CN110706016A - Method and device for detecting business abnormity and computer readable storage medium - Google Patents
Method and device for detecting business abnormity and computer readable storage medium Download PDFInfo
- Publication number
- CN110706016A CN110706016A CN201910785006.7A CN201910785006A CN110706016A CN 110706016 A CN110706016 A CN 110706016A CN 201910785006 A CN201910785006 A CN 201910785006A CN 110706016 A CN110706016 A CN 110706016A
- Authority
- CN
- China
- Prior art keywords
- service
- monitored
- monitoring
- time sequence
- anomaly detection
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
- 238000000034 method Methods 0.000 title claims description 49
- 238000003860 storage Methods 0.000 title abstract description 4
- 238000012544 monitoring process Methods 0.000 claims abstract description 233
- 238000001514 detection method Methods 0.000 claims abstract description 108
- 230000005856 abnormality Effects 0.000 claims abstract description 16
- 230000002159 abnormal effect Effects 0.000 claims description 47
- 238000001914 filtration Methods 0.000 claims description 24
- 230000008569 process Effects 0.000 claims description 9
- 238000004891 communication Methods 0.000 claims description 5
- 238000004590 computer program Methods 0.000 claims description 4
- 238000012545 processing Methods 0.000 claims description 4
- 238000013075 data extraction Methods 0.000 claims description 3
- 238000011156 evaluation Methods 0.000 claims description 3
- 238000010586 diagram Methods 0.000 description 4
- 238000012360 testing method Methods 0.000 description 4
- 230000008859 change Effects 0.000 description 3
- 238000007667 floating Methods 0.000 description 3
- 238000012986 modification Methods 0.000 description 3
- 230000004048 modification Effects 0.000 description 3
- 230000004044 response Effects 0.000 description 3
- 230000006399 behavior Effects 0.000 description 2
- 238000000354 decomposition reaction Methods 0.000 description 2
- 239000000284 extract Substances 0.000 description 2
- 108010045306 T134 peptide Proteins 0.000 description 1
- 230000001419 dependent effect Effects 0.000 description 1
- 238000009826 distribution Methods 0.000 description 1
- 238000005516 engineering process Methods 0.000 description 1
- 230000006870 function Effects 0.000 description 1
- 230000014759 maintenance of location Effects 0.000 description 1
- 238000004519 manufacturing process Methods 0.000 description 1
- 230000000737 periodic effect Effects 0.000 description 1
- 230000002265 prevention Effects 0.000 description 1
- 238000012954 risk control Methods 0.000 description 1
- 238000006467 substitution reaction Methods 0.000 description 1
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q30/00—Commerce
- G06Q30/02—Marketing; Price estimation or determination; Fundraising
- G06Q30/0207—Discounts or incentives, e.g. coupons or rebates
- G06Q30/0225—Avoiding frauds
Landscapes
- Business, Economics & Management (AREA)
- Engineering & Computer Science (AREA)
- Accounting & Taxation (AREA)
- Development Economics (AREA)
- Strategic Management (AREA)
- Finance (AREA)
- Game Theory and Decision Science (AREA)
- Entrepreneurship & Innovation (AREA)
- Economics (AREA)
- Marketing (AREA)
- Physics & Mathematics (AREA)
- General Business, Economics & Management (AREA)
- General Physics & Mathematics (AREA)
- Theoretical Computer Science (AREA)
- Debugging And Monitoring (AREA)
Abstract
The invention discloses a service abnormity detection method, which comprises the following steps: determining at least one monitoring dimension and at least one service index to be monitored; determining at least one monitoring path for monitoring service abnormity according to at least one monitoring dimension; each monitoring path corresponds to one or more combinations of monitoring dimensions in at least one monitoring dimension; acquiring a time sequence corresponding to at least one service index to be monitored aiming at each monitoring path; respectively detecting time sequence abnormality of a time sequence corresponding to at least one service index to be monitored; and outputting a service abnormity prompt according to the time sequence abnormity detection result. The invention also discloses a device for detecting the service abnormity, a computing device and a computer readable storage medium.
Description
Technical Field
The present invention relates to internet technologies, and in particular, to a method and an apparatus for detecting a service anomaly, and a computer-readable storage medium.
Background
To facilitate new merchant extensions to offline facilitators and crowd-sourced merchants, the transaction platform may typically return a partial commission to the merchant based on the merchant's transactions. This commission-returned business model is often referred to simply as commission-return. Currently, trading platforms have invested a large amount of marketing funds in the commission return process. However, the counter commission business is developed and the cheating behavior that a plurality of bad merchants collect a large number of counter commission funds through false transactions and code exchange transactions also occurs. This type of cheating is generally called a suit-back commission, and has the characteristics of mass production and great harmfulness, and accurate prevention and control are difficult to guarantee through a general recognition model, and the coverage rate is also low. Therefore, a solution for detecting abnormal situations of business is needed, which can be used for detecting abnormal situations of business such as commission on return.
Disclosure of Invention
In view of this, the present invention provides a method for detecting a service anomaly, including: determining at least one monitoring dimension and at least one service index of a service to be monitored; determining at least one monitoring path for monitoring service abnormity according to the at least one monitoring dimension; each monitoring path corresponds to one or more combinations of monitoring dimensions in the at least one monitoring dimension; acquiring a time sequence corresponding to the at least one service index to be monitored aiming at each monitoring path; performing time sequence anomaly detection on a time sequence corresponding to the at least one service index to be monitored; and outputting a service abnormity prompt according to the time sequence abnormity detection result.
Wherein, the determining at least one monitoring path for monitoring the service anomaly according to the at least one monitoring dimension includes: and performing full-permutation and combination on all monitoring dimensions, and taking the obtained combination as the at least one monitoring path.
Wherein the method further comprises: acquiring service data of the service to be monitored; wherein, for each monitoring path, acquiring the time sequence corresponding to the at least one service index to be monitored includes: for each monitoring path, assigning a value to the monitoring dimension combination determined by the monitoring path; extracting service data which accords with the condition and is related to the at least one service index to be monitored from the service data by taking the assigned monitoring path as the condition; and counting the extracted data, and determining a time sequence of the at least one service index to be monitored in a preset time window.
Wherein, the obtaining of the time sequence corresponding to the at least one service index to be monitored for each monitoring path includes: sending at least one service data request to a server of a transaction platform, wherein each service data request corresponds to a service index to be monitored and an assigned monitoring path; and receiving a time sequence corresponding to the at least one service index to be monitored from a server of the trading platform.
Wherein, the time sequence corresponding to the at least one service index to be monitored respectively performs time sequence anomaly detection, and the time sequence anomaly detection comprises: and respectively carrying out time sequence anomaly detection on the time sequence corresponding to the at least one service index to be monitored by adopting an S-H-ESD method to carry out the time sequence anomaly detection.
Determining the statistic of the GESD through the following formula in the process of respectively detecting the time sequence abnormality of the time sequence corresponding to the at least one service index to be monitored by adopting an S-H-ESD method:
wherein x isiIs the value of the ith sample in the time series;is the median of the sample; s is the average difference of the samples.
The service abnormity prompt comprises an abnormal value and an abnormal score of the at least one service index to be monitored and a corresponding monitoring path thereof.
After obtaining the time sequence corresponding to the at least one service index to be monitored, the method further includes: and filtering the time sequence according to a preset filtering condition, and deleting the time sequence meeting the filtering condition.
Wherein, the service to be monitored comprises a commission returning service; the monitoring dimension includes: one or any combination of an account opening channel, a merchant operation type, a merchant type, an account opening area and an account opening coefficient; the service indexes to be monitored comprise: one or any combination of the number of newly signed merchants, the percentage of 60 merchants in 3 days, the percentage of returned merchants, the percentage of merchant remaining, and the cost of merchant opening an account.
The business to be monitored comprises business access business; the service indexes to be monitored comprise: applying for the number of admitted merchants.
The service to be monitored comprises a small program inspection service; the service indexes to be monitored comprise: applet page visit volume and/or applet daily transaction volume.
The invention provides a service abnormity detection method, which comprises the following steps:
the input module is used for determining at least one monitoring dimension and at least one service index to be monitored of the service to be monitored;
the monitoring path generation module is used for determining at least one monitoring path for monitoring abnormal services according to the at least one monitoring dimension; each monitoring path corresponds to one or more combinations of monitoring dimensions in the at least one monitoring dimension;
the time sequence acquisition module is used for acquiring a time sequence corresponding to the at least one service index to be monitored aiming at each monitoring path;
the time sequence anomaly detection module is used for respectively detecting the time sequence anomaly of the time sequence corresponding to the extracted at least one service index to be monitored; and
and the output module is used for outputting service abnormity reminding according to the time sequence abnormity detection result.
Wherein the apparatus further comprises: the data acquisition module is used for acquiring the service data of the service to be monitored; wherein, the time sequence acquisition module comprises:
the evaluation unit is used for evaluating the monitoring dimension combination determined by the monitoring paths aiming at each monitoring path;
the data extraction unit is used for extracting the service data which accords with the condition and is related to the at least one service index to be monitored from the service data by taking the assigned monitoring path as the condition; and
and the statistical unit is used for performing statistics on the extracted data and determining a time sequence of the at least one service index to be monitored in a preset time window.
Wherein, the time sequence acquisition module comprises:
the transaction platform comprises a request unit, a processing unit and a processing unit, wherein the request unit is used for sending at least one service data request to a server of the transaction platform, and each service data request corresponds to a service index to be monitored and an assigned monitoring path;
and the receiving unit is used for receiving the time sequence corresponding to the at least one service index to be monitored from the server of the trading platform.
The monitoring path generation module performs full permutation and combination on all monitoring dimensions, and uses the obtained full permutation and combination as the at least one monitoring path.
And the time sequence anomaly detection module adopts an S-H-ESD method to respectively detect the time sequence anomaly of the extracted time sequence corresponding to the at least one service index to be monitored.
The timing sequence anomaly detection module determines the statistic of the GESD through the following formula in the process of respectively performing timing sequence anomaly detection on the extracted timing sequence corresponding to the at least one service index to be monitored by adopting an S-H-ESD method:
wherein x isiIs the value of the ith sample in the time series;
is the median of the sample; s is the average difference of the samples.
The service abnormity prompt output by the output module comprises an abnormal value and an abnormal score of a service index and a corresponding monitoring path.
The above apparatus further comprises: and the filtering module is used for filtering the time sequence corresponding to the at least one service index to be monitored according to a preset filtering condition and deleting the time sequence meeting the filtering condition.
The invention proposes a computing device comprising:
at least one processor;
a memory;
a network communication device;
an input device;
an output device; and
a bus connecting the at least one processor, the memory, the network communication device, the input device, and the output device; wherein,
the at least one processor is configured to execute the machine-readable instruction module stored in the memory to perform the above-mentioned traffic anomaly detection method.
The present invention proposes a computer-readable medium, on which a computer program is stored, which, when executed by a processor, implements the above-mentioned traffic anomaly detection method.
By the service anomaly detection method and the service anomaly detection device, the time sequence anomaly detection can be carried out on the time sequence corresponding to the service index from a plurality of monitoring dimensions, the coverage of the service index anomaly in a plurality of dimensions is ensured, the missing detection of the abnormal condition can be effectively prevented, the method and the device have the advantages of strong robustness and low risk missing rate, and the comprehensive and rapid service anomaly detection is realized.
Drawings
FIG. 1 is a schematic diagram of a system 100 in which embodiments of the present invention are implemented;
fig. 2 shows a flow chart of a service anomaly detection method according to an embodiment of the present invention;
fig. 3 shows an example of determining at least one monitoring path for performing abnormal traffic monitoring according to the at least one monitoring dimension according to the embodiment of the present invention;
fig. 4 shows an internal structure of the service anomaly detection apparatus according to the embodiment of the present invention;
fig. 5 shows a flowchart of a service anomaly detection method according to another embodiment of the present invention;
fig. 6 shows an internal structure of a service abnormality detection apparatus according to another embodiment of the present invention; and
FIG. 7 shows an internal structure of a computing device according to an embodiment of the invention.
Detailed Description
In order to make the objects, technical solutions and advantages of the present invention more apparent, the present invention is described in further detail below with reference to specific embodiments and the accompanying drawings.
As previously mentioned, there is a cheating act of a suit back commission in the process of a commission back to a merchant. The technical scheme of the invention is specially provided for identifying the abnormal condition of the business caused by the cheating behavior. Fig. 1 shows a schematic structural diagram of a system 100 to which the embodiment of the present invention is applied. As shown in fig. 1, in a system 100 to which an embodiment of the present invention is applied, each merchant 101 is connected to a server 102 of a trading platform through a network, and becomes a contracted merchant by contracting with the trading platform. After becoming a contracted merchant, the merchants 101 can be used as sellers to conduct online transactions with buyers through the transaction platform. The information for each merchant 101 (including merchant information as well as transaction information) will be recorded in the database 103 of the server 102 of the transaction platform. In addition, during the execution of various services, the database 103 records service data related to the various services. For example, for a commission return service application, newly signed-up merchant information (including merchant identification, time of opening an account, channel of opening an account, merchant operation type, merchant type, area of opening an account, coefficient of opening an account, and whether it is a commission return merchant, etc.), transaction information of each merchant, and newly cancelled merchant information (including merchant identification, time of cancellation, channel of opening an account, merchant operation type, merchant type, area of opening an account, coefficient of opening an account, and whether it is a commission return merchant, etc.) will be recorded in database 103. In addition to the merchant 101, the server 102 of the trading platform and the database 103, the system 100 further includes a service anomaly detection device 104. The abnormal service detection device 104 may be connected to the database 103, acquire the service information from the database 103, and process, analyze, and count the acquired service information to detect abnormal service so as to discover cheating such as commission. The abnormal service detection device 104 may be further connected to the server 102 of the trading platform, and may acquire information related to a service to be monitored from the server 102 of the trading platform, and analyze the acquired information, thereby performing abnormal service detection, so as to discover cheating such as commission.
It should be noted that, in the embodiment of the present invention, the service anomaly detection apparatus 104 may specifically be a single computing device with a computing function, such as a workstation; in addition, the service anomaly detection device 104 may also be a functional module integrated on the trading platform server 102.
The following describes in detail a specific process of the service anomaly detection device 104 according to the embodiment of the present invention with reference to the drawings.
Fig. 2 shows a flow chart of a service anomaly detection method according to an embodiment of the present invention. As mentioned above, the method can be applied to the traffic anomaly detection apparatus 104. As shown in fig. 2, the method for detecting service anomaly mainly includes the following steps:
In the embodiment of the present invention, the service to be monitored refers to a service that has a risk of cheating and needs to be monitored, such as the above commission return service, and may further include a merchant admission service or an applet polling service, and other services that have a risk of cheating.
In the embodiment of the present invention, the service data refers to data related to a certain service. For example, for a commission return service, the service data can include newly signed-up merchant information (including merchant identification, time of opening an account, channel of opening an account, merchant operation type, merchant type, area of opening an account, coefficient of opening an account, whether it is a commission return merchant, etc.), transaction information of each merchant, and newly cancelled merchant information (including merchant identification, time of cancellation, channel of opening an account, merchant operation type, merchant type, area of opening an account, coefficient of opening an account, whether it is a commission return merchant, etc.), etc. For a merchant admission service, the service data may include merchant information (including merchant identification, admission time, merchant operation type, merchant type, region, etc.) for which admission is requested. For applet polling services, the service data may include applet page access information, applet transaction information, and the like.
In an embodiment of the present invention, the service data of the service to be monitored may be obtained from the database 103 of the whole trading platform, for example, obtained from the database 103 through the trading platform server 102 or obtained directly from the database 103.
In the embodiment of the present invention, the at least one monitoring dimension and the at least one service index to be monitored may be set by the service party according to actual requirements.
In the embodiment of the present invention, the monitoring dimension refers to the division of the granularity for monitoring the service index to be monitored. For example, still taking a merchant rebate scenario as an example, the monitoring dimensions described above may include: an account opening channel, a merchant operation type, a merchant type, an account opening area, an account opening coefficient and the like. The monitoring dimension of the account opening area can be further divided into more detailed monitoring dimensions of account opening province, account opening city, account opening area and the like. Wherein, the setting of each monitoring dimension represents that the service index can be monitored from the dimension. In addition, each monitoring dimension may have a different value. For example, the value of the monitoring dimension of the account opening channel may include: service provider account opening, crowd-sourced account opening, etc. The value of the monitoring dimension of the business operation type can comprise the following steps: stores, mobile, transportation, and vendors. The value of the monitoring dimension of the merchant type can comprise: application type merchants, offline collection merchants, return merchants, and the like. The value of the monitoring dimension of the account opening area can include: each province, city, county, etc. Similar monitoring dimension settings can also be adopted for abnormal detection of business such as business admission business of merchants and small program inspection.
In the embodiment of the present invention, the service index to be monitored is generally a service index capable of reflecting a potential risk of the service to be monitored, and may also be referred to as a risk index. The selection of the service index to be monitored mainly depends on service experience, and generally can be a time sequence index which is highly concerned by some services and changes along with time. Still taking the business return scene of the merchant as an example, the business index to be monitored may include: business indexes before, in advance and after. Wherein the prior risk indicators may include: number of newly signed merchants, etc. Accident risk indicators may include: 60 merchants are full in 3 days, and the counter is the number of merchants. The post-hoc risk indicators may include: merchant retention rate, merchant account opening cost, and the like. For the business admission service of the merchant, the business index to be monitored can comprise the number of merchants applying for admission. For the applet polling service, the service index to be monitored may include an applet page access amount, an applet daily transaction amount, and the like. And the abnormal detection of business such as business access business of a merchant and small program inspection can also be carried out according to the business condition to set the business index to be monitored.
It should be noted that the above embodiments are described by taking a commission returning service, a merchant admission service, and an applet polling service as examples. In the embodiment of the present invention, different monitoring dimensions and service indexes to be monitored may also be set for different service scenarios, that is, the at least one monitoring dimension and the at least one service index to be monitored are set according to a service to be monitored.
In an embodiment of the present invention, the monitoring path may be used as a condition for extracting data from the traffic data.
For example, for three monitoring dimensions of an account opening channel, a merchant operation type and an account opening area, the three monitoring dimensions can be combined to determine a monitoring path, namely the account opening area-account opening channel-merchant operation type. For example, Guangdong province-Guangzhou city-facilitator account-mobile type merchants are an example of assigning values to the monitoring paths described above. The example of the monitoring path corresponds to a combination of three monitoring dimensions, namely, a service provider account (value of an account opening channel), a floating merchant (value of a merchant operation type) and Guangdong province-Guangzhou city (value of an account opening area).
Fig. 3 shows an example of determining at least one monitoring path for performing abnormal traffic monitoring according to the at least one monitoring dimension according to the embodiment of the present invention. In the example shown in fig. 3, it is assumed that there are four monitoring dimensions Ti (i ═ 1,2,3,4), and each monitoring dimension has a different value Tij (i ═ 1,2,3, 4; j ═ 1,2, … Ki). Each node in fig. 3 represents a combination of monitoring dimensions, and the combination of monitoring dimensions gradually deepens from top to bottom. The four nodes T1, T2, T3 and T4 in the first layer represent that the monitoring dimensions are not combined, and each monitoring dimension individually forms a monitoring path. The six nodes T12, T13, T14, T23, T24, and T34 of the second layer represent any two monitoring dimensions combined (e.g., T12 represents a combination of two monitoring dimensions T1 and T2), each two monitoring dimensions combined to form a monitoring path. The four nodes T123, T124, T134, and T234 of the third layer represent any combination of three monitoring dimensions (e.g., T123 represents a combination of three monitoring dimensions T1, T2, and T3), and each combination of three monitoring dimensions constitutes a monitoring path. A node T1234 at the fourth level represents the combination of four monitoring dimensions, which together form a monitoring path. Under the condition of carrying out full combination (cross multiplication) on the values of the four monitoring dimensions, assigned Pi Tij monitoring paths are obtained. Therefore, when the subsequent abnormal detection is carried out, the time sequence abnormal detection can be carried out on the service indexes to be monitored on all assigned II Tij monitoring paths, so that the abnormal detection can be carried out on all the monitoring granularity without missing the abnormal condition.
In an embodiment of the present invention, the at least one monitoring path determined according to the at least one monitoring dimension for performing abnormal service monitoring may perform full permutation and combination on one or more monitoring dimensions in the at least one monitoring dimension, and use an obtained full permutation and combination as the at least one monitoring path.
In the embodiment of the present invention, a part of combinations may be further deleted from the full permutation combination according to the actual situation of the service to be monitored, and then the remaining combinations are used as the at least one monitoring path. The main reason for deleting the partial combinations is that it takes a long time to detect an abnormality for each of the full-permutation combinations when the number of monitoring dimensions is large. Thus, combinations that are not to be considered can be pruned out according to the actual conditions of the service, for example, it is known that for a certain or certain combinations, the amount of service data is small, and thus no anomaly detection is necessary, or for a certain or certain combinations, the service data is not to be considered, and the combination can be deleted. Therefore, the time required by the abnormity detection can be reduced, and the computing resources are saved.
And 204, extracting service data from the service data according to the at least one service index to be monitored for each monitoring path, performing statistics, and determining a time sequence corresponding to the at least one service index to be monitored.
In an embodiment of the present invention, the service data includes all raw data required for determining the at least one service indicator to be detected.
As mentioned above, each monitoring path corresponds to a combination of at least one monitoring dimension, i.e. constitutes a condition for extracting data or may also be referred to as a data range. Therefore, in this step, for each monitoring path, the monitoring dimension combination determined by the monitoring path may be assigned, data that meets the above condition and is related to the at least one service index to be monitored is extracted from the service data with the assigned monitoring path as a condition, and the extracted data is counted, so as to obtain a time sequence of the at least one service index to be monitored within a predetermined time window.
For example, for a value of the monitoring path of guangdong province-guangzhou city-facilitator account opening-mobile merchant, for a to-be-monitored business index of the number of newly-signed merchants, the information of the newly-signed merchants of the guangdong province-guangzhou city-facilitator account opening-mobile merchant may be extracted from the information of the newly-signed merchants of the business data, and the extracted information of the newly-signed merchants may be counted, so as to obtain a time sequence of the to-be-monitored business index of the newly-signed merchants within a predetermined time window (for example, the number of newly-signed merchants per day meeting the condition of guangdong province-guangzhou city-facilitator account opening-mobile merchant within 30 days). In the embodiment of the present invention, the above operations are repeatedly performed according to all values of each monitoring path and the combination of each service index to be monitored, so as to obtain a time sequence corresponding to each service index to be monitored in all monitoring paths.
In the embodiment of the present invention, after the time sequence corresponding to each service index to be monitored in all monitoring paths is obtained, the time sequence sequences may be further filtered according to a preset filtering condition, and the time sequence sequences meeting the preset filtering condition are deleted. For example, a number threshold or a ratio threshold of 0 s in a time series is set in advance, and when the number of 0 s in a time series is greater than the number threshold or the ratio of 0 s in a time series is greater than the ratio threshold, the time series is deleted. The preset condition may be set according to a traffic situation.
In general, in this step, the timing abnormality detection can be performed based on the 3 σ principle. However, since the detection using the 3 σ principle cannot effectively detect local abnormal fluctuations, and is less robust to extreme abnormal conditions existing in the timing sequence, more false detections are usually caused.
In this case, embodiments of the present invention employ a conservative hybrid extreme student hybrid ESD (S-H-ESD) algorithm for the above-described timing anomaly detection. The S-H-ESD algorithm decomposes a time sequence by adopting a conservative-Trend decomposition (STL) method, thereby solving the problem that a residual error component is easily influenced by an extreme abnormal value. The STL method includes an outer loop and an inner loop that uses the loses method to obtain periodic linear components to achieve more complex timing decomposition relationships. The outer loop realizes stronger robustness to abnormal values through weighting the time sequence data points. In the section for detecting the error, the generalized version esd (gesd) hypothesis test is used. The GESD test is a method of detecting a plurality of abnormal values in univariate data that approximately satisfy a normal distribution. In the course of a GESD test, the statistics of the GESD are typically determined from the mean of the samples and the variance of the samples. However, since the mean and variance are easily affected by extreme outliers, more robust statistics are used in the detection of timing anomalies using the S-H-ESD algorithm: the mean and the variance in the process of determining the statistic of the GESD are replaced by the median and the mean difference, and the median is used as the estimation of the time sequence trend, so that when the abnormal values in the time sequence data have large proportion and the abnormal values have extreme points, the detection results have high robustness. Specifically, in the S-H-ESD algorithm, the statistics of GESD can be determined by equation (1) below:
wherein x isiIs the value of the ith sample in the time series;is the median of the sample; s is the average difference of the samples. When the GESD test is carried out, the cycle is carried out for R times, the data with the maximum statistical quantity in the previous cycle is removed in each cycle, then the statistical quantity is recalculated until the R data are removed, and the statistical quantity R is obtained1，R2，……，Rr. And determining an abnormal value lambda from the calculated statistic and the calculated critical valueiWherein the number of abnormal values is the largest and satisfies Ri>λiI of (1).
However, the S-H-ESD algorithm applying median and average difference can still have poor adaptability to the time sequence with large trend change. Based on the above problem, in the embodiment of the present invention, a sliding median is used instead of the median to determine the statistics of the GESD, so as to adapt to the time series data with large trend change. Wherein, the sliding median is the median of each time window calculated for the whole time sequence sliding in one time window. For example, the time window may be set to 5 days.
And step 206, outputting a service abnormity prompt according to the time sequence abnormity detection result.
In an embodiment of the present invention, the time sequence abnormality detection result is an abnormality sensing condition of a time sequence corresponding to the service indicator to be monitored on the at least one monitoring path, that is, whether the time sequence has a point with an abnormal numerical value. If the service abnormality reminding exists, the service abnormality reminding can comprise abnormal values and abnormal scores of service indexes, corresponding monitoring paths and the like. And specific numerical values of numerator and denominator can be respectively output for the proportional type service index.
Specifically, the abnormal value is a point where the service index value is abnormal in a certain time unit under a certain monitoring path, for example, a point where a time sequence corresponding to a certain service index is too high or too low. The above anomaly score is the standard score (z-score) of the point of the anomaly in a time series, usually the difference between a number and the mean divided by the standard deviation. The corresponding monitoring path refers to a monitoring path corresponding to the time sequence where the abnormal point is located. In addition, since some of the service indicators to be monitored belong to the proportional service indicators, the output abnormal value includes the numerical values of the numerator and the denominator. For example, for the index of the proportion of returned merchants, the denominator is the total number of merchants and the numerator is the number of merchants with returned commissions.
And after receiving the service abnormity prompt, the manager performs service risk control according to the information carried in the service abnormity prompt.
By the service anomaly detection method, the time sequence anomaly detection can be performed on the time sequence corresponding to the service index from multiple monitoring dimensions, and the coverage of the service index anomaly in multiple dimensions is ensured, so that the omission of abnormal conditions can be effectively prevented, the method has the advantages of strong robustness and low risk omission rate, and the comprehensive and rapid service anomaly detection is realized.
Corresponding to the service anomaly detection method, the embodiment of the invention also provides a service anomaly detection device. Fig. 4 shows an internal structure of the traffic abnormality detection apparatus. As shown in fig. 4, the service abnormality detection apparatus includes:
a data obtaining module 401, configured to obtain service data of a service to be monitored;
an input module 402, configured to determine at least one monitoring dimension and at least one service index to be monitored;
a monitoring path generating module 403, configured to determine at least one monitoring path for performing abnormal service monitoring according to the at least one monitoring dimension; each monitoring path corresponds to one or more combinations of monitoring dimensions in the at least one monitoring dimension;
a time sequence acquiring module 404, configured to acquire, for each monitoring path, a time sequence corresponding to the at least one service index to be monitored;
a time sequence anomaly detection module 405, which respectively performs time sequence anomaly detection on the time sequence corresponding to the at least one service index to be monitored; and
and the output module 406 is configured to output a service exception prompt according to the time sequence exception detection result.
In an embodiment of the present invention, the data obtaining module 401 may obtain service statistical data of a service to be monitored from a database of a transaction platform.
In an embodiment of the present invention, the monitoring path generating module 403 may perform full permutation and combination on all monitoring dimensions of the at least one monitoring dimension, and use the obtained full permutation and combination as the at least one monitoring path.
In the embodiment of the present invention, the monitoring path generating module 403 may further delete a part of combinations from the full permutation combination according to the actual situation of the service to be monitored, and then use the remaining combinations as the at least one monitoring path, so as to reduce the time required for anomaly detection and save the computing resources.
In an embodiment of the present invention, the time sequence extracting module 404 may include: the evaluation unit is used for evaluating the monitoring dimension combination determined by the monitoring paths aiming at each monitoring path; the data extraction unit is used for extracting the service data which accords with the condition and is related to the at least one service index to be monitored from the service data by taking the assigned monitoring path as the condition; and the statistical unit is used for performing statistics on the extracted data and determining a time sequence of the at least one service index to be monitored in a preset time window.
In an embodiment of the present invention, the timing anomaly detection module 405 may perform timing anomaly detection based on a 3 σ principle or perform timing anomaly detection by using an S-H-ESD algorithm. Furthermore, in the S-H-ESD algorithm, the statistic of the GESD can be determined by using the sliding median, so that the method is more suitable for time series data with larger trend change. Wherein, the sliding median is the median of each time window calculated for the whole time sequence sliding in one time window. For example, the time window may be set to 5 days.
In an embodiment of the present invention, the service abnormality reminder output by the output module 406 may include an abnormal value and an abnormal score of the service indicator, and a corresponding monitoring path. And specific numerical values of numerator and denominator can be respectively output for the proportional type service index.
In an embodiment of the present invention, the service anomaly detection apparatus may further include: and the filtering module is used for filtering the time sequence corresponding to the at least one service index to be monitored according to a preset filtering condition and deleting the time sequence meeting the filtering condition.
As an alternative to the above scheme, the operation of extracting, counting, and determining the time sequence corresponding to the at least one service index to be monitored from the service data of the service to be monitored according to the at least one service index to be monitored for each monitoring path may also be executed by the server 102 of the transaction platform. In this case, after determining at least one monitoring path, for each monitoring path, the service anomaly detection device 104 may request a time sequence corresponding to the at least one service index to be monitored from the server 102 of the trading platform according to the determined detection path. In the foregoing embodiment, the service anomaly detection method implemented by the service anomaly detection apparatus 104 may be as shown in fig. 5, and mainly includes the following steps:
step 501, determining at least one monitoring dimension and at least one service index to be monitored.
Step 502, determining at least one monitoring path for monitoring service abnormity according to the at least one monitoring dimension; each monitoring path corresponds to a combination of one or more monitoring dimensions in the at least one monitoring dimension.
Step 503, acquiring a time sequence corresponding to the at least one service index to be monitored for each monitoring path.
In an embodiment of the present invention, the service anomaly detection device 104 may directly obtain the time sequence corresponding to the at least one service index to be monitored from the server of the transaction platform.
In the embodiment of the present invention, after determining at least one service index to be monitored and at least one monitoring path, the service anomaly detection apparatus 104 sends at least one service data request to the server 102 of the transaction platform, where each service data request corresponds to one service index to be monitored and one assigned monitoring path. After the server 102 of the transaction platform receives the at least one service data request, for each service data request, service data related to a service index to be monitored is extracted from the service data recorded in the database 103 under the condition of the monitoring dimension combination determined by the monitoring path, and statistics is performed to determine a time sequence corresponding to the service index to be monitored. Then, as a response to each service request, the server 102 of the transaction platform may return a time sequence corresponding to a monitoring path and a service index to be monitored to the service anomaly detection device 104.
For example, for the value of the monitoring path of Guangdong province, Guangzhou city, service provider account opening and mobile merchants, for the to-be-monitored business index of the number of newly contracted merchants, the business anomaly detection device 104 will send a business data request to the server 102 of the trading platform. After receiving the service data request, the server 102 of the transaction platform may extract the new contracted merchant information of the Guangdong province-Guangzhou city-facilitator account opening-floating merchant from the new contracted merchant information recorded in the database 103, and count the extracted new contracted merchant information, thereby obtaining a time sequence of the service index of the new contracted merchant within a predetermined time window (for example, the number of new contracted merchants per day meeting the condition of the Guangdong province-Guangzhou city-facilitator account opening-floating merchant within 30 days). Then, the time series is fed back to the service abnormality detection apparatus 104 as a response to the service data request.
And 504, respectively detecting the time sequence abnormality of the time sequence corresponding to the at least one service index to be monitored.
And 505, outputting a service abnormity prompt according to the time sequence abnormity detection result.
It should be noted that the implementation methods of the steps 501-502 and 504-505 are the same as those of the steps 202-203 and 205-206 in fig. 2, and therefore, the description thereof is omitted here.
Corresponding to the above service anomaly detection method, an embodiment of the present invention further provides a service anomaly detection apparatus, whose structure is shown in fig. 6, and mainly includes:
an input module 402, configured to determine at least one monitoring dimension and at least one service index to be monitored;
a monitoring path generating module 403, configured to determine at least one monitoring path for performing abnormal service monitoring according to the at least one monitoring dimension; each monitoring path corresponds to one or more combinations of monitoring dimensions in the at least one monitoring dimension;
a time sequence acquiring module 404, configured to acquire, for each monitoring path, a time sequence corresponding to the at least one service index to be monitored;
a time sequence anomaly detection module 405, which respectively performs time sequence anomaly detection on the time sequence corresponding to the at least one service index to be monitored; and
and the output module 406 is configured to output a service exception prompt according to the time sequence exception detection result.
In an embodiment of the present invention, the time sequence acquiring module 601 may acquire a time sequence corresponding to the at least one service index to be monitored from a server of the transaction platform. Specifically, the time sequence acquiring module 404 may include:
the system comprises a request unit, a transaction platform and a monitoring unit, wherein the request unit is used for sending at least one service data request to a server 102 of the transaction platform, and each service data request corresponds to a service index to be monitored and an assigned monitoring path;
and the receiving unit is used for receiving the time sequence corresponding to the at least one service index to be monitored from the server of the trading platform.
After receiving the service data requests, the server 102 of the transaction platform extracts service data related to the service index to be monitored from the service data recorded in the database 103 on the condition that the value of the monitoring dimension combination determined by the assigned monitoring path is taken as a condition for each service data request, and performs statistics to determine a time sequence corresponding to the service index to be monitored; then, as a response to each service request, a time sequence corresponding to one monitoring path and one service index to be monitored is returned to the time sequence acquisition module 601.
It should be noted that the input module 402, the monitoring path generating module 403, the timing anomaly detecting module 405, and the output module 406 are the same as the corresponding modules in fig. 4, and therefore, implementation methods of the modules are not described herein again.
In an embodiment of the present invention, the service anomaly detection apparatus may further include: and the filtering module is used for filtering the time sequence corresponding to the at least one service index to be monitored according to a preset filtering condition and deleting the time sequence meeting the filtering condition.
Through the service anomaly detection device, the time sequence anomaly detection can be carried out on the time sequence corresponding to the service index from a plurality of monitoring dimensions, the coverage of the service index anomaly in a plurality of dimensions is ensured, the omission of the abnormal condition can be effectively prevented, the robustness is high, the risk omission rate is low, and the comprehensive and rapid service anomaly detection is realized.
Based on the different embodiments, the invention provides a service anomaly detection method, which comprises the following steps: determining at least one monitoring dimension and at least one service index of a service to be monitored; determining at least one monitoring path for monitoring service abnormity according to the at least one monitoring dimension; each monitoring path corresponds to one or more combinations of monitoring dimensions in the at least one monitoring dimension; acquiring a time sequence corresponding to the at least one service index to be monitored aiming at each monitoring path; performing time sequence anomaly detection on a time sequence corresponding to the at least one service index to be monitored; and outputting a service abnormity prompt according to the time sequence abnormity detection result.
As described above, the time sequence corresponding to the at least one service index to be monitored obtained for each monitoring path may be extracted from the obtained service data or obtained from the server of the platform. In addition, the specific implementation method of each step may refer to the above embodiments, and is not described herein again.
An embodiment of the present invention further provides a computing device, an internal structure of which mainly includes, as shown in fig. 7: at least one processor 702, memory 704, network communication device 706, input device 708, output device 710, and bus 712 connecting the above devices. The at least one processor 702 is configured to execute modules of machine-readable instructions stored in the memory. In an embodiment of the present invention, the one or more processors execute a machine readable instruction module to implement the service anomaly detection method shown in fig. 2 or fig. 5.
An embodiment of the present invention further provides a computer-readable medium, on which a computer program is stored, and the computer program, when executed by a processor, implements the service anomaly detection method shown in fig. 2 or fig. 5.
Those of ordinary skill in the art will understand that: the discussion of any embodiment above is meant to be exemplary only, and is not intended to intimate that the scope of the disclosure, including the claims, is limited to these examples; within the idea of the invention, also features in the above embodiments or in different embodiments may be combined, steps may be implemented in any order, and there are many other variations of the different aspects of the invention as described above, which are not provided in detail for the sake of brevity.
In addition, well known power/ground connections to Integrated Circuit (IC) chips and other components may or may not be shown within the provided figures for simplicity of illustration and discussion, and so as not to obscure the invention. Furthermore, devices may be shown in block diagram form in order to avoid obscuring the invention, and also in view of the fact that specifics with respect to implementation of such block diagram devices are highly dependent upon the platform within which the present invention is to be implemented (i.e., specifics should be well within purview of one skilled in the art). Where specific details (e.g., circuits) are set forth in order to describe example embodiments of the invention, it should be apparent to one skilled in the art that the invention can be practiced without, or with variation of, these specific details. Accordingly, the description is to be regarded as illustrative instead of restrictive.
While the present invention has been described in conjunction with specific embodiments thereof, many alternatives, modifications, and variations of these embodiments will be apparent to those of ordinary skill in the art in light of the foregoing description. For example, other memory architectures (e.g., dynamic ram (dram)) may use the discussed embodiments.
The embodiments of the invention are intended to embrace all such alternatives, modifications and variances that fall within the broad scope of the appended claims. Therefore, any omissions, modifications, substitutions, improvements and the like that may be made without departing from the spirit and principles of the invention are intended to be included within the scope of the invention.
Claims (21)
1. A method for detecting service abnormality is characterized in that the method comprises the following steps:
determining at least one monitoring dimension and at least one service index of a service to be monitored;
determining at least one monitoring path for monitoring service abnormity according to the at least one monitoring dimension; each monitoring path corresponds to one or more combinations of monitoring dimensions in the at least one monitoring dimension;
acquiring a time sequence corresponding to the at least one service index to be monitored aiming at each monitoring path;
performing time sequence anomaly detection on a time sequence corresponding to the at least one service index to be monitored; and
and outputting a service abnormity prompt according to the time sequence abnormity detection result.
2. The method according to claim 1, wherein the determining at least one monitoring path for monitoring the traffic anomaly according to the at least one monitoring dimension comprises:
and performing full-permutation and combination on all monitoring dimensions, and taking the obtained combination as the at least one monitoring path.
3. The method of detecting traffic anomalies according to claim 1, characterized in that said method further comprises: acquiring service data of the service to be monitored;
the obtaining, for each monitoring path, a time sequence corresponding to the at least one service index to be monitored includes:
for each monitoring path, assigning a value to the monitoring dimension combination determined by the monitoring path;
extracting service data which accords with the condition and is related to the at least one service index to be monitored from the service data by taking the assigned monitoring path as the condition; and
and counting the extracted data, and determining a time sequence of the at least one service index to be monitored in a preset time window.
4. The method according to claim 1, wherein the obtaining, for each monitoring path, a time sequence corresponding to the at least one service indicator to be monitored comprises:
sending at least one service data request to a server of a transaction platform, wherein each service data request corresponds to a service index to be monitored and an assigned monitoring path; and
and receiving a time sequence corresponding to the at least one service index to be monitored from a server of the trading platform.
5. The method according to claim 1, wherein the performing the time sequence anomaly detection on the time sequence sequences corresponding to the at least one service index to be monitored respectively comprises:
and respectively carrying out time sequence anomaly detection on the time sequence corresponding to the at least one service index to be monitored by adopting a conservative mixed extreme chemical and biochemical deviation S-H-ESD method to carry out the time sequence anomaly detection.
6. The service anomaly detection method according to claim 5, wherein the statistics of generalized version extreme chemical-biochemical deviation (GESD) are determined by the following formula in the process of respectively performing time sequence anomaly detection on the time sequence corresponding to the at least one service index to be monitored by adopting an S-H-ESD method:
wherein x isiIs the value of the ith sample of the time series;is the median of the sample; s is the average difference of the samples.
7. The method according to claim 1, wherein the service anomaly reminder includes an anomaly value, an anomaly score and a corresponding monitoring path of the at least one service index to be monitored.
8. The method according to claim 1, wherein after obtaining the time sequence corresponding to the at least one service indicator to be monitored, the method further comprises:
and filtering the time sequence according to a preset filtering condition, and deleting the time sequence meeting the filtering condition.
9. A method of detecting anomalies in traffic as claimed in any one of claims 1 to 8, characterized in that said traffic to be monitored comprises a return traffic;
the monitoring dimension includes: one or any combination of an account opening channel, a merchant operation type, a merchant type, an account opening area and an account opening coefficient;
the service indexes to be monitored comprise: one or any combination of the number of newly signed merchants, the percentage of 60 merchants in 3 days, the percentage of returned merchants, the percentage of merchant remaining, and the cost of merchant opening an account.
10. The method according to any one of claims 1 to 8, wherein the traffic to be monitored comprises a merchant admission traffic;
the service indexes to be monitored comprise: applying for the number of admitted merchants.
11. The method according to any one of claims 1 to 8, wherein the service to be monitored comprises an applet patrol service;
the service indexes to be monitored comprise: applet page visit volume and/or applet daily transaction volume.
12. A traffic anomaly detection apparatus, comprising:
the input module is used for determining at least one monitoring dimension and at least one service index to be monitored of the service to be monitored;
the monitoring path generation module is used for determining at least one monitoring path for monitoring abnormal services according to the at least one monitoring dimension; each monitoring path corresponds to one or more combinations of monitoring dimensions in the at least one monitoring dimension;
the time sequence acquisition module is used for acquiring a time sequence corresponding to the at least one service index to be monitored aiming at each monitoring path;
the time sequence anomaly detection module is used for respectively detecting the time sequence anomaly of the time sequence corresponding to the extracted at least one service index to be monitored; and
and the output module is used for outputting service abnormity reminding according to the time sequence abnormity detection result.
13. The traffic anomaly detection apparatus according to claim 12, characterized in that said apparatus further comprises: the data acquisition module is used for acquiring the service data of the service to be monitored; wherein,
the time sequence acquisition module comprises:
the evaluation unit is used for evaluating the monitoring dimension combination determined by the monitoring paths aiming at each monitoring path;
the data extraction unit is used for extracting the service data which accords with the condition and is related to the at least one service index to be monitored from the service data by taking the assigned monitoring path as the condition; and
and the statistical unit is used for performing statistics on the extracted data and determining a time sequence of the at least one service index to be monitored in a preset time window.
14. The apparatus according to claim 12, wherein the time sequence acquiring module comprises:
the transaction platform comprises a request unit, a processing unit and a processing unit, wherein the request unit is used for sending at least one service data request to a server of the transaction platform, and each service data request corresponds to a service index to be monitored and an assigned monitoring path;
and the receiving unit is used for receiving the time sequence corresponding to the at least one service index to be monitored from the server of the trading platform.
15. The device according to claim 12, wherein the monitoring path generating module performs full permutation and combination on all monitoring dimensions, and uses the obtained full permutation and combination as the at least one monitoring path.
16. The apparatus according to claim 12, wherein the timing anomaly detection module performs timing anomaly detection on the extracted timing sequence corresponding to the at least one service index to be monitored by using a conservative mixed extreme chemical and biochemical deviation S-H-ESD method.
17. The service anomaly detection device according to claim 16, wherein the time sequence anomaly detection module determines statistics of generalized chemical extreme biochemical deviation (GESD) by the following formula in the process of respectively performing time sequence anomaly detection on the extracted time sequence corresponding to the at least one service index to be monitored by using an S-H-ESD method:
wherein x isiIs the value of the ith sample of the time series;
is the median of the sample; s is the average difference of the samples.
18. The apparatus according to claim 12, wherein the service abnormality reminder output by the output module includes an abnormal value and an abnormal score of the service indicator and a corresponding monitoring path.
19. The traffic anomaly detection apparatus according to claim 12, characterized in that said apparatus further comprises:
and the filtering module is used for filtering the time sequence corresponding to the at least one service index to be monitored according to a preset filtering condition and deleting the time sequence meeting the filtering condition.
20. A computing device, comprising:
at least one processor;
a memory;
a network communication device;
an input device;
an output device; and
a bus connecting the at least one processor, the memory, the network communication device, the input device, and the output device; wherein,
the at least one processor is configured to execute the memory-stored module of machine-readable instructions to perform the method of traffic anomaly detection according to any one of claims 1 to 8.
