CN103365969B - The method and system that a kind of anomaly data detection processes - Google Patents
The method and system that a kind of anomaly data detection processes Download PDFInfo
- Publication number
- CN103365969B CN103365969B CN201310253223.4A CN201310253223A CN103365969B CN 103365969 B CN103365969 B CN 103365969B CN 201310253223 A CN201310253223 A CN 201310253223A CN 103365969 B CN103365969 B CN 103365969B
- Authority
- CN
- China
- Prior art keywords
- data
- user
- interval
- specific behavior
- dealing money
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
- 238000000034 method Methods 0.000 title claims abstract description 105
- 238000001514 detection method Methods 0.000 title claims abstract description 26
- 230000008569 process Effects 0.000 title claims abstract description 24
- 239000000284 extract Substances 0.000 claims abstract description 16
- 230000006870 function Effects 0.000 claims description 20
- 230000003542 behavioural effect Effects 0.000 claims description 6
- 238000000605 extraction Methods 0.000 claims description 5
- 230000000630 rising effect Effects 0.000 claims description 5
- 238000009499 grossing Methods 0.000 claims description 3
- 230000002159 abnormal effect Effects 0.000 abstract description 19
- 238000012544 monitoring process Methods 0.000 abstract description 4
- 230000006399 behavior Effects 0.000 description 102
- 238000012423 maintenance Methods 0.000 description 8
- PCHJSUWPFVWCPO-UHFFFAOYSA-N gold Chemical compound [Au] PCHJSUWPFVWCPO-UHFFFAOYSA-N 0.000 description 5
- 239000010931 gold Substances 0.000 description 5
- 229910052737 gold Inorganic materials 0.000 description 5
- 230000008901 benefit Effects 0.000 description 4
- 230000009471 action Effects 0.000 description 3
- 230000008859 change Effects 0.000 description 3
- 230000003203 everyday effect Effects 0.000 description 3
- 238000004900 laundering Methods 0.000 description 3
- XLYOFNOQVPJJNP-UHFFFAOYSA-N water Substances O XLYOFNOQVPJJNP-UHFFFAOYSA-N 0.000 description 3
- 238000004590 computer program Methods 0.000 description 2
- 238000011161 development Methods 0.000 description 2
- 238000010586 diagram Methods 0.000 description 2
- 238000012545 processing Methods 0.000 description 2
- 241001269238 Data Species 0.000 description 1
- 206010028813 Nausea Diseases 0.000 description 1
- 238000004458 analytical method Methods 0.000 description 1
- 230000009286 beneficial effect Effects 0.000 description 1
- 150000001875 compounds Chemical class 0.000 description 1
- 239000012141 concentrate Substances 0.000 description 1
- 230000002354 daily effect Effects 0.000 description 1
- 238000013461 design Methods 0.000 description 1
- 238000001035 drying Methods 0.000 description 1
- 230000007246 mechanism Effects 0.000 description 1
- 239000000203 mixture Substances 0.000 description 1
- 230000008439 repair process Effects 0.000 description 1
- GOLXNESZZPUPJE-UHFFFAOYSA-N spiromesifen Chemical compound CC1=CC(C)=CC(C)=C1C(C(O1)=O)=C(OC(=O)CC(C)(C)C)C11CCCC1 GOLXNESZZPUPJE-UHFFFAOYSA-N 0.000 description 1
- 238000012546 transfer Methods 0.000 description 1
- 238000012795 verification Methods 0.000 description 1
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
- G06F16/20—Information retrieval; Database structures therefor; File system structures therefor of structured data, e.g. relational data
- G06F16/24—Querying
- G06F16/245—Query processing
- G06F16/2455—Query execution
- G06F16/24553—Query execution of query operations
- G06F16/24554—Unary operations; Data partitioning operations
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q30/00—Commerce
- G06Q30/02—Marketing; Price estimation or determination; Fundraising
- G06Q30/0201—Market modelling; Market analysis; Collecting market data
Landscapes
- Engineering & Computer Science (AREA)
- Business, Economics & Management (AREA)
- Finance (AREA)
- Theoretical Computer Science (AREA)
- Strategic Management (AREA)
- Development Economics (AREA)
- Accounting & Taxation (AREA)
- Entrepreneurship & Innovation (AREA)
- Data Mining & Analysis (AREA)
- General Physics & Mathematics (AREA)
- Physics & Mathematics (AREA)
- General Engineering & Computer Science (AREA)
- Databases & Information Systems (AREA)
- Computational Linguistics (AREA)
- Game Theory and Decision Science (AREA)
- Economics (AREA)
- Marketing (AREA)
- General Business, Economics & Management (AREA)
- Financial Or Insurance-Related Operations Such As Payment And Settlement (AREA)
Abstract
The invention discloses the method and system that a kind of anomaly data detection processes, the method comprise the steps that and gather the specific behavior data of user in preset time period；Extract the characteristic information in described specific behavior data, determine the data interval of user's specific behavior data according to described characteristic information；When the specific behavior data of user exceed the data interval of its correspondence, carry out predetermined operation.The present invention in time and accurately detect out abnormal transaction data and carry out respective handling can improve abnormal data monitoring efficiency, reduce corresponding harm.
Description
Technical field
The present invention relates to technical field of data processing, be specifically related to what a kind of anomaly data detection processed
Method, and, the system that a kind of anomaly data detection processes.
Background technology
Along with Internet technology and the high speed development of ecommerce, online transaction grows with each passing day, simultaneously
Bring a lot of safety problem.In recent years, the money laundering carried out by network trading platform, false friendship
Easily and the abnormal normal transaction order of the most serious upset of concluding the business such as fishing behavior, to people's
Produce, life brings the biggest loss.
Network trading platform exigence carries out effective management and control to these queasy transaction behaviors,
Safeguard normal transaction order.General way is to be classified by trade user, then for often
The user of one class sets transaction threshold, if dealing money exceedes described transaction threshold, then accuses
Alert.But, above-mentioned setting transaction threshold is usually general setting, and subjective composition occupies the biggest
Proportion, thus cause accurately detecting out abnormal transaction.
Therefore, in the urgent need to address technical problem is that of those skilled in the art: provide a kind of abnormal
The mechanism that Data Detection processes, it is possible in time and accurately detect out abnormal transaction data and carry out phase
Should process, improve abnormal data monitoring efficiency, reduce corresponding harm.
Summary of the invention
In view of the above problems, it is proposed that the present invention is to provide one to overcome the problems referred to above or at least
Partly solve the method for a kind of abnormal transaction data detection process of the problems referred to above and corresponding one
The system that abnormal transaction data detection processes.
According to one aspect of the present invention, it is provided that a kind of method that anomaly data detection processes, bag
Include:
The specific behavior data of user in collection preset time period；
Extract the characteristic information in described specific behavior data, determine user according to described characteristic information
The data interval of specific behavior data；
When the specific behavior data of user exceed the data interval of its correspondence, carry out predetermined behaviour
Make.
Alternatively, described user includes multiple, and described foundation characteristic information determines user's specific behavior
The step of the data interval of data includes:
According to the characteristic information in the specific behavior data of the plurality of user by the plurality of user's
Online specific behavior data are divided into one or more data interval；
Determine the data interval that the specific behavior data of each user are corresponding.
Alternatively, the described data interval determining user's specific behavior data according to described characteristic information
Step include:
The particular row of described user is determined according to the characteristic information in the specific behavior data of described user
Data interval for data.
Alternatively, described specific behavior data are transaction data.
Alternatively, one or more threshold value is set for described data interval；Described specific as user
When behavioral data exceeds the data interval of its correspondence, the step carrying out predetermined operation includes:
When the transaction data of user exceeds the interval first threshold of its corresponding data but without departing from the second threshold
During value, carry out at least one operation following: send first order warning information, analyze described user's
Specific behavior data；
And/or,
When the transaction data of user exceeds the interval Second Threshold of its corresponding data but without departing from the 3rd threshold
During value, carry out at least one operation following: send second level warning information, suspend described user's
Trading function and described user examine described specific behavior data；
And/or,
When the transaction data of user is beyond three threshold value that its corresponding data is interval, carry out with down to
A few operation: send third level warning information, close all functions of described user, freeze institute
State the account of user, warning.
Alternatively, described first order warning information is mail alarm, and described second level warning information is
Short message alarm, described third level warning information is circulation short message alarm or circulation voice messaging alarm.
Alternatively, when being provided with multiple threshold value in described data interval, described method is also wrapped
Include:
After characteristic information in extracting described transaction data, believe according to the feature of described transaction data
Breath generates corresponding trade off curve；
When the transaction data of user exceeds the interval first threshold of its corresponding data but without departing from the second threshold
During value, and when the trade off curve of described user rises for smoothing, it is determined that the transaction data of described user
For normal data.
Alternatively, described characteristic information includes dealing money and/or trading volume, described according to described many
Characteristic information in the specific behavior data of individual user is by the online specific behavior number of the plurality of user
Include according to the sub-step being divided into one or more data interval:
Extract each user dealing money in preset time period and/or trading volume；
Dealing money and/or the trading volume of described each user are clustered, it is thus achieved that dealing money gathers
Class distributed intelligence and/or trading volume clustering distribution information；
According to described dealing money clustering distribution information and/or trading volume clustering distribution information by useful for institute
The dealing money at family or trading volume are divided into one or more data interval.
Alternatively, described characteristic information includes dealing money and/or trading volume, described according to described use
Characteristic information in the specific behavior data at family determines the data field of the specific behavior data of described user
Between sub-step include:
Extract described user dealing money in preset time period and/or trading volume；
Calculate the meansigma methods of described dealing money and/or the meansigma methods of trading volume；
True according to the preset ratio scope of the meansigma methods of described dealing money and/or the meansigma methods of trading volume
The data interval of fixed described user's specific behavior data.
According to a further aspect in the invention, it is provided that the system that a kind of anomaly data detection processes, bag
Include:
Data acquisition module, is suitable to gather the specific behavior data of user in preset time period；
Characteristic information extracting module, is suitable to extract the characteristic information in described specific behavior data；
Interval division module, is suitable to determine the number of user's specific behavior data according to described characteristic information
According to interval；
Scheduled operation performs module, is suitable to exceed the data of its correspondence in the specific behavior data of user
Time interval, carry out predetermined operation.
Alternatively, described user includes multiple, and described interval division module includes:
First interval division submodule, is suitable to according in the specific behavior data of the plurality of user
The online specific behavior data of the plurality of user are divided into one or more data field by characteristic information
Between；
First interval determines submodule, is adapted to determine that the number that the specific behavior data of each user are corresponding
According to interval.
Alternatively, described interval division module includes:
Second interval division submodule, is suitable to according to the feature in the specific behavior data of described user
Information determines the data interval of the specific behavior data of described user.
Alternatively, described specific behavior data are transaction data.
Alternatively, one or more threshold value is set for described data interval；Described scheduled operation performs
Module includes:
First order alarm submodule, is suitable to exceed its corresponding data interval at the transaction data of user
First threshold but during without departing from Second Threshold, carry out at least one operation following: send the first order and accuse
Alarming information, analyze the specific behavior data of described user；
And/or,
Second level alarm submodule, is suitable to exceed its corresponding data interval at the transaction data of user
Second Threshold but during without departing from three threshold values, carry out at least one operation following: send the second level and accuse
Alarming information, the trading function suspending described user and described user examine described specific behavior number
According to；
And/or,
Third level alarm submodule, is suitable to exceed its corresponding data interval at the transaction data of user
During three threshold values, carry out at least one operation following: send described in third level warning information, closedown
All functions of user, freeze the account of described user, warning.
Alternatively, described first order warning information is mail alarm, and described second level warning information is
Short message alarm, described third level warning information is circulation short message alarm or circulation voice messaging alarm.
Alternatively, when being provided with multiple threshold value in described data interval, described system is also wrapped
Include:
Trade off curve generation module, after being suitable to the characteristic information in extracting described transaction data, depends on
The trade off curve of corresponding user is generated according to the characteristic information of described transaction data；
Normal data determination module, is suitable to exceed its corresponding data interval at the transaction data of user
First threshold but during without departing from Second Threshold, and the trade off curve of described user for smooth rising time,
Judge that the transaction data of described user is as normal data.
Alternatively, described characteristic information includes that dealing money and/or trading volume, described first interval are drawn
Molecular modules includes:
Dealing money or trading volume acquiring unit, be suitable to extract each user in preset time period
Dealing money and/or trading volume；
Clustering distribution information acquisition unit, is suitable to the dealing money of described each user and/or transaction
Amount clusters, it is thus achieved that dealing money clustering distribution information and/or trading volume clustering distribution information；
First data interval division unit, be suitable to according to described dealing money clustering distribution information and/or
Dealing money and/or the trading volume of all users are divided into one or many by trading volume clustering distribution information
Individual data interval.
Alternatively, described characteristic information includes that dealing money and/or trading volume, described second interval are drawn
Molecular modules includes:
Dealing money or trading volume extraction unit, be suitable to extract described user in preset time period
Dealing money and/or trading volume；
Computing unit, is suitable to the meansigma methods of meansigma methods and/or the trading volume calculating described dealing money；
Second data interval division unit, is suitable to the meansigma methods according to described dealing money and/or transaction
The preset ratio scope of the meansigma methods of amount determines the data interval of described user's specific behavior data.
The method and system that a kind of anomaly data detection according to the present invention processes, can be according to user
Specific behavior data in preset time period determine the data interval of user's specific behavior data, and are
Described data interval arranges different threshold values, when the transaction data in described data interval exceedes a certain
Carry out predetermined operation during threshold value, detect abnormal data with this, thus solve traditional different
The coarse problem of Data Detection in regular data detection, achieves the specific behavior of effective monitoring user
The liveness of the data of data and curves and user, thus in time and accurately detect out abnormal data also
Carry out respective handling, improve the efficiency of anomaly data detection, reduce the beneficial effect of corresponding harm.
Described above is only the general introduction of technical solution of the present invention, in order to better understand the present invention
Technological means, and can be practiced according to the content of description, and the present invention's be upper in order to allow
State and can become apparent with other objects, features and advantages, below especially exemplified by the concrete reality of the present invention
Execute mode.
Accompanying drawing explanation
By reading the detailed description of hereafter preferred implementation, various other advantage and benefit pair
Will be clear from understanding in those of ordinary skill in the art.Accompanying drawing is only used for illustrating preferred implementation
Purpose, and be not considered as limitation of the present invention.And in whole accompanying drawing, with identical
Reference marks represents identical parts.In the accompanying drawings:
Fig. 1 shows a kind of method that anomaly data detection processes
The flow chart of steps of embodiment 1；
Fig. 2 shows a kind of method that anomaly data detection processes
The flow chart of steps of embodiment 2；
Fig. 3 shows a kind of method that anomaly data detection processes
Middle characteristic information trade off curve schematic diagram；
Fig. 4 shows the system that a kind of anomaly data detection processes
Structured flowchart.
Detailed description of the invention
It is more fully described the exemplary embodiment of the disclosure below with reference to accompanying drawings.Although in accompanying drawing
Show the exemplary embodiment of the disclosure, it being understood, however, that may be realized in various forms this
Disclose and should not limited by embodiments set forth here.On the contrary, it is provided that these embodiments be in order to
The disclosure can be best understood from, and complete for the scope of the present disclosure can be conveyed to ability
The technical staff in territory.
With reference to Fig. 1, it is shown that a kind of anomaly data detection processes
The flow chart of steps of embodiment of the method 1, specifically may comprise steps of:
Step S110, the specific behavior data of user in collection preset time period；
Step S120, extracts the characteristic information in described specific behavior data, believes according to described feature
Breath determines the data interval of user's specific behavior data；
Step S130, when the specific behavior data of user exceed the data interval of its correspondence, is carried out
Predetermined operation.
In embodiments of the present invention, by the specific behavior data in the user preset time period are carried out
Detect to determine the data interval of user's specific behavior data, and be that described data interval sets one
Or multiple threshold value, it is thus possible to detect abnormal data in time, and can be for abnormal number in various degree
According to, carry out predetermined operation, prevent the loss that abnormal data causes.
With reference to Fig. 2, it is shown that a kind of anomaly data detection processes
The flow chart of steps of embodiment of the method 2, in the present embodiment, with described specific behavior data for handing over
Easily the situation of data illustrates, and specifically may comprise steps of:
Step S210, the transaction data of user in collection preset time period；
Specifically, the transaction data in described collection preset time period can be to gather transaction platform
The transaction data of user in a unit of time, the transaction data of described user can include user
The various situations of the transaction occurred within a period of time in past, such as trading volume, single trade gold
Volume, total transaction amount etc. in a period of time, wherein, described user can be one or more.
It should be noted that in the embodiment of the present invention preset time period of indication can be one month or
The time periods such as person one day, the embodiment of the present invention to this without being any limitation as.
Step S220, extracts the characteristic information in described transaction data, true according to described characteristic information
Determine the data interval of customer transaction data；
For transaction platform, the transaction data of user can use multinomial characteristic information to embody,
Described characteristic information can be trading volume, dealing money etc..User in gathering preset time period
Transaction data after, the characteristic information in described transaction data can be extracted, in order to preferably
Observe each user the transaction rule of the characteristic information of transaction data, Ke Yiwei in preset time period
The transaction data of user generates corresponding trade off curve according to characteristic information.As shown with reference to Fig. 3
Characteristic information trade off curve schematic diagram, abscissa express time in figure, vertical coordinate represents trading volume,
Article two, the trading volume situation of user every day since trade off curve represents two weeks.
In one preferred embodiment of the invention, when described user is multiple, described according to special
Reference breath determines that the step of data interval of user's specific behavior data can include following sub-step:
Sub-step S11, according to the characteristic information in the specific behavior data of the plurality of user by described
The online specific behavior data of multiple users are divided into one or more data interval；
Sub-step S13, determines the data interval that the specific behavior data of each user are corresponding.
Specifically, because the trading situation of each industry is different, in the transaction data of user
Characteristic information can be divided into a lot of groups according to the feature of industry, the daily trading volume of such as general small item
The highest, averagely at more than 100；Clothes then strikes a bargain and wants more relatively small, tens to several
Ten, in consideration of it, different grades of trading volume can be divided into one or more number of deals
According to interval, can be by trading volume one transaction data interval of division more than 100, trading volume exists
Another transaction data of the division of less than 100 is interval.And differ according to the characteristic information of transaction data
Sample, the transaction data interval divided to the transaction data of user is also different, therefore, it can
Clustering information according to described characteristic information divides data interval.
In one preferred embodiment of the invention, described characteristic information can include dealing money,
Described sub-step S11 can include following sub-step:
Sub-step S111, extracts each user dealing money in preset time period；
Sub-step S113, clusters the dealing money of described each user, it is thus achieved that dealing money
Clustering distribution information；
Sub-step S115, according to described dealing money clustering distribution information by the trade gold of all users
Volume is divided into one or more data interval.
Specifically, can obtain according to obtaining each user dealing money in preset time period
Take the clustering distribution information of all customer transaction amount of money, according to described clustering distribution information by useful for institute
The dealing money at family is divided into one or more data interval.Such as, by obtaining dealing money
Distribution situation obtains the dealing money of small item (sole product is inexpensive in 100 yuan) and concentrates on
Less than 1000 yuan, 1000 to 5000 yuan, more than 5000 yuan, then the transaction data interval divided can
Think less than 1000 yuan, 1000 yuan-5000 yuan, more than 5000 yuan.
In another preferred embodiment of the invention, described characteristic information can include trading volume,
Described sub-step S11 can include following sub-step:
Sub-step S121, extracts each user trading volume in preset time period；
Sub-step S123, clusters the trading volume of described each user, it is thus achieved that trading volume clusters
Distributed intelligence；
Sub-step S125, draws the trading volume of all users according to described trading volume clustering distribution information
It is divided into one or more data interval.
Specifically, described carry out clustering the method obtaining data interval with described according to trading volume
The method obtaining data interval according to dealing money is identical, and the present embodiment is not described in detail in this.
In one preferred embodiment of the invention, described foundation characteristic information determines user's particular row
Following sub-step can be included for the step of the data interval of data:
Sub-step S21, determines described use according to the characteristic information in the specific behavior data of described user
The data interval of the specific behavior data at family.
In one preferred embodiment of the invention, described characteristic information can include dealing money,
Described sub-step S21 can include following sub-step:
Sub-step S211, extracts described user dealing money in preset time period；
Sub-step S213, calculates the meansigma methods of described dealing money；
Sub-step S215, determines described according to the preset ratio scope of the meansigma methods of described dealing money
The data interval of customer transaction data.
In another preferred embodiment of the invention, described characteristic information can include trading volume,
Described sub-step S21 can include following sub-step:
Sub-step S221, extracts described user trading volume in preset time period；
Sub-step S223, calculates the meansigma methods of described trading volume；
Sub-step S225, determines described use according to the preset ratio scope of the meansigma methods of described trading volume
The data interval of family transaction data.
Specifically, the characteristic information of customer transaction data can be extracted, such as trading volume, trade gold
Volumes etc., by calculating the meansigma methods of described characteristic information, according to the preset ratio model of described meansigma methods
Enclose the data interval determining customer transaction data.Wherein, the preset ratio scope of described meansigma methods can
Think numerical range or a percentage range etc. that meansigma methods fluctuates, such as according to transaction
Amount, or the upper and lower 20% division data interval of meansigma methods of dealing money.
Certainly, described transaction is divided according to clustering distribution information or according to the meansigma methods of characteristic information
Data interval is only the example of the embodiment of the present invention, and those skilled in the art use according to practical situation
Other model split data intervals are all possible, such as, if described preset time period is long
A time period (such as one month), it is also possible to according to described transaction data is specified feature letter
The clustering distribution information of the meansigma methods of breath divides data interval, such as, obtain each in units of day
The dealing money of user every day, after one month, with the summation of the dealing money of described every day divided by
Natural law obtains dealing money meansigma methods, then obtains according to the dealing money meansigma methods of each user and hands over
The easily clustering distribution information of the amount of money, according to described clustering distribution information the distributed areas comparing concentration
As data interval；Or, according to meansigma methods and the maximum of specifying characteristic information in transaction data
Division transaction data is interval, or after transaction data being weighted according to the situation in busy season and dull season
Divide, the embodiment of the present invention to this without being any limitation as.
It addition, in implementing, owing to the trading situation of user will not be unalterable, deposit
A lot of probabilities, such as user business within a period of time carry out the best, so Day Trading
The amount of money is constantly increasing；There certainly exist contrary possibility.One or many so divided to user
Individual transaction data interval should be that tool is resilient, dynamically can change according to the situation of transaction,
Therefore, it is interval that the embodiment of the present invention can also dynamically adjust the one or more transaction data, example
As, still quote above-mentioned example, along with the change of economic conditions, small commodity market development is fine,
The dealing money of user is concentrated mainly on less than 2000 yuan, 2000 yuan to 7000, more than 7000 yuan
Three intervals, then can adjust, according to described change, the cut off value that each transaction data is interval,
Because conventional cut off value is the most out-of-date.In a word, transaction platform can be according to this Data Representation
Adjust cut off value.Certainly, described transaction data interval can also be carried out by those skilled in the art
Manual setting, the present invention to this without being any limitation as.
Step S230, when the transaction data of user exceeds the data interval of its correspondence, makes a reservation for
Operation.
It is applied to the embodiment of the present invention, is provided with one or more threshold values of correspondence for data interval,
Can be to the threshold value of each data interval definition transaction upper limit risk supervision, when in transaction data interval
The transaction data of user reach to carry out predetermined operation when specifying threshold value.Wherein, described definition
Threshold value is not a unique value, but a class value, each threshold value correspondence one scheduled operation,
I.e. behavior.
Described one group of threshold value can be made up of multiple threshold values, and this is not restricted by the embodiment of the present invention,
The embodiment of the present invention illustrates with the situation that described threshold value is three, preferred in the one of the present invention
In embodiment, described step S230 can include following sub-step:
Sub-step S31, when the transaction data of user beyond the interval first threshold of its corresponding data but
During without departing from Second Threshold, carry out at least one operation following: send first order warning information, divide
Analyse the transaction data of described user.
Specifically, the first threshold (or deserving to be called limit value) of described data interval is exactly corresponding threshold value
In minimum, this value is referred to as " basic water level value ".Transaction when the characteristic attribute specified
Data break through this value, but do not break through next value, and described first order warning information can include accusing
Alert rank and alarm mode, described warning level can be " commonly ", can use and more relax
Alarm mode alert operation maintenance personnel, such as mail alarm, corresponding " behavior " is the most slow
With.When operation maintenance personnel obtains reporting to the police, represent that this transaction data may have exception, need to cause this
The attention of the user that transaction data is corresponding, operation maintenance personnel can analyze the transaction data of described user,
Such as check this user trade off curve during this period of time, see and whether belong to a smooth mistake risen
Whether journey, if belonging to smooth rising, then can be determined that as arm's length dealing data, it may be considered that repair
This user (is moved into the transaction data zone that another one trading volume is bigger by the Range Attributes changing this user
In between), or temporarily observe, do not take any action.
In another preferred embodiment of the invention, described step S230 can include following sub-step
Rapid:
Sub-step S41, when the transaction data of user beyond the interval Second Threshold of its corresponding data but
During without departing from three threshold values, carry out at least one operation following: send second level warning information, temporarily
The trading function and the described user that stop described user examine described transaction data.
Specifically, if the transaction data of user directly breaks through the second threshold that corresponding data is interval
Value, does not breaks through the 3rd threshold value, represents that the transaction within certain a period of time of this transaction data swashs suddenly
Increasing, this unexpected surge is the most abnormal, exists for the biggest transaction risk this time
Probability.Second Threshold is positioned on " basic water level value ", can be scheduled on the position more than 10%
Or the place of 20%, is determined on a case-by-case basis, this value is " warning line ", described second
Level warning information can be to include alarm level and alarm mode, and wherein said alarm level can be
" more serious ", can use and alert operation maintenance personnel, such as note report than relatively rapid type of alarm
Alert, corresponding " behavior " is the strictest.At this moment the behavior defined can be divided into two parts, and one
It is the trading function of the user that this transaction data of transaction platform automatic pause is corresponding, suspends this use all
The current transaction at family, but other function of this user retains.Two is that operation maintenance personnel needs to go examination & verification to be somebody's turn to do
The transaction data of user, and this user examines, check for wash sale or other
Abnormal activity.
In another preferred embodiment of the invention, described step S230 can include following sub-step
Rapid:
Sub-step S51, when the transaction data of user exceeds the 3rd threshold value that its corresponding data is interval
Time, carry out at least one operation following: send third level warning information, close the institute of described user
There is function, freeze the account of described user, warning.
Specifically, if the transaction data of user directly breaks through the 3rd that corresponding transaction data is interval
Threshold value, this threshold value is " disaster water level ", and the alarm level in described warning information can be
" seriously ", shows that this transaction data exists the most serious problem, needs to notify O&M people at once
Member, in the case of can not get operation maintenance personnel feedback, uninterruptedly notifies, such as, circulates SMS notification
Or language phone, until operation maintenance personnel responds, " behavior " of employing is the strictest.At this moment
Transaction platform can close all functions of user corresponding to this transaction data, such as, forbid transaction, prohibits
Only withdraw deposit, freeze the account of this user.Transaction is analyzed by operation maintenance personnel, if suspecting is to wash
Money or wash sale, can report to the police.
The embodiment of the present invention is by detecting the transaction data in preset time period, to divide number
According to interval, and the mode that data interval sets one or more threshold values detects abnormal number of deals
According to.Wherein, described abnormal transaction data can be to utilize payment platform to carry out money laundering, wash sale
Deng.Wherein, money laundering refers to the money that lawless person is obtained by illegal means, by legal
The most a series of transaction of financial work flow or transfer accounts, become the mistake of the money seeming legal
Journey；Wash sale refers to improve account credit by improper mode, hinders buyer efficiently to do shopping power
The behavior of benefit.Can be with the trade off curve of effective monitoring user and the friendship of user by the embodiment of the present invention
The easily liveness of data, thus detect abnormal transaction data, it is to avoid transaction platform becomes illegal point
Son obtains the instrument of illegal profit.
Certainly, the situation that specific behavior data are transaction data of described user is only the present embodiment
A kind of example, described specific behavior data can also be other behavioral datas, the present invention to this without
It is any limitation as.
It should be noted that for embodiment of the method, in order to be briefly described, therefore it is all expressed as
A series of combination of actions, but those skilled in the art should know, and the present invention is by being retouched
The restriction of the sequence of movement stated because according to the present invention, some step can use other orders or
Person is carried out simultaneously.Secondly, those skilled in the art also should know, reality described in this description
Executing example and belong to preferred embodiment, involved action and module not necessarily present invention institute is necessary
's.
With reference to Fig. 4, it is shown that a kind of anomaly data detection processes
The structured flowchart of system embodiment, specifically can include with lower module:
Data acquisition module 410, is suitable to gather the specific behavior data of user in preset time period；
In a kind of preferred exemplary of the present embodiment, described specific behavior data can be number of deals
According to.
Characteristic information extracting module 420, is suitable to extract the characteristic information in described specific behavior data；
Interval division module 430, is suitable to according to described characteristic information as determining user's specific behavior number
According to data interval；
In one preferred embodiment of the invention, described user can be multiple, and described interval is drawn
Sub-module 430 can include following submodule:
First interval division submodule, is suitable to according in the specific behavior data of the plurality of user
The online specific behavior data of the plurality of user are divided into one or more data field by characteristic information
Between；
First interval determines submodule, is adapted to determine that the number that the specific behavior data of each user are corresponding
According to interval.
Further, in one preferred embodiment of the invention, described characteristic information can include
Dealing money and/or trading volume, described first interval division submodule can include such as lower unit:
Dealing money or trading volume acquiring unit, be suitable to extract each user in preset time period
Dealing money and/or trading volume；
Clustering distribution information acquisition unit, is suitable to the dealing money of described each user and/or transaction
Amount clusters, it is thus achieved that dealing money clustering distribution information and/or trading volume clustering distribution information；
First data interval division unit, be suitable to according to described dealing money clustering distribution information and/or
Dealing money and/or the trading volume of all users are divided into one or many by trading volume clustering distribution information
Individual data interval.
In another preferred embodiment of the invention, described interval division module 430 can include
Following submodule:
Second interval division submodule, is suitable to according to the feature in the specific behavior data of described user
Information determines the data interval of the specific behavior data of described user.
Further, in one preferred embodiment of the invention, described characteristic information can include
Dealing money and/or trading volume, described second interval division submodule can include such as lower unit:
Dealing money or trading volume extraction unit, be suitable to extract described user in preset time period
Dealing money and/or trading volume；
Computing unit, is suitable to the meansigma methods of meansigma methods and/or the trading volume calculating described dealing money；
Second data interval division unit, is suitable to the meansigma methods according to described dealing money and/or transaction
The preset ratio scope of the meansigma methods of amount determines the data interval of described user's specific behavior data.
Scheduled operation performs module 440, is suitable to the specific behavior data user and exceeds its correspondence
During data interval, carry out predetermined operation.
In one preferred embodiment of the invention, it is provided with one or more for described data interval
Threshold value；Described scheduled operation performs module 440 and may include that
First order alarm submodule, is suitable to exceed its corresponding data interval at the transaction data of user
First threshold but during without departing from Second Threshold, carry out at least one operation following: send the first order and accuse
Alarming information, analyze the specific behavior data of described user；
And/or,
Second level alarm submodule, is suitable to exceed its corresponding data interval at the transaction data of user
Second Threshold but during without departing from three threshold values, carry out at least one operation following: send the second level and accuse
Alarming information, the trading function suspending described user and described user examine described specific behavior number
According to；
And/or,
Third level alarm submodule, is suitable to exceed its corresponding data interval at the transaction data of user
During three threshold values, carry out at least one operation following: send described in third level warning information, closedown
All functions of user, freeze the account of described user, warning.
