CN115564450B

CN115564450B - Wind control method, device, storage medium and equipment

Info

Publication number: CN115564450B
Application number: CN202211556873.1A
Authority: CN
Inventors: 赵闻飙; 彭凤超; 刘腾飞; 徐恪; 李琦
Original assignee: Alipay Hangzhou Information Technology Co Ltd
Current assignee: Alipay Hangzhou Information Technology Co Ltd
Priority date: 2022-12-06
Filing date: 2022-12-06
Publication date: 2023-03-10
Anticipated expiration: 2042-12-06
Also published as: CN115564450A

Abstract

The specification discloses a wind control method, a wind control device, a storage medium and equipment, which are used for clustering abnormal services according to service data of the abnormal services to obtain each service cluster and typical services corresponding to each service cluster. For each typical service, according to the service data of the typical service, determining the reason of the typical service identified as abnormal through the interpretation model. And determining the reason for identifying the residual abnormal service as the abnormal service according to the similarity between the residual abnormal service and each typical service and the reason for identifying each typical service as the abnormal service, so as to execute the wind control service according to the reason for identifying each abnormal service as the abnormal service. Typical services used for inputting the interpretation model can be determined through clustering, the reasons of other abnormal services identified as abnormal services are determined based on the reasons of the typical services output by the model identified as the abnormal services, the data volume of the input model is reduced, the time consumed by model calculation is reduced, and the efficiency of determining the reasons is improved so as to improve the wind control efficiency.

Description

Wind control method, device, storage medium and equipment

Technical Field

The present disclosure relates to the field of wind control technologies, and in particular, to a wind control method, a wind control apparatus, a storage medium, and a device.

Background

At present, users pay more and more attention to private data. Anomaly detection is one of the common wind control methods. Through anomaly detection, whether the service is abnormal or not can be identified.

However, only the classification result of whether the traffic is abnormal or not can be obtained by the abnormality detection, and the cause of the abnormal traffic identified as abnormal cannot be obtained. And the risk of a business is reasonably evaluated, and the corresponding reason is usually required to be referred to. Therefore, at present, after the abnormal service is determined by the abnormal detection model, the reason why the abnormal service is identified as abnormal needs to be determined.

However, the existing method for determining the reason that the abnormal service is identified as the abnormal service has the problems of low efficiency and low wind control efficiency.

Disclosure of Invention

The present specification provides a method, apparatus, storage medium, and device for wind control to at least partially solve the above problems.

The technical scheme adopted by the specification is as follows:

the present specification provides a wind control method, including:

determining the service data of each abnormal service;

clustering the abnormal services according to the service data to obtain each service cluster and a clustering center corresponding to each service cluster, and respectively determining typical services of each service cluster according to the clustering center of each service cluster;

for each typical service, determining the reason why the typical service is identified as abnormal service through an interpretation model according to the service data of the typical service;

determining the reason for identifying the residual abnormal service as the abnormal service according to the similarity between the residual abnormal service and each typical service and the reason for identifying each typical service as the abnormal service;

and executing the wind control service according to the reason that each abnormal service is identified as the abnormal service.

This specification provides a wind-control device, including:

the determining module is used for determining the service data of each abnormal service;

the clustering module is used for clustering the abnormal services according to the service data to obtain each service cluster and a clustering center corresponding to each service cluster respectively, and determining typical services of each service cluster respectively according to the clustering centers of each service cluster;

the reason determining module is used for determining the reason that the typical service is identified as the abnormal service according to the service data of the typical service through an explanation model aiming at each typical service;

the reason propagation module is used for determining the reason that the residual abnormal service is identified as the abnormal service according to the similarity between the residual abnormal service and each typical service and the reason that each typical service is identified as the abnormal service;

and the wind control module is used for executing the wind control service according to the reason that each abnormal service is identified as the abnormal service.

The present specification provides a computer-readable storage medium storing a computer program which, when executed by a processor, implements the above-described wind control method.

The present specification provides an electronic device comprising a memory, a processor and a computer program stored on the memory and executable on the processor, the processor implementing the above-described wind control method when executing the program.

The technical scheme adopted by the specification can achieve the following beneficial effects:

in the wind control method, each abnormal service is clustered according to the service data of the abnormal service, so that each service cluster and the typical service corresponding to each service cluster are obtained. And determining the reason of the typical service identified as the abnormity through the interpretation model according to the service data of the typical service for each typical service. And determining the reason for identifying the remaining abnormal service as the abnormal service according to the similarity between the remaining abnormal service and each typical service and the reason for identifying each typical service as the abnormal service, so as to execute the wind control service according to the reason for identifying each abnormal service as the abnormal service.

As can be seen from the above, the wind control method provided in this specification may determine, through clustering, a typical service used for inputting the interpretation model, identify, as a cause of the abnormal service, the typical service output based on the interpretation model, and determine a cause of the abnormal service, where other abnormal services are identified as the causes of the abnormal service, thereby implementing efficient propagation of the abnormal cause, reducing data volume input to the interpretation model, reducing calculation time consumption of the interpretation model, and improving efficiency of determining the cause of the abnormal service identified as the abnormal service, so as to improve wind control efficiency.

Drawings

The accompanying drawings, which are included to provide a further understanding of the specification and are incorporated in and constitute a part of this specification, illustrate embodiments of the specification and together with the description serve to explain the specification and not to limit the specification in a non-limiting sense. In the drawings:

FIG. 1 is a schematic flow chart of a method of wind control provided herein;

FIG. 2 is a schematic diagram of an interpretation model provided in the present specification;

FIG. 3 is a schematic view of a wind control device provided herein;

fig. 4 is a schematic diagram of an electronic device provided in this specification.

Detailed Description

At present, after the abnormal service is determined by the abnormal detection model, data of the determined abnormal service generally needs to be input into other models for explaining the reason that the service is identified as the abnormal service, so as to respectively determine the reason that the abnormal service is identified as the abnormal service. That is, the output of the abnormality detection model is interpreted by another model.

Because each abnormal business needs to be explained through a model, and the existing model for explaining the reason has the problem of low operation efficiency, a large amount of time needs to be consumed when the abnormal business is identified as the abnormal reason, the efficiency for determining the reason is low (namely, the explanation efficiency is low), the wind control efficiency is further low, and even the wind control is not timely, so that the business loss is caused.

To at least partially address the above issues, the present specification provides a method of wind control. By the wind control method, abnormal services can be clustered into different service clusters through clustering according to the service data of the abnormal services, and typical services in each service cluster are respectively determined. Wherein each business cluster can correspond to a risk type.

Then, the typical service can be used as a representative in the corresponding service cluster and input into the interpretation model, and the reason why the typical service is identified as the abnormal service is obtained. After the reason that the typical service is identified as the abnormal service is obtained, the reason that the remaining abnormal service is identified as the abnormal service can be determined according to the similarity between the remaining abnormal service and the typical service and the reason that the typical service is identified as the abnormal service, so that the propagation of the reasons is realized. Therefore, the reasons corresponding to all abnormal services can be obtained, but each abnormal service does not need to be input into the interpretation model, and the interpretation efficiency of the abnormal services can be greatly improved so as to improve the wind control efficiency.

In order to make the objects, technical solutions and advantages of the present disclosure more clear, the technical solutions of the present disclosure will be clearly and completely described below with reference to the specific embodiments of the present disclosure and the accompanying drawings. It is to be understood that the embodiments described are only a few embodiments of the present disclosure, and not all embodiments. All other embodiments obtained by a person of ordinary skill in the art based on the embodiments in the present specification without any creative effort belong to the protection scope of the present specification.

The technical solutions provided by the embodiments of the present description are described in detail below with reference to the accompanying drawings.

Fig. 1 is a schematic flow chart of a wind control method in this specification, which specifically includes the following steps:

s100: and determining the service data of each abnormal service.

In this specification, the wind control method may be performed by a server. The server may be a single server or a plurality of servers, and may be a distributed system, for example.

The server may periodically determine each abnormal service and determine a reason why each abnormal service is identified as an abnormal service, to execute a wind-controlled service based on the determined reason.

For example, a day may be a period, for example, each service of the previous day may be determined at the zero point of the day, and abnormal services in each service may be determined through the abnormality detection model, so as to further determine the reason why each abnormal service is identified as an abnormal service through the wind control method.

When determining that each abnormal service is identified as a cause of the abnormal service, first, the server may determine service data of each abnormal service.

S102: and clustering the abnormal services according to the service data to obtain each service cluster and a clustering center corresponding to each service cluster, and respectively determining typical services of each service cluster according to the clustering center of each service cluster.

After determining the service data of each abnormal service, the server can cluster each abnormal service according to the service data to obtain each service cluster and a cluster center corresponding to each service cluster, so as to determine the typical service of each service cluster according to the cluster center of each service cluster.

As described above, a business cluster may correspond to a risk type. For example, the risk types may include money laundering risks, billing risks, coupon cash-out risks, and the like. And aiming at each service cluster, determining typical services from the abnormal services of the service cluster according to the clustering center of the service cluster, namely the typical services corresponding to the risk types of the service cluster.

Since the typical traffic is determined based on the cluster center, the typical traffic is an abnormal traffic representative of the traffic cluster and capable of indicating a general level of risk status of each abnormal traffic of the traffic cluster.

The Clustering algorithm used in the present specification is not limited, and for example, a k-means (k-means) Clustering algorithm, a Density-Based Clustering algorithm (Density-Based Spatial Clustering Of Applications With Noise, DBSCAN) or the like may be used.

S104: and for each typical service, determining the reason for the typical service to be identified as abnormal service according to the service data of the typical service through an interpretation model.

After determining the typical service corresponding to each service cluster, the server may determine, for each typical service, the reason why the typical service is identified as an abnormal service through an interpretation model according to the service data of the typical service.

S106: and determining the reason for identifying the residual abnormal service as the abnormal service according to the similarity between the residual abnormal service and each typical service and the reason for identifying each typical service as the abnormal service.

Since there is always a commonality between the reasons for similar abnormal traffic being identified as abnormal traffic, after determining the reason for each typical traffic being identified as abnormal traffic, the server may determine the reason for the remaining abnormal traffic being identified as abnormal traffic according to the similarity between the remaining abnormal traffic and each typical traffic and the reason for each typical traffic being identified as abnormal traffic.

S108: and executing the wind control service according to the reason that each abnormal service is identified as the abnormal service.

After determining that each abnormal service is identified as the reason of the abnormal service, the server can execute the wind control service according to the reason that each abnormal service is identified as the abnormal service.

Based on the method shown in fig. 1, each abnormal service is clustered according to the service data of the abnormal service, so as to obtain each service cluster and the typical service corresponding to each service cluster. And determining the reason of the typical service identified as the abnormity through the interpretation model according to the service data of the typical service for each typical service. And determining the reason for identifying the remaining abnormal service as the abnormal service according to the similarity between the remaining abnormal service and each typical service and the reason for identifying each typical service as the abnormal service, so as to execute the wind control service according to the reason for identifying each abnormal service as the abnormal service.

The method can determine the typical service for inputting the interpretation model through clustering, determines the reason that other abnormal services are identified as abnormal services based on the reason that the typical service output by the interpretation model is identified as the abnormal service, realizes the propagation of the abnormal reasons with high efficiency, reduces the data volume input into the interpretation model, reduces the calculation time consumption of the interpretation model, and improves the efficiency of determining the reason that the abnormal service is identified as the abnormal service so as to improve the wind control efficiency.

After the service is executed, a service record is generated, and is used for storing relevant data of the service, such as the execution time of the service, the related service body, the service content and the like, which is an important basis for determining whether the service is abnormal. Thus, the traffic record may be used to determine the reason why abnormal traffic was identified as abnormal traffic.

In one or more embodiments of the present specification, when determining the service data of each abnormal service in step S100, the server may record, for each abnormal service, the service of the abnormal service as the service data of the abnormal service. Namely, the service record generated by executing the abnormal service is used as the service data of the abnormal service.

Alternatively, since some noisy data may be present in the traffic record, the server may extract from the traffic record traffic characteristics that can be used to determine the cause of the abnormal traffic being identified as abnormal traffic, to determine the traffic data based on the traffic characteristics.

Then, when the service data of each abnormal service is determined in step S100, specifically, the server may determine the service record of the abnormal service for each abnormal service. And then, according to the determined service record, determining the feature value of each preset service feature corresponding to the abnormal service to obtain the feature vector of the abnormal service, wherein the feature vector is used as the service data of the abnormal service.

In one or more embodiments of the present specification, the service record used to determine the feature vector of the abnormal service may be a service record generated by executing the abnormal service. Alternatively, the service record generated by executing the abnormal service may not be limited, and for example, the service record of the service historically executed by the service subject related to the abnormal service may also be included. Then, the feature value of at least part of the preset service features may be determined based on a plurality of service records. For example, the traffic characteristic "frequency" may be determined based on traffic records of a plurality of traffic of the traffic body corresponding to the abnormal traffic.

Taking a transaction as an example, the business entities involved in a transaction may include buyers, sellers, and parties to facilitate the transaction (e.g., parties providing technical support for the transaction, parties to facilitate a transaction planning activity, parties to distribute coupons, etc.).

Then, the preset service features may include features of the service itself and features of the service body corresponding to the service. For example, characteristics of the transaction service itself may include transaction amount, transaction time, and the like. As described above, the service body corresponding to the service may include: a service party, a seller, a buyer, etc. Then, the characteristics of the business entity may include: the location of the buyer, the transaction frequency of the buyer, whether the buyer and the seller are in a relationship of relatives and friends, whether the buyer and the seller are in a group relationship, etc. Based on the characteristics of the business subjects, whether the transaction is suspected of illegal behaviors such as money laundering, bill swiping, coupon cashing and the like can be identified.

Whether the seller and the buyer are in a relationship of relatives and friends can be determined based on accounts registered by the seller and the buyer on a service platform corresponding to the server, or can be determined based on real-name authentication information of the buyer and the seller. It should be noted that the information determined in this specification is obtained through a legal way after being authorized by the user.

Whether the buyer and the seller are in a group relationship may be determined according to the number of transactions between the seller and the buyer within a predetermined time and a predetermined threshold, for example, when the number of transactions between the seller and the buyer within the predetermined time is greater than the predetermined threshold, it may be determined that the seller and the buyer are in a group relationship.

In addition, in one or more embodiments of the present specification, when determining the typical service of each service cluster according to the cluster center of each service cluster in step S102, the server may use the cluster center of each service cluster as the typical service of each service cluster, because the cluster center can indicate the prevalence level of each abnormal service in the service cluster.

It should be noted that the clustering center determined by the clustering algorithm does not necessarily correspond to the abnormal service actually existing. That is, there is not necessarily abnormal traffic at the cluster center. The server can take the determined clustering center as a typical service in the corresponding service cluster no matter whether the determined clustering center has abnormal services or not.

Or, the server may further regard each service cluster, and when an abnormal service exists in the clustering center of the service cluster, take the clustering center of the service cluster as a typical service of the service cluster. When the abnormal service does not exist in the clustering center of the service cluster, the typical service of the service cluster can be determined from the abnormal services in the service cluster according to the distance between each abnormal service in the service cluster and the clustering center of the service cluster.

The clustering center of the service cluster has abnormal services, that is, the service data of the clustering center is the same as at least one abnormal service of the service cluster. The clustering center of the service cluster has no abnormal service, that is, the service data of the clustering center is different from any abnormal service of the service cluster.

In one or more embodiments of the present description, the server may determine, as a representative service, the abnormal service that is closest to the center of the cluster.

In one or more embodiments of the present disclosure, when there are a plurality of services in the service cluster to which the cluster center belongs, the distances between the plurality of services and the cluster center are the same, and the distances between the plurality of services and the cluster center are the closest services in each abnormal service in the service cluster, that is, when there are a plurality of abnormal services closest to the cluster center, the server may use the abnormal service closest to the cluster center as the pending service. Then, for each pending service, the sum of the distances between the pending service and other abnormal services in the service cluster to which the pending service belongs can be determined, and the abnormal service with the minimum sum of the obtained distances is used as a typical service in the service cluster.

In one or more embodiments of the present disclosure, the server may determine distances between each abnormal service and a cluster center of the service cluster according to a feature vector of each abnormal service of the service cluster and a feature vector of the cluster center of the service cluster.

In this specification, the interpretation model used is not limited, and an existing interpretation model, for example, a sharpley Additive interpretation (SHAP) model, may be used. Then, in step S104 in this specification, when the typical service is identified as the cause of the abnormal service through the interpretation model according to the service data of the typical service for each typical service, specifically, the server may input the service data of the typical service into the interpretation model for each typical service to obtain the feature weight corresponding to each service feature of the typical service.

The server may then identify the obtained feature weight of each service feature as a cause of the typical service being identified as an abnormal service. Or, the server may filter part of the service features according to the feature weight of each service feature, so as to use the filtered service features and the service features thereof as the reasons for identifying the typical service as the abnormal service.

The characteristic weight is used for representing the contribution degree of the service characteristic to identifying the typical service as the abnormal service. And, the feature weight is positively correlated with the contribution degree. That is, the larger the feature weight corresponding to the traffic feature is, the larger the contribution of the traffic feature to the identified abnormal traffic of the traffic belonging thereto is.

Of course, other interpretation models may also be used in this specification. For example, due to the diversity of risks, abnormal services also have no labelerable fixed mode, so that compared with a supervised learning model, an interpretation model obtained by unsupervised or self-supervised training is more beneficial to accurately determining the reason for identifying the abnormal services as the abnormal services.

For example, the interpretation model may be trained by contrast learning. The input of the interpretation model can comprise business data corresponding to abnormal business and business data of normal business, so that the interpretation model can compare and learn the difference between the business data of normal business and the business data of abnormal business in the training process, and when the interpretation model is applied, the interpretation model can accurately output the reason that the abnormal business is identified as the abnormal business.

For the convenience of understanding, the present specification first describes a training process for explaining a model:

first, the server can determine the service data of the service group consisting of abnormal service and normal service as a training sample. The number of normal services corresponding to one service group can be set as required. For example, since there may be a service similar to the abnormal service in the normal service, when training the interpretation model, training is performed for the purpose other than to enable the interpretation model to distinguish the abnormal service from the normal service, and to learn the difference of the service characteristics of the abnormal service and the normal service. In addition, in order to enable the interpretation model to learn the difference of service characteristics among abnormal services, normal services similar to the abnormal services and normal services, the interpretation model can also accurately distinguish normal services similar to the abnormal services compared with the normal services. Thus, a training sample may include traffic data for an abnormal traffic, traffic data for a normal traffic similar to the abnormal traffic, and traffic data for another normal traffic.

In one or more embodiments of the present description, the interpretation model may include an embedding (embedding) layer and an attention layer.

In one embodiment, the attention layer may consist of a single hidden layer and a linear rectification function.

The server can input the training sample into the embedding layer of the interpretation model, and the embedding characteristics corresponding to the business data of the training sample are obtained according to the input business data and the parameters of the embedding layer. Then, the embedded features of the training sample may be concatenated (concat) and input into the attention layer to obtain the attention weight corresponding to the training sample output by the attention layer. Wherein the embedded features are matrices. Attention weights are vectors.

The server may then determine a countering attention weight based on the attention weight. For example, the sum of the values of the same dimension of the attention weight and the negated attention weight may be 1.

The server can respectively weight each embedded feature of the training sample according to the attention weight to obtain a first triple. And weighting each embedded feature of the training sample according to the negated attention weight to obtain a second triple.

The server may then determine a triple Loss (Triplet Loss) corresponding to the first triple as the first Loss and a triple Loss corresponding to the second triple as the second Loss. And determining a total loss based on the first loss and the second loss. To adjust the parameters of the interpretation model based on the total loss.

In one or more embodiments of the present description, the formula for determining the total loss may be specified as follows:

wherein L is the total loss, L ₁ I.e. first loss, L ₂ I.e. the second loss.

Is a preset hyper-parameter.

Alternatively, a total loss may be determined for a batch (batch) of training samples, and the formula for determining the total loss may also be as follows:

wherein L is _1i I.e. the first loss, L, of the ith training sample in the set Q of one batch training sample _2i I.e., the second loss of the ith training sample in set Q.

For ease of understanding, this specification also provides a schematic diagram of the interpretation model shown in fig. 2.

As shown in fig. 2, a graph consisting of one rectangle and three circles therein represents service data of one service. One training sample includes traffic data of one abnormal traffic and traffic data of two normal traffic. The training sample is firstly input into an embedding layer of the interpretation model, and each embedding feature corresponding to the training sample can be obtained according to each service data corresponding to the training sample and the parameters of the embedding layer. After the embedded features are stitched, the resulting stitched embedded features may be input into the attention layer of the interpretation model. The attention weight of the attention layer output and the respective embedded features are used to determine the loss.

From the attention weight of the attention layer output and the respective embedded features, a first penalty can be determined. The second loss may be determined based on the inverted attention weight corresponding to the attention weight and the respective embedded features. From the first loss and the second loss, a total loss may be determined. The parameters and attention weights of the embedding layer are used for determining the characteristic weight of each service characteristic contained in the service data of the abnormal service in the service data input into the interpretation model.

Accordingly, in one or more embodiments of the present specification, when determining, for each typical service, the cause of the typical service identified as an abnormal service through the interpretation model according to the service data of the typical service in step S104, the server may first determine the service data of each normal service. Then, for each typical service, according to the similarity between each normal service and the typical service, two related services corresponding to the typical service are determined from each normal service, and a service group is formed with the typical service. That is, one service group includes one abnormal service and two related services corresponding to the abnormal service.

The server may then determine, from the respective service data of the service group, a cause of the typical service being identified as an abnormal service through the interpretation model.

Wherein the normal business input into the interpretation model is used for enabling the interpretation model to learn the difference between the normal business and the abnormal business, and the difference between the normal business similar to the abnormal business and other normal businesses.

When determining two related services corresponding to the typical service from the normal services according to the similarity between the normal services and the typical service, the server can determine the similarity between the normal services and the typical service respectively. And then, according to the determined similarity, determining the similar service with the highest similarity with the typical service from the normal services.

Then, the server may randomly screen one normal service from the remaining normal services, and use the screened normal service and the similar service as related services of the typical service.

In one or more embodiments of the present description, the server may further determine similarity of each normal service to the typical service. And then, according to the determined similarity, determining the similar service with the highest similarity with the typical service from the normal services, determining the normal service with the corresponding similarity smaller than a preset first threshold from the rest normal services, and randomly screening one normal service from the normal services with the corresponding similarity smaller than the first threshold. Then, the server may regard the screened normal service and the similar service as related services of the typical service.

Or, the server may also determine the similarity between each normal service and the typical service. And then, according to the determined similarity, randomly determining one related service from the normal services with the corresponding similarity larger than a preset second threshold, and randomly determining another related service from the normal services with the corresponding similarity smaller than the first threshold. In one or more embodiments of the present specification, the server may determine the reason why the typical service is identified as an abnormal service according to the feature weight of each service feature of the typical service determined by the interpretation model.

When the reason that the typical service is identified as the abnormal service is determined through the interpretation model according to each service data of the service group, specifically, the server may input the service data of each service of the service group of the typical service into the embedding layer. Then, for each service data of the service group, the embedding characteristics corresponding to the service data can be obtained according to the parameters of the embedding layer and the service data.

Then, the server may splice the embedded features corresponding to the service group and input the spliced features into the attention layer to obtain the attention weight corresponding to the service group.

Then, the server may determine feature weights corresponding to the service features of the typical service according to the attention weight and the parameters of the embedded layer, so as to determine the reason why the typical service is identified as an abnormal service according to the feature weights corresponding to the service features of the typical service.

Wherein the feature weight is used for representing the contribution degree of the service feature to the identification of the typical service as abnormal service.

When determining the reason that the typical service is identified as the abnormal service according to the feature weight corresponding to each service feature of the typical service, specifically, the server may rank the service features of the typical service according to the feature weight corresponding to each service feature of the typical service, so as to determine the reason that the typical service is identified as the abnormal service from the service features of the typical service according to a ranking result and a preset number.

For example, the traffic characteristics with the highest weight may be identified as the cause of the typical traffic identified as abnormal traffic. Or, according to the preset number and the sorting result, determining the characteristic features and the characteristic weights of the partial services in the order from high to low of the characteristic weights as the reasons for identifying the typical service as the abnormal service.

Further, since abnormal services in the same service cluster are similar services corresponding to the same risk type, the server may identify, for each typical service, the typical service as a cause of the abnormality, as a cause of each of the other abnormal services in the service cluster corresponding to the typical service being identified as an abnormality.

Or, when determining that the remaining abnormal service is identified as the cause of the abnormal service in step S106 according to the similarity between the remaining abnormal service and each typical service and the reason that each typical service is identified as the abnormal service, the server may further determine, for each typical service, the abnormal service in the service cluster to which the typical service belongs, the abnormal service whose similarity with the typical service is greater than a preset third threshold, as the hit service. And identifying the typical service as the reason of the abnormal service, and identifying the hit service corresponding to the typical service as the reason of the abnormal service. For non-hit traffic, the data can be input to the interpretation model, respectively, to determine an interpretation of the non-hit traffic based on the output of the interpretation model.

Or, the server may further determine, for each remaining abnormal service, a similarity between the remaining abnormal service and each typical service according to the service data of the remaining abnormal service and the service data of each typical service. And determining the total similarity corresponding to the remaining abnormal services according to the determined similarities.

Then, the server may determine, for each typical service, a probability that a cause of the remaining abnormal service identified as an abnormal service is a cause corresponding to the typical service according to the similarity between the remaining abnormal service and the typical service and the total similarity. That is, the probability that the unusual traffic is identified as the cause of the abnormal traffic is determined to be the same as the cause that the typical traffic is identified as the abnormal traffic.

Then, the server may determine the reason why the remaining abnormal traffic is identified as abnormal traffic according to the probabilities that the remaining abnormal traffic corresponds to the reason why each typical traffic is identified as abnormal traffic, respectively, and the reason why each typical traffic is identified as abnormal traffic.

For example, suppose 2 service clusters are obtained by clustering, wherein the typical service 1 of one service cluster is identified as the service characteristic of the transaction frequency, and the typical service 2 of the other service cluster is identified as the service characteristic of the group. And the probability of one remaining abnormal traffic corresponding to the typical traffic 1 is 0.6, and the probability corresponding to the typical traffic 2 is 0.6. The reason why the remaining abnormal traffic is identified as abnormal traffic is: a probability of 0.3 results in being identified as anomalous traffic for transaction frequency and a probability of 0.6 results in being identified as anomalous traffic for a group partner.

The similarity between businesses can be determined based on the distance (such as euclidean distance) between businesses determined by the business data of the businesses, and the determined distance is inversely related to the similarity. For example, the reciprocal of the distance between the services may be taken as the similarity.

Specifically, the server may determine, for each typical service, a ratio of the similarity between the typical service and the abnormal service to the total similarity as a probability that the reason why the abnormal service is identified as the abnormal service is the reason corresponding to the typical service.

In addition, when the wind control service is executed according to the reason that each abnormal service is identified as an abnormal service in step S108, the server may further determine, for each typical service, a risk type corresponding to the typical service according to the feature value of each service feature of the typical service and the matching condition corresponding to each preset risk type.

And then, determining the risk types corresponding to the remaining abnormal services according to the similarity between the remaining abnormal services and each typical service and the risk types corresponding to each typical service, so as to execute the wind control service according to the reason and the risk types of the abnormal services identified as the abnormal services.

The server can determine the probability of the risk type corresponding to the typical service of the remaining abnormal service according to the similarity between the remaining abnormal service and the typical service and the total similarity between each remaining abnormal service and the typical service. Then, the probability of various risk types existing in the remaining abnormal service can be determined according to the probability that the remaining abnormal service respectively corresponds to the risk type of each typical service and the risk type of each typical service.

For example, assuming that the service cluster obtained by clustering is 2, the number of typical services is also 2. Assuming that the similarity of one remaining abnormal service to one of the typical services (hereinafter referred to as a first typical service) is 0.2 and the similarity to the other typical service (hereinafter referred to as a second typical service) is 0.6, the total similarity is 0.8. The probability of the abnormal service having the first risk type corresponding to the first typical service is 0.25, and the probability of the abnormal service having the second risk type corresponding to the second typical service is 0.75.

In one or more embodiments of the present specification, in order to make the reason that the abnormal service is identified as the abnormal service determined based on the service characteristics of the abnormal service more accurate, when the reason that the typical service is identified as the abnormal service is determined through the interpretation model according to the service data of the typical service in step S106, the server may further determine the characteristic weight corresponding to each service characteristic of the typical service through the interpretation model according to the service data of the typical service. And then, determining a Gaussian model corresponding to each service characteristic according to each abnormal service in the service cluster to which the typical service belongs.

Then, the server may determine a likelihood value of each service feature of the typical service according to the gaussian model corresponding to each service feature, so as to determine, for each service feature, an update weight of the service feature according to the likelihood value and the feature weight of the service feature of the typical service.

Finally, the server can determine the reason that the typical service is identified as the abnormal service according to the updating weight corresponding to each service characteristic of the typical service.

In one or more embodiments of the present specification, the server may provide gaussian modeling according to a feature value corresponding to the service feature and each abnormal service in the service cluster to which the typical service belongs, and determine a gaussian model of the service feature.

In one or more embodiments of the present description, the likelihood value of the traffic characteristic is an output of a gaussian model corresponding to the traffic characteristic. That is, the server may input the feature value of the service feature into the gaussian model corresponding to the service feature for each service feature of the typical service, so as to obtain a likelihood value (likelihood) corresponding to the service feature of the typical service.

In one or more embodiments of the present specification, after determining the gaussian model corresponding to each service feature, the server may also rank each service feature according to a feature weight corresponding to each service feature of the typical service. And screening part of service characteristics according to the sequencing result and the preset characteristic quantity to serve as undetermined characteristics. For example, assuming that the typical service contains 200 service features, 10 or 20 service features may be screened as pending features.

Then, the server can determine the likelihood value corresponding to the undetermined feature through the Gaussian model corresponding to the undetermined feature according to the feature value of the undetermined feature. And determining the update weight of the undetermined characteristic of the typical service according to the likelihood value of the undetermined characteristic and the characteristic weight.

The server may then determine the cause of the typical traffic identified as anomalous traffic based on the updated weights of the pending characteristics of the typical traffic.

In addition, in order to assist a user executing the wind control service to more conveniently and clearly understand the risks of the abnormal service from a plurality of angles, or in order to enable an object executing the wind control service to clearly determine the reason of the abnormal service, the server can also determine a message corresponding to the abnormal service. The message can identify the abnormal service characteristic granularity as the abnormal reason, and the abnormal service characteristic granularity is gathered at the granularity of the main body corresponding to the abnormal service so as to integrate the reasons corresponding to the abnormal service, so that the explanation of the reason that the service is identified as the abnormal service is more popular and easier to understand.

Wherein, the message may include: a message corresponding to the service itself, and a message corresponding to the service body. For example, the interpretation message corresponding to the service itself may include the reason why the service is identified as an abnormal service, the involved service resources, and the like. The involved service resources may be transaction amount, data traffic, and the like of the service. Or, the service may also be a service resource to be provided to the service party corresponding to the service, such as an exposure duration, a recommendation number, and the like.

When the wind control service is executed according to the reason that each abnormal service is identified as an abnormal service in step S108, the server may determine, for each abnormal service, a service body corresponding to the abnormal service, and determine, for each service body, an interpretation message corresponding to the service body according to the reason that each abnormal service of the service body is identified as an abnormal service and a preset message template. And executing the wind control service on each service main body according to the reason that the abnormal service corresponding to each service main body is identified as the abnormal service, and sending the determined explanation message to the corresponding service main body.

For example, the service body of the wind control service to be executed may be determined according to the reason that the abnormal service corresponding to each body is identified as the abnormal service and a preset wind control rule, and the corresponding interpretation message may be sent to the determined service body.

Or, the server may also determine, for each abnormal service, an interpretation packet corresponding to the abnormal service according to the reason that the abnormal service is identified as the abnormal service and a preset packet template. And executing the wind control service according to the reason that the abnormal service is identified as abnormal, and sending the explanation message corresponding to the abnormal service to the service main body corresponding to the abnormal service.

Or when the wind control service is executed according to the reason of each abnormal service, the server can also display an explanation page according to the reason that each abnormal service is identified as abnormal and the explanation message corresponding to each abnormal service. The user can determine the wind control strategy executed on the abnormal service through the interpretation message displayed in the interpretation page, so as to execute the wind control service according to the determined wind control service.

Therefore, the server can respond to the operation of the user on the interpretation page to execute the wind control business.

In addition, in a wind control scene, risk search can be performed based on the business relation between different business bodies corresponding to abnormal business. For example, the exception of the buyer may cause the business exception of the seller, and further cause the business exception of the seller corresponding to the service provider. Therefore, the reason why the business of the buyer and the seller is identified as abnormal can be regarded as the reason why the business of the service provider is identified as abnormal, and the magnitudes of the abnormal businesses which the buyer, the seller and the service provider can involve are different and increase in the order of the buyer, the seller and the service provider. Thus, the following may be used: and the buyer, the seller and the service party sequentially count and gather the reasons of the abnormal service, which are identified as the abnormal service, and respectively generate corresponding messages for the service main bodies of the buyer, the seller and the service party in three magnitude types.

After the messages of the business bodies of various magnitude types are obtained, risk exploration can be performed based on the corresponding messages according to the sequence of the service party and the seller and buyer.

In addition to classifying the abnormal services according to the magnitude of the abnormal services related to the service body, the service body can be classified according to the attribute of the service body aiming at each magnitude type, and different service bodies are divided into different attribute types.

For example, for a buyer, attributes may include: teenagers, adolescents, middle-aged people, elderly people, men, women, etc. For sellers, the attributes may then include: restaurant stores, supermarkets, clothing stores, and the like. For the service side, the attribute type may not be determined.

Based on the magnitude types and/or the attribute types, the business bodies can be associated to obtain a risk exploration path of the message connected with the business bodies. The user can conduct risk exploration based on the risk exploration path, and one risk exploration path can contain a plurality of anchor points. The skipping among different messages can be realized by clicking the corresponding anchor points by the user.

Therefore, in one or more embodiments of the present specification, the server may further determine a service body corresponding to each abnormal service, a type of each service body, and an interpretation message of each service body. And determining the statistical message of each type according to the interpretation message corresponding to the service main body of the type aiming at each type. The type may be a magnitude type, or may be an attribute type.

Then, the server may determine, for each statistical packet, an anchor point in the statistical packet according to at least one of a service body and a type of the service body included in the statistical packet. The anchor point is connected with the explanation message of the service body contained in the statistic message, or the anchor point is connected with the statistic message of the type of the service body contained in the statistic message.

The server can respond to the selection operation of the user and determine the target message.

When the user needs to check other messages related to the target message, the corresponding anchor point in the target message can be clicked.

The server can respond to the clicking operation of the user on the anchor point in the target message and display the statistical message or the explanation message corresponding to the clicked anchor point.

The server can also respond to the determination operation of the user and send the statistical message or the interpretation message determined by the user to the object executing the wind control service.

The message corresponding to the service body may include an explanation message corresponding to a single service body and a statistical message corresponding to a type of service body.

The explanation message corresponding to the service body may include the counted number of abnormal services of the service body, and the reason why the abnormal services are identified as abnormal.

The statistical message corresponding to one type of service body may include the number of abnormal services of one type of service body, and the reason why the abnormal services are identified as abnormal.

Or, the interpretation message corresponding to the service body may also include a type corresponding to the service body, and the user may obtain the statistical message corresponding to the type by clicking an anchor point corresponding to the type.

For example, the statistical message may be: 1000 old people have 2 ten thousand transactions with the same amount, high frequency and scattered positions in 50 dining stores, and 10 ten thousand of business marketing funds are involved. Wherein the elderly, i.e. the buyer-level type, are the attribute types of the business entities. And the restaurant store is the attribute type of the business body of the seller magnitude type. The amount, the frequency and the position are service characteristics of the service identified as the reasons of abnormal services, the number of each abnormal service corresponding to the service main bodies with two attribute types is 2 ten thousand, and the related commission amount is 10 ten thousand. The user can obtain statistical messages corresponding to the elderly by clicking the anchor point of the 'elderly', or at least partial corresponding interpretation messages in 1000 elderly respectively. The user can obtain the statistical messages corresponding to the types of the restaurant stores by clicking the anchor point of the restaurant store, or the statistical messages corresponding to at least part of the 50 restaurant stores respectively.

In this specification, by determining the risk search path, the risk search is performed in the order of the service provider, the seller and the buyer according to the risk search path, for example, according to the message of the service provider, it can be determined from which seller the risk comes. The user can further determine the message of the seller and determine the reason why the seller has risks. So as to further lock the buyer with the risk and check the message of the buyer.

In addition, the message may also include a risk type corresponding to the service. And the server can take each typical service as a typical case of the risk type corresponding to each typical service.

The determined representative case can be sent to a corresponding business main body, such as a service party. Or, may be sent to the object on which the wind-controlled service is performed.

Or, in the explanation page, the typical case corresponding to each risk type can also be shown.

In addition, in one or more embodiments of the present specification, based on the risk search path, in addition to obtaining the message, after the user determines the business entity with risk, the user may obtain relevant data of the business entity, for example, transaction details of the abnormal business, and information of the business entity, so as to extract abnormal information other than the content included in the message.

Fig. 3 is a schematic view of a wind control device provided in the present specification, the device including:

a determining module 200, configured to determine service data of each abnormal service;

a clustering module 201, configured to cluster the abnormal services according to the service data to obtain service clusters and clustering centers corresponding to the service clusters, and determine typical services of the service clusters according to the clustering centers of the service clusters;

a reason determining module 202, configured to determine, for each typical service, a reason why the typical service is identified as an abnormal service through an interpretation model according to the service data of the typical service;

the reason propagation module 203 is configured to determine, according to the similarity between the remaining abnormal service and each typical service and the reason why each typical service is identified as an abnormal service, the reason why the remaining abnormal service is identified as an abnormal service;

and the wind control module 204 is configured to execute the wind control service according to the reason that each abnormal service is identified as an abnormal service.

Optionally, the determining module 200 is further configured to determine, for each abnormal service, a service record of the abnormal service;

and determining the characteristic value of each preset service characteristic corresponding to the abnormal service according to the service record to obtain the characteristic vector of the abnormal service as the service data of the abnormal service.

Optionally, the clustering module 201 is further configured to, for each service cluster, when an abnormal service exists in a clustering center of the service cluster, use the clustering center as a typical service of the service cluster, and when the abnormal service does not exist in the clustering center of the service cluster, determine the typical service of the service cluster from the abnormal services of the service cluster according to a distance between each abnormal service in the service cluster and the clustering center of the service cluster.

Optionally, the reason determining module 202 is further configured to determine service data of each normal service, determine, for each typical service, two related services corresponding to the typical service from the normal services according to a similarity between the normal service and the typical service, form a service group with the typical service, and determine, according to each service data of the service group, a reason why the typical service is identified as an abnormal service through an interpretation model.

Optionally, the interpretation model includes an embedding layer and an attention layer, the reason determining module 202 is further configured to input service data of each service of the service group into the embedding layer, obtain, for each service data of the service group, an embedding feature corresponding to the service data according to a parameter of the embedding layer and the service data, join the embedding features corresponding to the service group, input the joined embedding features into the attention layer, obtain an attention weight corresponding to the service group, determine, according to the attention weight and the parameter of the embedding layer, a feature weight corresponding to each service feature of the typical service, and determine, according to the feature weight corresponding to each service feature of the typical service, a reason that the typical service is identified as an abnormal service, where the feature weight is used to represent a contribution degree of the service feature to identifying the typical service as an abnormal service.

Optionally, the reason determining module 202 is further configured to sort the service features of the typical service according to the feature weights corresponding to the service features of the typical service, and determine, according to the sorting result and the preset number, the reason why the typical service is identified as an abnormal service from the service features of the typical service.

Optionally, the wind control module 204 is further configured to, for each typical service, determine a risk type corresponding to the typical service according to a feature value of each service feature of the typical service and a preset matching condition corresponding to each risk type, determine a risk type corresponding to the remaining abnormal service according to a similarity between the remaining abnormal service and each typical service and a risk type corresponding to each typical service, and execute the wind control service according to a reason and a risk type that each abnormal service is identified as an abnormal service.

Optionally, the cause propagation module 203 is further configured to, for each remaining abnormal service, determine similarity between the remaining abnormal service and each typical service according to the service data of the remaining abnormal service and the service data of each typical service, determine total similarity corresponding to the remaining abnormal service according to the determined similarities, determine, for each typical service, a probability that a cause of the remaining abnormal service identified as an abnormal service is a cause corresponding to the typical service according to the similarity between the remaining abnormal service and the typical service and the total similarity, and determine a cause of the remaining abnormal service identified as an abnormal service according to the probability that the remaining abnormal service corresponds to a cause of each typical service identified as an abnormal service and a cause of each typical service identified as an abnormal service.

Optionally, the reason determining module 202 is further configured to determine, according to the service data of the typical service, a feature weight corresponding to each service feature of the typical service through an interpretation model, determine, according to each abnormal service in a service cluster to which the typical service belongs, a gaussian model corresponding to each service feature, determine, according to the gaussian model corresponding to each service feature, a likelihood value of each service feature of the typical service, determine, for each service feature, an update weight of the service feature according to the likelihood value and the feature weight of the service feature of the typical service, and determine, according to the update weight corresponding to each service feature of the typical service, a reason why the typical service is identified as the abnormal service.

Optionally, the wind control module 204 is further configured to determine, for each abnormal service, a service main body corresponding to the abnormal service, determine, for each service main body, an explanation packet corresponding to the service main body according to a reason that each abnormal service of the service main body is identified as an abnormal service and a preset packet template, execute the wind control service on each service main body according to a reason that each abnormal service corresponding to the service main body is identified as an abnormal service, and send the determined explanation packet to the corresponding service main body.

Optionally, the apparatus further comprises:

a sending module 205, configured to determine a service main body corresponding to each abnormal service, a type of each service main body, and an interpretation message of each service main body, determine, for each type, a statistical message of the type according to the interpretation message corresponding to the type of service main body, determine, for each statistical message, an anchor point in the statistical message according to at least one of the service main body and the type of service main body included in the statistical message, where the anchor point is connected to the interpretation message of the service main body included in the statistical message, or the anchor point is connected to the statistical message of the type of service main body included in the statistical message, determine, in response to a selection operation of a user, a target message, in response to a click operation of the anchor point in the target message by the user, display the statistical message or the interpretation message corresponding to the clicked anchor point, and send, in response to the determination operation of the user, the statistical message or the interpretation message determined by the user to an object on which the wind control service is executed.

The present specification also provides a computer-readable storage medium storing a computer program, which is operable to execute the above-described wind control method.

This specification also provides a schematic block diagram of the electronic device shown in fig. 4. As shown in fig. 4, at the hardware level, the electronic device includes a processor, an internal bus, a network interface, a memory, and a non-volatile memory, and may also include hardware required for other services. The processor reads a corresponding computer program from the nonvolatile memory to the memory and then runs the computer program to realize the wind control method. Of course, besides the software implementation, this specification does not exclude other implementations, such as logic devices or combination of software and hardware, and so on, that is, the execution subject of the following processing flow is not limited to each logic unit, and may be hardware or logic devices.

In the 90 s of the 20 th century, improvements in a technology could clearly distinguish between improvements in hardware (e.g., improvements in circuit structures such as diodes, transistors, switches, etc.) and improvements in software (improvements in process flow). However, as technology advances, many of today's process flow improvements have been seen as direct improvements in hardware circuit architecture. Designers almost always obtain the corresponding hardware circuit structure by programming an improved method flow into the hardware circuit. Thus, it cannot be said that an improvement in the process flow cannot be realized by hardware physical blocks. For example, a Programmable Logic Device (PLD), such as a Field Programmable Gate Array (FPGA), is an integrated circuit whose Logic functions are determined by programming the Device by a user. A digital system is "integrated" on a PLD by the designer's own programming without requiring the chip manufacturer to design and fabricate application-specific integrated circuit chips. Furthermore, nowadays, instead of manually manufacturing an Integrated Circuit chip, such Programming is often implemented by "logic compiler" software, which is similar to a software compiler used in program development and writing, but the original code before compiling is also written by a specific Programming Language, which is called Hardware Description Language (HDL), and HDL is not only one but many, such as ABEL (Advanced Boolean Expression Language), AHDL (alternate Hardware Description Language), traffic, CUPL (core universal Programming Language), HDCal, jhddl (Java Hardware Description Language), lava, lola, HDL, PALASM, rhyd (Hardware Description Language), and vhigh-Language (Hardware Description Language), which is currently used in most popular applications. It will also be apparent to those skilled in the art that hardware circuitry for implementing the logical method flows can be readily obtained by a mere need to program the method flows with some of the hardware description languages described above and into an integrated circuit.

The controller may be implemented in any suitable manner, for example, the controller may take the form of, for example, a microprocessor or processor and a computer-readable medium storing computer-readable program code (e.g., software or firmware) executable by the (micro) processor, logic gates, switches, an Application Specific Integrated Circuit (ASIC), a programmable logic controller, and an embedded microcontroller, examples of which include, but are not limited to, the following microcontrollers: ARC 625D, atmel AT91SAM, microchip PIC18F26K20, and Silicone Labs C8051F320, the memory controller may also be implemented as part of the control logic for the memory. Those skilled in the art will also appreciate that, in addition to implementing the controller as pure computer readable program code, the same functionality can be implemented by logically programming method steps such that the controller is in the form of logic gates, switches, application specific integrated circuits, programmable logic controllers, embedded microcontrollers and the like. Such a controller may thus be considered a hardware component, and the means included therein for performing the various functions may also be considered as a structure within the hardware component. Or even means for performing the functions may be regarded as being both a software module for performing the method and a structure within a hardware component.

The systems, devices, modules or units illustrated in the above embodiments may be implemented by a computer chip or an entity, or by a product with certain functions. One typical implementation device is a computer. In particular, the computer may be, for example, a personal computer, a laptop computer, a cellular telephone, a camera phone, a smartphone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or a combination of any of these devices.

For convenience of description, the above devices are described as being divided into various units by function, and are described separately. Of course, the functionality of the various elements may be implemented in the same one or more pieces of software and/or hardware in the practice of this description.

As will be appreciated by one skilled in the art, embodiments of the present invention may be provided as a method, system, or computer program product. Accordingly, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment combining software and hardware aspects. Furthermore, the present invention may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, and the like) having computer-usable program code embodied therein.

The present invention is described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each flow and/or block of the flow diagrams and/or block diagrams, and combinations of flows and/or blocks in the flow diagrams and/or block diagrams, can be implemented by computer program instructions. These computer program instructions may be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.

These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including instruction means which implement the function specified in the flowchart flow or flows and/or block diagram block or blocks.

These computer program instructions may also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.

In a typical configuration, a computing device includes one or more processors (CPUs), input/output interfaces, network interfaces, and memory.

The memory may include forms of volatile memory in a computer readable medium, random Access Memory (RAM) and/or non-volatile memory, such as Read Only Memory (ROM) or flash memory (flash RAM). Memory is an example of a computer-readable medium.

Computer-readable media, including both non-transitory and non-transitory, removable and non-removable media, may implement information storage by any method or technology. The information may be computer readable instructions, data structures, modules of a program, or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static Random Access Memory (SRAM), dynamic Random Access Memory (DRAM), other types of Random Access Memory (RAM), read Only Memory (ROM), electrically Erasable Programmable Read Only Memory (EEPROM), flash memory or other memory technology, compact disc read only memory (CD-ROM), digital Versatile Disks (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices, or any other non-transmission medium, which can be used to store information that can be accessed by a computing device. As defined herein, a computer readable medium does not include a transitory computer readable medium such as a modulated data signal and a carrier wave.

It should also be noted that the terms "comprises," "comprising," or any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but may include other elements not expressly listed or inherent to such process, method, article, or apparatus. Without further limitation, an element defined by the phrases "comprising a," "8230," "8230," or "comprising" does not exclude the presence of other like elements in a process, method, article, or apparatus comprising the element.

As will be appreciated by one skilled in the art, embodiments of the present description may be provided as a method, system, or computer program product. Accordingly, the description may take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment combining software and hardware aspects. Furthermore, the description may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, and the like) having computer-usable program code embodied therein.

This description may be described in the general context of computer-executable instructions, such as program modules, being executed by a computer. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform particular tasks or implement particular abstract data types. The specification may also be practiced in distributed computing environments where tasks are performed by remote processing devices that are linked through a communications network. In a distributed computing environment, program modules may be located in both local and remote computer storage media including memory storage devices.

The embodiments in the present specification are described in a progressive manner, and the same and similar parts among the embodiments are referred to each other, and each embodiment focuses on the differences from the other embodiments. In particular, as for the system embodiment, since it is substantially similar to the method embodiment, the description is relatively simple, and reference may be made to the partial description of the method embodiment for relevant points.

The above description is only an example of the present disclosure, and is not intended to limit the present disclosure. Various modifications and alterations to this description will become apparent to those skilled in the art. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present specification should be included in the scope of the claims of the present specification.

Claims

1. A method of wind control, comprising:

determining the service data of each abnormal service;

for each typical service, determining the reason of the typical service identified as abnormal service through an explanation model according to the service data of the typical service;

determining the reason for identifying the remaining abnormal service as the abnormal service according to the similarity between the remaining abnormal service and each typical service and the reason for identifying each typical service as the abnormal service;

2. The method of claim 1, wherein determining the service data of each abnormal service specifically comprises:

determining a service record of each abnormal service;

3. The method according to claim 1, wherein the determining the typical service of each service cluster according to the cluster center of each service cluster specifically comprises:

aiming at each service cluster, when abnormal service exists in the clustering center of the service cluster, taking the clustering center as the typical service of the service cluster;

when abnormal services do not exist in the clustering center of the service cluster, determining typical services of the service cluster from the abnormal services of the service cluster according to the distance between each abnormal service in the service cluster and the clustering center of the service cluster.

4. The method according to claim 2, wherein for each typical service, determining, according to the service data of the typical service, the cause of the typical service being identified as the abnormal service through the interpretation model specifically includes:

determining the service data of each normal service;

for each typical service, determining two related services corresponding to the typical service from the normal services according to the similarity between the normal services and the typical service, and forming a service group with the typical service;

and determining the reason of the typical service identified as the abnormal service through an interpretation model according to the service data of the service group.

5. The method of claim 4, the interpretation model comprising an embedding layer and an attention layer;

determining the reason why the typical service is identified as the abnormal service through an interpretation model according to the service data of the service group, which specifically comprises the following steps:

inputting service data of each service of the service group into the embedding layer;

aiming at each service data of the service group, obtaining an embedding characteristic corresponding to the service data according to the parameters of the embedding layer and the service data;

after all the embedded features corresponding to the service group are spliced, inputting the attention layer to obtain the attention weight corresponding to the service group;

determining feature weights corresponding to various service features of the typical service according to the attention weights and the parameters of the embedded layer;

determining the reason that the typical service is identified as abnormal service according to the characteristic weight corresponding to each service characteristic of the typical service;

the characteristic weight is used for representing the contribution degree of the service characteristic to identifying the typical service as abnormal service.

6. The method according to claim 5, wherein determining, according to the feature weight corresponding to each service feature of the typical service, the reason why the typical service is identified as an abnormal service specifically includes:

sorting the service characteristics of the typical service according to the characteristic weight corresponding to the service characteristics of the typical service;

and determining the reason for identifying the typical service as the abnormal service from the service characteristics of the typical service according to the sequencing result and the preset number.

7. The method according to claim 1, wherein the executing of the wind-controlled service according to the reason that each abnormal service is identified as an abnormal service specifically comprises:

for each typical service, determining a risk type corresponding to the typical service according to the characteristic value of each service characteristic of the typical service and the preset matching condition corresponding to each risk type;

determining the risk types corresponding to the remaining abnormal services according to the similarity between the remaining abnormal services and each typical service and the risk types corresponding to each typical service;

and executing the wind control business according to the reason and the risk type of each abnormal business identified as the abnormal business.

8. The method according to claim 1, wherein determining the reason why the remaining abnormal service is identified as the abnormal service according to the similarity between the remaining abnormal service and each typical service and the reason why each typical service is identified as the abnormal service specifically comprises:

for each remaining abnormal service, respectively determining the similarity between the remaining abnormal service and each typical service according to the service data of the remaining abnormal service and the service data of each typical service;

determining the total similarity corresponding to the remaining abnormal services according to the determined similarities;

for each typical service, determining the probability that the reason of the remaining abnormal service identified as the abnormal service is the reason corresponding to the typical service according to the similarity between the remaining abnormal service and the typical service and the total similarity;

and determining the reason for identifying the residual abnormal service as the abnormal service according to the probability of the residual abnormal service corresponding to the reason for identifying each typical service as the abnormal service and the reason for identifying each typical service as the abnormal service.

9. The method according to claim 1, wherein determining, according to the service data of the typical service, the cause of the typical service being identified as an abnormal service through an interpretation model specifically comprises:

determining feature weights corresponding to various service features of the typical service through an interpretation model according to the service data of the typical service;

determining a Gaussian model corresponding to each service characteristic according to each abnormal service in a service cluster to which the typical service belongs;

determining likelihood values of all service characteristics of the typical service according to the Gaussian models corresponding to all service characteristics;

for each service characteristic, determining the update weight of the service characteristic according to the likelihood value and the characteristic weight of the service characteristic of the typical service;

and determining the reason for identifying the typical service as the abnormal service according to the updating weight corresponding to each service characteristic of the typical service.

10. The method according to claim 1, wherein the performing of the wind-controlled service according to the reason that each abnormal service is identified as an abnormal service specifically comprises:

determining a service main body corresponding to each abnormal service;

aiming at each service main body, determining an explanation message corresponding to the service main body according to the reason that each abnormal service of the service main body is identified as the abnormal service and a preset message template;

and executing the wind control service for each service main body according to the reason that the abnormal service corresponding to each service main body is identified as the abnormal service, and sending the determined explanation message to the corresponding service main body.

11. The method of claim 1, further comprising:

determining a service main body corresponding to each abnormal service, the type of each service main body and an explanation message of each service main body;

for each type, determining a statistical message of the type according to an explanation message corresponding to the business main body of the type;

aiming at each statistical message, determining an anchor point in the statistical message according to at least one of a service main body and a type of the service main body contained in the statistical message, wherein the anchor point is connected with an explanation message of the service main body contained in the statistical message or is connected with the statistical message of the type of the service main body contained in the statistical message;

responding to the selection operation of a user, and determining a target message;

responding to the clicking operation of the user on the anchor point in the target message, and displaying a statistical message or an explanation message corresponding to the clicked anchor point;

and responding to the determination operation of the user, and sending the statistical message or the explanation message determined by the user to an object executing the wind control service.

12. A wind control device comprising:

the reason propagation module is used for determining the reason that the remaining abnormal business is identified as the abnormal business according to the similarity between the remaining abnormal business and each typical business and the reason that each typical business is identified as the abnormal business;

13. A computer-readable storage medium, in which a computer program is stored which, when being executed by a processor, carries out the method according to any one of claims 1 to 11.

14. An electronic device comprising a memory, a processor and a computer program stored on the memory and executable on the processor, the processor implementing the method of any one of claims 1 to 11 when the program is executed by the processor.