CN115017211A - Method and device for determining abnormality detection object, storage medium and computer equipment - Google Patents
Method and device for determining abnormality detection object, storage medium and computer equipment Download PDFInfo
- Publication number
- CN115017211A CN115017211A CN202210674799.7A CN202210674799A CN115017211A CN 115017211 A CN115017211 A CN 115017211A CN 202210674799 A CN202210674799 A CN 202210674799A CN 115017211 A CN115017211 A CN 115017211A
- Authority
- CN
- China
- Prior art keywords
- process node
- approval data
- business process
- detection object
- node approval
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
- 238000000034 method Methods 0.000 title claims abstract description 367
- 238000001514 detection method Methods 0.000 title claims abstract description 266
- 230000005856 abnormality Effects 0.000 title claims description 17
- 230000008569 process Effects 0.000 claims abstract description 306
- 230000002159 abnormal effect Effects 0.000 claims abstract description 101
- 238000004891 communication Methods 0.000 claims description 20
- 238000012216 screening Methods 0.000 claims description 17
- 238000012545 processing Methods 0.000 claims description 14
- 238000013507 mapping Methods 0.000 claims description 12
- 238000012163 sequencing technique Methods 0.000 claims description 8
- 238000010276 construction Methods 0.000 claims description 6
- 230000000977 initiatory effect Effects 0.000 claims description 5
- 230000002547 anomalous effect Effects 0.000 claims description 2
- 238000005516 engineering process Methods 0.000 description 9
- 230000008901 benefit Effects 0.000 description 8
- 238000013473 artificial intelligence Methods 0.000 description 5
- 238000010586 diagram Methods 0.000 description 3
- 238000004364 calculation method Methods 0.000 description 2
- 230000006870 function Effects 0.000 description 2
- 230000010365 information processing Effects 0.000 description 2
- 230000004048 modification Effects 0.000 description 2
- 238000012986 modification Methods 0.000 description 2
- 230000002776 aggregation Effects 0.000 description 1
- 238000004220 aggregation Methods 0.000 description 1
- 238000013135 deep learning Methods 0.000 description 1
- 230000006872 improvement Effects 0.000 description 1
- 230000003993 interaction Effects 0.000 description 1
- 238000010801 machine learning Methods 0.000 description 1
- 238000003058 natural language processing Methods 0.000 description 1
- 238000011022 operating instruction Methods 0.000 description 1
- 230000008520 organization Effects 0.000 description 1
- 238000013450 outlier detection Methods 0.000 description 1
- 230000000750 progressive effect Effects 0.000 description 1
- 230000009467 reduction Effects 0.000 description 1
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
- G06F16/20—Information retrieval; Database structures therefor; File system structures therefor of structured data, e.g. relational data
- G06F16/24—Querying
- G06F16/245—Query processing
- G06F16/2458—Special types of queries, e.g. statistical queries, fuzzy queries or distributed queries
- G06F16/2462—Approximate or statistical queries
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q10/00—Administration; Management
- G06Q10/10—Office automation; Time management
- G06Q10/103—Workflow collaboration or project management
Landscapes
- Engineering & Computer Science (AREA)
- Physics & Mathematics (AREA)
- Business, Economics & Management (AREA)
- Theoretical Computer Science (AREA)
- Strategic Management (AREA)
- Human Resources & Organizations (AREA)
- Entrepreneurship & Innovation (AREA)
- General Physics & Mathematics (AREA)
- Probability & Statistics with Applications (AREA)
- Data Mining & Analysis (AREA)
- Computational Linguistics (AREA)
- General Engineering & Computer Science (AREA)
- Software Systems (AREA)
- Mathematical Physics (AREA)
- Fuzzy Systems (AREA)
- Databases & Information Systems (AREA)
- Economics (AREA)
- Marketing (AREA)
- Operations Research (AREA)
- Quality & Reliability (AREA)
- Tourism & Hospitality (AREA)
- General Business, Economics & Management (AREA)
- Testing And Monitoring For Control Systems (AREA)
Abstract
The application discloses a method and a device for determining an abnormal detection object, a storage medium and computer equipment, relates to the technical field of abnormal detection, and mainly aims to solve the problem that the existing method for detecting abnormal values based on data distribution cannot be applied to scenes that the backlog of the number of detection orders is generally higher. The method comprises the following steps: acquiring the service process node approval data of each detection object; constructing a straight line according to the business process node approval data of each detection object to obtain a linear trend detection model; and performing anomaly detection on the service process node approval data of each detection object based on the linear trend detection model to obtain the abnormal service process node approval data in the service process node approval data of each detection object.
Description
Technical Field
The present application relates to the field of anomaly detection technologies, and in particular, to a method and an apparatus for determining an anomaly detection object, a storage medium, and a computer device.
Background
Outliers are those where an individual value in a sample deviates significantly from the rest of the observations of the sample to which it belongs, and usually appear to be significantly larger or smaller than the others, and are not difficult to find or reject. In the field of statistics, there are many detection methods for abnormal values, such as a mean square error detection method, a boxplot detection method, a cluster detection method, etc., and the operation result thereof inevitably detects the abnormal value. However, in the scenario of detecting the order quantity backlog, the above statistical outlier detection methods such as the mean square detection method and the box line detection method are used to detect outliers based on the distribution of the data itself, so as to remove noise points and accelerate the convergence rate of the model, and avoid the reduction of the generalization ability of the model due to the noise points, and the overall level of the sample is not considered. Therefore, a method for determining an abnormality detection object is needed to automatically determine an abnormal value in a sample.