Wherein, described first order warning information can be mail alarm, described second level warning information
Can be short message alarm, described third level warning information can be circulation short message alarm or circulation voice
Information alert.
Alternatively, when being provided with multiple threshold value in described data interval, described system is all right
Including:
Trade off curve generation module, after being suitable to the characteristic information in extracting described transaction data, depends on
The trade off curve of corresponding user is generated according to the characteristic information of described transaction data；
Normal data determination module, is suitable to exceed its corresponding data interval at the transaction data of user
First threshold but during without departing from Second Threshold, and the trade off curve of described user for smooth rising time,
Judge that the transaction data of described user is as normal data.
For the system embodiment of Fig. 4, due to its phase basic with above-mentioned embodiment of the method
Seemingly, so describe is fairly simple, relevant part sees the part of embodiment of the method and illustrates.
Provided herein algorithm and display not with any certain computer, virtual system or other set
Standby intrinsic relevant.Various general-purpose systems can also be used together with based on teaching in this.According to upper
The description in face, constructs the structure required by this kind of system and is apparent from.Additionally, the present invention is also
It is not for any certain programmed language.It is understood that, it is possible to use various programming languages realize at this
The present disclosure described, and the description above done language-specific is to disclose this
Bright preferred forms.
In description mentioned herein, illustrate a large amount of detail.But, it is possible to reason
Solving, embodiments of the invention can be put into practice in the case of not having these details.Real at some
In example, it is not shown specifically known method, structure and technology, in order to not fuzzy to this specification
Understanding.
Similarly, it will be appreciated that in order to simplify the disclosure and help to understand in each inventive aspect
One or more, above in the description of the exemplary embodiment of the present invention, each of the present invention
Feature is grouped together in single embodiment, figure or descriptions thereof sometimes.But, and
The method of the disclosure should be construed to reflect an intention that i.e. the present invention for required protection requirement
Than the more feature of feature being expressly recited in each claim.More precisely, it is as follows
As the claims in face are reflected, inventive aspect is less than single enforcement disclosed above
All features of example.Therefore, it then follows claims of detailed description of the invention are thus expressly incorporated in
This detailed description of the invention, the most each claim itself is as the independent embodiment of the present invention.
Those skilled in the art are appreciated that and can enter the module in the equipment in embodiment
Row adaptively changes and they is arranged on the one or more equipment different from this embodiment
In.Module in embodiment or unit or assembly can be combined into a module or unit or group
Part, and multiple submodule or subelement or sub-component can be put them in addition.Except so
Feature and/or process or unit at least some exclude each other outside, can use any
Combination is to all spies disclosed in this specification (including adjoint claim, summary and accompanying drawing)
Levy and so disclosed any method or all processes of equipment or unit are combined.Unless
Additionally it is expressly recited, disclosed in this specification (including adjoint claim, summary and accompanying drawing)
Each feature can be replaced by providing identical, equivalent or the alternative features of similar purpose.
Although additionally, it will be appreciated by those of skill in the art that embodiment bags more described herein
Some feature included by including in other embodiments rather than further feature, but different embodiment
The combination of feature means to be within the scope of the present invention and formed different embodiments.Example
As, in the following claims, embodiment required for protection one of arbitrarily can be with
Arbitrary compound mode uses.
The all parts embodiment of the present invention can realize with hardware, or with at one or more
The software module run on processor realizes, or realizes with combinations thereof.The technology of this area
Personnel should be appreciated that and can use microprocessor or digital signal processor (DSP) in practice
Realize the some or all portions in anomaly data detection processing equipment according to embodiments of the present invention
The some or all functions of part.The present invention is also implemented as performing side as described herein
Part or all equipment of method or device program (such as, computer program and computer
Program product).The program of such present invention of realization can store on a computer-readable medium,
Or can be to have the form of one or more signal.Such signal can be from internet website
Upper download obtains, or provides on carrier signal, or provides with any other form.
The present invention will be described rather than limits the present invention to it should be noted above-described embodiment
Make, and those skilled in the art can design without departing from the scope of the appended claims
Go out alternative embodiment.In the claims, any reference marks structure between bracket should not will be located in
Cause limitations on claims.Word " comprises " not exclude the presence of and does not arranges in the claims
Element or step.Word "a" or "an" before being positioned at element do not exclude the presence of multiple this
The element of sample.The present invention can be by means of including the hardware of some different elements and by means of suitable
When the computer of programming realizes.If in the unit claim listing equipment for drying, these dresses
Several in putting can be specifically to be embodied by same hardware branch.Word first, second,
And third use does not indicates that any order.Can be title by these word explanations.
Embodiment of the invention discloses that a kind of method that A1, anomaly data detection process, bag
Include: the specific behavior data of user in collection preset time period；Extract in described specific behavior data
Characteristic information, determine the data interval of user's specific behavior data according to described characteristic information；When
When the specific behavior data of user exceed the data interval of its correspondence, carry out predetermined operation.A2、
Method as described in A1, described user includes multiple, and described foundation characteristic information determines that user is specific
The step of the data interval of behavioral data includes: according in the specific behavior data of the plurality of user
Characteristic information the online specific behavior data of the plurality of user are divided into one or more data
Interval；Determine the data interval that the specific behavior data of each user are corresponding.A3, as described in A1
Method, the step of the described data interval determining user's specific behavior data according to described characteristic information
Suddenly include: determine the spy of described user according to the characteristic information in the specific behavior data of described user
Determine the data interval of behavioral data.A4, method as described in A1 or A2 or A3, described specific
Behavioral data is transaction data.A5, method as described in A4, arrange one for described data interval
Individual or multiple threshold values；When the described specific behavior data as user exceed the data interval of its correspondence,
The step carrying out predetermined operation includes: when the transaction data of user is beyond its corresponding data interval
First threshold but during without departing from Second Threshold, carry out at least one operation following: send the first order and accuse
Alarming information, analyze the specific behavior data of described user；And/or, when the transaction data of user exceeds
Second Threshold that its corresponding data is interval but during without departing from three threshold values, carry out at least one behaviour following
Make: the trading function send second level warning information, suspending described user is examined with described user
Described specific behavior data；And/or, when user transaction data beyond its corresponding data interval the
During three threshold values, carry out at least one operation following: send third level warning information, close described use
All functions at family, freeze the account of described user, warning.A6, method as described in A5,
Described first order warning information is mail alarm, and described second level warning information is short message alarm, institute
State third level warning information for circulation short message alarm or circulation voice messaging alarm.A7, such as A5 institute
The method stated, when being provided with multiple threshold value in described data interval, described method also includes:
After characteristic information in extracting described transaction data, the characteristic information according to described transaction data is raw
Become corresponding trade off curve；When the transaction data of user exceeds the first threshold that its corresponding data is interval
But during without departing from Second Threshold, and when the trade off curve of described user rises for smoothing, it is determined that described
The transaction data of user is normal data.A8, method as described in A2, described characteristic information includes
Dealing money and/or trading volume, described according to the feature in the specific behavior data of the plurality of user
The online specific behavior data of the plurality of user are divided into one or more data interval by information
Sub-step includes: extract each user dealing money in preset time period and/or trading volume；Will
Dealing money and/or the trading volume of described each user cluster, it is thus achieved that dealing money clustering distribution
Information and/or trading volume clustering distribution information；According to described dealing money clustering distribution information and/or
Dealing money or the trading volume of all users are divided into one or more by trading volume clustering distribution information
Data interval.A9, method as described in A3, described characteristic information includes dealing money and/or friendship
Yi Liang, described determines described user's according to the characteristic information in the specific behavior data of described user
The sub-step of the data interval of specific behavior data includes: extract described user in preset time period
Dealing money and/or trading volume；Calculate the meansigma methods of described dealing money and/or the flat of trading volume
Average；According to the meansigma methods of described dealing money and/or the preset ratio scope of the meansigma methods of trading volume
Determine the data interval of described user's specific behavior data.
The system that embodiments of the invention also disclose B10, a kind of anomaly data detection processes, bag
Include: data acquisition module, be suitable to gather the specific behavior data of user in preset time period；Feature
Information extraction modules, is suitable to extract the characteristic information in described specific behavior data；Interval division mould
Block, is suitable to determine the data interval of user's specific behavior data according to described characteristic information；Predetermined behaviour
Make to perform module, be suitable to, when the specific behavior data of user exceed the data interval of its correspondence, enter
The operation that row is predetermined.B11, system as described in B10, described user includes multiple, described interval
Division module includes: the first interval division submodule, is suitable to the particular row according to the plurality of user
For the characteristic information in data the online specific behavior data of the plurality of user are divided into one or
Multiple data intervals；First interval determines submodule, is adapted to determine that the specific behavior number of each user
According to corresponding data interval.B12, system as described in B10, described interval division module includes:
Second interval division submodule, is suitable to according to the characteristic information in the specific behavior data of described user
Determine the data interval of the specific behavior data of described user.B13, such as B10 or B11 or B12
Described system, described specific behavior data are transaction data.B14, as described in B13 it is
System, arranges one or more threshold value for described data interval；Described scheduled operation performs module bag
Include: first order alarm submodule, be suitable to exceed its corresponding data interval at the transaction data of user
First threshold but during without departing from Second Threshold, carry out at least one operation following: send the first order and accuse
Alarming information, analyze the specific behavior data of described user；And/or, second level alarm submodule, suitable
The interval Second Threshold of its corresponding data is exceeded but without departing from the 3rd threshold value in the transaction data user
Time, carry out at least one operation following: send second level warning information, suspend the friendship of described user
Easily function and described user examine described specific behavior data；And/or, third level alarm submodule
Block, is suitable to when the transaction data of user is beyond three threshold value that its corresponding data is interval, carry out with
At least one operation lower: send third level warning information, close all functions of described user, freeze
Tie the account of described user, warning.B15, system as described in B14, the described first order alerts
Information is mail alarm, and described second level warning information is short message alarm, described third level alarm letter
Breath is circulation short message alarm or circulation voice messaging alarm.B16, system as described in B14, when
When being provided with multiple threshold value in described data interval, described system also includes: trade off curve generates
Module, after being suitable to the characteristic information in extracting described transaction data, according to described transaction data
Characteristic information generates the trade off curve of corresponding user；Normal data determination module, is suitable to user's
When transaction data is beyond the interval first threshold of its corresponding data but without departing from Second Threshold and described
When the trade off curve of user is for smooth rising, it is determined that the transaction data of described user is normal data.
B17, system as described in B11, described characteristic information includes dealing money and/or trading volume, institute
State the first interval division submodule to include: dealing money or trading volume acquiring unit, be suitable to extract often
Individual user dealing money in preset time period and/or trading volume；Clustering distribution acquisition of information list
Unit, is suitable to cluster dealing money and/or the trading volume of described each user, it is thus achieved that trade gold
Volume clustering distribution information and/or trading volume clustering distribution information；First data interval division unit, suitable
According to described dealing money clustering distribution information and/or trading volume clustering distribution information by all users
Dealing money and/or trading volume be divided into one or more data interval.B18, as described in B12
System, described characteristic information includes dealing money and/or trading volume, described second interval division
Module includes: dealing money or trading volume extraction unit, is suitable to extract described user at Preset Time
Dealing money in Duan and/or trading volume；Computing unit, is suitable to calculate the average of described dealing money
Value and/or the meansigma methods of trading volume；Second data interval division unit, is suitable to according to described trade gold
The preset ratio scope of the meansigma methods of volume and/or the meansigma methods of trading volume determines described user's specific behavior
The data interval of data.
Claims (14)
1. the method that anomaly data detection processes, including:
The specific behavior data of user in collection preset time period, wherein, described specific behavior data
For transaction data；
Extract the characteristic information in described specific behavior data, determine user according to described characteristic information
The data interval of specific behavior data, and multiple threshold value is set for described data interval；And,
Corresponding trade off curve is generated according to the characteristic information of described transaction data；
When the specific behavior data of user exceed the data interval of its correspondence, carry out predetermined behaviour
Make；
Described method also includes:
When the transaction data of user exceeds the interval first threshold of its corresponding data but without departing from the second threshold
During value, and when the trade off curve of described user rises for smoothing, it is determined that the transaction data of described user
For normal data.
2. the method for claim 1, described user includes multiple, described according to described spy
Reference breath determines that the step of the data interval of the specific behavior data of user includes:
According to the characteristic information in the specific behavior data of the plurality of user by the plurality of user's
Online specific behavior data are divided into one or more data interval；
Determine the data interval that the specific behavior data of each user are corresponding.
3. the method for claim 1, the described spy determining user according to described characteristic information
The step of the data interval determining behavioral data includes:
The particular row of described user is determined according to the characteristic information in the specific behavior data of described user
Data interval for data.
4. the method for claim 1, the described specific behavior data as user are right beyond it
During the data interval answered, the step carrying out predetermined operation includes:
When the transaction data of user exceeds the interval first threshold of its corresponding data but without departing from the second threshold
During value, carry out at least one operation following: send first order warning information, analyze described user's
Specific behavior data；
And/or,
When the transaction data of user exceeds the interval Second Threshold of its corresponding data but without departing from the 3rd threshold
During value, carry out at least one operation following: send second level warning information, suspend described user's
Trading function and described user examine described specific behavior data；
And/or,
When the transaction data of user is beyond three threshold value that its corresponding data is interval, carry out with down to
A few operation: send third level warning information, close all functions of described user, freeze institute
State the account of user, warning.
5. method as claimed in claim 4, described first order warning information is mail alarm, institute
Stating second level warning information is short message alarm, described third level warning information for circulation short message alarm or
Circulation voice messaging alerts.
6. method as claimed in claim 2, described characteristic information includes dealing money and/or transaction
Amount, described according to the characteristic information in the specific behavior data of the plurality of user by the plurality of use
The sub-step that the online specific behavior data at family are divided into one or more data interval includes:
Extract each user dealing money in preset time period and/or trading volume；
Dealing money and/or the trading volume of described each user are clustered, it is thus achieved that dealing money gathers
Class distributed intelligence and/or trading volume clustering distribution information；
According to described dealing money clustering distribution information and/or trading volume clustering distribution information by useful for institute
The dealing money at family or trading volume are divided into one or more data interval.
7. method as claimed in claim 3, described characteristic information includes dealing money and/or friendship
Yi Liang, described determines described user's according to the characteristic information in the specific behavior data of described user
The sub-step of the data interval of specific behavior data includes:
Extract described user dealing money in preset time period and/or trading volume；
Calculate the meansigma methods of described dealing money and/or the meansigma methods of trading volume；
True according to the preset ratio scope of the meansigma methods of described dealing money and/or the meansigma methods of trading volume
The data interval of the specific behavior data of fixed described user.
8. the system that anomaly data detection processes, including:
Data acquisition module, is suitable to gather the specific behavior data of user in preset time period, wherein,
Described specific behavior data are transaction data；
Characteristic information extracting module, is suitable to extract the characteristic information in described specific behavior data；
Interval division module, is suitable to determine the specific behavior data of user according to described characteristic information
Data interval, and multiple threshold value is set for described data interval；
Scheduled operation performs module, is suitable to exceed the data of its correspondence in the specific behavior data of user
Time interval, carry out predetermined operation；
Described system also includes:
Trade off curve generation module, after being suitable to the characteristic information in extracting described transaction data, depends on
The trade off curve of corresponding user is generated according to the characteristic information of described transaction data；
Normal data determination module, is suitable to exceed its corresponding data interval at the transaction data of user
First threshold but during without departing from Second Threshold, and the trade off curve of described user for smooth rising time,
Judge that the transaction data of described user is as normal data.
9. system as claimed in claim 8, described user includes multiple, described interval division mould
Block includes:
First interval division submodule, is suitable to according in the specific behavior data of the plurality of user
The online specific behavior data of the plurality of user are divided into one or more data field by characteristic information
Between；
First interval determines submodule, is adapted to determine that the number that the specific behavior data of each user are corresponding
According to interval.
10. system as claimed in claim 8, described interval division module includes:
Second interval division submodule, is suitable to according to the feature in the specific behavior data of described user
Information determines the data interval of the specific behavior data of described user.
11. systems as claimed in claim 8, described scheduled operation performs module and includes:
First order alarm submodule, is suitable to exceed its corresponding data interval at the transaction data of user
First threshold but during without departing from Second Threshold, carry out at least one operation following: send the first order and accuse
Alarming information, analyze the specific behavior data of described user；
And/or,
Second level alarm submodule, is suitable to exceed its corresponding data interval at the transaction data of user
Second Threshold but during without departing from three threshold values, carry out at least one operation following: send the second level and accuse
Alarming information, the trading function suspending described user and described user examine described specific behavior number
According to；
And/or,
Third level alarm submodule, is suitable to exceed its corresponding data interval at the transaction data of user
During three threshold values, carry out at least one operation following: send described in third level warning information, closedown
All functions of user, freeze the account of described user, warning.
12. systems as claimed in claim 11, described first order warning information is mail alarm,
Described second level warning information is short message alarm, and described third level warning information is circulation short message alarm
Or circulation voice messaging alarm.
13. systems as claimed in claim 9, described characteristic information includes dealing money and/or friendship
Yi Liang, described first interval division submodule includes:
Dealing money or trading volume acquiring unit, be suitable to extract each user in preset time period
Dealing money and/or trading volume；
Clustering distribution information acquisition unit, is suitable to the dealing money of described each user and/or transaction
Amount clusters, it is thus achieved that dealing money clustering distribution information and/or trading volume clustering distribution information；
First data interval division unit, be suitable to according to described dealing money clustering distribution information and/or
Dealing money and/or the trading volume of all users are divided into one or many by trading volume clustering distribution information
Individual data interval.
14. systems as claimed in claim 10, described characteristic information includes dealing money and/or friendship
Yi Liang, described second interval division submodule includes:
Dealing money or trading volume extraction unit, be suitable to extract described user in preset time period
Dealing money and/or trading volume；
Computing unit, is suitable to the meansigma methods of meansigma methods and/or the trading volume calculating described dealing money；
Second data interval division unit, is suitable to the meansigma methods according to described dealing money and/or transaction
The preset ratio scope of the meansigma methods of amount determines the data interval of the specific behavior data of described user.
Priority Applications (2)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201610755774.4A CN106446021B (en) | 2013-06-24 | 2013-06-24 | A kind of method and system of anomaly data detection processing |
| CN201310253223.4A CN103365969B (en) | 2013-06-24 | 2013-06-24 | The method and system that a kind of anomaly data detection processes |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201310253223.4A CN103365969B (en) | 2013-06-24 | 2013-06-24 | The method and system that a kind of anomaly data detection processes |
Related Child Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201610755774.4A Division CN106446021B (en) | 2013-06-24 | 2013-06-24 | A kind of method and system of anomaly data detection processing |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN103365969A CN103365969A (en) | 2013-10-23 |
| CN103365969B true CN103365969B (en) | 2016-09-28 |
Family
ID=49367310
Family Applications (2)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201310253223.4A Active CN103365969B (en) | 2013-06-24 | 2013-06-24 | The method and system that a kind of anomaly data detection processes |
| CN201610755774.4A Expired - Fee Related CN106446021B (en) | 2013-06-24 | 2013-06-24 | A kind of method and system of anomaly data detection processing |
Family Applications After (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201610755774.4A Expired - Fee Related CN106446021B (en) | 2013-06-24 | 2013-06-24 | A kind of method and system of anomaly data detection processing |
Country Status (1)
| Country | Link |
|---|---|
| CN (2) | CN103365969B (en) |
Families Citing this family (40)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN104751566B (en) * | 2013-12-30 | 2018-11-27 | 中国银联股份有限公司 | It monitors the method for pseudo- card risk and realizes the transaction processing system of this method |
| CN104852810B (en) * | 2014-02-18 | 2018-11-30 | 中国移动通信集团公司 | A kind of determination method and apparatus of business platform exception |
| CN103986515B (en) * | 2014-05-09 | 2016-06-08 | 浙江中烟工业有限责任公司 | The performance indications monitoring method of fibre channel media |
| CN104077371B (en) * | 2014-06-24 | 2019-03-29 | 用友优普信息技术有限公司 | The method and system of monitor database abnormal data |
| CN105225116A (en) * | 2014-06-24 | 2016-01-06 | 阿里巴巴集团控股有限公司 | The recognition methods of transactional operation and server |
| CN105335851B (en) * | 2014-08-01 | 2021-12-21 | 小米科技有限责任公司 | Pre-payment confirmation protection method and device based on payment history |
| CN105426365B (en) * | 2014-08-01 | 2018-11-02 | 阿里巴巴集团控股有限公司 | Distinguish the method and device of interbehavior |
| CN105405048B (en) * | 2014-09-09 | 2020-02-11 | 阿里巴巴集团控股有限公司 | Method and device for identifying periodic behaviors |
| CN106327230B (en) * | 2015-06-30 | 2019-12-24 | 阿里巴巴集团控股有限公司 | Abnormal user detection method and equipment |
| CN106789844B (en) * | 2015-11-23 | 2020-06-16 | 阿里巴巴集团控股有限公司 | Malicious user identification method and device |
| CN106815452A (en) * | 2015-11-27 | 2017-06-09 | 苏宁云商集团股份有限公司 | A kind of cheat detection method and device |
| CN105528535A (en) * | 2015-12-25 | 2016-04-27 | 北京奇虎科技有限公司 | Log information based user behavior analysis method and apparatus |
| CN106980998A (en) * | 2016-01-18 | 2017-07-25 | 阿里巴巴集团控股有限公司 | The abnormal monitoring method of merchant transaction and device |
| CN107133833A (en) * | 2016-02-26 | 2017-09-05 | 阿里巴巴集团控股有限公司 | abnormal transaction identification method and device |
| CN107292641A (en) * | 2016-03-30 | 2017-10-24 | 阿里巴巴集团控股有限公司 | A kind of method and system of data management and control |
| CN106202389B (en) * | 2016-07-08 | 2020-02-07 | 中国银联股份有限公司 | Anomaly monitoring method and device based on transaction data |
| CN106326913A (en) * | 2016-08-09 | 2017-01-11 | 中国银联股份有限公司 | Money laundering account determination method and device |
| CN107038181A (en) * | 2016-09-07 | 2017-08-11 | 阿里巴巴集团控股有限公司 | The determination method and device of the trade date of transactional operation |
| CN108230137B (en) * | 2016-12-14 | 2022-05-03 | 大唐半导体设计有限公司 | Method and device for processing credit investigation data |
| CN107103688B (en) * | 2017-02-28 | 2020-08-18 | 广州地理研究所 | Processing method, device and system for public transport card swiping payment data |
| CN106991145B (en) * | 2017-03-23 | 2021-03-23 | 中国银联股份有限公司 | Data monitoring method and device |
| CN108965207B (en) * | 2017-05-19 | 2021-02-26 | 北京京东尚科信息技术有限公司 | Machine behavior identification method and device |
| CN107894745A (en) * | 2017-11-20 | 2018-04-10 | 广东汇嵘绿色能源股份有限公司 | A kind of boiler energy Internet of Things on-line monitoring system and its monitoring method |
| CN108011782B (en) * | 2017-12-06 | 2020-10-16 | 北京百度网讯科技有限公司 | Method and device for pushing alarm information |
| CN108446148B (en) * | 2018-01-29 | 2021-05-07 | 北京奇艺世纪科技有限公司 | Rule management method and device and electronic equipment |
| CN110458580A (en) * | 2018-05-07 | 2019-11-15 | 中移(苏州)软件技术有限公司 | A kind of exception channel detection method, device, medium and equipment |
| CN108710559A (en) * | 2018-05-22 | 2018-10-26 | 阿里巴巴集团控股有限公司 | The notification method and device of data exception |
