CN111782900A - Abnormal service detection method and device, electronic equipment and storage medium - Google Patents
Abnormal service detection method and device, electronic equipment and storage medium Download PDFInfo
- Publication number
- CN111782900A CN111782900A CN202010793037.XA CN202010793037A CN111782900A CN 111782900 A CN111782900 A CN 111782900A CN 202010793037 A CN202010793037 A CN 202010793037A CN 111782900 A CN111782900 A CN 111782900A
- Authority
- CN
- China
- Prior art keywords
- rule
- data
- sub
- interaction data
- service interaction
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
- 230000002159 abnormal effect Effects 0.000 title claims abstract description 121
- 238000001514 detection method Methods 0.000 title claims abstract description 59
- 230000003993 interaction Effects 0.000 claims abstract description 144
- 238000003066 decision tree Methods 0.000 claims abstract description 95
- 238000000926 separation method Methods 0.000 claims abstract description 22
- 238000012545 processing Methods 0.000 claims abstract description 20
- 238000004422 calculation algorithm Methods 0.000 claims description 25
- 238000000034 method Methods 0.000 claims description 22
- 238000011156 evaluation Methods 0.000 claims description 20
- 238000004458 analytical method Methods 0.000 claims description 14
- 238000013016 damping Methods 0.000 claims description 10
- 238000012544 monitoring process Methods 0.000 claims description 8
- 238000004590 computer program Methods 0.000 claims description 5
- 238000010276 construction Methods 0.000 claims description 2
- 238000005516 engineering process Methods 0.000 abstract description 3
- 238000013473 artificial intelligence Methods 0.000 abstract description 2
- 230000006870 function Effects 0.000 description 7
- 230000002452 interceptive effect Effects 0.000 description 6
- 230000008569 process Effects 0.000 description 6
- 238000004364 calculation method Methods 0.000 description 4
- 238000010586 diagram Methods 0.000 description 4
- 238000000605 extraction Methods 0.000 description 3
- 230000005540 biological transmission Effects 0.000 description 2
- 230000008859 change Effects 0.000 description 2
- 238000013145 classification model Methods 0.000 description 2
- 238000004891 communication Methods 0.000 description 2
- 238000013135 deep learning Methods 0.000 description 2
- 239000004973 liquid crystal related substance Substances 0.000 description 2
- 230000003287 optical effect Effects 0.000 description 2
- 238000005457 optimization Methods 0.000 description 2
- 230000006399 behavior Effects 0.000 description 1
- 230000007547 defect Effects 0.000 description 1
- 238000012986 modification Methods 0.000 description 1
- 230000004048 modification Effects 0.000 description 1
- 230000002093 peripheral effect Effects 0.000 description 1
- 238000012216 screening Methods 0.000 description 1
- 238000006467 substitution reaction Methods 0.000 description 1
- 239000002699 waste material Substances 0.000 description 1
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
- G06F16/90—Details of database functions independent of the retrieved data types
- G06F16/903—Querying
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
- G06F16/90—Details of database functions independent of the retrieved data types
- G06F16/903—Querying
- G06F16/9035—Filtering based on additional data, e.g. user or group profiles
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
- G06F16/90—Details of database functions independent of the retrieved data types
- G06F16/906—Clustering; Classification
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
- G06N5/00—Computing arrangements using knowledge-based models
- G06N5/01—Dynamic search techniques; Heuristics; Dynamic trees; Branch-and-bound
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q40/00—Finance; Insurance; Tax strategies; Processing of corporate or income taxes
- G06Q40/04—Trading; Exchange, e.g. stocks, commodities, derivatives or currency exchange
Landscapes
- Engineering & Computer Science (AREA)
- Theoretical Computer Science (AREA)
- Databases & Information Systems (AREA)
- Physics & Mathematics (AREA)
- General Physics & Mathematics (AREA)
- Data Mining & Analysis (AREA)
- General Engineering & Computer Science (AREA)
- Computational Linguistics (AREA)
- Business, Economics & Management (AREA)
- Finance (AREA)
- Accounting & Taxation (AREA)
- Computing Systems (AREA)
- Software Systems (AREA)
- Mathematical Physics (AREA)
- Evolutionary Computation (AREA)
- Artificial Intelligence (AREA)
- Development Economics (AREA)
- Economics (AREA)
- Marketing (AREA)
- Strategic Management (AREA)
- Technology Law (AREA)
- General Business, Economics & Management (AREA)
- Management, Administration, Business Operations System, And Electronic Commerce (AREA)
- Data Exchanges In Wide-Area Networks (AREA)
Abstract
The invention relates to an artificial intelligence technology, and discloses an abnormal service detection method, which comprises the following steps: constructing an early warning rule group according to the data characteristics of historical service interaction data, and performing box separation processing to obtain a box separation rule set; calculating a kini coefficient of the box-dividing rule set to generate a sub-rule decision tree; generating an integrated rule decision tree according to the sub-rule decision tree, and obtaining a rule engine according to the integrated rule decision tree and the sub-rule decision tree; classifying the service interaction data to be detected by utilizing the rule engine, and identifying a data characteristic label; detecting the data marked as the common sample label to obtain abnormal business interaction data; and sending early warning information to a user according to the abnormal sample label and the abnormal service interaction data. The invention also relates to a block chain technology, and the historical service interaction data can be stored in the block chain. The invention can realize the abnormal service detection function covering various service data, improving the accuracy and being more stable.
Description
Technical Field
The present invention relates to the field of artificial intelligence technologies, and in particular, to a method and an apparatus for detecting abnormal traffic, an electronic device, and a computer-readable storage medium.
Background
The business scene is complicated and often involves various conditions and data, so that some abnormal businesses, such as suspicious transaction behaviors in foreign exchange business, may cause the transaction to be invalid and need to be withdrawn.
The existing intelligent early warning system for detecting abnormal services still has some defects, for example, a rule decision tree is simply established correspondingly based on a decision tree algorithm principle, so that the stability of a decision tree rule engine is easily reduced for pursuing an optimal kini coefficient, and the flexibility of the rule engine is low; the data volume of the covered service is small, and the accuracy of the obtained detection result is low.
Disclosure of Invention
The invention provides an abnormal service detection method, an abnormal service detection device, electronic equipment and a computer readable storage medium, and mainly aims to provide an abnormal service detection method which covers various service data, improves the accuracy and is more stable.