Disclosure of Invention
In view of the above, the present application provides a method and an apparatus for determining an abnormal detection object, a storage medium, and a computer device, and mainly aims to solve the problem that the existing method for detecting an abnormal value based on the distribution of data itself cannot be applied to a scenario where the backlog of the number of detection orders is generally high.
According to an aspect of the present application, there is provided a method of determining an abnormality detection object, including:
acquiring the service process node approval data of each detection object;
constructing a straight line according to the service process node approval data of each detection object to obtain a linear trend detection model;
and performing anomaly detection on the service process node approval data of each detection object based on the linear trend detection model to obtain the abnormal service process node approval data in the service process node approval data of each detection object.
Preferably, the performing, based on the linear trend detection model, abnormal detection on the service process node approval data of each detection object to obtain abnormal service process node approval data in the service process node approval data of each detection object specifically includes:
inputting the abscissa of the coordinate point corresponding to the maximum value business process node approval data in the business process node approval data of each detection object into the linear trend detection model to obtain predicted business process node approval data;
and if the approval data of the maximum business process node is larger than the approval data of the expected business process node, determining that the approval data of the maximum business process node is the approval data of the abnormal business process node.
Preferably, the constructing a straight line according to the service process node approval data of each detection object to obtain a linear trend detection model specifically includes:
sequencing the service process node approval data of each detection object;
screening out the service process node approval data smaller than a preset service process node approval data threshold;
coordinate mapping processing is carried out on the screened business process node approval data to obtain coordinate points corresponding to the business process node approval data;
and constructing a straight line based on the coordinate point corresponding to the minimum business process node approval data in the screened business process node approval data and the coordinate point corresponding to the second-largest business process node approval data in the screened business process node approval data to obtain a linear trend detection model.
Preferably, before screening out the business process node approval data smaller than the preset business process node approval data threshold, the method further includes:
acquiring the service process node approval data of the completed service process in the service database;
and configuring the preset service process node approval data threshold according to the service process node approval data of the total completed service processes.
Preferably, after obtaining the abnormal business process node approval data in the business process node approval data of each detection object, the method further includes:
and identifying the detection object corresponding to the abnormal service process node approval data according to the detection object identifier to determine an abnormal detection object, and outputting abnormal condition description information aiming at the abnormal detection object according to a preset format, wherein the abnormal condition description information comprises basic information and contribution degree of the abnormal detection object.
Preferably, before the outputting of the abnormal situation description information for the abnormality detection target, the method further includes:
the contribution degree of the abnormal detection object is used for representing the difference value between the business process node approval data of the abnormal detection object and the preset business process node approval data threshold value, and accounts for the proportion of the sum of the difference values between the business process node approval data which are screened out and the preset business process node approval data threshold value.
Preferably, before the obtaining of the service process node approval data of each detection object, the method further includes:
receiving an initiation request of a business process, configuring a corresponding detection object identifier for the business process, and acquiring business process node approval data of the detection object based on the detection object identifier.
According to another aspect of the present application, there is provided an abnormality detection object determination apparatus including:
the acquisition module is used for acquiring the service process node approval data of each detection object;
the construction module is used for constructing a straight line according to the business process node approval data of each detection object to obtain a linear trend detection model;
and the detection module is used for carrying out abnormity detection on the business process node approval data of each detection object based on the linear trend detection model to obtain abnormal business process node approval data in the business process node approval data of each detection object.
Preferably, the detection module specifically includes:
the input unit is used for inputting the abscissa of the coordinate point corresponding to the maximum value business process node approval data in the business process node approval data of each detection object into the linear trend detection model to obtain the expected business process node approval data;
and the determining unit is used for determining that the approval data of the maximum business process node is abnormal business process node approval data if the approval data of the maximum business process node is larger than the approval data of the expected business process node.
Preferably, the building module specifically includes:
the sequencing unit is used for sequencing the service process node approval data of each detection object;
the screening unit is used for screening the service process node approval data smaller than a preset service process node approval data threshold;
the mapping unit is used for carrying out coordinate mapping processing on the screened business process node approval data to obtain coordinate points corresponding to the business process node approval data;
and the construction unit is used for constructing a straight line based on the coordinate point corresponding to the minimum business process node approval data in the screened business process node approval data and the coordinate point corresponding to the second-largest business process node approval data in the screened business process node approval data to obtain a linear trend detection model.
Preferably, before the screening unit, the module further comprises:
the acquisition unit is used for acquiring the service process node approval data of the total completed service processes in the service database;
and the configuration unit is used for configuring the preset business process node approval data threshold according to the business process node approval data of the total completed business process.
Preferably, after the detecting module, the apparatus further comprises:
and the output module is used for identifying the detection object corresponding to the abnormal business process node approval data according to the detection object identifier so as to determine the abnormal detection object, and outputting abnormal condition description information aiming at the abnormal detection object according to a preset format, wherein the abnormal condition description information comprises the basic information and the contribution degree of the abnormal detection object.