21. A computer-readable medium, on which a computer program is stored which, when being executed by a processor, carries out the traffic anomaly detection method according to any one of claims 1 to 8.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201910785006.7A CN110706016A (en) | 2019-08-23 | 2019-08-23 | Method and device for detecting business abnormity and computer readable storage medium |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201910785006.7A CN110706016A (en) | 2019-08-23 | 2019-08-23 | Method and device for detecting business abnormity and computer readable storage medium |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN110706016A true CN110706016A (en) | 2020-01-17 |
Family
ID=69193846
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201910785006.7A Pending CN110706016A (en) | 2019-08-23 | 2019-08-23 | Method and device for detecting business abnormity and computer readable storage medium |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN110706016A (en) |
Cited By (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN111738770A (en) * | 2020-06-28 | 2020-10-02 | 北京达佳互联信息技术有限公司 | Advertisement abnormal flow detection method and device |
| CN112162911A (en) * | 2020-10-14 | 2021-01-01 | 中国民航信息网络股份有限公司 | Abnormal business operation behavior detection method, device, equipment and readable storage medium |
| CN112579907A (en) * | 2020-12-25 | 2021-03-30 | 北京百度网讯科技有限公司 | Abnormal task detection method and device, electronic equipment and storage medium |
| CN112953904A (en) * | 2021-01-27 | 2021-06-11 | 北京达佳互联信息技术有限公司 | Abnormality detection method, abnormality detection device, server, and storage medium |
| CN113220796A (en) * | 2020-01-21 | 2021-08-06 | 北京达佳互联信息技术有限公司 | Abnormal business index analysis method and device |
Citations (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN106095655A (en) * | 2016-05-31 | 2016-11-09 | 北京蓝海讯通科技股份有限公司 | A kind of method for detecting abnormality, application and monitoring device |
| EP3203403A1 (en) * | 2016-02-05 | 2017-08-09 | Sony Corporation | Method, apparatus and system for securing web services |
| CN109035021A (en) * | 2018-07-17 | 2018-12-18 | 阿里巴巴集团控股有限公司 | A kind of monitoring method, device and the equipment of index of trading |
| CN109818942A (en) * | 2019-01-07 | 2019-05-28 | 微梦创科网络科技（中国）有限公司 | A kind of user account number method for detecting abnormality and device based on temporal aspect |
| CN110008080A (en) * | 2018-12-25 | 2019-07-12 | 阿里巴巴集团控股有限公司 | Operational indicator method for detecting abnormality, device and electronic equipment based on time series |
-
2019
- 2019-08-23 CN CN201910785006.7A patent/CN110706016A/en active Pending
Patent Citations (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| EP3203403A1 (en) * | 2016-02-05 | 2017-08-09 | Sony Corporation | Method, apparatus and system for securing web services |
| CN106095655A (en) * | 2016-05-31 | 2016-11-09 | 北京蓝海讯通科技股份有限公司 | A kind of method for detecting abnormality, application and monitoring device |
| CN109035021A (en) * | 2018-07-17 | 2018-12-18 | 阿里巴巴集团控股有限公司 | A kind of monitoring method, device and the equipment of index of trading |
| CN110008080A (en) * | 2018-12-25 | 2019-07-12 | 阿里巴巴集团控股有限公司 | Operational indicator method for detecting abnormality, device and electronic equipment based on time series |
| CN109818942A (en) * | 2019-01-07 | 2019-05-28 | 微梦创科网络科技（中国）有限公司 | A kind of user account number method for detecting abnormality and device based on temporal aspect |
Non-Patent Citations (1)
| Title |
|---|
| 博客园: "《grubbs test》", Retrieved from the Internet <URL:https://www.cnblogs.com/rnanprince/articles/10732471.html> * |
Cited By (9)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN113220796A (en) * | 2020-01-21 | 2021-08-06 | 北京达佳互联信息技术有限公司 | Abnormal business index analysis method and device |
| CN111738770A (en) * | 2020-06-28 | 2020-10-02 | 北京达佳互联信息技术有限公司 | Advertisement abnormal flow detection method and device |
| CN111738770B (en) * | 2020-06-28 | 2023-09-26 | 北京达佳互联信息技术有限公司 | Advertisement abnormal flow detection method and device |
| CN112162911A (en) * | 2020-10-14 | 2021-01-01 | 中国民航信息网络股份有限公司 | Abnormal business operation behavior detection method, device, equipment and readable storage medium |
| CN112162911B (en) * | 2020-10-14 | 2024-03-29 | 中国民航信息网络股份有限公司 | Abnormal business operation behavior detection method, device, equipment and readable storage medium |
| CN112579907A (en) * | 2020-12-25 | 2021-03-30 | 北京百度网讯科技有限公司 | Abnormal task detection method and device, electronic equipment and storage medium |
| CN112579907B (en) * | 2020-12-25 | 2023-08-11 | 北京百度网讯科技有限公司 | Abnormal task detection method and device, electronic equipment and storage medium |
| CN112953904A (en) * | 2021-01-27 | 2021-06-11 | 北京达佳互联信息技术有限公司 | Abnormality detection method, abnormality detection device, server, and storage medium |
| CN112953904B (en) * | 2021-01-27 | 2022-11-18 | 北京达佳互联信息技术有限公司 | Abnormality detection method, abnormality detection device, server, and storage medium |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN110706016A (en) | Method and device for detecting business abnormity and computer readable storage medium | |
| WO2021072887A1 (en) | Abnormal traffic monitoring method and apparatus, and device and storage medium | |
| WO2023056723A1 (en) | Fault diagnosis method and apparatus, and electronic device and storage medium | |
| CN109308225B (en) | Virtual machine abnormality detection method, device, equipment and storage medium | |
| CN110909306B (en) | Business abnormality detection method and device, electronic equipment and storage equipment | |
| CN112801316A (en) | Fault positioning method, system equipment and storage medium based on multi-index data | |
| CN114020971A (en) | Abnormal data detection method and device | |
| CN112801456A (en) | Fund liquidity risk early warning method, device and electronic equipment | |
| CN116701130A (en) | Dynamic baseline optimization method and device based on index portrait and electronic equipment | |
| CN112116401A (en) | Pressure testing method, device, equipment and storage medium | |
| CN112434717B (en) | Model training method and device | |
| CN115221218A (en) | Quality evaluation method and device for vehicle data, computer equipment and storage medium | |
| CN113065234B (en) | Batch reliability risk level assessment method and system for intelligent electric meters | |
| CN115114124A (en) | Host risk assessment method and device | |
| CN114938339B (en) | Data processing method and related device | |
| CN111914591A (en) | Duration determination method and device | |
| CN112988536B (en) | Data anomaly detection method, device, equipment and storage medium | |
| CN114239296A (en) | Data processing method and device and electronic equipment | |
| CN112613755A (en) | Method and device for evaluating enterprise risk by using confidence coefficient and electronic equipment | |
| CN112148764B (en) | Feature screening method, device, equipment and storage medium | |
| CN112116433A (en) | Order attributing method and device | |
| CN113327336A (en) | Method and device for identifying man-vehicle relationship and electronic equipment | |
| Vesely | Quantifying maintenance effects on unavailability and risk using Markov modeling | |
| CN112508745B (en) | Document evaluation method and device | |
| CN112863231B (en) | Method, system and device for calibrating remaining parking spaces of parking lot and storage medium |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| TA01 | Transfer of patent application right | ||
| TA01 | Transfer of patent application right |
Effective date of registration: 20200922 Address after: Cayman Enterprise Centre, 27 Hospital Road, George Town, Grand Cayman Islands Applicant after: Innovative advanced technology Co.,Ltd. Address before: Cayman Enterprise Centre, 27 Hospital Road, George Town, Grand Cayman Islands Applicant before: Advanced innovation technology Co.,Ltd. Effective date of registration: 20200922 Address after: Cayman Enterprise Centre, 27 Hospital Road, George Town, Grand Cayman Islands Applicant after: Advanced innovation technology Co.,Ltd. Address before: A four-storey 847 mailbox in Grand Cayman Capital Building, British Cayman Islands Applicant before: Alibaba Group Holding Ltd. |
|
| RJ01 | Rejection of invention patent application after publication |
Application publication date: 20200117 |