| CN109034821A (en) * | 2018-06-29 | 2018-12-18 | 深圳春沐源控股有限公司 | transaction monitoring method and monitoring device, storage medium and server |
| CN108985798A (en) * | 2018-07-04 | 2018-12-11 | 成都中医药大学 | A kind of Chinese medicine source tracing method of full chain multistage |
| CN108961059A (en) * | 2018-07-11 | 2018-12-07 | 海南新软软件有限公司 | Digital cash exception transaction monitoring method, apparatus and system |
| CN109816323A (en) * | 2018-12-12 | 2019-05-28 | 上海点融信息科技有限责任公司 | Transaction auditing method, calculating equipment, storage medium for block chain network |
| CN110189178B (en) * | 2019-05-31 | 2023-06-20 | 创新先进技术有限公司 | Abnormal transaction monitoring method and device and electronic equipment |
| CN110298705A (en) * | 2019-07-03 | 2019-10-01 | 深圳市中农数据有限公司 | Circulation of Agricultural Products price index instructs system |
| CN110881035B (en) * | 2019-11-13 | 2020-12-08 | 广西大学行健文理学院 | Network security system based on cloud computing and artificial intelligence |
| CN111598699A (en) * | 2020-05-20 | 2020-08-28 | 嘉联支付有限公司 | Divide moist system based on cluster |
| CN111652718B (en) * | 2020-07-09 | 2023-07-28 | 平安银行股份有限公司 | Value flow direction monitoring method, device, equipment and medium based on relational network graph |
| CN112214528A (en) * | 2020-09-25 | 2021-01-12 | 桦蓥(上海)信息科技有限责任公司 | Financial object single item abnormal attribute analysis method based on correlation analysis |
| CN112150162A (en) * | 2020-11-24 | 2020-12-29 | 深圳华锐金融技术股份有限公司 | Transaction account supervision method and device, computer equipment and storage medium |
| CN112612998A (en) * | 2020-12-25 | 2021-04-06 | 福州掌中云科技有限公司 | Method and equipment for detecting and identifying abnormal channel based on real-time access condition |
| CN113127470A (en) * | 2021-05-10 | 2021-07-16 | 广州欢网科技有限责任公司 | Method and equipment for judging whether Clickhouse data is abnormal or not |
Citations (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN102368842A (en) * | 2011-10-12 | 2012-03-07 | 中国联合网络通信集团有限公司 | Detection method of abnormal behavior of mobile terminal and detection system thereof |
Family Cites Families (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101154287A (en) * | 2006-09-29 | 2008-04-02 | 阿里巴巴公司 | Method and system for filtering merchandise information |
| US20110087535A1 (en) * | 2009-10-14 | 2011-04-14 | Seiko Epson Corporation | Information processing device, information processing system, control method for an information processing device, and a program |
| CN102467726B (en) * | 2010-11-04 | 2015-07-29 | 阿里巴巴集团控股有限公司 | A kind of data processing method based on online trade platform and device |
| CN102855588B (en) * | 2011-06-29 | 2016-08-24 | 北京神州绿盟信息安全科技股份有限公司 | Method for detection of transaction data, device and server |
| CN102890803B (en) * | 2011-07-21 | 2016-01-06 | 阿里巴巴集团控股有限公司 | The defining method of the abnormal process of exchange of electronic goods and device thereof |
| CN103136247B (en) * | 2011-11-29 | 2015-12-02 | 阿里巴巴集团控股有限公司 | Attribute data interval division method and device |
-
2013
- 2013-06-24 CN CN201310253223.4A patent/CN103365969B/en active Active
- 2013-06-24 CN CN201610755774.4A patent/CN106446021B/en not_active Expired - Fee Related
Patent Citations (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN102368842A (en) * | 2011-10-12 | 2012-03-07 | 中国联合网络通信集团有限公司 | Detection method of abnormal behavior of mobile terminal and detection system thereof |
Also Published As
| Publication number | Publication date |
|---|---|
| CN106446021A (en) | 2017-02-22 |
| CN103365969A (en) | 2013-10-23 |
| CN106446021B (en) | 2019-08-02 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN103365969B (en) | The method and system that a kind of anomaly data detection processes | |
| US11765248B2 (en) | Responsive action prediction based on electronic messages among a system of networked computing devices | |
| CN107918905A (en) | Abnormal transaction identification method, apparatus and server | |
| US10496815B1 (en) | System, method, and computer program for classifying monitored assets based on user labels and for detecting potential misuse of monitored assets based on the classifications | |
| CN107766533B (en) | Automatic detection method and system for telephone traffic abnormality, storage medium and electronic equipment | |
| WO2019051951A1 (en) | Service data monitoring method and apparatus, terminal device and storage medium | |
| EP1704492A1 (en) | Automated anomaly detection | |
| CN101996203A (en) | Web information filtering method and system | |
| CN102881125A (en) | Alarm monitoring system based on multi-information fusion centralized processing platform | |
| CN108809734B (en) | Network alarm root analysis method, system, storage medium and computer equipment | |
| CN112861895B (en) | Abnormal article detection method and device | |
| CN107247728A (en) | Text handling method, device and computer-readable storage medium | |
| CN112948223A (en) | Method and device for monitoring operation condition | |
| CN108959293A (en) | A kind of text data classification method and server | |
| CN115204881A (en) | Data processing method, device, equipment and storage medium | |
| CN110611655B (en) | Blacklist screening method and related product | |
| CN116701866A (en) | Park event linkage processing method based on Internet of things equipment | |
| CN111414829A (en) | Method and device for sending alarm information | |
| CN110149303A (en) | A kind of network safety pre-warning method and early warning system of Party school | |
| CN111241077A (en) | Financial fraud behavior identification method based on internet data | |
| CN103324520A (en) | Subscribing method based on conditional combination and sharing | |
| CN115860465A (en) | Enterprise associated data processing early warning method, system and device | |
| CN111754326B (en) | Risk early warning method and device | |
| CN114547406A (en) | Data monitoring method, system, storage medium and electronic device | |
| CN113986657A (en) | Alarm event processing method and processing device |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| C06 | Publication | ||
| PB01 | Publication | ||
| C10 | Entry into substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| C41 | Transfer of patent application or patent right or utility model | ||
| TA01 | Transfer of patent application right |
Effective date of registration: 20160808 Address after: 100015, room 2, building B, building 6, No. 108, Jiuxianqiao Road, Chaoyang District, Beijing Applicant after: BEIJING QICHUANG YOUSHENG TECHNOLOGY Co.,Ltd. Address before: 100088 Beijing city Xicheng District xinjiekouwai Street 28, block D room 112 (Desheng Park) Applicant before: BEIJING QIHOO TECHNOLOGY Co.,Ltd. Applicant before: Qizhi software (Beijing) Co.,Ltd. |
|
| C14 | Grant of patent or utility model | ||
| GR01 | Patent grant | ||
| TR01 | Transfer of patent right |
Effective date of registration: 20220211 Address after: Room 801, 8th floor, No. 104, floors 1-19, building 2, yard 6, Jiuxianqiao Road, Chaoyang District, Beijing 100015 Patentee after: BEIJING QIHOO TECHNOLOGY Co.,Ltd. Address before: Room 108, block B, building 2, yard 6, Jiuxianqiao Road, Chaoyang District, Beijing 100015 Patentee before: BEIJING QICHUANG YOUSHENG TECHNOLOGY Co.,Ltd. |
|
| TR01 | Transfer of patent right | ||
| TR01 | Transfer of patent right |
Effective date of registration: 20220725 Address after: 300450 No. 9-3-401, No. 39, Gaoxin 6th Road, Binhai Science Park, Binhai New Area, Tianjin Patentee after: 3600 Technology Group Co.,Ltd. Address before: Room 801, 8th floor, No. 104, floors 1-19, building 2, yard 6, Jiuxianqiao Road, Chaoyang District, Beijing 100015 Patentee before: BEIJING QIHOO TECHNOLOGY Co.,Ltd. |
|
| TR01 | Transfer of patent right | ||
| TR01 | Transfer of patent right |
Effective date of registration: 20230714 Address after: 1765, floor 17, floor 15, building 3, No. 10 Jiuxianqiao Road, Chaoyang District, Beijing 100015 Patentee after: Beijing Hongxiang Technical Service Co.,Ltd. Address before: 300450 No. 9-3-401, No. 39, Gaoxin 6th Road, Binhai Science Park, Binhai New Area, Tianjin Patentee before: 3600 Technology Group Co.,Ltd. |
|
| TR01 | Transfer of patent right |