CN115437870A - Method, device, computer equipment and storage medium for monitoring business process data - Google Patents

Abstract

This application relates to the field of business anomaly monitoring, and discloses a business process data monitoring method, device, computer equipment, and storage medium, wherein the method includes: obtaining log data of each business system; screening the log data to obtain abnormal Data, the abnormal data is the data of the abnormal situation in the business system, the abnormal data includes the ID number of the user; according to the ID number, the call chain of the user is called, and tracked according to the call chain, Find out the business system called by the user; check each business system one by one according to the operation time sequence of the business system called by the user to find the problem system; analyze the operation behavior and the problem according to the preset analysis strategy The system analyzes to obtain abnormal events, and takes corresponding remedial measures for the abnormal events according to the analysis strategy. This application can output and improve the monitoring and processing efficiency of exceptions in the business system.

Description

Monitoring method, device, computer equipment and storage medium for business process data

technical field

The present application relates to the field of business anomaly monitoring, in particular to a method, device, computer equipment and storage medium for monitoring business process data.

Background technique

In the existing technology, the business of the securities industry can be completed by the customer calling the corresponding system. For example, the customer places an order to buy stocks, places an order from the front end, passes through multiple middle and background core systems, and finally submits it to the exchange, and the exchange returns After the result, return the feedback information according to the original channel and display it on the front end of the client. This process needs to call multiple systems such as the transaction system for transaction operations, the account system for managing customer information, etc., and as long as one of the systems appears Abnormal, the whole process is difficult to complete, but the risk monitoring of the current business system is relatively scattered and incomplete. Usually, the customer finds the problem and reports it, and manually analyzes and handles the problem. The timeliness of disposal is low, and the handling of abnormalities is not comprehensive ,low efficiency.

Contents of the invention

The main purpose of this application is to provide a monitoring method, device, computer equipment and storage medium for business process data, aiming to solve the problem of incomplete and inefficient handling of exceptions in current securities business processes.

In order to achieve the purpose of the above invention, this application proposes a monitoring method for business process data, including:

Obtain the log data of each business system;

Screening the log data to obtain abnormal data, the abnormal data is the data of the abnormal situation in the business system, and the abnormal data includes the ID number of the user who caused the abnormal situation;

Retrieve the call chain of the user according to the ID number, and track according to the call chain, so as to find out the business system called by the user from each of the business systems; wherein, the call chain is the user in turn Call the information flow of each business system;

Investigate each of the business systems one by one according to the order of operation time when the user invokes the business system to find out the problem system, and the problem system is a system that is abnormal when the user performs an operation behavior;

Analyzing the operational behavior and the problematic system according to a preset analysis strategy to obtain abnormal events, and taking corresponding remedial measures for the abnormal events according to the analysis strategy.

Further, after acquiring the log data of each business system, it also includes:

Carrying out logical verification and character rule verification on the log data to clean the log data;

Dividing the cleaned log data into real-time operation data and historical operation data from the time dimension;

Dividing the cleaned log data into operation type data of different classifications from the type dimension;

the ID of the user who obtained the log data;

Taking the user ID as the main body, the real-time operation data, historical operation data, and operation type data are associated and merged to obtain optimized log data.

Further, the abnormal data includes first abnormal data, second abnormal data and third abnormal data; the filtering of the log data to obtain abnormal data includes:

Examining the log data by matching preset keywords to filter out the first abnormal data;

extracting the operating frequency data at a first preset position from the remaining data after filtering out the first abnormal data, and judging whether the operating frequency data exceeds a preset value;

If yes, then determine that the data corresponding to the first preset position is the second abnormal data;

extracting a field at a second preset position from the remaining data after filtering out the second abnormal data, and judging whether the field is a preset field;

If so, it is determined that the data corresponding to the second preset position is the third abnormal data.

Further, the analysis of the operation behavior and the problematic system according to the preset analysis strategy, after obtaining the abnormal event, further includes:

Performing a security audit on the abnormal event to obtain the security level of the abnormal event;

The abnormal event is sent to the person in charge designated by the security level through a preset notification method.

Further, before acquiring the log data of each business system, it also includes:

Obtain user input information;

The service system to be called is obtained according to the input information.

Further, before calling the call chain of the user according to the ID number, it also includes:

When the called business system is a designated business system, a connection pool is established in the designated business system, and the ID number and the operation time points of sequentially calling the designated business system are used as nodes, and calls are generated according to the nodes chain;

When the called business system is not a designated business system, the operation time point of the called business system is used as a node, and each node is associated to generate a call chain.

Further, the calling the user's call chain according to the ID number, and tracking according to the call chain, so as to find out the service system called by the user from each of the service systems, includes:

According to the association sequence of the nodes of the call chain, sequentially determine whether the business system is a designated business system;

If so, search the service system invoked by the user from each of the service systems according to the ID number of the user and the operation time point;

If not, search for the service system invoked by the user from each of the service systems according to the operation time point of the previous node and the operation time point of the next node in the association sequence.

The present application also provides a monitoring device for business process data, including:

Data acquisition module: used to acquire log data of each business system;

Data screening module: used to filter the log data to obtain abnormal data, the abnormal data is the data of the abnormal situation in the business system, and the abnormal data includes the ID number of the user who caused the abnormal situation;

Data tracking module: used to call the call chain of the user according to the ID number, and track according to the call chain, so as to find out the business system called by the user from each of the business systems; wherein, the The call chain described above is for the user to call the information flow of each business system in turn;

Abnormal troubleshooting module: used to check each of the business systems one by one according to the operation time sequence of the user calling the business system to find out the problem system, and the problem system is a system that appears abnormal when the user performs an operation behavior;

Abnormality processing module: used to analyze the operation behavior and the problematic system according to the preset analysis strategy, obtain the abnormal event, and take corresponding remedial measures for the abnormal event according to the analysis strategy.

The present application also provides a computer device, including a memory and a processor, the memory stores a computer program, and the processor implements the steps of any one of the methods for monitoring business process data described above when executing the computer program.

The present application also provides a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, the steps of the method for monitoring business process data described in any one of the above items are implemented.

This application example provides a monitoring method for the business process data of the securities IT system, by obtaining the log data of each business system, screening the log data to obtain abnormal data, and obtaining the ID number of the user in the abnormal data , find the call chain of the user through the ID number, call the call chain of the user according to the ID number, and track according to the call chain, so as to find out the service of the user from each of the business systems System, check each of the business systems one by one to find out the problem system, analyze the operation behavior of the user and the problem system according to the preset analysis strategy, obtain abnormal events, and analyze the problem according to the analysis strategy Take corresponding remedial measures for the abnormal event, monitor the abnormal situation in each business system of the securities business process and deal with the abnormal situation, so as to realize the pre-warning, in-event monitoring, and post-event audit of the abnormal event. In the process, full-link monitoring is realized, abnormal problems are quickly resolved, and the efficiency of business process exception resolution is improved.

Description of drawings

Fig. 1 is a schematic flow diagram of an embodiment of the method for monitoring business process data of the present application;

FIG. 2 is a schematic flow diagram of another embodiment of the method for monitoring business process data of the present application;

FIG. 3 is a schematic structural diagram of an embodiment of a monitoring device for business process data of the present application;

Fig. 4 is a schematic block diagram of an embodiment of the computer equipment of the present application.

The realization, functional features and advantages of the present application will be further described in conjunction with the embodiments and with reference to the accompanying drawings.

detailed description

In order to make the purpose, technical solution and advantages of the present application clearer, the present application will be further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described here are only used to explain the present application, and are not intended to limit the present application.

Referring to FIG. 1 , an embodiment of the present application provides a method for monitoring business process data, including steps S10-S50. The steps of the method for monitoring business process data are described in detail as follows.

S10. Obtain log data of each business system.

This embodiment is applied to an electronic data system with several business systems. The electronic data system includes several business systems and each business system may also include several sub-business systems. For example, the electronic data system is a securities The industry's electronic data system is used to monitor and deal with abnormal situations in various business systems of the securities business process, so as to realize pre-warning, in-process monitoring, and post-event audit of abnormal events that occur or may occur in various business systems. In the process of users calling various business systems, full-link monitoring is realized to quickly solve abnormal problems. The business systems include trading systems, account systems, etc. Upload user information, etc. In this embodiment, each business system is monitored in real time, and a large amount of log data of each business system is obtained, and the log data includes user information, user call information, system operation information, and the like. Further, the log data is packaged and stored through the blockchain technology, and after the log data is packaged and stored through the blockchain technology, the log data can be deeply traced to the source, and the information generated by each business system can be completely queried. log data each time.

S20. Filter the log data to obtain abnormal data, the abnormal data is the data of the abnormal situation in the business system, and the abnormal data includes the ID number of the user who caused the abnormal situation.

In this embodiment, since the acquired log data of each business system has a large amount of information, it is necessary to filter the data in the log data to filter out abnormal data. When filtering log data, the log data can be cleaned, optimized, modeled and classified first. In one embodiment, the data generated when the business system is running normally can be determined due to the uncertainty of the data generated when the business system is abnormal. Therefore, the normal data is filtered by configuring regular expressions. When the log data When the regular expression is satisfied, the log data is determined to be normal data, and then data in the log data other than the normal data is determined to be abnormal data. Filter out the abnormal data by filtering the log data. The abnormal data is the data of the abnormal situation in the business system. If the generated log data cannot meet the filtering conditions of normal data, it is determined as abnormal data. Further, the abnormal data includes the ID number of the user who caused the abnormal situation, and the log data generated by each business system has the ID number of the user, and the ID number is the unique identification of the user in the business system. number to identify each distinct user.

S30. Retrieve the call chain of the user according to the ID number, and trace according to the call chain, so as to find out the service system called by the user from each of the service systems; wherein, the call chain is The user calls the information flow of each business system in turn.

In this embodiment, after obtaining the ID number of the user in the abnormal data, the call chain of the user is found through the ID number. The called business system establishes association information with the identification, packs them into blocks according to the identification and each called business system, and links them into a block chain to obtain a call chain; the call chain is for the user to call each The information flow of the business system, the information flow includes the calling time of the business system, the calling interface, the function input, the function output and other information, and then trace according to the call chain, that is, find the user from the above business system according to the call chain The business system called, so as to obtain the various business systems called by the user when operating the securities business process.

S40. Check each of the business systems one by one according to the operation time sequence of the user invoking the business systems to find out the problematic system, and the problematic system is a system in which an abnormality occurs when the user performs an operation behavior.

In this embodiment, after finding out the business system used by the user to operate the securities business process according to the ID number, the abnormal node can be found through the call chain, that is, the abnormal node can be found out during the user operation. The abnormal problem system checks each of the business systems one by one according to the user's operation time sequence, forms an operation chain for the user's operation on each business system, and then checks the business systems in turn according to the abnormal data to obtain the problem system, the problematic system is a system in which abnormalities occur during user operations. In one application scenario, the user can complete the operation process of the entire securities business, that is, the system runs through the entire call chain, but there will be abnormal situations, such as excessive order frequency resulting in abnormal data. At this time, according to the abnormal data Check each business system in order to determine the abnormal problem system; in another application scenario, the user did not complete the entire correct business operation process, for example, only staying in a certain system and an exception occurred. The node is abnormal and cannot enter a node, that is, the entire call chain has not been run. At this time, the business system corresponding to the node where it stays is the problem system.

S50. Analyze the operation behavior and the problematic system according to a preset analysis strategy to obtain an abnormal event, and take corresponding remedial measures for the abnormal event according to the analysis strategy.

In this embodiment, after the problematic system and the user's operation behavior on the problematic system are found, the user's operation behavior and the problematic system are analyzed according to the preset analysis strategy to obtain abnormal events, and according to the The above analysis strategy takes corresponding remedial measures for the abnormal event. The analysis strategy includes obtaining the log information of the problematic system and the user's operation behavior information. The operation behavior information includes the user's historical operation behavior information and current operation behavior information, such as ordering operations, query operations, complaint operations, uploading information, etc. Then analyze corresponding abnormal events according to the log information and operation behavior information, and then take remedial measures for the abnormal events. For example, abnormal events can be "the user's order frequency is too high per unit time", "the user agreement has not been signed", etc. The above analysis strategy is jointly formulated by business experts and technical experts, and a large amount of data is collected for different types of business and Develop corresponding analysis strategies for the corresponding risk points. For example, if the order frequency is too high to limit the flow, due to the huge amount of log data, the above method can quickly filter out the abnormal data that appears in the securities business process, and then determine the abnormal event corresponding to the abnormal data, so that according to the abnormal event Take targeted measures.

This embodiment provides a method for monitoring the business process data of a securities IT system, by obtaining the log data of each business system, screening the log data to obtain abnormal data, and obtaining the ID number of the user in the abnormal data , find the call chain of the user through the ID number, call the call chain of the user according to the ID number, and track according to the call chain, so as to find out the service of the user from each of the business systems System, check each of the business systems one by one to find out the problem system, analyze the operation behavior of the user and the problem system according to the preset analysis strategy, obtain abnormal events, and analyze the problem according to the analysis strategy Take corresponding remedial measures for the abnormal event, monitor the abnormal situation in each business system of the securities business process and deal with the abnormal situation, so as to realize the pre-warning, in-event monitoring, and post-event audit of the abnormal event. In the process, full-link monitoring is realized, abnormal problems are quickly resolved, and the efficiency of business process exception resolution is improved.

In one application scenario, a customer trades stocks on the Science and Technology Innovation Board on the APP, and finds that an error has been reported and cannot place an order. At this time, an exception is detected through monitoring, and the corresponding call chain is found through the corresponding customer number of the customer, and then the entire call is checked. It is found that the customer's order information only stays in the trading system, that is, the problematic system is found, and then the corresponding abnormal events are analyzed based on the problematic system and user operation behavior information. For example, checking whether the customer has an agreement in the trading system and finding that the customer has no agreement, It will further trace to the account system to check whether the customer has signed the agreement, whether the video and voice are kept on file, etc. If the inspection results meet the requirements, it means that the customer has signed the agreement, and there is a problem with the account system and transaction system data. Return to the account The system and the trading system continue to eliminate the cause. If the result of the check is whether the customer has signed the agreement, the abnormal event is "the customer has not signed the agreement". At this time, corresponding remedial measures can be taken, that is, a solution is given, and the customer Synchronize the protocol information to the trading system.

In one embodiment, as shown in Figure 2, after obtaining the log data of each business system, it also includes:

S11: Perform logic verification and character rule verification on the log data, so as to clean the log data;

S12: Divide the cleaned log data into real-time operation data and historical operation data from the time dimension;

S13: Divide the cleaned log data into operation type data of different classifications from the type dimension;

S14: The ID of the user who acquires the log data;

S15: Taking the ID of the user as the main body, correlating and merging the real-time operation data, historical operation data, and operation type data to obtain optimized log data.

In this embodiment, since there is a large amount of redundant information in the log data, after the log data of each business system is obtained, the log data is logically checked to eliminate unnecessary fields in the log data or to correct any occurrences in the log data. Wrong fields, and then filter and check the character rules, match and compare through the preset character format, eliminate the wrong data that does not conform to the rules, and complete the cleaning of the log data. Further, the cleaned log data can be optimized, and the cleaned log data can be divided into real-time operation data and historical operation data from the time dimension. The real-time operation data is the data of the current user operating the system, and the historical operation data It is the data that users have operated on the system in history. From the type dimension, the log data after cleaning is divided into different types of operation type data. The operation type includes transaction and other types, and then the ID of the user who obtained the log data, The real-time operation data, historical operation data, and operation type data are associated and merged to obtain optimized log data. In this way, by classifying the log data of each business system and performing data fusion with the user ID as the main body, it can be Subsequent queries provide more convenient conditions and improve the query efficiency of log data.

In one embodiment, the abnormal data includes first abnormal data, second abnormal data and third abnormal data; the filtering of the log data to obtain abnormal data includes:

Examining the log data by matching preset keywords to filter out the first abnormal data;

extracting the operating frequency data at a first preset position from the remaining data after filtering out the first abnormal data, and judging whether the operating frequency data exceeds a preset value;

If yes, then determine that the data corresponding to the first preset position is the second abnormal data;

extracting a field at a second preset position from the remaining data after filtering out the second abnormal data, and judging whether the field is a preset field;

If so, it is determined that the data corresponding to the second preset position is the third abnormal data.

In this embodiment, for the IT system of the securities business process, the abnormal data includes the first abnormal data or/and the second abnormal data or/and the third abnormal data, and the first abnormal data, the second abnormal data are screened out in the following manner abnormal data and third abnormal data. Firstly, the log data is checked by matching with the preset keywords, and the first abnormal data is screened out, such as data with keywords such as "error report" and "abnormality", then the corresponding abnormal data can be directly initially screened out; After the remaining data, abnormal data can be further screened out by judging whether the preset conditions are met. Specifically, the operating frequency data at the first preset position is extracted from the remaining data after the first abnormal data is screened out, and the judgment is made. Whether the operation frequency data exceeds the preset value, for example, abnormal order data, the user’s normal order frequency is 10 times per unit time, but the operation data that appears is 20 times per unit time, that is, the operation frequency data exceeds For the preset value, it can be determined that the data corresponding to the first preset position is the second abnormal data; further, the field of the second preset position is extracted from the remaining data after filtering out the second abnormal data, Judging whether the field is a preset field, if so, then judging that the data corresponding to the second preset position is the third abnormal data, for example, the data of the second preset position is reset to zero, and the field is empty, indicating that the system has Abnormal. At this time, it can be determined that the data at the second preset position is the third abnormal data. In this way, the abnormal data is screened out through the above steps, so that the cause of the abnormality can be analyzed based on the above abnormal data, and the analysis efficiency of abnormal data can be improved.

In one embodiment, the analysis of the operation behavior and the problematic system according to the preset analysis strategy, after obtaining the abnormal event, further includes:

Performing a security audit on the abnormal event to obtain the security level of the abnormal event;

The abnormal event is sent to the person in charge designated by the security level through a preset notification method.

In this embodiment, the operation behavior of the user and the problematic system are analyzed according to the preset analysis strategy, and after the abnormal event is obtained, a security audit is performed on the abnormal event to determine the impact of the abnormal event, including The abnormal event is an abnormal opinion caused by the user or an individual abnormal event or an overall abnormal event, so as to obtain the security level of the abnormal event, and then send the abnormal event to the specified security level through the preset notification method. The person in charge, the handling of different abnormal events needs to notify the person in charge designated by different security levels, inform the person in charge that there is an abnormal risk in the current correct business process, and improve the feedback efficiency of system abnormalities.

In another embodiment, after obtaining the abnormal event, further verify the identity of the customer, including obtaining the image information and voice information reserved by the user, and then verify the identity of the customer through voice recognition, semantic recognition, and image recognition technologies to ensure that the customer The identity of the customer is correct to ensure the security of the business system used by the customer.

In one embodiment, before obtaining the log data of each business system, it also includes:

Obtain user input information;

The service system to be called is obtained according to the input information.

In this embodiment, different users have different scopes of business systems due to different permissions. Before obtaining the log data of each business system, the user's input information is obtained, and the business that needs to be called is obtained according to the input information. system, so as to determine all the business systems that the user can use under the current input information. When obtaining the log data later, it is only necessary to obtain the data of the business systems that are called, and the business systems that cannot be called do not need to be queried Search its database to improve the efficiency of log data acquisition and resource utilization.

In one embodiment, before calling the user's call chain according to the ID number, it further includes:

When the called business system is a designated business system, a connection pool is established in the designated business system, and the ID number and the operation time points of sequentially calling the designated business system are used as nodes, and calls are generated according to the nodes chain;

When the called business system is not a designated business system, the operation time point of the called business system is used as a node, and each node is associated to generate a call chain.

In this embodiment, before calling the user's call chain, different call chains are generated according to the business system called by the user. When the called business system is a designated business system, a connection pool is established in the designated business system , and use the ID number and the operation time point of invoking the specified business system as nodes, and generate a call chain based on the nodes, for example, if the called business system provides a controllable system for research and development, then it will be established in the specified business system Connection pool, and put the key of the node of the call chain into the connection pool with the ID number of the user and the operation time point of calling the specified business system, and then according to the node, a call chain for the user to call the specified business system can be generated; when the If the called business system is not a designated business system, the operation time point of the called business system is used as a node, and each node is associated to generate a call chain. For example, if it is an uncontrollable system provided by a customer or supplier, the call The operating time point of the business system is used as a node, and then each node corresponding to each calling system is associated to establish the user's information flow, thereby obtaining the calling chain. That is, the call chain is an information flow in which the user calls each service system in turn, wherein each service system corresponds to a node of the call chain.

In one embodiment, the calling chain of the user is called according to the ID number, and tracking is carried out according to the chain, so as to find out the business system called by the user from each business system, including :

According to the association sequence of the nodes of the call chain, sequentially determine whether the business system is a designated business system;

If so, search the service system invoked by the user from each of the service systems according to the ID number of the user and the operation time point;

If not, search for the service system invoked by the user from each of the service systems according to the operation time point of the previous node and the operation time point of the next node in the association sequence.

In this embodiment, the calling chain corresponding to the user is retrieved according to the ID number, that is, which business systems the user has called through the calling chain, because individual business systems are not controllable systems provided by enterprise research and development, but external docking systems, for example For stock trading, if it needs to be reported to the exchange, it needs to be connected to the system of the exchange. Then this system is an uncontrollable system connected to the outside world. It cannot store the customer's customer number when calling, so according to the node of the call chain According to the associated sequence, determine whether the business system is a designated business system in turn, if so, you can directly search for the user’s business system from each business system based on the user’s ID number and operation time point; if not, you cannot use the ID number to find the user’s business system Inquiry, at this time, can be searched through the operation time point, according to the operation time point of the previous node of the current node in the association sequence and the operation time point of the next node, the user's business system is searched from each of the business systems, so that It no longer restricts whether the business system is an external system or an internal system, and improves the extensiveness of the monitoring and application of securities business processes.

Referring to Figure 3, the present application also provides a monitoring device for business process data, including:

Data acquisition module 10: used to acquire log data of each business system;

Data screening module 20: used to filter the log data to obtain abnormal data, the abnormal data is the data of the abnormal situation in the business system, and the abnormal data includes the ID number of the user who caused the abnormal situation ;

Data tracking module 30: used to call the call chain of the user according to the ID number, and track according to the call chain, so as to find out the business system called by the user from each of the business systems; wherein, The call chain is the information flow of each business system called by the user in turn;

Abnormality checking module 40: used to check each of the business systems one by one according to the operation time sequence of the user calling the business system, to find out the problem system, and the problem system is a system where an exception occurs when the user performs an operation behavior;

Abnormality processing module 50: used to analyze the operation behavior and the problematic system according to the preset analysis strategy, obtain the abnormal event, and take corresponding remedial measures for the abnormal event according to the analysis strategy.

As mentioned above, it can be understood that each component of the device for monitoring business process data proposed in this application can realize the function of any one of the methods for monitoring business process data described above.

Referring to FIG. 4 , an embodiment of the present application further provides a computer device, which may be a mobile terminal, and its internal structure may be as shown in FIG. 4 . The computer equipment includes a processor, a memory, a network interface, and a display device and an input device connected through a system bus. Wherein, the network interface of the computer device is used to communicate with external terminals through a network connection. The input device of the computer equipment is used for receiving user's input. The computer is designed with a processor to provide computing and control capabilities. The memory of the computer device includes storage media. The storage medium stores business systems, computer programs and databases. The database of the computer device is used to store data. When the computer program is executed by the processor, a method for monitoring business process data is realized.

The processor executes the above-mentioned monitoring method of business process data, including: obtaining log data of each business system; screening the log data to obtain abnormal data, and the abnormal data is data of abnormal situations in the business systems , the abnormal data includes the ID number of the user who caused the abnormal situation; according to the ID number, the call chain of the user is called, and traced according to the call chain, to find out from each of the business systems The business system invoked by the user; wherein, the invocation chain is the information flow of the user invoking each business system in turn; each of the business systems is checked one by one according to the operation time sequence of the user invoking the business system to find out the problem system, the problematic system is a system in which abnormality occurs when the user performs an operation behavior; analyze the operation behavior and the problematic system according to a preset analysis strategy, obtain abnormal events, and analyze the abnormality according to the analysis strategy The event takes appropriate remedial action.

The computer equipment provides a method for monitoring the business process data of the securities IT system, by obtaining the log data of each business system, screening the log data to obtain abnormal data, and obtaining the ID of the user in the abnormal data number, find the user's call chain through the ID number, call the user's call chain according to the ID number, and track according to the call chain, so as to find out the user's call chain from each of the business systems Business system, check each of the business systems one by one to find out the problem system, analyze the operation behavior of the user and the problem system according to the preset analysis strategy, obtain abnormal events, and according to the analysis strategy Take corresponding remedial measures for the abnormal events, monitor the abnormal situations in each business system of the securities business process and deal with the abnormal situations, so as to realize pre-warning, in-process monitoring, and post-event audit of abnormal events. In the process, realize full-link monitoring, quickly solve abnormal problems, and improve the efficiency of solving business process exceptions.

An embodiment of the present application also provides a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by the processor, a method for monitoring business process data is implemented, including the steps of: obtaining log data; filter the log data to obtain abnormal data, the abnormal data is the data of the abnormal situation in the business system, and the abnormal data includes the ID number of the user who caused the abnormal situation; according to the The ID number calls the call chain of the user, and traces according to the call chain, so as to find out the business system called by the user from each of the business systems; wherein, the call chain is for the user to call each The information flow of the business system; check each of the business systems one by one according to the operation time sequence of the user calling the business system to find out the problem system, and the problem system is the system where the user operates abnormally; The established analysis strategy analyzes the operation behavior and the problematic system to obtain abnormal events, and takes corresponding remedial measures for the abnormal events according to the analysis strategy.

The computer-readable storage medium provides a method for monitoring the business process data of the securities IT system, by obtaining the log data of each business system, the log data is screened to obtain abnormal data, and the The ID number of the user, find the call chain of the user through the ID number, call the call chain of the user according to the ID number, and track the call chain according to the call chain, so as to find out the call chain of the user from each of the business systems According to the business system of the user mentioned above, each business system is checked one by one to find out the problem system, and the operation behavior of the user and the problem system are analyzed according to the preset analysis strategy to obtain abnormal events, and according to the The above-mentioned analysis strategy takes corresponding remedial measures for the abnormal events, monitors the abnormal situations in each business system of the securities business process and handles the abnormal situations, so as to realize pre-warning, in-process monitoring, and post-event audit of abnormal events. In the process of each business system, realize full-link monitoring, quickly solve abnormal problems, and improve the efficiency of solving abnormal business processes.

Those of ordinary skill in the art can understand that all or part of the processes in the methods of the above embodiments can be implemented through computer programs to instruct related hardware, and the computer programs can be stored in a non-volatile computer-readable memory In the medium, when the computer program is executed, it may include the processes of the embodiments of the above-mentioned methods.

Any reference to memory, storage, database or other media provided herein and used in the examples may include non-volatile and/or volatile memory.

Nonvolatile memory can include read only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in various forms such as Static RAM (SRAM), Dynamic RAM (DRAM), Synchronous DRAM (SDRAM), Double Data Rate SDRAM (SSRSDRAM), Enhanced SDRAM (ESDRAM), Synchronous Link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

It should be noted that, in this document, the term "comprising", "comprising" or any other variation thereof is intended to cover a non-exclusive inclusion such that a process, apparatus, article or method comprising a set of elements includes not only those elements, It also includes other elements not expressly listed, or elements inherent in the process, apparatus, article, or method. Without further limitations, an element defined by the phrase "comprising a ..." does not preclude the presence of additional same elements in the process, apparatus, article or method comprising the element.

The above descriptions are only preferred embodiments of the present application, and are not intended to limit the patent scope of the present application.

Any equivalent structure or equivalent process transformation made by using the contents of the specification and drawings of this application, or directly or indirectly used in other related technical fields, is also included in the scope of patent protection of this application.

Claims (10)

1. A method for monitoring business process data, comprising: Obtain the log data of each business system; Screening the log data to obtain abnormal data, the abnormal data is the data of the abnormal situation in the business system, and the abnormal data includes the ID number of the user who caused the abnormal situation; Retrieve the call chain of the user according to the ID number, and track according to the call chain, so as to find out the business system called by the user from each of the business systems; wherein, the call chain is the user in turn Call the information flow of each business system; Investigate each of the business systems one by one according to the order of operation time when the user invokes the business system to find out the problem system, and the problem system is a system that is abnormal when the user performs an operation behavior; Analyzing the operational behavior and the problematic system according to a preset analysis strategy to obtain abnormal events, and taking corresponding remedial measures for the abnormal events according to the analysis strategy. 2. The monitoring method of business process data according to claim 1, characterized in that, after acquiring the log data of each business system, further comprising: Carrying out logical verification and character rule verification on the log data to clean the log data; Dividing the cleaned log data into real-time operation data and historical operation data from the time dimension; Dividing the cleaned log data into operation type data of different classifications from the type dimension; the ID of the user who obtained the log data; Taking the user ID as the main body, the real-time operation data, historical operation data, and operation type data are associated and merged to obtain optimized log data. 3. The monitoring method of business process data according to claim 1, wherein the abnormal data includes first abnormal data, second abnormal data, and third abnormal data; the filtering of the log data, to get exception data, including: Examining the log data by matching preset keywords to filter out the first abnormal data; extracting the operating frequency data at a first preset position from the remaining data after filtering out the first abnormal data, and judging whether the operating frequency data exceeds a preset value; If yes, then determine that the data corresponding to the first preset position is the second abnormal data; extracting a field at a second preset position from the remaining data after filtering out the second abnormal data, and judging whether the field is a preset field; If so, it is determined that the data corresponding to the second preset position is the third abnormal data. 4. The monitoring method of business process data according to claim 1, characterized in that, analyzing the operation behavior and the problematic system according to the preset analysis strategy, and after obtaining the abnormal event, further comprising: Performing a security audit on the abnormal event to obtain the security level of the abnormal event; The abnormal event is sent to the person in charge designated by the security level through a preset notification method. 5. The monitoring method of business process data according to claim 1, characterized in that, before acquiring the log data of each business system, further comprising: Obtain user input information; The service system to be called is obtained according to the input information. 6. The monitoring method of business process data according to claim 5, characterized in that, before calling the call chain of the user according to the ID number, further comprising: When the called business system is a designated business system, a connection pool is established in the designated business system, and the ID number and the operation time points of sequentially calling the designated business system are used as nodes, and calls are generated according to the nodes chain; When the called business system is not a designated business system, the operation time point of the called business system is used as a node, and each node is associated to generate a call chain. 7. The monitoring method of business process data according to claim 6, characterized in that, the calling chain of the user is called according to the ID number, and tracking is carried out according to the calling chain, so as to obtain from each of the Find out the business system invoked by the user in the business system, including: According to the association sequence of the nodes of the call chain, sequentially determine whether the business system is a designated business system; If so, search the service system invoked by the user from each of the service systems according to the ID number of the user and the operation time point; If not, search for the service system invoked by the user from each of the service systems according to the operation time point of the previous node and the operation time point of the next node in the association sequence. 8. A monitoring device for business process data, comprising: Data acquisition module: used to acquire log data of each business system; Data screening module: used to filter the log data to obtain abnormal data, the abnormal data is the data of the abnormal situation in the business system, and the abnormal data includes the ID number of the user who caused the abnormal situation; Data tracking module: used to call the call chain of the user according to the ID number, and track according to the call chain, so as to find out the business system called by the user from each of the business systems; wherein, the The call chain described above is the information flow of each business system called by the user in turn; Abnormal troubleshooting module: used to check each of the business systems one by one according to the operation time sequence of the user calling the business system to find out the problem system, and the problem system is a system that appears abnormal when the user performs an operation behavior; Abnormality processing module: used to analyze the operation behavior and the problematic system according to the preset analysis strategy, obtain the abnormal event, and take corresponding remedial measures for the abnormal event according to the analysis strategy. 9. A computer device, comprising a memory and a processor, the memory stores a computer program, wherein the processor implements the business process data according to any one of claims 1 to 7 when executing the computer program The steps of the monitoring method. 10. A computer-readable storage medium, on which a computer program is stored, characterized in that, when the computer program is executed by a processor, the steps of the method for monitoring business process data according to any one of claims 1 to 7 are realized .

Images