CN113487316B - Distributed payment system security processing method and device - Google Patents

Distributed payment system security processing method and device Download PDF

Info

Publication number
CN113487316B
CN113487316B CN202110828767.3A CN202110828767A CN113487316B CN 113487316 B CN113487316 B CN 113487316B CN 202110828767 A CN202110828767 A CN 202110828767A CN 113487316 B CN113487316 B CN 113487316B
Authority
CN
China
Prior art keywords
level
index
reconstruction sequence
health state
sequence
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Active
Application number
CN202110828767.3A
Other languages
Chinese (zh)
Other versions
CN113487316A (en
Inventor
杨晨
谭新培
张照胜
张悦
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Yinqing Technology Co ltd
Original Assignee
Yinqing Technology Co ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Yinqing Technology Co ltd filed Critical Yinqing Technology Co ltd
Priority to CN202110828767.3A priority Critical patent/CN113487316B/en
Publication of CN113487316A publication Critical patent/CN113487316A/en
Application granted granted Critical
Publication of CN113487316B publication Critical patent/CN113487316B/en
Active legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/38—Payment protocols; Details thereof
    • G06Q20/382—Payment protocols; Details thereof insuring higher security of transaction
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F11/00—Error detection; Error correction; Monitoring
    • G06F11/36—Preventing errors by testing or debugging software
    • G06F11/3604—Software analysis for verifying properties of programs
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/08—Payment architectures
    • G06Q20/085—Payment architectures involving remote charge determination or related payment systems

Landscapes

  • Engineering & Computer Science (AREA)
  • Business, Economics & Management (AREA)
  • Theoretical Computer Science (AREA)
  • Accounting & Taxation (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Finance (AREA)
  • General Business, Economics & Management (AREA)
  • Strategic Management (AREA)
  • Computer Security & Cryptography (AREA)
  • Software Systems (AREA)
  • Computer Hardware Design (AREA)
  • Quality & Reliability (AREA)
  • General Engineering & Computer Science (AREA)
  • Alarm Systems (AREA)
  • Financial Or Insurance-Related Operations Such As Payment And Settlement (AREA)

Abstract

The embodiment of the application provides a distributed payment system security processing method and device, wherein the method comprises the following steps: modeling a plurality of performance indexes of a payment system, and carrying out aggregation processing through a logic dependency relationship among the performance indexes based on a preset variation self-encoder to obtain a corresponding system-level reconstruction sequence, an index-level reconstruction sequence and a component-level reconstruction sequence of the payment system; determining alarm thresholds of the system level reconstruction sequence and the index level reconstruction sequence; sequentially determining a system-level health state, an index-level health state and a component-level health state corresponding to the index-level health state of the payment system according to the alarm threshold of the system-level reconstruction sequence, the alarm threshold of the index-level reconstruction sequence and a preset exception propagation rule; the application can accurately and real-timely determine the health degree of the distributed payment system at the system level, the component level and the index level, and ensure the information safety and the running stability of the payment system.

Description

Distributed payment system security processing method and device
Technical Field
The application relates to the field of information security, in particular to a security processing method and device for a distributed payment system.
Background
Because of the different types and scales of the processed services, the payment system is distributed from the logic level and the physical implementation level, for example, the types of the services can be a large payment service, a small payment service, an online banking payment service and the like, and the different services can be supported by one or more physical servers to support the computing services, and these can be collectively called as components. In order to ensure the stable operation of the payment system, it is necessary to monitor and analyze performance indexes of different sides of the payment system, such as the success rate of a certain service, the CPU utilization rate of a certain server, and the like. Therefore, from the perspective of quantification of the health of the payment system during operation, the whole analysis system needs to obtain the health degree during operation of the three layers of the system-component-index, and grade the health degree, such as three stages of health, warning and alarming, and can be further understood as the need of quantifying the health degree during operation of the payment system in a grading manner. The measurement of the health degree of a system can be essentially equivalent to the measurement of the abnormality degree of the system, and the current method for evaluating the abnormality of the index is mainly focused on: (1) Single index anomaly detection and (2) multi-index anomaly detection, but none of them measure the health of a payment system when three layers are running.
For the single-index anomaly detection method, for time sequence performance index data collected for the purpose of large-scale system monitoring, the existing single-index anomaly detection algorithm learns the history rule of the single index and compares the different judging index health (anomaly) degree of the current point and the predicted or reconstructed point. Many methods are available, such as regression-based methods and 3-sigma principle-based methods, but basically only measure the deviation degree of a single index, and the health degree description of a system level and a component is realized by monitoring a plurality of indexes, so that the health degree evaluation of the system level and the component level cannot be realized by the single index anomaly detection method.
For the multi-index anomaly detection method, the method uses a plurality of indexes as matrix data, and judges the overall health (anomaly) degree of the current vector and the predicted or reconstructed vector by simultaneously learning the history rule and comparing the difference between the current vector and the predicted or reconstructed vector, such as an LSTM-based method and the like. While such methods are capable of characterizing the health (health and alarms) of a host of indicators by analyzing the indicators in their entirety, they only enable a two-layer assessment of the health of the "host-indicator" and do not effectively rank the health.
The payment system is very necessary as a financial infrastructure supporting smooth running of domestic countryside in China, and multi-scale evaluation of the running state thereof is classified.
Disclosure of Invention
Aiming at the problems in the prior art, the application provides a safety processing method and a safety processing device for a distributed payment system, which can accurately and real-timely determine the respective health degrees of the distributed payment system at a system level, a component level and an index level, and ensure the information safety and the running stability of the payment system.
In order to solve at least one of the problems, the application provides the following technical scheme:
in a first aspect, the present application provides a method for securely processing a distributed payment system, including:
modeling a plurality of performance indexes of a payment system, and carrying out aggregation processing through a logic dependency relationship among the performance indexes based on a preset variation self-encoder to obtain a corresponding system-level reconstruction sequence, an index-level reconstruction sequence and a component-level reconstruction sequence of the payment system;
Determining an alarm threshold of the system level reconstruction sequence, and determining the alarm threshold of the index level reconstruction sequence according to the system alarm contribution degree of the index level reconstruction sequence;
And sequentially determining the system-level health state, the index-level health state and the component-level health state corresponding to the index-level health state of the payment system according to the alarm threshold of the system-level reconstruction sequence, the alarm threshold of the index-level reconstruction sequence and a preset exception propagation rule.
Further, the determining the alarm threshold of the index level reconstruction sequence according to the system alarm contribution degree of the index level reconstruction sequence includes:
Determining the system alarm contribution degree of the index-level reconstruction sequence according to the proportion of the index-level reconstruction sequence dimension in the system-level reconstruction sequence dimension, the alarm position of the index-level reconstruction sequence in the system-level reconstruction sequence and the similarity with the system-level reconstruction sequence;
And carrying out data alignment operation on the index-level reconstruction sequence to the system-level reconstruction sequence according to the system alarm contribution degree, and determining an alarm threshold of the index-level reconstruction sequence.
Further, the determining, in order, the system-level health state, the index-level health state, and the component-level health state corresponding to the index-level health state of the payment system according to the alarm threshold of the system-level reconstruction sequence, the alarm threshold of the index-level reconstruction sequence, and a preset exception propagation rule includes:
determining a system-level health state of the payment system according to the system-level reconstruction sequence and a corresponding alarm threshold;
Determining the index level health state of the payment system according to the system level health state, the index level reconstruction sequence and the corresponding alarm threshold value;
and determining the corresponding component level health state according to the index level health state of the payment system.
Further, after the sequentially determining the system-level health state, the index-level health state, and the component-level health state corresponding to the index-level health state of the payment system, the method includes:
Determining a corresponding index level health degree value according to a numerical comparison relation between the data characteristic value of the index level reconstruction sequence and a preset threshold value;
And determining corresponding system-level health degree values and component-level health degree values according to a preset health degree mapping rule, the system-level health state and the reconstructed sequence after component-level health state normalization processing.
In a second aspect, the present application provides a distributed payment system security processing apparatus comprising:
the index sequence reconstruction module is used for modeling a plurality of performance indexes of the payment system, and carrying out aggregation processing through a logic dependency relationship among the performance indexes based on a preset variation self-encoder to obtain a corresponding system-level reconstruction sequence, an index-level reconstruction sequence and a component-level reconstruction sequence of the payment system;
The alarm threshold determining module is used for determining an alarm threshold of the system level reconstruction sequence and determining the alarm threshold of the index level reconstruction sequence according to the system alarm contribution degree of the index level reconstruction sequence;
and the health state determining module is used for sequentially determining the system-level health state, the index-level health state and the component-level health state corresponding to the index-level health state of the payment system according to the alarm threshold of the system-level reconstruction sequence, the alarm threshold of the index-level reconstruction sequence and a preset exception propagation rule.
Further, the alarm threshold determining module includes:
A system alarm contribution degree determining unit, configured to determine a system alarm contribution degree of the index level reconstruction sequence according to a specific gravity of the index level reconstruction sequence dimension in the system level reconstruction sequence dimension, and an alarm position of the index level reconstruction sequence in the system level reconstruction sequence and a similarity with the system level reconstruction sequence;
And the index level alarm threshold determining unit is used for carrying out data alignment operation on the index level reconstruction sequence to the system level reconstruction sequence according to the system alarm contribution degree and determining the alarm threshold of the index level reconstruction sequence.
Further, the health status determination module includes:
A system-level health state determining unit, configured to determine a system-level health state of the payment system according to the system-level reconstruction sequence and a corresponding alarm threshold;
The index-level health state determining unit is used for determining the index-level health state of the payment system according to the system-level health state, the index-level reconstruction sequence and the corresponding alarm threshold value;
And the component-level health state determining unit is used for determining the corresponding component-level health state according to the index-level health state of the payment system.
Further, the health status determination module includes:
the index level health degree value determining unit is used for determining a corresponding index level health degree value according to the value comparison relation between the data characteristic value of the index level reconstruction sequence and a preset threshold value;
the system-level health degree value and component-level health degree value determining unit is used for determining corresponding system-level health degree values and component-level health degree values according to a preset health degree mapping rule, the system-level health state and the reconstructed sequence after normalization processing of the component-level health state.
In a third aspect, the present application provides an electronic device comprising a memory, a processor and a computer program stored on the memory and executable on the processor, the processor implementing the steps of the distributed payment system security processing method when the program is executed.
In a fourth aspect, the present application provides a computer readable storage medium having stored thereon a computer program which when executed by a processor performs the steps of the distributed payment system security processing method.
According to the technical scheme, the application provides the distributed payment system safety processing method and the distributed payment system safety processing device, and the three-layer unified alarm is realized by constructing a system-component-index disambiguation abnormal propagation mode, so that the respective health degree of the distributed payment system at a system level, a component level and an index level can be accurately and real-timely determined, and the information safety and the running stability of the payment system are ensured.
Drawings
In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings that are required in the embodiments or the description of the prior art will be briefly described, and it is obvious that the drawings in the following description are some embodiments of the present application, and other drawings may be obtained according to these drawings without inventive effort for a person skilled in the art.
FIG. 1 is a flow chart of a security processing method of a distributed payment system according to an embodiment of the present application;
FIG. 2 is a second flow chart of a security processing method of a distributed payment system according to an embodiment of the present application;
FIG. 3 is a third flow chart of a security processing method of a distributed payment system according to an embodiment of the present application;
FIG. 4 is a flow chart of a security processing method of a distributed payment system according to an embodiment of the present application;
FIG. 5 is one of the block diagrams of a distributed payment system security processing arrangement in an embodiment of the present application;
FIG. 6 is a second block diagram of a security processing apparatus of a distributed payment system according to an embodiment of the present application;
FIG. 7 is a third block diagram of a security processing apparatus for a distributed payment system in accordance with an embodiment of the present application;
FIG. 8 is a fourth block diagram of a distributed payment system security processing apparatus in accordance with an embodiment of the present application;
FIG. 9 is a schematic diagram of an exception propagation rule according to an embodiment of the present application;
fig. 10 is a schematic structural diagram of an electronic device according to an embodiment of the present application.
Detailed Description
For the purpose of making the objects, technical solutions and advantages of the embodiments of the present application more apparent, the technical solutions of the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present application, and it is apparent that the described embodiments are some embodiments of the present application, but not all embodiments of the present application. All other embodiments, which can be made by those skilled in the art based on the embodiments of the application without making any inventive effort, are intended to be within the scope of the application.
Considering the time sequence performance index data collected for the purpose of monitoring a large-scale system in the prior art for a single index anomaly detection method, the existing single index anomaly detection algorithm learns the historical rule of the single index and compares the health (anomaly) degree of different judgment indexes of a current point and a predicted or reconstructed point. The method has a plurality of methods, such as a regression-based method, a 3-sigma principle-based method and the like, but basically only can measure the deviation degree of a single index, and the health degree description of a system level and a component is realized by monitoring a plurality of indexes, so that the health degree evaluation of the system level and the component level cannot be realized by the single index anomaly detection method; and for multi-index anomaly detection methods in the prior art, the method takes a plurality of indexes as matrix data, and judges the overall health (anomaly) degree of the current vector and the predicted or reconstructed vector by simultaneously learning the history rule and comparing the difference between the current vector and the predicted or reconstructed vector, such as an LSTM-based method and the like. Although the method can describe the health degree (health and alarm) of the index hosts by integrally analyzing a plurality of indexes, the method only realizes the problem that the health degree of the two layers of host-index is evaluated and the health degree cannot be effectively classified.
In order to accurately and real-timely determine the health degree of a distributed payment system at a system level, a component level and an index level, and ensure the safety and operation stability of payment system information, the application provides an embodiment of a distributed payment system safety processing method, referring to fig. 1, wherein the distributed payment system safety processing method specifically comprises the following contents:
Step S101: modeling a plurality of performance indexes of a payment system, and carrying out aggregation processing through a logic dependency relationship among the performance indexes based on a preset variation self-encoder to obtain a corresponding system-level reconstruction sequence, an index-level reconstruction sequence and a component-level reconstruction sequence of the payment system.
Specifically, let the multi-index data be generated by a high-dimensional random variable x= { X 1,x2,...,xn } and independently distributed, and the variable X i represents index i. The variational self-encoder (Variational Auto-Encoder, VAE) is a generic term for a class of depth probability map models, through neural networksThe fitting mode encodes X into a low-dimensional random variable Z, then decodes Z into X through a neural network theta, ensures that the decoded X is similar to the original value as much as possible in the iterative process, and the VAE can finally output R X as follows:
RX＝log(pθ(X|Z))＝∑i∈[1,n]log(pθ(xi|Z)) (1)
Wherein p θ (X|Z) represents the conditional probability of X being regenerated after X information is encoded into Z through a neural network, R X is defined as a system level reconstruction sequence, and the reconstruction sequence of index X i Defined as log (p θ(xi |z)). Due to/>And θ can be user-defined, so the method of this patent can be applied to other variant VAE algorithms.
Assume that there is a user-defined configuration set c= { C 1,c2,...,cm }, where m represents the number of components, whereC j ε C are all a subset of [1, n ], and/>Representing the index division mode constructed by the user according to the membership between the index and the component, the reconstruction sequence/>, of the component level c k can be definedThe method comprises the following steps:
Thus, the system, the component and the index level reconstruction sequence can be obtained from the encoder through variation, and the range of the reconstruction sequence is as follows And smaller values in the sequence represent more anomalies in the corresponding host (system, component, or indicator).
Step S102: and determining an alarm threshold of the system level reconstruction sequence, and determining the alarm threshold of the index level reconstruction sequence according to the system alarm contribution degree of the index level reconstruction sequence.
Specifically, in order to identify the abnormality from the reconstructed sequence, an alarm threshold needs to be set for the reconstructed sequence, and because the monitoring indexes are numerous, the threshold identification abnormality is manually set for the reconstructed sequences of the system level, the component level and the index level respectively, and a great deal of labor cost is brought, so the section provides a threshold setting method, which only needs to set the threshold for the reconstructed sequences of the system level and the index level, and does not need to set the component level alarm threshold. The threshold is set for all index-level reconstruction sequences at once by aligning the index-level reconstruction sequences to the system-level reconstruction sequences.
Let vector R X＝(r1,r2,...,rT be the system level reconstruction sequence calculated according to equation (11), time range [1, T ], then the system level threshold is defined as:
thX＝μX-λXσX (3)
Where μ X is the mean of R X, σ X is the variance of R X, and λ X is the user-defined parameter, typically set to 2. If r t≤thX, the system is considered to be alerted at time t.
In order to set the threshold value for all indexes at one time, the contribution degree of different indexes to the system alarm needs to be quantized, the higher the contribution degree is, the more important the contribution degree is to the system alarm, the more strict the threshold value setting is, and conversely, the more relaxed the contribution degree is. The contribution degree is measured and divided into two parts, wherein one part is the proportion alpha of the dimension of the index-level reconstruction sequence to the dimension of the system-level reconstruction sequence, and the other part is the similarity beta between the alarm position of the index-level reconstruction sequence in the system-level reconstruction sequence and the system-level reconstruction sequence. The total dimension of the system level reconstruction sequence is L X＝∑t∈[1,T]rt. Similarly, the dimension of the reconstructed sequence of index i may be defined asWherein/>The value representing the reconstructed sequence of index i at time t, L i is the dimension of the reconstructed sequence of index i, then α i of index i can be defined as:
Further, the present patent uses the system level alarms as the real labels of the index alarms, and selects a threshold value on the reconstructed sequence of the index i as far as possible so that the alarms are similar to the real labels, and the similarity can use the F1 metric.
Formalizing the above description, given a threshold th X, calculating according to equation (13) to obtain the tag vector of the system alarmA T epsilon {0,1},0 represents a system alarm at time t, and 1 represents normal. Given a certain threshold th i for index i, if/>Alarm tag/>, at time t, of index iOtherwise/>Tag vector/>, of index i alarms can also be constructedBeta i defining index i is:
Wherein, And/>Respectively index i minimum and maximum of reconstructed sequence,/>For the label vector/>Relative to the tag vector/>Accuracy of/>Is the recall rate and β i e 0, 1. Due to/>Is the real number domain, and in order to reduce the search space, the complexity of the search can be reduced by means of uniform sampling.
Thus, the contribution w i of the index i can be defined as:
wi＝τ1αi+τ2βi (6)
Where τ 1+τ2 =1, for adjusting the weights of α i and β i, τ 1＝0.6,τ2 =0.4 is generally set. Further, the threshold value of the index i reconstruction sequence may be set as:
thi＝μi-λxwiσi (7)
Wherein mu i is the mean value of the index i reconstruction sequence, sigma i is the variance, lambda x is the user-defined parameter, and all index level reconstruction sequence thresholds are set to share lambda x. If it is The indicator i is considered to be alarmed at time t.
Step S103: and sequentially determining the system-level health state, the index-level health state and the component-level health state corresponding to the index-level health state of the payment system according to the alarm threshold of the system-level reconstruction sequence, the alarm threshold of the index-level reconstruction sequence and a preset exception propagation rule.
Alternatively, if index i is present such that time t isAnd r t＞thX shows that the system is normal, but has index alarm, the system is defined to be in a warning state at the moment. Further, when the system is set to be in a warning state, the number of indexes giving an alarm is W t.
Specifically, the application also designs an anomaly propagation rule of 'system-component-index', which is used for eliminating possible ambiguity of alarms of different levels. As shown in fig. 9, the system health is classified into normal, warning and alarm, the component health is classified into normal and alarm, and the index is classified into normal and alarm. Specific rule of exception propagation is as follows:
strategy 1: the system is normal, which necessarily results in normal index and normal components.
Strategy 2: the system alarms, which must cause an index alarm, further cause the index hosting component to alarm.
Strategy 3: the system alarms, which must cause an index alarm, further cause the index hosting component to alarm.
From the above strategy, it can be found that the exception propagation strategy firstly determines the system level health state according to the threshold lambda X and the system warning level definition, but triggers the index level health state calculation, and finally triggers the component level health state calculation instead of the step-by-step downward logic relationship, so that ambiguity possibly caused by the multi-level triggering of the health state calculation can be effectively avoided, and the threshold value is not required to be set for the component level reconstruction sequence.
From the above description, it can be known that the security processing method for the distributed payment system provided by the embodiment of the application can realize three-layer unified alarm by constructing a disambiguation abnormal propagation mode of a system-component-index, can accurately and real-timely determine the respective health degrees of the distributed payment system at a system level, a component level and an index level, and ensures the security and the stable operation of the information of the payment system.
In order to accurately determine the alarm threshold of the index level reconstruction sequence, in an embodiment of the distributed payment system security processing method of the present application, referring to fig. 2, the method may further specifically include the following:
step S201: and determining the system alarm contribution degree of the index-level reconstruction sequence according to the proportion of the index-level reconstruction sequence dimension in the system-level reconstruction sequence dimension, the alarm position of the index-level reconstruction sequence in the system-level reconstruction sequence and the similarity with the system-level reconstruction sequence.
Step S202: and carrying out data alignment operation on the index-level reconstruction sequence to the system-level reconstruction sequence according to the system alarm contribution degree, and determining an alarm threshold of the index-level reconstruction sequence.
Specifically, in order to set the threshold value for all the indexes at one time, the contribution degree of different indexes to the system alarm needs to be quantified, the higher the contribution degree is, the more important the contribution degree is to the system alarm, the more strict the threshold value setting is, and conversely, the more relaxed the contribution degree is. The contribution degree is measured and divided into two parts, wherein one part is the proportion alpha of the dimension of the index-level reconstruction sequence to the dimension of the system-level reconstruction sequence, and the other part is the similarity beta between the alarm position of the index-level reconstruction sequence in the system-level reconstruction sequence and the system-level reconstruction sequence. The total dimension of the system level reconstruction sequence is L X＝∑t∈[1,T]rt. Similarly, the dimension of the reconstructed sequence of index i may be defined asWherein/>The value representing the reconstructed sequence of index i at time t, L i is the dimension of the reconstructed sequence of index i, then α i of index i can be defined as:
Further, the present patent uses the system level alarms as the real labels of the index alarms, and selects a threshold value on the reconstructed sequence of the index i as far as possible so that the alarms are similar to the real labels, and the similarity can use the F1 metric.
Specifically, by aligning the index-level reconstruction sequences to the system-level reconstruction sequences, thresholds are set for all the index-level reconstruction sequences at once.
In order to accurately determine the health status of each level of the payment system, in an embodiment of the distributed payment system security processing method of the present application, referring to fig. 3, the following may be further specifically included:
Step S301: and determining the system-level health state of the payment system according to the system-level reconstruction sequence and the corresponding alarm threshold value.
Step S302: and determining the index-level health state of the payment system according to the system-level health state, the index-level reconstruction sequence and the corresponding alarm threshold value.
Step S303: and determining the corresponding component level health state according to the index level health state of the payment system.
Optionally, the exception propagation rule first determines the system level health state according to the threshold λ X and the system warning level definition, but triggers the index level health state calculation, and finally triggers the component level health state calculation instead of the step-by-step downward logic relationship, so that ambiguity possibly caused when the component level health state calculation is triggered in multiple steps can be effectively avoided, and the threshold is not required to be set for the component level reconstruction sequence.
In order to accurately determine the health value of each level of the payment system, in an embodiment of the distributed payment system security processing method of the present application, referring to fig. 4, the following may be further specifically included:
Step S401: and determining the corresponding index level health degree value according to the value comparison relation between the data characteristic value of the index level reconstruction sequence and a preset threshold value.
Step S402: and determining corresponding system-level health degree values and component-level health degree values according to a preset health degree mapping rule, the system-level health state and the reconstructed sequence after component-level health state normalization processing.
In particular, the reconstructed sequence, although it can distinguish between the host's normal and abnormal, lacks a warning level, and is of the value rangeDoes not have good readability and therefore needs to be mapped further.
Specifically, since the index itself has a data value (such as CPU utilization), there is no need to define the health. Set up the collectionFor the normalized value of R X and threshold th X, let the system level health at time t be SysHS t, which is defined as follows:
wherein S a (0, 100) is the fractional lower bound of the system in the health state, S b (0, 100) is the fractional lower bound of the system in the warning state, and S a＞Sb, S a＝80,Sb =60 is generally set, the first segment of the piecewise function represents that the reconstructed sequence of the normalized system in the normal state is mapped to [ S a, 100], the second segment represents that the reconstructed sequence of the normalized system in the warning state is mapped to [ S b,Sa ], the penalty term is provided to ensure that the health degree is lower as the warning index is more, and the third segment of the piecewise function represents that the reconstructed sequence of the normalized system in the warning state is mapped to [0,S b). The above ensures that the final fitness sequence is between 0 and 100 and the three states of the system are partitioned at S a and S b.
For the component c k, set upReconstructing sequence for the module/>Normalized sequence, then the value of the reconstructed sequence under normal conditions of the component is derived from/>Expressed as/>Component-level health at time t is therefore/>The calculation mode is as follows:
Wherein, The first segment of the piecewise function represents mapping the reconstructed sequence of the normalized component normal state to [ C a, 100], and the second segment represents mapping the reconstructed sequence of the normalized component alarm state to [0, C a ]) in order to prevent the possible out-of-range condition of the unknown normalized reconstructed value at the runtime, both segments of the formula (20) need to be compared with the boundary C a to correct the final health.
In order to accurately and real-timely determine the health degree of the distributed payment system at the system level, the component level and the index level, and ensure the safety and the operation stability of the payment system information, the application provides an embodiment of a distributed payment system safety processing device for realizing all or part of the contents of the distributed payment system safety processing method, referring to fig. 5, the distributed payment system safety processing device specifically comprises the following contents:
The index sequence reconstruction module 10 is configured to model a plurality of performance indexes of a payment system, and perform aggregation processing through a logical dependency relationship between the performance indexes based on a preset variation self-encoder, so as to obtain a system level reconstruction sequence, an index level reconstruction sequence and a component level reconstruction sequence of the corresponding payment system.
The alarm threshold determining module 20 is configured to determine an alarm threshold of the system level reconstruction sequence, and determine an alarm threshold of the index level reconstruction sequence according to a system alarm contribution of the index level reconstruction sequence.
The health status determining module 30 is configured to sequentially determine a system level health status, an index level health status, and a component level health status corresponding to the index level health status of the payment system according to the alarm threshold of the system level reconstruction sequence, the alarm threshold of the index level reconstruction sequence, and a preset exception propagation rule.
From the above description, it can be known that the distributed payment system security processing device provided by the embodiment of the application can realize three-layer unified alarm by constructing a disambiguation abnormal propagation mode of a system-component-index, can accurately and real-timely determine the respective health degree of the distributed payment system at a system level, a component level and an index level, and ensures the security and operation stability of the payment system information.
In order to accurately determine the alarm threshold of the index level reconstruction sequence, in an embodiment of the distributed payment system security processing apparatus of the present application, referring to fig. 6, the alarm threshold determining module 20 includes:
A system alarm contribution degree determining unit 21, configured to determine a system alarm contribution degree of the index-level reconstruction sequence according to a specific gravity of the index-level reconstruction sequence dimension in the system-level reconstruction sequence dimension, and an alarm position of the index-level reconstruction sequence in the system-level reconstruction sequence, and a similarity with the system-level reconstruction sequence.
And the index level alarm threshold determining unit 22 is configured to perform data alignment operation on the index level reconstruction sequence to the system level reconstruction sequence according to the system alarm contribution degree, and determine an alarm threshold of the index level reconstruction sequence.
In order to accurately determine the health status of each level of the payment system, in one embodiment of the distributed payment system security processing apparatus of the present application, referring to fig. 7, the health status determining module 30 includes:
A system-level health status determining unit 31, configured to determine a system-level health status of the payment system according to the system-level reconstruction sequence and a corresponding alarm threshold;
An indicator level health status determining unit 32, configured to determine an indicator level health status of the payment system according to the system level health status, the indicator level reconstruction sequence, and a corresponding alarm threshold;
A component level health status determining unit 33, configured to determine a corresponding component level health status according to the indicator level health status of the payment system.
In order to accurately determine the health value of each level of the payment system, in one embodiment of the distributed payment system security processing apparatus of the present application, referring to fig. 8, the health status determining module 30 includes:
An index level health degree value determining unit 34, configured to determine a corresponding index level health degree value according to a value comparison relationship between the data feature value of the index level reconstruction sequence and a preset threshold value;
the system-level health degree value and component-level health degree value determining unit 35 is configured to determine a corresponding system-level health degree value and component-level health degree value according to a preset health degree mapping rule, the system-level health state and the reconstructed sequence after normalization processing of the component-level health state.
In order to further explain the scheme, the application also provides a specific application example for realizing the distributed payment system security processing method by applying the distributed payment system security processing device, which specifically comprises the following contents:
(1) The reconstructed sequence of index level, component level and system level is generated for quantifying the current state reducibility of the different levels.
(2) And (5) defining alarm thresholds on the system level and index level reconstruction sequences, and distinguishing abnormal from normal.
(3) The anomaly propagation policy is constructed to identify component alarms and system alarms and map the reconstructed sequence to health. Which comprises the following steps:
1) Reconstruction sequence generation
Let the multi-index data be generated by a high-dimensional random variable x= { X 1,x2,...,xn } and independently distributed, and the variable X i represents index i. The variational self-encoder (Variational Auto-Encoder, VAE) is a generic term for a class of depth probability map models, through neural networksThe fitting mode encodes X into a low-dimensional random variable Z, then decodes Z into X through a neural network theta, ensures that the decoded X is similar to the original value as much as possible in the iterative process, and the VAE can finally output R X as follows:
RX＝log(pθ(X|Z))＝∑i∈[1,n]log(pθ(xi|Z)) (11)
Wherein p θ (X|Z) represents the conditional probability of X being regenerated after X information is encoded into Z through a neural network, R X is defined as a system level reconstruction sequence, and the reconstruction sequence of index X i Defined as log (p θ(xi |z)). Due to/>And θ can be user-defined, so the method of this patent can be applied to other variant VAE algorithms.
Assume that there is a user-defined configuration set c= { C 1,c2,...,cm }, where m represents the number of components, whereC j ε C are all a subset of [1, n ], and/>Representing the index division mode constructed by the user according to the membership between the index and the component, the reconstruction sequence/>, of the component level c k can be definedThe method comprises the following steps:
Thus, the system, the component and the index level reconstruction sequence can be obtained from the encoder through variation, and the range of the reconstruction sequence is as follows And smaller values in the sequence represent more anomalies in the corresponding host (system, component, or indicator). In order to recognize that an abnormality is recognized from the reconstructed sequence, an alarm threshold needs to be set for the reconstructed sequence.
2) Threshold setting method
Because the monitoring indexes are numerous, the threshold identification abnormality is manually set for the system level, the component level and the index level reconstruction sequences respectively, and a great deal of labor cost is brought, so the section provides a threshold setting method which only needs to set the threshold for the system level and the index level reconstruction sequences and does not need to set the component level alarm threshold. The threshold is set for all index-level reconstruction sequences at once by aligning the index-level reconstruction sequences to the system-level reconstruction sequences.
Let vector R X＝(r1,r2,...,rT be the system level reconstruction sequence calculated according to equation (11), time range [1, T ], then the system level threshold is defined as:
thX＝μX-λXσX (13)
Where μ X is the mean of R X, σ X is the variance of R X, and λ X is the user-defined parameter, typically set to 2. If r t≤thX, the system is considered to be alerted at time t.
In order to set the threshold value for all indexes at one time, the contribution degree of different indexes to the system alarm needs to be quantized, the higher the contribution degree is, the more important the contribution degree is to the system alarm, the more strict the threshold value setting is, and conversely, the more relaxed the contribution degree is. The contribution degree is measured and divided into two parts, wherein one part is the proportion alpha of the dimension of the index-level reconstruction sequence to the dimension of the system-level reconstruction sequence, and the other part is the similarity beta between the alarm position of the index-level reconstruction sequence in the system-level reconstruction sequence and the system-level reconstruction sequence. The total dimension of the system level reconstruction sequence is L X＝∑t∈[1,T]rt. Similarly, the dimension of the reconstructed sequence of index i may be defined asWherein/>The value representing the reconstructed sequence of index i at time t, L i is the dimension of the reconstructed sequence of index i, then α i of index i can be defined as:
Further, the present patent uses the system level alarms as the real labels of the index alarms, and selects a threshold value on the reconstructed sequence of the index i as far as possible so that the alarms are similar to the real labels, and the similarity can use the F1 metric.
Formalizing the above description, given a threshold th X, calculating according to equation (13) to obtain the tag vector of the system alarmA T epsilon {0,1},0 represents a system alarm at time t, and 1 represents normal. Given a certain threshold th i for index i, if/>Alarm tag/>, at time t, of index iOtherwise/>Tag vector/>, of index i alarms can also be constructedBeta i defining index i is:
Wherein, And/>Respectively index i minimum and maximum of reconstructed sequence,/>For the label vector/>Relative to the tag vector/>Accuracy of/>Is the recall rate and β i e 0, 1. Due to/>Is the real number domain, and in order to reduce the search space, the complexity of the search can be reduced by means of uniform sampling.
Thus, the contribution w i of the index i can be defined as:
wi＝τ1αi+τ2βi (16)
where τ 1+τ2 =t, for adjusting the weights of α i and β i, τ 1＝0.6,τ2 =0.4 is generally set. Further, the threshold value of the index i reconstruction sequence may be set as:
thi＝μi-λxwiσi (17)
Wherein mu i is the mean value of the index i reconstruction sequence, sigma i is the variance, lambda x is the user-defined parameter, and all index level reconstruction sequence thresholds are set to share lambda x. If it is The indicator i is considered to be alarmed at time t.
3) Anomaly propagation strategy and health grading
The upper section solves the problems of system level normal and alarm and index level normal and alarm, and the lower section mainly solves the problems of component level normal and alarm. In addition, the reconstructed sequence, although it can distinguish between the host's normal and abnormal, lacks a warning level, and is of the value rangeDoes not have good readability and therefore needs to be mapped further. Thus, this section is divided into 3 parts: (1) system level alert definition, (2) exception propagation policy design, (3) health map.
System level alert definition: if index i is present such that time t isAnd r t＞thX shows that the system is normal, but has index alarm, the system is defined to be in a warning state at the moment. Further, when the system is set to be in a warning state, the number of indexes giving an alarm is W t.
And (3) design of an anomaly propagation strategy: this section devised an anomaly propagation strategy of "system-component-index" for disambiguating the alarms at different levels. As shown in fig. 9, the system health is classified into normal, warning and alarm, the component health is classified into normal and alarm, and the index is classified into normal and alarm. The exception propagation strategy is as follows:
strategy 1: the system is normal, which inevitably leads to normal indexes and normal components;
Strategy 2: a system warning, which is to cause index warning and further cause the index host component warning;
strategy 3: the system alarms, which can cause index alarms and further cause the index hosting component alarms;
From the above strategy, it can be found that the exception propagation strategy firstly determines the system level health state according to the threshold lambda X and the system warning level definition, but triggers the index level health state calculation, and finally triggers the component level health state calculation instead of the step-by-step downward logic relationship, so that ambiguity possibly caused by the multi-level triggering of the health state calculation can be effectively avoided, and the threshold value is not required to be set for the component level reconstruction sequence.
Component tag vector: as can be derived from the exception propagation policy, when a component C k e C, a system level threshold th X and an alarm threshold th i for any index i are given, the component tag vector is defined asThe calculation mode is as follows: /(I)
Health degree mapping: this section mainly defines system-level health and component-level health, and since the index itself has data values (such as CPU utilization), there is no need to define health. Set up the collectionFor the normalized value of R X and threshold th X, let the system level health at time t be SysHS t, which is defined as follows:
wherein S a (0, 100) is the fractional lower bound of the system in the health state, S b (0, 100) is the fractional lower bound of the system in the warning state, and S a＞Sb, S a＝80,Sb =60 is generally set, the first segment of the piecewise function represents that the reconstructed sequence of the normalized system in the normal state is mapped to [ S a, 100], the second segment represents that the reconstructed sequence of the normalized system in the warning state is mapped to [ S b,Sa ], the penalty term is provided to ensure that the health degree is lower as the warning index is more, and the third segment of the piecewise function represents that the reconstructed sequence of the normalized system in the warning state is mapped to [0,S b). The above ensures that the final fitness sequence is between 0 and 100 and the three states of the system are partitioned at S a and S b.
For the component c k, set upReconstructing sequence for the module/>Normalized sequence, then the value of the reconstructed sequence under normal conditions of the component is derived from/>Expressed as/>Component-level health at time t is therefore/>The calculation mode is as follows:
Wherein, The first segment of the piecewise function represents mapping the reconstructed sequence of the normalized component normal state to [ C a, 100], and the second segment represents mapping the reconstructed sequence of the normalized component alarm state to [0, C a ]) in order to prevent the possible out-of-range condition of the unknown normalized reconstructed value at the runtime, both segments of the formula (20) need to be compared with the boundary C a to correct the final health.
As can be seen from the above, the present application can also achieve the following technical effects:
(1) A multi-scale reconstruction sequence construction method based on a variation self-encoder is provided, the reconfigurability of a plurality of performance index data is modeled, and a system level and a component level reconstruction sequence is described through logic dependency relation aggregation among indexes.
(2) The index reconstruction sequence self-adaptive alarm threshold selection method for aligning the system level reconstruction sequence is provided, and the alarm threshold of the index reconstruction sequence is selected by automatically enabling the index level reconstruction sequence to be aligned with the alarm state of the system level, dynamically identifying the contribution degree of the index to the whole alarm and selecting the alarm threshold of the index reconstruction sequence.
(3) An anomaly propagation strategy oriented to a three-level monitoring architecture and a health degree grading mechanism thereof are provided, a system-component-index unambiguous anomaly propagation mode is constructed to realize three-level unified alarm, and the system-level health degree and the component-level health degree are mapped by combining a reconstruction sequence and an alarm threshold value.
In order to accurately and real-timely determine the health degree of a distributed payment system at a system level, a component level and an index level and ensure the safety and the operation stability of payment system information, the application provides an embodiment of an electronic device for realizing all or part of contents in a safety processing method of the distributed payment system, wherein the electronic device specifically comprises the following contents:
a processor (processor), a memory (memory), a communication interface (Communications Interface), and a bus; the processor, the memory and the communication interface complete communication with each other through the bus; the communication interface is used for realizing information transmission between the distributed payment system security processing device and related equipment such as a core service system, a user terminal, a related database and the like; the logic controller may be a desktop computer, a tablet computer, a mobile terminal, etc., and the embodiment is not limited thereto. In this embodiment, the logic controller may refer to an embodiment of the distributed payment system security processing method in the embodiment and an embodiment of the distributed payment system security processing device, and the contents thereof are incorporated herein, and the repetition is omitted.
It is understood that the user terminal may include a smart phone, a tablet electronic device, a network set top box, a portable computer, a desktop computer, a Personal Digital Assistant (PDA), a vehicle-mounted device, a smart wearable device, etc. Wherein, intelligent wearing equipment can include intelligent glasses, intelligent wrist-watch, intelligent bracelet etc..
In practical applications, part of the security processing method of the distributed payment system may be executed on the electronic device side as described above, or all operations may be completed in the client device. Specifically, the selection may be made according to the processing capability of the client device, and restrictions of the use scenario of the user. The application is not limited in this regard. If all operations are performed in the client device, the client device may further include a processor.
The client device may have a communication module (i.e. a communication unit) and may be connected to a remote server in a communication manner, so as to implement data transmission with the server. The server may include a server on the side of the task scheduling center, and in other implementations may include a server of an intermediate platform, such as a server of a third party server platform having a communication link with the task scheduling center server. The server may include a single computer device, a server cluster formed by a plurality of servers, or a server structure of a distributed device.
Fig. 10 is a schematic block diagram of a system configuration of an electronic device 9600 according to an embodiment of the present application. As shown in fig. 10, the electronic device 9600 may include a central processor 9100 and a memory 9140; the memory 9140 is coupled to the central processor 9100. Notably, this fig. 10 is exemplary; other types of structures may also be used in addition to or in place of the structures to implement telecommunications functions or other functions.
In one embodiment, the distributed payment system security processing method functions may be integrated into the central processor 9100. The central processor 9100 may be configured to perform the following control:
Step S101: modeling a plurality of performance indexes of a payment system, and carrying out aggregation processing through a logic dependency relationship among the performance indexes based on a preset variation self-encoder to obtain a corresponding system-level reconstruction sequence, an index-level reconstruction sequence and a component-level reconstruction sequence of the payment system.
Step S102: and determining an alarm threshold of the system level reconstruction sequence, and determining the alarm threshold of the index level reconstruction sequence according to the system alarm contribution degree of the index level reconstruction sequence.
Step S103: and sequentially determining the system-level health state, the index-level health state and the component-level health state corresponding to the index-level health state of the payment system according to the alarm threshold of the system-level reconstruction sequence, the alarm threshold of the index-level reconstruction sequence and a preset exception propagation rule.
From the above description, it can be known that the electronic device provided by the embodiment of the application realizes three-layer unified alarm by constructing a disambiguation abnormal propagation mode of a system-component-index, can accurately and real-timely determine the respective health degrees of the distributed payment system at the system level, the component level and the index level, and ensures the information security and the operation stability of the payment system.
In another embodiment, the distributed payment system security processing apparatus may be configured separately from the central processor 9100, for example, the distributed payment system security processing apparatus may be configured as a chip connected to the central processor 9100, and the distributed payment system security processing method functions are implemented by control of the central processor.
As shown in fig. 10, the electronic device 9600 may further include: a communication module 9110, an input unit 9120, an audio processor 9130, a display 9160, and a power supply 9170. It is noted that the electronic device 9600 need not include all of the components shown in fig. 10; in addition, the electronic device 9600 may further include components not shown in fig. 10, and reference may be made to the related art.
As shown in fig. 10, the central processor 9100, sometimes referred to as a controller or operational control, may include a microprocessor or other processor device and/or logic device, which central processor 9100 receives inputs and controls the operation of the various components of the electronic device 9600.
The memory 9140 may be, for example, one or more of a buffer, a flash memory, a hard drive, a removable media, a volatile memory, a non-volatile memory, or other suitable device. The information about failure may be stored, and a program for executing the information may be stored. And the central processor 9100 can execute the program stored in the memory 9140 to realize information storage or processing, and the like.
The input unit 9120 provides input to the central processor 9100. The input unit 9120 is, for example, a key or a touch input device. The power supply 9170 is used to provide power to the electronic device 9600. The display 9160 is used for displaying display objects such as images and characters. The display may be, for example, but not limited to, an LCD display.
The memory 9140 may be a solid state memory such as Read Only Memory (ROM), random Access Memory (RAM), SIM card, etc. But also a memory which holds information even when powered down, can be selectively erased and provided with further data, an example of which is sometimes referred to as EPROM or the like. The memory 9140 may also be some other type of device. The memory 9140 includes a buffer memory 9141 (sometimes referred to as a buffer). The memory 9140 may include an application/function storage portion 9142, the application/function storage portion 9142 storing application programs and function programs or a flow for executing operations of the electronic device 9600 by the central processor 9100.
The memory 9140 may also include a data store 9143, the data store 9143 for storing data, such as contacts, digital data, pictures, sounds, and/or any other data used by an electronic device. The driver storage portion 9144 of the memory 9140 may include various drivers of the electronic device for communication functions and/or for performing other functions of the electronic device (e.g., messaging applications, address book applications, etc.).
The communication module 9110 is a transmitter/receiver 9110 that transmits and receives signals via an antenna 9111. A communication module (transmitter/receiver) 9110 is coupled to the central processor 9100 to provide input signals and receive output signals, as in the case of conventional mobile communication terminals.
Based on different communication technologies, a plurality of communication modules 9110, such as a cellular network module, a bluetooth module, and/or a wireless local area network module, etc., may be provided in the same electronic device. The communication module (transmitter/receiver) 9110 is also coupled to a speaker 9131 and a microphone 9132 via an audio processor 9130 to provide audio output via the speaker 9131 and to receive audio input from the microphone 9132 to implement usual telecommunications functions. The audio processor 9130 can include any suitable buffers, decoders, amplifiers and so forth. In addition, the audio processor 9130 is also coupled to the central processor 9100 so that sound can be recorded locally through the microphone 9132 and sound stored locally can be played through the speaker 9131.
The embodiment of the present application further provides a computer readable storage medium capable of implementing all the steps in the distributed payment system security processing method in which the execution subject is a server or a client, and the computer readable storage medium stores a computer program thereon, and the computer program when executed by a processor implements all the steps in the distributed payment system security processing method in which the execution subject is a server or a client, for example, the processor implements the following steps when executing the computer program:
Step S101: modeling a plurality of performance indexes of a payment system, and carrying out aggregation processing through a logic dependency relationship among the performance indexes based on a preset variation self-encoder to obtain a corresponding system-level reconstruction sequence, an index-level reconstruction sequence and a component-level reconstruction sequence of the payment system.
Step S102: and determining an alarm threshold of the system level reconstruction sequence, and determining the alarm threshold of the index level reconstruction sequence according to the system alarm contribution degree of the index level reconstruction sequence.
Step S103: and sequentially determining the system-level health state, the index-level health state and the component-level health state corresponding to the index-level health state of the payment system according to the alarm threshold of the system-level reconstruction sequence, the alarm threshold of the index-level reconstruction sequence and a preset exception propagation rule.
As can be seen from the above description, the computer readable storage medium provided by the embodiment of the present application realizes three-layer unified alarm by constructing a disambiguation anomaly propagation mode of "system-component-index", so as to accurately and real-timely determine the respective health degrees of the distributed payment system at the system level, the component level and the index level, and ensure the information security and the operation stability of the payment system.
It will be apparent to those skilled in the art that embodiments of the present invention may be provided as a method, apparatus, or computer program product. Accordingly, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment combining software and hardware aspects. Furthermore, the present invention may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, and the like) having computer-usable program code embodied therein.
The present invention is described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (devices), and computer program products according to embodiments of the invention. It will be understood that each flow and/or block of the flowchart illustrations and/or block diagrams, and combinations of flows and/or blocks in the flowchart illustrations and/or block diagrams, can be implemented by computer program instructions. These computer program instructions may be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.
These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including instruction means which implement the function specified in the flowchart flow or flows and/or block diagram block or blocks.
These computer program instructions may also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.
The principles and embodiments of the present invention have been described in detail with reference to specific examples, which are provided to facilitate understanding of the method and core ideas of the present invention; meanwhile, as those skilled in the art will have variations in the specific embodiments and application scope in accordance with the ideas of the present invention, the present description should not be construed as limiting the present invention in view of the above.

Claims (8)

1. A method for secure processing of a distributed payment system, the method comprising:
modeling a plurality of performance indexes of a payment system, and carrying out aggregation processing through a logic dependency relationship among the performance indexes based on a preset variation self-encoder to obtain a corresponding system-level reconstruction sequence, an index-level reconstruction sequence and a component-level reconstruction sequence of the payment system;
Determining an alarm threshold of the system level reconstruction sequence, and determining the alarm threshold of the index level reconstruction sequence according to the system alarm contribution degree of the index level reconstruction sequence;
Sequentially determining a system-level health state, an index-level health state and a component-level health state corresponding to the index-level health state of the payment system according to the alarm threshold of the system-level reconstruction sequence, the alarm threshold of the index-level reconstruction sequence and a preset exception propagation rule;
the determining the alarm threshold of the index level reconstruction sequence according to the system alarm contribution degree of the index level reconstruction sequence comprises the following steps:
Determining the system alarm contribution degree of the index-level reconstruction sequence according to the proportion of the index-level reconstruction sequence dimension in the system-level reconstruction sequence dimension, the alarm position of the index-level reconstruction sequence in the system-level reconstruction sequence and the similarity with the system-level reconstruction sequence;
And carrying out data alignment operation on the index-level reconstruction sequence to the system-level reconstruction sequence according to the system alarm contribution degree, and determining an alarm threshold of the index-level reconstruction sequence.
2. The method according to claim 1, wherein determining the system-level health state, the index-level health state, and the component-level health state corresponding to the index-level health state of the payment system in order according to the alarm threshold of the system-level reconstruction sequence, the alarm threshold of the index-level reconstruction sequence, and a preset exception propagation rule comprises:
determining a system-level health state of the payment system according to the system-level reconstruction sequence and the corresponding alarm threshold value;
Determining the index level health state of the payment system according to the system level health state, the index level reconstruction sequence and the corresponding alarm threshold value;
and determining the corresponding component level health state according to the index level health state of the payment system.
3. The distributed payment system security processing method according to claim 1, wherein after the sequentially determining a system-level health state, an index-level health state, and a component-level health state corresponding to the index-level health state of the payment system, comprising:
Determining a corresponding index level health degree value according to a numerical comparison relation between the data characteristic value of the index level reconstruction sequence and a preset threshold value;
And determining corresponding system-level health degree values and component-level health degree values according to a preset health degree mapping rule, the system-level health state and the reconstructed sequence after component-level health state normalization processing.
4. A distributed payment system security processing apparatus, comprising:
the index sequence reconstruction module is used for modeling a plurality of performance indexes of the payment system, and carrying out aggregation processing through a logic dependency relationship among the performance indexes based on a preset variation self-encoder to obtain a corresponding system-level reconstruction sequence, an index-level reconstruction sequence and a component-level reconstruction sequence of the payment system;
The alarm threshold determining module is used for determining an alarm threshold of the system level reconstruction sequence and determining the alarm threshold of the index level reconstruction sequence according to the system alarm contribution degree of the index level reconstruction sequence;
The health state determining module is used for sequentially determining the system-level health state, the index-level health state and the component-level health state corresponding to the index-level health state of the payment system according to the alarm threshold of the system-level reconstruction sequence, the alarm threshold of the index-level reconstruction sequence and a preset exception propagation rule;
The alarm threshold determining module includes:
A system alarm contribution degree determining unit, configured to determine a system alarm contribution degree of the index level reconstruction sequence according to a specific gravity of the index level reconstruction sequence dimension in the system level reconstruction sequence dimension, and an alarm position of the index level reconstruction sequence in the system level reconstruction sequence and a similarity with the system level reconstruction sequence;
And the index level alarm threshold determining unit is used for carrying out data alignment operation on the index level reconstruction sequence to the system level reconstruction sequence according to the system alarm contribution degree and determining the alarm threshold of the index level reconstruction sequence.
5. The distributed payment system security processing apparatus of claim 4, wherein the health status determination module comprises:
A system-level health state determining unit, configured to determine a system-level health state of the payment system according to the system-level reconstruction sequence and a corresponding alarm threshold;
The index-level health state determining unit is used for determining the index-level health state of the payment system according to the system-level health state, the index-level reconstruction sequence and the corresponding alarm threshold value;
And the component-level health state determining unit is used for determining the corresponding component-level health state according to the index-level health state of the payment system.
6. The distributed payment system security processing apparatus of claim 4, wherein the health status determination module comprises:
the index level health degree value determining unit is used for determining a corresponding index level health degree value according to the value comparison relation between the data characteristic value of the index level reconstruction sequence and a preset threshold value;
the system-level health degree value and component-level health degree value determining unit is used for determining corresponding system-level health degree values and component-level health degree values according to a preset health degree mapping rule, the system-level health state and the reconstructed sequence after normalization processing of the component-level health state.
7. An electronic device comprising a memory, a processor and a computer program stored on the memory and executable on the processor, characterized in that the processor implements the steps of the distributed payment system security processing method of any of claims 1 to 3 when the program is executed by the processor.
8. A computer readable storage medium having stored thereon a computer program, characterized in that the computer program, when executed by a processor, implements the steps of the distributed payment system security processing method of any of claims 1 to 3.
CN202110828767.3A 2021-07-22 2021-07-22 Distributed payment system security processing method and device Active CN113487316B (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN202110828767.3A CN113487316B (en) 2021-07-22 2021-07-22 Distributed payment system security processing method and device

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN202110828767.3A CN113487316B (en) 2021-07-22 2021-07-22 Distributed payment system security processing method and device

Publications (2)

Publication Number Publication Date
CN113487316A CN113487316A (en) 2021-10-08
CN113487316B true CN113487316B (en) 2024-05-03

Family

ID=77942912

Family Applications (1)

Application Number Title Priority Date Filing Date
CN202110828767.3A Active CN113487316B (en) 2021-07-22 2021-07-22 Distributed payment system security processing method and device

Country Status (1)

Country Link
CN (1) CN113487316B (en)

Citations (14)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
GB0303443D0 (en) * 2002-02-15 2003-03-19 Fair Isaac And Company Inc Fraud and abuse detection and entity profiling in hierarchical coded payment systems
WO2004046882A2 (en) * 2002-11-15 2004-06-03 Fair Isaac Corporation Fraud and abuse detection and entity profiling in hierarchical coded payment systems
WO2016202216A1 (en) * 2015-06-19 2016-12-22 阿里巴巴集团控股有限公司 Method and device for obtaining payment threshold
CN106776214A (en) * 2016-12-12 2017-05-31 广州市申迪计算机系统有限公司 A kind of server health degree appraisal procedure
CN106897557A (en) * 2017-02-23 2017-06-27 中国人民解放军国防科学技术大学 The in-orbit health state evaluation method of satellite and assessment system based on component function mapping graph
US9886338B1 (en) * 2015-09-30 2018-02-06 EMC IP Holding Company LLC Health check solution evaluating system status
CN110070461A (en) * 2019-04-17 2019-07-30 南瑞集团有限公司 A kind of power information system health degree appraisal procedure and its assessment system
CN110839016A (en) * 2019-10-18 2020-02-25 平安科技（深圳）有限公司 Abnormal flow monitoring method, device, equipment and storage medium
CN111199799A (en) * 2019-12-31 2020-05-26 深圳市三收健康管理科技有限公司 Health prompt information processing method and device and terminal equipment
CN111340333A (en) * 2020-02-12 2020-06-26 腾讯科技（深圳）有限公司 Payment service data processing method and device and computer equipment
CN111461828A (en) * 2020-03-31 2020-07-28 深圳市三收健康管理科技有限公司 Health data processing method, device and system based on bill
CN111784162A (en) * 2020-07-01 2020-10-16 支付宝(杭州)信息技术有限公司 Health index evaluation method, device and equipment of business system
CN112162907A (en) * 2020-09-30 2021-01-01 上海新炬网络信息技术股份有限公司 Health degree evaluation method based on monitoring index data
CN112801316A (en) * 2021-01-28 2021-05-14 中国人寿保险股份有限公司上海数据中心 Fault positioning method, system equipment and storage medium based on multi-index data

Family Cites Families (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20150269346A1 (en) * 2014-03-24 2015-09-24 Mastercard International Incorporated Mining transaction data for healthiness index

Patent Citations (14)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
GB0303443D0 (en) * 2002-02-15 2003-03-19 Fair Isaac And Company Inc Fraud and abuse detection and entity profiling in hierarchical coded payment systems
WO2004046882A2 (en) * 2002-11-15 2004-06-03 Fair Isaac Corporation Fraud and abuse detection and entity profiling in hierarchical coded payment systems
WO2016202216A1 (en) * 2015-06-19 2016-12-22 阿里巴巴集团控股有限公司 Method and device for obtaining payment threshold
US9886338B1 (en) * 2015-09-30 2018-02-06 EMC IP Holding Company LLC Health check solution evaluating system status
CN106776214A (en) * 2016-12-12 2017-05-31 广州市申迪计算机系统有限公司 A kind of server health degree appraisal procedure
CN106897557A (en) * 2017-02-23 2017-06-27 中国人民解放军国防科学技术大学 The in-orbit health state evaluation method of satellite and assessment system based on component function mapping graph
CN110070461A (en) * 2019-04-17 2019-07-30 南瑞集团有限公司 A kind of power information system health degree appraisal procedure and its assessment system
CN110839016A (en) * 2019-10-18 2020-02-25 平安科技（深圳）有限公司 Abnormal flow monitoring method, device, equipment and storage medium
CN111199799A (en) * 2019-12-31 2020-05-26 深圳市三收健康管理科技有限公司 Health prompt information processing method and device and terminal equipment
CN111340333A (en) * 2020-02-12 2020-06-26 腾讯科技（深圳）有限公司 Payment service data processing method and device and computer equipment
CN111461828A (en) * 2020-03-31 2020-07-28 深圳市三收健康管理科技有限公司 Health data processing method, device and system based on bill
CN111784162A (en) * 2020-07-01 2020-10-16 支付宝(杭州)信息技术有限公司 Health index evaluation method, device and equipment of business system
CN112162907A (en) * 2020-09-30 2021-01-01 上海新炬网络信息技术股份有限公司 Health degree evaluation method based on monitoring index data
CN112801316A (en) * 2021-01-28 2021-05-14 中国人寿保险股份有限公司上海数据中心 Fault positioning method, system equipment and storage medium based on multi-index data

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
业务与硬件融合的智能电网调度控制系统健康度综合评价;李新鹏;邬小波;高欣;戚岳;黄晴晴;王轶;;电力系统自动化;20171025(20);78-83, 162 *

Also Published As

Publication number Publication date
CN113487316A (en) 2021-10-08

Similar Documents

Publication Publication Date Title
CN111275546B (en) Financial customer fraud risk identification method and device
CN108052528A (en) A kind of storage device sequential classification method for early warning
CN111932269B (en) Equipment information processing method and device
CN111582341B (en) User abnormal operation prediction method and device
CN110310123B (en) Risk judging method and device
CN106537423A (en) Adaptive featurization as service
CN111611390B (en) Data processing method and device
CN111191677B (en) User characteristic data generation method and device and electronic equipment
CN114399321A (en) Business system stability analysis method, device and equipment
CN111178687B (en) Financial risk classification method and device and electronic equipment
CN109559218A (en) A kind of determination method, apparatus traded extremely and storage medium
CN114418189A (en) Water quality grade prediction method, system, terminal device and storage medium
CN112330432B (en) Risk level identification model training method, risk level identification method, terminal and storage medium
CN113487316B (en) Distributed payment system security processing method and device
CN116843395A (en) Alarm classification method, device, equipment and storage medium of service system
CN116777642A (en) Vehicle risk parameter prediction method and device based on ensemble learning model
CN116523622A (en) Object risk prediction method and device, electronic equipment and storage medium
CN111782774A (en) Question recommendation method and device
CN112764957A (en) Application fault delimiting method and device
CN112737834A (en) Cloud hard disk fault prediction method, device, equipment and storage medium
CN117115596B (en) Training method, device, equipment and medium of object action classification model
CN115640896B (en) Household user power load prediction method under multi-user scene and related equipment
CN114693431A (en) Credit evaluation method, apparatus, device, medium, and program product
CN117573401A (en) Abnormality detection method, abnormality detection device, abnormality detection apparatus, and storage medium
CN117876021A (en) Data prediction method, device, equipment and storage medium based on artificial intelligence

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination
GR01 Patent grant
GR01 Patent grant