Preferably, before the output module, the apparatus further includes:
and the calculation module is used for representing the difference between the approval data of the business process nodes of the abnormal detection object and the threshold value of the preset business process node approval data and accounting for the proportion of the sum of the differences between the approval data of each screened business process node and the threshold value of the preset business process node approval data.
Preferably, before the obtaining module, the apparatus further includes:
and the receiving module is used for receiving an initiating request of a business process, configuring a corresponding detection object identifier for the business process and acquiring business process node approval data of the detection object based on the detection object identifier.
According to still another aspect of the present application, there is provided a storage medium having at least one executable instruction stored therein, the executable instruction causing a processor to perform an operation corresponding to the above-described method for determining an abnormality detection object.
According to yet another aspect of the present application, there is provided a computer device including: the system comprises a processor, a memory, a communication interface and a communication bus, wherein the processor, the memory and the communication interface complete mutual communication through the communication bus;
the memory is used for storing at least one executable instruction, and the executable instruction enables the processor to execute the operation corresponding to the determination method of the abnormal detection object.
By means of the technical scheme, the technical scheme provided by the embodiment of the application at least has the following advantages:
the application provides a method and a device for determining abnormal detection objects, a storage medium and computer equipment, wherein firstly, business process node approval data of each detection object is obtained; secondly, constructing a straight line according to the service process node approval data of each detection object to obtain a linear trend detection model; and finally, performing anomaly detection on the service process node approval data of each detection object based on the linear trend detection model to obtain the abnormal service process node approval data in the service process node approval data of each detection object. Compared with the prior art, the method and the device have the advantages that the abnormal detection is carried out on the service process node approval data through the linear trend detection model, so that the abnormal data in the service process node approval data are determined, the automatic determination of the abnormal values in the service process node approval data is realized, the method and the device are more suitable for detecting the scene of the service process node approval data because the statistical data distribution is not completely used as the detection basis, operators can automatically and efficiently determine abnormal detection objects when facing complex and massive service process node approval data, and the detection efficiency is greatly improved.
The foregoing description is only an overview of the technical solutions of the present application, and the present application can be implemented according to the content of the description in order to make the technical means of the present application more clearly understood, and the following detailed description of the present application is given in order to make the above and other objects, features, and advantages of the present application more clearly understandable.
Drawings
Various additional advantages and benefits will become apparent to those of ordinary skill in the art upon reading the following detailed description of the preferred embodiments. The drawings are only for purposes of illustrating the preferred embodiments and are not to be construed as limiting the application. Also, like reference numerals are used to refer to like parts throughout the drawings. In the drawings:
fig. 1 is a flowchart illustrating a method for determining an abnormal detection object according to an embodiment of the present application;
fig. 2 is a block diagram illustrating a component of an abnormality detection object determination apparatus according to an embodiment of the present application;
fig. 3 shows a schematic structural diagram of a computer device provided in an embodiment of the present application.
Detailed Description
Exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. While exemplary embodiments of the present disclosure are shown in the drawings, it should be understood that the present disclosure may be embodied in various forms and should not be limited to the embodiments set forth herein. Rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the scope of the disclosure to those skilled in the art.
The embodiment of the application can acquire and process related data based on an artificial intelligence technology. Among them, Artificial Intelligence (AI) is a theory, method, technique and application system that simulates, extends and expands human Intelligence using a digital computer or a machine controlled by a digital computer, senses the environment, acquires knowledge and uses the knowledge to obtain the best result.
The artificial intelligence infrastructure generally includes technologies such as sensors, dedicated artificial intelligence chips, cloud computing, distributed storage, big data processing technologies, operation/interaction systems, mechatronics, and the like. The artificial intelligence software technology mainly comprises a computer vision technology, a robot technology, a biological recognition technology, a voice processing technology, a natural language processing technology, machine learning/deep learning and the like.
Based on this, in an embodiment, as shown in fig. 1, a method for determining an anomaly detection object is provided, which is described by taking the method applied to a computer device such as a server as an example, where the server may be an independent server, or may be a cloud server that provides basic cloud computing services such as a cloud service, a cloud database, cloud computing, a cloud function, cloud storage, a Network service, cloud communication, a middleware service, a domain name service, a security service, a Content Delivery Network (CDN), a big data and an artificial intelligence platform, such as an intelligent medical system, a digital medical platform, and the like.
The method comprises the following steps:
101. and acquiring the service process node approval data of each detection object.
The detection object is used for representing each next business department of each branch company, such as a department responsible for heavy card leasing, a department responsible for light card leasing, a department responsible for second-hand car leasing and the like; the business process node approval data is used for representing the approval condition of the opened order business process, such as the number of orders which are not approved by the business department A, the time length consumed by the business department A for order approval, the number of orders which are returned by the business department A, and the like. In the embodiment of the application, the abnormal data of other business departments obviously deviating from the same grade can be accurately detected by acquiring the business process node approval data of each business department in the same grade and carrying out abnormal detection on the business process node approval data based on the linear trend detection model.
It can be understood that, in general, when an order is signed, a corresponding business department is associated, and when the approval data of the business process nodes is obtained, all the approval data of the business process nodes at a certain level may be obtained through an aggregation function, for example, order backlog data is obtained through summation, or time consumed for order approval is obtained through an average value. In addition, for example, taking the order backlog data as an example, the business process node approval data includes many dimensions, such as business classification (heavy truck, light truck, used truck, etc.), area, group, and the like. New derived dimensions can be generated among the dimensions through combination, and the number of dimension combinations can be obtained through permutation and combination: dim (n) ═ 2 n 1 (where n represents the number of dimensions), but the organization dimensions themselves have a relationship of superior and inferior, so the number of optimized combinations is: dim (n) ═ n (where n represents the number of layers of the tissue architecture).
102. And constructing a straight line according to the approval data of the business process nodes of all the detection objects to obtain a linear trend detection model.
In the embodiment of the present application, a straight line is constructed based on the service process node approval data of each detection object obtained in step 101, that is, the linear trend detection model performs anomaly detection, and compared with performing anomaly detection by an anomaly value detection method based on statistics in the prior art, comparison between departments of the same level is performed without being limited by the distribution of sample data itself, and the method is more suitable for practical application scenarios such as a sample being higher overall.
103. And performing anomaly detection on the service process node approval data of each detection object based on a linear trend detection model to obtain the abnormal service process node approval data in the service process node approval data of each detection object.
The linear trend detection model is constructed based on the acquired business process node approval data of all business departments at the same level and is used for detecting whether abnormal detection objects which are obviously deviated from other detection objects exist in all detection objects at the same level. In the embodiment of the application, the abnormal detection is performed on the service process node approval data of each service department in the same level, which is obtained in step 101, based on a linear trend detection model, so that the abnormal service process node approval data in the same level is obtained.
It should be noted that, after obtaining the service process node approval data of the anomaly detection object, the description of the anomaly detection object may be output according to a preset format, an index, and the like, and the embodiment of the present application is not particularly limited.
Compared with the prior art, the method and the device have the advantages that the abnormal detection is carried out on the service process node approval data through the linear trend detection model, so that the abnormal detection object in the service process node approval data is determined, the automatic determination of the abnormal value in the service process node approval data is realized, the scene of detecting the service process node approval data is more suitable because the statistical data distribution is not completely used as the detection basis, when operators face the complex and massive service process node approval data, the automatic and efficient determination of the abnormal detection object is realized, and the detection efficiency is greatly improved.
For further explanation and limitation, in the embodiment of the present application, the performing exception detection on the service process node approval data of each detection object based on the linear trend detection model to obtain exception service process node approval data in the service process node approval data of each detection object specifically includes: inputting the abscissa of a coordinate point corresponding to the maximum value business process node approval data in the business process node approval data of each detection object into a linear trend detection model to obtain predicted business process node approval data; and if the approval data of the maximum business process node is larger than the approval data of the expected business process node, determining that the approval data of the maximum business process node is the approval data of the abnormal business process node.
And the expected business process node approval data is used for representing the business process node approval data which is obtained according to the linear trend detection model and is in a normal range. Specifically, a coordinate point obtained by coordinate mapping processing of the approval data of the maximum business process node in the business process node approval data of each detection object is substituted into the linear trend detection model to obtain expected business process node approval data, namely the business process node approval data in a normal range; and further comparing the actual approval data of the maximum business process node with the expected approval data of the business process node, and if the actual approval data of the maximum business process node is larger than the expected approval data of the business process node, indicating that the actual approval data of the maximum business process node obviously deviates from the expected approval data of the business process node in a normal range, and determining that the approval data of the maximum business process node is the business process node approval data of the abnormal detection object.
Illustratively, the linear trend detection model is a straight line y ═ x +6, a coordinate point corresponding to the maximum business process node approval data obtained through coordinate mapping processing is (3,15), and the straight line y ═ x +6 is substituted into (3,15), so that y ^ 3+6 ^ 9<15 is obtained, which indicates that the maximum business process node approval data obviously deviates from a normal range, that is, the maximum business process node approval data is determined to be the business process node approval data of the abnormal detection object.
For further explanation and limitation, in the embodiment of the present application, a straight line is constructed according to the business process node approval data of each detection object, so as to obtain a linear trend detection model, which specifically includes: sequencing the service process node approval data of each detection object; screening out the service process node approval data smaller than a preset service process node approval data threshold; coordinate mapping processing is carried out on the screened business process node approval data to obtain coordinate points corresponding to the business process node approval data; and constructing a straight line based on the coordinate point corresponding to the minimum business process node approval data in the screened business process node approval data and the coordinate point corresponding to the second-largest business process node approval data in the screened business process node approval data to obtain a linear trend detection model.
Specifically, firstly, sequencing the service process node approval data of each detection object obtained in step 101, and screening the service process node approval data smaller than the preset service process node approval data threshold based on the preset service process node approval data threshold; secondly, performing coordinate mapping processing on the remaining service process node approval data after the screening out to obtain a coordinate point corresponding to each service process node approval data, specifically, performing coordinate mapping processing according to x being equal to index and y being equal to value; and finally, constructing a linear trend detection model based on the minimum value and the second maximum value in the rest business process node approval data after screening.
Illustratively, taking order backlog data as an example, the obtained order backlog quantities of 6 business departments at the same level are respectively [15,4,6,7,8,2], firstly, the order backlog quantities are sequenced to obtain [2,4,6,7,8,15], a preset business process node approval data threshold value is set to be 5, and a part smaller than the preset business process node approval data threshold value 5 is screened out to obtain [6,7,8,15 ]; then, coordinate mapping processing is performed on [6,7,8,15] based on x ═ index and y ═ value, and coordinate points [ (0,6), (1,7), (2,8), (3,15) ] are obtained; finally, a linear trend detection model is constructed by the minimum value coordinate points (0,6) and the second maximum value coordinate points (2,8), and a straight line y is obtained as x + 6.
Optionally, in this embodiment of the present application, before screening out the service process node approval data smaller than the preset service process node approval data threshold, the method in the embodiment further includes: acquiring the service process node approval data of the completed service process in the service database; and configuring and presetting a service process node approval data threshold according to the service process node approval data of the total completed service processes.
Illustratively, business process node approval data of orders of which the business processes are completely finished in an order database can be obtained, and the consumed time of finishing each business process node of all the orders is counted and averaged to be used as a preset approval time threshold; or counting the number of orders at the same business process node at the same time, configuring the order backlog threshold value of each business process node according to the target order processing rate, and the like.
Preferably, in the embodiment of the present application, after obtaining the abnormal business process node approval data in the business process node approval data of each detected object, the method of the embodiment further includes: and identifying the detection object corresponding to the examination and approval data of the abnormal business process node according to the detection object identifier to determine the abnormal detection object, and outputting abnormal condition description information aiming at the abnormal detection object according to a preset format.
The abnormal condition description information comprises basic information and contribution degree of an abnormal detection object; the basic information includes but is not limited to the service range of the detection object, the order overstock condition, etc.; the contribution degree is used for representing the ratio between the contribution amount and the input amount.
Illustratively, the abnormal situation description information for the abnormality detection object is output: the number of non-guaranteed lines-retail department-southern China-Zhejiang group returns is increased, and the contribution degree is 52%.
For further explanation and limitation, in the embodiment of the present application, before outputting the abnormal situation description information for the abnormal detection object, the method of the embodiment further includes:
the contribution degree of the abnormal detection object is used for representing the difference between the approval data of the business process nodes of the abnormal detection object and the threshold value of the approval data of the preset business process nodes, and accounts for the proportion of the sum of the differences between the approval data of the business process nodes which are screened out and the threshold value of the approval data of the preset business process nodes.
Illustratively, based on the above example of the order backlog data, after performing anomaly detection by using a linear trend detection model and determining that the maximum value business process node approval data is the business process node approval data of the anomaly detection object, the contribution degree is calculated to be (15-5)/((6-5) + (7-5) + (8-5) + (15-5)) -, 62.5%.
It should be noted that, if the number of data after screening by using the preset business process node approval data threshold is 1, the value is an abnormal value, and the contribution degree is 100%
If the number of data after screening is finished by using the preset service process node approval data threshold is 2, if the maximum value service process node approval data max/the minimum value service process node approval data min > is 2, the maximum value service process node approval data is an abnormal value, and the contribution degree is the maximum value service process node approval data max/(the minimum value service process node approval data max + the maximum value service process node approval data max).
For further explanation and limitation, in the embodiment of the present application, before obtaining the business process node approval data of each detected object, the method of the embodiment further includes: and receiving an initiation request of the service process, configuring a corresponding detection object identifier for the service process, and acquiring service process node approval data of the detection object based on the detection object identifier.
It should be noted that, in order to more efficiently obtain the service process node approval data of each detection object, when the service process of the order is initiated, a unique identity of the corresponding detection object may be configured for each service process, so as to obtain the service process node approval data of the detection object based on the detection object identity.
The application provides a method for determining abnormal detection objects, which comprises the steps of firstly, obtaining service process node approval data of each detection object; secondly, constructing a straight line according to the service process node approval data of each detection object to obtain a linear trend detection model; and finally, performing anomaly detection on the service process node approval data of each detection object based on the linear trend detection model to obtain the abnormal service process node approval data in the service process node approval data of each detection object. Compared with the prior art, the method and the device have the advantages that the abnormal detection is carried out on the service process node approval data through the linear trend detection model, so that the abnormal detection object in the service process node approval data is determined, the automatic determination of the abnormal value in the service process node approval data is realized, the scene of detecting the service process node approval data is more suitable because the statistical data distribution is not completely used as the detection basis, when operators face the complex and massive service process node approval data, the automatic and efficient determination of the abnormal detection object is realized, and the detection efficiency is greatly improved.
Further, as an implementation of the method shown in fig. 1, an embodiment of the present application provides an apparatus for determining an abnormality detection object, as shown in fig. 2, the apparatus includes:
an acquisition module 21, a construction module 22 and a detection module 23.
The acquisition module 21 is configured to acquire service process node approval data of each detected object;
the construction module 22 is configured to construct a straight line according to the service process node approval data of each detection object to obtain a linear trend detection model;
the detection module 23 is configured to perform anomaly detection on the service process node approval data of each detection object based on the linear trend detection model, so as to obtain anomalous service process node approval data in the service process node approval data of each detection object.
In a specific application scenario, the detection module specifically includes:
the input unit is used for inputting the abscissa of the coordinate point corresponding to the maximum value business process node approval data in the business process node approval data of each detection object into the linear trend detection model to obtain the expected business process node approval data;
and the determining unit is used for determining that the approval data of the maximum business process node is abnormal business process node approval data if the approval data of the maximum business process node is larger than the approval data of the expected business process node.
In a specific application scenario, the building module specifically includes:
the sequencing unit is used for sequencing the service process node approval data of each detection object;
the screening unit is used for screening the service process node approval data smaller than a preset service process node approval data threshold;
the mapping unit is used for carrying out coordinate mapping processing on the screened business process node approval data to obtain coordinate points corresponding to the business process node approval data;
and the construction unit is used for constructing a straight line based on the coordinate point corresponding to the minimum business process node approval data in the screened business process node approval data and the coordinate point corresponding to the second-maximum business process node approval data in the screened business process node approval data to obtain a linear trend detection model.
In a specific application scenario, before the screening unit, the module further includes:
the acquisition unit is used for acquiring the service process node approval data of the total completed service processes in the service database;
and the configuration unit is used for configuring the preset business process node approval data threshold according to the business process node approval data of the total completed business process.
In a specific application scenario, after the detecting module, the apparatus further includes:
and the output module is used for identifying the detection object corresponding to the abnormal service process node approval data according to the detection object identifier so as to determine an abnormal detection object, and outputting abnormal condition description information aiming at the abnormal detection object according to a preset format, wherein the abnormal condition description information comprises basic information and contribution degree of the abnormal detection object.
In a specific application scenario, before the output module, the apparatus further includes:
and the calculation module is used for representing the difference between the approval data of the business process nodes of the abnormal detection object and the threshold value of the preset business process node approval data and accounting for the proportion of the sum of the differences between the approval data of each screened business process node and the threshold value of the preset business process node approval data.
In a specific application scenario, before the obtaining module, the apparatus further includes:
and the receiving module is used for receiving an initiating request of a business process, configuring a corresponding detection object identifier for the business process and acquiring business process node approval data of the detection object based on the detection object identifier.
The application provides a device for determining abnormal detection objects, which comprises the steps of firstly, obtaining service process node approval data of each detection object; secondly, constructing a straight line according to the service process node approval data of each detection object to obtain a linear trend detection model; and finally, performing anomaly detection on the service process node approval data of each detection object based on the linear trend detection model to obtain the abnormal service process node approval data in the service process node approval data of each detection object. Compared with the prior art, the method and the device have the advantages that the abnormal detection is carried out on the service process node approval data through the linear trend detection model, so that the abnormal detection object in the service process node approval data is determined, the automatic determination of the abnormal value in the service process node approval data is realized, the scene of detecting the service process node approval data is more suitable because the statistical data distribution is not completely used as the detection basis, when operators face the complex and massive service process node approval data, the automatic and efficient determination of the abnormal detection object is realized, and the detection efficiency is greatly improved.
According to an embodiment of the present application, there is provided a storage medium storing at least one executable instruction, where the computer executable instruction may execute the method for determining an abnormality detection object in any of the method embodiments described above.
Based on such understanding, the technical solution of the present application may be embodied in the form of a software product, which may be stored in a non-volatile storage medium (which may be a CD-ROM, a usb disk, a removable hard disk, etc.), and includes several instructions for enabling a computer device (which may be a personal computer, a server, or a network device, etc.) to execute the method according to the implementation scenarios of the present application.
Fig. 3 is a schematic structural diagram of a computer device according to an embodiment of the present application, where the specific embodiment of the present application does not limit a specific implementation of the computer device.
As shown in fig. 3, the computer apparatus may include: a processor (processor)302, a communication Interface 304, a memory 306, and a communication bus 308.
Wherein: the processor 302, communication interface 304, and memory 306 communicate with each other via a communication bus 308.
A communication interface 304 for communicating with network elements of other devices, such as clients or other servers.
The processor 302 is configured to execute the program 310, and may specifically execute relevant steps in the above-described method for determining an anomaly detection object.
In particular, program 310 may include program code comprising computer operating instructions.
The processor 302 may be a central processing unit CPU, or an application Specific Integrated circuit asic, or one or more Integrated circuits configured to implement embodiments of the present application. The computer device includes one or more processors, which may be the same type of processor, such as one or more CPUs; or may be different types of processors such as one or more CPUs and one or more ASICs.
And a memory 306 for storing a program 310. Memory 306 may comprise high-speed RAM memory and may also include non-volatile memory (non-volatile memory), such as at least one disk memory.
The program 310 may specifically be configured to cause the processor 302 to perform the following operations:
acquiring the service process node approval data of each detection object;
constructing a straight line according to the business process node approval data of each detection object to obtain a linear trend detection model;
and performing anomaly detection on the service process node approval data of each detection object based on the linear trend detection model to obtain the abnormal service process node approval data in the service process node approval data of each detection object.
The storage medium may further include an operating system and a network communication module. The operating system is a program that manages hardware and software resources of the identified physical device of the abnormality detection object, and supports the operation of the information processing program and other software and/or programs. The network communication module is used for realizing communication among components in the storage medium and communication with other hardware and software in the information processing entity device.
In the present specification, the embodiments are described in a progressive manner, each embodiment focuses on differences from other embodiments, and the same or similar parts in the embodiments are referred to each other. For the system embodiment, since it basically corresponds to the method embodiment, the description is relatively simple, and reference may be made to the partial description of the method embodiment for relevant points.
The method and system of the present application may be implemented in a number of ways. For example, the methods and systems of the present application may be implemented by software, hardware, firmware, or any combination of software, hardware, and firmware. The above-described order for the steps of the method is for illustration only, and the steps of the method of the present application are not limited to the order specifically described above unless specifically stated otherwise. Further, in some embodiments, the present application may also be embodied as a program recorded in a recording medium, the program including machine-readable instructions for implementing a method according to the present application. Thus, the present application also covers a recording medium storing a program for executing the method according to the present application.
It will be apparent to those skilled in the art that the modules or steps of the present application described above may be implemented by a general purpose computing device, they may be centralized on a single computing device or distributed across a network of multiple computing devices, and alternatively, they may be implemented by program code executable by a computing device, such that they may be stored in a storage device and executed by a computing device, and in some cases, the steps shown or described may be performed in an order different than that described herein, or they may be separately fabricated into individual integrated circuit modules, or multiple ones of them may be fabricated into a single integrated circuit module. Thus, the present application is not limited to any specific combination of hardware and software.
The above description is only a preferred embodiment of the present application and is not intended to limit the present application, and various modifications and changes may be made by those skilled in the art. Any modification, equivalent replacement, improvement and the like made within the spirit and principle of the present application shall be included in the protection scope of the present application.
Claims (10)
1. A method of determining an abnormality detection target, comprising:
acquiring the service process node approval data of each detection object;
constructing a straight line according to the service process node approval data of each detection object to obtain a linear trend detection model;
and performing anomaly detection on the service process node approval data of each detection object based on the linear trend detection model to obtain the anomalous service process node approval data in the service process node approval data of each detection object.
2. The method according to claim 1, wherein the performing anomaly detection on the business process node approval data of each detection object based on the linear trend detection model to obtain the abnormal business process node approval data in the business process node approval data of each detection object specifically comprises:
inputting the abscissa of the coordinate point corresponding to the maximum value business process node approval data in the business process node approval data of each detection object into the linear trend detection model to obtain predicted business process node approval data;
and if the approval data of the maximum business process node is larger than the approval data of the expected business process node, determining that the approval data of the maximum business process node is the approval data of the abnormal business process node.
3. The method according to claim 2, wherein the step of constructing a straight line according to the approval data of the business process nodes of each detection object to obtain a linear trend detection model specifically comprises the steps of:
sequencing the service process node approval data of each detection object;
screening out the service process node approval data smaller than a preset service process node approval data threshold;
coordinate mapping processing is carried out on the screened business process node approval data to obtain coordinate points corresponding to the business process node approval data;
and constructing a straight line based on the coordinate point corresponding to the minimum business process node approval data in the screened business process node approval data and the coordinate point corresponding to the second-largest business process node approval data in the screened business process node approval data to obtain a linear trend detection model.
4. The method of claim 3, wherein prior to screening out business process node approval data that is less than a preset business process node approval data threshold, the method further comprises:
acquiring the service process node approval data of the completed service process in the service database;
and configuring the preset service process node approval data threshold according to the service process node approval data of the total completed service processes.
5. The method according to claim 1, wherein after obtaining the abnormal business process node approval data in the business process node approval data of each detection object, the method further comprises:
and identifying the detection object corresponding to the abnormal business process node approval data according to the detection object identifier to determine an abnormal detection object, and outputting abnormal condition description information aiming at the abnormal detection object according to a preset format, wherein the abnormal condition description information comprises basic information and contribution degree of the abnormal detection object.
6. The method according to claim 5, wherein before the outputting the abnormal situation description information for the abnormality detection object, the method further comprises:
the contribution degree of the abnormal detection object is used for representing the difference value between the business process node approval data of the abnormal detection object and the preset business process node approval data threshold value, and accounts for the proportion of the sum of the difference values between the business process node approval data which are screened out and the preset business process node approval data threshold value.
7. The method of claim 1, wherein before obtaining the business process node approval data of each detection object, the method further comprises:
receiving an initiation request of a business process, configuring a corresponding detection object identifier for the business process, and acquiring business process node approval data of the detection object based on the detection object identifier.
8. An apparatus for specifying an abnormality detection target, comprising:
the acquisition module is used for acquiring the service process node approval data of each detection object;
the construction module is used for constructing a straight line according to the business process node approval data of each detection object to obtain a linear trend detection model;
and the detection module is used for carrying out abnormity detection on the business process node approval data of each detection object based on the linear trend detection model to obtain abnormal business process node approval data in the business process node approval data of each detection object.
9. A storage medium having at least one executable instruction stored therein, wherein the executable instruction causes a processor to perform an operation corresponding to the method for determining an abnormality detection object according to any one of claims 1 to 7.
10. A computer device, comprising: the system comprises a processor, a memory, a communication interface and a communication bus, wherein the processor, the memory and the communication interface complete mutual communication through the communication bus;
the memory is used for storing at least one executable instruction, wherein the executable instruction causes the processor to execute the operation corresponding to the determination method of the abnormality detection object according to any one of claims 1-7.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202210674799.7A CN115017211A (en) | 2022-06-15 | 2022-06-15 | Method and device for determining abnormality detection object, storage medium and computer equipment |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202210674799.7A CN115017211A (en) | 2022-06-15 | 2022-06-15 | Method and device for determining abnormality detection object, storage medium and computer equipment |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN115017211A true CN115017211A (en) | 2022-09-06 |
Family
ID=83075604
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202210674799.7A Pending CN115017211A (en) | 2022-06-15 | 2022-06-15 | Method and device for determining abnormality detection object, storage medium and computer equipment |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN115017211A (en) |
Cited By (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN115471141A (en) * | 2022-11-02 | 2022-12-13 | 成都飞机工业（集团）有限责任公司 | Business process cycle management and control method, device, equipment and medium |
Citations (7)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN110909306A (en) * | 2018-09-17 | 2020-03-24 | 阿里巴巴集团控股有限公司 | Service abnormity detection method and device, electronic equipment and storage equipment |
| KR20200036241A (en) * | 2018-09-28 | 2020-04-07 | 주식회사 알스피릿 | Method for anomaly detection based on regression analysis predictive model |
| CN111507376A (en) * | 2020-03-20 | 2020-08-07 | 厦门大学 | Single index abnormality detection method based on fusion of multiple unsupervised methods |
| CN112132722A (en) * | 2020-08-20 | 2020-12-25 | 彭涛 | Method and device for determining abnormal trend of number of government affair hotlines, electronic equipment and medium |
| WO2021109314A1 (en) * | 2019-12-06 | 2021-06-10 | 网宿科技股份有限公司 | Method, system and device for detecting abnormal data |
| CN113312527A (en) * | 2021-07-28 | 2021-08-27 | 太平金融科技服务(上海)有限公司深圳分公司 | Purchase data processing method and device, computer equipment and storage medium |
| CN113918376A (en) * | 2021-12-14 | 2022-01-11 | 湖南天云软件技术有限公司 | Fault detection method, device, equipment and computer readable storage medium |
-
2022
- 2022-06-15 CN CN202210674799.7A patent/CN115017211A/en active Pending
Patent Citations (7)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN110909306A (en) * | 2018-09-17 | 2020-03-24 | 阿里巴巴集团控股有限公司 | Service abnormity detection method and device, electronic equipment and storage equipment |
| KR20200036241A (en) * | 2018-09-28 | 2020-04-07 | 주식회사 알스피릿 | Method for anomaly detection based on regression analysis predictive model |
| WO2021109314A1 (en) * | 2019-12-06 | 2021-06-10 | 网宿科技股份有限公司 | Method, system and device for detecting abnormal data |
| CN111507376A (en) * | 2020-03-20 | 2020-08-07 | 厦门大学 | Single index abnormality detection method based on fusion of multiple unsupervised methods |
| CN112132722A (en) * | 2020-08-20 | 2020-12-25 | 彭涛 | Method and device for determining abnormal trend of number of government affair hotlines, electronic equipment and medium |
| CN113312527A (en) * | 2021-07-28 | 2021-08-27 | 太平金融科技服务(上海)有限公司深圳分公司 | Purchase data processing method and device, computer equipment and storage medium |
| CN113918376A (en) * | 2021-12-14 | 2022-01-11 | 湖南天云软件技术有限公司 | Fault detection method, device, equipment and computer readable storage medium |
Non-Patent Citations (1)
| Title |
|---|
| 哪吒: "数据分析笔记——自动归因", pages 1 - 2, Retrieved from the Internet <URL:https://zhuanlan.zhihu.com/p/388688061> * |
Cited By (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN115471141A (en) * | 2022-11-02 | 2022-12-13 | 成都飞机工业（集团）有限责任公司 | Business process cycle management and control method, device, equipment and medium |
| CN115471141B (en) * | 2022-11-02 | 2023-03-24 | 成都飞机工业（集团）有限责任公司 | Business process cycle management and control method, device, equipment and medium |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN109086720B (en) | Face clustering method, face clustering device and storage medium | |
| CN107169768B (en) | Method and device for acquiring abnormal transaction data | |
| US10637714B2 (en) | Proactive fault detection and diagnostics for networked node transaction events | |
| CN110471949B (en) | Data blood margin analysis method, device, system, server and storage medium | |
| CN110704231A (en) | Fault processing method and device | |
| CN106874135B (en) | Method, device and equipment for detecting machine room fault | |
| US10289464B1 (en) | Robust event prediction | |
| CN109241084B (en) | Data query method, terminal equipment and medium | |
| CN105989163A (en) | Data real-time processing method and system | |
| CN115412371B (en) | Big data security protection method and system based on Internet of things and cloud platform | |
| CN107203464B (en) | Method and device for positioning service problem | |
| CN115017211A (en) | Method and device for determining abnormality detection object, storage medium and computer equipment | |
| CN112446637A (en) | Building construction quality safety online risk detection method and system | |
| CN117290719B (en) | Inspection management method and device based on data analysis and storage medium | |
| CN108920601B (en) | Data matching method and device | |
| CN114328095A (en) | Task abnormity warning method and device | |
| CN117519951A (en) | Real-time data processing method and system based on message center | |
| CN110991241B (en) | Abnormality recognition method, apparatus, and computer-readable medium | |
| CN112182579A (en) | Process list generation method and device and abnormal process detection method and device | |
| CN111737371B (en) | Data flow detection classification method and device capable of dynamically predicting | |
| CN115099946A (en) | Capacity prediction method and system based on bank face storage platform | |
| CN110166295B (en) | Method for judging whether network topology supports Byzantine fault tolerance or not | |
| CN112434648A (en) | Wall shape change detection method and system | |
| CN113051307A (en) | Alarm signal analysis method, equipment, storage medium and device | |
| CN116993297B (en) | Task data generation method and system based on electronic conference record |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination |