Data processing method and apparatus, electronic device, and storage medium

Abstract

Disclosed in the present invention are a data processing method and apparatus, an electronic device, and a storage medium. The method comprises: constructing a graph association structure in which transaction parties in a target service scene serve as nodes and association relationships among the transaction parties serve as edges; on the basis of service information of the transaction parties indicated by the nodes in the graph association structure, the association relationships among the transaction parties, and a preset anomaly analysis rule, determining anomaly values corresponding to the nodes, wherein each anomaly value is used for indicating the abnormal fluctuation degree of transaction of the transaction party indicated by one node, and the abnormal fluctuation degree is determined on the basis of the service information of the transaction party and service information of other transaction parties having association relationships with the transaction party; and when an anomaly value corresponding to a first node is greater than a preset threshold, determining that the first node is an abnormal node, and determining the transaction party indicated by the first node as an abnormal transaction party. Anomaly values are determined by using a graph association structure in combination with a plurality of factors so as to determine the comparison result, so that abnormal nodes can be quickly and accurately determined.

Description

Data processing method and device, electronic device and storage medium

[0001] Cross-reference to related applications

[0002] The present application claims priority to the Chinese patent application No. 202410432948.8, filed on April 10, 2024, and entitled "A data processing method, device, electronic device and storage medium", the whole content of which is incorporated herein by reference. TECHNICAL FIELD

[0003] The present application relates to the technical field of computer, and in particular to a data processing method, device, electronic device and storage medium. BACKGROUND

[0004] At present, in a huge transaction network, a large amount of transaction data and complex transaction behavior relationships composed of transaction subjects will be generated every day. Therefore, when there is a sudden change such as a sudden decrease in the number of transactions in the transaction data, it is necessary to determine the transaction subject that may have the abnormal performance, and take the transaction subject as an abnormal transaction subject to be optimized, so as to adjust and optimize the specific business strategy of the abnormal transaction subject, and ensure the normal operation of the transaction network.

[0005] Therefore, how to determine the abnormal transaction subject to be optimized has become a technical problem to be solved. SUMMARY

[0006] The present application provides a data processing method, device, electronic device and storage medium, so that the efficiency and accuracy of the method for determining the abnormal transaction subject to be optimized are higher.

[0007] In a first aspect, the present application provides a data processing method, which comprises:

[0008] Constructing a graph association structure taking the transaction subjects in a target business scenario as nodes and the association relationships between the transaction subjects as edges;

[0009] Determining an abnormal value corresponding to each node based on the business information of the transaction subject indicated by each node in the graph association structure, the association relationship between the transaction subjects and a preset abnormal analysis rule; wherein each abnormal value is used to indicate the abnormal fluctuation degree of the transaction subject indicated by a node; the abnormal fluctuation degree is determined based on the business information of the transaction subject and the business information of other transaction subjects having an association relationship with the transaction subject;

[0010] When the abnormal value corresponding to the first node is greater than a preset threshold value, determining that the first node is an abnormal node, and determining the transaction subject indicated by the first node as an abnormal transaction subject.

[0011] In a possible implementation, the abnormality value corresponding to each node is determined based on the business information of the transaction subject indicated by each node in the graph association structure, the association relationship between the transaction subjects, and a preset abnormality analysis rule.

[0012] The fluctuation value of each node is determined based on the business information of the transaction subject indicated by each node in the graph association structure and a first sub-rule in the preset abnormality analysis rule, respectively. The first sub-rule is used for magnitude normalization processing on the initial fluctuation value of a node obtained based on business information of different magnitudes.

[0013] The influence value of the business information of each node affected by other nodes is determined based on the association relationship between the transaction subjects and a second sub-rule in the preset abnormality analysis rule, respectively. The second sub-rule is used for calculating the degree of influence of a lower node affected by the fluctuation of an upper node, the lower node and the upper node being determined based on the association relationship between the transaction subjects.

[0014] The abnormality value corresponding to each node is determined according to the fluctuation value and the corresponding influence value of each node.

[0015] In a possible implementation, the fluctuation value of each node is determined based on the business information of the transaction subject indicated by each node in the graph association structure and a first sub-rule in the preset abnormality analysis rule, respectively.

[0016] The business information of the transaction subject indicated by each node is input into a preset time sequence attribution model, respectively, to obtain the initial fluctuation value corresponding to each node output by the preset time sequence attribution model. The preset time sequence attribution model determines the initial fluctuation value of a transaction subject based on the business information of the transaction subject within a preset time period and a preset magnitude fluctuation evaluation rule. The preset magnitude fluctuation evaluation rule includes a plurality of mapping relationships, different mapping relationships include a numerical range corresponding to business information of different magnitudes, and an initial fluctuation value corresponding to the numerical range.

[0017] The initial fluctuation value corresponding to each transaction subject is normalized to obtain the fluctuation value of each node. In a possible implementation, the normalization is implemented based on the following manner:

[0018] wherein, S i represents the fluctuation value of a node, r i represents the initial fluctuation value corresponding to a node, and K is used to represent the total number of nodes in the graph association structure.

[0019] In a possible implementation, the second sub-rule is determined based on the following formula:

[0020] wherein ep ij represents an influence value of node i relative to node j, Δi represents a change value of the business information value of node i between two time points, Δj represents a change value of the business information value of node j between two time points, ep it represents the business information value of node i at time t, ep it’ represents the business information value of node i at time t', ep jt represents the business information value of node j at time t, ep jt’ represents the business information value of node j at time t', and node i and node j are any nodes in the graph association structure.

[0021] In a possible implementation, the abnormal change value corresponding to each node is determined according to the fluctuation value and the corresponding influence value of each node, and includes the following steps.

[0022] An influence value of an associated node associated with the node is taken as a matrix factor to construct an initial abnormal change iteration matrix.

[0023] The fluctuation value of each node is substituted into a third sub-rule of the preset abnormal change analysis rule according to the initial abnormal change iteration matrix and the fluctuation value of each node, and the abnormal change value corresponding to each node is determined respectively; the third sub-rule is used to iteratively optimize the fluctuation value of the node in combination with the influence values corresponding to all nodes associated with the node.

[0024] In a possible implementation, the third sub-rule is determined based on the following formula: H n ← θH n-1 + d

[0025] wherein H n represents a set of abnormal change values of all nodes, and n is used to represent the number of iterations, when n is equal to 1, H 1 ← θS' + d, S' represents a set of fluctuation values of all nodes, ep ij represents an influence value of node i relative to node j, node i and node j are any nodes in the graph association structure, S k represents the fluctuation value of node k, d is a non-zero adjustment coefficient, and i and j are positive integers.

[0026] In a possible implementation, after the first node is determined as an abnormal change node, the method further includes the following steps.

[0027] Screening a candidate path including the first node based on the graph association structure, taking the candidate path as a transaction path;

[0028] Analyzing the transaction path to obtain a transaction analysis result; the transaction analysis result is used to indicate an influence node associated with the transaction node, and to optimize a business of a transaction subject corresponding to the influence node based on business information of the transaction node.

[0029] In a second aspect, an embodiment of the present application provides a data processing apparatus, and the apparatus comprises:

[0030] A construction unit configured to construct a graph association structure taking a transaction subject in a target business scenario as a node and an association relationship between the transaction subjects as an edge;

[0031] A determination unit configured to determine a transaction value corresponding to each node based on business information of a transaction subject indicated by each node in the graph association structure, the association relationship between the transaction subjects, and a preset transaction analysis rule; wherein each transaction value is used to indicate an abnormal fluctuation degree of a transaction of a transaction subject indicated by a node; the abnormal fluctuation degree is determined based on the business information of the transaction subject and business information of other transaction subjects having an association relationship with the transaction subject;

[0032] A processing unit configured to determine that a first node is a transaction node when a transaction value corresponding to the first node is greater than a preset threshold, and to determine a transaction subject indicated by the first node as a transaction transaction subject.

[0033] In a possible implementation, the determination unit is specifically configured to:

[0034] Determine a fluctuation value of each node based on business information of a transaction subject indicated by each node in the graph association structure and a first sub-rule in the preset transaction analysis rule; the first sub-rule is used to perform magnitude normalization processing on an initial fluctuation value of a node obtained based on business information of different magnitudes;

[0035] Determine an influence value of the business information of each node affected by other nodes based on the association relationship between the transaction subjects and a second sub-rule in the preset transaction analysis rule; the second sub-rule is used to calculate a degree of influence of a lower node affected by fluctuation of an upper node, the lower node and the upper node being determined based on the association relationship between the transaction subjects;

[0036] Determine a transaction value corresponding to each node according to the fluctuation value of each node and the corresponding influence value.

[0037] In a possible implementation, the determination unit is specifically configured to:

[0038] inputting the business information of a transaction subject indicated by each of the nodes into a preset time sequence attribution model to obtain an initial fluctuation value corresponding to each of the nodes output by the preset time sequence attribution model; the preset time sequence attribution model determines the initial fluctuation value of a transaction subject based on the business information of the transaction subject within a preset time period and a preset magnitude fluctuation evaluation rule; the preset magnitude fluctuation evaluation rule includes a plurality of mapping relationships, different mapping relationships include a numerical range corresponding to different magnitudes of business information, and an initial fluctuation value corresponding to the numerical range;

[0039] normalizing the initial fluctuation value corresponding to each of the transaction subjects to obtain the fluctuation value of each of the nodes. In a possible implementation, the normalization is implemented based on the following manner:

[0040] wherein, S i represents the fluctuation value of a node, r i represents the initial fluctuation value corresponding to the node, and K represents the total number of nodes in the graph association structure.

[0041] In a possible implementation, the second sub-rule is determined based on the following formula:

[0042] wherein, ep ij represents the influence value of node i relative to node j, Δi represents the change value of the business information value of node i between two time points, Δj represents the change value of the business information value of node j between two time points, e it represents the business information value of node i at time t, e it’ represents the business information value of node i at time t', e jt represents the business information value of node j at time t, e jt’ represents the business information value of node j at time t', and node i and node j are any nodes in the graph association structure.

[0043] In a possible implementation, the determination unit is specifically configured to:

[0044] construct an initial abnormal iteration matrix by taking the influence value of an associated node associated with one of the nodes as a matrix factor;

[0045] determine the abnormal value corresponding to each of the nodes respectively by substituting the initial abnormal iteration matrix and the fluctuation value corresponding to each of the nodes into a third sub-rule of the preset abnormal analysis rule; the third sub-rule is used to iteratively optimize the fluctuation value of a node in combination with the influence values corresponding to all nodes associated with the node.

[0046] In a possible implementation, the third sub-rule is determined based on the following formula: H n ← θH n-1 + d

[0047] wherein H n represents a set of fluctuation values of all nodes, n is used to represent the iteration round, when n is equal to 1, H 1 ← θS' + d, S' represents a set of fluctuation values of all nodes, ep ij represents an influence value of node i relative to node j, node i and node j are any nodes in the graph association structure, S k represents a fluctuation value of node k, d is a non-zero adjustment coefficient, i and j are positive integers.

[0048] In a possible implementation, after determining that the first node is a fluctuation node, the apparatus further includes an optimization unit configured to:

[0049] filtering a candidate path including the first node based on the graph association structure, and taking the candidate path as a fluctuation path;

[0050] analyzing the fluctuation path to obtain a fluctuation analysis result, wherein the fluctuation analysis result is used to indicate an influence node associated with the fluctuation node, and the fluctuation analysis result is used to optimize a business of a transaction subject corresponding to the influence node based on business information corresponding to the fluctuation node.

[0051] In a third aspect, an electronic device is provided, including at least one processor, and a memory connected with the at least one processor in communication; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to execute any method provided in the first aspect of the present application.

[0052] In a fourth aspect, a computer storage medium is provided, wherein the computer readable storage medium stores a computer program, and the computer program is used to enable a computer to execute any method provided in the first aspect of the present application.

[0053] In a fifth aspect, a computer program product is provided, and the computer program product includes computer program code, when the computer program code is executed on a computer, the computer program code enables the computer to execute any method provided in the first aspect of the present application.

[0054] The present application has the following advantages:

[0055] In the embodiment of the present application, a graph association structure can be constructed, taking transaction subjects in a target business scenario as nodes and the association relationship between the transaction subjects as edges. Further, based on the business information of the transaction subject indicated by each node in the graph association structure, the association relationship between the transaction subjects and a preset abnormal fluctuation analysis rule, the abnormal fluctuation value corresponding to each node is determined. Each abnormal fluctuation value is used to indicate the abnormal fluctuation degree of the transaction subject indicated by a node. The abnormal fluctuation degree is determined based on the business information of the transaction subject and the business information of other transaction subjects having an association relationship with the transaction subject. It can be seen that in the embodiment of the present application, the abnormal fluctuation value corresponding to the node is determined from the perspective of the graph association structure, and the determination of the abnormal fluctuation value takes into account both the business information of the transaction subject and the business information of other transaction subjects having an association relationship with the transaction subject, thereby improving the accuracy of the attribution analysis of the abnormal fluctuation performance. In this way, when the abnormal fluctuation value corresponding to the first node is greater than a preset threshold, the first node is determined as an abnormal fluctuation node, and the transaction subject indicated by the first node is determined as an abnormal fluctuation transaction subject, so that the abnormal fluctuation transaction subject causing the abnormal fluctuation matter can be accurately and efficiently determined.

[0056] Other features and advantages of the present application will be set forth in the following description, and in part will become apparent to those skilled in the art from the description, or can be learned by practice of the present application. The objects and other advantages of the present application can be achieved and obtained by means of the structures particularly pointed out in the written description, claims, and accompanying drawings. BRIEF DESCRIPTION OF DRAWINGS

[0057] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the related art, the drawings needed to be used in the embodiments or the related art description will be briefly introduced below. Obviously, the drawings in the following description are only some embodiments of the present application, and those skilled in the art can also obtain other drawings according to the provided drawings without any creative labor.

[0058] FIG. 1 is an optional schematic diagram of an application scenario in an embodiment of the present application;

[0059] FIG. 2 is an optional schematic diagram of an application scenario in an embodiment of the present application;

[0060] FIG. 3 is a flow diagram of a data processing method in an embodiment of the present application;

[0061] FIG. 4 is a schematic diagram of a graph association structure in an embodiment of the present application;

[0062] FIG. 5 is a schematic diagram of a fluctuation value of a node in a graph association structure in an embodiment of the present application;

[0063] FIG. 6 is a schematic diagram of an influence value of a node in a graph association structure in an embodiment of the present application;

[0064] Fig. 7 is a diagram of a transaction value corresponding to a computing node in an embodiment of the present application;

[0065] Fig. 8 is a diagram of a transaction path in an embodiment of the present application;

[0066] Fig. 9 is a diagram of a structure of a data processing apparatus in an embodiment of the present application;

[0067] Fig. 10 is a diagram of a structure of an electronic device in an embodiment of the present application;

[0068] Fig. 11 is a diagram of another structure of an electronic device in an embodiment of the present application. DETAILED DESCRIPTION

[0069] In order to make the objects, technical solutions and advantages of the present application clearer, the technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only some of the embodiments of the present application, but not all the embodiments. Based on the embodiments in the present application, all the other embodiments obtained by those of ordinary skill in the art without creative work fall within the scope of protection of the present application. The embodiments in the present application and the features in the embodiments can be combined with each other arbitrarily without conflict. Moreover, although the logical order is shown in the flowchart, in some cases, the steps shown or described can be performed in an order different from that here.

[0070] The terms in the specification and claims of the present application and the above-described drawings, the first, the second, etc. are used to distinguish similar objects, and do not have to be used to describe a specific order or sequence. It should be understood that the data used in this way can be exchanged under appropriate circumstances, so that the embodiments of the present application described herein can be implemented in an order other than that illustrated or described herein.

[0071] The word "exemplary" used in the present application means "serving as an example, an implementation, or an illustration". Any embodiment described as "exemplary" is not necessarily to be construed as superior or better than other embodiments.

[0072] Exemplary embodiments of the present application are described herein with reference to the accompanying drawings, which are meant to be exemplary in nature, and include various specific details to facilitate understanding, and should not be considered limiting. Therefore, one of ordinary skill in the art will appreciate that various changes and modifications can be made to the embodiments described herein without departing from the scope of the present application. Also, for the sake of brevity and clarity, descriptions of well-known functions and constructions are omitted herein. It should be noted that, in the embodiments of the present application, some software, components, models and the like that are available in the industry can be mentioned, which should be considered as exemplary, and the purpose is only to illustrate the feasibility in the implementation of the technical solutions of the present application, but does not mean that the applicant has or must have used the scheme.

[0073] In the technical solutions of the present application, the collection, transmission and use of data comply with the requirements of relevant national laws and regulations.

[0074] At present, as described above, how to determine the transaction subject to be optimized has become a technical problem to be solved.

[0075] In view of this, the embodiments of the present application provide a data processing method, by which a graph association structure with transaction subjects in a target business scenario as nodes and association relationships between the transaction subjects as edges can be constructed. Further, based on the business information of the transaction subjects indicated by each node in the graph association structure, the association relationships between the transaction subjects and a preset abnormal transaction analysis rule, an abnormal transaction value corresponding to each node is determined. Each abnormal transaction value is used to indicate the abnormal fluctuation degree of the transaction of the transaction subject indicated by a node. The abnormal fluctuation degree is determined based on the business information of the transaction subject and the business information of other transaction subjects having an association relationship with the transaction subject. It can be seen that in the embodiments of the present application, the abnormal transaction value corresponding to the node is determined from the perspective of the graph association structure, and the determination of the abnormal transaction value takes into account both the business information of the transaction subject and the business information of other transaction subjects having an association relationship with the transaction subject, thereby improving the accuracy of the attribution analysis of abnormal performance. In this way, when the abnormal transaction value corresponding to the first node is greater than a preset threshold, the first node is determined as an abnormal node, and the transaction subject indicated by the first node is determined as an abnormal transaction subject, so that the abnormal transaction subject causing the abnormal transaction can be accurately and efficiently determined.

[0076] After introducing the design idea of the embodiments of the present application, the application scenarios to which the technical solutions of the embodiments of the present application can be applied are briefly introduced. It should be noted that the application scenarios introduced below are only used to illustrate the embodiments of the present application and are not limiting. In the specific implementation process, the technical solutions provided by the embodiments of the present application can be flexibly applied according to actual needs.

[0077] In the embodiments of the present application, the data processing method provided by the embodiments of the present application can be applied to any business scenario that needs to perform transaction attribution analysis, for example, a business scenario of performing transaction attribution analysis on each functional module in the software system of the A business, a business scenario of performing transaction attribution analysis on each functional unit in the network platform, and the like, for example, a business scenario of performing transaction attribution analysis on each subject in the payment system in the financial field, a business scenario of performing transaction attribution analysis on each subject in the lending system in the financial field, a business scenario of performing transaction attribution analysis on each subject in the manufacturing system in the manufacturing field, a business scenario of performing transaction attribution analysis on each subject in the enterprise management system in the management field, and the like, which are not limited in the embodiments of the present application.

[0078] Please refer to FIG. 1, which is an application scenario to which the technical solution of the embodiments of the present application can be applied. In the scenario diagram, it includes devices 101 corresponding to a plurality of acquirers, devices 102 corresponding to a plurality of payment subsidiaries, a device 103 corresponding to a payment parent company, and a device 104 corresponding to an analysis system for performing transaction attribution analysis on the payment system. It should be noted that the acquirers, the payment subsidiaries, and the payment parent company can all be referred to as transaction subjects.

[0079] Each device 104 corresponding to an analysis system can include one or more processors 1041, memories 1042, and I / O interfaces 1043 for interacting with the device, and the like. In addition, the devices 101, 102, 103, and 104 can be directly or indirectly connected through one or more networks 105.

[0080] It should be noted that in the embodiments of the present application, the objects 1, 2, …, n, n being a positive integer, of the devices 101-1, 101-2, …, 101-n can simultaneously initiate payment transactions, of course, the object 1 can initiate a transaction first, and the object 2 can initiate a transaction later, which is not limited in the embodiments of the present application, so that the analysis system can receive a large number of concurrent payment transaction data and perform transaction attribution analysis on the payment transaction data, that is, determine whether there is a transaction performance in the payment transaction data. The specific scheme of performing transaction attribution analysis on the payment transaction data can be referred to the data processing method provided by the embodiments of the present application, which will be described in detail below, and will not be repeated here.

[0081] For example, referring to FIG. 2, another application scenario to which the technical solution of the embodiment of the present application can be applied is shown in the scenario diagram, which includes devices 201 corresponding to a plurality of selling institutions, devices 202 corresponding to a plurality of manufacturing subsidiaries, a device 203 corresponding to a manufacturing general company, and a device 104 corresponding to an analysis system for transaction attribution analysis of the selling system. It should be noted that the selling institutions, the manufacturing subsidiaries, and the manufacturing general company can be referred to as transaction subjects.

[0082] Each device 104 corresponding to an analysis system can include one or more processors 1041, memories 1042, and I / O interfaces 1043 for interacting with devices, etc. In addition, the devices 201, 202, 203, and 104 can be directly or indirectly connected through one or more networks 105.

[0083] It should be noted that in the embodiment of the present application, the selling institutions 1, 2, …, n, n being a positive integer, using the devices 201-1, 201-2, …, 201-n, can simultaneously initiate selling transactions, of course, the selling institution 1 can initiate a selling transaction first, and the selling institution 2 can initiate a selling transaction, which is not limited in the embodiment of the present application, so that the analysis system can receive a large number of concurrent selling transaction data and perform transaction attribution analysis on the selling transaction data, i.e., determine whether there is a transaction performance in the selling transaction data. The specific solution for transaction attribution analysis of the selling transaction data can refer to the data processing method provided by the embodiment of the present application, which will be described in detail below, and will not be repeated here.

[0084] Each device in FIGS. 1 and 2 can be a mobile phone, a tablet computer (PAD), a personal computer (PC), a smart television, a smart watch, a smart speaker, a smart vehicle device, and a wearable device, but is not limited thereto. These devices can have the function of logging in and using a learning website.

[0085] In addition, the devices in FIGS. 1 and 2 can be independent physical servers, a server cluster or a distributed system composed of a plurality of physical servers, or a cloud server providing cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, content distribution networks (CDNs), and basic cloud computing services such as big data and artificial intelligence platforms, but are not limited thereto.

[0086] The network 105 can be a wired network or a wireless network. For example, the wireless network can be a mobile cellular network or a wireless fidelity (WiFi) network. Of course, the network 105 can also be another possible network, and the embodiments of the present application do not make any limitation in this regard.

[0087] Of course, the method provided by the embodiments of the present application is not limited to the application scenarios shown in FIG. 1 and FIG. 2, and can also be applied to other possible application scenarios, and the embodiments of the present application do not make any limitation in this regard.

[0088] To further illustrate the technical solutions provided by the embodiments of the present application, the following will describe the technical solutions in detail with reference to the accompanying drawings and specific embodiments. Although the embodiments of the present application provide the following method operation steps, more or fewer operation steps can be included in the method based on conventional or non-creative labor. The execution order of the steps is not limited to the execution order provided by the embodiments of the present application in the logical sense. The method can be executed in sequence or in parallel during actual processing or when the device is executed.

[0089] Please refer to FIG. 3, which is a flow diagram of a data processing method according to an embodiment of the present application. The data processing method can be executed by the device 104 in FIG. 1 and FIG. 2, and the device 104 is deployed with an analysis system for transaction attribution analysis.

[0090] Step 301: Construct a graph association structure with transaction subjects in a target business scenario as nodes and association relationships between the transaction subjects as edges.

[0091] In the embodiments of the present application, the electronic device can first determine a target business scenario, and hereinafter, the target business scenario is taken as a business scenario of a payment system in the financial field as an example for description. The business scenario of the payment system in the financial field includes a payment parent company, a plurality of payment subsidiaries and a plurality of acquirers. The payment parent company, the payment subsidiaries and the acquirers can be understood as transaction subjects, and hereinafter, the subjects are referred to as transaction subjects for convenience of description. Then, the association relationships between the payment parent company, the plurality of payment subsidiaries and the plurality of acquirers can be determined based on business information. For example, the business information is the number of merchants, and then it can be determined that the payment parent company and the payment subsidiaries have an association relationship in terms of the number of merchants, and the payment subsidiaries and the acquirers have an association relationship in terms of the number of merchants. For another example, the business information is the number of transactions, and then it can be determined that the payment parent company and the payment subsidiaries have an association relationship in terms of the number of transactions, and the payment subsidiaries and the acquirers have an association relationship in terms of the number of transactions.

[0092] Further, a graph association structure can be constructed with transaction subjects in a target business scenario as nodes and association relationships between the transaction subjects as edges.

[0093] For example, refer to FIG. 4, which is a schematic diagram of a graph association structure according to an embodiment of the present application. In FIG. 4, a quadrilateral pattern represents a node of a transaction subject being an acquirer, a pentagon pattern represents a node of a transaction subject being a payment subsidiary, and a hexagon pattern represents a node of a transaction subject being a payment parent company.

[0094] Optionally, the graph association structure can also be expressed in a mathematical form, specifically as follows: G={V,ε}

[0095] In the formula, V represents a node set included in the graph association structure, and ε represents an edge set of the graph association structure.

[0096] In step 302, based on the business information of the transaction subject indicated by each node in the graph association structure, the association relationship between the transaction subjects, and a preset anomaly analysis rule, an anomaly value corresponding to each node is determined; each anomaly value is used to indicate an abnormal fluctuation degree of a transaction of a transaction subject indicated by a node; the abnormal fluctuation degree is determined based on the business information of the transaction subject and the business information of other transaction subjects having an association relationship with the transaction subject.

[0097] In the embodiment of the present application, the electronic device can determine the anomaly value corresponding to each node by, but not limited to, the following steps:

[0098] In step A, a fluctuation value of each node is determined based on the business information of the transaction subject indicated by each node in the graph association structure and a first sub-rule in the preset anomaly analysis rule; the first sub-rule is used to perform magnitude normalization processing on an initial fluctuation value of the node obtained based on business information of different magnitudes.

[0099] In the embodiment of the present application, the electronic device can input the business information of the transaction subject indicated by each node into a preset time sequence attribution model to obtain an initial fluctuation value corresponding to each node output by the preset time sequence attribution model; the preset time sequence attribution model determines the initial fluctuation value of a transaction subject based on the business information of the transaction subject in a preset time period and a preset magnitude fluctuation evaluation rule. The preset magnitude fluctuation evaluation rule includes a plurality of mapping relationships, different mapping relationships include a numerical range corresponding to business information of different magnitudes, and an initial fluctuation value corresponding to the numerical range.

[0100] For example, assuming that the node is acquirer A and the business information is the monthly transaction volume of acquirer A in 2021-2023, the input of the preset time series attribution model is that the monthly transaction volume of acquirer A in 2021-2023 is 100, so that the value range corresponding to the transaction volume is 100-200 based on the fluctuation evaluation rule, and the initial fluctuation value corresponding to the value range 100-200 is 120%, and it is determined that the initial fluctuation value of the node in the transaction volume order is 120%.

[0101] In addition, since the scales of different business values are different, for example, the order of magnitude of the transaction volume is hundreds of millions, and the order of magnitude of the number of merchants is tens of millions, that is, there is a huge difference in the orders of magnitude of the two business values, therefore, the initial fluctuation value corresponding to each transaction subject can be normalized, so that the orders of magnitude can be unified. That is, the initial fluctuation value corresponding to each transaction subject can be normalized to obtain the fluctuation value of each node. The fluctuation value is used to indicate the fluctuation of the value of the business information of the transaction subject indicated by the node (hereinafter referred to as business information value for convenience of description).

[0102] Optionally, the normalization is realized based on the following manner:

[0103] Wherein, S i represents the fluctuation value of the node, r i represents the initial fluctuation value corresponding to the node, and K represents the total number of nodes in the graph association structure.

[0104] For example, referring to FIG. 5, FIG. 5 is a schematic diagram of the fluctuation value of a node in a graph association structure provided by an embodiment of the present application. In FIG. 5, the quadrilateral pattern represents a node of a transaction subject being an acquirer, the pentagon pattern represents a node of a transaction subject being a payment subsidiary, and the hexagon pattern represents a node of a transaction subject being a payment parent company. The fluctuation value of the node of the transaction subject being the acquirer represented by the quadrilateral pattern is 0.1, 0.1=120% / 1200%, wherein 120% is the same period increase value of the business information of the transaction subject being the acquirer, and 1200% is the sum of the same period increase values of the business information of the transaction subjects indicated by all nodes except the node of the parent company.

[0105] Step B: respectively based on the association relationship between the transaction subjects and the second sub-rule in the preset abnormal fluctuation analysis rule, determine the influence value of the fluctuation of the business information of each node affected by other nodes; the second sub-rule is used to calculate the degree of influence of the lower node affected by the fluctuation of the upper node, and the lower node and the upper node are determined based on the association relationship between the transaction subjects;

[0106] In the embodiment of the present application, the second sub-rule is determined based on the following formula:

[0107] wherein, ep ij represents the influence value of node i relative to node j, Δi represents the change value of the business information value of node i between two time points, Δj represents the change value of the business information value of node j between two time points, ep it represents the business information value of node i at time t, ep it’ represents the business information value of node i at time t', ep jt represents the business information value of node j at time t, ep jt’ represents the business information value of node j at time t', and node i and node j are any nodes in the graph association structure.

[0108] In the embodiment of the present application, after the second sub-rule is determined, the influence value of the fluctuation of the business information of each node affected by other nodes can be determined based on the association relationship between the transaction subjects and the aforementioned second sub-rule.

[0109] For example, referring to FIG. 6, which is a schematic diagram of the influence value of a node in a graph association structure according to an embodiment of the present application. In FIG. 6, the quadrilateral pattern represents a node whose transaction subject is an acquirer, the pentagon pattern represents a node whose transaction subject is a payment subsidiary, and the hexagon pattern represents a node whose transaction subject is a payment parent company. The influence value of the node whose transaction subject is the payment subsidiary represented by the pentagon pattern is 0.2, 0.2 = 3000 million / 1.5 billion, wherein 3000 million is the change value of the transaction volume of the transaction subject which is the payment subsidiary, and 1.5 billion is the change value of the transaction volume of the transaction subject which is the parent company.

[0110] Step C: determining the corresponding abnormal transaction value of each node according to the fluctuation value and the corresponding influence value of each node.

[0111] In the embodiment of the present application, the electronic device can take the influence value of an associated node associated with one of the nodes as an initial abnormal transaction iteration matrix. For example, the initial abnormal transaction iteration matrix can be represented as:

[0112] wherein, θ represents the initial abnormal transaction iteration matrix, θ i,j is a matrix factor in θ, ep ij represents the influence value of node i relative to node j, and node i and node j are any nodes in the graph association structure, i.e. i, j ∈ K. When node i and node j are not associated, ep

[0113] Furthermore, the electronic device can substitute the initial abnormality iteration matrix and the fluctuation value corresponding to each node into the third sub-rule of the preset abnormality analysis rule to determine the abnormality value corresponding to each node respectively; the third sub-rule is used to iteratively optimize the fluctuation value of the node in combination with the influence values ​​corresponding to all nodes that have an associated relationship with the node.

[0114] Optionally, the third sub-rule is determined based on the following formula: H 1 ←θS′+d H 2 ←θH 1 +d ... H n ←θH n-1 +d

[0115] Among them, H represents the intermediate variable of the iterative process, H n Indicates the result of the nth round of iteration, the size of n is based on H n and H n-1 The Euclidean distance between them is determined by the size of the distance. Generally, when H n and H n-1 The iteration can be stopped when the Euclidean distance between them is less than 0.0001. θ represents the initial dynamic iteration matrix, S′ represents the set of fluctuation values ​​of all nodes, S′={S1,S2,……,S K}, d is a non-zero adjustment coefficient, i, j are positive integers.

[0116] The final node's abnormal value distribution is H n for The change value of node 1 is H1 n That is, vector H n The first element of .

[0117] Optionally, the electronic device can also sort the abnormal values ​​corresponding to all nodes from large to small to obtain the abnormal values ​​of all nodes after sorting. For example, please refer to Figure 7, which is a schematic diagram of a method for calculating the abnormal value corresponding to a node provided by an embodiment of the present invention. Among them, the quadrilateral pattern in Figure 7 is used to represent the node whose transaction subject is the acquiring institution, the pentagonal pattern is used to represent the node whose transaction subject is the payment subsidiary, and the hexagonal pattern is used to represent the node whose transaction subject is the payment head office.

[0118] Step 303: When the change value corresponding to the first node is greater than a preset threshold, the first node is determined to be a change node, and the transaction subject indicated by the first node is determined to be the change transaction subject.

[0119] In the embodiment of the present application, after obtaining the abnormality values corresponding to all nodes, a preset threshold value can be determined according to historical experience, for example, 0.5. The intermediate value of the top 4 in the sorting information of the obtained abnormality values corresponding to all nodes can also be used as the preset threshold value, and of course, the preset threshold value can also be determined in other ways, which is not limited in the embodiment of the present application.

[0120] In the embodiment of the present application, after the electronic device determines the preset threshold value, the first node corresponding to the abnormality value greater than the preset threshold value can be screened out from all nodes, and the first node is used as the abnormality node. That is, the first node can be one node or a group of nodes.

[0121] In the embodiment of the present application, after the abnormality node is determined, the abnormality node can also be put back to the constructed graph association structure for restoration, so that a clear association tracing path can be obtained to improve the convenience of transaction subject attribution analysis.

[0122] In the embodiment of the present application, the electronic device can screen a candidate path including the first node based on the graph association structure, use the candidate path as an abnormality path, analyze the abnormality path to obtain an abnormality analysis result, and use the abnormality analysis result to indicate an influence node associated with the abnormality node and optimize the business of the transaction subject corresponding to the influence node based on the business information corresponding to the abnormality node.

[0123] For example, referring to FIG. 8, which is a schematic diagram of an abnormality path provided by an embodiment of the present application. In FIG. 8, the quadrilateral pattern represents a node of a transaction subject as an acquirer, the pentagon pattern represents a node of a transaction subject as a payment subsidiary company, and the hexagon pattern represents a node of a transaction subject as a payment parent company. The node represented by the completely filled quadrilateral pattern in FIG. 8 is the first node, and the node represented by the completely filled quadrilateral pattern and the nodes represented by the completely filled pentagon pattern and the completely filled hexagon pattern form an abnormality path.

[0124] In the embodiment of the present application, the association tracing path of attribution analysis, that is, the abnormality path, is further restored by taking advantage of the graph association structure, which improves the convenience of abnormality attribution analysis of the transaction subject, and further improves the strategy optimization effect on the actual business.

[0125] Based on the same inventive concept, an embodiment of the present application also provides a data processing apparatus. As shown in FIG. 9, which is a structural schematic diagram of a data processing apparatus 900, the data processing apparatus 900 can include:

[0126] The construction unit 901 is configured to construct a graph association structure taking a transaction subject in a target business scenario as a node and an association relationship between the transaction subjects as an edge.

[0127] The determining unit 902 is configured to determine an abnormal fluctuation value corresponding to each node based on the business information of the transaction subject indicated by each node in the graph association structure, the association relationship between the transaction subjects, and a preset abnormal fluctuation analysis rule. Each abnormal fluctuation value is used to indicate an abnormal fluctuation degree of the transaction subject indicated by a node, and the abnormal fluctuation degree is determined based on the business information of the transaction subject and the business information of other transaction subjects having an association relationship with the transaction subject.

[0128] The processing unit 903 is configured to determine that the first node is an abnormal node and determine the transaction subject indicated by the first node as an abnormal transaction subject when the abnormal fluctuation value corresponding to the first node is greater than a preset threshold.

[0129] In a possible implementation, the determining unit 902 is specifically configured to:

[0130] The fluctuation value of each node is determined based on the business information of the transaction subject indicated by each node in the graph association structure and a first sub-rule in the preset abnormal fluctuation analysis rule respectively. The first sub-rule is used to perform magnitude normalization processing on an initial fluctuation value of a node obtained based on business information of different magnitudes.

[0131] The influence value of the business information of each node affected by other nodes is determined based on the association relationship between the transaction subjects and a second sub-rule in the preset abnormal fluctuation analysis rule respectively. The second sub-rule is used to calculate a degree of influence of a lower node affected by the fluctuation of an upper node, and the lower node and the upper node are determined based on the association relationship between the transaction subjects.

[0132] The abnormal fluctuation value corresponding to each node is determined according to the fluctuation value of each node and the corresponding influence value.

[0133] In a possible implementation, the determining unit 902 is specifically configured to:

[0134] The business information of the transaction subject indicated by each node is input into a preset time sequence attribution model respectively, and an initial fluctuation value corresponding to each node output by the preset time sequence attribution model is obtained. The preset time sequence attribution model is used to determine the initial fluctuation value of a transaction subject based on the business information of the transaction subject in a preset time period and a preset magnitude fluctuation evaluation rule. The preset magnitude fluctuation evaluation rule includes a plurality of mapping relationships, different mapping relationships include a numerical range corresponding to different magnitude business information, and an initial fluctuation value corresponding to the numerical range.

[0135] The initial fluctuation value corresponding to each transaction subject is normalized to obtain the fluctuation value of each node. In a possible implementation, the normalization processing is implemented based on the following manner:

[0136] wherein S i represents a fluctuation value of a node, r i represents an initial fluctuation value corresponding to the node, and K represents a total number of nodes in the graph association structure.

[0137] In a possible implementation, the second sub-rule is determined based on the following formula:

[0138] wherein ep ij represents an influence value of node i with respect to node j, Δi represents a change value of the business information value of node i between two time points, Δj represents a change value of the business information value of node j between two time points, e it represents a business information value of node i at time t, e it’ represents a business information value of node i at time t', e jt represents a business information value of node j at time t, e jt’ represents a business information value of node j at time t', and node i and node j are any nodes in the graph association structure.

[0139] In a possible implementation, the determining unit 902 is specifically configured to:

[0140] an influence value of an associated node having an association relationship with the node is taken as a matrix element to construct an initial abnormal iteration matrix;

[0141] the initial abnormal iteration matrix and the fluctuation value corresponding to each node are substituted into a third sub-rule of the preset abnormal analysis rule to determine an abnormal value corresponding to each node respectively; and the third sub-rule is configured to iteratively optimize the fluctuation value of the node in combination with the influence values corresponding to all nodes having an association relationship with the node.

[0142] In a possible implementation, the third sub-rule is determined based on the following formula: H n ← θH n-1 + d

[0143] wherein H n represents a set of abnormal values of all nodes, n represents an iteration round number, when n is equal to 1, H 1 ← θS' + d, S' represents a set of fluctuation values of all nodes, S' = {S1, S2, …, S K}, θ represents the initial abnormal iteration matrix, and θ i,j is a matrix element in θ, ep ijrepresents an influence value of node i relative to node j, node i and node j are any nodes in the graph association structure, S k represents a fluctuation value of node k, d is a non-zero adjustment coefficient, i, j are positive integers.

[0144] In a possible implementation, after determining that the first node is a transaction node, the apparatus further includes an optimization unit configured to:

[0145] filtering a candidate path including the first node based on the graph association structure, and taking the candidate path as a transaction path;

[0146] analyzing the transaction path to obtain a transaction analysis result, the transaction analysis result being used to indicate an influence node associated with the transaction node and to optimize a business of a transaction subject corresponding to the influence node based on business information corresponding to the transaction node.

[0147] For the sake of brevity, the above portions are described in accordance with the functions respectively. Of course, the functions of the modules (or units) can be implemented in one or more software or hardware in the implementation of the present application.

[0148] After introducing the data processing method and apparatus of the exemplary embodiments of the present application, next, an electronic device according to another exemplary embodiment of the present application is introduced.

[0149] Those skilled in the art can understand that each aspect of the present application can be implemented as a system, a method or a program product. Therefore, each aspect of the present application can be specifically implemented as follows: a complete hardware embodiment, a complete software embodiment (including firmware, microcode, etc.), or an embodiment combining hardware and software, which can be collectively referred to as "circuitry", "module" or "system".

[0150] As to the apparatus in the above embodiments, the specific implementation manners of the modules have been described in detail in the embodiments related to the method, and will not be described in detail here.

[0151] Based on the same inventive concept as the above method embodiments, the present embodiments further provide an electronic device, and the principle of solving the problem of the electronic device is similar to that of the above method embodiments. Therefore, the implementation of the electronic device can be referred to the implementation of the above method, and the repeated parts will not be described here.

[0152] Referring to FIG. 10, which is a block diagram of an electronic device 1000 according to an exemplary embodiment, the electronic device in the embodiment of the present application includes at least one processor 1001 and a memory 1002 connected to the at least one processor 1001. The embodiment of the present application does not limit the specific connection medium between the processor 1001 and the memory 1002. In FIG. 10, the connection between the processor 1001 and the memory 1002 is taken as an example of connection through a bus. The bus is represented by a thick line in FIG. 10. The connection mode between other components is only illustrative and is not limited. The bus can be divided into an address bus, a data bus, a control bus, etc. For convenience of representation, only one thick line is used in FIG. 10, but it does not mean that there is only one bus or only one type of bus.

[0153] In the embodiment of the present application, the memory 1002 stores instructions executable by the at least one processor 1001. The at least one processor 1001 can execute the steps included in the foregoing data processing method by executing the instructions stored in the memory 1002.

[0154] The processor 1001 is the control center of the electronic device. It can connect various parts of the entire fault detection device through various interfaces and lines. Through the running or execution of the instructions stored in the memory 1002 and the calling of the data stored in the memory 1002, the electronic device can process data and perform various functions, thereby performing overall monitoring on the electronic device. Optionally, the processor 1001 can include one or more processing units. The processor 1001 can integrate an application processor and a modem processor. The processor 1001 mainly processes the operating system, user interface, and application programs, etc. The modem processor mainly processes wireless communication. It can be understood that the foregoing modem processor can also not be integrated into the processor 1001. In some embodiments, the processor 1001 and the memory 1002 can be implemented on the same chip. In some embodiments, they can also be implemented on separate chips respectively.

[0155] The processor 1001 can be a general-purpose processor, such as a central processing unit (CPU), a digital signal processor, an application-specific integrated circuit, a field programmable gate array, or other programmable logic device, a discrete gate or transistor logic component, a discrete hardware component, which can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of the present application. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the method disclosed in combination with the embodiments of the present application can be directly embodied as execution completed by a hardware processor, or executed by a combination of hardware and software modules in the processor.

[0156] The memory 1002 is a non-volatile computer readable storage medium, which can be used to store non-volatile software programs, non-volatile computer executable programs and modules. The memory 1002 can include at least one type of storage medium, for example, can include flash memory, hard disk, multimedia card, card type memory, random access memory (RAM), static random access memory (SRAM), programmable read-only memory (PROM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), magnetic storage, magnetic disk, optical disk, etc. The memory 1002 is any other medium capable of carrying or storing desired program code in the form of instructions or data structures and capable of being accessed by a computer, but is not limited to this. The memory 1002 in the embodiment of the present application can also be a circuit or any other device capable of realizing a storage function, used to store program instructions and / or data.

[0157] Based on the same inventive concept, the embodiment of the present application further provides another schematic diagram of an electronic device, as shown in FIG. 11, the electronic device 104 includes a display unit 1140, a processor 1180 and a memory 1120, wherein the display unit 1140 includes a display panel 1141, used to display information input by a user or information provided to the user and various object selection interfaces of the electronic device 104, etc., which is mainly used to display related operation interfaces of the analysis system installed in the electronic device 104, shortcut windows, etc. in the embodiment of the present application. Optionally, the display panel 1141 can be configured in the form of LCD (Liquid Crystal Display) or OLED (Organic Light-Emitting Diode).

[0158] The processor 1180 is used to read a computer program and then execute the method defined by the computer program, for example, the processor 1180 reads an application program of the analysis system, so as to run the analysis system on the electronic device 104 and display related operation interfaces of the analysis system on the display unit 1140. The processor 1180 can include one or more general-purpose processors, and can also include one or more DSPs (Digital Signal Processors) used to execute related operations to realize the technical solutions provided by the embodiment of the present application.

[0159] The memory 1120 generally includes an internal memory and an external memory. The internal memory can be a random access memory (RAM), a read only memory (ROM), a cache memory (CACHE), etc. The external memory can be a hard disk, a compact disk, a USB disk, a floppy disk, a tape drive, etc. The memory 1120 is used to store computer programs and other data. The computer programs include application programs corresponding to various software, etc. The other data can include data generated after the operating system or the application programs are run, including system data (such as configuration parameters of the operating system) and user data. In the embodiment of the present application, program instructions are stored in the memory 1120, and the processor 1180 executes the program instructions in the memory 1120 to realize the functions of the data processing method discussed above.

[0160] In addition, the electronic device 104 can further include a display unit 1140 for receiving input digital information, character information or contact touch operation / non-contact gesture, and generating signal input related to user settings and function control of the electronic device 104, etc. Specifically, in the embodiment of the present application, the display unit 1140 can include a display panel 1141. The display panel 1141, for example, a touch screen, can collect touch operations (such as target objects using fingers, styluses, etc. Any suitable object or accessory on or near the display panel 1141 or on the display panel 1141) of the user and drive the corresponding connection device according to the pre-set program. Optionally, the display panel 1141 can include two parts of a touch detection device and a touch controller. The touch detection device detects the touch position of the user and detects the signal generated by the touch operation and transmits the signal to the touch controller; the touch controller receives the touch information from the touch detection device and converts it into touch coordinates and sends it to the processor 1180, and can also receive commands from the processor 1180 and execute them. In the embodiment of the present application, if the user performs a selection operation on the associated subprogram, the touch detection device in the display panel 1141 detects the touch operation, and then sends the signal corresponding to the detected touch operation to the touch controller. The touch controller converts the signal into touch coordinates and sends it to the processor 1180. The processor 1180 determines the target business scenario selected by the user according to the received touch coordinates, and controls the display panel 1141 to display the transaction subject in the target business scenario.

[0161] The display panel 1141 can be implemented in various types such as resistive, capacitive, infrared and surface acoustic wave, etc. In addition to the display unit 1140, the electronic device 104 can further include an input unit 1130, which can include one or more of a physical keyboard, function keys (such as volume control buttons, on / off buttons, etc.), trackballs, mice, joysticks, etc. In FIG. 11, the input unit 1130 is taken as an example including an image input device 1131 and other input devices 1132.

[0162] In addition to the above, the electronic device 104 can further include a power supply 1190 for powering other modules, an audio circuit 1160, a near field communication module 1170, and an RF circuit 1110. The electronic device 104 can further include one or more sensors 1150, such as an acceleration sensor, a light sensor, a pressure sensor, etc. The audio circuit 1160 specifically includes a speaker 1161 and a microphone 1162, etc., for example, a user can use voice control, the electronic device 104 can collect the user's voice through the microphone 1162, and can control according to the user's voice, and when there is a change in the user's business information, the corresponding prompt sound can be played through the speaker 1161.

[0163] In an example embodiment, a storage medium including operations, such as the memory 1002 including operations, is also provided, and the above-mentioned operations can be executed by the processor 1001 of the electronic device 1000 to complete the above-mentioned method. Optionally, the storage medium can be a non-transitory computer-readable storage medium, for example, the non-transitory computer-readable storage medium can be a ROM, a random access memory (RAM), a CD-ROM, a magnetic tape, a floppy disk, and an optical data storage device, etc.

[0164] Based on the same inventive concept as the above method embodiments, various aspects of the data processing method provided by the present application can also be implemented in the form of a program product, which includes program code for causing an electronic device to execute the steps of the data processing method according to various example embodiments of the present application described above in the specification when the program product is run on the electronic device, for example, the electronic device can execute the steps as shown in FIG. 3.

[0165] The program product can adopt any combination of one or more readable media. The readable medium can be a readable signal medium or a readable storage medium. The readable storage medium may, for example, but is not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or apparatus, or any combination of the above. More specific examples (non-exhaustive list) of readable storage media include: an electrical connection having one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above.

[0166] The program product of the embodiments of the present application can take a portable compact disc read only memory (CD-ROM) and include a program code, and can be run on a server. However, the program product of the present application is not limited thereto, and in this document, the readable storage medium can be any tangible medium that contains or stores a program that can be used by or in connection with a command execution system, apparatus, or device.

[0167] The readable signal medium can include a data signal propagated in a baseband or as a part of a carrier wave, in which a readable program code is borne. Such a propagated data signal can take a variety of forms, including but not limited to electro-magnetic signal, optical signal, or any suitable combination thereof. The readable signal medium can also be any readable medium that can be used to send, propagate, or transfer a program for use by or in connection with a command execution system, apparatus, or device.

[0168] The program code contained in the readable medium can be transmitted using any suitable medium, including but not limited to wireless, wired, optical fiber cable, RF, or the like, or any suitable combination thereof.

[0169] Although the preferred embodiments of the present application have been described, those skilled in the art can make additional changes and modifications to these embodiments once they get the basic inventive concept. Therefore, the appended claims are intended to include the preferred embodiments and all the changes and modifications falling within the scope of the present application.

[0170] Obviously, various modifications and changes can be made to the present application by those skilled in the art without departing from the spirit and scope of the present application. Thus, it is intended that the present application embrace all such changes and modifications as fall within the scope of the appended claims and their equivalents.

Claims

1. A data processing method, wherein: The method comprises: Construct a graph association structure with transaction entities in the target business scenario as nodes and the association relationships between transaction entities as edges; Based on the business information of the transaction subject indicated by each node in the graph association structure, the association relationship between the transaction subjects, and the preset abnormality analysis rules, the abnormality value corresponding to each node is determined; wherein each abnormality value is used to indicate the degree of abnormal fluctuation of the transaction of the transaction subject indicated by the node; the abnormal fluctuation degree is determined based on the transaction subject's own business information and the business information of other transaction subjects with which it has an association relationship; When the change value corresponding to the first node is greater than a preset threshold, the first node is determined to be a change node, and the transaction subject indicated by the first node is determined to be the change transaction subject.

2. The method according to claim 1, wherein Determining the change value corresponding to each node based on the business information of the transaction subject indicated by each node in the graph association structure, the association relationship between the transaction subjects, and the preset change analysis rules includes: Determining the fluctuation value of each node based on the business information of the transaction subject indicated by each node in the graph association structure and the first sub-rule in the preset abnormal movement analysis rule; the first sub-rule is used to perform magnitude normalization processing on the initial fluctuation values ​​of the nodes obtained based on business information of different magnitudes; Determining, based on the associations between the transaction entities and the second sub-rule in the preset abnormal movement analysis rule, an impact value of the fluctuation of the business information of each node being affected by the influence of other nodes; the second sub-rule is used to calculate the degree to which the lower-level nodes are affected by the fluctuation of the upper-level nodes, and the lower-level nodes and the upper-level nodes are determined based on the associations between the transaction entities; According to the fluctuation value and the corresponding impact value of each node, the abnormal value corresponding to each node is determined.

3. The method according to claim 2, wherein: Determining the fluctuation value of each node based on the business information of the transaction subject indicated by each node in the graph association structure and the first sub-rule in the preset abnormal movement analysis rule, including: Inputting the business information of the transaction subject indicated by each node into a preset time series attribution model, respectively, to obtain an initial fluctuation value corresponding to each node output by the preset time series attribution model; the preset time series attribution model determines the initial fluctuation value of a transaction subject based on the business information of the transaction subject within a preset time period and a preset magnitude fluctuation evaluation rule; the preset magnitude fluctuation evaluation rule includes multiple mapping relationships, each mapping relationship including a numerical range corresponding to business information of different magnitudes and an initial fluctuation value corresponding to the numerical range; The initial fluctuation value corresponding to each of the transaction entities is normalized to obtain the fluctuation value of each of the nodes.

4. The method according to claim 3, wherein: The normalization process is implemented based on the following method: Among them, S i Indicates the fluctuation value of the node, r i represents the initial fluctuation value corresponding to the node, and K is used to represent the total number of nodes in the graph association structure.

5. The method according to claim 2, wherein: The second sub-rule is determined based on the following formula: Among them, ep ij represents the influence value of node i relative to node j, Δi represents the change value of the business information value of node i between two moments, Δj represents the change value of the business information value of node j between two moments, e it represents the business information value of node i at time t, e it’ represents the business information value of node i at time t', e jt represents the business information value of node j at time t, e jt’ represents the business information value of node j at time t', where nodes i and j are any nodes in the graph association structure.

6. The method according to any one of claims 2 to 5, wherein: Determining the change value corresponding to each node according to the fluctuation value and the corresponding impact value of each node includes: Taking the influence value of an associated node associated with the node as a matrix factor, constructing an initial change iteration matrix; According to the initial abnormality iteration matrix and the fluctuation value corresponding to each node, the third sub-rule of the preset abnormality analysis rule is substituted to determine the abnormality value corresponding to each node respectively; the third sub-rule is used to iteratively optimize the fluctuation value of the node in combination with the influence values ​​corresponding to all nodes that have an associated relationship with the node.

7. The method according to claim 6, wherein: The third sub-rule is determined based on the following formula: n ←θH n-1 +d Among them, H n Represents the set of all node change values, n is used to represent the number of iterations, when n is equal to 1, H 1 ←θS′+d, S′ represents the set of fluctuation values ​​of all nodes, S′={S1,S2,……,S K }, θ represents the initial dynamic iteration matrix, θ i,j is the matrix factor in θ, ep ij Represents the influence value of node i relative to node j, where nodes i and j are any nodes in the graph association structure, S k represents the fluctuation value of node k, d is a non-zero adjustment coefficient, and i and j are positive integers.

8. The method of claim 1, wherein: After determining that the first node is a changed node, the method further includes: Based on the graph association structure, screening candidate paths including the first node, and using the candidate paths as change paths; The abnormal path is analyzed to obtain an abnormal analysis result; the abnormal analysis result is used to indicate the impact node associated with the abnormal node, and based on the business information corresponding to the abnormal node, the business of the transaction subject corresponding to the impact node is optimized.

9. A data processing device, wherein: The device comprises: A construction unit is used to construct a graph association structure with transaction entities in the target business scenario as nodes and association relationships between transaction entities as edges; a determining unit configured to determine an abnormality value corresponding to each node in the graph association structure based on the business information of the transaction subject indicated by each node, the association relationship between the transaction subjects, and a preset abnormality analysis rule; wherein each abnormality value is used to indicate the degree of abnormal fluctuation in the transaction of the transaction subject indicated by the node; the abnormal fluctuation degree is determined based on the transaction subject's own business information and the business information of other transaction subjects with which it has an association relationship; The processing unit is configured to determine that the first node is a changed node when the change value corresponding to the first node is greater than a preset threshold, and to determine the transaction subject indicated by the first node as the changed transaction subject.

10. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 8 are implemented.

11. A computer-readable storage medium, wherein: The program product includes program codes. When the program product is run on an electronic device, the program codes are used to enable the electronic device to execute the steps of any one of the methods described in claims 1-8.

12. A computer program product, wherein: The computer program product comprises: a computer program code, and when the computer program code is run on a computer, the computer is caused to execute the method according to any one of claims 1 to 8.

Images