Transaction object anomaly detection method and apparatus

Abstract

Embodiments of the present application provide a transaction object anomaly detection method and apparatus, which can be applied to the technical field of computers. The method comprises: dividing M transaction elements into N transaction dimensions; combining the transaction elements comprised in the N transaction dimensions to obtain L transaction objects; and for each selected transaction object, determining an anomaly detection result of the transaction object on the basis of respective target transaction data of the transaction object in a plurality of detection periods. In the present application, different transaction objects are refined on the basis of transaction dimensions and transaction elements, and anomaly detection results are obtained on the basis of respective target transaction data of different transaction objects. Compared with an anomaly detection method that all transaction objects use the same set of alarm thresholds, the present application is more targeted, thereby ensuring the accuracy of anomaly detection of transaction objects having a small transaction volume. In addition, the anomaly detection results are obtained by combining target transaction data of a plurality of detection periods, thereby further improving the accuracy of anomaly detection.

Description

A method and apparatus for detecting anomalies in trading objects

[0001] Cross-references to related applications

[0002] This application claims priority to Chinese Patent Application No. 202510181208.6, filed on February 18, 2025, entitled "A Method and Apparatus for Detecting Anomalies in Trading Objects", the entire contents of which are incorporated herein by reference. Technical Field

[0003] This application relates to the field of computer technology, and in particular to a method and apparatus for detecting anomalies in trading objects. Background Technology

[0004] In the daily operations of trading institutions, especially in scenarios following production changes, maintaining the stability of trading objects typically requires anomaly detection. This involves monitoring aspects such as trading volume, success rate, and transaction latency. Related technologies involve the trading platform periodically collecting the total trading volume of all trading objects over a fixed time period, then taking the difference from the total trading volume of the previous period. The rate of change is then calculated based on this difference and compared to an alarm threshold to determine whether an alarm should be triggered and to initiate emergency procedures.

[0005] However, for some inactive transaction objects, such as foreign card channels (e.g., cross-border payments, third-party platforms) or low-frequency transaction scenarios such as the early morning hours, the transaction volume of these transaction objects is low. Therefore, the transaction volume of these transaction objects accounts for a small proportion of the overall transaction volume. As a result, it is difficult to detect the anomalies of these transaction objects using the above-mentioned anomaly detection methods, thereby reducing the accuracy of transaction object anomaly detection. Summary of the Invention

[0006] This invention provides a method and apparatus for detecting anomalies in trading objects, which improves the accuracy of anomaly detection and ensures the stability of daily operations of trading institutions.

[0007] On the one hand, embodiments of this application provide an anomaly detection method for transaction objects, the method comprising:

[0008] Obtain M transaction elements, divide the M transaction elements into N transaction dimensions, each transaction dimension contains at least one transaction element, N and M are positive integers, and N is less than M;

[0009] The transaction elements contained in the N transaction dimensions are combined to obtain L transaction objects. Each transaction object contains N transaction elements, which are obtained from the N transaction dimensions, and L is a positive integer.

[0010] For each selected transaction object, an anomaly detection result is obtained based on the target transaction data of the transaction object in multiple detection periods.

[0011] Optionally, obtaining the anomaly detection result of the transaction object based on the target transaction data of the transaction object in multiple detection periods includes:

[0012] For each of the multiple detection periods, the following operations are performed: based on the historical transaction data of the transaction object within a detection period, determine the alarm threshold corresponding to the detection period; based on the target transaction data of the transaction object within the detection period and the alarm threshold corresponding to the detection period, obtain the sub-detection result of the transaction object within the detection period.

[0013] Based on the sub-detection results corresponding to each of the multiple detection time periods, the anomaly detection results of the transaction object are obtained.

[0014] Optionally, determining the alarm threshold corresponding to the detection period based on the historical transaction data of the transaction object within a detection period includes:

[0015] Determine the standard deviation of the historical transaction data of the transaction object within a detection period;

[0016] Based on the standard deviation and the preset dynamic coefficient, the alarm threshold corresponding to the detection period is determined.

[0017] Optionally, obtaining the sub-detection results of the transaction object within the detection period includes:

[0018] If the target transaction data of the transaction object within the detection period is greater than the alarm threshold corresponding to the detection period, then the sub-detection result is a local anomaly.

[0019] If the target transaction data of the transaction object within the detection period is not greater than the alarm threshold corresponding to the detection period, then the sub-detection result is locally normal.

[0020] Optionally, obtaining the anomaly detection result of the transaction object based on the sub-detection results corresponding to each of the multiple detection time periods includes:

[0021] For each of the multiple detection periods, the abnormality rate of the transaction object in the multiple detection periods is calculated based on the sub-detection results.

[0022] If the anomaly ratio is greater than or equal to a preset threshold, the anomaly detection result of the transaction object is abnormal; otherwise, the anomaly detection result of the transaction object is normal.

[0023] Optionally, the target transaction data is at least one of the following:

[0024] Number of failed transactions, number of successful transactions, transaction success rate, and transaction latency.

[0025] On one hand, embodiments of this application provide an anomaly detection device for transaction objects, the device comprising:

[0026] The acquisition module is used to acquire M transaction elements, divide the M transaction elements into N transaction dimensions, and each transaction dimension contains at least one transaction element. N and M are positive integers, and N is less than M.

[0027] The transaction elements contained in the N transaction dimensions are combined to obtain L transaction objects. Each transaction object contains N transaction elements, which are obtained from the N transaction dimensions, and L is a positive integer.

[0028] The processing module is used to obtain the anomaly detection result of each selected transaction object based on the target transaction data of the transaction object in multiple detection periods.

[0029] Optionally, the processing module is specifically used for:

[0030] For each of the multiple detection periods, the following operations are performed: based on the historical transaction data of the transaction object within a detection period, determine the alarm threshold corresponding to the detection period; based on the target transaction data of the transaction object within the detection period and the alarm threshold corresponding to the detection period, obtain the sub-detection result of the transaction object within the detection period.

[0031] Based on the sub-detection results corresponding to each of the multiple detection time periods, the anomaly detection results of the transaction object are obtained.

[0032] Optionally, the processing module is specifically used for:

[0033] Determine the standard deviation of the historical transaction data of the transaction object within a detection period;

[0034] Based on the standard deviation and the preset dynamic coefficient, the alarm threshold corresponding to the detection period is determined.

[0035] Optionally, the processing module is specifically used for:

[0036] If the target transaction data of the transaction object within the detection period is greater than the alarm threshold corresponding to the detection period, then the sub-detection result is a local anomaly.

[0037] If the target transaction data of the transaction object within the detection period is not greater than the alarm threshold corresponding to the detection period, then the sub-detection result is locally normal.

[0038] Optionally, the processing module is specifically used for:

[0039] For each of the multiple detection periods, the abnormality rate of the transaction object in the multiple detection periods is calculated based on the sub-detection results.

[0040] If the anomaly ratio is greater than or equal to a preset threshold, the anomaly detection result of the transaction object is abnormal; otherwise, the anomaly detection result of the transaction object is normal.

[0041] On one hand, embodiments of this application provide a computer device, including:

[0042] Memory, used to store program instructions;

[0043] The processor is used to call the program instructions stored in the memory and execute the steps of the above-mentioned anomaly detection method for the transaction object according to the obtained program.

[0044] On one hand, embodiments of this application provide a computer-readable storage medium storing a computer program executable by a computer device, which, when run on the computer device, causes the computer to perform the steps of the above-described method for detecting anomalies in the transaction object.

[0045] On one hand, embodiments of this application provide a computer program product, including a computer program stored on a computer-readable storage medium, the computer program including program instructions, which, when executed by a computer device, cause the computer device to perform the steps of the above-described method for detecting anomalies in transaction objects.

[0046] In this embodiment, M transaction elements are divided into N transaction dimensions, and the transaction elements contained in the N transaction dimensions are combined to obtain L transaction objects. For each selected transaction object, the anomaly detection result is determined based on the target transaction data of the transaction object in multiple detection periods. This application refines different transaction objects based on transaction dimensions and transaction elements, and obtains anomaly detection results based on the target transaction data of different transaction objects. Compared with the existing anomaly detection method that uses the same set of alarm thresholds for all transaction objects, this application is more targeted, thus ensuring the accuracy of anomaly detection for transaction objects with small transaction volumes. At the same time, by setting multiple detection periods and obtaining anomaly detection results based on the target transaction data of multiple detection periods, the accuracy of anomaly detection is further improved. Secondly, this application first divides the M transaction elements into N transaction dimensions, and then combines the N transaction dimensions to obtain L transaction objects. Compared with directly combining a large number of transaction elements, this avoids a surge in the number of transaction objects and reduces the number of detection results, making it easier to maintain and ensuring the stability of the daily operation of the trading institution. Attached Figure Description

[0047] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0048] Figure 1 is a schematic diagram of a system architecture provided in an embodiment of this application;

[0049] Figure 2 is a flowchart illustrating an anomaly detection method for a transaction object provided in an embodiment of this application;

[0050] Figure 3 is a flowchart illustrating an anomaly detection method for a transaction object provided in an embodiment of this application;

[0051] Figure 4 is a schematic diagram of the structure of an anomaly detection device for a transaction object provided in an embodiment of this application;

[0052] Figure 5 is a schematic diagram of the structure of a computer device provided in an embodiment of this application. Detailed Implementation

[0053] To make the objectives, technical solutions, and beneficial effects of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without inventive effort are within the scope of protection of this invention.

[0054] It should be noted that the brief descriptions of terms in this application are only for the convenience of understanding the embodiments described below, and are not intended to limit the embodiments of this application. Unless otherwise stated, these terms should be understood in their ordinary and common meaning.

[0055] The terms "first," "second," "third," etc., used in the specification, claims, and accompanying drawings of this application are used to distinguish similar or related objects or entities, and do not necessarily imply a specific order or sequence, unless otherwise specified. It should be understood that such terms are interchangeable where appropriate.

[0056] The terms “comprising” and “having”, and any variations thereof, are intended to cover but not exclude inclusion, for example, a product or device that includes a range of components is not necessarily limited to all of the components that are clearly listed, but may include other components that are not clearly listed or that are inherent to such product or device.

[0057] The term "module" refers to any known or subsequently developed hardware, software, firmware, artificial intelligence, fuzzy logic, or combination of hardware and / or software code that is capable of performing the functions associated with that element.

[0058] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features therein. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of this application.

[0059] The following is a brief introduction to the system architecture diagram applicable to the technical solutions of the embodiments of this application. It should be noted that the process described below is only for illustrating the embodiments of this application and is not intended to limit the scope of the application.

[0060] Referring to Figure 1, which is a system architecture diagram applicable to an embodiment of this application, the system architecture includes at least a terminal device 101 and a server 102. The number of terminal devices 101 can be one or more, and the number of servers 102 can also be one or more. This application does not specifically limit the number of terminal devices 101 and servers 102.

[0061] Terminal device 101 is pre-installed with an application that has anomaly detection capabilities. This application can be a client application, a web application, a mini-program application, etc. Terminal device 101 can be a smartphone, tablet, laptop, desktop computer, smart home appliance, smart voice interaction device, smart in-vehicle device, etc., but is not limited to these.

[0062] Server 102 is the backend server of the application. Server 102 can be an independent physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, content delivery networks (CDN), and big data and artificial intelligence platforms, but it is not limited to these.

[0063] It should be noted that the method in this embodiment can be executed by the terminal device 101 or the server 102 alone, or by the terminal device 101 and the server 102 together.

[0064] In this embodiment, the terminal device 101 and the server 102 can communicate directly or indirectly through one or more networks. The network can be a wired network or a wireless network; for example, the wireless network can be a mobile cellular network or a Wireless-Fidelity (WIFI) network, or other possible networks. This embodiment does not limit the types of networks used.

[0065] Based on the system architecture diagram shown in Figure 1, this application embodiment provides a flowchart of an anomaly detection method for transaction objects. This method can be executed by the terminal device 101 shown in Figure 1, or by the server 102, or by interaction between the terminal device 101 and the server 102, as shown in Figure 2. The flowchart includes the following steps:

[0066] Step 201: Obtain M transaction elements and divide the M transaction elements into N transaction dimensions. Each transaction dimension contains at least one transaction element. N and M are positive integers, and N is less than M.

[0067] Specifically, transaction elements refer to the key components or conditions involved in a transaction, including the buyer and seller, the subject matter of the transaction, the price, and the payment method. These M transaction elements are divided into the following five transaction dimensions: central identifier, institutional identifier, transaction type, response code, and other elements.

[0068] The central identifier includes: subsystem identifier; institution identifier includes: accepting institution identifier code, sending institution identifier code, receiving institution identifier code, routing institution identifier code, issuing institution identifier code, acquiring bank identifier code, foreign card acquiring bank identifier code, and branch office code; transaction type includes: system transaction code, institution access type, transaction channel, and transaction mode; response code includes: internal error reason code, issuing institution response code, requester response code, and internal response code; other elements include: merchant type, card type, card nature, acceptance region code, default currency code, card medium, card organization code, country code, service point input method code, and service point PIN acquisition code.

[0069] Through testing, this application found that using four out of the five transaction dimensions can guarantee the successful execution of the anomaly detection method for transaction objects. Therefore, this application uses four transaction dimensions as an example to illustrate the technical solution. It should be noted that the process described below is only for illustrating the embodiments of this application and is not a limitation.

[0070] Step 202: Combine the transaction elements contained in the N transaction dimensions to obtain L transaction objects. Each transaction object contains N transaction elements, which are obtained from the N transaction dimensions, and L is a positive integer.

[0071] Specifically, select one transaction element from each transaction dimension to obtain N transaction elements. Combine the N transaction elements to form a transaction object.

[0072] Step 203: For each selected transaction object, obtain the anomaly detection result of the transaction object based on the target transaction data of the transaction object in multiple detection periods.

[0073] Specifically, among the L trading objects, there are trading objects in high-frequency trading scenarios, trading objects in low-frequency trading scenarios (i.e., trading objects with small trading volumes), and possibly trading objects in other trading scenarios.

[0074] For low-frequency transaction scenarios, transaction objects with transaction volume and / or transaction frequency below a preset threshold can be identified from L transaction objects based on the transaction type or the time period in which the transaction occurs.

[0075] For example, if the transaction object's transaction channel (such as cross-border payment) is a foreign card channel within the transaction type dimension, then the transaction object is a low-frequency transaction object. Similarly, if the transaction object has a low transaction volume during the early morning hours, such as 1:00 AM to 5:00 AM, it can also be classified as a low-frequency transaction object.

[0076] Subsequently, anomaly detection can be performed on either L trading objects that are in low-frequency trading scenarios or on all L trading objects.

[0077] In this embodiment, representative transaction elements are combined based on multiple transaction dimensions, transaction features, and transaction time to reduce unnecessary transaction dimensions. Furthermore, by selectively choosing transaction objects for anomaly detection, blindly performing anomaly detection on all transaction objects is avoided, effectively improving the accuracy and efficiency of anomaly detection for transaction objects with small transaction volumes. For each selected transaction object, the target transaction data for each object is examined across multiple detection periods, and the anomaly detection result for each transaction object is obtained based on the anomalies in the transaction data.

[0078] Specifically, the duration of the testing period can be set according to the actual situation. For example, multiple testing periods can be 1 hour, 2 hours, ..., 24 hours, and this application does not make specific limitations.

[0079] In some embodiments, the target transaction data includes at least one of the following: number of failed transactions, number of successful transactions, transaction success rate, and transaction latency.

[0080] Specifically, transaction latency refers to the time delay from initiating a transaction request to the completion of the transaction, and is used to measure the response time and processing time in the transaction process.

[0081] In the actual anomaly detection process, the technical solution of this application performs anomaly detection on four target transaction data points for trading objects with small transaction volumes: the number of failed transactions, the number of successful transactions, the transaction success rate, and the transaction latency. It was found that during peak trading hours such as 09:00-10:00, 10:00-11:00, 11:00-12:00, 12:00-13:00, 14:00-15:00, 15:00-16:00, and 16:00-17:00, the anomaly detection results for the number of successful transactions, the transaction success rate, and the transaction latency were all normal. However, the anomaly in the number of failed transactions was detected promptly. This indicates that the anomaly detection effect for the number of failed transactions is more significant than that for other target transaction data points, and it can better predict and prevent potential risks associated with trading objects with small transaction volumes.

[0082] However, in different financial businesses, the number of successful transactions, transaction success rate, and transaction latency remain important indicators for evaluating transaction objects. Therefore, in the practical application of the technical solution in this application, analyzing the patterns and trends of abnormal occurrences in the number of failed transactions is beneficial to improving the accuracy and timeliness of detecting abnormalities in the number of failed transactions. By comprehensively considering factors such as the number of successful transactions, transaction success rate, and transaction latency, the abnormality detection methods and processes can be continuously optimized to improve the level of risk management.

[0083] In some embodiments, for multiple detection periods, the following operations are performed respectively: based on the historical transaction data of the transaction object within a detection period, an alarm threshold corresponding to a detection period is determined; based on the target transaction data of the transaction object within a detection period and the alarm threshold corresponding to a detection period, a sub-detection result of the transaction object within a detection period is obtained; based on the sub-detection results corresponding to each of the multiple detection periods, an anomaly detection result of the transaction object is obtained.

[0084] Specifically, a detection period for a transaction object can be a short time interval such as 10 minutes or 15 minutes. The historical transaction data of the transaction object within a detection period can be set according to the actual situation, such as historical transaction data of the past 20 days or 30 days; this application does not impose specific limitations.

[0085] For example, assuming a detection period is 10 minutes (e.g., 10:00-10:10), the historical transaction data of the trading object in the past 30 days during the 10:00-10:10 detection period is obtained to determine the alarm threshold corresponding to the detection period; based on the alarm threshold of the detection period and the target transaction data of the trading object, the sub-detection results of the trading object within the detection period are determined.

[0086] In some embodiments, the standard deviation of the historical transaction data of the transaction object within a detection period is determined; based on the standard deviation and a preset dynamic coefficient, an alarm threshold corresponding to a detection period is determined.

[0087] Specifically, the formula for calculating the standard deviation is shown in the following formula (1):

[0088] Where s represents the standard deviation of historical transaction data within a detection period; N represents the number of historical transaction data; x i This represents the i-th historical transaction data; This represents the average of N historical transaction data.

[0089] It can also calculate the average and variance of historical transaction data of a trading object within a detection period, and determine the alarm threshold based on the average / variance and a preset dynamic coefficient. If errors are found in the historical transaction data of the trading object during the calculation process, the erroneous transaction data can be removed.

[0090] For example, the system collects the number of historical failed transactions of a trading entity each day between 10:00 and 10:10 (the detection period) over the past 30 days. Then, it calculates the standard deviation of the collected historical failed transaction counts. The product of this standard deviation and a preset dynamic coefficient is used as the alarm threshold corresponding to the number of failed transactions during the 10:00-10:10 detection period. The preset dynamic coefficient is set according to actual circumstances, and this application does not impose specific limitations.

[0091] In some embodiments, if the target transaction data of a transaction object within a detection period is greater than the alarm threshold corresponding to the detection period, the sub-detection result is locally abnormal; if the target transaction data of a transaction object within a detection period is not greater than the alarm threshold corresponding to the detection period, the sub-detection result is locally normal.

[0092] For example, if the alarm threshold for the number of failed transactions of a small trading volume transaction object during the detection period of 10:00-10:10 is 1, but the target number of failed transactions of the transaction object during the same detection period is 5, which is greater than the alarm threshold of 1 for the corresponding detection period, then the sub-detection result of the transaction object during the detection period of 10:00-10:10 is considered to be locally abnormal; if the target number of failed transactions of the transaction object during the same detection period of 10:00-10:10 is 0, which is less than the alarm threshold of 1 for the corresponding detection period, then the sub-detection result of the transaction object during the same detection period of 10:00-10:10 is considered to be locally normal.

[0093] In some embodiments, for the sub-detection results corresponding to each of the multiple detection time periods, the abnormality ratio of the transaction object in the multiple detection time periods is calculated; if the abnormality ratio is greater than or equal to a preset threshold, the abnormal detection result of the transaction object is abnormal; otherwise, the abnormal detection result of the transaction object is normal.

[0094] Specifically, the multiple detection periods and preset thresholds are set based on actual conditions, and this application does not impose specific limitations. After determining the multiple detection periods for each of the L transaction objects, the abnormality rate of each transaction object in its respective multiple detection periods is first calculated. Then, a preset threshold is set based on actual conditions. If the abnormality rate of a transaction object is greater than or equal to the corresponding preset threshold, the abnormality detection result of that transaction object is considered abnormal.

[0095] For example, a preset threshold of 90% is set. The selected detection periods are 36, with each detection period being 10 minutes, totaling 6 hours. Based on the sub-detection results of the trading object within each of the 36 10-minute detection periods, the anomaly rate of the trading object is calculated. For instance, if all sub-detection results of the trading object in the 36 10-minute detection periods are local anomalies, the anomaly rate is 100%, which is greater than the preset threshold of 90%. Therefore, the anomaly detection result of the trading object is considered abnormal; trading objects with an anomaly rate below 90% are considered normal.

[0096] In addition, each of the 36 10-minute detection periods has its own corresponding alarm threshold. For each 10-minute detection period, the corresponding alarm threshold needs to be calculated.

[0097] In this embodiment, the abnormality ratio of multiple trading objects in multiple detection periods is considered to be abnormal if the abnormality ratio is greater than or equal to a preset threshold. This can achieve a relative balance between detecting abnormalities and controlling the number of abnormal trading objects, which is conducive to flexibly handling trading objects with low trading volume and / or low trading frequency, improving the level of risk management, and ensuring the stability of the daily operation of trading institutions.

[0098] In this embodiment, M transaction elements are divided into N transaction dimensions, and the transaction elements contained in the N transaction dimensions are combined to obtain L transaction objects. For each selected transaction object, the anomaly detection result is determined based on the target transaction data of the transaction object in multiple detection periods. This application refines different transaction objects based on transaction dimensions and transaction elements, and obtains anomaly detection results based on the target transaction data of different transaction objects. Compared with the existing anomaly detection method that uses a uniform set of alarm thresholds for all transactions, this application is more targeted, ensuring the accuracy of anomaly detection for transaction objects with small transaction volumes. At the same time, by setting multiple detection periods and obtaining anomaly detection results based on the target transaction data of multiple detection periods, it is easier to manage the number of abnormal transaction objects. Secondly, this application first divides the M transaction elements into N transaction dimensions, and then combines the N transaction dimensions to obtain L transaction objects. Compared with directly combining a large number of transaction elements, this avoids a surge in the number of transaction objects and reduces the number of detection results, which is easier to maintain and ensures the stability of the daily operation of the trading institution.

[0099] To better explain the embodiments of this application, the following describes an anomaly detection method for transaction objects provided by the embodiments of this application in conjunction with a practical scenario. The process of this method is executed by the server shown in Figure 1, and includes the following steps, as shown in Figure 3:

[0100] Step 301: Divide the M transaction elements into N transaction dimensions, and combine the transaction elements contained in the N transaction dimensions to obtain L transaction objects.

[0101] Step 302: For each selected small-volume trading object, obtain the corresponding standard deviation based on the historical trading data of the trading object within a detection period. Determine the alarm threshold corresponding to a detection period based on the standard deviation and the preset dynamic coefficient.

[0102] Step 303: If the target transaction data of the transaction object within a detection period is greater than the alarm threshold corresponding to the detection period, the sub-detection result is locally abnormal; otherwise, the sub-detection result of the transaction object is locally normal.

[0103] Step 304: Calculate the anomaly rate of the transaction object in multiple detection periods based on the sub-detection results corresponding to each of the multiple detection periods.

[0104] Step 305: If the abnormality rate of the transaction object in multiple detection periods is greater than or equal to the preset threshold, the abnormality detection result of the transaction object is abnormal; otherwise, the abnormality detection result of the transaction object is normal.

[0105] In actual anomaly detection, the technical solution of this application, for trading objects with small transaction volumes, shows that when the total duration of multiple detection periods is set to 1 hour and the preset threshold is 10%, as many as 220 trading objects with an anomaly rate exceeding 10% are detected during these multiple detection periods. However, when the total duration of multiple detection periods is set to 6 hours and the preset threshold is 90%, only 4 trading objects have an anomaly rate exceeding 90% during these multiple detection periods. This demonstrates that a higher preset threshold and a longer duration of multiple detection periods significantly reduce the number of abnormal trading objects. Therefore, the number of abnormal trading objects can be controlled by setting a preset threshold and the duration of multiple detection periods.

[0106] Specifically, when the preset threshold is set to 90%, the change in the number of abnormal trading objects is minimal regardless of the values ​​across multiple detection periods. This indicates that a preset threshold of 90% is currently the optimal threshold for trading objects with low trading volumes. As the trading volume of a trading object increases or its trading pattern changes, the appropriate range of the preset threshold is adaptively adjusted. For trading objects with high trading volume and / or frequency, a shorter time span ensures timely detection of anomalies, while for trading objects with low trading volume and / or frequency, a longer time span is more suitable.

[0107] In this embodiment, M transaction elements are divided into N transaction dimensions, and the transaction elements contained in the N transaction dimensions are combined to obtain L transaction objects. For each selected transaction object, the anomaly detection result is determined based on the target transaction data of the transaction object in multiple detection periods. This application refines different transaction objects based on transaction dimensions and transaction elements, and obtains anomaly detection results based on the target transaction data of different transaction objects. Compared with the existing anomaly detection method that uses a uniform set of alarm thresholds for all transactions, this application is more targeted, ensuring the accuracy of anomaly detection for transaction objects with small transaction volumes. At the same time, by setting multiple detection periods and obtaining anomaly detection results based on the target transaction data of multiple detection periods, it is easier to manage the number of abnormal transaction objects. Secondly, this application first divides the M transaction elements into N transaction dimensions, and then combines the N transaction dimensions to obtain L transaction objects. Compared with directly combining a large number of transaction elements, this avoids a surge in the number of transaction objects and reduces the number of detection results. This is easier to maintain and ensures the stability of the daily operation of the trading institution.

[0108] Based on the same technical concept, this application provides a schematic diagram of the structure of a transaction object anomaly detection device, as shown in Figure 4. The transaction object anomaly detection device 400 includes:

[0109] The acquisition module 401 is used to acquire M transaction elements, divide the M transaction elements into N transaction dimensions, each transaction dimension contains at least one transaction element, N and M are positive integers, and N is less than M;

[0110] The transaction elements contained in the N transaction dimensions are combined to obtain L transaction objects. Each transaction object contains N transaction elements, which are obtained from the N transaction dimensions, and L is a positive integer.

[0111] The processing module 402 is used to obtain the anomaly detection result of each selected transaction object based on the target transaction data of the transaction object in multiple detection periods.

[0112] Optionally, the processing module 402 is specifically used for:

[0113] For each of the multiple detection periods, the following operations are performed: based on the historical transaction data of the transaction object within a detection period, determine the alarm threshold corresponding to the detection period; based on the target transaction data of the transaction object within the detection period and the alarm threshold corresponding to the detection period, obtain the sub-detection result of the transaction object within the detection period.

[0114] Based on the sub-detection results corresponding to each of the multiple detection time periods, the anomaly detection results of the transaction object are obtained.

[0115] Optionally, the processing module 402 is specifically used for:

[0116] Determine the standard deviation of the historical transaction data of the transaction object within a detection period;

[0117] Based on the standard deviation and the preset dynamic coefficient, the alarm threshold corresponding to the detection period is determined.

[0118] Optionally, the processing module 402 is specifically used for:

[0119] If the target transaction data of the transaction object within the detection period is greater than the alarm threshold corresponding to the detection period, then the sub-detection result is a local anomaly.

[0120] If the target transaction data of the transaction object within the detection period is not greater than the alarm threshold corresponding to the detection period, then the sub-detection result is locally normal.

[0121] Optionally, the processing module 402 is specifically used for:

[0122] For each of the multiple detection periods, the abnormality rate of the transaction object in the multiple detection periods is calculated based on the sub-detection results.

[0123] If the anomaly ratio is greater than or equal to a preset threshold, the anomaly detection result of the transaction object is abnormal; otherwise, the anomaly detection result of the transaction object is normal.

[0124] In this embodiment, M transaction elements are divided into N transaction dimensions, and the transaction elements contained in the N transaction dimensions are combined to obtain L transaction objects. For each selected transaction object, the anomaly detection result is determined based on the target transaction data of the transaction object in multiple detection periods. This application refines different transaction objects based on transaction dimensions and transaction elements, and obtains anomaly detection results based on the target transaction data of different transaction objects. Compared with the existing anomaly detection method that uses a uniform set of alarm thresholds for all transactions, this application is more targeted, ensuring the accuracy of anomaly detection for transaction objects with small transaction volumes. At the same time, by setting multiple detection periods and obtaining anomaly detection results based on the target transaction data of multiple detection periods, it is easier to manage the number of abnormal transaction objects. Secondly, this application first divides the M transaction elements into N transaction dimensions, and then combines the N transaction dimensions to obtain L transaction objects. Compared with directly combining a large number of transaction elements, this avoids a surge in the number of transaction objects and reduces the number of detection results, which is easier to maintain and ensures the stability of the daily operation of the trading institution.

[0125] Based on the same technical concept, this application provides a computer device, which can be the server shown in FIG1. ​​As shown in FIG5, it includes at least one processor 501 and a memory 502 connected to at least one processor. In this application embodiment, the specific linking medium between the processor 501 and the memory 502 is not limited. FIG5 shows the processor 501 and the memory 502 connected via a bus. The bus can be divided into address bus, data bus, control bus, etc.

[0126] In this embodiment of the application, the memory 502 stores instructions executed by at least one processor 501. By executing the instructions stored in the memory 502, at least one processor 501 can perform the steps of the above-described abnormal detection method for transaction objects.

[0127] The processor 501 is the control center of the computer device. It can connect to various parts of the computer device using various interfaces and lines. By running or executing instructions stored in the memory 502 and calling data stored in the memory 502, it can detect anomalies in transaction objects. Optionally, the processor 501 may include one or more processing modules. The processor 501 may integrate an application processor and a modem processor. The application processor mainly handles the operating system, user interface, and applications, while the modem processor mainly handles wireless communication. It is understood that the modem processor may not be integrated into the processor 501. In some embodiments, the processor 501 and the memory 502 may be implemented on the same chip; in some embodiments, they may also be implemented on separate chips.

[0128] Processor 501 can be a general-purpose processor, such as a central processing unit (CPU), digital signal processor, application-specific integrated circuit (ASIC), field-programmable gate array (FPGA), or other programmable logic device, discrete gate or transistor logic device, or discrete hardware component, capable of implementing or executing the methods, steps, and logic block diagrams disclosed in the embodiments of this application. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the methods disclosed in the embodiments of this application can be directly manifested as being executed by a hardware processor, or executed by a combination of hardware and software modules within the processor.

[0129] Memory 502, as a non-volatile computer-readable storage medium, can be used to store non-volatile software programs, non-volatile computer-executable programs, and modules. Memory 502 may include at least one type of storage medium, such as flash memory, hard disk, multimedia card, card-type memory, random access memory (RAM), static random access memory (SRAM), programmable read-only memory (PROM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), magnetic storage, magnetic disk, optical disk, etc. Memory 502 can be any other medium capable of carrying or storing desired program code in the form of instructions or data structures and accessible by a computer device, but is not limited thereto. In the embodiments of this application, memory 502 can also be a circuit or any other device capable of implementing storage functions for storing program instructions and / or data.

[0130] Based on the same inventive concept, embodiments of this application provide a computer-readable storage medium storing a computer program executable by a computer device, which, when run on the computer device, causes the computer device to perform the steps of the above-mentioned anomaly detection method for transaction objects.

[0131] Based on the same inventive concept, embodiments of this application provide a computer program product, including a computer program stored on a computer-readable storage medium. The computer program includes program instructions, which, when executed by a computer device, cause the computer device to perform the steps of the above-described method for detecting anomalies in transaction objects.

[0132] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0133] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to this application. It should be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions specified in one or more blocks of the flowchart illustrations and / or one or more blocks of the block diagrams.

[0134] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means that implement the functions specified in one or more flowcharts and / or one or more block diagrams.

[0135] These computer program instructions may also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer-implemented process, such that the instructions, which execute on the computer or other programmable apparatus, provide steps for implementing the functions specified in one or more flowcharts and / or one or more block diagrams.

[0136] Obviously, those skilled in the art can make various modifications and variations to this application without departing from the spirit and scope of this application. Therefore, if such modifications and variations fall within the scope of the claims of this application and their equivalents, this application also intends to include such modifications and variations.

Claims

1. A method for detecting anomalies in trading objects, characterized in that, include: Obtain M transaction elements, divide the M transaction elements into N transaction dimensions, each transaction dimension contains at least one transaction element, N and M are positive integers, and N is less than M; The transaction elements contained in the N transaction dimensions are combined to obtain L transaction objects. Each transaction object contains N transaction elements, which are obtained from the N transaction dimensions, and L is a positive integer. For each selected transaction object, an anomaly detection result is obtained based on the target transaction data of the transaction object in multiple detection periods.

2. The method as described in claim 1, characterized in that, The step of obtaining the anomaly detection result of the transaction object based on the target transaction data of the transaction object in multiple detection periods includes: For each of the multiple detection periods, the following operations are performed: based on the historical transaction data of the transaction object within a detection period, determine the alarm threshold corresponding to the detection period; based on the target transaction data of the transaction object within the detection period and the alarm threshold corresponding to the detection period, obtain the sub-detection result of the transaction object within the detection period. Based on the sub-detection results corresponding to each of the multiple detection time periods, the anomaly detection results of the transaction object are obtained.

3. The method as described in claim 2, characterized in that, The step of determining the alarm threshold corresponding to the detection period based on the historical transaction data of the transaction object within a detection period includes: Determine the standard deviation of the historical transaction data of the transaction object within a detection period; Based on the standard deviation and the preset dynamic coefficient, the alarm threshold corresponding to the detection period is determined.

4. The method as described in claim 2, characterized in that, Obtaining the sub-detection results of the transaction object within the detection period includes: If the target transaction data of the transaction object within the detection period is greater than the alarm threshold corresponding to the detection period, then the sub-detection result is a local anomaly. If the target transaction data of the transaction object within the detection period is not greater than the alarm threshold corresponding to the detection period, then the sub-detection result is locally normal.

5. The method as described in claim 2, characterized in that, The process of obtaining the anomaly detection result of the transaction object based on the sub-detection results corresponding to each of the multiple detection time periods includes: For each of the multiple detection periods, the abnormality rate of the transaction object in the multiple detection periods is calculated based on the sub-detection results. If the anomaly ratio is greater than or equal to a preset threshold, the anomaly detection result of the transaction object is abnormal; otherwise, the anomaly detection result of the transaction object is normal.

6. The method according to any one of claims 1 to 5, characterized in that, The target transaction data includes at least one of the following: Number of failed transactions, number of successful transactions, transaction success rate, and transaction latency.

7. An anomaly detection device for a trading object, characterized in that, include: The acquisition module is used to acquire M transaction elements, divide the M transaction elements into N transaction dimensions, and each transaction dimension contains at least one transaction element. N and M are positive integers, and N is less than M. The transaction elements contained in the N transaction dimensions are combined to obtain L transaction objects. Each transaction object contains N transaction elements, which are obtained from the N transaction dimensions, and L is a positive integer. The processing module is used to obtain the anomaly detection result of each selected transaction object based on the target transaction data of the transaction object in multiple detection periods.

8. A computer device, characterized in that, include: Memory, used to store program instructions; A processor is configured to invoke program instructions stored in the memory and execute the steps of the method according to any one of claims 1 to 6 in accordance with the obtained program.

9. A computer-readable storage medium, characterized in that, It stores a computer program executable by a computer device, which, when run on the computer device, causes the computer device to perform the steps of the method according to any one of claims 1 to 6.

10. A computer program product, characterized in that, The computer program product includes a computer program stored on a computer-readable storage medium, the computer program including program instructions that, when executed by a computer device, cause the computer device to perform the steps of the method as described in any one of claims 1 to 6.

Images