In order to achieve the above object, a method for detecting abnormal traffic provided by the present invention includes:
constructing an early warning rule group according to the data characteristics of historical service interaction data, and performing box separation processing on the early warning rule group to obtain a box separation rule set;
calculating a kini coefficient of the box-dividing rule set, and generating a sub-rule decision tree according to the kini coefficient;
generating an integrated rule decision tree according to the sub-rule decision tree, and obtaining a rule engine according to the integrated rule decision tree and the sub-rule decision tree;
classifying the service interaction data to be detected by utilizing the rule engine, and identifying a data feature label for the service interaction data to be detected according to the classification, wherein the data feature label comprises a common sample label and an abnormal sample label;
detecting the service interaction data to be detected marked as the common sample label to obtain abnormal service interaction data;
and sending early warning information to a user according to the abnormal sample label and the abnormal service interaction data.
Optionally, the establishing an early warning rule set according to the data characteristics of the historical service interaction data includes:
dividing the historical service interaction data according to the dimensions of the preset types, and performing service logic analysis on the historical service interaction data under each dimension;
extracting data characteristics in the historical service interaction data according to a service logic analysis result;
and constructing an early warning rule group according to the data characteristics.
Optionally, the calculating a kini coefficient of the binning rule set, and generating a sub-rule decision tree according to the kini coefficient includes:
calculating the damping coefficient of each rule in the box-dividing rule set by using a preset damping evaluation algorithm;
selecting the rule with the minimum kini coefficient value as the root node of the sub-rule decision tree;
calculating a kini coefficient for the remaining rules of the binning rule set using the kini evaluation algorithm;
selecting a rule with the smallest value of the kini coefficient as a child node of the root node;
judging whether a preset stopping condition is met, and when the stopping condition is not met, calculating a kini coefficient for the remaining rules of the box-dividing rule set by using the kini evaluation algorithm, and selecting the rule with the minimum kini coefficient value as a child node under the child node; and outputting a sub-rule decision tree consisting of the root node and the sub-nodes when a preset stop condition is met.
Optionally, the classifying the service interaction data to be detected by using the rule engine, and identifying the data feature tag for the service interaction data to be detected according to the classification includes:
comparing the service interaction data to be detected with a rule corresponding to a root node in the rule engine, judging whether the service interaction data to be detected accords with the rule, classifying the service interaction data to be detected according to a judgment result, and distributing the service interaction data to be detected to child nodes of the root node;
for each child node in the rule engine, comparing a sub data set allocated to the current child node with a rule corresponding to the child node, judging whether the sub data set meets the rule, classifying the sub data set according to a judgment result, and allocating the sub data set to the child node under the current child node to obtain a classification result;
and according to the classification result of the rule engine, identifying a data feature tag for the data in the service interaction data to be detected.
Optionally, the further detecting the to-be-detected service interaction data identified as the common sample label includes:
dividing the to-be-detected service interaction data marked as the common sample label into a plurality of sub-sample label data according to the service category of the to-be-detected service interaction data;
and carrying out anomaly detection on the plurality of sub-sample label data by using a pre-constructed standard monitoring model to obtain abnormal business interaction data.
In order to solve the above problem, the present invention further provides an abnormal service detection apparatus, including:
the early warning rule building module is used for building an early warning rule group according to the data characteristics of historical service interaction data and performing box separation processing on the early warning rule group to obtain a box separation rule set;
the sub-rule decision tree generation module is used for calculating the kini coefficient of the box-dividing rule set and generating a sub-rule decision tree according to the kini coefficient;
the rule engine generating module is used for generating an integrated rule decision tree according to the sub-rule decision tree and obtaining a rule engine according to the integrated rule decision tree and the sub-rule decision tree;
the data classification identification module is used for classifying the service interaction data to be detected by utilizing the rule engine and identifying a data characteristic label for the service interaction data to be detected according to the classification, wherein the data characteristic label comprises a common sample label and an abnormal sample label;
the data detection module is used for detecting the service interaction data to be detected, which is identified as a common sample label, so as to obtain abnormal service interaction data;
and the early warning message reminding module is used for sending an early warning message to a user according to the abnormal sample label and the abnormal service interaction data.
Optionally, when the early warning rule set is established according to the data characteristics of the historical service interaction data, the early warning rule building module performs the following operations:
dividing the historical service interaction data according to the dimensions of the preset types, and performing service logic analysis on the historical service interaction data under each dimension;
extracting data characteristics in the historical service interaction data according to a service logic analysis result;
and constructing an early warning rule group according to the data characteristics.
Optionally, when calculating a kini coefficient of the binning rule set and generating a sub-rule decision tree according to the kini coefficient, the sub-rule decision tree generating module performs the following operations:
calculating the damping coefficient of each rule in the box-dividing rule set by using a preset damping evaluation algorithm;
selecting the rule with the minimum kini coefficient value as the root node of the sub-rule decision tree;
calculating a kini coefficient for the remaining rules of the binning rule set using the kini evaluation algorithm;
selecting a rule with the smallest value of the kini coefficient as a child node of the root node;
judging whether a preset stopping condition is met, and when the stopping condition is not met, calculating a kini coefficient for the remaining rules of the box-dividing rule set by using the kini evaluation algorithm, and selecting the rule with the minimum kini coefficient value as a child node under the child node;
and outputting a sub-rule decision tree consisting of the root node and the sub-nodes when a preset stop condition is met.
In order to solve the above problem, the present invention also provides an electronic device, including:
a memory storing at least one instruction; and
and the processor executes the instructions stored in the memory to realize the abnormal service detection method.
In order to solve the above problem, the present invention further provides a computer-readable storage medium, where at least one instruction is stored, and the at least one instruction is executed by a processor in an electronic device to implement the abnormal traffic detection method according to any one of the above.
According to the embodiment of the invention, an early warning rule group is constructed according to the data characteristics of historical business interaction data, and the early warning rule group is subjected to box separation processing to obtain a box separation rule set, so that the stability of the data can be enhanced through the box separation processing, and the stability of a subsequent rule decision tree is improved; calculating the kini coefficient of the box-dividing rule set, and generating a sub-rule decision tree according to the kini coefficient, so that the data characteristics can be fully utilized, and the establishment of a subsequent rule engine is facilitated; generating an integrated rule decision tree according to the sub-rule decision tree, obtaining a rule engine according to the integrated rule decision tree and the sub-rule decision tree, and constructing the rule engine by using a framework of the integrated rule decision tree and the sub-rule decision tree, so that the flexibility of the rule engine is improved; detecting the service interaction data to be detected marked as the common sample label to obtain abnormal service interaction data, and detecting the common sample label to enlarge the detected service data volume; and sending early warning information to the user according to the abnormal sample label and the abnormal service interaction data, so that the accuracy of the detection result is improved. Therefore, the abnormal service detection method, the abnormal service detection device and the computer readable storage medium provided by the invention can realize the functions of covering various service data, improving the accuracy and more stably detecting the abnormal service.
