CN117196651A

CN117196651A - Enterprise abnormity monitoring method and device based on data asynchronous processing and storage medium

Info

Publication number: CN117196651A
Application number: CN202311002193.XA
Authority: CN
Inventors: 陈炜; 王玉; 张丽玮; 姜鳗芮
Original assignee: CAPITAL UNIVERSITY OF ECONOMICS AND BUSINESS
Current assignee: CAPITAL UNIVERSITY OF ECONOMICS AND BUSINESS
Priority date: 2023-08-09
Filing date: 2023-08-09
Publication date: 2023-12-08
Anticipated expiration: 2043-08-09

Abstract

The application discloses an enterprise exception monitoring method and device based on data asynchronous processing and a storage medium. The method comprises the following steps: determining enterprise data information, first characteristic information, second characteristic information, enterprise correlation information and enterprise anomaly information related to predetermined indexes of a plurality of enterprises in a data asynchronous processing mode, and storing the determined information into different data storage layers; determining a plurality of sampling days corresponding to the query request; and determining a critical enterprise that needs to be monitored and a critical anomaly conductive path that indicates a time path for anomaly propagation. The method solves the problems that the influence of abnormal enterprises on other related enterprises cannot be accurately analyzed, the influence of the abnormal enterprises on the enterprise state is analyzed through manpower, the operation such as the enterprise which is easy to be influenced, the abnormal conduction path, the enterprise state which changes in real time and the like are determined, the accuracy rate is low, the efficiency is low, and the data analysis result cannot be fed back rapidly.

Description

Enterprise abnormity monitoring method and device based on data asynchronous processing and storage medium

Technical Field

The present application relates to the field of information technologies, and in particular, to an enterprise exception monitoring method and apparatus based on data asynchronous processing, and a storage medium.

Background

With the development of computer technology, big data and artificial intelligence technology are applied to prevent the occurrence, propagation and spread of enterprise anomalies. Enterprise anomalies include, for example, enterprise power usage anomalies, and the like. Because of the business associations between enterprises, there are also cases of propagation and diffusion of enterprise anomalies. By means of big data analysis, the system can analyze characteristic information of enterprises, find out enterprises which are likely to trigger abnormality, and analyze abnormal conduction paths of the enterprises. Therefore, the corresponding enterprises can be monitored in advance to avoid the occurrence, the propagation and the diffusion of larger anomalies.

Among them, in order to accurately analyze abnormal enterprises and abnormal conduction paths, various algorithm models are used to analyze characteristic information of the enterprises. Wherein the different states correspond to abnormal states of the enterprise in which characteristic divergence occurs. Therefore, the system can analyze the individual abnormal state of each enterprise through the characteristic information of the enterprise.

However, the existing analysis model does not consider the difference of contribution rates of the transmission source enterprises in the abnormal conduction process and the difference of the abnormal resistance of the non-abnormal enterprise individuals. And when the enterprise features diverge greatly, the influence of the abnormal enterprise on other related enterprise features cannot be analyzed timely. For example, when power consumption is abnormal, some enterprises have characteristic extreme divergence phenomenon, and at present, the influence of abnormal enterprises on enterprises which have not have the characteristic extreme divergence can only be analyzed by manually collecting data. The analysis efficiency of the manually collected data is very low, so that some key relation information can be omitted and individual variability of enterprises can be ignored. In particular, manual de-analysis is difficult to implement when considering dynamic associations and individual variability.

Moreover, such businesses may not only affect other associated businesses through one channel, requiring more possible channels to be mined. How to effectively analyze the influence scope of the scattered enterprises on other related enterprises in a certain channel in time and identify the easily affected enterprises and abnormal conduction paths, which is very helpful to the enterprise management and investment decision making in advance for abnormal prevention and control. However, by manually collecting materials, the influence range of the widely dispersed enterprises on other related enterprises cannot be analyzed, so that the enterprises and abnormal conduction paths which are easy to be influenced cannot be accurately identified.

In addition, the existing technology simply classifies the states of the enterprise (abnormal states, abnormal states which are easy to occur, latent states, immune states and the like) according to the attributes of the enterprise, and does not consider that the states of the enterprise change in real time according to the time. In addition, the prior art determines the process of simulating the abnormal propagation, does not consider the real enterprise state of the enterprise, and does not consider that the enterprise state of the propagation source enterprise of the power consumption divergence abnormality in reality is not fixed. Real-time changes in enterprise status are also difficult to analyze by manually gathering materials, making it difficult to accurately determine the source enterprise that caused the anomaly.

In the prior art, the influence of the abnormal enterprise on other related enterprise features can be determined according to the feature information of the enterprise, the influence of the abnormal enterprise on the enterprise features is analyzed, and the enterprise which is easy to be influenced, the abnormal conduction path and the enterprise state which changes in real time are determined.

For the above operation, when the data is analyzed in real time, the analysis time is long because the data is huge and the analysis quantity is huge. When the analysis result needs to be determined immediately, the data analysis result cannot be fed back quickly obviously in a real-time analysis mode.

Aiming at the problems that the prior art cannot accurately analyze the influence of abnormal enterprises on other related enterprises and the influence of the abnormal enterprises on the enterprise state by manually collecting materials, the operation such as the easily influenced enterprises, abnormal conduction paths, the enterprise state which changes in real time and the like is determined, the accuracy and the efficiency are low, and the data analysis result cannot be fed back rapidly due to the large calculation amount of real-time analysis, no effective solution is proposed at present.

Disclosure of Invention

The embodiment of the application provides an enterprise exception monitoring method, device and storage medium for asynchronous data processing, which at least solve the technical problems that in the prior art, the influence of an exception enterprise on other related enterprises cannot be accurately analyzed through the existing model, the influence of the exception enterprise on the enterprise state is analyzed through manually collecting materials, the operations such as the enterprise which is easy to be affected, an exception conduction path, the enterprise state which changes in real time and the like are determined, the accuracy rate is low, the efficiency is low, and the data analysis result cannot be fed back quickly due to the large calculation amount of real-time analysis.

According to one aspect of the embodiment of the application, there is provided an enterprise exception monitoring method based on data asynchronous processing, including: determining enterprise data information, first characteristic information, second characteristic information, enterprise correlation information and enterprise anomaly information related to predetermined indexes of a plurality of enterprises in a data asynchronous processing mode, and storing the determined information into different data storage layers; responding to a query request input by a user, and determining a plurality of sampling days corresponding to the query request; and determining a critical enterprise to be monitored and a critical abnormal conduction path indicating a time path of abnormal propagation according to the determined plurality of sampling days and enterprise abnormal information corresponding to the plurality of sampling days, wherein the first characteristic information is used for indicating the change condition of enterprise data information of the corresponding enterprise between adjacent sampling days, the second characteristic information is used for indicating the fluctuation condition of the enterprise data information of the corresponding enterprise and the intensity of upward change of the enterprise data information, the correlation information is used for indicating the correlation between the first characteristic information of the plurality of enterprises in a sliding time window corresponding to the corresponding sampling days, and the enterprise abnormal information is used for indicating whether each sampling day of the enterprise in an abnormal conduction period corresponding to the corresponding sampling day is in an abnormal state and the probability of becoming in the abnormal state.

According to another aspect of an embodiment of the present application, there is also provided a storage medium including a stored program, wherein the method of any one of the above is performed by a processor when the program is run.

According to another aspect of the embodiment of the present application, there is also provided an enterprise exception monitoring apparatus based on data asynchronous processing, including: the first determining module is used for determining enterprise data information, first characteristic information, second characteristic information, enterprise correlation information and enterprise abnormality information related to the preset indexes of a plurality of enterprises in a data asynchronous processing mode, and storing the determined information into different data storage layers; the second determining module is used for responding to the query request input by the user and determining a plurality of sampling days corresponding to the query request; and a third determining module for determining, according to the determined plurality of sampling days and the enterprise anomaly information corresponding to the plurality of sampling days, a critical enterprise to be monitored and a critical anomaly conduction path indicating a time path of anomaly propagation, wherein the first characteristic information is used for indicating a variation condition of enterprise data information of the respective enterprise between adjacent sampling days, the second characteristic information is used for indicating a fluctuation condition of the enterprise data information of the respective enterprise and an intensity of upward variation of the enterprise data information, the correlation information is used for indicating correlation between the first characteristic information of the plurality of enterprises within a sliding time window corresponding to the respective sampling days, and the enterprise anomaly information is used for indicating whether each sampling day of the enterprise within the anomaly conduction period corresponding to the respective sampling day is an anomaly state and a probability of becoming an anomaly state.

According to another aspect of the embodiment of the present application, there is also provided an enterprise exception monitoring apparatus based on data asynchronous processing, including: a processor; and a memory, coupled to the processor, for providing instructions to the processor for processing the steps of: determining enterprise data information, first characteristic information, second characteristic information, enterprise correlation information and enterprise anomaly information related to predetermined indexes of a plurality of enterprises in a data asynchronous processing mode, and storing the determined information into different data storage layers; responding to a query request input by a user, and determining a plurality of sampling days corresponding to the query request; and determining a critical enterprise to be monitored and a critical abnormal conduction path indicating a time path of abnormal propagation according to the determined plurality of sampling days and enterprise abnormal information corresponding to the plurality of sampling days, wherein the first characteristic information is used for indicating the change condition of enterprise data information of the corresponding enterprise between adjacent sampling days, the second characteristic information is used for indicating the fluctuation condition of the enterprise data information of the corresponding enterprise and the intensity of upward change of the enterprise data information, the correlation information is used for indicating the correlation between the first characteristic information of the plurality of enterprises in a sliding time window corresponding to the corresponding sampling days, and the enterprise abnormal information is used for indicating whether each sampling day of the enterprise in an abnormal conduction period corresponding to the corresponding sampling day is in an abnormal state and the probability of becoming in the abnormal state.

In the embodiment of the application, the enterprise relevance determining module calculates relevance information among enterprises according to the characteristic information of each enterprise on each sampling day, so as to obtain an enterprise characteristic network (namely, relevance information) for reflecting the relevance among the enterprises. The enterprise status determination module may then determine, based on the enterprise feature network, an impact of the abnormal enterprise on other associated enterprise features. Compared with the prior art, the technical scheme can accurately analyze the influence of the abnormal enterprises on other related enterprise characteristics, and does not need to collect analysis materials by manpower. Thereby ensuring the accuracy of information analysis and improving the analysis efficiency.

And the enterprise state determining module determines a propagation source enterprise according to the divergence rate of the current day on the first sampling day of the abnormal conduction period, and then determines non-abnormal state enterprises with different abnormal resistance capacities by using the amplitude change intensity, so that the propagation source is determined according to the actual data of the current day, and the authenticity of the abnormal data is ensured. And the first sampling day of each abnormal conduction period is each sampling day of the corresponding monthly time window in turn, so that the influence of the first sampling day on the subsequent sampling day can be determined according to the first sampling day of each abnormal conduction period, and the influence of each sampling day on the current month in the monthly time window is also determined. Thus, the propagation source enterprises of each sampling day are considered, and the anomalies are more comprehensively identified. In addition, the technical scheme does not depend on manual collection materials, determines the key abnormal conduction path, and avoids the influence of each sampling day in the month to the month by manual analysis, thereby ensuring the accuracy of information analysis and improving the analysis efficiency.

In the technical scheme, the enterprise state determining module updates the initial state according to the initial state of each sampling day and the characteristic information of the enterprise on each sampling day, so as to determine the enterprise state information and the abnormal probability information of the enterprise on the sampling day. So that the determined enterprise status of the enterprise corresponds to the actual form of the enterprise. And the key abnormal conduction path determining module obtains a real and effective key abnormal conduction path and identifies an enterprise with low abnormal resistance according to the enterprise feature network and the abnormal conduction period. And the enterprise state of real-time change is avoided from being determined manually, the accuracy of information analysis is ensured, and the analysis efficiency is improved. Furthermore, in the technical scheme, the key enterprise determining module can monitor the enterprises which are low in abnormal resistance and easy to influence, so that the abnormal enterprises can be truly and effectively blocked from infecting other enterprises which are low in abnormal resistance, and the stability of the enterprises is ensured. Compared with the existing abnormal propagation model which cannot accurately analyze the influence of the abnormal enterprise on other related enterprise characteristics, the technical scheme overcomes the defects of the existing abnormal propagation model, and the influence of the abnormal enterprise on other related enterprise characteristics is not needed to be analyzed through manpower.

In addition, the technical scheme collects enterprise data information in an asynchronous processing mode, extracts characteristic information, calculates enterprise correlation in time according to the characteristic information, and analyzes key enterprises and key abnormal conduction paths. When a user needs to inquire the enterprise correlation information, the key enterprise or the key abnormal conduction path, the technical scheme does not need to perform a large amount of data calculation in real time, and the corresponding data analysis result can be fed back quickly and timely by reading and calling the enterprise abnormal information which is determined and stored in advance, so that the data feedback speed is improved. And further solves the technical problem that the data analysis result cannot be fed back quickly in the prior art.

Drawings

The accompanying drawings, which are included to provide a further understanding of the application and are incorporated in and constitute a part of this specification, illustrate embodiments of the application and together with the description serve to explain the application and do not constitute a limitation on the application. In the drawings:

FIG. 1 is a block diagram of the hardware architecture of a computing device for implementing the method according to embodiment 1 of the application;

FIG. 2 is a schematic diagram of an enterprise exception monitoring system based on data asynchronous processing according to embodiment 1 of the present application;

FIG. 3 is a schematic diagram of an enterprise anomaly monitoring platform according to embodiment 1 of the present application;

FIG. 4 is a flow chart of an enterprise exception monitoring method based on data asynchronous processing according to the first aspect of embodiment 1 of the present application;

FIG. 5 is a schematic diagram of an enterprise exception information table according to embodiment 1 of the present application;

FIG. 6 is a flow chart of determining update status according to embodiment 1 of the present application;

FIG. 7 is a schematic diagram of a monitoring device for an abnormal enterprise according to embodiment 2 of the present application; and

FIG. 8 is a schematic view of a monitoring device for abnormal enterprises according to embodiment 3 of the present application

Detailed Description

In order to enable those skilled in the art to better understand the technical solution of the present application, the technical solution of the present application in the embodiment of the present application will be clearly and completely described below with reference to the accompanying drawings in the embodiment of the present application. It will be apparent that the described embodiments are merely some, but not all embodiments of the application. All other embodiments, which can be made by those skilled in the art based on the embodiments of the present application without making any inventive effort, shall fall within the scope of the present application.

It should be noted that the terms "first," "second," and the like in the description and the claims of the present application and the above figures are used for distinguishing between similar objects and not necessarily for describing a particular sequential or chronological order. It is to be understood that the data so used may be interchanged where appropriate such that the embodiments of the application described herein may be implemented in sequences other than those illustrated or otherwise described herein. Furthermore, the terms "comprises," "comprising," and "having," and any variations thereof, are intended to cover a non-exclusive inclusion, such that a process, method, system, article, or apparatus that comprises a list of steps or elements is not necessarily limited to those steps or elements expressly listed but may include other steps or elements not expressly listed or inherent to such process, method, article, or apparatus.

Example 1

According to the present embodiment, a method embodiment of an enterprise anomaly monitoring method is provided, and it should be noted that the steps illustrated in the flowchart of the drawing may be performed in a computer system such as a set of computer executable instructions, and that although a logical order is illustrated in the flowchart, in some cases, the steps illustrated or described may be performed in an order other than that illustrated herein.

The method embodiments provided by the present embodiments may be performed in a mobile terminal, a computer terminal, a server, or similar computing device. FIG. 1 illustrates a block diagram of a hardware architecture of a computing device for implementing an enterprise exception monitoring method. As shown in fig. 1, the computing device may include one or more processors (which may include, but are not limited to, a microprocessor MCU, a programmable logic device FPGA, etc., processing means), memory for storing data, and transmission means for communication functions. In addition, the method may further include: a display, an input/output interface (I/O interface), a Universal Serial Bus (USB) port (which may be included as one of the ports of the I/O interface), a network interface, a power supply, and/or a camera. It will be appreciated by those of ordinary skill in the art that the configuration shown in fig. 1 is merely illustrative and is not intended to limit the configuration of the electronic device described above. For example, the computing device may also include more or fewer components than shown in FIG. 1, or have a different configuration than shown in FIG. 1.

It should be noted that the one or more processors and/or other data processing circuits described above may be referred to herein generally as "data processing circuits. The data processing circuit may be embodied in whole or in part in software, hardware, firmware, or any other combination. Furthermore, the data processing circuitry may be a single stand-alone processing module, or incorporated in whole or in part into any of the other elements in the computing device. As referred to in embodiments of the application, the data processing circuit acts as a processor control (e.g., selection of the path of the variable resistor termination connected to the interface).

The memory may be used to store software programs and modules of application software, such as program instructions/data storage devices corresponding to the enterprise anomaly monitoring method in the embodiments of the present application, and the processor executes the software programs and modules stored in the memory, thereby executing various functional applications and data processing, that is, implementing the enterprise anomaly monitoring method of the application program. The memory may include high speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid state memory. In some examples, the memory may further include memory remotely located with respect to the processor, which may be connected to the computing device via a network. Examples of such networks include, but are not limited to, the internet, intranets, local area networks, mobile communication networks, and combinations thereof.

The transmission means is used for receiving or transmitting data via a network. Specific examples of the network described above may include a wireless network provided by a communications provider of the computing device. In one example, the transmission means includes a network adapter (NetworkInterfaceController, NIC) that can be connected to other network devices via a base station to communicate with the internet. In one example, the transmission device may be a Radio Frequency (RF) module, which is used to communicate with the internet wirelessly.

The display may be, for example, a touch screen type Liquid Crystal Display (LCD) that may enable a user to interact with a user interface of the computing device.

It should be noted herein that in some alternative embodiments, the computing device shown in FIG. 1 described above may include hardware elements (including circuitry), software elements (including computer code stored on a computer-readable medium), or a combination of both hardware and software elements. It should be noted that fig. 1 is only one example of a particular specific example and is intended to illustrate the types of components that may be present in the computing devices described above.

Fig. 2 is a schematic diagram of an enterprise anomaly monitoring system according to the present embodiment. Referring to fig. 2, the system includes a user terminal device 100 and an enterprise anomaly monitoring platform 200. The enterprise abnormality monitoring platform acquires data related to each enterprise from the Internet and analyzes the data, so that abnormality of the enterprise is monitored. And the enterprise monitoring platform 200 is in communication connection with the user terminal device 100, and is configured to return corresponding enterprise exception information to the user according to the query request sent by the user.

In addition, FIG. 3 shows an architecture diagram of the enterprise anomaly monitoring platform 200 depicted in FIG. 2. Referring to fig. 3, the platform includes: a data source; a data acquisition layer; an ETL layer; a data storage layer; and an application layer.

Wherein the data collection layer collects daily enterprise data information for each enterprise from the data sources, wherein the enterprise data information may be, for example, enterprise data information related to a predetermined index, and in particular, the predetermined index may be, for example, enterprise data information related to daily power consumption of the enterprise.

And the ETL layer performs ETL processing on the acquired enterprise data information of each enterprise, and stores the enterprise data information after the ETL processing to an enterprise information data table of the first data storage layer. And referring to fig. 3, enterprise anomaly monitoring platform 200 is deployed with a plurality of different data storage layers. The first data storage layer is provided with an enterprise data information table, the second data storage layer is provided with a first characteristic information table and a second enterprise information characteristic table, the third data storage layer is provided with an enterprise correlation information table, and the fourth data storage layer is provided with an enterprise abnormal information table. With respect to each data table, which will be described in detail below.

The application layer comprises an enterprise characteristic information extraction module, an enterprise relevance determination module, an abnormal conduction period determination module, an enterprise state determination module and a query processing module.

The enterprise characteristic information extraction module is used for determining first characteristic information and second characteristic information related to the preset indexes according to enterprise data information in the first data storage layer, storing the first characteristic information in a first characteristic information table of the second data storage layer and storing the second characteristic information in a second characteristic information table.

The enterprise correlation determination module is used for calculating correlation among the first characteristic information of each enterprise according to the first characteristic information of each enterprise on each sampling day stored in the first characteristic information table of the second data storage layer, so that enterprise correlation information tables corresponding to different sampling dates are created in the third data storage layer.

The abnormal conduction period determination module is to determine abnormal conduction periods corresponding to respective month time windows. Wherein the abnormal conduction period is determined according to the time length from each sampling day of the month time window to the last sampling day of the month time window.

The enterprise state determination module is configured to obtain enterprise-related information corresponding to each sampling day of each abnormal conduction period from an enterprise-related information table in the third data storage layer corresponding to each sampling day of each abnormal conduction period, and obtain second feature information corresponding to each sampling day of each abnormal conduction period from a second feature information table in the second data storage layer. And the enterprise state determining module determines enterprise abnormal information of each enterprise in each sampling day of each abnormal conduction period according to the acquired enterprise correlation information and the second characteristic information. And the enterprise state determining module creates an enterprise abnormal information table corresponding to each month in the fourth data storage layer according to the determined enterprise abnormal information. And the enterprise status determination module sends the determined enterprise exception information to the query processing module.

The query processing module receives a query request of the user terminal device 100, obtains each month corresponding to the query request according to the received query request, and obtains the abnormal information of each enterprise from the corresponding enterprise abnormal information table in the fourth data storage layer. Or the query processing module determines a month time window in which the enterprise abnormal information needs to be additionally calculated, and sends the information of the month time window to the enterprise state determining module, and the enterprise state determining module determines the enterprise abnormal information corresponding to the month time window. Then, the query processing module determines, according to the enterprise anomaly information obtained from the enterprise status determining module and the enterprise anomaly information table, a key enterprise to be monitored and a key anomaly conduction path indicating a time path of anomaly propagation, and returns the key anomaly conduction path as a query result to the user terminal device 100.

In the above-described operating environment, according to the first aspect of the present embodiment, there is provided an enterprise anomaly monitoring method based on data asynchronous processing, which is implemented by the enterprise anomaly monitoring platform 200. Fig. 4 shows a schematic flow chart of the method, and referring to fig. 4, the method includes:

S402: determining enterprise data information, first characteristic information, second characteristic information, enterprise correlation information and enterprise anomaly information related to predetermined indexes of a plurality of enterprises in a data asynchronous processing mode, and storing the determined information into different data storage layers;

s404: responding to a query request input by a user, and determining a plurality of sampling days corresponding to the query request; and

s406: and determining a key enterprise to be monitored and a key abnormal conduction path indicating a time path of abnormal propagation according to the determined sampling days and the enterprise abnormal information corresponding to the sampling days. Wherein the method comprises the steps of

The first characteristic information is used for indicating the change condition of the enterprise data information of the corresponding enterprise between adjacent sampling days, the second characteristic information is used for indicating the divergence condition of the enterprise data information of the corresponding enterprise and the intensity of the upward change of the enterprise data information, the correlation information is used for indicating the correlation between the first characteristic information of a plurality of enterprises in a sliding time window corresponding to the corresponding sampling days, and the enterprise abnormal information is used for indicating whether each sampling day of the enterprise in an abnormal conduction period corresponding to the corresponding sampling day is in an abnormal state and the probability of being in the abnormal state.

Specifically, referring to fig. 3, the data collection layer of the enterprise anomaly monitoring platform 200 is configured to collect enterprise data information of m enterprises, respectively, enterprise 1 to enterprise m, at a first time point of asynchronous processing. Where enterprise is denoted by "E", i.e., enterprise 1-enterprise m are identified as E ₁ ～E _m . Hereinafter also labeled E _i ，i＝1～m。

So that the data acquisition layer acquires the enterprise E in real time ₁ ～E _m Related enterprise data information. And after the enterprise data information acquired by the data acquisition layer in real time is processed by the ETL layer, the enterprise data information is stored in an enterprise data information table of the first data storage layer. The enterprise data information table stores the data of the enterprise E for each sampling day ₁ ～E _m Enterprise data information corresponding to the predetermined index of (c). For example, the predetermined index may be a power consumption amount, so that the enterprise E may be stored in the enterprise data information table ₁ ～E _m Power usage data information at each sampling day.

The enterprise feature information extraction module of the enterprise anomaly monitoring platform 200 determines enterprise E at a second point in time of the asynchronous process ₁ ～E _m Is provided, and the first characteristic information and the second characteristic information of the same. Wherein the first characteristic information is used to indicate a change in enterprise data information of the same enterprise between adjacent sampling days. Taking electricity consumption as an example, the first characteristic information is the difference value between the electricity consumption of two adjacent sampling days of the enterprise after logarithmic transformation. Thus, the first characteristic information can be used for reflecting the enterprises of the same enterprises between the adjacent sampling days The change of the data information. The second characteristic information includes a divergence rate and an amplitude variation intensity, wherein the divergence rate is used to indicate the divergence condition of the first characteristic information of the enterprise in the same sampling day, and may be, for example, a square sum of the first characteristic information of the enterprise in a period of time from the end of the sampling day. The amplitude change intensity is used to describe the change intensity of the amplitude of the enterprise data information of the same enterprise in the same sampling day, for example, taking electricity consumption as an example, and the amplitude change intensity can be determined by the following formula:

QRI＝MA/(MA+MB)

wherein QRI represents the magnitude variation intensity; MA represents the average number of power consumption rises within a period of time up to the corresponding sampling day; MB represents the average of the drop in power consumption up to the corresponding sampling day.

Then, the enterprise feature information extraction module stores the first feature information into a first feature information table of the second data storage layer and stores the second feature information into a second feature information table of the second data storage layer.

And, the enterprise relevance determination module of the enterprise exception monitoring platform 200 determines enterprise E at a third point in time of the asynchronous process ₁ ～E _m Is used for the correlation information of the video signal. And storing the relevance information in an enterprise relevance information table of the third data storage layer according to the determined relevance information. Specifically, the correlation information will be described in detail later.

And, the abnormal conduction period determination module and the enterprise status determination module of the enterprise abnormal monitoring platform 200 determine each of the risk conduction periods corresponding to the respective months, and each of the enterprises E, at a fourth point in time of the asynchronous process ₁ ～E _m Enterprise anomaly information at each anomalous conduction period. Wherein the enterprise anomaly information is used to indicate whether an enterprise is in an abnormal state and a probability of becoming in an abnormal state for each sampling day within the abnormal conduction period corresponding to the respective sampling day. Regarding the abnormal conduction period and the enterprise abnormal information, detailed description will be made later.

Then, when the user transmits a query request (for example, the query request, requesting an enterprise anomaly monitoring query for a plurality of sampling days included in a period of time) to the enterprise anomaly monitoring platform 200 through the user terminal device 100, the enterprise anomaly monitoring platform 200 receives the query request from the user terminal device 100 and determines a plurality of sampling days, for example, sampling days in 2014-10-20 to 2016-12-02, based on the query request. And then the enterprise anomaly monitoring platform 200 acquires the enterprise anomaly information contained in the corresponding enterprise anomaly information table from the fourth data storage layer according to the plurality of sampling days. And determining key enterprises and key abnormal conduction paths to be monitored according to the determined sampling days and the enterprise abnormal information corresponding to the determined sampling days, and feeding the determined information back to the user terminal equipment 100 as a query result. In particular, the method of determining critical businesses and critical abnormal conductive paths will be described in detail below.

As described in the background, the existing analysis model does not consider the difference of the contribution rate of the transmission source enterprise in the abnormal transmission process and the difference of the abnormal resistance of the non-abnormal enterprise individuals. And when the fluctuation of enterprise characteristics is large, the influence of abnormal enterprises on other related enterprise characteristics cannot be analyzed timely. For example, when power consumption is abnormal, characteristic extreme fluctuation phenomenon occurs in some enterprises, and at present, the influence of abnormal enterprises on enterprises which have not occurred characteristic extreme fluctuation can only be analyzed by manually collecting data. The analysis efficiency of the manually collected data is very low, so that some key relation information can be omitted and individual variability of enterprises can be ignored. In particular, manual de-analysis is difficult to implement when considering dynamic associations and individual variability.

Moreover, such businesses may not only affect other associated businesses through one channel, requiring more possible channels to be mined. How to analyze the influence range of the enterprise with large fluctuation on other related enterprises on a certain channel timely and effectively, and identify the easily affected enterprises and abnormal conduction paths, which is very helpful for the enterprise management and investment decision to make abnormal prevention and control in advance. However, the influence range of the enterprise with large fluctuation on other related enterprises cannot be analyzed in time by manually collecting materials, so that the enterprise and the abnormal conduction path which are easy to be influenced cannot be accurately identified.

In addition, the existing technology simply classifies the states of the enterprise (abnormal states, abnormal states which are easy to occur, latent states, immune states and the like) according to the attributes of the enterprise, and does not consider that the states of the enterprise change in real time according to the time. In addition, the prior art determines the process of simulating the abnormal propagation, does not consider the real enterprise state of the enterprise, and does not consider that the enterprise state of the propagation source enterprise of the abnormal power consumption fluctuation in reality is not fixed. Real-time changes in enterprise status are also difficult to analyze by manually gathering materials, making it difficult to accurately determine the source enterprise that caused the anomaly.

In view of the above technical problems, the enterprise relevance determining module calculates relevance information between enterprises according to the characteristic information of each enterprise on each sampling day, so as to obtain an enterprise characteristic network (i.e. relevance information) for reflecting the relevance between enterprises. The enterprise status determination module may then determine, based on the enterprise feature network, an impact of the abnormal enterprise on other associated enterprise features. Compared with the prior art, the technical scheme can accurately analyze the influence of the abnormal enterprises on other related enterprise characteristics, and does not need to collect analysis materials by manpower. Thereby ensuring the accuracy of information analysis and improving the analysis efficiency.

Optionally, determining, by means of data asynchronous processing, enterprise data information related to predetermined indicators of a plurality of enterprises, first feature information, second feature information, enterprise correlation information, and enterprise anomaly information, and storing the determined information in different data storage layers, including: collecting enterprise data information of a plurality of enterprises on each sampling day, and updating an enterprise data information table arranged on a first data storage layer according to the collected enterprise data information; after updating the enterprise data information table on each sampling day, determining first characteristic information and second characteristic information of a plurality of enterprises, and updating a characteristic information table arranged on a second data storage layer according to the determined first characteristic information and second characteristic information, wherein the characteristic information table indexes the first characteristic information and the second characteristic information by the identification and date of the enterprises; after the characteristic information table is updated on each sampling day, determining enterprise correlation information corresponding to the sampling day according to first characteristic information recorded in the characteristic information table, and creating an enterprise correlation information table corresponding to the enterprise correlation information in a third data storage layer, wherein each enterprise correlation information table is indexed through the corresponding sampling day; and on the last sampling day of each month, performing the following operations: determining an abnormal conduction period corresponding to a plurality of sampling days of the month respectively with the month as one month time window, wherein the abnormal conduction period extends from the corresponding sampling day to the last sampling day of the corresponding month time window; acquiring second characteristic information of a plurality of enterprises on a plurality of sampling days of the month from the characteristic information table and acquiring enterprise correlation information corresponding to the plurality of sampling days of the month from an enterprise correlation information table corresponding to the plurality of sampling days of the month; and determining enterprise anomaly information corresponding to each sampling day in the abnormal conduction period of the month according to the second characteristic information corresponding to the plurality of sampling days of the month and the correlation information corresponding to the plurality of sampling days of the month, and creating an enterprise anomaly information table corresponding to the month in a fourth data storage layer according to the determined enterprise anomaly information, wherein the enterprise anomaly information comprises enterprise state information and anomaly probability information, the enterprise state information is used for indicating whether each sampling day of the enterprise in the abnormal conduction period is in an anomaly state or not, and the anomaly probability information is used for indicating the probability that each sampling day of the enterprise in the abnormal conduction period is in an anomaly.

Specifically, for example, a working day is taken as the sampling day described in the present embodiment. The data asynchronous processing then consists of two parts:

(one) operations performed every sampling day

1) Enterprise data information is collected, and an enterprise data information table of the first data storage layer is updated according to the collected enterprise data information:

for example, on sampling day 2014, 10 and 20, the data collection layer and the ETL layer of the enterprise anomaly monitoring platform 200 collect data on the internet to obtain enterprise data information (e.g., electricity consumption) corresponding to each enterprise on sampling day 2014, 10 and 20. The enterprise data information may include, for example, enterprise data information corresponding to the day of the sampling day (e.g., the amount of electricity used for the day), and enterprise data information for various time periods (e.g., each hour) of the sampling day. Further, the data collection layer and the ETL layer update the enterprise data information to the enterprise data information table of the first data storage layer. By analogy, on each sampling day, the enterprise anomaly monitoring platform 200 collects enterprise data information corresponding to the sampling day and updates it to the enterprise data information table.

2) Extracting first characteristic information and second characteristic information from the updated enterprise data information table:

specifically, after the enterprise data information table is updated, an enterprise information extraction module of the enterprise anomaly monitoring platform extracts the first feature information and the second feature information from the updated enterprise data information table.

1. Extracting first characteristic information

The first characteristic information is used for indicating the difference value between the electricity consumption of two adjacent sampling days of the enterprise after logarithmic transformation. For example, for 20 days of 10 months 2014, enterprise E ₁ Is used to indicate the log transformed difference between the business data information (e.g., electricity usage) at 10, 20, 2014 and the business data information (e.g., electricity usage) at 10, 19, 2014. Further, for day 21 of 10.2014, enterprise E ₁ Is used to indicate the log-transformed difference between the business data information (e.g., electricity usage) at month 21 of 2014 and the business data information (e.g., electricity usage) at month 10 of 2014. And so on. So that for each business E on each sampling day ₁ ～E _m After the enterprise data information table completes updating of the enterprise data information of the sampling date, the enterprise feature information extraction module extracts first feature information corresponding to the sampling date according to the updated enterprise data information, and updates the extracted first feature information to the first feature information table of the second data storage layer.

For example, table 1 below shows the first characteristic information SYL of each sampling day of each business. Referring to Table 1, E ₁ Is 0001.hk _m Enterprise name 300406.SZ, sampling day 2014-10-20-2016-12-02, thus Table 1 describes enterprise E ₁ ～E _m First characteristic information SYL of each of sampling days 2014-10-20 to 2016-12-02.

TABLE 1

2. Extracting second characteristic information

In addition, after the enterprise data information table is updated, the enterprise feature information extraction module also extracts second feature information corresponding to the sampling date from the updated enterprise data information. Wherein the second characteristic information includes divergence rate and magnitude change intensity. Wherein the divergence rate is used to reflect the divergence of the first characteristic information of the same business on the sampling day, and the divergence degree can be determined by calculating the square sum of the first characteristic information of the business within a period of time from the business to the sampling day. The amplitude change intensity is used for indicating the intensity of amplitude change of the enterprise in the process of changing the enterprise data information. For example, for a certain sampling day, the magnitude change intensity of the enterprise may be determined by the formula described above.

Specifically, at 10 and 20 days 2014, the enterprise feature information extraction module will be based on enterprise E ₁ And the electricity consumption of each time period of the sampling day, and the determined enterprise E ₁ The sum of squares of the electricity consumption amounts at 10 and 20 days 2014 is taken as the divergence rate. And according to the method, the enterprise characteristic information extraction module can determine the enterprise E ₁ The magnitude of the electricity consumption amount varies intensity at 10 and 20 days 2014. Similarly, the enterprise feature information extraction module may determine enterprise E ₁ ～E _m The magnitude of the electricity consumption amount varies intensity at 10 and 20 days 2014. And updating the second characteristic information table according to the determined amplitude variation intensity. Further, on each sampling day, the enterprise feature information extraction module can determine enterprise E ₁ ～E _m And the amplitude change intensity of the electricity consumption in the sampling day is updated to the second characteristic information table.

3) After the feature information table is updated, determining enterprise relevance information according to the updated first feature information

Specifically, taking the example of 10-20 th of the sampling date 2015, after the enterprise feature information extraction module has updated the first feature information table and the second feature information table, the enterprise correlation determination module acquires first feature information related to each enterprise from the first feature information table, and calculates correlation information corresponding to the 10-20 th of the sampling date 2015.

Specifically, the enterprise relevance determination module determines, for each sampling day, a sliding time window corresponding to the sampling day. Suppose that 10/20/2015 is the j-th sampling day that can be associated with a sliding time windowThe enterprise relevance determination module determines that the sliding time window corresponding to the jth sampling day is marked with win _j . Where j=1 to n.

More specifically, each sliding time window win _j The number of sampling days contained is h _j Wherein h is _j Is a natural number. And with a sliding time window win _j The corresponding j-th sampling day is the last sampling day in the sliding time window. For example, for the j-th sampling day 2015, 10 months and 20 days, the last sampling day of the sliding time window corresponding to the j-th sampling day is 2015, 10 months and 20 days.

Within each sliding time window there is a predetermined number of sampling days DA _j,k 。DA _j,k Representing the kth sampling day in the jth sliding time window. Wherein for the jth sliding time window win _j ，k＝1～h _j 。

For example, in the present embodiment the window length of the sliding time window (i.e. the sampling day involved) may be 250 sampling days each, i.e. h _j =250, j=1 to n. The sliding step size of the adjacent sliding time window is 1 sampling day. For example, in a first sliding time window win associated with a first sampling day (2015, 10, 12 days) in which the sliding window can be associated ₁ The first sampling day of (2) is 2014, 10, 15, the second sampling day of the sliding time window is 2014, 10, 16, and so on, the sliding time window win ₁ The last sampling day of (2) is 2015, 10, 12.

Further, for the sampling day 2015, 10 and 13, which is 10 and 12 years after the sampling day 2015, a second sliding time window win corresponding to the sampling day can be determined ₂ . In a second sliding time window win ₂ In the sliding time window, the first sampling day is 2014-10-16, the second sampling day is 2014-10-17, and the last sampling day is 2015, 10 and 13.

By analogy, for each sampling day, a sliding time window corresponding thereto may be determined.

Further, for the jth sample day, enterprise E _i In sliding time window win _j Each sampling day DA of (3) _j,k Are all corresponding to a first enterprise feature information SYL _i,j,k . Wherein SYL is _i,j,k First characteristic information representing a kth sampling day of an ith business in a jth sliding time window. For example, the first characteristic information of the first business on the first sampling day in the first sliding time window is the first characteristic information of business 0001.HK on days 2014-10-15.

Then, for the jth sampling day, the enterprise relevance determination module determines a sliding time window win based on the determined _j And determining the correlation information corresponding to the sampling day according to the first characteristic information of each enterprise on each transaction day. Specifically, table 2 shows first characteristic information of a plurality of enterprises within a jth sliding time window corresponding to a jth transaction day. Referring to Table 2, the vector of the first characteristic information of the ith enterprise in the jth sliding time windowThe formula can be expressed as: />

For example, the vector of first characteristic information for the jth sliding time window of the first enterprise:

vector of first characteristic information of jth sliding time window of second enterprise:

and so on, the vector of the first characteristic information of the jth sliding time window of the mth enterprise:

TABLE 2

Further, for example, the enterprise relevance determining module obtains the first feature information of the enterprise 1 and the enterprise 1 in the j-th sliding time window, and then calculates the relevance information a of the enterprise 1 and the enterprise 1 according to the obtained first feature information through calculation of a predetermined relevance formula _j,1,1 . The correlation information a for enterprise 1 and enterprise 2 in the jth sliding time window may then be calculated _j,1,2 So that the enterprise relevance determining module can calculate and obtain the relevance information a of the jth sliding time window among all enterprises according to the calculation mode of the relevance information _j,x,y (a _j,x,y The correlation information of the enterprise x and the enterprise y in the j-th sliding time window is shown, which will be described in detail later. ).

Further, the enterprise relevance determining module calculates the relevance among all enterprises in the jth sliding time window, and then creates an enterprise relevance information table corresponding to the sampling date in the third data storage layer according to the calculated relevance among all enterprises. Wherein the business relevance information table is indexed by the specific date of the sampling day. And the data in the enterprise correlation information table is stored in a matrix form.

For example, a sliding time window win corresponding to the jth sampling day _j The specific structure of the corresponding enterprise relevance information table is shown as a matrix as follows:

and the enterprise correlation determination module determines an enterprise correlation information table corresponding to each sampling day according to the first characteristic information in the updated first characteristic information table after the first characteristic information table is updated, and stores the enterprise correlation information table in the third data storage layer. And, for different sampling days, different enterprise correlation information tables are generated for indicating correlations among enterprises for the sampling days.

(II) determining enterprise anomaly information corresponding to each of the anomalous conduction periods for each month on the last sampling day of that month

Further, referring to fig. 3, at the last sampling day of each month, the abnormal conduction period determination module of the enterprise abnormal monitoring platform determines the month as a month time window, the abnormal conduction periods respectively corresponding to a plurality of sampling days of the month, wherein the abnormal conduction periods extend from the respective sampling days to the last sampling day of the corresponding month time window.

For example, at the last sampling day of 2016, 3, 31, the abnormal conduction period determination module determines abnormal conduction periods corresponding to a plurality of sampling days of 2016, 3, as a month time window.

Specifically, the abnormal conduction period determination module determines, in each month time window, a plurality of abnormal conduction periods corresponding to each month time window by sliding the sub-window. For example, in a certain month time window, the first sampling day of the first abnormal conduction period is the first sampling day in the month time window, and the last sampling day of the first abnormal conduction period is the last sampling day in the month time window.

In the month time window, the first sampling day of the second abnormal conduction period is the second sampling day in the month time window, and the last sampling day of the second abnormal conduction period is the last sampling day in the month time window.

Similarly, in the month time window, the last abnormal conduction period has only one sampling day, which is the last sampling day in the month time window.

In summary, the abnormal conduction period determining module obtains the first sampling day of the current abnormal conduction period by moving the first sampling day of the previous abnormal conduction period backward by one sampling day in the month time window, and the last sampling day of each abnormal conduction period is the last sampling day of the month time window, so as to determine a plurality of abnormal conduction periods in the month time window.

For example, for month 2016, the first abnormal conduction period in this month time window includes all sampling days from month 2016, month 3, 1, to month 2016, month 3, 31; the second abnormal conduction period includes all sampling days of 2016 month 3 and 2 to 2016 month 3 and 31; the third abnormal conduction period includes all sampling days of 2016 3/3 to 2016 3/31; and so on, the last abnormal conduction period in the month time window includes only 31 days of 2016, 3.

Further, and so on, the abnormal conduction period determination module may determine an abnormal conduction period for each month on the last day of the month.

Then, the enterprise status determination module obtains second characteristic information of the plurality of enterprises on the plurality of sampling days of the month from the characteristic information table and obtains enterprise correlation information corresponding to the plurality of sampling days of the month from an enterprise correlation information table corresponding to the plurality of sampling days of the month.

For example, on the last sampling day of 2016, 3, and 2016, 3, 31, and after determining the abnormal conduction period corresponding to 2016, 3, the business state determination module obtains second characteristic information (i.e., divergence rate and magnitude change intensity) of each business on 2016, 3, 1, and 2016, 3, 31, from the second characteristic information table. The enterprise state determining module also accesses the enterprise correlation information table corresponding to each sampling day of 2016, 3, 1 and 31 from the third data storage layer, and obtains different enterprises E in each sampling day ₁ ～E _m Correlation information between the two.

Then, the enterprise state determination module determines enterprise anomaly information corresponding to each sampling day of the month from the second feature information corresponding to the plurality of sampling days of the month and the correlation information corresponding to the plurality of sampling days of the month, and creates an enterprise anomaly information table corresponding to the month in the fourth data storage layer according to the determined enterprise anomaly information, wherein the enterprise anomaly information includes enterprise state information and anomaly probability information, the enterprise state information is used for indicating whether each sampling day of the enterprise in the anomaly conduction period is an anomaly state, and the anomaly probability information is used for indicating a probability that each sampling day of the enterprise in the anomaly conduction period is an anomaly.

Specifically, the business state determination module determines each business E based on the first abnormal conduction period corresponding to the month 3 of 2016 (i.e., all sampling days from the month 1 of 2016 to the month 31 of 2016), based on the second characteristic information corresponding to each sampling day of the abnormal conduction period (the second characteristic information corresponding to all sampling days from the month 1 of 2016 to the month 31 of 2016), and based on the business correlation information (i.e., the correlation information corresponding to each sampling day is acquired from the business correlation information table corresponding to all sampling days from the month 1 of 2016 to the month 3 of 2016) ₁ ～E _m Enterprise abnormality information corresponding to each of the sampling days of 2016, 3, 1 to 31, respectively.

Then, based on the second abnormal conduction period corresponding to the month 3 of 2016 (i.e., all sampling days from the month 2 of 2016 to the month 31 of 2016), the business state determination module determines each business E based on the second characteristic information corresponding to each sampling day of the abnormal conduction period (the second characteristic information corresponding to all sampling days from the month 2 of 2016 to the month 31 of 2016) and the business correlation information (i.e., the correlation information corresponding to each sampling day is acquired from the business correlation information table corresponding to all sampling days from the month 2 of 2016 to the month 31 of 2016) ₁ ～E _m Enterprise abnormality information corresponding to each sampling day of 2016, 3, 2 and 31, respectively.

By analogy, during the abnormal conduction period corresponding to 31 of 3 in 2016 (i.e., 31 of 3 in 2016 itself), the enterprise status determination module determines based on the second characteristic information corresponding to the sampling date (the second characteristic information corresponding to 31 of 3 in 2016) and the enterprise correlation information (i.e., acquires the corresponding correlation information from the enterprise correlation information table corresponding to 31 of 3 in 2016)Each enterprise E ₁ ～E _m Enterprise anomaly information corresponding to 31/3/2016, respectively.

The enterprise anomaly information comprises enterprise state information and anomaly probability information, wherein the enterprise state information is used for indicating whether each sampling day of an enterprise in an abnormal conduction period is in an abnormal state, and the anomaly probability information is used for indicating the probability that each sampling day of the enterprise in the abnormal conduction period is abnormal. Specific calculation methods will be described in more detail later, and will not be described here again.

Then, the enterprise status determination module creates an enterprise anomaly information table corresponding to the month at the fourth data storage layer based on the determined enterprise anomaly information. Wherein the enterprise anomaly information table records enterprise anomaly information for each enterprise for each sampling day in each anomalous conduction period. For example, fig. 5 shows an enterprise anomaly information table corresponding to month 2016 and 3.

Referring to fig. 5, a cell labeled "×" records enterprise anomaly information corresponding to sampling days in the corresponding anomalous conduction period. And each enterprise E is recorded in the cell ₁ ～E _m Is an enterprise exception information. The cells marked "-" do not document information. The method for determining the abnormal information of the enterprise will be described in detail later, and will not be described herein.

Therefore, the technical scheme can timely determine the first characteristic information and the second characteristic information of the current day by timely collecting the enterprise data information of a plurality of enterprises on each sampling day, and further calculate the enterprise correlation information according to the first characteristic information and the second characteristic information. Thus, the latest enterprise correlation information can be updated in time. And the technical scheme determines the enterprise abnormal information in the abnormal conduction period according to the second characteristic information and the correlation information on the last sampling day of the month, so that the enterprise abnormal information can be determined in time according to the latest enterprise correlation information.

Optionally, determining, according to the determined multiple sampling days and the enterprise anomaly information corresponding to the multiple sampling days, an operation of monitoring a critical enterprise and a critical anomaly conduction path indicating a time path of anomaly propagation, including: determining a month time window corresponding to the query request according to the determined sampling days; acquiring enterprise anomaly information corresponding to the determined first month time window from an enterprise anomaly information table when the sampling days contained in the determined first month time window belong to the same month, and determining enterprise anomaly information corresponding to each sampling day in the anomaly transmission period of the plurality of enterprises and the second month time window according to second characteristic information and correlation information corresponding to a plurality of sampling days of the second month time window when the sampling days contained in the determined second month time window belong to different months; and determining a critical enterprise to be monitored and a critical anomaly conduction path indicating a time path of anomaly propagation by using the enterprise anomaly information acquired based on the first month time window and the enterprise anomaly information determined based on the second month time window.

Specifically, in this embodiment, the query processing module, after receiving the query request from the user, determines the query period corresponding to the query request, for example, in this embodiment, the query period corresponding to the query request is 2015-11-17-2016-12-02. That is, the user wants to determine the critical business and critical abnormal conduction paths that need to be monitored based on the information in the inquiry period. The query processing module then determines a sampling day contained in the query range upon receipt of the query request, and determines a month time window based on the determined sampling day.

For example, the query processing module divides sampling days in a query period corresponding to the query request according to the month. For example, the query time period is 2015-11-17-2016-12-02, the query processing module divides the sampling days in the second study period into month time windows 1-e. Hereinafter described as a month time window L _u U=1 to e, where e is the number of month time windows. Wherein the month time window L _u The sampling diary in (2) is DB _u,p The p-th sampling day of the u-th month time window is indicated. For the month time window L _u ，p＝1～f _u 。f _u For the u-th month time window L _u Is a number of sampling days.

For example, month time window 1 includes sampling days in 2015-11-17-2015-12-31, month time window 2 includes sampling days in 2016-01-2016-01-31, and month time window e includes sampling days in 2016-11-01-2016-12-02. And wherein sampling days less than one month should be incorporated into the adjacent month time window. For example, 2015-11-17-2015-11-30 is incorporated into 2015-12 if it does not exceed one month. 2016-12-01 to 2016-12-02 for less than one month, they are incorporated into 2016-11.

It can be seen that the month time window determined according to the inquiry period is classified into two types: namely, a first month time window of the same month to which the sampling day in the month time window belongs; and a second month time window in which the sampling day within the month time window belongs to a different month.

For example, in the above example, the month time window 1 and the month time window e are the second month time window; the month time windows 2 to e-1 are the first month time windows.

Therefore, according to the technical solution of this embodiment, for the first month time windows, that is, the month time windows 2 to e-1, the query processing module may directly obtain the enterprise exception information table corresponding to the first month time window from the fourth data storage layer. The corresponding enterprise anomaly information does not have to be calculated any more.

However, for the month time window 1 and the month time window e, the query processing module needs to determine the corresponding enterprise exception information.

Thus, according to the present embodiment, since the collected enterprise data information has been analyzed and calculated in advance, the enterprise anomaly information tables corresponding to different months are deployed in advance. Therefore, when a query request of a user is received, enterprise abnormal information is recalculated only for the first month time window and the last month time window in the query period of the query request, and for other month time windows, the enterprise abnormal information table with corresponding month can be directly obtained from the enterprise abnormal information. Therefore, the method greatly reduces the operation amount in the query processing process, and improves the feedback response speed for the query while improving the efficiency.

Optionally, the operation of determining the enterprise correlation information corresponding to the sampling date according to the first feature information recorded in the feature information table includes: and determining the correlation information between any two enterprises in the sliding time window by utilizing a correlation calculation formula according to the first characteristic information of the enterprises in the sliding time window corresponding to the sampling date.

Specifically, in the sliding time window corresponding to each sampling day, the first feature information (i.e., the first feature information) of each enterprise on each sampling day is respectively:

in enterprise 1, the first characteristic information of the sampling day corresponding to the first sliding time window is: SYL _1,1,1 ，SYL _1,1,2 ，...，

In enterprise 2, the first characteristic information of the sampling day corresponding to the first sliding time window is: SYL _2,1,1 ，SYL _2,1,2 ，...，/>

……

In the enterprise m, the first characteristic information of the sampling day corresponding to the first sliding time window is: SYL _m,1,1 ，SYL _m,1,2 ，...，

In the second sliding time window, the first characteristic information of each enterprise on each sampling day is respectively:

in enterprise 1, the first characteristic information of the sampling day corresponding to the second sliding time window is: SYL _1,2,1 ，SYL _1,2,2 ，...，

In enterprise 2, the first characteristic information of the sampling day corresponding to the second sliding time window is: SYL _2,2,1 ，SYL _2,2,2 ，...，

……

In enterprise m, the first characteristic information of the sampling day corresponding to the second sliding time window is: SYL _m,2,1 ，SYL _m,2,2 ，...，

And so on, in the nth sliding time window, the first characteristic information of each enterprise on each sampling day is respectively:

in enterprise 1, the first characteristic information of the sampling day corresponding to the nth sliding time window is: SYL _1,n,1 ，SYL _1,n,2 ，...，

In the enterprise 2, the first feature information of the sampling day corresponding to the nth sliding time window is: SYL _2,n,1 ，SYL _2,n,2 ，...，

……

In the enterprise m, the first feature information of the sampling day corresponding to the nth sliding time window is: SYL _m,n,1 ，SYL _m,n,2 ，...，

Further, the enterprise relevance determination module calculates a value of relevance between the xth enterprise and the yth enterprise in the jth sliding time window according to a calculation formula of relevance. Wherein the calculation formula of the correlation is as follows:

for example, in a first sliding time window, a correlation a between a first business and a first business _1,1,1 ：

In a first sliding time window, a correlation a between a first enterprise and a second enterprise _1,1,2 ：

……

In the first sliding time window, correlation a between the mth enterprise and the mth enterprise _1,m,m ：

In the nth sliding time window, the correlation a between the first enterprise and the first enterprise _n,1,1 ：

Correlation a between first enterprise and second enterprise in nth sliding time window _n,1,2 ：

……

In the nth sliding time window, correlation a between the mth enterprise and the mth enterprise _n,m,m ：

The above-described correlation calculation formula is exemplified by Pearson. The calculation formula for calculating the correlation of the first feature information between enterprises may be a calculation formula for calculating the correlation such as Pearson, spearman and Kendall, and is not particularly limited herein. And wherein the constructed enterprise feature network is a licensed network.

For example, the correlation calculation formula may refer to linear correlation calculation such as Pearson, etc. in the case of abnormal conduction on the linear characteristic relation. The correlation calculation formula can refer to the nonlinear correlation calculation such as Spearman and Kendall under the abnormal conduction condition on the nonlinear characteristic relation. In the abnormal conduction condition on other characteristic relations, the correlation can be calculated by adopting a proper correlation calculation formula according to actual needs, for example, the correlation can be calculated by adopting a gray correlation calculation formula and the like. In addition, according to actual needs, the technical scheme can also consider various linear and nonlinear characteristic relations at the same time.

Therefore, the technical scheme obtains the tightness of the connection between enterprises by calculating the correlation information between the enterprises, and accurately obtains the probability of abnormal transmission of the enterprises according to the correlation information.

Optionally, determining, according to the second feature information and the correlation information corresponding to the plurality of sampling days of the month time window, enterprise anomaly information corresponding to each sampling day in the abnormal conduction period of the month time window, includes: setting a plurality of sampling days of the month time window as first sampling days of corresponding abnormal conduction periods, and determining initial states of the plurality of enterprises in the first sampling days of the abnormal conduction periods of the month time window according to second characteristic information of the plurality of enterprises in the month time window; and determining an updated state of the plurality of enterprises on the first sampling day of the abnormal conduction period according to the initial state and the correlation information of the plurality of enterprises on the first sampling day of the abnormal conduction period and according to a preset abnormal propagation model.

Specifically, in this embodiment, whether the entire month is taken as one month time window or sampling days disposed in the same month are divided into one second month time window, the enterprise anomaly information corresponding to each sampling day in the abnormal conduction period of the month time window is determined for a plurality of enterprises. This operation is implemented by the abnormal conduction period determination module and the enterprise status determination module in fig. 3.

Specifically, in the month time window, each sampling day is taken as the first day of one abnormal conduction period, and the last sampling day in the month time window is taken as the last day of all abnormal conduction periods in the month time window. Such that each sampling day in the monthly time window has a corresponding abnormal conduction period, the sampling day being the first sampling day in the corresponding abnormal conduction period.

According to the month time window L _u Sampling day DB in (1) _u,p Determining abnormal conduction period J _u,v . Wherein u=1 to e, p=1 to f _u ，v＝1～f _u E and f _u Is a natural number. And further in the present embodiment, f _u Corresponding to both the month time window L _u The number of sampling days in (a) also corresponds to the month time window L _u The number of abnormal conduction periods in (a). And further define the abnormal conduction period J _u,v Sampling day DC in (3) _u,v,w . Wherein w=1 to g _u,v ，g _u,v The v-th abnormal conduction period J representing the u-th month as a natural number _u,v Is a number of sampling days.

To sum up, DB _u,p Represents the u-th month time window L _u P-th sampling day, J _u,v Representing the v-th abnormal conduction period in the u-th month time window, DC _u,v,w Representing the w-th sampling day in the v-th abnormal conduction period in the u-th month time window. In which the abnormal conduction period J _u,v As defined below:

window of month time L _u Last sampling day of (2)As abnormal conduction period J _u,v Is>Window of month time L _u Is the v-th sampling day of (1) as the abnormal conduction period J _u,v DC for the first sampling day of (2) _u,v,1 。

For example, the 1 st month time window L ₁ The sampling date of (1) includes DB _1,1 ，DB _1,2 ，...，(i.e., 2015-11-17-2015-12-31), the day DB will be sampled _1,1 ，DB _1,2 ，...，/>(i.e., 2015-11-17-2015-12-31) as the abnormal conduction period J _1,1 Sampling day DC in (3) _1,1,1 ，DC _1,1,2 ，...，/>Sampling day DB _1,2 ，DB _1,3 ，...，/>(i.e., 2015-11-18-2015-12-31) as the abnormal conduction period J _1,2 Sampling day DC in (3) _1,2,1 ，DC _1,2,2 ，...，/>..; sampling day +.>(i.e., 2015-12-31) as an abnormal conduction period +.>Sampling day +.>

For example, month time window L of 2 nd month ₂ The sampling date of (1) includes DB _2,1 ，DB _2,2 ，...，(i.e., 2016-01-2016-01-29), the day of sampling DB _2,1 ，DB _2,2 ，...，/>(i.e., 2016-01-2016-01-29) as abnormal conduction period J _2,1 Sampling day DC in (3) _2,1,1 ，DC _2,1,2 ，...，/>Sampling day DB _2,2 ，DB _2,3 ，...，/>(i.e., 2016-01-02 to 2016-01-29) as the abnormal conduction period J _2,2 Sampling day DC in (3) _2,2,1 ，DC _2,2,2 ，...，..; sampling day +.>(i.e., 2016-01-29) as an abnormal conduction period +.>Sampling day +.>

And so on, the e-th month time window L _e The sampling date of (1) includes DB _e,1 ，DB _e,2 ，...，(i.e., 2016-11-01 to 2016-12-02), the sampling date DB _e,1 ，DB _e,2 ，...，/>(i.e., 2016-11-01 to 2016-12-02) as the abnormal conduction period J _e,1 Sampling day DC in (3) _e,1,1 ，DC _e,1,2 ，...，/>Sampling day DB _e,2 ，DB _e,3 ，...，/>(i.e., 2016-11-02 to 2016-12-02) as the abnormal conduction period J _e,2 Sampling day DC in (3) _e,2,1 ，DC _e,2,2 ，...，..; sampling day +.>(i.e., 2016-12-02) as an abnormal conduction period +.>Sampling day +.>

Further, the second characteristic information includes divergence rate and magnitude change intensity. That is, enterprise status information may be determined for an enterprise by the divergence rate and the magnitude change intensity. Wherein the enterprise state information includes abnormal states and non-abnormal states. Specifically, the enterprise state determination module may determine an enterprise in an abnormal state through a divergence rate, and determine an enterprise in a non-abnormal state through an amplitude variation intensity. Wherein the enterprise state determination module may determine whether the enterprise is abnormal, for example, based on the divergence rate, and for abnormal enterprises determine its abnormal state, and for non-abnormal enterprises, for example, may determine the non-abnormal state of the enterprise based on the magnitude change strength.

And according to the difference of the abnormal grades, the abnormal states respectively comprise: i ¹ ，I ² And I ³ . Table 3 shows the abnormal state of the enterprise, the division criteria of the abnormal state, and the corresponding abnormal propagation strengths. Referring to Table 3, for example, the enterprise status determination module determines that the enterprise status of enterprise 1 is abnormal and the divergence rate BDL is greater than c+2. Where c is a predetermined constant. So that the enterprise state determining module determines the abnormal state of the enterprise 1 as I according to the dividing standard ¹ And the abnormal propagation intensity is high.

TABLE 3 Table 3

Wherein,represented in time window L for arbitrary month _u The divergence rate of enterprise i in the p-th sample day.

And the non-abnormal state includes: immune state R, latent state E ¹ Latent state E ² Latent state E ³ Latent state E ⁴ An abnormal state S is liable to occur. Table 4 shows the non-abnormal state of the enterprise, the division criteria for the non-abnormal state, the corresponding abnormal resistance, and the corresponding latency. As shown in reference to table 4, for example, when the enterprise status determination module determines that the enterprise status information of the enterprise 2 is a non-abnormal status and the amplitude variation intensity QRI is between 30 and 70, the non-abnormal status of the enterprise 2 is determined to be an immune status according to the division criteria, the abnormality resistance is high and there is no latency.

TABLE 4 Table 4

Wherein,represented in time window L for arbitrary month _u The intensity of the change in the amplitude of enterprise i in the p-th sampling day.

Further, the enterprise state determining module determines whether the enterprises 1 to m are abnormal or not according to the divergence rate and the amplitude variation intensity on the first sampling day in the abnormal conduction period (hereinafter, referred to) as a transmission source enterprise, and determines the enterprises in the abnormal state as non-transmission source enterprises.

Further, referring to fig. 6, the step of the enterprise status determination module determining the initial status of the first sampling day is as follows:

s1: the enterprise status determination module determines a month time window L _u Is of abnormal conduction period J _u,v Is the sampling day DC of (1) _u,v,w 。

S2: determining sampling day DC _u,v,w Is set in the initial state of (2).

When w=1, the enterprise status determination module determines that the day of sampling DC _u,v,w For the month time window L _u Is of abnormal conduction period J _u,v According to a month time window L _u Is of abnormal conduction period J _u,v DC for the first sampling day of (2) _u,v,w Enterprise E of (2) _i Is determined in a moon time window L _u Is of abnormal conduction period J _u,v DC for the first sampling day of (2) _u,v,w Enterprise E of (2) _i Enterprise state B of (2) _u,v,w,i (i.e., abnormal or non-abnormal) and to bring enterprise state B _u,v,w,i Is determined to be in a month time window L _u Is of abnormal conduction period J _u,v DC for the first sampling day of (2) _u,v,w Enterprise E of (2) _i Is set in the initial state of (2).

Further, the enterprise state determining module determines an initial state of the plurality of enterprises on a first sampling day of the abnormal conduction period, then determines correlation information corresponding to the first sampling day, and then updates the initial state according to the corresponding correlation information and a preset abnormal propagation model to determine an updated state of the plurality of enterprises on the first sampling day of the abnormal conduction period.

Therefore, the technical scheme determines the initial state of the current sampling day according to the second characteristic information, and determines the update state according to the initial state. That is, the technical scheme can update the enterprise status of the enterprise in real time according to the influence of the first sampling day of the abnormal conduction period on the subsequent sampling day.

Optionally, the determining operation of the enterprise anomaly information corresponding to each sampling day in the abnormal conduction period of the month time window according to the second feature information corresponding to the plurality of sampling days of the month time window and the correlation information further includes: for a second sampling day after the first sampling day in the abnormal conduction period, taking the updated state of the enterprises on the previous sampling day of the second sampling day as the initial state of the enterprises on the second sampling day; and determining the update state of the enterprises on the second sampling day according to the initial state and the correlation information of the enterprises on the second sampling day and the preset abnormal propagation model.

Specifically, referring to fig. 3 and 6, the step of the enterprise status determination module determining the initial status of the second sampling day is as follows:

S2: determining sampling day DC _u,v,w Is set in the initial state of (2).

When w is not equal to 1, the enterprise state determining module determines that the sampling date DC is not equal to 1 _u,v,w Not a month time window L _u Is of abnormal conduction period J _u,v Then the first sampling day of (2) will be DC _u,v,w DC from the last sampling day of (a) _u,v,w-1 Enterprise E _i Is taken as the sampling day DC _u,v,w Enterprise E of (2) _i Is set in the initial state of (2).

Further, the enterprise state determining module determines an initial state of the plurality of enterprises on a second sampling day of the abnormal conduction period, then determines correlation information corresponding to the second sampling day, and then updates the initial state according to the corresponding correlation information and a preset abnormal propagation model to determine an updated state of the plurality of enterprises on the second sampling day of the abnormal conduction period.

Therefore, the technical scheme takes the updated state of the last sampling day as the initial state of the current sampling day, and determines the updated state according to the initial state. That is, the technical scheme can update the enterprise status of the enterprise in real time according to the influence of the first sampling day of the abnormal conduction period on the subsequent sampling day.

Optionally, the operation of setting the plurality of sampling days of the month time window as the first sampling days of the corresponding abnormal conduction period and determining the initial state of the plurality of enterprises in the first sampling days of the abnormal conduction period of the month time window according to the second characteristic information of the plurality of enterprises in the month time window includes: determining corresponding enterprise state information of the enterprises on the first sampling day according to the divergence rate of the enterprises on the first sampling day of the abnormal conduction period of the monthly time window, wherein the enterprise state information comprises abnormal state information which is transmitted as abnormal and non-abnormal state information which is not transmitted as abnormal; determining abnormal state information of the enterprises on the first sampling day of the abnormal conduction period and taking the abnormal state as an initial state under the condition that the enterprises are transmitted as abnormality on the first sampling day of the abnormal conduction period; and under the condition that the plurality of enterprises are not propagated as abnormal on the first sampling day of the abnormal conduction period, determining non-abnormal state information of the plurality of enterprises on the first sampling day of the abnormal conduction period according to the amplitude change intensity, and taking the non-abnormal state information as an initial state, wherein the non-abnormal state information comprises a latent state, an immune state and an abnormal state which is easy to occur.

Specifically, the enterprise status determination module obtains enterprise E _i Comparing the divergence rate with a constant c on the first sampling day of the abnormal conduction period, and determining the enterprise E when the divergence rate is greater than or equal to the constant c _i The enterprise status information on the first sampling day of the abnormal conduction period is an abnormal status. When enterprise E _i If the enterprise status information on the first sampling day of the abnormal conduction period is an abnormal status, determining a range section within which the divergence rate falls according to the division criteria in table 3, thereby determining that the corresponding abnormal status is I ¹ ，I ² Or I ³ 。

The enterprise state determining module compares the divergence rate with a constant c, and determines enterprise E when the divergence rate is less than the constant c _i The business state information on the first sampling day of the abnormal conduction period is a non-abnormal state. The enterprise state determining module obtains enterprise E _i The amplitude variation intensity of the amplitude variation intensity on the first sampling day of the abnormal conduction period is determined according to the division criteria in table 3, and the range section in which the amplitude variation intensity falls is determined, thereby determining that the corresponding non-abnormal state is an immune state R, a latent state E ¹ Latent state E ² Latent state E ³ Latent state E ⁴ An abnormal state S is also liable to occur.

Therefore, the technical scheme determines the abnormal state according to the divergence rate, and then determines the non-abnormal state according to the amplitude change intensity, so that the enterprise state information can be determined more accurately according to different indexes.

Optionally, according to the initial state and the correlation information of the plurality of enterprises on the first sampling day of the abnormal conduction period, determining the updated state of the plurality of enterprises on the first sampling day of the abnormal conduction period according to a preset abnormal propagation model includes: calculating anomaly probability information of the plurality of enterprises on the first sampling day of the anomaly conduction period according to the anomaly resistance capability of the plurality of enterprises on the first sampling day of the anomaly conduction period, the anomaly propagation intensity of the enterprises associated with the plurality of enterprises, the feature association degree of the enterprises with abnormal states associated with the plurality of enterprises and the number of the enterprises with abnormal states associated with the plurality of enterprises, wherein the feature association degree is determined according to the correlation information corresponding to the first sampling day; when the initial state of the enterprises on the first sampling day of the abnormal conduction period is an abnormal state which is easy to occur or the initial state is a latent state and the latent day is zero, determining the update state of the enterprises on the first sampling day of the abnormal conduction period according to the abnormal probability information of the enterprises on the first sampling day of the abnormal conduction period; in the case that the initial state of the plurality of enterprises on the first sampling day of the abnormal conduction period is a latent state and the latent day is not zero, taking the initial state as an updated state of the plurality of enterprises on the first sampling day of the abnormal conduction period; and determining an updated state of the first sampling day according to the second characteristic information of the enterprises on the next sampling day of the first sampling day of the abnormal conduction period under the condition that the initial state of the enterprises on the first sampling day of the abnormal conduction period is an immune state.

Specifically, the outlier calculation module may calculate the corresponding outlier probability information according to an outlier calculation formula, wherein the outlier P of the ith enterprise in the w-th sampling day of the ith month v-th abnormal conduction period _u,v,w,i The calculation formula of (i.e., anomaly probability information) is:

where θ is the inverse of the ith enterprise anomaly resistance capability, F _b Is the intensity of the anomaly propagation by enterprise b of the anomaly associated with the ith enterprise before the current sampling day decays. Wherein abnormal state I ¹ 、I ² And I ³ The abnormal propagation intensity of (a) is as follows from strong to weak in turn: i ¹ >I ² >I ³ And the value of the abnormal propagation intensity corresponding to each abnormal propagation intensity may be a value set in advance to be greater than "0". Omega _bi Is the characteristic association degree of enterprise i and the b-th enterprise with abnormal state, and is the enterprise characteristic network A of the sliding time window corresponding to the current sampling date _j And (5) determining. Wherein the current sampling day is the last sampling day of the corresponding sliding time window. q is the number of businesses with abnormal states associated with business i. Wherein the degree of association of features omega _bi Is determined by the following means: on the current date of samplingFor indexing, the corresponding enterprise correlation information table is queried at the third data storage layer. And inquiring in the inquired correlation information table according to the values of b and i to obtain corresponding enterprise correlation information. Determining the feature association degree omega according to the acquired correlation information _bi . Thus, in this way, since the enterprise correlation information is directly obtained from the pre-stored enterprise correlation information table without repeated cumbersome calculations, a quick feedback and response can be achieved.

Further, e.g. month time window L _u Is of abnormal conduction period J _u,v Is the sampling day DC of (1) _u,v,w For enterprise E _i On the first sampling day (i.e., the first sampling day) of the abnormal conduction period.

Referring to FIG. 6, the step of the enterprise status determination module determining the updated status for the first sampling day is as follows:

s3: the enterprise status determination module confirms enterprise E _i DC on sampling day _u,v,w,i Whether the initial state of (a) is an abnormal state.

S4: when the initial state is not an abnormal state, the enterprise state determination module determines that the initial state is a non-abnormal state. The enterprise status determination module then obtains the time window L at month _u Is of abnormal conduction period J _u,v DC on the w-th sampling day of (2) _u,v,w Enterprise E of (2) _i The non-abnormal state of the strain is determined to be an immune state R and a latent state E by the division criteria in Table 4 ¹ Latent state E ² Latent state E ³ Latent state E ⁴ An abnormal state S is also liable to occur.

S5: referring to Table 4, the enterprise status determination module determines enterprise E according to the partition criteria _i Whether the initial state of (2) is a latent state. When enterprise E _i When the initial state of (a) is the latent state, determining that the latent state is the latent state E ¹ Latent state E ² Latent state E ³ Or the latency state E ⁴ . In which the latency state E ¹ Latent state E ² Latent state E ³ Latent state E ⁴ Is different in latency daysSo that the enterprise status determination module sets the enterprise E according to different latency status _i Latency days of (2).

S6: DC when on sampling day _u,v,w Enterprise E _i When the initial state of (2) is not the latent state, the enterprise state determining module determines enterprise E according to the division criteria in Table 4 _i If the initial state of (1) is the abnormal state S, when enterprise E _i The initial state of (1) is a state in which abnormality is likely to occur S, and S12 is executed.

S7: DC when on sampling day _u,v,w Enterprise E _i When the initial state of (1) is not the abnormal state S which is easy to occur, the enterprise state determining module determines the enterprise E _i Is immune state R.

S8: the enterprise status determination module obtains DC on sampling day _u,v,w Enterprise E for the next sampling day of (a) _i Determining enterprise E according to the acquired amplitude variation intensity of the next sampling day _i The enterprise state of (a) is immune state R, latent state E ¹ Latent state E ² Latent state E ³ Latent state E ⁴ An abnormal state S is also liable to occur. The enterprise status determination module thus takes the determined enterprise status as a sampling date DC _u,v,w Is updated with the updated state of (c). And the outlier calculation module calculates enterprise E _i DC on sampling day _u,v,w The outlier of (2) is noted as "0".

S9: when it is determined at step S5 that the sampling date DC _u,v,w When the initial state of (a) is a latent state, the enterprise state determining module determines enterprise E _i Whether the latency period of (i.e., whether the latency days is "0").

S10: when enterprise E _i The enterprise status determination module determines the enterprise E _i Minus 1 day of latency, and enterprise E _i Is determined to be a latent state. And the outlier calculation module calculates enterprise E _i DC on sampling day _u,v,w The outlier of (2) is noted as "0".

S11: when it is determined in step S9 that the latency number is 0, then the enterprise status determination module determines that enterprise E _i Has ended.

S12: the abnormal value calculation module calculates a formula according to the abnormal valueComputing enterprise E _i DC on sampling day _u,v,w Is an outlier of (2). Wherein outliers are used to characterize the probability that an enterprise is propagated as outliers.

S13: the enterprise state determining module is preset with three thresholds, namely alpha respectively ₁ 、α ₂ And alpha ₃ . At this step the enterprise status determination module will DC the current sampling day _u,v,w Enterprise E of (2) _i Is the outlier P of (2) _u,v,w,i Respectively with alpha ₁ And alpha ₂ Comparing and judging the abnormal value P _u,v,w,i Whether or not to be greater than or equal to alpha ₁ And is less than alpha ₂ 。

S14: when P _u,v,w,i Greater than or equal to alpha ₁ And is less than alpha ₂ The enterprise status determination module determines enterprise E _i Is abnormal and enterprise E _i Is I ³ Whereby the enterprise state determination module is based on the abnormal state I ³ Updating enterprise E _i DC on the current sampling day _u,v,w Enterprise state B of (2) _u,v,w,i . Namely, enterprise E _i DC on sampling day _u,v,w Is the update state of I ³ . Wherein B is _u,v,w,i The business state for the ith business on the w-th sampling day of the v-th abnormal conduction period of the u-th month. And the outlier calculation module calculates enterprise E _i DC on sampling day _u,v,w Is marked as P _u,v,w,i 。

S15: when it is determined in step S13 that "P" is not satisfied _u,v,w,i Greater than or equal to alpha ₁ And is less than alpha ₂ When' the enterprise state determining module judges the abnormal value P _u,v,w,i Whether or not to be greater than or equal to alpha ₂ And is less than alpha ₃ 。

S16: when P _u,v,w,i Greater than or equal to alpha ₂ And is less than alpha ₃ The enterprise status determination module determines enterprise E _i Is abnormal and enterprise E _i Is I ² Whereby the enterprise state determination module is based on the abnormal state I ² Updating enterprise E _i Enterprise status B at the current sampling day _u,v,w,i . Namely, enterprise E _i DC on sampling day _u,v,w Is the update state of I ² . And the outlier calculation module calculates enterprise E _i DC on sampling day _u,v,w Is marked as P _u,v,w,i 。

S17: but in step S15, it is determined that "P" is not satisfied _u,v,w,i Greater than or equal to alpha ₂ And is less than alpha ₃ When' the enterprise state determining module judges the abnormal value P _u,v,w,i Whether or not to be greater than or equal to alpha ₃ 。

S18: when P _u,v,w,i Greater than or equal to alpha ₃ The enterprise status determination module determines enterprise E _i Is abnormal and enterprise E _i Is I ¹ Whereby the enterprise state determination module is based on the abnormal state I ¹ Updating enterprise E _i Enterprise status B at the current sampling day _u,v,w,i . Namely, enterprise E _i DC on sampling day _u,v,w Is the update state of I ¹ . And the outlier calculation module calculates enterprise E _i DC on sampling day _u,v,w Is marked as P _u,v,w,i 。

S19: when it is determined in step S17 that "P" is not satisfied _u,v,w,i Greater than or equal to alpha ₃ "when, P _u,v,w,i Less than alpha ₁ The enterprise status determination module determines enterprise E _i Is not propagated as an anomaly, and returns to step S8.

Therefore, according to the technical scheme, different initial states correspond to different update states, so that corresponding update states are determined according to the initial states and the current characteristic relation, and possible abnormal conditions are covered at the same time from multiple angles, so that the abnormal propagation path is more comprehensive.

Optionally, according to the initial state and the correlation information of the plurality of enterprises on the first sampling day of the abnormal conduction period, determining the updated state of the plurality of enterprises on the first sampling day of the abnormal conduction period according to a preset abnormal propagation model, further includes: determining abnormal propagation intensity of the plurality of enterprises on the first sampling day of the abnormal conduction period according to a preset attenuation rate under the condition that the initial state of the plurality of enterprises on the first sampling day of the abnormal conduction period is an abnormal state; and determining abnormal states of the enterprises on the first sampling day of the abnormal conduction period according to the abnormal propagation intensity.

In particular, e.g. month time window L _u Is of abnormal conduction period J _u,v Is the sampling day DC of (1) _u,v,w For enterprise E _i On the first sampling day (i.e., the first sampling day) of the abnormal conduction period.

s20: when it is determined in step S3 that enterprise E _i When the initial state of (1) is abnormal, the enterprise state determining module determines that the abnormal state is I according to the division criteria in Table 3 ¹ 、I ² Or I ³ And determines abnormal state I ¹ 、I ² And I ³ Respectively corresponding to the abnormal propagation intensities.

S21: due to enterprise E _i Is of the anomaly propagation intensity F _i Attenuation is carried out according to the attenuation rate rho, so that the enterprise state determining module calculates sampling date DC according to the attenuation rate rho _u,v,w Enterprise E _i Is of the anomaly propagation intensity F _i 。

S22: the enterprise state determination module judges the abnormal propagation intensity F _i Whether greater than 0. When the abnormal propagation intensity F _i Less than or equal to 0, S8 is returned.

S23: when the abnormal propagation intensity F _i If the enterprise state is greater than 0, the enterprise state determination module determines enterprise E _i Is propagated with anomalies to thereby obtain the current sampling date DC _u,v,w Enterprise E _i Is updated to an abnormal state (i.e., sampling day DC _u,v,w Enterprise E _i Is an abnormal state). And the outlier calculation module calculates enterprise E _i DC on sampling day _u,v,w The outlier of (2) is noted as 0.

Therefore, according to the technical scheme, different initial states correspond to different update states, so that corresponding update states are determined according to the initial states, possible abnormal conditions are covered at the same time from multiple angles, and the abnormal propagation path is more comprehensive.

Optionally, according to the initial state and the correlation information of the plurality of enterprises on the second sampling day, determining the update state of the plurality of enterprises on the second sampling day according to the preset abnormal propagation model includes: calculating anomaly probability information of the plurality of enterprises on the first sampling day of the anomaly conduction period according to the anomaly resistance capability of the plurality of enterprises on the first sampling day of the anomaly conduction period, the anomaly propagation intensity of the enterprises associated with the plurality of enterprises, the feature association degree of the enterprises with the anomaly state associated with the plurality of enterprises and the number of the enterprises with the anomaly state associated with the plurality of enterprises, wherein the feature association degree is determined according to the correlation information corresponding to the first sampling day; when the initial state of the enterprises on the second sampling day of the abnormal conduction period is an abnormal state which is easy to occur or the initial state is a latent state and the latent day is zero, determining the update state of the enterprises on the second sampling day of the abnormal conduction period according to the abnormal probability information of the enterprises on the second sampling day of the abnormal conduction period; in the case that the initial state of the plurality of enterprises on the second sampling day of the abnormal conduction period is a latent state and the latent day is not zero, taking the initial state as an updated state of the plurality of enterprises on the second sampling day of the abnormal conduction period; and determining an updated state of the second sampling day according to second characteristic information of the plurality of enterprises on a next sampling day of the second sampling day of the abnormal conduction period under the condition that the initial state of the plurality of enterprises on the second sampling day of the abnormal conduction period is an immune state.

where θ is the inverse of the ith enterprise anomaly resistance capability, F _b Is the intensity of the anomaly propagation by enterprise b of the anomaly associated with the ith enterprise before the current sampling day decays. Wherein abnormal state I ¹ 、I ² And I ³ The abnormal propagation intensity of (a) is as follows from strong to weak in turn: i ¹ >I ² >I ³ And the value of the abnormal propagation intensity corresponding to each abnormal propagation intensity may be a value set in advance to be greater than "0". Omega _bi Is the feature association degree of enterprise i and the b-th enterprise with abnormal state, and can be based on the enterprise feature network A of the sliding time window corresponding to the current sampling day in step S204 _j And (5) determining. Wherein the current sampling day is the last sampling day of the corresponding sliding time window. q is the number of businesses with abnormal states associated with business i.

Further, e.g. month time window L _u Is of abnormal conduction period J _u,v Is the sampling day DC of (1) _u,v,w For enterprise E _i On the non-first sampling day (i.e., the second sampling day) of the abnormal conduction period.

Referring to FIG. 6, the steps of the enterprise status determination module determining the updated status for the second sampling day are as described above in S3-S19.

Optionally, according to the initial state and the correlation information of the multiple enterprises on the second sampling day, determining the update state of the multiple enterprises on the second sampling day according to the preset abnormal propagation model, and further includes: determining abnormal propagation intensity of the plurality of enterprises on the second sampling day of the abnormal conduction period according to a preset attenuation rate under the condition that the initial state of the plurality of enterprises on the second sampling day of the abnormal conduction period is an abnormal state; and determining an abnormal state of the plurality of enterprises on a second sampling day of the abnormal conduction period according to the abnormal propagation intensity.

In particular, e.g. month time window L _u Is of abnormal conduction period J _u,v Is the sampling day DC of (1) _u,v,w For enterprise E _i On the non-first sampling day (i.e., the second sampling day) of the abnormal conduction period.

Referring to fig. 6, the steps of the enterprise status determination module determining the updated status for the second sampling day are as described above in S20-S23.

Optionally, determining the operation of the key enterprise to be monitored according to the plurality of sampling days of the query period and the enterprise anomaly information corresponding to the plurality of sampling days includes: counting the abnormal times of the enterprises in each abnormal conduction period of the query period, and calculating the first average abnormal times of the enterprises relative to the abnormal conduction period in each month time window according to the abnormal times of the enterprises in each month time window of the query period and the number of the abnormal conduction periods of each month time window; counting the sum of the first average abnormal times of the enterprises corresponding to each month time window and the number of the month time windows, and calculating the second average abnormal times of the enterprises relative to the abnormal conduction time period in the query time period; and sequencing the second average abnormal times of the enterprises, and determining the predetermined number of enterprises with the largest second average abnormal times as key enterprises.

In particular, if enterprise E _i The w-th sampling day DC of the v-th abnormal conduction period at the u-th month of the inquiry period _u,v,w If the updated status of (1) is abnormal, the enterprise status determination module determines enterprise E _i DC on sampling day _u,v,w Propagated as anomalies; if enterprise E _i DC on sampling day _u,v,w If the updated status of (1) is a non-abnormal status, then the enterprise status determination moduleDetermining enterprise E _i DC on sampling day _u,v,w Are not propagated as anomalies. Thereafter, the critical business determination module counts business E based on the number of days propagated as anomalies _i In the abnormal conduction period J _u,v Number of anomalies Q of (2) _u,v,i . Wherein u=1 to e, v=1 to f _u . And wherein Q _u,v,i Representing the number of anomalies for the ith enterprise during the v-th anomalous conduction period of the ith month time window. And wherein the number of anomalies is the number of transitions from a non-anomalous state to an anomalous state.

Further, the query processing module divides the number of anomalies in the month time window by the number of anomalies in the abnormal conduction period corresponding to the month time window, thereby obtaining an average number of anomalies AQ in the abnormal conduction period corresponding to the month time window _u,i (i.e., a first average anomaly count). Wherein AQ is _u,i Representing the average number of anomalies for the anomaly conduction period for the ith enterprise corresponding to the ith month time window.

Wherein, enterprise E _i And a month time window L _u The calculation formula of the average anomaly times of the corresponding anomaly conduction period is as follows:

wherein f _u For the month time window L _u Is a number of abnormal conduction periods of the battery.

Further, enterprise E _i With each month time window L in the inquiry period ₁ ～L _e The average anomaly times of the corresponding anomaly conduction periods are respectively as follows: AQ _1,i ，AQ _2,i ，...，AQ _e,i 。

The query processing module then queries enterprise E _i With each month time window L ₁ ～L _e Average number of anomalies AQ for corresponding anomalous conduction periods _1,i ～AQ _e,i Further averaging to calculate enterprise E _i Average anomaly number BQ of anomaly conduction period corresponding to inquiry period _i (i.e., the second average number of anomalies). Wherein BQ is _i Represent the firsti enterprises E _i The average number of anomalies of the anomalous conduction period corresponding to the inquiry period.

Wherein enterprise E _i The calculation formula of the average anomaly times of the anomaly conduction period corresponding to the inquiry period is as follows:

further, the query processing module sorts the enterprises according to the average abnormal times of the abnormal conduction time periods corresponding to the query time periods, so that a preset number of enterprises with the highest average abnormal times are obtained, and the preset number of enterprises are used as key enterprises. The key enterprise determination module may then obtain corresponding enterprise features for the key enterprise. Wherein the enterprise features may include, for example: characteristics of corporate stock, registered capital, corporate type, volume of transactions, etc.

Therefore, according to the technical scheme, the key enterprises with the largest abnormal times are screened out from all enterprises according to the abnormal times of the abnormal conduction time periods corresponding to the enterprises in the query time period, so that the key enterprises can be directly determined to monitor the enterprises, and the efficiency of determining to monitor the enterprises is improved.

Optionally, determining the critical abnormal conductive path based on the abnormal probability information comprises: calculating the sum of abnormal probability information of all enterprises of each abnormal conduction period, and calculating average abnormal values relative to the abnormal conduction periods in each month time window according to the number of the abnormal conduction periods in each month time window; and comparing the average anomaly values of the anomaly conduction periods for the respective month time windows, and determining all the anomaly conduction periods of the month time window for which the average anomaly value of the anomaly conduction period is greatest as the critical anomaly conduction path.

Specifically, the critical abnormal conduction path determination module obtains the w-th sampling day DC for the v-th abnormal conduction period at the u-th month _u,v,w Abnormal values of enterprises 1-m in (1) and then calculating DC on sampling days _u,v,w The sum of the outliers of all enterprises. That is, a critical abnormal conduction path determination module The block sets DC of enterprises 1-m in sampling day _u,v,w To obtain the sampling day DC _u,v,w Total outlier MP of sampling days of (2) _u,v,w . Wherein the total outlier of sampling days is identified as MP. Wherein u=1 to e, v=1 to f _u ，w＝1～g _u,v ，e、f _u And g _u,v G is natural number _u,v The v-th abnormal conduction period J representing the u-th month _u,v Is a number of sampling days. J (J) _u,v Representing the v-th abnormal conduction period, MP, in the u-th month time window _u,v,w The total outliers of sampling days for the w-th sampling day in the v-th abnormal conduction period in the u-th month time window are represented.

In which during the month time window L _u Is of abnormal conduction period J _u,v Is the sampling day DC of (1) _u,v,w Enterprise E of (2) _i Is the outlier P of (2) _u,v,w,i Respectively P _u,v,w,1 ，P _u,v,w,2， ...，P _u,v,w,m

Then in the month time window L _u Is of abnormal conduction period J _u,v Is the sampling day DC of (1) _u,v,w The calculation formula of the total outlier of the sampling day is as follows:

further, the critical abnormal conduction path determination module will be abnormal conduction period J _u,v Day of middle samplingTransaction total outlier +.>Adding to obtain an abnormal conduction period J _u,v Is a period outlier JMP of (1) _u,v . Wherein the period outlier is identified as JMP, and wherein u=1 to e, v=1 to f _u E and f _u Is natural number JMP _u,v A period outlier representing a v-th abnormal conduction period in the u-th month time window.

Then atMoon time window L _u Is of abnormal conduction period J _u,v The calculation formula of the time period outlier of (2) is:

further, the critical abnormal conduction path determination module will window the month time window L _u Time period anomaly value of abnormal conduction time period in (a)Averaging to obtain average outlier AMP for each month time window _u . Wherein the average outlier is identified as "AMP", u=1 to e. AMP (AMP) _u Representing the average outliers of the u-th month time window.

Then in the month time window L _u Average anomaly value of (2):

wherein the month time window L _u The number of abnormal conduction periods of f _u 。

Further, the critical abnormal conduction path determination module will average abnormal value AMP ₁ ～AMP _e Sorting is performed to determine a month time window in which the average outlier is greatest. The critical abnormal conduction path determination module then determines all abnormal conduction periods in the month time window having the largest average abnormal value as the set of critical abnormal conduction paths.

Thus, the present solution evaluates the characteristic divergent abnormal conduction conditions by determining the average outlier of the calculated abnormal conduction periods. And the key abnormal conduction path determined according to the average abnormal value of the abnormal conduction period is beneficial to timely preventing systematic financial abnormality according to the key abnormal conduction path.

Further, referring to FIG. 6, the sequential steps of the enterprise state determination module to determine the initial state and the updated state are as follows:

S2: determining sampling day DC _u,v,w Is set in the initial state of (2).

S2.1 when w=1, the enterprise status determination module determines sampling day DC _u,v,w For the month time window L _u Is of abnormal conduction period J _u,v According to a month time window L _u Is of abnormal conduction period J _u,v DC for the first sampling day of (2) _u,v,w Enterprise E of (2) _i Is determined in a moon time window L _u Is of abnormal conduction period J _u,v DC for the first sampling day of (2) _u,v,w Enterprise E of (2) _i Enterprise state B of (2) _u,v,w,i (i.e., abnormal or non-abnormal) and to bring enterprise state B _u,v,w,i Is determined to be in a month time window L _u Is of abnormal conduction period J _u,v DC for the first sampling day of (2) _u,v,w Enterprise E of (2) _i Is set in the initial state of (2).

S2.2: when w is not equal to 1, the enterprise state determining module determines that the sampling date DC is not equal to 1 _u,v,w Not a month time window L _u Is of abnormal conduction period J _u,v Then the first sampling day of (2) will be DC _u,v,w DC from the last sampling day of (a) _u,v,w-1 Enterprise E _i Is taken as the sampling day DC _u,v,w Enterprise E of (2) _i Is set in the initial state of (2).

S5: referring to Table 4, the enterprise status determination module determines enterprise E according to the partition criteria _i Whether the initial state of (2) is a latent state. When enterprise E _i When the initial state of (a) is the latent state, determining that the latent state is the latent state E ¹ Latent state E ² Latent state E ³ Or the latency state E ⁴ . In which the latency state E ¹ Latent state E ² Latent state E ³ Latent state E ⁴ The latency days of the enterprise E are different, so that the enterprise state determining module sets the enterprise E according to different latency states _i Latency days of (2).

S9: when it is determined at step S5 that the sampling date DC _u,v,w When the initial state of (a) is a latent state, the enterprise state determining moduleBlock determination Enterprise E _i Whether the latency period of (i.e., whether the latency days is "0").

S12: outlier computing module calculates enterprise E _i DC on sampling day _u,v,w Is an outlier of (2). Wherein outliers are used to characterize the probability that an enterprise is propagated as outliers.

Abnormal value P of the ith enterprise on the w-th sampling day of the ith month's v-th abnormal conduction period _u,v,w,i The calculation formula of (2) is as follows:

where θ is the inverse of the ith enterprise anomaly resistance capability, F _b Is the intensity of the anomaly propagation by enterprise b of the anomaly associated with the ith enterprise before the current sampling day decays. Wherein abnormal state I ¹ 、I ² And I ³ The abnormal propagation intensity of (a) is as follows from strong to weak in turn: i ¹ >I ² >I ³ And the value of the abnormal propagation intensity corresponding to each abnormal propagation intensity may be a value set in advance to be greater than "0". Omega _bi Is the feature association degree of enterprise i and the b-th enterprise with abnormal state, and can be based on the enterprise feature network A of the sliding window corresponding to the current sampling date in step S204 _j And (5) determining. Wherein the current sampling day is the last sampling day of the corresponding sliding time window. q is the number of businesses with abnormal states associated with business i.

S19: when it is determined in step S17 that "P" is not satisfied _u,v,w,i Greater than or equal to alpha ₃ "when, P _u,v,w,i Less than alpha ₁ The enterprise status determination module determines enterprise E _i Is not abnormal, and returns to step S8.

S23: when the abnormal propagation intensity F _i If the enterprise state is greater than 0, the enterprise state determination module determines enterprise E _i Is abnormal, thereby DC is obtained from the current sampling day _u,v,w Enterprise E _i Updates the enterprise status to an abnormal statusI.e. sampling day DC _u,v,w Enterprise E _i Is an abnormal state). And the outlier calculation module calculates enterprise E _i DC on sampling day _u,v,w The outlier of (2) is noted as 0.

Thus, in the manner described above (i.e., S1-S23), the enterprise status determination module determines the initial status and updated status for each sample day of each abnormal conduction period for each month time window for each enterprise.

Further, referring to fig. 1, according to a second aspect of the present embodiment, there is provided a storage medium. The storage medium includes a stored program, wherein the method of any one of the above is performed by a processor when the program is run.

Thus, according to the present embodiment, the enterprise relevance determining module calculates relevance information between each enterprise according to the feature information of each enterprise on each sampling day, so as to obtain an enterprise feature network (i.e., relevance information) for reflecting the relevance between the enterprises. The enterprise status determination module may then determine, based on the enterprise feature network, an impact of the abnormal enterprise on other associated enterprise features. Compared with the prior art, the technical scheme can accurately analyze the influence of the abnormal enterprises on other related enterprise characteristics, and does not need to collect analysis materials by manpower. Thereby ensuring the accuracy of information analysis and improving the analysis efficiency.

In the technical scheme, the enterprise state determining module updates the initial state according to the initial state of each sampling day and the characteristic information of the enterprise on each sampling day, so as to determine the enterprise state information and the abnormal probability information of the enterprise on the sampling day. So that the determined enterprise status of the enterprise corresponds to the actual form of the enterprise. And the key abnormal conduction path determining module obtains a real and effective key abnormal conduction path and identifies an enterprise with low abnormal resistance according to the enterprise feature network and the abnormal conduction period. And the enterprise state of real-time change is avoided from being determined manually, the accuracy of information analysis is ensured, and the analysis efficiency is improved. Furthermore, in the technical scheme, the key enterprise determining module can monitor the enterprises which are low in abnormal resistance and easy to influence, so that the abnormal enterprises can be truly and effectively blocked from transmitting the abnormality to the enterprises with low abnormal resistance, and the stability of the enterprises is ensured. Compared with the existing abnormal propagation model which cannot accurately analyze the influence of the abnormal enterprise on other related enterprise characteristics, the technical scheme overcomes the defects of the existing abnormal propagation model, and the influence of the abnormal enterprise on other related enterprise characteristics is not needed to be analyzed through manpower.

It should be noted that, for simplicity of description, the foregoing method embodiments are all described as a series of acts, but it should be understood by those skilled in the art that the present invention is not limited by the order of acts described, as some steps may be performed in other orders or concurrently in accordance with the present invention. Further, those skilled in the art will also appreciate that the embodiments described in the specification are all preferred embodiments, and that the acts and modules referred to are not necessarily required for the present invention.

In addition, although the embodiments of the present invention have been described using electricity consumption as an example. The scope of the present invention is not limited thereto, but the predetermined index may be other physical quantities such as heat consumption, etc. And the predetermined index may also be a stock price of the enterprise (corresponding to the power generation amount), the first characteristic information may be a stock price logarithmic yield rate of the enterprise (corresponding to the first characteristic information), and the second characteristic information may be an achieved fluctuation rate (corresponding to the divergence rate) and a relative strength index (corresponding to the amplitude variation intensity) of the enterprise.

From the description of the above embodiments, it will be clear to a person skilled in the art that the method according to the above embodiments may be implemented by means of software plus the necessary general hardware platform, but of course also by means of hardware, but in many cases the former is a preferred embodiment. Based on such understanding, the technical solution of the present invention may be embodied essentially or in a part contributing to the prior art in the form of a software product stored in a storage medium (e.g. ROM/RAM, magnetic disk, optical disk) comprising instructions for causing a terminal device (which may be a mobile phone, a computer, a server, or a network device, etc.) to perform the method according to the embodiments of the present invention.

Example 2

Fig. 7 shows an enterprise anomaly monitoring device 700 based on data asynchronous processing according to the present embodiment, which device 700 corresponds to the method according to the first aspect of embodiment 1. Referring to fig. 7, the apparatus 700 includes: a first determining module 710, configured to determine, by means of data asynchronous processing, enterprise data information related to predetermined indicators of a plurality of enterprises, first feature information, second feature information, enterprise correlation information, and enterprise anomaly information, and store the determined information in different data storage layers; a second determining module 720, configured to determine, in response to a query request input by a user, a plurality of sampling days of a query period corresponding to the query request; and a third determining module 730 for determining, according to a plurality of sampling days of the query period and the enterprise anomaly information corresponding to the plurality of sampling days, a critical enterprise to be monitored and a critical anomaly conduction path indicating a time path of anomaly propagation, wherein the first characteristic information is used for indicating a variation condition of enterprise data information of the corresponding enterprise between adjacent sampling days, the second characteristic information is used for indicating a divergence condition of the enterprise data information of the corresponding enterprise and an intensity of an amplitude variation of the enterprise data information, the correlation information is used for indicating a correlation between the first characteristic information of the plurality of enterprises within a sliding time window corresponding to the corresponding sampling days, and the enterprise anomaly information is used for indicating whether each sampling day of the enterprise within the anomaly conduction period corresponding to the corresponding sampling day is an anomaly state and a probability of becoming an anomaly state.

Optionally, the first determining module 710 includes: the first updating sub-module is used for acquiring enterprise data information of a plurality of enterprises on each sampling day and updating an enterprise data information table arranged on the first data storage layer according to the acquired enterprise data information; the second updating sub-module is used for determining first characteristic information and second characteristic information of a plurality of enterprises after updating the enterprise data information table on each sampling day, and updating the characteristic information table arranged on the second data storage layer according to the determined first characteristic information and second characteristic information, wherein the characteristic information table indexes the first characteristic information and the second characteristic information according to the identification and the date of the enterprises; the first determining submodule is used for determining enterprise correlation information corresponding to the corresponding sampling day according to the first characteristic information recorded in the characteristic information table after the characteristic information table is updated on each sampling day, and creating an enterprise correlation information table corresponding to the enterprise correlation information in the third data storage layer, wherein each enterprise correlation information table is indexed through the corresponding sampling day; and a second determination submodule for performing, on the last sampling day of each month, the following operations: determining an abnormal conduction period corresponding to a plurality of sampling days of the month respectively with the month as one month time window, wherein the abnormal conduction period extends from the corresponding sampling day to the last sampling day of the corresponding month time window; a first obtaining sub-module, configured to obtain second feature information of a plurality of enterprises on a plurality of sampling days of the month from the feature information table, and obtain enterprise correlation information corresponding to the plurality of sampling days of the month from an enterprise correlation information table corresponding to the plurality of sampling days of the month; and a third determination sub-module for determining, according to second feature information corresponding to the plurality of sampling days of the month and correlation information corresponding to the plurality of sampling days of the month, enterprise anomaly information corresponding to each sampling day of the plurality of enterprises and the abnormal conduction period of the month, and creating, according to the determined enterprise anomaly information, an enterprise anomaly information table corresponding to the month in the fourth data storage layer, wherein the enterprise anomaly information includes enterprise status information for indicating whether each sampling day of the enterprise in the abnormal conduction period is an anomaly state and anomaly probability information for indicating a probability that each sampling day of the enterprise in the abnormal conduction period is an anomaly.

Optionally, the third determining module 730 includes: a fourth determining submodule, configured to determine a month time window corresponding to the query request according to a plurality of sampling days of the query period; a fifth determining submodule, configured to obtain, from the enterprise anomaly information table, enterprise anomaly information corresponding to the determined first month time window when sampling days included in the determined first month time window belong to the same month, and determine, from second feature information and correlation information corresponding to a plurality of sampling days of the second month time window when sampling days included in the determined second month time window belong to different months, enterprise anomaly information corresponding to each sampling day in an anomaly conduction period of the second month time window for a plurality of enterprises; and a sixth determining sub-module for determining a critical enterprise to be monitored and a critical anomaly conductive path indicating a time path for anomaly propagation using the enterprise anomaly information acquired based on the first month time window and the enterprise anomaly information determined based on the second month time window.

Optionally, the first determining submodule includes: and the first determining unit is used for determining the correlation information between any two enterprises in the sliding time window by utilizing the correlation calculation formula according to the first characteristic information of the enterprises in the sliding time window corresponding to the sampling date.

Optionally, the third determining sub-module comprises: a second determining unit, configured to set a plurality of sampling days of the month time window as first sampling days of the corresponding abnormal conduction period, and determine an initial state of the first sampling days of the abnormal conduction period of the plurality of enterprises in the month time window according to second characteristic information of the plurality of sampling days of the plurality of enterprises in the month time window; and a third determining unit for determining an updated state of the plurality of enterprises on the first sampling day of the abnormal conduction period according to the initial state and the correlation information of the plurality of enterprises on the first sampling day of the abnormal conduction period and according to a preset abnormal propagation model.

Optionally, the third determining sub-module further comprises: a fourth determining unit configured to, for a second sampling day after the first sampling day in the abnormal conduction period, take an update status of the plurality of enterprises on a sampling day preceding the second sampling day as an initial status of the plurality of enterprises on the second sampling day; and a fifth determining unit, configured to determine an update status of the plurality of enterprises on the second sampling day according to the initial status and the correlation information of the plurality of enterprises on the second sampling day and according to a preset abnormal propagation model.

Optionally, the second determining unit includes: determining corresponding enterprise state information of the enterprises on the first sampling day according to the divergence rate of the enterprises on the first sampling day of the abnormal conduction period of the monthly time window, wherein the enterprise state information comprises abnormal state information which is transmitted as abnormal and non-abnormal state information which is not transmitted as abnormal; determining abnormal state information of the enterprises on the first sampling day of the abnormal conduction period and taking the abnormal state as an initial state under the condition that the enterprises are transmitted as abnormality on the first sampling day of the abnormal conduction period; and under the condition that the plurality of enterprises are not propagated as abnormal on the first sampling day of the abnormal conduction period, determining non-abnormal state information of the plurality of enterprises on the first sampling day of the abnormal conduction period according to the amplitude change intensity, and taking the non-abnormal state information as an initial state, wherein the non-abnormal state information comprises a latent state, an immune state and an abnormal state which is easy to occur.

Optionally, the third determining unit includes: calculating anomaly probability information of the plurality of enterprises on the first sampling day of the anomaly conduction period according to the anomaly resistance capability of the plurality of enterprises on the first sampling day of the anomaly conduction period, the anomaly propagation intensity of the enterprises associated with the plurality of enterprises, the feature association degree of the enterprises with the anomaly state associated with the plurality of enterprises and the number of the enterprises with the anomaly state associated with the plurality of enterprises, wherein the feature association degree is determined according to the correlation information corresponding to the first sampling day; when the initial state of the enterprises on the first sampling day of the abnormal conduction period is an abnormal state which is easy to occur or the initial state is a latent state and the latent day is zero, determining the update state of the enterprises on the first sampling day of the abnormal conduction period according to the abnormal probability information of the enterprises on the first sampling day of the abnormal conduction period; in the case that the initial state of the plurality of enterprises on the first sampling day of the abnormal conduction period is a latent state and the latent day is not zero, taking the initial state as an updated state of the plurality of enterprises on the first sampling day of the abnormal conduction period; and determining an updated state of the first sampling day according to the second characteristic information of the enterprises on the next sampling day of the first sampling day of the abnormal conduction period under the condition that the initial state of the enterprises on the first sampling day of the abnormal conduction period is an immune state.

Optionally, the third determining unit further includes: determining abnormal propagation intensity of the plurality of enterprises on the first sampling day of the abnormal conduction period according to a preset attenuation rate under the condition that the initial state of the plurality of enterprises on the first sampling day of the abnormal conduction period is an abnormal state; and determining abnormal states of the enterprises on the first sampling day of the abnormal conduction period according to the abnormal propagation intensity.

Optionally, the third determining unit includes: calculating anomaly probability information of the plurality of enterprises on the first sampling day of the anomaly conduction period according to the anomaly resistance capability of the plurality of enterprises on the first sampling day of the anomaly conduction period, the anomaly propagation intensity of the enterprises associated with the plurality of enterprises, the feature association degree of the enterprises with the anomaly state associated with the plurality of enterprises and the number of the enterprises with the anomaly state associated with the plurality of enterprises, wherein the feature association degree is determined according to the correlation information corresponding to the first sampling day; when the initial state of the enterprises on the second sampling day of the abnormal conduction period is an abnormal state which is easy to occur or the initial state is a latent state and the latent day is zero, determining the update state of the enterprises on the second sampling day of the abnormal conduction period according to the abnormal probability information of the enterprises on the second sampling day of the abnormal conduction period; in the case that the initial state of the plurality of enterprises on the second sampling day of the abnormal conduction period is a latent state and the latent day is not zero, taking the initial state as an updated state of the plurality of enterprises on the second sampling day of the abnormal conduction period; and determining an updated state of the second sampling day according to second characteristic information of the plurality of enterprises on a next sampling day of the second sampling day of the abnormal conduction period under the condition that the initial state of the plurality of enterprises on the second sampling day of the abnormal conduction period is an immune state.

Optionally, the third determining unit further includes: determining abnormal propagation intensity of the plurality of enterprises on the second sampling day of the abnormal conduction period according to a preset attenuation rate under the condition that the initial state of the plurality of enterprises on the second sampling day of the abnormal conduction period is an abnormal state; and determining an abnormal state of the plurality of enterprises on a second sampling day of the abnormal conduction period according to the abnormal propagation intensity.

Optionally, the third determining module 730 further includes: a first statistics sub-module, configured to count the abnormal times of the plurality of enterprises in each abnormal conduction period of the query period, and calculate a first average abnormal times of the plurality of enterprises in each month time window relative to the abnormal conduction period according to the abnormal times of the plurality of enterprises in each month time window of the query period and the number of the abnormal conduction periods of each month time window; the second statistics sub-module is used for counting the sum of the first average abnormal times corresponding to each month time window and the number of the month time windows of a plurality of enterprises, and calculating the second average abnormal times of the plurality of enterprises relative to the abnormal conduction time period in the query time period; and the sorting module is used for sorting the second average abnormal times of all enterprises and determining the enterprises with the preset number of maximum second average abnormal times as key enterprises.

Optionally, the third determining module 730 includes: a first calculation sub-module for calculating a sum of anomaly probability information of all enterprises of each abnormal conduction period of the query period, and calculating an average anomaly value with respect to the abnormal conduction period within each month time window according to the number of abnormal conduction periods of each month time window; and a comparison sub-module for comparing average outliers of the outlier conduction periods for each of the moon time windows, determining all of the outlier conduction periods of the moon time window for which the average outlier of the outlier conduction periods is greatest as the critical outlier conduction path.

Example 3

Fig. 8 shows an enterprise anomaly monitoring device 800 based on data asynchronous processing according to the present embodiment, the device 800 corresponding to the method according to the first aspect of embodiment 1. Referring to fig. 8, the apparatus 800 includes: a processor 810; and a memory 820 coupled to the processor 810 for providing instructions to the processor 810 for processing the following processing steps: determining enterprise data information, first characteristic information, second characteristic information, enterprise correlation information and enterprise anomaly information related to predetermined indexes of a plurality of enterprises in a data asynchronous processing mode, and storing the determined information into different data storage layers; responding to a query request input by a user, and determining a plurality of sampling days of a query period corresponding to the query request; and determining a critical enterprise to be monitored and a critical abnormal conduction path indicating a time path of abnormal propagation according to a plurality of sampling days of the query period and enterprise abnormal information corresponding to the plurality of sampling days, wherein the first characteristic information is used for indicating the change condition of enterprise data information of the corresponding enterprise between adjacent sampling days, the second characteristic information is used for indicating the divergence condition of the enterprise data information of the corresponding enterprise and the strength of the amplitude change of the enterprise data information, the correlation information is used for indicating the correlation between the first characteristic information of the plurality of enterprises in a sliding time window corresponding to the corresponding sampling days, and the enterprise abnormal information is used for indicating whether each sampling day of the enterprise in the abnormal conduction period corresponding to the corresponding sampling day is in an abnormal state and the probability of becoming the abnormal state.

Optionally, determining, by means of data asynchronous processing, enterprise data information related to predetermined indicators of a plurality of enterprises, first feature information, second feature information, enterprise correlation information, and enterprise anomaly information, and storing the determined information in different data storage layers, including: collecting enterprise data information of a plurality of enterprises on each sampling day, and updating an enterprise data information table arranged on a first data storage layer according to the collected enterprise data information; after updating the enterprise data information table on each sampling day, determining first characteristic information and second characteristic information of a plurality of enterprises, and updating a characteristic information table arranged on a second data storage layer according to the determined first characteristic information and second characteristic information, wherein the characteristic information table indexes the first characteristic information and the second characteristic information by the identification and date of the enterprises; after the characteristic information table is updated on each sampling day, determining enterprise correlation information corresponding to the corresponding sampling day according to the first characteristic information recorded in the characteristic information table, and creating an enterprise correlation information table corresponding to the enterprise correlation information in a third data storage layer, wherein each enterprise correlation information table is indexed through the corresponding sampling day; and on the last sampling day of each month, performing the following operations: determining an abnormal conduction period corresponding to a plurality of sampling days of the month respectively with the month as one month time window, wherein the abnormal conduction period extends from the corresponding sampling day to the last sampling day of the corresponding month time window; acquiring second characteristic information of a plurality of enterprises on a plurality of sampling days of the month from the characteristic information table and acquiring enterprise correlation information corresponding to the plurality of sampling days of the month from an enterprise correlation information table corresponding to the plurality of sampling days of the month; and determining enterprise anomaly information corresponding to each sampling day of the month according to the second characteristic information corresponding to the plurality of sampling days of the month and the correlation information corresponding to the plurality of sampling days of the month, and creating an enterprise anomaly information table corresponding to the month in a fourth data storage layer according to the determined enterprise anomaly information, wherein the enterprise anomaly information comprises enterprise state information and anomaly probability information, the enterprise state information is used for indicating whether each sampling day of the enterprise in the anomaly conduction period is an anomaly state, and the anomaly probability information is used for indicating the probability that each sampling day of the enterprise in the anomaly conduction period is an anomaly.

Optionally, determining, according to the plurality of sampling days of the query period and the enterprise anomaly information corresponding to the plurality of sampling days, an operation of a critical enterprise to be monitored and a critical anomaly conduction path indicating a time path of anomaly propagation, including: determining a month time window corresponding to the query request according to a plurality of sampling days of the query period; acquiring enterprise anomaly information corresponding to the determined first month time window from an enterprise anomaly information table under the condition that sampling days contained in the determined first month time window belong to the same month, and determining enterprise anomaly information corresponding to each sampling day in an anomaly conduction period of a plurality of enterprises and the second month time window according to second characteristic information and correlation information corresponding to a plurality of sampling days of the second month time window under the condition that sampling days contained in the determined second month time window belong to different months; and determining a critical enterprise to be monitored and a critical anomaly conduction path indicating a time path of anomaly propagation by using the enterprise anomaly information acquired based on the first month time window and the enterprise anomaly information determined based on the second month time window.

Optionally, according to the initial state and the correlation information of the plurality of enterprises on the first sampling day of the abnormal conduction period, determining the updated state of the plurality of enterprises on the first sampling day of the abnormal conduction period according to a preset abnormal propagation model includes: calculating anomaly probability information of the plurality of enterprises on the first sampling day of the anomaly conduction period according to the anomaly resistance capability of the plurality of enterprises on the first sampling day of the anomaly conduction period, the anomaly propagation intensity of the enterprises associated with the plurality of enterprises, the feature association degree of the enterprises with the anomaly state associated with the plurality of enterprises and the number of the enterprises with the anomaly state associated with the plurality of enterprises, wherein the feature association degree is determined according to the correlation information corresponding to the first sampling day; when the initial state of the enterprises on the first sampling day of the abnormal conduction period is an abnormal state which is easy to occur or the initial state is a latent state and the latent day is zero, determining the update state of the enterprises on the first sampling day of the abnormal conduction period according to the abnormal probability information of the enterprises on the first sampling day of the abnormal conduction period; in the case that the initial state of the plurality of enterprises on the first sampling day of the abnormal conduction period is a latent state and the latent day is not zero, taking the initial state as an updated state of the plurality of enterprises on the first sampling day of the abnormal conduction period; and determining an updated state of the first sampling day according to the second characteristic information of the enterprises on the next sampling day of the first sampling day of the abnormal conduction period under the condition that the initial state of the enterprises on the first sampling day of the abnormal conduction period is an immune state.

Optionally, determining the operation of the key enterprise to be monitored according to the plurality of sampling days of the query period and the enterprise anomaly information corresponding to the plurality of sampling days further includes: counting the abnormal times of the enterprises in each abnormal conduction period of the query period, and calculating the first average abnormal times of the enterprises relative to the abnormal conduction period in each month time window according to the abnormal times of the enterprises in each month time window of the query period and the number of the abnormal conduction periods of each month time window; counting the sum of the first average abnormal times of the enterprises corresponding to each month time window and the number of the month time windows, and calculating the second average abnormal times of the enterprises relative to the abnormal conduction time period in the query time period; and sequencing the second average abnormal times of the enterprises, and determining the predetermined number of enterprises with the largest second average abnormal times as key enterprises.

Optionally, determining the operation of the critical abnormal conduction path according to the plurality of sampling days of the query period and the enterprise abnormal information corresponding to the plurality of sampling days includes: calculating the sum of anomaly probability information of all enterprises of each abnormal conduction period of the query period, and calculating average anomaly values relative to the abnormal conduction periods in each month time window according to the number of the abnormal conduction periods in each month time window; and comparing the average anomaly values of the anomaly conduction periods for the respective month time windows, and determining all the anomaly conduction periods of the month time window for which the average anomaly value of the anomaly conduction period is greatest as the critical anomaly conduction path.

The foregoing embodiment numbers of the present application are merely for the purpose of description, and do not represent the advantages or disadvantages of the embodiments.

In the foregoing embodiments of the present application, the descriptions of the embodiments are emphasized, and for a portion of this disclosure that is not described in detail in this embodiment, reference is made to the related descriptions of other embodiments.

In the several embodiments provided in the present application, it should be understood that the disclosed technology may be implemented in other manners. The above-described embodiments of the apparatus are merely exemplary, and the division of the units, such as the division of the units, is merely a logical function division, and may be implemented in another manner, for example, multiple units or components may be combined or may be integrated into another system, or some features may be omitted, or not performed. Alternatively, the coupling or direct coupling or communication connection shown or discussed with each other may be through some interfaces, units or modules, or may be in electrical or other forms.

The units described as separate units may or may not be physically separate, and units shown as units may or may not be physical units, may be located in one place, or may be distributed on a plurality of network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

In addition, each functional unit in the embodiments of the present invention may be integrated in one processing unit, or each unit may exist alone physically, or two or more units may be integrated in one unit. The integrated units may be implemented in hardware or in software functional units.

The integrated units, if implemented in the form of software functional units and sold or used as stand-alone products, may be stored in a computer readable storage medium. Based on such understanding, the technical solution of the present invention may be embodied essentially or in part or all of the technical solution or in part in the form of a software product stored in a storage medium, including instructions for causing a computer device (which may be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method according to the embodiments of the present invention. And the aforementioned storage medium includes: a U-disk, a Read-Only Memory (ROM), a random access Memory (RAM, random Access Memory), a removable hard disk, a magnetic disk, or an optical disk, or other various media capable of storing program codes.

The foregoing is merely a preferred embodiment of the present invention and it should be noted that modifications and adaptations to those skilled in the art may be made without departing from the principles of the present invention, which are intended to be comprehended within the scope of the present invention.

Claims

1. An enterprise exception monitoring method based on data asynchronous processing is characterized by comprising the following steps:

determining enterprise data information, first characteristic information, second characteristic information, enterprise correlation information and enterprise anomaly information related to predetermined indexes of a plurality of enterprises in a data asynchronous processing mode, and storing the determined information into different data storage layers;

responding to a query request input by a user, and determining a plurality of sampling days of a query period corresponding to the query request; and

determining key enterprises to be monitored and key abnormal conduction paths indicating time paths of abnormal propagation according to a plurality of sampling days of the query period and enterprise abnormal information corresponding to the sampling days, wherein

The first characteristic information is used for indicating the change condition of the enterprise data information of the corresponding enterprise between adjacent sampling days, the second characteristic information is used for indicating the divergence condition of the enterprise data information of the corresponding enterprise and the intensity of the enterprise data information amplitude change, the correlation information is used for indicating the correlation between the first characteristic information of the plurality of enterprises in a sliding time window corresponding to the corresponding sampling days, and the enterprise abnormal information is used for indicating whether each sampling day of the enterprise in an abnormal conduction period corresponding to the corresponding sampling day is in an abnormal state and the probability of being in the abnormal state.

2. The method of claim 1, wherein determining, by way of data asynchronous processing, the business data information, the first characteristic information, the second characteristic information, the business correlation information, and the business anomaly information associated with the predetermined metrics for the plurality of businesses, and storing the determined information in the different data storage layers, comprises:

collecting enterprise data information of the enterprises on each sampling day, and updating an enterprise data information table arranged on the first data storage layer according to the collected enterprise data information;

after updating the enterprise data information table, determining first characteristic information and second characteristic information of the enterprises on each sampling day, and updating a characteristic information table arranged on a second data storage layer according to the determined first characteristic information and second characteristic information, wherein the characteristic information table indexes the first characteristic information and the second characteristic information by the identification and the date of the enterprises;

after the characteristic information table is updated on each sampling day, determining enterprise correlation information corresponding to the corresponding sampling day according to the first characteristic information recorded in the characteristic information table, and creating an enterprise correlation information table corresponding to the enterprise correlation information on a third data storage layer, wherein each enterprise correlation information table is indexed through the corresponding sampling day; and

On the last sampling day of each month, the following operations are performed:

determining, with the month as one month time window, an abnormal conduction period corresponding to a plurality of sampling days of the month, respectively, wherein the abnormal conduction period extends from a respective sampling day to a last sampling day of the corresponding month time window;

acquiring second characteristic information of the enterprises on a plurality of sampling days of the month from the characteristic information table and acquiring enterprise correlation information corresponding to the plurality of sampling days of the month from an enterprise correlation information table corresponding to the plurality of sampling days of the month; and

determining, from second characteristic information corresponding to a plurality of sampling days of the month and correlation information corresponding to a plurality of sampling days of the month, enterprise anomaly information corresponding to each sampling day of the month and creating, in a fourth data storage layer, an enterprise anomaly information table corresponding to the month according to the determined enterprise anomaly information, wherein the enterprise anomaly information includes enterprise status information indicating whether each sampling day of the enterprise in the anomaly conduction period is an anomaly state and anomaly probability information indicating a probability that each sampling day of the enterprise in the anomaly conduction period is an anomaly, wherein the enterprise anomaly information table includes enterprise status information indicating whether each sampling day of the enterprise in the anomaly conduction period is an anomaly state and anomaly probability information indicating a probability that each sampling day of the enterprise in the anomaly conduction period is an anomaly, and wherein

Determining, according to a plurality of sampling days of the query period and enterprise anomaly information corresponding to the plurality of sampling days, a critical enterprise to be monitored and a critical anomaly conduction path indicating a time path for anomaly propagation, including:

determining a month time window corresponding to the query request according to a plurality of sampling days of the query period;

acquiring enterprise anomaly information corresponding to the determined first month time window from the enterprise anomaly information table when the sampling days contained in the determined first month time window belong to the same month, and determining enterprise anomaly information corresponding to each sampling day in the abnormal conduction period of the second month time window for the plurality of enterprises according to second characteristic information and correlation information corresponding to the plurality of sampling days of the second month time window when the sampling days contained in the determined second month time window belong to different months; and

determining a critical business to be monitored and a critical anomaly conductive path indicating a time path for anomaly propagation using business anomaly information obtained based on a first month time window and business anomaly information determined based on a second month time window, wherein

And determining the enterprise correlation information corresponding to the sampling date according to the first characteristic information recorded in the characteristic information table, wherein the operation comprises the following steps: determining correlation information between any two enterprises in the sliding time window by utilizing a correlation calculation formula according to first characteristic information of the enterprises in the sliding time window corresponding to the sampling date, wherein

Determining, from the second characteristic information and the correlation information corresponding to the plurality of sampling days of the monthly time window, enterprise anomaly information corresponding to each sampling day within an anomalous conduction period of the monthly time window for the plurality of enterprises, including:

setting a plurality of sampling days of a month time window as first sampling days of corresponding abnormal conduction periods, and determining initial states of the plurality of enterprises in the first sampling days of the abnormal conduction periods of the month time window according to second characteristic information of the plurality of enterprises in the month time window; and

and determining the update state of the enterprises on the first sampling day of the abnormal conduction period according to the initial state and the correlation information of the enterprises on the first sampling day of the abnormal conduction period and a preset abnormal propagation model.

3. The method of claim 2, wherein determining enterprise anomaly information for the plurality of enterprises corresponding to respective sampling days within the anomalous conduction period of the month time window based on the second characteristic information and the correlation information corresponding to the plurality of sampling days of the month time window, further comprises:

for a second sampling day following the first sampling day within the abnormal conduction period, taking an updated state of the plurality of enterprises on a sampling day preceding the second sampling day as an initial state of the plurality of enterprises on the second sampling day; and

and determining the update state of the enterprises on the second sampling day according to the initial state and the correlation information of the enterprises on the second sampling day and a preset abnormal propagation model.

4. The method of claim 2, wherein the operations of setting the plurality of sampling days of the monthly time window as the first sampling day of the corresponding abnormal conduction period and determining the initial state of the plurality of enterprises at the first sampling day of the abnormal conduction period of the monthly time window based on the second characteristic information of the plurality of enterprises at the plurality of sampling days of the monthly time window comprise:

Determining enterprise state information corresponding to the plurality of enterprises on a first sampling day according to the divergence rate of the plurality of enterprises on the first sampling day of the abnormal conduction period of the month time window, wherein the enterprise state information comprises abnormal state information which is transmitted as an abnormality and non-abnormal state information which is not transmitted as an abnormality;

determining abnormal state information of the plurality of enterprises on the first sampling day of the abnormal conduction period and taking the abnormal state as the initial state under the condition that the plurality of enterprises are transmitted as abnormal on the first sampling day of the abnormal conduction period; and

determining non-abnormal state information of the plurality of enterprises on the first sampling day of the abnormal conduction period according to the amplitude variation intensity and taking the non-abnormal state information as the initial state, wherein the non-abnormal state information comprises a latent state, an immune state and an abnormal state which is easy to occur, wherein

According to the initial state and the correlation information of the enterprises on the first sampling day of the abnormal conduction period, determining the updated state of the enterprises on the first sampling day of the abnormal conduction period according to a preset abnormal propagation model, wherein the operation comprises the following steps:

Calculating anomaly probability information of the plurality of enterprises on the first sampling day of the anomaly conduction period according to the anomaly resistance capability of the plurality of enterprises on the first sampling day of the anomaly conduction period, the anomaly propagation intensity of the enterprises associated with the plurality of enterprises, the feature association degree of the enterprises with the anomaly state associated with the plurality of enterprises and the number of the enterprises with the anomaly state associated with the plurality of enterprises, wherein the feature association degree is determined according to the correlation information corresponding to the first sampling day;

determining an update state of the plurality of enterprises on the first sampling day of the abnormal conduction period according to the abnormal probability information of the plurality of enterprises on the first sampling day of the abnormal conduction period when the initial state of the plurality of enterprises on the first sampling day of the abnormal conduction period is an abnormal state or the initial state is a latent state and the latent day is zero;

in a case where an initial state of the plurality of enterprises on the first sampling day of the abnormal conduction period is a latent state and a latent day is not zero, taking the initial state as an updated state of the plurality of enterprises on the first sampling day of the abnormal conduction period; and

Determining an updated status of a first sampling day of the abnormal conduction period based on second characteristic information of the plurality of enterprises on a next sampling day of the abnormal conduction period, where the initial status of the plurality of enterprises on the first sampling day is an immune status

According to the initial state and the correlation information of the enterprises on the first sampling day of the abnormal conduction period, determining the updated state of the enterprises on the first sampling day of the abnormal conduction period according to a preset abnormal propagation model, and further comprising:

determining abnormal propagation intensity of the enterprises on the first sampling day of the abnormal conduction period according to a preset attenuation rate under the condition that the initial state of the enterprises on the first sampling day of the abnormal conduction period is an abnormal state; and

and determining the abnormal state of the enterprises on the first sampling day of the abnormal conduction period according to the abnormal propagation intensity.

5. The method of claim 3, wherein determining the updated status of the plurality of enterprises on the second sampling day based on the initial status and the correlation information of the plurality of enterprises on the second sampling day and based on a preset exception propagation model comprises:

Calculating anomaly probability information of the plurality of enterprises on a first sampling day of the anomalous conduction period according to the anomalous resistance capability of the plurality of enterprises on the first sampling day of the anomalous conduction period, the anomalous propagation intensity of the enterprises associated with the plurality of enterprises, the characteristic association degree of the enterprises associated with the plurality of enterprises and the number of the enterprises associated with the plurality of enterprises and having the anomalous state, wherein the characteristic association degree is determined according to the correlation information corresponding to the first sampling day;

determining an update state of the plurality of enterprises on the second sampling day of the abnormal conduction period according to the abnormal probability information of the plurality of enterprises on the second sampling day of the abnormal conduction period when the initial state of the plurality of enterprises on the second sampling day of the abnormal conduction period is an abnormal state or the initial state is a latent state and the latent day is zero;

in a case where an initial state of the plurality of enterprises on the second sampling day of the abnormal conduction period is a latent state and a latent day is not zero, taking the initial state as an updated state of the plurality of enterprises on the second sampling day of the abnormal conduction period; and

In the case that the initial state of the plurality of enterprises on the second sampling day of the abnormal conduction period is an immune state, determining an update state of the second sampling day according to second characteristic information of the plurality of enterprises on the next sampling day of the abnormal conduction period, and

according to the initial state and the correlation information of the enterprises on the second sampling day, determining the update state of the enterprises on the second sampling day according to a preset abnormal propagation model, and further comprising:

determining abnormal propagation intensity of the enterprises on the second sampling day of the abnormal conduction period according to a preset attenuation rate under the condition that the initial state of the enterprises on the second sampling day of the abnormal conduction period is an abnormal state; and

and determining the abnormal state of the enterprises on the second sampling day of the abnormal conduction period according to the abnormal propagation intensity.

6. The method of claim 2, wherein determining operation of the critical business to be monitored based on the plurality of sampling days of the query period and business anomaly information corresponding to the plurality of sampling days further comprises:

Counting the abnormal times of the enterprises in each abnormal conduction period of the inquiry period, and calculating the first average abnormal times of the enterprises relative to the abnormal conduction period in each month time window according to the abnormal times of the enterprises in each month time window of the inquiry period and the number of the abnormal conduction periods of each month time window;

counting the sum of the first average abnormal times corresponding to each month time window and the number of the month time windows of the enterprises, and calculating the second average abnormal times of the enterprises relative to the abnormal conduction time period in the query time period; and

ordering the second average abnormal times of the enterprises, determining the predetermined number of enterprises with the largest second average abnormal times as key enterprises, and

determining the critical abnormal conduction path according to a plurality of sampling days of the query period and enterprise abnormal information corresponding to the plurality of sampling days, comprising:

calculating the sum of abnormal probability information of all enterprises of each abnormal conduction period of the inquiry period, and calculating average abnormal values relative to the abnormal conduction periods in each month time window according to the number of the abnormal conduction periods in each month time window; and

Comparing the average abnormal values of the abnormal conduction periods of the respective month time windows, and determining all abnormal conduction periods of the month time window with the largest average abnormal value of the abnormal conduction periods as the key abnormal conduction path.

7. A storage medium comprising a stored program, wherein the method of any one of claims 1 to 6 is performed by a processor when the program is run.

8. An enterprise exception monitoring device based on data asynchronous processing, which is characterized by comprising:

the first determining module is used for determining enterprise data information, first characteristic information, second characteristic information, enterprise correlation information and enterprise abnormality information related to the preset indexes of a plurality of enterprises in a data asynchronous processing mode, and storing the determined information into different data storage layers;

a second determining module, configured to determine a plurality of sampling days of a query period corresponding to a query request input by a user in response to the query request; and

a third determining module for determining a critical enterprise to be monitored and a critical abnormal conduction path indicating a time path of abnormal propagation according to a plurality of sampling days of the query period and enterprise abnormal information corresponding to the plurality of sampling days, wherein

9. An enterprise exception monitoring device based on data asynchronous processing, which is characterized by comprising:

a processor; and

a memory, coupled to the processor, for providing instructions to the processor to process the following processing steps: