorithm, the fuzzy C-means algorithm, or the mean-shift algorithm. Therefore, the process of inputting the business data vector into the unsupervised clustering model to obtain the trained unsupervised clustering model and the categories corresponding to the business data can refer to the process of using a clustering algorithm such as the K-means algorithm, the fuzzy C-means algorithm, or the mean-shift algorithm to classify multiple vectors into multiple categories.

[0153] After completing the training process of the above-mentioned unsupervised clustering model, the clustering results of the business data can be obtained. Referring to Figure 4C, Figure 4C is a schematic diagram of the clustering results of a business data provided by an embodiment of the present application. Figure 4C is a schematic diagram of the clustering results of the business data obtained by continuing to use the business data X1-X45 in Figure 4A as an example.

[0154] As shown in FIG4C , business data X1-X45 belong to four categories (category Y1-category Y4). The details are as follows:

[0155] Category Y1 contains fewer types of business data, but the amount of business data varies significantly between categories. Specifically, Category Y1 includes business data of categories A, B, and H, and the amount of business data of category A is much greater than that of category B or category H.

[0156] Category Y2 includes a wide range of business data types, but the volume of business data varies significantly between categories. Specifically, Category Y2 includes business data from categories A, B, C, E, and F, with Category A having far more volume than other categories.

[0157] Category Y3 includes many types of business data, but the amount of business data varies greatly between categories. Specifically, Category Y3 includes business data of categories B, D, G, and H, and the amount of business data of category B is greater than that of other categories.

[0158] Category Y4 includes many types of business data, but the amount of business data varies little between categories. Specifically, category Y4 includes business data of categories C, D, E, and F, and the amount of business data of all categories is similar.

[0159] It should be understood that the above Figure 4C is illustrated by taking 45 business data belonging to 4 categories as an example. In actual applications, the number of business data and the number of categories may be more or less, and the business data situation under each category needs to be determined according to the actual application scenario, and this application does not make specific limitations.

[0160] S203: Oversampling the business data of the same category to obtain training samples of the category, and further obtaining training samples of multiple categories.

[0161] In some possible implementations, to address the imbalanced distribution of service data across different types within a category, oversampling of service data within the same category can be performed. Oversampling refers to increasing the volume of service data from other categories to bring it closer to that of the category with the largest volume. In one specific implementation, oversampling can be achieved by replicating service data within a category to increase the volume of that category.

[0162] By oversampling the business data within each category, the business data within each category can be made into a balanced data set. This balanced data set corresponding to a category can then be used as the training sample for that category (also known as the training sample set). Based on the clustering results of the business data in Figure 4C above, oversampling the business data within each category in Figure 4C yields training samples for multiple categories, as shown in Figure 4D.

[0163] See Figure 4D, which is a schematic diagram of a training sample of multiple categories provided by an embodiment of the present application. As shown in Figure 4D:

[0164] There are 11 business data under category Y1, among which category A has the most business data, with 8 (including X1-X8). Therefore, the business data of category B and category H are increased to 8 respectively, so that the amount of business data of category A, category B and category H in category Y1 is equal, thereby obtaining 24 training samples of category Y1 (including Y101-Y124).

[0165] There are 12 business data under category Y2, among which category A has the most business data, with 6 (including X9-X14). Therefore, the business data of category B, category C, category E and category F are increased to 6 respectively, so that the amount of business data of category A, category B, category C, category E and category F in category Y2 is equal, thereby obtaining 30 training samples of category Y2 (including Y201-Y230).

[0166] There are 13 business data under category Y3, among which category B has the most business data, with 6 (including X19-X24). Therefore, the business data of category D, category G and category H are increased to 6 respectively, so that the amount of business data of category B, category D, category G and category H in category Y3 is equal, thereby obtaining 24 training samples of category Y3 (including Y301-Y324).

[0167] There are 9 business data under category Y4, among which category C has the most business data, with 3 (including X27-X29). Therefore, the business data of category D, category E and category F are increased to 3 respectively, so that the amount of business data of category C, category D, category E and category F in category Y4 is equal, thus obtaining 12 training samples of category Y4 (including Y401-Y412).

[0168] As shown in Figure 4D:

[0169] (1) The number of categories in the same category is proportional to the amount of oversampled business data. The greater the number of categories, the more business data needs to be oversampled, and the greater the cost of oversampling; the fewer the number of categories, the less business data needs to be oversampled, and the lower the cost of oversampling.

[0170] For example, category Y2 requires oversampling of 4 types of business data, while category Y1 only requires oversampling of 2 types of business data. Therefore, the cost of oversampling category Y2 is greater than the cost of oversampling category Y1.

[0171] (2) The degree of difference in the amount of business data between different types within the same category is proportional to the amount of oversampled business data. The greater the difference in the amount of business data between different types, the more business data needs to be oversampled and the greater the cost of oversampling; the smaller the difference in the amount of business data between different types, the less business data needs to be oversampled and the lower the cost of oversampling.

[0172] For example, in category Y1, the amount of service data for category A differs by 6 from that for category B and category H, and by 7 from that for category H. Therefore, the amount of service data for category B and category H needs to be increased by 6 and 7, respectively, to obtain 24 training samples for category Y1. However, in category Y4, the amount of service data for category C is similar to that for the other categories, so the amount of service data for each category only needs to be increased by 1 to obtain 12 training samples for category Y4. Therefore, the cost of oversampling category Y1 is greater than the cost of oversampling category Y4.

[0173] It should be understood that the oversampling in Figure 4D above is illustrated by taking the same amount of business data for all types in the same category as an example. In actual applications, the amount of oversampled business data may be more or less. The specific situation needs to be determined according to the actual application scenario, and this application does not make any specific limitations.

[0174] It should be understood that the above-mentioned use of oversampling to obtain training samples for a category is merely an example and is not specifically limited herein. In practical applications, undersampling can also be used to obtain training samples for a category. Undersampling refers to reducing the amount of service data for other categories so that the amount of service data for other categories is similar to that of the category with the least service data. In a specific implementation, undersampling can be achieved by deleting service data in a category to reduce the amount of service data for that category.

[0175] By undersampling the business data for each category, the business data in each category can be made into a balanced data set. This balanced data set corresponding to the category can then be used as the training sample for that category (also called the training sample set). This process is similar to the above-mentioned process of oversampling business data for the same category to obtain training samples for that category, and then obtaining training samples for multiple categories. For the sake of brevity, this process will not be elaborated here.

[0176] S204: Using the training samples of the multiple categories and their labels, respectively train multiple supervised classification models to obtain multiple trained supervised classification models, wherein the labels of the training samples are the labels of the business data.

[0177] Since the training samples of a category are obtained by oversampling the business data of that category, the training samples of that category include business data and data augmented based on the business data. For example, in category Y1 in Figure 4D above, training samples Y101-Y108 are business data X1-X8 of category A; training samples Y109-Y116 include both business data X15 and X16 of category B, as well as six data obtained by oversampling X15 and / or X16; and training samples Y117-Y124 include both business data X44 of category H, as well as seven data obtained by oversampling X44.

[0178] When the training sample is business data, the vector of the business data is used as the vector of the training sample, and the label of the business data is used as the label of the training sample. When the training data is data added based on the business data, the vector of the corresponding business data is used as the vector of the training sample, and the label of the corresponding business data is used as the label of the training sample. For example, if training sample Y109 is business data X15, the vector of business data X15 is used as the vector of training sample Y109, and the label of business data X15 is used as the label of training sample Y109; if training sample Y116 is data obtained by copying business data X16, the vector of business data X16 is used as the vector of training sample Y116, and the label of business data X16 is used as the label of training sample Y116.

[0179] In some possible implementations, using training samples from multiple categories and their labels to train multiple supervised classification models, respectively, to obtain multiple trained supervised classification models, includes: using the vectors and labels of the training samples from each category as input data, training a supervised classification model, and obtaining a trained supervised classification model. Using the training samples from multiple categories in FIG. 4D as an example, the multiple trained supervised classification models obtained are shown in FIG. 4E .

[0180] See Figure 4E, which is a schematic diagram of multiple trained supervised classification models provided in an embodiment of the present application.

[0181] As shown in Figure 4E , the training samples of the four categories (category Y1-category Y4) are used to train four supervised classification models (supervised classification model Z1-supervised classification model Z4), thereby obtaining four trained supervised classification models. The vectors and labels of the training samples Y101-Y124 of category Y1 are used to train the supervised classification model Z1, the vectors and labels of the training samples Y201-Y230 of category Y2 are used to train the supervised classification model Z2, the vectors and labels of the training samples Y301-Y324 of category Y3 are used to train the supervised classification model Z3, and the vectors and labels of the training samples Y401-Y412 of category Y4 are used to train the supervised classification model Z4.

[0182] As can be seen from FIG. 4E , the number of supervised classification models depends on the number of categories in the unsupervised clustering model in step S202 , and is equal to the number of categories in the unsupervised clustering model.

[0183] It should be understood that the input data of the supervised classification model in Figure 4E above is illustrated by taking the training samples of categories Y1 to Y4 in Figure 4D above as an example. In actual applications, the input data of the supervised classification model may be more or less, and the specific situation needs to be determined according to the actual application scenario. This application does not make specific limitations.

[0184] In some possible implementations, the supervised classification model (such as the supervised classification model Z1 in FIG4E ) can be a classification algorithm such as a decision tree, random forest, or XGBOOST. Therefore, the process of inputting the vectors and labels of the training samples of each category into the supervised classification model to obtain the trained supervised classification model can refer to the process of inputting labeled data into a decision tree (or random forest, XGBOOST) to obtain the trained decision tree (or random forest, XGBOOST).

[0185] In some possible implementations, to improve the accuracy of the supervised classification model, before training multiple supervised classification models using training samples from multiple categories and their labels, the labels of the training samples are first integrated. Multiple semantically similar labels are merged into a single label, allowing the supervised classification model to fully learn the characteristics of training samples with the same label. The process of integrating the labels of the training samples can be seen in the execution process of step S301 in Figure 5 below.

[0186] It should be understood that the training process of the anomaly recognition model in Figure 3 above is illustrated by taking one unsupervised clustering model and multiple supervised classification models in the anomaly recognition model as an example. In actual applications, the number of unsupervised clustering models and supervised classification models can be one or more, and this application does not make specific limitations.

[0187] To solve the problem of uneven distribution of business data, two technical solutions are currently used, including:

[0188] The first technical solution directly oversamples the unevenly distributed business data to obtain a balanced training sample set. Due to the large variety of business data labels and the large disparity in the amount of business data between different labels, this technical solution will cause excessive duplication of training samples, resulting in long oversampling time, large memory consumption, and high costs. It will also lead to long training times when the supervised classification model is subsequently trained using this training sample set containing a large amount of business data. In addition, because this training sample set contains too many different labels and the training samples for most labels are obtained through extensive duplication and are of poor quality, this will cause the supervised classification model to overfit the training samples, resulting in poor generalization ability of the supervised classification model.

[0189] The second technical solution directly undersamples the unevenly distributed business data to obtain a balanced training sample set. Due to the large disparity in the amount of business data between different labels, this technical solution will result in excessive discarding of training samples, rendering the discarded training samples ineffective. When the supervised classification model is subsequently trained using this training sample set containing only a small amount of business data, the supervised classification model cannot fully learn the characteristics of each label, resulting in poor generalization, instability, unreliability, and performance degradation.

[0190] This technical solution converts the major goal of solving the problem of uneven distribution of business data into a smaller goal of solving the problem of uneven distribution of business data within a category, and overcomes the problem of overall uneven distribution of business data by solving the problem of uneven distribution of business data within all categories.

[0191] When this technical solution uses oversampling to address the uneven distribution of business data within a category, it first uses an unsupervised clustering model to divide the business data into multiple categories based on the pure data characteristics of the business data, so that each category has only a few labels. The category is then used as the maximum range for oversampling, and business data within the same category is oversampled according to the type of label to obtain a balanced training sample set corresponding to the category. This achieves moderate replication of training samples, shortens oversampling time, reduces memory consumption, and lowers costs. Furthermore, by simultaneously oversampling business data from multiple categories according to the type of label to obtain a balanced training sample set corresponding to the multiple categories, oversampling time and costs can be further shortened.

[0192] On the other hand, when the supervised classification model is subsequently trained using a balanced set of training samples corresponding to the categories, the supervised classification model can fully learn the characteristics of each label within that category, making the learned characteristics accurate and comprehensive. Therefore, when the supervised classification model is used to identify business data of that category in the future, this supervised classification model has higher accuracy and precision. Furthermore, using multiple training sample sets corresponding to the categories simultaneously to train multiple supervised classification models can further shorten training time. In addition, because the training sample set only contains a few labels and the training samples are obtained through moderate replication and are of high quality, this can effectively reduce the supervised classification model's overfitting of the training samples and improve the supervised classification model's generalization ability.

[0193] When this technical solution uses undersampling to solve the problem of uneven distribution of business data within a category, it adopts an unsupervised clustering model to divide the business data into multiple categories, so that there are only a few labels under each category. Then, the category is used as the maximum range of undersampling, and the business data under the same category is undersampled according to the type of label to obtain a balanced distribution of training samples corresponding to the category. In this way, the training samples can be discarded moderately, avoiding the problem of training samples being unable to play a role due to being discarded in large quantities.

[0194] (2) Generation process of abnormal cause tree

[0195] Referring to FIG5 , FIG5 is a flow chart of a method for generating an abnormality cause tree provided in an embodiment of the present application. As shown in FIG5 , the method for generating an abnormality cause tree provided in an embodiment of the present application includes:

[0196] S301: Integrate tags for business data.

[0197] The business data tag is used to identify whether the business data is abnormal and the specific cause of the abnormality. The storage system 200 in FIG. 1A , FIG. 1B , or FIG. 1C stores the business data with the tag. Therefore, the business data tag can be obtained from the storage system 200 in FIG. 1A , FIG. 1B , or FIG. 1C .

[0198] Since business data is tagged by business personnel, this can lead to uneven quality due to being tagged by multiple people. This can result in labels with similar semantics but different characters. For example, labels such as "parts not accounted for," "parts omitted for registration," and "materials omitted for accounting" can be found. The labeling process for these business data labels can be found in the introduction to business data labels in storage system 200 in FIG. 1A . For the sake of brevity, this will not be elaborated here.

[0199] To solve the above problems, you can integrate the tags of business data and merge multiple tags with similar semantics into one tag, thereby improving the quality of tags. The tag integration method can refer to the following implementation methods 1 to 3:

[0200] Implementation method 1: Use a large language model (LLM) to integrate labels.

[0201] Implementation method 2: Use text clustering algorithm to integrate labels.

[0202] Implementation method 3: Integrate tags manually.

[0203] In implementation 1 of step S301, the large language model refers to a deep learning model built by analyzing and learning a large amount of text. The large language model can be, for example, a generative pre-trained transformer (GPT), a bidirectional encoder representations from transformers (BERT), an eXtreme learning network (XLNet), or a text-to-text transfer transformer (T5).

[0204] In some possible implementations, the above-mentioned use of a large language model to integrate labels is specifically as follows: the labels are input into the large language model, and the large language model is fine-tuned based on a prompt method, so that the fine-tuned large language model integrates the labels and outputs the integrated labels.

[0205] In one specific implementation, the prompt-based method fine-tunes the large language model by inputting a prompt template into the large language model to guide it in label integration and output the integrated labels. The prompt template is text and serves as a task for the large language model. The prompt template can be generated using methods such as zero-shot prompting, few-shot prompting, or instruction prompting.

[0206] As an example, a zero-sample prompt is used to generate a prompt template 11, and the prompt template 11 may be:

[0207] "Merge all texts with similar semantics into one text, and output the integrated text in the form of a list."

[0208] As another example, a few-sample prompt is used to generate the prompt template 12. The prompt template 12 may be:

[0209] "Below are some examples of merging multiple semantically similar texts. Please use these examples to integrate the provided text.

[0210] Example 1: Accessories not accounted for; Accessories omitted from registration; Materials omitted from accounting. Consolidation Result: Accessories omitted from accounting.

[0211] Example 2: Label affixed incorrectly; label affixed incorrectly; label affixed in the wrong place. Result: Label affixed improperly.

[0212] Example 3: Improper transfer of portable devices; illegal transfer of portable devices; non-compliant transfer of portable devices. Integration result: Irregular transfer of portable devices.

[0213] Please merge all the texts with similar semantics into one text and output the combined text in a list."

[0214] In summary, inputting the label and prompt template 11 (or prompt template 12) into the large language model allows the large language model to integrate the label and output the integrated label. This process can be referred to the process of inputting text and prompt template into GPT, BERT, XLNet, or T5 to obtain the target text. For the sake of brevity, it will not be elaborated here.

[0215] In implementation 2 of step S301, a text clustering algorithm is used to cluster a text collection to obtain one or more text clusters. A text cluster is a group of texts that have similarities in semantics or categories. The text clustering algorithm can be, for example, a K-means algorithm, a hierarchical clustering algorithm, a balanced iterative reducing and clustering using hierarchies (BIRCH), or a density-based spatial clustering of applications with noise (DBSCAN).

[0216] In some possible implementations, the above-mentioned use of a text clustering algorithm to integrate labels is specifically as follows: inputting the labels into the text clustering algorithm, using the text clustering algorithm to divide the labels into multiple clusters, and selecting a label in each cluster as the target label of the cluster, so as to obtain the target labels of all clusters as the integrated labels. This process can refer to the process of using the K-means algorithm, hierarchical clustering algorithm, BIRCH or DBSCAN to divide a text collection into multiple clusters based on text similarity, and obtain the representative text of each cluster (such as the average value or center point of the text within the cluster). For the sake of brevity of the specification, it will not be elaborated here.

[0217] In implementation mode 3 of step S301 , the tags are integrated manually. Specifically, a small number of business personnel integrate multiple tags with similar semantics and determine one tag to replace the multiple tags with similar semantics.

[0218] It should be understood that the implementation methods 1, 2, and 3 of integrating tags in step S301 are merely examples and are not specifically limited herein. In practical applications, any implementation method that can integrate tags and combine multiple semantically similar tags into one tag is within the scope of protection of this application.

[0219] S302: Construct a label tree based on the integrated labels, and use the label tree as the abnormality cause tree.

[0220] In some possible implementations, a large language model can be used to construct the integrated tags into a tag tree that indicates the causal relationships between multiple tags. Specifically, the integrated tags are input into the large language model, and a prompt template is input into the large language model to guide the large language model to construct a tag tree based on the causal relationships between the integrated tags. The structure of the tag tree can be seen in Figure 6, which is a schematic diagram of the structure of a tag tree provided in an embodiment of the present application.

[0221] As shown in Figure 6, the label tree consists of four layers (L1-L4). The labels between adjacent layers have a causal relationship. The specific situation is as follows:

[0222] The tags in layer L2 are the causes of the tags in layer L1. Specifically, tags L201-L204 in layer L2 are the causes of tags L101-L108 in layer L1; tags L205-L208 in layer L2 are the causes of tags L109-L116 in layer L1; and tags L209-L212 in layer L2 are the causes of tags L117-L124 in layer L1.

[0223] The labels in layer L3 are the causes of the labels in layer L2. Specifically, labels L301 and L302 in layer L3 are the causes of labels L201-L204 in layer L2; labels L303 and L304 in layer L3 are the causes of labels L205-L208 in layer L2; and labels L305 and L306 in layer L3 are the causes of labels L209-L212 in layer L2.

[0224] The labels in layer L4 are the cause of the labels in layer L3. Specifically, label L401 in layer L4 is the cause of label L301 and label L302 in layer L3; label L402 in layer L4 is the cause of label L303 and label L3024 in layer L3; and label L403 in layer L4 is the cause of label L305 and label L306 in layer L3.

[0225] It should be understood that the above Figure 6 is illustrated by taking the example of a tag tree having four layers and including 45 tags. In actual applications, the number of layers and the number of tags in the tag tree can be more or less, which can be determined according to the actual application scenario. This application does not make specific limitations.

[0226] Next, the business system of the purchasing department in step S201 in FIG. 3 is used as an actual scenario, and FIG. 6 is further explained in combination with the tag tree constructed by tags of business data in the business system.

[0227] See Table 1, which illustrates a tag tree constructed based on tags of business data in the business system of the purchasing department. For the sake of brevity, Table 1 only shows part of the tag tree.

[0228] Table 1

[0229] (Continued)

[0230] Table 1 shows that the tag tree constructed based on the tags of business data in the procurement department's business system has four layers (L1-L4). Each item in layer L1 is a tag at the finest level; each item in layer L2 is a tag at a finer level; each item in layer L3 is a tag at a coarser level; and each item in layer L4 is a tag at the coarsest level. The following example, "Missing Accounting for Accessories" and "Conversion between R&D Materials and Assets" in layer L1, illustrates the tag relationships between different layers. The details are as follows:

[0231] The label relationship between layer L1 and layer L2 is specifically as follows: the three labels in layer L1, "Missed account creation for accessories" and "Missed account creation for material requisition forms", have a common cause represented by the two labels "Incomplete account creation" and "Inaccurate account creation" in layer L2. The two labels in layer L1, "Untimely account creation for material distribution" and "Untimely account creation for purchases", have a common cause represented by the label "Untimely account creation" in layer L2. The two labels in layer L1, "Electronic labels not affixed" and "Untimely printing of paper asset labels", have a common cause represented by the two labels "Irregular asset label affixation" and "Untimely asset label affixation" in layer L2. The two labels in layer L1, "Project closed but still applying for assets (external)" and "Project closed but still applying for assets (internal)", have a common cause represented by the label "Inconsistent asset purchase time" in layer L2. The two labels in layer L1, "Fixed assets mistakenly routed through the material requisition channel" and "High-risk physical items not centrally requisitioned," share a common cause represented by the label "Inconsistent asset requisition type" in layer L2. The two labels in layer L1, "Short-term requisition of fixed assets of the same type" and "Short-term requisition of materials of the same type," share a common cause represented by the label "Excessive asset requisition quantity" in layer L2. The two labels in layer L1, "R&D materials used for non-R&D activities" and "Conversion of R&D materials into assets," share a common cause represented by the label "Fake requisition" in layer L2.

[0232] The label relationship between layers L2 and L3 is as follows: The five labels in layer L2, "Incomplete Accounting" and "Delayed Asset Labeling," share a common cause represented by the label "Irregular Accounting Process" in layer L3. The three labels in layer L2, "Inconsistent Asset Subscription Time" and "Excessive Asset Subscription Quantity," share a common cause represented by the label "Irrational Demand" in layer L3. The label "Fake Subscription" in layer L2 is also responsible for the label "Unrealistic Demand" in layer L3.

[0233] The label relationship between layer L3 and layer L4 is specifically as follows: the three labels in layer L3, "non-standardized accounting process" and "unrealistic requirements", have a common cause represented by the label "accounting management risk" in layer L4.

[0234] It should be understood that the "use period of assets to be disposed of is less than 1 year" - "irregular transfer of portable devices to individuals" in layer L1, and the label relationship between different related levels, are similar to the "missing account for accessories" - "mutual conversion of R&D materials and assets" in the above-mentioned layer L1 and the label relationship between different related levels. For the sake of brevity, they will not be elaborated here.

[0235] It should be understood that the above Table 1 is only an example, and this application does not specifically limit the specific content of the tag tree.

[0236] The construction method of the above tag tree can refer to the following implementation method 1 and implementation method 2:

[0237] Implementation method 1: Use prompt templates to guide the large language model to determine the causal relationship between tags, and then use the large language model to build a tag tree with causal tags.

[0238] Implementation method 2: Use a prompt template to guide the large language model to generate one or more new tags that have a causal relationship with the existing tags, and then use the large language model to build a tag tree with these causal tags.

[0239] In the implementation method 1 of step S302, the prompt template generated by using the zero-sample prompt is used as an example for introduction. The prompt template generated by using the zero-sample prompt can be, for example, the following:

[0240] Prompt template 21: "Please explain the causal relationship between Y1, Y2, and Y3."

[0241] Prompt template 22: "Please find the text that leads to Y1 from all the texts."

[0242] Prompt Template 23: "Please find the texts that have causal relationships from all the texts."

[0243] The following uses prompt template 21 and prompt template 22 as examples to specifically describe the process of building a tag tree.

[0244] (1) Using prompt template 21

[0245] Replace Y1, Y2, and Y3 with three labels (e.g., label L101, label L102, and label L201 in FIG6 ), input the prompt template 21 including the three labels into the large language model, and identify the label (hereinafter referred to as the first label) as the cause among the three labels (e.g., label L201 in FIG6 ) based on the output of the large language model.

[0246] Replace Y1 with the first label, and replace Y2 and Y3 with two new labels (such as label L202 and label L301 in FIG6 ). Input the prompt template 21 including these three labels into the large language model. Based on the output of the large language model, identify the label (hereinafter referred to as the second label) that serves as the cause among the three labels (such as label L301 in FIG6 ).

[0247] Replace Y1 with the second label, and replace Y2 and Y3 with two new labels (such as label L302 and label L401 in FIG6 ). Input the prompt template 21 including these three labels into the large language model. Based on the output of the large language model, identify the label that serves as the cause among the three labels (such as label L401 in FIG6 ).

[0248] The above steps are iterated until the final cause is found, or until all integrated labels are used to generate prompt template 21, and then the output results of all large language models are integrated to obtain the cause tree of the first label (such as label L101 (or label L102) → label L201 → label L301 → label L401 in Figure 6 above).

[0249] The process of obtaining the cause tree of other labels is similar to the process of obtaining the cause tree of the first label described above, and for the sake of brevity of the specification, it will not be elaborated here.

[0250] Finally, the reason trees of all labels are integrated to obtain the label tree.

[0251] (2) Using prompt template 22

[0252] Replace Y1 with the initial label (such as label L101 in FIG6 ), input the prompt template 22 including the initial label into the large language model, and select a label as the first label (such as label L201 in FIG6 ) from the output of the large language model (such as labels L201 to L204 in FIG6 );

[0253] Replace Y1 with the first label, input the prompt template 22 including the first label into the large language model, and select one label as the second label (such as label L301 in FIG6 ) from the output of the large language model (such as label L301 and label L302 in FIG6 );

[0254] Replace Y1 with the second label, input the prompt template 22 including the second label into the large language model, and select a label from the output of the large language model (such as label L401 in FIG. 6 ) as the third label;

[0255] The above steps are iterated until the output result of the large language model indicates that there is no text that leads to Y1 in all texts. Then the initial label, the first label, the second label, the third label, etc. are integrated to obtain a branch of the cause tree of the initial label (such as label L101 → label L201 → label L301 → label L401 in Figure 6 above).

[0256] The process of obtaining other branches of the cause tree of the initial label is similar to the process of obtaining one branch of the cause tree of the initial label described above, and will not be elaborated here for the sake of brevity.

[0257] Then, all branches of the cause tree of the initial label are integrated to obtain a complete cause tree of the initial label.

[0258] The process of obtaining the complete cause tree of other labels is similar to the process of obtaining the complete cause tree of the initial label described above, and for the sake of brevity of the specification, it will not be elaborated here.

[0259] Finally, the complete cause trees of all labels are integrated to obtain the label tree.

[0260] It should be understood that the above-mentioned use of prompt template 21 and prompt template 22 to construct a tag tree is only an example and is not specifically limited here. In actual application, the prompt template needs to be determined according to the actual application scenario and is not specifically limited in this application.

[0261] In Implementation 2 of step S302, the existing labels can be the labels of the training samples in step S204 of FIG. The following description continues with the example of a prompt template generated using a zero-sample prompt. For example, a prompt template generated using a zero-sample prompt could be "Please list the reasons that lead to Y1." The process of constructing a label tree using this prompt template is similar to the process of constructing a label tree using prompt template 22 in Implementation 1 of step S302. For the sake of brevity, this description will not be repeated here.

[0262] By iteratively inputting the prompt template of Y1, which includes constantly changing specific content, into the large language model to obtain multiple output results of the large language model, and then integrating the multiple output results, the powerful text generation capability of the large language model can be used to expand the label tree, so that the label tree contains more labels and causal relationships, making the label tree more complete and covering a wider range.

[0263] It should be understood that the implementation method 1 and implementation method 2 of integrating tags in step S302 are only examples and are not specifically limited here. In practical applications, any implementation method that can build a tag tree based on the integrated tags is within the scope of protection of this application.

[0264] In summary, integrating the causal relationships between all tags into a tag tree clearly demonstrates the relationship between one tag and other tags, making it easier to find related tags for a given tag. Furthermore, tags in a tag tree are derived by merging multiple tags with similar semantics. Therefore, the tag tree is standardized and regulated, facilitating standardized output when the tag tree is subsequently used, thus achieving digital and standardized business operations.

[0265] (3) Identification process of abnormal causes

[0266] Referring to Figure 7, Figure 7 is a flow chart of another abnormality cause identification method provided by an embodiment of the present application. As shown in Figure 7, the abnormality cause identification method provided by an embodiment of the present application includes:

[0267] S401: Determine whether the business data is suspicious data.

[0268] In some possible implementations, the method for determining suspicious data may refer to the following implementation 1 and implementation 2:

[0269] Implementation method 1: Match business data with business policies and determine whether the business data is suspicious data based on the matching results.

[0270] Implementation method 2: Input the business data into the first supervised classification model, and determine whether the business data is suspicious data based on the classification results.

[0271] In implementation method 1 of step S401, business policies are the specific rules, guidelines, and constraints established by an organization regarding business operations and decision-making. Business policies may include various regulations, processes, standards, and requirements, etc., used to guide the behavior and decision-making of business personnel in their work. Business policies may be, for example, business specifications or business rules. Business specifications are normative documents used to standardize and guide an organization's business operations and processes, including workflows, standard operating procedures, and policy provisions. Business rules are executable rules or conditions established within business processes to guide business operations and decision-making.

[0272] Below, taking the fixed asset application form in step S201 in Figure 3 as business data and the business rules related to fixed asset application as an example of business policy, we will specifically introduce the process of matching business data with business policies and determining whether the business data is suspicious data based on the matching results.

[0273] Assume that the fixed asset application form A1 is: Name: Zhang San; Employee number: 100100; Date of joining the company: March 20, 2023; Assets under name: 1 laptop; Registration date: May 20, 2023; Purpose of asset: Personal office use; Useful life: 8 months; Application date: February 5, 2024; Applied asset item: Laptop; Purpose of asset: Personal office use.

[0274] Assume that business rule B1 is: if you already have a portable device in your name, and the "asset purpose" is "personal office use", and the usage period is less than 33 months, you cannot apply for a new portable device for "personal office use".

[0275] In a specific implementation, matching the fixed asset application form A1 with the business rule B1 includes converting the business rule B1 into a structured query language (SQL) statement C1, using SQL statement C2 in SQL statement C1 to query multiple application forms including the fixed asset application form A1 to obtain a query result, and then using SQL statement C3 in SQL statement C1 to perform a calculation operation on the query result to obtain a calculation result.

[0276] SQL statement C2 is used to retrieve application forms from the procurement department's business system for laptops with a bill of lading date of last month. Specifically, these fixed asset application forms include the phrase "office laptop."

[0277] SQL statement C3 is: Bill of Lading Date = Asset Activation Date ≤ 33 Months AND Role ≠ Asset Administrator (Assert Administrator). This SQL statement C3 checks whether the applicant in the application form has a portable computer that has been used for less than 33 months. If so, the result is 1; otherwise, the result is 0.

[0278] Therefore, the query result obtained using SQL statement C2 includes fixed asset application form A1. The calculation result of fixed asset application form A1 using SQL statement C3 is 1, indicating that fixed asset application form A1 does not comply with business rule B1. Fixed asset application form A1 is therefore considered suspicious data.

[0279] To summarize, business data can be matched with business policies. If the match fails, it indicates that the business data does not comply with the business policy, and the business data is treated as suspicious data; if the match succeeds, it indicates that the business data complies with the business policy, and the business data is treated as normal data.

[0280] In implementation mode 2 of step S401 , the first supervised classification model is used to implement a classification task with two category labels, and may be a classification algorithm such as a support vector machine, a decision tree, or naive Bayes.

[0281] The first supervised classification model is trained based on normal business data and abnormal business data.

[0282] Specifically, business data with a "normal" label and business data with an "abnormal" label are input into a first supervised classification model to obtain a trained first supervised classification model. This process can refer to the process of inputting data with two class labels into a support vector machine (or decision tree, naive Bayes) to obtain a trained support vector machine (or decision tree, naive Bayes). The normal business data and the abnormal business data can be the normal business data and the abnormal business data in FIG4B .

[0283] Therefore, the business data can be input into the trained first supervised classification model. If the corresponding category of the business data in the trained first supervised classification model is "abnormal", the business data is regarded as suspicious data; if the corresponding category of the business data in the trained first supervised classification model is "normal", the business data is regarded as normal data.

[0284] It should be understood that the implementation methods 1 and 2 for determining suspicious data in step S401 are merely examples and are not specifically limited herein. In practical applications, any implementation method capable of determining whether business data is suspicious data is within the scope of protection of this application.

[0285] S402: When the business data is suspicious data, a first processing method is adopted to obtain a first abnormality cause of the business data.

[0286] In some possible implementations, a first processing method is used to obtain a first abnormality cause of the business data, including: inputting the business data into a trained abnormality recognition model to obtain the first abnormality cause of the business data. This process is described in detail below.

[0287] In Figure 3 above, the anomaly recognition model includes different numbers of unsupervised clustering models and supervised classification models in different scenarios. Below, we use the example of a trained anomaly recognition model that includes one trained unsupervised clustering model and multiple trained supervised classification models to specifically describe the process of inputting business data into the trained anomaly recognition model to obtain the first anomaly cause of the business data. This process includes, but is not limited to, the following steps:

[0288] First, the business data is converted to obtain a vector of the business data. This process is similar to the execution process of step S201 in Figure 3 above, and for the sake of brevity, it will not be further described here.

[0289] Subsequently, the vector of the business data is input into the trained unsupervised clustering model to obtain a first category of the business data. The first category of the business data is the category corresponding to the business data in the trained unsupervised clustering model. Taking the unsupervised clustering model as an example, the process of inputting the vector of the business data into the trained unsupervised clustering model to obtain the first category of the business data can be referred to the process of using the K-means algorithm to classify the input data into corresponding categories. For the sake of brevity, this description will not be elaborated here.

[0290] Next, the business data vector is input into the trained supervised classification model corresponding to the first category to obtain a second category of the business data, and the second category is used as the first abnormality cause. The second category of the business data is the category corresponding to the business data in the trained supervised classification model corresponding to the first category. For example, if the supervised classification model is a decision tree, the process of inputting the business data vector into the trained supervised classification model corresponding to the first category to obtain the second category of the business data can be similar to the process of using a decision tree to classify the input data into corresponding categories. For the sake of brevity, this description will not be elaborated here.

[0291] It should be understood that the above-mentioned calculation of the first abnormal cause of business data using the abnormality recognition model including an unsupervised clustering model and multiple supervised classification models is only an example and is not specifically limited here.

[0292] S403: adopting the second processing method to obtain the abnormal cause chain of the first abnormal cause, and using the abnormal cause chain as the target abnormal cause of the business data.

[0293] In some possible implementations, the second processing method is used to obtain the exception cause chain of the first exception cause, including: matching the first exception cause with the exception cause tree to determine the exception cause chain of the first exception cause. This process is described in detail below.

[0294] Specifically, a string match is performed on the first abnormal cause with the abnormal causes in the abnormal cause tree to determine the number of layers of the first abnormal cause in the abnormal cause tree, the cause of the first abnormal cause in the next layer in the abnormal cause tree is used as the second abnormal cause, the cause of the second abnormal cause in the next layer in the abnormal cause tree is used as the third abnormal cause, and so on, until the nth abnormal cause is at the highest layer of the abnormal cause tree.

[0295] The following uses the label tree in Figure 6 as the exception cause tree and the label L101 in the label tree as an example of the first exception cause to specifically introduce the process of matching the first exception cause with the exception cause tree and determining the exception cause chain of the first exception cause.

[0296] The first abnormality cause is label L101, and therefore is located at layer L1 of the label tree. The cause of the first abnormality cause in the layer below layer L1 (i.e., layer L2) is used as the second abnormality cause, and the second abnormality cause includes labels L201, L202, L203, and L204. The cause of the second abnormality cause in the layer below layer L2 (i.e., layer L3) is used as the third abnormality cause, and the third abnormality cause includes labels L301 and L302. The cause of the third abnormality cause in the layer below layer L3 (i.e., layer L4) is used as the fourth abnormality cause, and the fourth abnormality cause is labeled L401.

[0297] Since the fourth abnormal cause is at the highest level of the label tree, the first abnormal cause, the second abnormal cause, the third abnormal cause and the fourth abnormal cause are integrated in sequence to obtain the abnormal cause chain of the first abnormal cause, specifically: label L101→label L201 / label L202 / label L203 / label L204→label L301 / label L302→label L401.

[0298] Continuing with the label tree in Table 1 as an actual scenario, assuming that label L101 is specifically represented as "accessory missing from account creation" in the label tree in Table 1, the abnormal cause chain of label L101 is specifically represented as: "accessory missing from account creation" → "incomplete account creation" / "inaccurate account creation" → "non-standard account creation process" → "account creation management risk".

[0299] It can be understood that the length of the abnormal cause chain depends on the level of the first abnormal cause in the abnormal cause tree. As the level of the first abnormal cause increases, the length of the abnormal cause chain gradually shortens. When the first abnormal cause is a label in layer L2 of the label tree, the abnormal cause chain only includes the first abnormal cause, the second abnormal cause, and the third abnormal cause. When the first abnormal cause is a label in layer L3 of the label tree, the abnormal cause chain only includes the first abnormal cause and the second abnormal cause. When the first abnormal cause is a label in layer L3 of the label tree, the abnormal cause chain only includes the first abnormal cause.

[0300] In some possible implementations, the number of exception cause chains for the first exception cause is multiple, mainly including the following two situations:

[0301] Case 1: There are multiple first exception causes, and each first exception cause has one exception cause chain, so that there are multiple exception cause chains for the first exception cause.

[0302] Case 2: There is a specified requirement for the exception cause chain, so that the number of exception cause chains for the first exception cause is multiple.

[0303] Case 1 of step S403 exists in a scenario where the abnormality recognition model has one unsupervised clustering model and a scenario where the abnormality recognition model has multiple unsupervised clustering models.

[0304] When the anomaly recognition model has an unsupervised clustering model, the number of anomaly cause chains depends on the number of categories corresponding to the business data in the unsupervised clustering model. Specifically, the business data vector is input into the unsupervised clustering model. Based on the similarity between the business data vector and each category in the unsupervised clustering model, the top K categories with the greatest similarity are selected as the first category of the business data, K∈N+. Therefore, there are K first categories of business data. The business data vector is input into K supervised classification models corresponding to the K first categories respectively, to obtain K second categories of business data (i.e., the first anomaly causes). Since each first anomaly cause has an anomaly cause chain, the first anomaly cause also has K anomaly cause chains.

[0305] When the anomaly recognition model has multiple unsupervised clustering models, the number of anomaly cause chains depends on the number of unsupervised clustering models. Specifically, the vector of business data is input into K unsupervised clustering models to obtain the first category of business data in each unsupervised clustering model, K≥2,K∈N + Therefore, there are K first categories of business data. The business data vectors are input into the K supervised classification models corresponding to the K first categories to obtain K second categories of business data (i.e., first abnormal causes). Since each first abnormal cause has an abnormal cause chain, there are also K abnormal cause chains for the first abnormal cause.

[0306] In case 2 of step S403 , the number of exception cause chains depends on the specific content of the specified requirement.

[0307] For example, when the exception cause chain is required to be the concatenation result of the exception causes, taking label L101 in the label tree in FIG6 as an example of the first exception cause, the second exception cause (including labels L201, L202, L203, and L204), the third exception cause (including labels L301 and L302), and the fourth exception cause (i.e., label L401) can be integrated into eight exception cause chains, including:

[0308] Exception cause chain 1: Label L101 → Label L201 → Label L301 → Label L401.

[0309] Exception cause chain 2: Label L101 → Label L202 → Label L301 → Label L401.

[0310] Exception cause chain 3: Label L101 → Label L203 → Label L301 → Label L401.

[0311] Exception cause chain 4: Label L101 → Label L204 → Label L301 → Label L401.

[0312] Exception cause chain 5: Label L101 → Label L201 → Label L302 → Label L401.

[0313] Exception cause chain 6: Label L101 → Label L202 → Label L302 → Label L401.

[0314] Exception cause chain 7: Label L101 → Label L203 → Label L302 → Label L401.

[0315] Exception cause chain 8: Label L101 → Label L204 → Label L302 → Label L401.

[0316] In some possible implementations, after executing step S403 in FIG. 7 , which matches the first exception cause with the exception cause tree, determines the exception cause chain associated with the first exception cause, and uses the exception cause chain as the target exception cause for the business data, a third processing method is employed to obtain a solution for the target exception cause. This provides users with a reasonable solution, allowing them to quickly eliminate risks associated with abnormal business data after identifying the cause of the abnormality.

[0317] Among them, the process of using the third processing method to obtain the solution to the target abnormality cause can refer to the following implementation methods 1 to 3:

[0318] Implementation method 1: The abnormal causes in the abnormal cause chain (including the first abnormal cause) are input into the second supervised classification model, and the solution corresponding to the abnormal cause is determined according to the classification result.

[0319] Among them, the second supervised classification model is used to implement multi-classification tasks, which can be a classification algorithm such as decision tree, random forest or XGBOOST. The second supervised classification model is obtained by training the cause of the abnormality as training data and the solution as the label of the training data. The training process of the second supervised classification model can refer to the process of inputting data with multiple category labels into a decision tree (or random forest, XGBOOST) to obtain a trained decision tree (or random forest, XGBOOST). Therefore, the above-mentioned process of inputting the cause of the abnormality into the second supervised classification model to determine the solution corresponding to the cause of the abnormality can refer to the process of using a decision tree to classify the input data into corresponding categories. For the sake of brevity of the specification, it will not be elaborated here.

[0320] Implementation method 2: Input the abnormal causes (including the first abnormal cause) in the abnormal cause chain into the knowledge-driven model, and infer the corresponding solutions to the abnormal causes.

[0321] A knowledge-driven model refers to a model constructed using expert knowledge, rules, or prior information. Examples include rule-based models, knowledge bases, and expert systems. Therefore, the aforementioned process of inputting the cause of an anomaly into a knowledge-driven model to infer the corresponding solution can be analogous to the process of obtaining inference results based on input data using a knowledge base. For the sake of brevity, this description will not be elaborated upon here.

[0322] Implementation method 3: Match the abnormal causes (including the first abnormal cause) in the abnormal cause chain with the abnormal operation table, and obtain the solution corresponding to the abnormal cause according to the matching result.

[0323] The exception operation table is used to record the solutions provided by business personnel or domain experts for one or more exception causes. Therefore, the process of matching the exception cause with the exception operation table to obtain the corresponding solution can be similar to the process of searching for a specified item in the table and outputting the relevant data for the specified item. For the sake of brevity, this description will not be further elaborated here.

[0324] It should be understood that the implementation methods 1, 2, and 3 for determining suspicious data in step S403 are merely examples and are not specifically limited herein. In practical applications, any implementation method that can determine a corresponding solution based on the cause of the anomaly is within the scope of protection of this application.

[0325] It should be understood that the anomaly cause identification method in Figure 7 is suitable for scenarios with large amounts of business data. In this method, after acquiring business data, it first determines whether the business data is suspicious data, and then analyzes the anomaly cause for the suspicious data. This allows for preliminary screening of large amounts of business data, effectively reducing the amount of data required for anomaly analysis, thereby reducing the computational complexity of the anomaly identification model and accelerating identification speed.

[0326] For scenarios with a small amount of business data, an embodiment of the present application provides another method for identifying abnormal causes. In this method, after obtaining the business data, the first processing method is directly adopted to obtain the first abnormal cause of the business data, and then the second processing method is adopted to obtain the abnormal cause chain of the first abnormal cause, and the abnormal cause chain is used as the target abnormal cause of the business data. Among them, the process of obtaining the first abnormal cause of the business data using the first processing method can refer to the execution process of step S402 in the aforementioned Figure 7. The process of obtaining the abnormal cause chain of the first abnormal cause using the second processing method can refer to the execution process of step S403 in the aforementioned Figure 7.

[0327] In summary, the implementation of the embodiments of the present application has the following advantages:

[0328] First, this technical solution uses an abnormal cause chain as the target abnormal cause of business data, which can significantly improve the fault tolerance of identifying abnormal causes of business data. This is because the longer the abnormal cause chain, the greater the probability that the abnormal cause chain contains the correct abnormal cause. Therefore, using a longer abnormal cause chain as the target abnormal cause of business data can improve the accuracy of identifying abnormal causes. Specifically, the abnormal cause chain not only includes the first abnormal cause, but also includes the cause of the first abnormal cause - the second abnormal cause, and may even include the cause of the second abnormal cause - the third abnormal cause, and the cause of the third abnormal cause - the fourth abnormal cause... Therefore, when the first abnormal cause is correct, the second abnormal cause, the third abnormal cause, and the fourth abnormal cause are also correct; when the first abnormal cause is incorrect, the second abnormal cause may still be correct. And when the second abnormal cause is incorrect, the third abnormal cause may still be correct.

[0329] For example, the specific example of the abnormal cause chain in the above step S403: "Missing account creation for accessories" → "Incomplete account creation" / "Inaccurate account creation" → "Irregular account creation process" → "Account creation management risk". When it is identified that the abnormal cause of the business data "Missing account creation for accessories" is correct, the other abnormal causes in the abnormal cause chain are also correct, that is, it is reasonable to express the abnormal cause of the business data as "Incomplete account creation", "Inaccurate account creation" or "Irregular account creation process" and so on; and when it is identified that the abnormal cause of the business data "Missing account creation for accessories" is wrong, for example, the correct abnormal cause is "Missing account creation for self-purchased micro-small accessories". Since the reason for "Missing account creation for self-purchased micro-small accessories" is "Incomplete account creation", the abnormal cause chain still contains the correct abnormal cause.

[0330] Therefore, compared with only identifying one abnormal cause of business data, where the correctness of the abnormal cause directly leads to an identification accuracy of only 100% or 0, this technical solution uses the abnormal cause chain as the target abnormal cause of business data, which can significantly improve the fault tolerance of identifying the abnormal cause of business data.

[0331] Secondly, since the abnormal cause chain includes not only multiple abnormal causes but also the causal relationship between these abnormal causes, taking the abnormal cause chain as the target abnormal cause can provide better explainability for subsequent analysis of abnormal situations in business data.

[0332] Third, compared with using a supervised classification model trained based on an unevenly distributed data set to identify the causes of abnormalities in business data, this technical solution uses an anomaly recognition model trained based on a balancedly distributed data set to determine the causes of abnormalities in business data. Since the anomaly recognition model has higher accuracy and precision than the supervised classification model, the correctness of the obtained abnormal causes is also higher.

[0333] Fourthly, this technical solution adopts an anomaly recognition model to identify the abnormal causes of business data, which can realize automatic identification of abnormal causes and improve identification efficiency.

[0334] Fifth, since the abnormal cause tree contains all abnormal causes and the causal relationship between them, this technical solution uses a pre-established abnormal cause tree to match the first abnormal cause. After identifying the first abnormal cause of the business data, the abnormal cause chain of the first abnormal cause can be quickly obtained, thereby improving the identification efficiency.

[0335] The present application also provides an anomaly analysis system comprising an anomaly cause identification system and a risk control platform. The anomaly cause identification system is configured to implement the steps performed by the anomaly cause identification system in the anomaly cause identification method shown in FIG. 2 . The risk control platform is configured to implement the steps performed by the risk control platform in the anomaly cause identification method shown in FIG. 2 .

[0336] The present application also provides a chip system, which includes a processor and a power supply circuit, the power supply circuit is used to power the processor, the processor is used to execute the operation steps performed by the abnormal cause identification system in the abnormal cause identification method of Figure 2, or the processor is used to execute the operation steps corresponding to the training method of the abnormal recognition model of Figure 3, or the processor is used to execute the operation steps corresponding to the generation method of the abnormal cause tree of Figure 5. For the sake of brevity, it will not be repeated here. Among them, the processor can be implemented by a GPU, and can also be implemented by computing devices such as DPU, NPU, XPU, SoC, offload card, and acceleration card.

[0337] Referring to Figure 8 , Figure 8 is a schematic diagram of the structure of a computing device provided in an embodiment of the present application. As shown in Figure 8 , the computing device 800 provided in an embodiment of the present application includes: a bus 801, a processor 802, a memory 803, and a communication interface 804. The processor 802, the memory 803, and the communication interface 804 communicate with each other via bus 801. The computing device 800 can be a server or a terminal device. It should be understood that this application does not limit the number of processors and memories in the computing device 800.

[0338] The bus 801 may be a peripheral component interconnect Express (PCIe) bus or an extended industry standard architecture (EISA) bus, a unified bus (Ubus or UB), a compute express link (CXL), a cache coherent interconnect for accelerators (CCIX), etc. Among them, the unified bus is also called the Lingqu bus. The bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, only one line is used in Figure 8, but it does not mean that there is only one bus or one type of bus. The bus 801 may include a path for transmitting information between various components of the computing device 800 (for example, the memory 803, the processor 802, and the communication interface 804).

[0339] The processor 802 may include any one or more computing devices such as a central processing unit (CPU), a graphics processing unit (GPU), a microprocessor (MP) or a digital signal processor (DSP), an ASIC, an FPGA, a CPLD, an NPU, a SoC, an offload card, an accelerator card, etc.

[0340] The memory 803 may include volatile memory, such as random access memory (RAM). The processor 802 may also include non-volatile memory, such as read-only memory (ROM), flash memory, a hard disk drive (HDD), or a solid state drive (SSD). In addition, the memory 803 may also be implemented by storage class memory (SCM), phase change memory (PCM), or other types of storage media.

[0341] It is worth noting that the same type of storage medium can be configured in the same computing device to implement the function of memory 803, or two or more types of storage media can be configured to implement the function of memory 803. This application does not limit this.

[0342] Memory 803 stores executable program code. Processor 802 executes this executable program code to implement the functions of acquisition unit 310 and transmission unit 350 in abnormality cause identification system 300 shown in FIG1A , FIG1B , or FIG1C , respectively, thereby executing the steps performed by the abnormality cause identification system in the abnormality cause identification method shown in FIG2 . In other words, memory 803 stores instructions for executing the abnormality cause identification method.

[0343] Alternatively, the memory 803 stores executable code, and the processor 802 executes the executable code to implement the functions of the training unit 360 in the abnormality cause identification system 300 in Figure 1A, Figure 1B, or Figure 1C, thereby implementing the training method of the abnormality identification model in Figure 3. In other words, the memory 803 stores instructions for executing the training method of the abnormality identification model.

[0344] Alternatively, the memory 803 stores executable code, and the processor 802 executes the executable code to implement the functions of the generation unit 370 in the abnormality cause identification system 300 shown in FIG. 1A , FIG. 1B , or FIG. 1C , thereby implementing the method for generating the abnormality cause tree shown in FIG. 5 . In other words, the memory 803 stores instructions for executing the method for generating the abnormality cause tree.

[0345] The communication interface 804 uses a transceiver module such as, but not limited to, a network interface card or a transceiver to implement communication between the computing device 800 and other computing devices or a communication network.

[0346] As a possible implementation method, the computing device 800 may also include a chip system, the chip system includes a processor and a power supply circuit, the power supply circuit is used to power the processor, the processor is used to execute the operation steps performed by the abnormal cause identification system in the abnormal cause identification method of Figure 2, or the processor is used to execute the operation steps corresponding to the training method of the abnormal recognition model of Figure 3, or the processor is used to execute the operation steps corresponding to the generation method of the abnormal cause tree of Figure 5. For the sake of brevity, it will not be repeated here. Among them, the processor can be implemented by a GPU, and can also be implemented by computing devices or AI chips such as DPU, NPU, XPU, SoC, offload card, acceleration card, etc.

[0347] As a possible implementation, the computing device 800 may include multiple types of processors 802, that is, the computing device 800 is a heterogeneous device. For example, the computing device 800 includes a CPU and a GPU. At least one of the processors 802 may execute the operation steps performed by the abnormality cause identification system in the abnormality cause identification method of FIG2 , or execute the operation steps corresponding to the training method of the abnormality identification model of FIG3 , or execute the operation steps corresponding to the method for generating the abnormality cause tree of FIG5 . For the sake of brevity, these steps will not be described in detail here.

[0348] Referring to Figure 9, Figure 9 is a schematic diagram of the structure of a computing device cluster provided in an embodiment of the present application. The computing device cluster provided in an embodiment of the present application includes at least one computing device. The computing device can be a server, such as a central server, an edge server, or a local server in a local data center. In some embodiments, the computing device can also be a terminal device such as a desktop computer, a laptop computer, or a smartphone.

[0349] As shown in FIG9 , the computing device cluster includes at least one computing device 800. The memory 803 in one or more computing devices 800 in the computing device cluster may store the same instructions for executing the steps performed by the abnormality cause identification system in the abnormality cause identification method of FIG2 , or instructions for executing the abnormality identification model training method of FIG3 , or instructions for executing the abnormality cause tree generation method of FIG5 , or instructions for executing the abnormality cause identification method of FIG7 .

[0350] In some possible implementations, the memory 803 of one or more computing devices 800 in the computing device cluster may also respectively store partial instructions for executing the steps executed by the abnormal cause identification system in the abnormal cause identification method of FIG. 2 , or partial instructions for executing the method for training the abnormality identification model of FIG. 3 , or partial instructions for executing the method for generating the abnormal cause tree of FIG. 5 , or partial instructions for executing the method for identifying the abnormal cause of FIG. 7 . In other words, the combination of one or more computing devices 800 may jointly execute instructions for executing the steps executed by the abnormal cause identification system in the abnormal cause identification method of FIG. 2 , or instructions for executing the method for training the abnormality identification model of FIG. 3 , or instructions for executing the method for generating the abnormal cause tree of FIG. 5 , or instructions for executing the method for identifying the abnormal cause of FIG. 7 .

[0351] It should be noted that the memory 803 in different computing devices 800 in the computing device cluster can store different instructions, each for executing part of the functions of the abnormality cause identification system 300 in Figure 1A, Figure 1B, or Figure 1C. That is, the instructions stored in the memory 803 in different computing devices 800 can implement the functions of one or more of the acquisition unit 310, screening unit 320, first processing unit 330, second processing unit 340, sending unit 350, training unit 360, and generation unit 370.

[0352] Referring to Figure 10, Figure 10 is a schematic diagram of the structure of another computing device cluster provided in an embodiment of the present application. In some possible implementations, one or more computing devices in the computing device cluster can be connected via a network. The network can be a wide area network or a local area network, etc. As shown in Figure 10, two computing devices 800A and 800B are connected via a network. Specifically, they are connected to the network through a communication interface in each computing device. In this type of possible implementation, the memory 803 in the computing device 800A stores instructions for executing the functions of the acquisition unit 310. At the same time, the memory 803 in the computing device 800B stores instructions for executing the functions of the sending unit 350.

[0353] The connection method between the computing device clusters shown in Figure 10 can be considered to be that the abnormal cause identification method provided in this application needs to receive a large amount of business data, so it is considered to hand over the functions implemented by the acquisition unit 310 to the computing device 800A for execution.

[0354] It should be understood that the functionality of the computing device 800A shown in FIG10 may also be implemented by multiple computing devices 800. Similarly, the functionality of the computing device 800B may also be implemented by multiple computing devices 800.

[0355] The embodiment of the present application also provides another computing device cluster. The connection relationship between the computing devices in the computing device cluster can be similar to the connection method of the computing device cluster described in Figures 9 and 10. The difference is that the memory 803 in one or more computing devices 800 in the computing device cluster can store the same instructions for executing the steps performed by the abnormal cause identification system in the abnormal cause identification method of Figure 2, or instructions for executing the training method of the abnormal recognition model of Figure 3, or instructions for executing the generation method of the abnormal cause tree of Figure 5, or instructions for executing the abnormal cause identification method of Figure 7.

[0356] In some possible implementations, the memory 803 of one or more computing devices 800 in the computing device cluster may also respectively store partial instructions for executing the steps executed by the abnormal cause identification system in the abnormal cause identification method of FIG. 2 , or partial instructions for executing the method for training the abnormality identification model of FIG. 3 , or partial instructions for executing the method for generating the abnormal cause tree of FIG. 5 , or partial instructions for executing the method for identifying the abnormal cause of FIG. 7 . In other words, the combination of one or more computing devices 800 may jointly execute instructions for executing the steps executed by the abnormal cause identification system in the abnormal cause identification method of FIG. 2 , or instructions for executing the method for training the abnormality identification model of FIG. 3 , or instructions for executing the method for generating the abnormal cause tree of FIG. 5 , or instructions for executing the method for identifying the abnormal cause of FIG. 7 .

[0357] It should be noted that the memory 803 in different computing devices 800 in the computing device cluster can store different instructions, each for executing part of the functions of the abnormality cause identification system 300 in Figure 1A, Figure 1B, or Figure 1C. That is, the instructions stored in the memory 803 in different computing devices 800 can implement the functions of one or more of the acquisition unit 310, screening unit 320, first processing unit 330, second processing unit 340, sending unit 350, training unit 360, and generation unit 370.

[0358] The embodiment of the present application also provides a computer program product comprising instructions. The computer program product may be software or a program product comprising instructions that can be run on a computing device or stored in any available medium. When the computer program product is run on at least one computing device, the at least one computing device executes the steps performed by the abnormal cause identification system in the abnormal cause identification method of FIG2 , or executes the training method of the abnormal recognition model of FIG3 , or executes the generation method of the abnormal cause tree of FIG5 , or executes the abnormal cause identification method of FIG7 .

[0359] The embodiment of the present application also provides a computer-readable storage medium. The computer-readable storage medium can be any available medium that can be stored by the computing device or a data storage device such as a data center containing one or more available media. The available medium can be a magnetic medium (for example, a floppy disk, a hard disk, a tape), an optical medium (for example, a DVD), or a semiconductor medium (for example, a solid-state hard disk), etc. The computer-readable storage medium includes instructions that instruct the computing device to execute the steps performed by the abnormal cause identification system in the abnormal cause identification method of Figure 2, or to execute the training method of the abnormal recognition model of Figure 3, or to execute the generation method of the abnormal cause tree of Figure 5, or to execute the abnormal cause identification method of Figure 7.

[0360] It should be understood that in the embodiments of the present application, "when...", "when..." and "if" all mean that the device will perform corresponding processing under certain objective circumstances, and do not limit the time. It does not require that the device must perform a judgment action when it is implemented, nor does it mean that there are other limitations.

[0361] It should be understood that in the embodiments of the present application, "simultaneously" does not necessarily strictly require that it occurs at the same time, minute, second, or even at the same moment. When the moments of occurrence are slightly different, it can also be understood as occurring "simultaneously."

[0362] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the protection scope of the technical solutions of the various embodiments of the present invention.

Claims

1. A method for identifying abnormal causes, characterized in that: The method comprises: Acquiring business data, wherein the business data is data generated by the business system when managing the business; Output the target exception cause of the business data, wherein the target exception cause is used to indicate problems existing in the business process of the business system managing the business, and the target exception cause is an exception cause chain, and the exception cause chain includes a first exception cause and a second exception cause, and the second exception cause is the cause of the first exception cause.

2. The method according to claim 1, characterized in that The business data is suspicious data, which is business data that does not comply with business policies, wherein the business policies are rules, guiding principles and constraints for operating and making decisions on the business, including one or more of regulations, processes, standards and requirements.

3. The method according to claim 1 or 2, characterized in that Before outputting the target abnormality cause of the business data, the method further includes: Using a first processing method to obtain the first abnormality cause; A second processing method is adopted to obtain the abnormal cause chain including the first abnormal cause, and the abnormal cause chain is used as the target abnormal cause, wherein the first processing method and the second processing method are different.

4. The method according to claim 3, characterized in that The first processing method is an anomaly identification model, which includes an unsupervised clustering model and a supervised classification model. The number of categories in the unsupervised clustering model is equal to the number of the supervised classification model. The first processing method is used to obtain the first anomaly cause of the business data, including: Inputting the business data into the unsupervised clustering model to obtain a first category of the business data, wherein the first category belongs to a category in the unsupervised clustering model; The business data is input into the supervised classification model corresponding to the first category to obtain a second category of the business data, and the second category is used as the first abnormality cause.

5. The method according to claim 4, characterized in that The training samples of the supervised classification model are obtained by oversampling or undersampling the business data under the same category in the unsupervised clustering model.

6. The method according to claim 4 or 5, characterized in that The training samples of the supervised classification model have labels, where the labels indicate abnormal causes, and the labels are obtained by merging multiple abnormal causes with similar semantics.

7. The method according to any one of claims 3 to 6, characterized in that: The second processing method is an exception cause tree, where the exception cause tree is used to indicate a causal relationship between multiple exception causes, where the multiple exception causes include the first exception cause and the second exception cause, and the causal relationship between the multiple exception causes includes a causal relationship between the first exception cause and the second exception cause. The second processing method is used to obtain the exception cause chain including the first exception cause, including: The first abnormality cause is matched with the abnormality cause tree to determine an abnormality cause chain of the first abnormality cause.

8. The method according to claim 7, characterized in that The multiple abnormal causes include existing abnormal causes and new abnormal causes, wherein the existing abnormal causes are labels of training samples of a supervised classification model, and the new abnormal causes are texts generated by a large language model that have a causal relationship with the existing abnormal causes.

9. The method according to any one of claims 1 to 8, characterized in that The method further comprises: The third processing method is used to obtain a solution to the cause of the target abnormality.

10. An abnormality cause identification system, characterized in that: include: Acquisition unit and sending unit, The acquisition unit is used to acquire business data, wherein the business data is data generated by the business system when managing the business; The sending unit is used to output the target exception cause of the business data, wherein the target exception cause is used to indicate a problem existing in the business process of the business system managing the business, the target exception cause is an exception cause chain, and the exception cause chain includes a first exception cause and a second exception cause, and the second exception cause is the cause of the first exception cause.

11. The system according to claim 10, wherein: The business data is suspicious data, which is business data that does not comply with business policies, wherein the business policies are rules, guiding principles and constraints for operating and making decisions on the business, including one or more of regulations, processes, standards and requirements.

12. The system according to claim 10 or 11, characterized in that The system further includes: a first processing unit and a second processing unit, The first processing unit is configured to obtain the first abnormality cause by adopting a first processing method; The second processing unit is configured to adopt a second processing method to obtain the abnormality cause chain including the first abnormality cause, and use the abnormality cause chain as the target abnormality cause, wherein the first processing method and the second processing method are different.

13. The system according to claim 12, wherein: The first processing method is an anomaly recognition model, which includes an unsupervised clustering model and a supervised classification model. The number of categories in the unsupervised clustering model is equal to the number of categories in the supervised classification model. The first processing unit is specifically used to input the business data into the unsupervised clustering model to obtain a first category of the business data, input the business data into the supervised classification model corresponding to the first category to obtain a second category of the business data, and use the second category as the first abnormality cause, wherein the first category belongs to a category in the unsupervised clustering model.

14. The system according to claim 13, wherein: The training samples of the supervised classification model are obtained by oversampling or undersampling the business data under the same category in the unsupervised clustering model.

15. The system according to claim 14, wherein: The training sample has a label, where the label indicates an abnormality cause, and the label is obtained by merging multiple abnormality causes with similar semantics.

16. The system according to any one of claims 12 to 15, characterized in that: The second processing method is an abnormality cause tree, wherein the abnormality cause tree is used to indicate a causal relationship between multiple abnormal causes, wherein the multiple abnormal causes include the first abnormal cause and the second abnormal cause, and the causal relationship between the multiple abnormal causes includes a causal relationship between the first abnormal cause and the second abnormal cause. The second processing unit is specifically configured to match the first abnormality cause with the abnormality cause tree to determine an abnormality cause chain of the first abnormality cause.

17. The system according to claim 16, wherein: The multiple abnormal causes include existing abnormal causes and new abnormal causes, wherein the existing abnormal causes are labels of training samples of a supervised classification model, and the new abnormal causes are texts generated by a large language model that have a causal relationship with the existing abnormal causes.

18. The system according to any one of claims 10 to 17, characterized in that The second processing unit is further configured to adopt a third processing method to obtain a solution to the cause of the target abnormality.

19. An abnormality analysis system, characterized in that: include: Abnormal cause identification system and risk control platform, The abnormality cause identification system is used to perform the method described in any one of claims 1 to 9; The risk control platform is used to receive target abnormal causes of business data from the abnormal cause identification system, and output the correct abnormal cause among the target abnormal causes.

20. A chip system, characterized in that: The chip system includes a processor and a power supply circuit, wherein the power supply circuit is used to supply power to the processor, and the processor is used to execute the operating steps of any one of the methods described in claims 1 to 9.

21. A computing device, characterized in that The method comprises a processor and a memory, wherein the memory is used to store instructions, and the processor is used to execute the instructions. When the processor executes the instructions, the method according to any one of claims 1 to 9 is implemented.

22. A computing device cluster, characterized in that: The method comprises at least one computing device, each computing device comprising a processor and a memory; the processor of the at least one computing device is used to execute instructions stored in the memory of the at least one computing device, so that the computing device cluster executes the method according to any one of claims 1 to 9.

23. A computer program product comprising instructions, characterized in that When the instructions are executed by a computing device, the computing device is caused to perform the method according to any one of claims 1 to 9.

24. A computer-readable storage medium, characterized in that The method comprises computer program instructions, and when the computer program instructions are executed by a computing device, the computing device performs the method according to any one of claims 1 to 9.

Images