Drawings
Fig. 1 is a schematic flow chart of a method for detecting abnormal traffic according to an embodiment of the present invention;
fig. 2 is a schematic flow chart of an early warning rule establishing method in the abnormal service detection method according to an embodiment of the present invention;
fig. 3 is a schematic flow chart of a method for generating a sub-rule decision tree in the abnormal service detection method according to an embodiment of the present invention;
fig. 4 is a schematic flowchart of a data feature tag identification method in an abnormal service detection method according to an embodiment of the present invention;
fig. 5 is a schematic flow chart of a data detection method in the abnormal service detection method according to an embodiment of the present invention;
fig. 6 is a schematic block diagram of an abnormal service detection apparatus according to an embodiment of the present invention;
fig. 7 is a schematic diagram of an internal structure of an electronic device implementing the abnormal service detection method according to an embodiment of the present invention;
the implementation, functional features and advantages of the objects of the present invention will be further explained with reference to the accompanying drawings.
Detailed Description
It should be understood that the specific embodiments described herein are merely illustrative of the invention and are not intended to limit the invention.
The execution subject of the abnormal service detection method provided by the embodiment of the present application includes, but is not limited to, at least one of electronic devices that can be configured to execute the method provided by the embodiment of the present application, such as a server and a terminal. In other words, the abnormal traffic detection method may be performed by software or hardware installed in the terminal device or the server device, and the software may be a block chain platform. The server includes but is not limited to: a single server, a server cluster, a cloud server or a cloud server cluster, and the like.
The invention provides a method for detecting abnormal business. Fig. 1 is a schematic flow chart of a method for detecting abnormal traffic according to an embodiment of the present invention.
In this embodiment, the abnormal service detection method includes:
s1, constructing an early warning rule group according to the data characteristics of the historical service interaction data, and performing box separation processing on the early warning rule group to obtain a box separation rule set.
Preferably, in the embodiment of the present invention, the historical business interaction data may be transaction data in an enterprise, for example, interaction data of businesses such as international reimbursement, closing remittance, trade financing and the like in a foreign exchange transaction business, and the like. The historical traffic interaction data may be obtained from nodes of a blockchain.
Further, referring to fig. 2, the establishing of the early warning rule set according to the data characteristics of the historical service interaction data includes:
s10, dividing the historical service interaction data according to preset kinds of dimensions, and performing service logic analysis on the historical service interaction data under each dimension;
s11, extracting data characteristics in the historical service interaction data according to the service logic analysis result;
and S12, constructing an early warning rule group according to the data characteristics.
The early warning rule group comprises a plurality of rules, and whether the actual service is abnormal or not can be judged according to the rules. The business logic analysis is to analyze the historical business interaction data divided according to the preset dimensionality according to the actual business process, so as to facilitate the subsequent extraction of data characteristics.
For example, original interaction data of product transactions such as international collection and payment, settlement and sales, trade financing and the like are divided according to dimensions including different product dimensions, different time series items, collection and payment, and the like, relevant data characteristics such as money amount, transaction frequency, collection and payment change frequency and the like are analyzed in each dimension, and an early warning rule set is formed according to the data characteristics, for example, if the transaction frequency of a certain product in one month is stable in a certain value range, early warning is performed on business data larger than the value range, and the business data serve as an early warning rule.
Further, the early warning rule group is subjected to box separation by adopting a preset box separation method, so that the rules of continuous variables contained in the early warning rules are divided into stable boxes, and a box separation rule set is obtained. The preset box dividing method comprises a chi-square box dividing method, an equidistant division method, an equal frequency division method and the like. The data characteristics in the early warning rules can be discretized through box separation processing, and the discretized characteristics have strong robustness on abnormal data and are convenient for subsequent calculation.
And S2, calculating a kini coefficient of the box-dividing rule set, and generating a sub-rule decision tree according to the kini coefficient.
In detail, referring to fig. 3, the S2 includes:
s20, calculating a kini coefficient of each rule in the box-dividing rule set by using a preset kini evaluation algorithm;
s21, selecting the rule with the minimum keney coefficient value as the root node of the sub-rule decision tree;
s22, calculating a kini coefficient for the remaining rules of the box-dividing rule set by using the kini evaluation algorithm;
s23, selecting a rule with the minimum keney coefficient value as a child node of the root node;
s24, judging whether a preset stopping condition is met, and when the stopping condition is not met, repeatedly executing S22 and S23, calculating a kini coefficient for the remaining rules of the box-dividing rule set by using the kini evaluation algorithm, and selecting the rule with the minimum kini coefficient value as a child node under the child node;
and when the preset stop condition is met, executing S25 and outputting a sub-rule decision tree consisting of the root node and the sub-nodes.
Preferably, in this embodiment of the present invention, the stop condition includes that the number of remaining rules in the binning rule set is smaller than a predetermined threshold, or a kini coefficient smaller than a predetermined threshold is obtained.
Preferably, in the embodiment of the present invention, the kini evaluation algorithm is as follows:
wherein D is the service interaction data, A is a rule in the binning rule set, and D1Is all data satisfying the rule A, D, in the service interaction data2Is all data not satisfying the rule A in the service interaction data, Gini (D)1) Is D1Gini (D)2) Is D2Gini (D, a) is the kini coefficient of the binning rule set corresponding to rule a.
And S3, generating an integrated rule decision tree according to the sub-rule decision tree, and obtaining a rule engine according to the integrated rule decision tree and the sub-rule decision tree.
In detail, in the embodiment of the present invention, the sub-rule decision trees are integrated based on the output of the sub-rule decision trees to generate the integrated rule decision tree; and combining the integrated rule decision tree and the sub-rule decision trees in a serial connection mode to obtain a rule engine.
In the embodiment of the invention, the rule engine is based on a decision tree algorithm and comprises a classifier of the sub-rule decision tree and the integrated rule decision tree, the stability between the partitioned areas can be solved to a certain extent by utilizing the rule engine, and the abnormal service identification can be realized by combining the constructed early warning rule.
The rule engine obtained in the embodiment of the invention can systematically integrate the relevant rules of actual services, and the framework of the sub-rule decision tree and the integrated rule decision tree is used on the basis of overlapping and binning, so that the overall flexibility, robustness and accuracy of the rule engine are enhanced, and the iterative optimization of the rule engine can be realized at the highest speed while abnormal services are identified.
S4, classifying the service interaction data to be detected by using the rule engine, and identifying data feature labels for the service interaction data to be detected according to the classification, wherein the data feature labels comprise common sample labels and abnormal sample labels.
In detail, referring to fig. 4, the classifying the service interaction data to be detected by using the rule engine, and identifying the data feature tag for the service interaction data to be detected according to the classification includes:
s40, comparing the service interaction data to be detected with a rule corresponding to a root node in the rule engine, judging whether the service interaction data to be detected accords with the rule, classifying the service interaction data to be detected according to a judgment result, and distributing the service interaction data to be detected to child nodes of the root node;
in detail, in the embodiment of the present invention, the service interaction data to be detected is divided into two sub data sets according to whether the service interaction data to be detected meets the rule, where the two sub data sets include a first sub data set meeting the rule and a second sub data set not meeting the rule, and the first sub data set is allocated to the first sub node of the root node, and the second sub data set is allocated to the second sub node of the root node.
S41, comparing the sub data set distributed to the current sub node with the rule corresponding to the sub node for each sub node in the rule engine, judging whether the sub data set meets the rule, classifying the sub data set according to the judgment result and distributing the sub data set to the sub node under the current sub node to obtain a classification result;
in the embodiment of the invention, each sub-node in the rule engine classifies the sub-data sets distributed to the current sub-node again until the current sub-node has no sub-node, so as to finish classifying the interactive data of the service to be detected and obtain the classification result of the rule engine.
And S42, respectively marking the data in the service interaction data to be detected as a common sample label and an abnormal sample label according to the classification result of the rule engine.
Preferably, after the classification calculation is completed, the embodiment of the present invention identifies data in the interactive data of the service to be detected, which conforms to the corresponding rule in the rule engine, as an abnormal sample label, and identifies the remaining data as a normal sample label.
And S5, detecting the service interaction data to be detected marked as the common sample label to obtain abnormal service interaction data.
In detail, referring to fig. 5, the detecting the service interaction data to be detected, which is identified as a common sample label, includes:
s50, dividing the to-be-detected service interaction data marked as the common sample label into a plurality of sub-sample label data according to the service category of the to-be-detected service interaction data;
furthermore, the service interactive data to be detected is divided into the sub-sample notepad data according to the service category, so that the subsequent abnormal detection is conveniently carried out according to the service category.
For example, the service interaction data to be detected, which is identified as a common sample label, includes various types of data, and may be divided into multiple sub-sample label data such as an international reimbursement declaration type, a foreign exchange account submission type, and a core transaction type.
And S51, carrying out anomaly detection on the plurality of sub-sample label data by using a pre-constructed standard monitoring model to obtain abnormal business interaction data.
Further, the standard monitoring model is a classification model for detecting an anomaly, which is established based on a deep learning algorithm, and the standard monitoring model performs anomaly detection on the plurality of subsample label data, and comprises:
extracting service characteristic information of the plurality of sub-sample label data;
matching the service characteristic information with a preset sensitive keyword library;
and collecting the successfully matched sample data of the corresponding sub-label to obtain abnormal service interaction data.
And S6, sending an early warning message to the user according to the abnormal sample label and the abnormal service interaction data.
Further, identifying the to-be-detected service interaction data corresponding to the abnormal sample label and the actual service corresponding to the abnormal service interaction data as an abnormal service, and sending early warning information to the user, so that the user can further process the abnormal service according to the early warning information, for example: and terminating the abnormal service, converting the abnormal service into manual processing and the like.
According to the embodiment of the invention, the target data set with the state identifier as the preset identifier is obtained from the original pushed data set, and the data which is not successfully pushed in the original pushed data set is separated by using the state identifier, so that the original pushed data set is conveniently pushed again in the follow-up process; acquiring original pushed data with a group trust value lower than a trust threshold value in the cluster data and collecting the original pushed data with the target data set to obtain an initial pushed data set, classifying the original pushed data set without being successfully pushed but without the state identification by using the group trust value, screening out data needing to be continuously pushed and collecting the data needing to be continuously pushed with the target data set, and ensuring that all the data needing to be pushed are not missed to be pushed; performing feature extraction on the initial push data set to obtain a feature set, performing deduplication processing on the initial push data set according to the feature set to obtain a data set to be pushed, and performing deduplication processing to reduce the data volume, reduce the cost of subsequent pushing and improve the efficiency of abnormal service detection; and configuring a transmission file of the non-repeating data set, transmitting the non-repeating data set to an abnormal business detection engine according to the transmission file, pushing data contained in the non-repeating data set by using the abnormal business detection engine, and pushing by using the abnormal business detection engine, so that the success rate of abnormal business detection is ensured, and the occupation and waste of computing resources are reduced. Therefore, the abnormal service detection method, the abnormal service detection device and the computer readable storage medium provided by the invention can realize the purpose of detecting the abnormal service with low cost and high success rate.
Fig. 6 is a functional block diagram of the abnormal traffic detection apparatus according to the present invention.
The abnormal service detection apparatus 100 of the present invention may be installed in an electronic device. According to the realized function, the abnormal service detection device may include an early warning rule construction module 101, a sub-rule decision tree generation module 102, a rule engine generation module 103, a data classification identification module 104, a data detection module 105, and an early warning message reminding module 106. A module according to the present invention, which may also be referred to as a unit, refers to a series of computer program segments that can be executed by a processor of an electronic device and that can perform a fixed function, and that are stored in a memory of the electronic device.
In the present embodiment, the functions regarding the respective modules/units are as follows:
the early warning rule building module 101 is configured to build an early warning rule group according to data characteristics of historical service interaction data, and perform binning processing on the early warning rule group to obtain a binning rule set.
Preferably, in the embodiment of the present invention, the historical business interaction data may be transaction data in an enterprise, for example, interaction data of businesses such as international reimbursement, closing remittance, trade financing and the like in a foreign exchange transaction business, and the like. The historical traffic interaction data may be obtained from nodes of a blockchain.
Further, the early warning rule building module 101 builds an early warning rule group by the following means:
dividing the historical service interaction data according to the dimensions of the preset types, and performing service logic analysis on the historical service interaction data under each dimension;
extracting data characteristics in the historical service interaction data according to a service logic analysis result;
and constructing an early warning rule group according to the data characteristics.
The early warning rule group comprises a plurality of rules, and whether the actual service is abnormal or not can be judged according to the rules. The business logic analysis is to analyze the business interaction data divided according to the preset dimensionality according to the actual business process, so as to facilitate the subsequent extraction of data characteristics.
For example, the early warning rule building module 101 divides original interaction data of product transactions such as international reimbursement, settlement and sales, trade financing and the like according to dimensions including different product dimensions, different time series items, remittance and the like, analyzes related data characteristics such as amount of money, transaction frequency, reimbursement change frequency and the like in each dimension, and forms an early warning rule group according to the data characteristics, and if the transaction frequency of a certain product in a month is stable in a certain numerical range, early warning is performed on business data larger than the numerical range to serve as an early warning rule.
Further, the embodiment of the invention performs binning processing on the early warning rule group by using a preset binning operation, so that the rules of continuous variables contained in the early warning rules are divided into stable bins to obtain a bin rule set. Wherein the preset box dividing operation comprises chi-square box dividing, equidistant dividing, equal-frequency dividing and the like. The data characteristics in the early warning rules can be discretized through box separation processing, and the discretized characteristics have strong robustness on abnormal data and are convenient for subsequent calculation.
The sub-rule decision tree generating module 102 is configured to calculate a kini coefficient of the binning rule set, and generate a sub-rule decision tree according to the kini coefficient.
In detail, the sub-rule decision tree generating module 102 is specifically configured to:
calculating the damping coefficient of each rule in the box-dividing rule set by using a preset damping evaluation algorithm;
selecting the rule with the minimum kini coefficient value as the root node of the sub-rule decision tree;
calculating a kini coefficient for the remaining rules of the binning rule set using the kini evaluation algorithm;
selecting a rule with the smallest value of the kini coefficient as a child node of the root node;
judging whether a preset stopping condition is met, and when the stopping condition is not met, calculating a kini coefficient for the remaining rules of the box-dividing rule set by using the kini evaluation algorithm, and selecting the rule with the minimum kini coefficient value as a child node under the child node; and outputting a sub-rule decision tree consisting of the root node and the sub-nodes when a preset stop condition is met.
Preferably, in this embodiment of the present invention, the stop condition includes that the number of remaining rules in the binning rule set is smaller than a predetermined threshold, or a kini coefficient smaller than a predetermined threshold is obtained.
Preferably, in the embodiment of the present invention, the kini evaluation algorithm is as follows:
wherein D is the service interaction data, A is a rule in the binning rule set, and D1Is all data satisfying the rule A, D, in the service interaction data2Is all data not satisfying the rule A in the service interaction data, Gini (D)1) Is D1Gini (D)2) Is D2Gini (D, a) is the kini coefficient of the binning rule set corresponding to rule a.
The rule engine generating module 103 is configured to generate an integrated rule decision tree according to the sub-rule decision tree, and obtain a rule engine according to the integrated rule decision tree and the sub-rule decision tree.
In detail, the rule engine generating module 103 according to the embodiment of the present invention integrates the sub-rule decision trees based on the output of the sub-rule decision trees to generate the integrated rule decision tree, and combines the integrated rule decision tree and the sub-rule decision trees in a serial manner to obtain a rule engine.
In the embodiment of the invention, the rule engine is based on a decision tree algorithm and comprises a classifier of the sub-rule decision tree and the integrated rule decision tree, the stability between the partitioned areas can be solved to a certain extent by utilizing the rule engine, and the abnormal service identification can be realized by combining the constructed early warning rule.
The rule engine obtained in the embodiment of the invention can systematically integrate the relevant rules of actual services, and the framework of the sub-rule decision tree and the integrated rule decision tree is used on the basis of overlapping and binning, so that the overall flexibility, robustness and accuracy of the rule engine are enhanced, and the iterative optimization of the rule engine can be realized at the highest speed while abnormal services are identified.
The data classification identification module 104 is configured to classify the service interaction data to be detected by using the rule engine, and identify a data feature tag for the service interaction data to be detected according to the classification, where the data feature tag includes a normal sample tag and an abnormal sample tag.
In detail, the data classification identification module 104 is specifically configured to perform the following operations:
comparing the service interaction data to be detected with a rule corresponding to a root node in the rule engine, judging whether the service interaction data to be detected accords with the rule, classifying the service interaction data to be detected according to a judgment result, and distributing the service interaction data to be detected to child nodes of the root node.
In detail, in the embodiment of the present invention, the service interaction data to be detected is divided into two sub data sets according to whether the service interaction data to be detected meets the rule, where the two sub data sets include a first sub data set meeting the rule and a second sub data set not meeting the rule, and the first sub data set is allocated to the first sub node of the root node, and the second sub data set is allocated to the second sub node of the root node.
Comparing a sub data set distributed to the current sub node with a rule corresponding to the sub node for each sub node in the rule engine, judging whether the sub data set meets the rule, classifying the sub data set according to a judgment result, and distributing the sub data set to the sub node under the current sub node to obtain a classification result;
in the embodiment of the invention, each sub-node in the rule engine classifies the sub-data sets distributed to the current sub-node again until the current sub-node has no sub-node, so as to finish classifying the interactive data of the service to be detected and obtain the classification result of the rule engine.
And thirdly, according to the classification result of the rule engine, respectively identifying the data in the service interaction data to be detected as a common sample label and an abnormal sample label.
Preferably, after the classification calculation is completed, the data classification identification module 104 according to the embodiment of the present invention identifies data that meets the rule in the rule engine in the service interaction data to be detected as an abnormal sample label, and identifies the remaining data as a normal sample label.
The data detection module 105 is configured to detect the to-be-detected service interaction data identified as the common sample label, so as to obtain abnormal service interaction data.
In detail, the data detection module 105 performs detection on the service interaction data to be detected, which is identified as a common sample label, by:
dividing the to-be-detected service interaction data marked as the common sample label into a plurality of sub-sample label data according to the service category of the to-be-detected service interaction data;
and carrying out anomaly detection on the plurality of sub-sample label data by using a pre-constructed standard monitoring model to obtain abnormal business interaction data.
And dividing the service interactive data to be detected into sub-sample notepad data according to the service class of the service interactive data to be detected, so as to facilitate subsequent abnormal detection according to the service class.
Further, the standard monitoring model is a classification model for detecting an anomaly, which is established based on a deep learning algorithm, and the standard monitoring model performs anomaly detection on the plurality of subsample label data, and comprises:
extracting service characteristic information of the plurality of sub-sample label data;
matching the service characteristic information with a preset sensitive keyword library;
and collecting the successfully matched sample data of the corresponding sub-label to obtain abnormal service interaction data.
The warning message reminding module 106 is configured to send a warning message to a user according to the abnormal sample tag and the abnormal service interaction data.
Further, the warning message reminding module 106 identifies the to-be-detected service interaction data corresponding to the abnormal sample label and the actual service corresponding to the abnormal service interaction data as an abnormal service, and sends warning information to the user, so that the user can further process the abnormal service according to the warning message, for example: and terminating the abnormal service, converting the abnormal service into manual processing and the like.
Fig. 7 is a schematic structural diagram of an electronic device implementing the abnormal service detection method according to the present invention.
The electronic device 1 may comprise a processor 10, a memory 11 and a bus, and may further comprise a computer program, such as an abnormal traffic detection program 12, stored in the memory 11 and executable on the processor 10.
The memory 11 includes at least one type of readable storage medium, which includes flash memory, removable hard disk, multimedia card, card-type memory (e.g., SD or DX memory, etc.), magnetic memory, magnetic disk, optical disk, etc. The memory 11 may in some embodiments be an internal storage unit of the electronic device 1, such as a removable hard disk of the electronic device 1. The memory 11 may also be an external storage device of the electronic device 1 in other embodiments, such as a plug-in mobile hard disk, a Smart Media Card (SMC), a Secure Digital (SD) Card, a Flash memory Card (Flash Card), and the like, which are provided on the electronic device 1. Further, the memory 11 may also include both an internal storage unit and an external storage device of the electronic device 1. The memory 11 may be used not only to store application software installed in the electronic device 1 and various types of data, such as codes of the abnormal traffic detection program 12, but also to temporarily store data that has been output or is to be output.
The processor 10 may be composed of an integrated circuit in some embodiments, for example, a single packaged integrated circuit, or may be composed of a plurality of integrated circuits packaged with the same or different functions, including one or more Central Processing Units (CPUs), microprocessors, digital Processing chips, graphics processors, and combinations of various control chips. The processor 10 is a Control Unit (Control Unit) of the electronic device, connects various components of the electronic device by using various interfaces and lines, and executes various functions and processes data of the electronic device 1 by running or executing programs or modules (for example, executing an abnormal service detection program and the like) stored in the memory 11 and calling data stored in the memory 11.
The bus may be a Peripheral Component Interconnect (PCI) bus, an Extended Industry Standard Architecture (EISA) bus, or the like. The bus may be divided into an address bus, a data bus, a control bus, etc. The bus is arranged to enable connection communication between the memory 11 and at least one processor 10 or the like.
Fig. 7 only shows an electronic device with components, and it will be understood by a person skilled in the art that the structure shown in fig. 7 does not constitute a limitation of the electronic device 1, and may comprise fewer or more components than shown, or a combination of certain components, or a different arrangement of components.
For example, although not shown, the electronic device 1 may further include a power supply (such as a battery) for supplying power to each component, and preferably, the power supply may be logically connected to the at least one processor 10 through a power management device, so as to implement functions of charge management, discharge management, power consumption management, and the like through the power management device. The power supply may also include any component of one or more dc or ac power sources, recharging devices, power failure detection circuitry, power converters or inverters, power status indicators, and the like. The electronic device 1 may further include various sensors, a bluetooth module, a Wi-Fi module, and the like, which are not described herein again.
Further, the electronic device 1 may further include a network interface, and optionally, the network interface may include a wired interface and/or a wireless interface (such as a WI-FI interface, a bluetooth interface, etc.), which are generally used for establishing a communication connection between the electronic device 1 and other electronic devices.
Optionally, the electronic device 1 may further comprise a user interface, which may be a Display (Display), an input unit (such as a Keyboard), and optionally a standard wired interface, a wireless interface. Alternatively, in some embodiments, the display may be an LED display, a liquid crystal display, a touch-sensitive liquid crystal display, an OLED (Organic Light-Emitting Diode) touch device, or the like. The display, which may also be referred to as a display screen or display unit, is suitable for displaying information processed in the electronic device 1 and for displaying a visualized user interface, among other things.
It is to be understood that the described embodiments are for purposes of illustration only and that the scope of the appended claims is not limited to such structures.
The abnormal traffic detection program 12 stored in the memory 11 of the electronic device 1 is a combination of instructions, which when executed in the processor 10, can implement:
constructing an early warning rule group according to the data characteristics of historical service interaction data, and performing box separation processing on the early warning rule group to obtain a box separation rule set;
calculating a kini coefficient of the box-dividing rule set, and generating a sub-rule decision tree according to the kini coefficient;
generating an integrated rule decision tree according to the sub-rule decision tree, and obtaining a rule engine according to the integrated rule decision tree and the sub-rule decision tree;
classifying the service interaction data to be detected by utilizing the rule engine, and identifying a data feature label for the service interaction data to be detected according to the classification, wherein the data feature label comprises a common sample label and an abnormal sample label;
detecting the service interaction data to be detected marked as the common sample label to obtain abnormal service interaction data;
and sending early warning information to a user according to the abnormal sample label and the abnormal service interaction data.
Further, the integrated modules/units of the electronic device 1, if implemented in the form of software functional units and sold or used as separate products, may be stored in a computer readable storage medium. The computer-readable medium may include: any entity or device capable of carrying said computer program code, recording medium, U-disk, removable hard disk, magnetic disk, optical disk, computer Memory, Read-Only Memory (ROM).
In the embodiments provided in the present invention, it should be understood that the disclosed apparatus, device and method can be implemented in other ways. For example, the above-described apparatus embodiments are merely illustrative, and for example, the division of the modules is only one logical functional division, and other divisions may be realized in practice.
The modules described as separate parts may or may not be physically separate, and parts displayed as modules may or may not be physical units, may be located in one place, or may be distributed on a plurality of network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of the present embodiment.
In addition, functional modules in the embodiments of the present invention may be integrated into one processing unit, or each unit may exist alone physically, or two or more units are integrated into one unit. The integrated unit can be realized in a form of hardware, or in a form of hardware plus a software functional module.
It will be evident to those skilled in the art that the invention is not limited to the details of the foregoing illustrative embodiments, and that the present invention may be embodied in other specific forms without departing from the spirit or essential attributes thereof.
The present embodiments are therefore to be considered in all respects as illustrative and not restrictive, the scope of the invention being indicated by the appended claims rather than by the foregoing description, and all changes which come within the meaning and range of equivalency of the claims are therefore intended to be embraced therein. Any accompanying claims should not be construed as limiting the claim concerned.
Furthermore, it is obvious that the word "comprising" does not exclude other elements or steps, and the singular does not exclude the plural. A plurality of units or means recited in the system claims may also be implemented by one unit or means in software or hardware. The terms second, etc. are used to denote names, but not any particular order.
Finally, it should be noted that the above embodiments are only for illustrating the technical solutions of the present invention and not for limiting, and although the present invention is described in detail with reference to the preferred embodiments, it should be understood by those skilled in the art that modifications or equivalent substitutions may be made on the technical solutions of the present invention without departing from the spirit and scope of the technical solutions of the present invention.
Claims (10)
1. A method for detecting abnormal traffic, the method comprising:
establishing an early warning rule group according to the data characteristics of historical service interaction data, and performing box separation processing on the early warning rule group to obtain a box separation rule set;
calculating a kini coefficient of the box-dividing rule set, and generating a sub-rule decision tree according to the kini coefficient;
generating an integrated rule decision tree according to the sub-rule decision tree, and obtaining a rule engine according to the integrated rule decision tree and the sub-rule decision tree;
classifying the service interaction data to be detected by utilizing the rule engine, and identifying a data feature label for the service interaction data to be detected according to the classification, wherein the data feature label comprises a common sample label and an abnormal sample label;
detecting the service interaction data to be detected marked as the common sample label to obtain abnormal service interaction data;
and sending early warning information to a user according to the abnormal sample label and the abnormal service interaction data.
2. The abnormal traffic detection method according to claim 1, wherein the establishing of the early warning rule set according to the data characteristics of the historical traffic interaction data comprises:
dividing the historical service interaction data according to the dimensions of the preset types, and performing service logic analysis on the historical service interaction data under each dimension;
extracting data characteristics in the historical service interaction data according to a service logic analysis result;
and constructing an early warning rule group according to the data characteristics.
3. The abnormal traffic detection method according to claim 1, wherein said calculating a kini coefficient of the binning rule set and generating a sub-rule decision tree based on the kini coefficient comprises:
calculating the damping coefficient of each rule in the box-dividing rule set by using a preset damping evaluation algorithm;
selecting the rule with the minimum kini coefficient value as the root node of the sub-rule decision tree;
calculating a kini coefficient for the remaining rules of the binning rule set using the kini evaluation algorithm;
selecting a rule with the smallest value of the kini coefficient as a child node of the root node; judging whether a preset stopping condition is met, and when the stopping condition is not met, calculating a kini coefficient for the remaining rules of the box-dividing rule set by using the kini evaluation algorithm, and selecting the rule with the minimum kini coefficient value as a child node under the child node;
and outputting a sub-rule decision tree consisting of the root node and the sub-nodes when a preset stop condition is met.
4. The abnormal service detection method according to claim 3, wherein said classifying the service interaction data to be detected by using the rule engine, and identifying the data feature tag for the service interaction data to be detected according to the classification comprises:
comparing the service interaction data to be detected with a rule corresponding to a root node in the rule engine, judging whether the service interaction data to be detected accords with the rule, classifying the service interaction data to be detected according to a judgment result, and distributing the service interaction data to be detected to child nodes of the root node;
for each child node in the rule engine, comparing a sub data set allocated to the current child node with a rule corresponding to the child node, judging whether the sub data set meets the rule, classifying the sub data set according to a judgment result, and allocating the sub data set to the child node under the current child node to obtain a classification result;
and according to the classification result of the rule engine, identifying a data feature tag for the data in the service interaction data to be detected.
5. The abnormal service detection method according to claim 1, wherein the detecting the service interaction data to be detected, which is identified as a common sample label, comprises:
dividing the to-be-detected service interaction data marked as the common sample label into a plurality of sub-sample label data according to the service category of the to-be-detected service interaction data;
and carrying out anomaly detection on the plurality of sub-sample label data by using a pre-constructed standard monitoring model to obtain abnormal business interaction data.
6. An abnormal traffic detection apparatus, characterized in that the apparatus comprises:
the early warning rule building module is used for building an early warning rule group according to the data characteristics of historical service interaction data and performing box separation processing on the early warning rule group to obtain a box separation rule set;
the sub-rule decision tree generation module is used for calculating the kini coefficient of the box-dividing rule set and generating a sub-rule decision tree according to the kini coefficient;
the rule engine generating module is used for generating an integrated rule decision tree according to the sub-rule decision tree and obtaining a rule engine according to the integrated rule decision tree and the sub-rule decision tree;
the data classification identification module is used for classifying the service interaction data to be detected by utilizing the rule engine and identifying a data characteristic label for the service interaction data to be detected according to the classification, wherein the data characteristic label comprises a common sample label and an abnormal sample label;
the data detection module is used for detecting the service interaction data to be detected, which is identified as a common sample label, so as to obtain abnormal service interaction data;
and the early warning message reminding module is used for sending an early warning message to a user according to the abnormal sample label and the abnormal service interaction data.
7. The abnormal traffic detection apparatus of claim 6, wherein, when the early warning rule set is established according to the data characteristics of the historical traffic interaction data, the early warning rule construction module performs the following operations:
dividing the historical service interaction data according to the dimensions of the preset types, and performing service logic analysis on the historical service interaction data under each dimension;
extracting data characteristics in the historical service interaction data according to a service logic analysis result;
and constructing an early warning rule group according to the data characteristics.
8. The abnormal traffic detection apparatus according to claim 6, wherein when calculating a kini coefficient of the binning rule set and generating a sub-rule decision tree based on the kini coefficient, the sub-rule decision tree generation module performs the following operations:
calculating the damping coefficient of each rule in the box-dividing rule set by using a preset damping evaluation algorithm;
selecting the rule with the minimum kini coefficient value as the root node of the sub-rule decision tree;
calculating a kini coefficient for the remaining rules of the binning rule set using the kini evaluation algorithm;
selecting a rule with the smallest value of the kini coefficient as a child node of the root node;
judging whether a preset stopping condition is met, and when the stopping condition is not met, calculating a kini coefficient for the remaining rules of the box-dividing rule set by using the kini evaluation algorithm, and selecting the rule with the minimum kini coefficient value as a child node under the child node; and outputting a sub-rule decision tree consisting of the root node and the sub-nodes when a preset stop condition is met.
9. An electronic device, characterized in that the electronic device comprises:
a memory storing at least one instruction; and
a processor executing instructions stored in the memory to perform the abnormal traffic detection method of any of claims 1 to 5.
10. A computer-readable storage medium comprising a storage data area storing data created according to use of blockchain nodes and a storage program area storing a computer program, wherein the computer program when executed by a processor implements the abnormal traffic detection method according to any one of claims 1 to 5.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202010793037.XA CN111782900B (en) | 2020-08-06 | 2020-08-06 | Abnormal service detection method and device, electronic equipment and storage medium |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202010793037.XA CN111782900B (en) | 2020-08-06 | 2020-08-06 | Abnormal service detection method and device, electronic equipment and storage medium |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN111782900A true CN111782900A (en) | 2020-10-16 |
| CN111782900B CN111782900B (en) | 2024-03-19 |
Family
ID=72762412
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202010793037.XA Active CN111782900B (en) | 2020-08-06 | 2020-08-06 | Abnormal service detection method and device, electronic equipment and storage medium |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN111782900B (en) |
Cited By (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN112487033A (en) * | 2020-11-30 | 2021-03-12 | 国网山东省电力公司电力科学研究院 | Service visualization method and system for data flow and network topology construction |
| CN113837404A (en) * | 2021-08-30 | 2021-12-24 | 平安国际智慧城市科技股份有限公司 | False elevator maintenance work order identification method, device, equipment and storage medium |
| CN113923006A (en) * | 2021-09-30 | 2022-01-11 | 北京淇瑀信息科技有限公司 | Equipment data authentication method and device and electronic equipment |
| CN114363367A (en) * | 2021-12-09 | 2022-04-15 | 广东电网有限责任公司 | Service processing method and system based on edge Internet of things proxy |
| CN117669513A (en) * | 2024-01-30 | 2024-03-08 | 江苏古卓科技有限公司 | Data management system and method based on artificial intelligence |
Citations (8)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20080140602A1 (en) * | 2006-12-11 | 2008-06-12 | International Business Machines Corporation | Using a data mining algorithm to discover data rules |
| CN104298778A (en) * | 2014-11-04 | 2015-01-21 | 北京科技大学 | Method and system for predicting quality of rolled steel product based on association rule tree |
| US20160116892A1 (en) * | 2014-10-22 | 2016-04-28 | Industrial Technology Research Institute | Method and system of cause analysis and correction for manufacturing data |
| CN107993139A (en) * | 2017-11-15 | 2018-05-04 | 华融融通（北京）科技有限公司 | A kind of anti-fake system of consumer finance based on dynamic regulation database and method |
| CN108764273A (en) * | 2018-04-09 | 2018-11-06 | 中国平安人寿保险股份有限公司 | A kind of method, apparatus of data processing, terminal device and storage medium |
| CN109408583A (en) * | 2018-09-25 | 2019-03-01 | 平安科技（深圳）有限公司 | Data processing method and device, computer readable storage medium, electronic equipment |
| CN109587000A (en) * | 2018-11-14 | 2019-04-05 | 上海交通大学 | High latency method for detecting abnormality and system based on collective intelligence network measurement data |
| CN110348472A (en) * | 2019-05-24 | 2019-10-18 | 中国平安财产保险股份有限公司 | Data Detection rule generating method, device, computer equipment and storage medium |
-
2020
- 2020-08-06 CN CN202010793037.XA patent/CN111782900B/en active Active
Patent Citations (8)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20080140602A1 (en) * | 2006-12-11 | 2008-06-12 | International Business Machines Corporation | Using a data mining algorithm to discover data rules |
| US20160116892A1 (en) * | 2014-10-22 | 2016-04-28 | Industrial Technology Research Institute | Method and system of cause analysis and correction for manufacturing data |
| CN104298778A (en) * | 2014-11-04 | 2015-01-21 | 北京科技大学 | Method and system for predicting quality of rolled steel product based on association rule tree |
| CN107993139A (en) * | 2017-11-15 | 2018-05-04 | 华融融通（北京）科技有限公司 | A kind of anti-fake system of consumer finance based on dynamic regulation database and method |
| CN108764273A (en) * | 2018-04-09 | 2018-11-06 | 中国平安人寿保险股份有限公司 | A kind of method, apparatus of data processing, terminal device and storage medium |
| CN109408583A (en) * | 2018-09-25 | 2019-03-01 | 平安科技（深圳）有限公司 | Data processing method and device, computer readable storage medium, electronic equipment |
| CN109587000A (en) * | 2018-11-14 | 2019-04-05 | 上海交通大学 | High latency method for detecting abnormality and system based on collective intelligence network measurement data |
| CN110348472A (en) * | 2019-05-24 | 2019-10-18 | 中国平安财产保险股份有限公司 | Data Detection rule generating method, device, computer equipment and storage medium |
Cited By (8)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN112487033A (en) * | 2020-11-30 | 2021-03-12 | 国网山东省电力公司电力科学研究院 | Service visualization method and system for data flow and network topology construction |
| CN113837404A (en) * | 2021-08-30 | 2021-12-24 | 平安国际智慧城市科技股份有限公司 | False elevator maintenance work order identification method, device, equipment and storage medium |
| CN113923006A (en) * | 2021-09-30 | 2022-01-11 | 北京淇瑀信息科技有限公司 | Equipment data authentication method and device and electronic equipment |
| CN113923006B (en) * | 2021-09-30 | 2024-02-02 | 北京淇瑀信息科技有限公司 | Equipment data authentication method and device and electronic equipment |
| CN114363367A (en) * | 2021-12-09 | 2022-04-15 | 广东电网有限责任公司 | Service processing method and system based on edge Internet of things proxy |
| CN114363367B (en) * | 2021-12-09 | 2023-12-01 | 广东电网有限责任公司 | Business processing method and system based on edge Internet of things proxy |
| CN117669513A (en) * | 2024-01-30 | 2024-03-08 | 江苏古卓科技有限公司 | Data management system and method based on artificial intelligence |
| CN117669513B (en) * | 2024-01-30 | 2024-04-12 | 江苏古卓科技有限公司 | Data management system and method based on artificial intelligence |
Also Published As
| Publication number | Publication date |
|---|---|
| CN111782900B (en) | 2024-03-19 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN111782900B (en) | Abnormal service detection method and device, electronic equipment and storage medium | |
| WO2022141858A1 (en) | Pedestrian detection method and apparatus, electronic device, and storage medium | |
| CN113157927A (en) | Text classification method and device, electronic equipment and readable storage medium | |
| CN112528616A (en) | Business form generation method and device, electronic equipment and computer storage medium | |
| CN112416714A (en) | Log processing method and device, electronic equipment and readable storage medium | |
| CN113806434A (en) | Big data processing method, device, equipment and medium | |
| CN113379391A (en) | Work order processing method and device, electronic equipment and computer readable storage medium | |
| CN114781832A (en) | Course recommendation method and device, electronic equipment and storage medium | |
| CN113435308B (en) | Text multi-label classification method, device, equipment and storage medium | |
| CN113505273B (en) | Data sorting method, device, equipment and medium based on repeated data screening | |
| CN117155771B (en) | Equipment cluster fault tracing method and device based on industrial Internet of things | |
| CN112597752B (en) | Complaint text processing method and device, electronic equipment and storage medium | |
| CN113806492A (en) | Record generation method, device and equipment based on semantic recognition and storage medium | |
| CN111930963A (en) | Knowledge graph generation method and device, electronic equipment and storage medium | |
| CN111429085A (en) | Contract data generation method and device, electronic equipment and storage medium | |
| CN114708073B (en) | Intelligent detection method and device for surrounding mark and serial mark, electronic equipment and storage medium | |
| CN113626605B (en) | Information classification method, device, electronic equipment and readable storage medium | |
| CN113705201B (en) | Text-based event probability prediction evaluation algorithm, electronic device and storage medium | |
| CN114418489B (en) | Intelligent monitoring and early warning method, device, equipment and medium for logistics sorting robot | |
| CN113221888B (en) | License plate number management system test method and device, electronic equipment and storage medium | |
| CN114996386A (en) | Business role identification method, device, equipment and storage medium | |
| CN111860661B (en) | Data analysis method and device based on user behaviors, electronic equipment and medium | |
| CN114238233A (en) | Automatic file cleaning method, device, equipment and storage medium | |
| CN113706207A (en) | Order transaction rate analysis method, device, equipment and medium based on semantic analysis | |
| CN113344674A (en) | Product recommendation method, device, equipment and storage medium based on user purchasing power |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |