CN110489431A - Method for detecting abnormality, device, computer equipment and storage medium - Google Patents

Method for detecting abnormality, device, computer equipment and storage medium Download PDF

Info

Publication number
CN110489431A
CN110489431A CN201910602389.XA CN201910602389A CN110489431A CN 110489431 A CN110489431 A CN 110489431A CN 201910602389 A CN201910602389 A CN 201910602389A CN 110489431 A CN110489431 A CN 110489431A
Authority
CN
China
Prior art keywords
data
data set
request
processing terminal
collection
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Pending
Application number
CN201910602389.XA
Other languages
Chinese (zh)
Inventor
向纯玉
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
OneConnect Smart Technology Co Ltd
Original Assignee
OneConnect Smart Technology Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by OneConnect Smart Technology Co Ltd filed Critical OneConnect Smart Technology Co Ltd
Priority to CN201910602389.XA priority Critical patent/CN110489431A/en
Publication of CN110489431A publication Critical patent/CN110489431A/en
Pending legal-status Critical Current

Links

Classifications

    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F16/00Information retrieval; Database structures therefor; File system structures therefor
    • G06F16/20Information retrieval; Database structures therefor; File system structures therefor of structured data, e.g. relational data
    • G06F16/23Updating
    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F16/00Information retrieval; Database structures therefor; File system structures therefor
    • G06F16/20Information retrieval; Database structures therefor; File system structures therefor of structured data, e.g. relational data
    • G06F16/25Integrating or interfacing systems involving database management systems
    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06QINFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q50/00Information and communication technology [ICT] specially adapted for implementation of business processes of specific business sectors, e.g. utilities or tourism
    • G06Q50/10Services
    • G06Q50/26Government or public services

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Business, Economics & Management (AREA)
  • Databases & Information Systems (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Tourism & Hospitality (AREA)
  • Data Mining & Analysis (AREA)
  • General Engineering & Computer Science (AREA)
  • General Health & Medical Sciences (AREA)
  • Educational Administration (AREA)
  • Health & Medical Sciences (AREA)
  • Economics (AREA)
  • Development Economics (AREA)
  • Human Resources & Organizations (AREA)
  • Marketing (AREA)
  • Primary Health Care (AREA)
  • Strategic Management (AREA)
  • General Business, Economics & Management (AREA)
  • Management, Administration, Business Operations System, And Electronic Commerce (AREA)

Abstract

The invention discloses a kind of method for detecting abnormality, device, computer equipment and storage mediums, request for data collection is divided according to processing terminal, analysis is carried out by the abnormal conditions of the request for data collection to the first preset time period and picks out the processing terminal for needing to carry out secondary detection, and pointedly the data to be tested collection in processing terminal is detected further according to the sampling observation factor.The request for data collection for needing to detect can be greatly reduced by the sampling observation factor that gradually progressive Multiple detection mode and specific aim are arranged, the processing terminal for improving the efficiency of abnormality detection, and emphasis being needed to detect with quick lock in further improves detection efficiency.

Description

Method for detecting abnormality, device, computer equipment and storage medium
Technical field
The present invention relates to data analysis field more particularly to a kind of method for detecting abnormality, device, computer equipment and storages Medium.
Background technique
With the fast development of computer technology, more and more scenes or task realize and turn under line on line Change, for many scenes or task carry out provide biggish convenience, do not need user completed into fixed place it is cumbersome The typing of request for data.However, can exist due to the real-time, interactive that user is not the scene of carrying out due to lacking effective verify Or authentication mechanism and lead to not guarantee request for data authentic and valid problem.Wherein, it is to apply for number the problem of most critical According to authenticity and validity, information submit during exist much lie about deceptive information the case where or applicant The abnormal activity repeatedly applied using phone number, ID card No., it is therefore desirable to data or information to offer into Row is veritified.Moreover, can be related to different processing terminals in many tasks or project, this is also resulted in for the true of information Reality detection is more difficult, it is difficult to judge to more efficient whether request for data is abnormal.
Summary of the invention
The embodiment of the present invention provides a kind of method for detecting abnormality, device, computer equipment and storage medium, to solve to line The inefficient problem of the abnormality detection of the data of upper typing.
A kind of method for detecting abnormality, comprising:
Obtain the request for data collection in the first preset time period;
The request for data collection according to processing terminal is divided to obtain corresponding to be evaluated with each processing terminal Estimate data set;
Each data set to be assessed is carried out detecting determining abnormal data set;
Each processing terminal is calculated according to the quantity of the abnormal data set and the quantity of the data set to be assessed The unnatural proportions of middle request for data collection;
If the unnatural proportions are greater than the first preset value, the second preset time period in the corresponding processing terminal is extracted Interior request for data collection, as history data set;
It is concentrated according to the sampling observation factor from the historical data and determines data to be tested collection;
Connection is established with third party database, the third party database is and public security system or the associated number of banking system According to library;
Corresponding application is transferred from public security system or banking system according to applicant's information that the data to be tested are concentrated All information of data set are into the third party database;
If the information to be confirmed and the information in the third party database that the data to be tested are concentrated are inconsistent, really The fixed data to be tested collection is historic abnormal data set.
A kind of abnormal detector, comprising:
Request for data collection obtains module, for obtaining the request for data collection in the first preset time period;
Data set division module, for by the request for data collection according to processing terminal divided to obtain with it is each described The corresponding data set to be assessed of processing terminal;
Data set detection module, for carrying out detecting determining abnormal data set to each data set to be assessed;
Unnatural proportions computing module, for according to the quantity of the abnormal data set and the quantity of the data set to be assessed Calculate the unnatural proportions of request for data collection in each processing terminal;
History data set determining module, for when the unnatural proportions are greater than the first preset value, then extracting corresponding institute The request for data collection in processing terminal in the second preset time period is stated, as history data set;
Data to be tested collection determining module determines data to be tested for concentrating according to the sampling observation factor from the historical data Collection;
Database connection module, for establishing connection with third party database, the third party database is and public security system System or the associated database of banking system;
Data import modul, applicant's information for being concentrated according to the data to be tested is from public security system or department of banking System transfers all information of corresponding request for data collection into the third party database;
Abnormal data set determining module, information to be confirmed and the third number formulary for being concentrated in the data to be tested When inconsistent according to the information in library, it is determined that the data to be tested collection is historic abnormal data set.
A kind of computer equipment, including memory, processor and storage are in the memory and can be in the processing The computer program run on device, the processor realize above-mentioned method for detecting abnormality when executing the computer program.
A kind of computer readable storage medium, the computer-readable recording medium storage have computer program, the meter Calculation machine program realizes above-mentioned method for detecting abnormality when being executed by processor.
In above-mentioned method for detecting abnormality, device, computer equipment and storage medium, server-side obtains first in advance from client If the request for data collection in the period;The request for data collection is divided to obtain and each processing according to processing terminal The corresponding data set to be assessed of terminal;The data set to be assessed is carried out detecting determining abnormal data set;According to the exception The quantity of data set and the quantity of the data set to be assessed calculate the anomaly ratio of request for data collection in each processing terminal Example;If the unnatural proportions are greater than the first preset value, extract in the corresponding processing terminal in the second preset time period Request for data collection, as history data set;It is concentrated according to the sampling observation factor from the historical data and determines data to be tested collection;With The connection of tripartite's Database, the third party database are and public security system or the associated database of banking system;According to institute State the applicant of data to be tested concentration from public security system or banking system transfer all information of corresponding request for data collection to In the third party database;If the information in information to be confirmed and the third party database that the data to be tested are concentrated It is inconsistent, it is determined that the data to be tested collection is historic abnormal data set.Request for data collection is carried out according to processing terminal It divides, carries out analyzing to pick out needing to carry out secondary detection by the abnormal conditions of the request for data collection to the first preset time period Processing terminal, further according to sampling observation the factor pointedly the data to be tested collection in processing terminal is detected.By gradually Progressive Multiple detection mode and the sampling observation factor of specific aim setting can greatly reduce the request for data collection for needing to detect, and improve The efficiency of abnormality detection, and the processing terminal that emphasis can be needed to detect with quick lock in, further improve detection efficiency.
Detailed description of the invention
In order to illustrate the technical solution of the embodiments of the present invention more clearly, below by institute in the description to the embodiment of the present invention Attached drawing to be used is needed to be briefly described, it should be apparent that, the accompanying drawings in the following description is only some implementations of the invention Example, for those of ordinary skill in the art, without any creative labor, can also be according to these attached drawings Obtain other attached drawings.
Fig. 1 is an application environment schematic diagram of method for detecting abnormality in one embodiment of the invention;
Fig. 2 is a flow chart of method for detecting abnormality in one embodiment of the invention;
Fig. 3 is another flow chart of method for detecting abnormality in one embodiment of the invention;
Fig. 4 is another flow chart of method for detecting abnormality in one embodiment of the invention;
Fig. 5 is another flow chart of method for detecting abnormality in one embodiment of the invention;
Fig. 6 is another flow chart of method for detecting abnormality in one embodiment of the invention;
Fig. 7 is a schematic diagram of abnormal detector in one embodiment of the invention;
Fig. 8 is another schematic diagram of abnormal detector in one embodiment of the invention;
Fig. 9 is another schematic diagram of abnormal detector in one embodiment of the invention;
Figure 10 is a schematic diagram of computer equipment in one embodiment of the invention.
Specific embodiment
Following will be combined with the drawings in the embodiments of the present invention, and technical solution in the embodiment of the present invention carries out clear, complete Site preparation description, it is clear that described embodiments are some of the embodiments of the present invention, instead of all the embodiments.Based on this hair Embodiment in bright, every other implementation obtained by those of ordinary skill in the art without making creative efforts Example, shall fall within the protection scope of the present invention.
Method for detecting abnormality provided in an embodiment of the present invention can be applicable in the application environment such as Fig. 1, wherein client (computer equipment) is communicated by network with server-side.Server-side obtains the application in the first preset time period from client Data set;The request for data collection according to processing terminal is divided to obtain corresponding to be assessed with each processing terminal Data set;The data set to be assessed is carried out detecting determining abnormal data set;According to the quantity of the abnormal data set and institute The quantity for stating data set to be assessed calculates the unnatural proportions of request for data collection in each processing terminal;If the unnatural proportions Greater than the first preset value, then the request for data collection in the corresponding processing terminal in the second preset time period is extracted, as going through History data set;It is concentrated according to the sampling observation factor from the historical data and determines data to be tested collection;It establishes and connects with third party database It connects, the third party database is and public security system or the associated database of banking system;It is concentrated according to the data to be tested Applicant transfer all information of corresponding request for data collection to the third party database from public security system or banking system In;If the information to be confirmed and the information in the third party database that the data to be tested are concentrated are inconsistent, it is determined that institute Data to be tested collection is stated as historic abnormal data set.Wherein, client (computer equipment) can be, but not limited to various individuals Computer, laptop, smart phone, tablet computer and portable wearable device.Server-side can use independent service The server cluster of device either multiple servers composition is realized.
In one embodiment, as shown in Fig. 2, providing a kind of method for detecting abnormality, the service in Fig. 1 is applied in this way It is illustrated, includes the following steps: for end
Request for data collection in S10, the first preset time period of acquisition.
Request for data collection is the data acquisition system for meeting certain condition, in this step, will meet above-mentioned first preset time Data in section extract, and form request for data collection.In this embodiment, this condition is then in the first preset time period Data set.Data in this application data set can be the request for data of every business, service or event.First preset time Section is a preset time interval, which can exist by default settings, can also be every When secondary execution, a period is inputted as the first preset time period, optionally, which can pass through finger The mode for enabling, selecting or editing is inputted.At present in the application process of many business, service or event, there are exceptions Data (deceptive information and data lack of standardization) need to contain the generation of adverse events to each place in application process The real effectiveness for the data that reason terminal is handled is examined.
In a specific embodiment, method for detecting abnormality provided by the present application can be applicable in software platform, pass through Application program obtains the request for data collection that user submits, and the request for data collection submitted by processing terminal is inspected by random samples and commented Estimate, the credit worthiness of associated processing terminal is judged with this.Request for data collection in the application can be regarded as a certain item The volume of data set that business is submitted, including application item and relevant information.
S20, the request for data collection according to processing terminal is divided to obtain it is corresponding with each processing terminal to be evaluated Estimate data set.
The request for data collection of submission contains processing terminal for handling the data etc. for information about, therefore the application is obtaining After a large amount of request for data collection in preset time period, these request for data collection can be divided according to processing terminal, be obtained The corresponding request for data collection of each processing terminal, i.e., the data set to be assessed in the application.For example, the request for data that will acquire Collection is divided, and the corresponding request for data collection of processing terminal A, the corresponding request for data collection of processing terminal B etc. are respectively obtained.It is optional Ground, specifically division mode can concentrate the end of the mark of the processing terminal in each request for data, upload according to request for data End, the location information uploaded or other information divide.
According to the quality condition that the purpose that processing terminal divides data set is to manage terminal request for data collection according to this A possibility that judging its exception, thus accomplishes targetedly to carry out abnormality detection, and avoids carrying out one by one all data Detection improves detection efficiency.
S30, each data set to be assessed is carried out detecting determining abnormal data set.
In this step, the request for data collection of each processing terminal is tested and analyzed respectively, it can be according to application number The case where detecting wherein request for data collection multiple with the presence or absence of same user-association according to emphasis the characteristics of collection, and phone number and body Part card number is to carry out real name binding with user, therefore can be according to the ginseng with uniqueness such as phone number, ID card No. Several to analyze data set to be assessed, same phone number or the associated more request for data collection of ID card No. belong to different Regular data collection.Alternatively, abnormal data set is determined according to the address that request for data is concentrated, if what same address occurred Number is more than certain amount threshold, corresponding data can also be determined as abnormal data.It is to be appreciated that address can There can be more people to share, so amount threshold can be configured according to actual needs.
It should be noted that detection mode in the application not merely just in phone number, ID card No. and Address has different detected rules in actual scene, is corresponding with different detection parameters, such as can be according to request for data Exceptional condition is arranged in the amount of money of concentration, if being more than the fair amount being arranged in advance, this application data set is considered as to abnormal Shen It please data set.
S40, each processing is calculated according to the quantity of the abnormal data set and the quantity of the data set to be assessed The unnatural proportions of request for data collection in terminal.
Specifically, it is assumed that the total amount for the request for data collection submitted by a certain processing terminal is 50, wherein there are three mobile phones More data sets of number-associated, then more data sets applying are abnormal data set, are submitted using first phone number Request for data collection quantity is 5, is 6 using the request for data collection quantity that second phone number is submitted, utilizes third cell-phone number The request for data collection quantity that code is submitted is 9, then all according to the quantity for the data set applied extremely and corresponding processing terminal The unnatural proportions that the quantity of request for data collection obtains are (5+6+9)/50, i.e., unnatural proportions are 40 percent.It is to be appreciated that Abnormal data set can be detected by Multiple factors simultaneously, such as considers phone number and ID card No. simultaneously.
If S50, the unnatural proportions are greater than the first preset value, extract in the corresponding processing terminal second it is default when Between request for data collection in section, as history data set.
If be greater than the first preset value according to the unnatural proportions that step S40 calculates the request for data collection of the processing terminal, say The bright processing terminal is the case where this period is there are a large amount of anomalous events, copes with the history data set of the processing terminal application Further detected.Specific method is the request for data collection for extracting the processing terminal in the second preset time period, as History data set.Second preset time period is also a preset time interval, can preset to obtain.Optionally, should Second preset time period has with the first preset time period to be associated with.Illustratively, the second preset time period can be default for first The special time period before period or the first preset time period before period.For example, if extracting request for data collection The first preset time period be May 1 to July 1, and certain in this time is counted by step S10 to step S40 The unnatural proportions for managing terminal are greater than the first preset value, then system is by the request for data collection before automatically extracting May 1, as History data set, it should be noted that history request for data collection history request for data collection all before can be May 1, Can be arranged to the history data set of extraction the period, such as transfer March 1 to the history data set occurred between May 1.
In practice, the substantial amounts of processing terminal, the request for data collection quantity handled is even more innumerable, in order to improve Detection efficiency, the application do not need to carry out request for data collection whole in processing terminal examination assessment, but obtain pre- If the request for data collection in the period carries out abnormality detection.On the other hand, request for data collection to all processing terminals is not it It all carries out abnormality detection, but history request for data collection is just transferred to the biggish processing terminal of unnatural proportions and is checked.It is such Mode saves a large amount of unnecessary detection process, greatly improves work efficiency.And the application method for detecting abnormality is not It is that the higher processing terminal of unnatural proportions is abnormal mechanism during unilateral definition herein, it can also be in conjunction with the history of the mechanism application Data set information summary is judged, and is reduced the probability of erroneous judgement, is improved the accuracy rate of abnormality detection.
S60, determining data to be tested collection is concentrated from the historical data according to the sampling observation factor.
When being inspected by random samples to the higher processing terminal of unnatural proportions can according to sampling observation the factor extract request for data collection into Row detection, optionally, the sampling observation factor can be the location information or application way when applying.
If carrying out analysis to the abnormal data set in processing terminal preset time period finds that most of abnormal data sets come from In same place, then it is location information that the sampling observation factor, which can pointedly be arranged, history request for data is concentrated into application place It extracts and is detected for the data set of the position.Data to be tested collection can also be determined according to the mode randomly selected, this When the sampling observation factor be random function or randomly select strategy.And so on, it can be confirmed as according to historical data concentration different The tendentiousness of the essential information analysis abnormal data set of regular data collection, recycling its tendentiousness that the sampling observation factor is pointedly arranged can Effectively to know abnormal processing terminal.
In addition to this, the history data set of a certain processing terminal can also be extracted according to certain sampling observation ratio.Show Example property, by setting certain sampling observation ratio, correspondence is then extracted from historical data concentration according to certain extraction strategy The data of quantity.The extraction strategy can according to certain time interval, or according to different positions etc..
S70, connection is established with third party database, the third party database is to be associated with public security system or banking system Database.
After determining data to be tested collection according to the sampling observation factor from historical data concentration, into detecting step, initially set up With the connection of third party database, third party database is database associated with public security system or banking system.Wherein, silver-colored The database of row system relationship can be the database that security requirement is higher and needs to verify user identity.
S80, the applicant's information concentrated according to the data to be tested are transferred corresponding from public security system or banking system All information of request for data collection are into the third party database.
After determining data to be tested collection, the applicant's information concentrated according to data to be tested is from public security system or banking system Whole relevant informations of this person are imported into third party database, therefore the information importeding into third party database is entirely Authentic and valid.The applicant's information is can be with the information of unique identification applicant, for example, phone number or ID card No. Deng.In a kind of possible mode, system can also directly according to applicant from the database of public security system or banking system into Row inquiry.
If the information to be confirmed and the information in the third party database that S90, the data to be tested are concentrated are inconsistent, Then determine the data to be tested collection for historic abnormal data set.
Information to be confirmed in the application be specifically as follows data to be tested concentrate include name, gender, the date of birth, Work unit, in addition to this, information to be confirmed can also include the information of other any need verifyings.The letter imported in database Whether breath can be used to check data to be tested concentrates the information of applicant's typing true, if request for data concentrates the letter of typing It ceases inconsistent with the information in third party database, it is determined that the data to be tested integrate as history abnormal data set.
It is detected again in the embodiment of the present application by inspecting factor pair data to be tested collection by random samples, passes through relevant authority system In authentic and valid information judge the authenticity of data to be tested collection, substantially increase the accuracy of abnormality detection, be subsequent place Whole abnormal judge of reason terminal provides accurate, strong data support.
Further, it can also assist being detected in a manner of sampling observation, sampling observation can pass through associated third party database The real effectiveness of data to be tested collection is examined, the basic condition of user is investigated, is including the information that applicant fills in No there is any discrepancy with the information reported, can also be checked by sending inquiry message to user, ask whether it is to apply in person Business and processing terminal whether there is excessively high situation etc. of charging.Alternatively, with obtaining user by other means true believe Breath is to be verified.Wherein, for whether be my application business investigation result can be used to check judge whether there is it is same One user applies for the case where more request for data collection.
Method for detecting abnormality in the embodiment of the present application first divides request for data collection according to processing terminal, passes through Analysis is carried out to the abnormal conditions of the request for data collection of the first preset time period and picks out the processing end for needing to carry out secondary detection The data to be tested collection in processing terminal is pointedly detected further according to the sampling observation factor in end.By gradually progressive more Re-detection mode and the sampling observation factor of specific aim setting can greatly reduce the request for data collection for needing to detect, and quick lock in needs emphasis The processing terminal of detection, improves detection efficiency.
In one embodiment, as shown in figure 3, carrying out detecting determining abnormal data to each data set to be assessed Collection, including;
S301, the data set to be assessed according to user's unique information is classified to obtain each user it is unique The property corresponding request for data collection of information, determines the quantity of the corresponding request for data collection of each user's unique information.
It include full name of applicant, phone number, body in the essential information that the request for data submitted by processing terminal is concentrated The information such as part card number, each applicant has unique corresponding ID card No. or phone number, therefore can pass through use Family unique information (phone number or ID card No. etc.) judges whether there is someone and applies for taking advantage of for more request for data collection Swindleness event first classifies to data set to be assessed according to user's unique information, obtains different user unique information pair The request for data collection and its quantity answered.Illustratively, for using ID card No. as user's unique information, it is assumed that certain Managing terminal section time received data set quantity to be assessed is 30, and 30 data sets to be assessed are respectively by 10 identity Number application is demonstrate,proved, is 6 by the request for data collection quantity that statistics discovery passes through first ID card No. application, passes through second The quantity of ID card No. application is 9, and the quantity by third ID card No. application is 8, other ID card No. are equal One is only applied for.
S302, the request for data collection that the quantity of the corresponding request for data collection of user's unique information is greater than to the second preset value It is determined as abnormal data set, and determines that the abnormal data concentrates the applicant's information for including.
Second preset value is the quantitative criteria for judging abnormal request for data collection, specifically can flexibly be set, if to abnormal application The definition of data set is more stringent, then the preset value can be set as 1, conversely, exceptional condition can also be relaxed, default settings be compared with Big numerical value.
If the second preset value is set as 1, the corresponding request for data collection quantity of ID card No. is equal greater than 1 request for data collection It is considered as abnormal request for data collection, then being exception by the request for data collection of first, second, third ID card No. application Then request for data collection determines that abnormal request for data concentrates the applicant's information for including.
S303, the phone number that the abnormal data is concentrated is transferred.
Although a user only corresponds to an ID card No., a user can but register multiple phone numbers, If the user and being related to abnormal request for data collection, the user and all answered with multiple phone numbers of this user-association It is supervised, the request for data collection comprising the user and number is strictly audited so as to subsequent.
S304, the full name of applicant concentrated according to the abnormal data, ID card No. and phone number formation are blocked Cut information.
Key message such as name, ID card No. and the phone number of abnormal data concentration will be had determined as after The intercept information of continuous data set facilitates quick-searching again and provides reliably to abnormal data set for subsequent application data set Examination criteria, improve the efficiency and accuracy of detection.
In one embodiment, as shown in figure 4, being historic abnormal data set in the determination data to be tested collection Later, the method for detecting abnormality further include:
The quantity of S100, the statistics historic abnormal data set.
S110, early warning intensity and the execution pair that the processing terminal is determined according to the quantity of the historic abnormal data set The early warning operation answered.
In this step, early warning intensity that can be different according to the different definition of historic abnormal data set quantity is applicable in difference Forewarning Measures, illustratively, early warning intensity is arranged respectively to level-one, second level, three-level early warning from high to low, is applicable in different pre- Alert measure, a fairly large number of processing terminal of abnormal data set are classified as level-one early warning, most stringent of Forewarning Measures are applicable in, with such It pushes away.It is operated early warning intensity has been determined and then has executed corresponding early warning according to early warning intensity.
Specifically, as shown in figure 5, determining the early warning of the processing terminal according to the quantity of the historic abnormal data set Intensity simultaneously executes corresponding early warning operation, comprising:
If the quantity of S111, the historic abnormal data set reach first threshold, corresponding processing terminal is determined For level-one early warning, and refuse processing terminal request for data collection all after first preset time period.
In this step, if the quantity of history abnormal data set is especially more, reach the first threshold of setting, then it will be corresponding Processing terminal is determined as most strong level-one early warning, and corresponding Forewarning Measures are to refuse hereafter all application numbers of preset time period According to collection.
If the quantity of S112, the historic abnormal data set reach second threshold, corresponding processing terminal is determined For second level early warning, and the request for data collection all after first preset time period to the processing terminal is marked.
If the quantity of historic abnormal data set is less than first threshold but is greater than second threshold, second level is determined it as Early warning can all be marked the request for data collection of the processing terminal hereafter, to carry out emphasis detection or audit.
If the quantity of S113, the historic abnormal data set reach third threshold value, corresponding processing terminal is determined For three-level early warning, and the request for data collection in the processing terminal is checked by preset ratio.
If historic abnormal data set negligible amounts, illustrate that the abnormal activity of the processing terminal is less, only need to be to it A certain proportion of request for data collection is extracted to be checked.The preset ratio according to different scenes or can be set It is fixed.
The detailed process of request for data collection review can refer to step S301 to S304, specifically repeat no more.
Sampling observation method in the embodiment of the present application is determined to processing eventually by the evaluation situation to historic abnormal data set The treatment measures at end can play forewarning function to processing terminal, be conducive to the behavior of specification handles terminal.
In one embodiment, as shown in fig. 6, in the quantity according to the abnormal data set and the number to be assessed After the unnatural proportions for calculating the processing terminal according to the quantity of collection, the method also includes:
S401, unnatural proportions of all processing terminals in first preset time period are obtained.
The unnatural proportions of preset time period are calculated by step S10 to step S40 for each processing terminal, this step is Obtain unnatural proportions of all processing terminals in the preset time period.
S402, sequence from high to low is carried out according to credit worthiness of the unnatural proportions to the processing terminal.
Unnatural proportions are inversely proportional with credit worthiness, and the higher processing terminal credit worthiness of unnatural proportions is lower, and unnatural proportions are lower Processing terminal credit worthiness it is higher, therefore credit worthiness can be ranked up according to unnatural proportions.
S403, integral increase and decrease operation is executed to the processing terminal by credit worthiness sequence.
After being ranked up according to credit worthiness of the unnatural proportions to all processing terminals, integral can be carried out to sequential steps and increased Subtract system, which can be set according to the actual situation, for example, each processing terminal original base product having the same Point.Optionally, after every minor sort, for credit worthiness first three processing terminal increase a definite integral, credit worthiness be in last three Processing terminal deduct certain integral.Over time, it can be executed according to the Global integration situation of processing terminal corresponding The processing terminal can be determined as abnormal terminals simultaneously when the Global integration of a processing terminal is lower than certain score value by strategy It takes accordingly tactful.
In the present embodiment, by obtaining unnatural proportions of all processing terminals in the preset time period, further according to The unnatural proportions carry out sequence from high to low to the credit worthiness of all processing terminals, eventually by credit worthiness sequence pair All processing terminals execute integral increase and decrease operation.By after accumulative to detection case for several times, according to credit worthiness to place It manages terminal and carries out abnormal judgement, carried out abnormality detection from multiple dimensions, preferably ensured the precision of abnormality detection.
It should be understood that the size of the serial number of each step is not meant that the order of the execution order in above-described embodiment, each process Execution sequence should be determined by its function and internal logic, the implementation process without coping with the embodiment of the present invention constitutes any limit It is fixed.
In one embodiment, a kind of abnormal detector is provided, which examines extremely with above-described embodiment Survey method corresponds.As shown in fig. 7, the abnormal detector includes that request for data collection obtains module 10, data set divides mould Block 20, data set detection module 30, unnatural proportions computing module 40, history data set determining module 50, data to be tested collection are true Cover half block 60, database connection module 70, data import modul 80 and abnormal data set determining module 90.Each functional module is detailed It is described as follows:
Request for data collection obtains module 10, for obtaining the request for data collection in the first preset time period.
Data set division module 20, for being divided to obtain and each institute the request for data collection according to processing terminal State the corresponding data set to be assessed of processing terminal.
Data set detection module 30, for carrying out detecting determining abnormal data set to each data set to be assessed.
Unnatural proportions computing module 40, for according to the quantity of the abnormal data set and the number of the data set to be assessed Amount calculates the unnatural proportions of request for data collection in each processing terminal.
History data set determining module 50 extracts corresponding institute if being greater than the first preset value for the unnatural proportions The request for data collection in processing terminal in the second preset time period is stated, as history data set.
Data to be tested collection determining module 60 determines number to be detected for concentrating according to the sampling observation factor from the historical data According to collection.
Database connection module 70, for establishing connection with third party database, the third party database is and public security System or the associated database of banking system.
Data import modul 80, applicant's information for being concentrated according to the data to be tested is from public security system or bank System transfers all information of corresponding request for data collection into the third party database.
Abnormal data set determining module 90, information to be confirmed and the third party for being concentrated in the data to be tested When information in database is inconsistent, it is determined that the data to be tested collection is historic abnormal data set.
Preferably, as shown in figure 8, data set detection module 30 includes quantity determination unit 301, the determining list of abnormal data set Member 302, phone number transfer unit 303 and information intercepting unit 304.
Quantity determination unit 301, for being classified to obtain the data set to be assessed according to user's unique information The corresponding request for data collection of each user's unique information, determines the corresponding Shen of each user's unique information Please data set quantity.
Abnormal data set determination unit 302, for the quantity of the corresponding request for data collection of user's unique information to be greater than The request for data collection of second preset value is determined as abnormal data set, and determines that the abnormal data concentrates the applicant's letter for including Breath.
Phone number transfers unit 303, the phone number concentrated for transferring the abnormal data.
Information intercepting unit 304, full name of applicant, ID card No. for being concentrated according to the abnormal data and described Phone number forms intercept information.
Preferably, as shown in figure 9, the abnormal detector further includes that unnatural proportions obtain module 401, sorting module 402 Module 403 is adjusted with integral.
Unnatural proportions obtain module 401, for obtaining exception of all processing terminals in first preset time period Ratio.
Sorting module 402, for being carried out from high to low according to credit worthiness of the unnatural proportions to the processing terminal Sequence.
Integral adjustment module 403, for executing integral increase and decrease operation to the processing terminal by credit worthiness sequence.
Preferably, which is also used to count the quantity of the historic abnormal data set;It is gone through according to described The quantity of history sexual abnormality data set determines the early warning intensity of the processing terminal and executes corresponding early warning operation.
If the quantity of the history abnormal data set reaches first threshold, corresponding processing terminal is determined as level-one Early warning, and refuse processing terminal request for data collection all after first preset time period;If the history The quantity of abnormal data set reaches second threshold, then corresponding processing terminal is determined as second level early warning, and eventually to the processing Request for data collection all after first preset time period is held to be marked;If the number of the history abnormal data set Amount reaches third threshold value, then corresponding processing terminal is determined as three-level early warning, and to the request for data in the processing terminal Collection is checked by preset ratio.
Specific about abnormal detector limits the restriction that may refer to above for method for detecting abnormality, herein not It repeats again.Modules in above-mentioned abnormal detector can be realized fully or partially through software, hardware and combinations thereof.On Stating each module can be embedded in the form of hardware or independently of in the processor in computer equipment, can also store in a software form In memory in computer equipment, the corresponding operation of the above modules is executed in order to which processor calls.
In one embodiment, a kind of computer equipment is provided, which can be server, internal junction Composition can be as shown in Figure 10.The computer equipment include by system bus connect processor, memory, network interface and Database.Wherein, the processor of the computer equipment is for providing calculating and control ability.The memory packet of the computer equipment Include non-volatile memory medium, built-in storage.The non-volatile memory medium is stored with operating system, computer program and data Library.The built-in storage provides environment for the operation of operating system and computer program in non-volatile memory medium.The calculating The database of machine equipment is for storing the data that the method for detecting abnormality in above-described embodiment uses.The computer equipment Network interface is used to communicate with external terminal by network connection.To realize one kind when the computer program is executed by processor Method for detecting abnormality.
In one embodiment, a kind of computer equipment is provided, including memory, processor and storage are on a memory And the computer program that can be run on a processor, processor realize the abnormal inspection in above-described embodiment when executing computer program Survey method.
In one embodiment, a kind of computer readable storage medium is provided, computer program is stored thereon with, is calculated Machine program realizes the method for detecting abnormality in above-described embodiment when being executed by processor.
Those of ordinary skill in the art will appreciate that realizing all or part of the process in above-described embodiment method, being can be with Relevant hardware is instructed to complete by computer program, the computer program can be stored in a non-volatile computer In read/write memory medium, the computer program is when being executed, it may include such as the process of the embodiment of above-mentioned each method.Wherein, To any reference of memory, storage, database or other media used in each embodiment provided herein, Including non-volatile and/or volatile memory.Nonvolatile memory may include read-only memory (ROM), programming ROM (PROM), electrically programmable ROM (EPROM), electrically erasable ROM (EEPROM) or flash memory.Volatile memory may include Random access memory (RAM) or external cache.By way of illustration and not limitation, RAM is available in many forms, Such as static state RAM (SRAM), dynamic ram (DRAM), synchronous dram (SDRAM), double data rate sdram (DDRSDRAM), enhancing Type SDRAM (ESDRAM), synchronization link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic ram (DRDRAM) and memory bus dynamic ram (RDRAM) etc..
It is apparent to those skilled in the art that for convenience of description and succinctly, only with above-mentioned each function Can unit, module division progress for example, in practical application, can according to need and by above-mentioned function distribution by different Functional unit, module are completed, i.e., the internal structure of described device is divided into different functional unit or module, more than completing The all or part of function of description.
Embodiment described above is merely illustrative of the technical solution of the present invention, rather than its limitations;Although referring to aforementioned reality Applying example, invention is explained in detail, those skilled in the art should understand that: it still can be to aforementioned each Technical solution documented by embodiment is modified or equivalent replacement of some of the technical features;And these are modified Or replacement, the spirit and scope for technical solution of various embodiments of the present invention that it does not separate the essence of the corresponding technical solution should all It is included within protection scope of the present invention.

Claims (10)

1. a kind of method for detecting abnormality characterized by comprising
Obtain the request for data collection in the first preset time period;
The request for data collection is divided to obtain number to be assessed corresponding with each processing terminal according to processing terminal According to collection;
Each data set to be assessed is carried out detecting determining abnormal data set;
Shen in each processing terminal is calculated according to the quantity of the abnormal data set and the quantity of the data set to be assessed Please data set unnatural proportions;
If the unnatural proportions are greater than the first preset value, extract in the corresponding processing terminal in the second preset time period Request for data collection, as history data set;
It is concentrated according to the sampling observation factor from the historical data and determines data to be tested collection;
Connection is established with third party database, the third party database is and public security system or the associated data of banking system Library;
Corresponding request for data is transferred from public security system or banking system according to applicant's information that the data to be tested are concentrated All information of collection are into the third party database;
If the information to be confirmed and the information in the third party database that the data to be tested are concentrated are inconsistent, it is determined that institute Data to be tested collection is stated as historic abnormal data set.
2. method for detecting abnormality as described in claim 1, which is characterized in that described to be carried out to each data set to be assessed It detects and determines abnormal data set, comprising:
The data set to be assessed is classified to obtain each user's unique information pair according to user's unique information The request for data collection answered determines the quantity of the corresponding request for data collection of each user's unique information;
The request for data collection that the quantity of the corresponding request for data collection of user's unique information is greater than the second preset value is determined as different Regular data collection, and determine that the abnormal data concentrates the applicant's information for including;
Transfer the phone number that the abnormal data is concentrated;
Full name of applicant, ID card No. and the phone number concentrated according to the abnormal data form intercept information.
3. method for detecting abnormality as described in claim 1, which is characterized in that the determination data to be tested collection be go through After history sexual abnormality data set, the method for detecting abnormality further include:
Count the quantity of the historic abnormal data set;
The early warning intensity of the processing terminal is determined according to the quantity of the historic abnormal data set and executes corresponding early warning Operation.
4. method for detecting abnormality as claimed in claim 3, which is characterized in that described according to the historic abnormal data set Quantity determines the early warning intensity of the processing terminal and executes corresponding early warning operation, comprising:
If the quantity of the history abnormal data set reaches first threshold, it is pre- that corresponding processing terminal is defined as level-one It is alert, and refuse processing terminal request for data collection all after first preset time period;
If the quantity of the history abnormal data set reaches second threshold, it is pre- that corresponding processing terminal is defined as second level It is alert, and the request for data collection all after first preset time period to the processing terminal is marked;
If the quantity of the fraud request for data collection reaches third threshold value, corresponding processing terminal is included in three-level early warning, and Request for data collection in the processing terminal is checked by preset ratio.
5. method for detecting abnormality as described in claim 1, which is characterized in that in the quantity according to the abnormal data set After the unnatural proportions for calculating the processing terminal with the quantity of the data set to be assessed, the method for detecting abnormality is also wrapped It includes:
Obtain unnatural proportions of all processing terminals in first preset time period;
Sequence from high to low is carried out according to credit worthiness of the unnatural proportions to the processing terminal;
Integral increase and decrease operation is executed to the processing terminal by credit worthiness sequence.
6. a kind of abnormal detector characterized by comprising
Request for data collection obtains module, for obtaining the request for data collection in the first preset time period;
Data set division module, for being divided to obtain and each processing the request for data collection according to processing terminal The corresponding data set to be assessed of terminal;
Data set detection module, for carrying out detecting determining abnormal data set to each data set to be assessed;
Unnatural proportions computing module, for being calculated according to the quantity of the abnormal data set and the quantity of the data set to be assessed The unnatural proportions of request for data collection in each processing terminal;
History data set determining module, for when the unnatural proportions are greater than the first preset value, then extracting the corresponding place The request for data collection in terminal in the second preset time period is managed, as history data set;
Data to be tested collection determining module determines data to be tested collection for concentrating according to the sampling observation factor from the historical data;
Database connection module, for establishing connection with third party database, the third party database be with public security system or The associated database of banking system;
Data import modul, applicant's information for being concentrated according to the data to be tested is from public security system or banking system tune Take all information of corresponding request for data collection into the third party database;
Abnormal data set determining module, information to be confirmed and the third party database for being concentrated in the data to be tested In information it is inconsistent when, it is determined that the data to be tested collection is historic abnormal data set.
7. abnormal detector as claimed in claim 6, which is characterized in that the data set detection module includes:
Quantity determination unit, it is each described for being classified to obtain the data set to be assessed according to user's unique information The corresponding request for data collection of user's unique information determines the corresponding request for data collection of each user's unique information Quantity;
Abnormal data set determination unit is preset for the quantity of the corresponding request for data collection of user's unique information to be greater than second The request for data collection of value is determined as abnormal data set, and determines that the abnormal data concentrates the applicant's information for including;
Phone number transfers unit, the phone number concentrated for transferring the abnormal data;
Information intercepting unit, full name of applicant, ID card No. and the cell-phone number for being concentrated according to the abnormal data Code forms intercept information.
8. abnormal detector as claimed in claim 6, which is characterized in that the abnormal detector further include:
Unnatural proportions obtain module, for obtaining unnatural proportions of all processing terminals in first preset time period;
Sorting module, for carrying out sequence from high to low according to credit worthiness of the unnatural proportions to the processing terminal;
Integral adjustment module, for executing integral increase and decrease operation to the processing terminal by credit worthiness sequence.
9. a kind of computer equipment, including memory, processor and storage are in the memory and can be in the processor The computer program of upper operation, which is characterized in that the processor realized when executing the computer program as claim 1 to Any one of 5 method for detecting abnormality.
10. a kind of computer readable storage medium, the computer-readable recording medium storage has computer program, and feature exists In realization method for detecting abnormality as described in any one of claim 1 to 5 when the computer program is executed by processor.
CN201910602389.XA 2019-07-05 2019-07-05 Method for detecting abnormality, device, computer equipment and storage medium Pending CN110489431A (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN201910602389.XA CN110489431A (en) 2019-07-05 2019-07-05 Method for detecting abnormality, device, computer equipment and storage medium

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN201910602389.XA CN110489431A (en) 2019-07-05 2019-07-05 Method for detecting abnormality, device, computer equipment and storage medium

Publications (1)

Publication Number Publication Date
CN110489431A true CN110489431A (en) 2019-11-22

Family

ID=68546730

Family Applications (1)

Application Number Title Priority Date Filing Date
CN201910602389.XA Pending CN110489431A (en) 2019-07-05 2019-07-05 Method for detecting abnormality, device, computer equipment and storage medium

Country Status (1)

Country Link
CN (1) CN110489431A (en)

Cited By (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110987448A (en) * 2019-12-05 2020-04-10 潍柴动力股份有限公司 Engine air inlet state monitoring method, device and equipment
CN111413903A (en) * 2020-04-01 2020-07-14 镇江颀珑工程技术服务有限公司 Nonlinear time-delay remote monitoring system for industrial production
CN112632545A (en) * 2020-12-31 2021-04-09 北京知道创宇信息技术股份有限公司 Data detection method and device and electronic equipment
CN113672675A (en) * 2021-08-09 2021-11-19 北京字跳网络技术有限公司 Data detection method and device and electronic equipment
CN114240059A (en) * 2021-11-22 2022-03-25 中国建设银行股份有限公司 Resource online application processing method and device, computer equipment and storage medium
CN116346774A (en) * 2023-02-16 2023-06-27 北京有元科技有限公司 Network flow data query system based on DNS (Domain name System) route

Cited By (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110987448A (en) * 2019-12-05 2020-04-10 潍柴动力股份有限公司 Engine air inlet state monitoring method, device and equipment
CN111413903A (en) * 2020-04-01 2020-07-14 镇江颀珑工程技术服务有限公司 Nonlinear time-delay remote monitoring system for industrial production
CN112632545A (en) * 2020-12-31 2021-04-09 北京知道创宇信息技术股份有限公司 Data detection method and device and electronic equipment
CN113672675A (en) * 2021-08-09 2021-11-19 北京字跳网络技术有限公司 Data detection method and device and electronic equipment
CN113672675B (en) * 2021-08-09 2023-12-15 北京字跳网络技术有限公司 Data detection method and device and electronic equipment
CN114240059A (en) * 2021-11-22 2022-03-25 中国建设银行股份有限公司 Resource online application processing method and device, computer equipment and storage medium
CN116346774A (en) * 2023-02-16 2023-06-27 北京有元科技有限公司 Network flow data query system based on DNS (Domain name System) route

Similar Documents

Publication Publication Date Title
CN110489431A (en) Method for detecting abnormality, device, computer equipment and storage medium
CN108876133B (en) Risk assessment processing method, device, server and medium based on business information
CN110782240B (en) Business data processing method and device, computer equipment and storage medium
CN108389121B (en) Loan data processing method, loan data processing device, loan data processing program, and computer device and storage medium
CN110490608B (en) Risk assessment method and device, computer equipment and storage medium
CN109598519B (en) Vehicle auditing method, device, computer equipment and storage medium
CN110619065A (en) Resource scheduling service processing method and device, computer equipment and storage medium
CN112232818A (en) Data reconciliation method and device, computer equipment and storage medium
WO2020233070A1 (en) Payment risk verification method and apparatus, computer device, and storage medium
CN109544090A (en) Order processing method, apparatus, computer equipment and storage medium
CN110659989A (en) Active exploration type compliance anti-money laundering method, device, system and storage medium
CN114331191A (en) Credit risk assessment method and device based on enterprise scale and association
CN111767192A (en) Service data detection method, device, equipment and medium based on artificial intelligence
CN115063228A (en) Anti-money laundering management platform and anti-money laundering method
CN109242658B (en) Suspicious transaction report generation method, suspicious transaction report generation system, suspicious transaction report generation computer device and suspicious transaction report storage medium
CN109670929A (en) Control method, device, equipment and the computer readable storage medium of loan early warning
CN107944841A (en) Emolument computing system and method
CN111861733A (en) Fraud prevention and control system and method based on address fuzzy matching
CN111147441A (en) Method and device for automatically detecting fraud behaviors of online ticket purchasing and readable storage medium
CN110807639A (en) Payment method and device
CN110222957A (en) A kind of data checking method and relevant device
CN110147998A (en) Client's networking processing method, device, computer equipment and storage medium
CN111861734B (en) Test evaluation system and method for three-party data source
CN114493858A (en) Illegal fund transfer suspicious transaction monitoring method and related components
CN108108901A (en) Weekly wage delivery system and method

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination