CN118331758A - Efficient fund transaction monitoring and analyzing system - Google Patents
Efficient fund transaction monitoring and analyzing system Download PDFInfo
- Publication number
- CN118331758A CN118331758A CN202410318377.5A CN202410318377A CN118331758A CN 118331758 A CN118331758 A CN 118331758A CN 202410318377 A CN202410318377 A CN 202410318377A CN 118331758 A CN118331758 A CN 118331758A
- Authority
- CN
- China
- Prior art keywords
- analysis
- node
- transaction
- monitoring
- monitoring rule
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
- 238000012544 monitoring process Methods 0.000 title claims abstract description 286
- 238000004458 analytical method Methods 0.000 claims abstract description 352
- 230000002776 aggregation Effects 0.000 claims abstract description 60
- 238000004220 aggregation Methods 0.000 claims abstract description 60
- 230000006870 function Effects 0.000 claims abstract description 20
- 238000012216 screening Methods 0.000 claims abstract description 5
- 238000000034 method Methods 0.000 claims description 30
- 238000012545 processing Methods 0.000 claims description 20
- 238000011156 evaluation Methods 0.000 claims description 18
- 230000002159 abnormal effect Effects 0.000 claims description 10
- 230000008569 process Effects 0.000 claims description 10
- 238000004364 calculation method Methods 0.000 claims description 8
- 238000012217 deletion Methods 0.000 claims description 4
- 230000037430 deletion Effects 0.000 claims description 4
- 230000001360 synchronised effect Effects 0.000 claims description 3
- 239000012634 fragment Substances 0.000 description 24
- 230000014509 gene expression Effects 0.000 description 4
- 238000012546 transfer Methods 0.000 description 4
- 238000010586 diagram Methods 0.000 description 3
- 238000006116 polymerization reaction Methods 0.000 description 3
- 230000009471 action Effects 0.000 description 2
- 239000000463 material Substances 0.000 description 2
- 230000005856 abnormality Effects 0.000 description 1
- 238000004891 communication Methods 0.000 description 1
- 238000011161 development Methods 0.000 description 1
- 238000005516 engineering process Methods 0.000 description 1
- 230000004927 fusion Effects 0.000 description 1
- 230000006872 improvement Effects 0.000 description 1
- 238000012986 modification Methods 0.000 description 1
- 230000004048 modification Effects 0.000 description 1
- 238000010606 normalization Methods 0.000 description 1
- 238000001028 reflection method Methods 0.000 description 1
- 238000006467 substitution reaction Methods 0.000 description 1
Landscapes
- Debugging And Monitoring (AREA)
Abstract
The invention provides a high-efficiency funds transaction monitoring and analyzing system, which comprises: a plurality of management nodes: screening out a monitoring rule subset from the cached monitoring rule set based on transaction information; selecting analysis nodes for each monitoring rule of the monitoring rule subset from the routing table in an asynchronous parallel mode, sending transaction analysis tasks to the selected analysis nodes, and counting analysis results returned by the selected analysis nodes to determine the transaction state of the transaction to be analyzed; a plurality of analysis nodes: constructing an aggregation query SQL statement by utilizing parameters of the transaction analysis task, querying in a database through the aggregation query SQL statement to obtain an aggregation value, determining an analysis result based on the aggregation value, and returning the analysis result to a management node for issuing the transaction analysis task; the database stores transaction information. The functions are distributed on different nodes, and the transaction analysis tasks are sent to the analysis nodes for analysis in an asynchronous parallel mode, so that the transaction analysis tasks are executed in parallel, and the transaction analysis efficiency is improved.
Description
Technical Field
The invention relates to the technical field of Internet, in particular to a high-efficiency funds transaction monitoring and analyzing system.
Background
With the rapid development of economies, the amount of funds traded and the frequency of trading increases rapidly, with more and more unusual transactions. The abnormal transaction not only causes huge loss to the user, but also seriously damages the financial order, hurts the credit of the financial institution, and causes bad influence in society.
The existing fund transaction monitoring analysis scheme generally calculates transaction information according to a pre-constructed monitoring rule, and obtains a transaction monitoring analysis result based on the calculation result. However, as the types of risk monitoring of the funds transaction increase, the number of monitoring rules increases, the transaction frequency increases, each funds transaction can be matched with a plurality of monitoring rules, the plurality of matched monitoring rules all need to be calculated, the time consumption is long, and the efficiency of monitoring and analyzing the funds transaction is reduced.
In addition, the existing fund transaction monitoring analysis scheme is characterized in that analysis and calculation of a plurality of monitoring rules and fusion of a plurality of calculation results are arranged on the same device, and the analysis efficiency of the transaction monitoring is low due to the fact that the analysis is limited by hardware such as calculation power and memory of a single device. As disclosed in the prior art with publication number CN114049215A, an abnormal transaction recognition method and device are disclosed, which are characterized in that the types of wind control rules are distinguished first, different types of wind control rules are input into different classifiers to be recognized to obtain keywords, the meaning represented by the wind control rules is represented according to the recognized keywords, and a corresponding processing mode is adopted according to the substantial meaning, so as to finally obtain a classification result, thereby improving the efficiency of transaction monitoring analysis. However, all the steps are executed on the same device, when the number of the transactions to be analyzed is large, the efficiency is limited by the computing resources of the device, the bottleneck of efficiency improvement exists, the transaction monitoring analysis result can not be obtained rapidly, and the efficiency can not be improved greatly.
Disclosure of Invention
The invention aims to solve the technical problem of low fund transaction monitoring analysis efficiency in the scenes of a large number of fund transactions and a large number of monitoring rules in the prior art, and provides a high-efficiency fund transaction monitoring analysis system.
To achieve the above object, the present invention provides a high-efficiency funds transaction monitoring and analyzing system, comprising: and each management node executes after receiving the transaction information of the transaction to be analyzed: screening out a monitoring rule subset from the monitoring rule set cached in the memory based on the transaction information; selecting analysis nodes for each monitoring rule of the monitoring rule subset in an asynchronous parallel mode from a routing table of the management node, sending a transaction analysis task to the selected analysis nodes, and counting analysis results returned by a plurality of selected analysis nodes to determine the transaction state of the transaction to be analyzed, wherein parameters of the transaction analysis task comprise transaction information and one monitoring rule in the monitoring rule subset; a plurality of analysis nodes, each analysis node executing, upon receiving a transaction analysis task: constructing an aggregation query SQL statement by utilizing the received parameters of the transaction analysis task, querying in a database through the aggregation query SQL statement to obtain an aggregation value, determining an analysis result based on the aggregation value, and returning the analysis result to a management node for issuing the transaction analysis task; and the database stores transaction information.
The transaction analysis system provided by the invention is divided into the management node and the analysis node, functions are distributed on different nodes, and transaction analysis tasks are submitted to the analysis node for analysis in an asynchronous parallel mode, so that the transaction analysis tasks can be executed in parallel, and the transaction analysis efficiency is greatly improved; in addition, the management node and the analysis node can be deployed with a plurality of nodes, so that the system has high availability and high expansibility.
Drawings
FIG. 1 is a schematic diagram of a funds-transaction monitoring and analysis system in accordance with a preferred embodiment of the invention;
FIG. 2 is a schematic diagram of a transaction analysis flow for a funds transaction monitoring and analysis system in accordance with a preferred embodiment of the invention;
FIG. 3 is an example of an analysis task log table record in a preferred embodiment of the present invention;
fig. 4 is a schematic diagram of a duty distribution of the process execution set monitoring rules of each analysis node in a preferred embodiment of the present invention.
Detailed Description
Embodiments of the present invention are described in detail below, examples of which are illustrated in the accompanying drawings, wherein like or similar reference numerals refer to like or similar elements or elements having like or similar functions throughout. The embodiments described below by referring to the drawings are illustrative only and are not to be construed as limiting the invention.
In the description of the present invention, it should be understood that the terms "longitudinal," "transverse," "upper," "lower," "front," "rear," "left," "right," "vertical," "horizontal," "top," "bottom," "inner," "outer," and the like indicate orientations or positional relationships based on the orientation or positional relationships shown in the drawings, merely to facilitate describing the present invention and simplify the description, and do not indicate or imply that the devices or elements referred to must have a specific orientation, be configured and operated in a specific orientation, and therefore should not be construed as limiting the present invention.
In the description of the present invention, unless otherwise specified and defined, it should be noted that the terms "mounted," "connected," and "coupled" are to be construed broadly, and may be, for example, mechanical or electrical, or may be in communication with each other between two elements, directly or indirectly through intermediaries, as would be understood by those skilled in the art, in view of the specific meaning of the terms described above.
The present invention provides an efficient funds transaction monitoring and analysis system which, in a preferred embodiment, as shown in figure 1, includes a plurality of management nodes, a plurality of analysis nodes, and a database (not shown) that stores transaction information for all transactions. A cluster consisting of a plurality of management nodes and a plurality of analysis nodes.
As shown in fig. 1, each management node and each analysis node communicate with each other through an RPC interface. Each management node provides an analysis node registration RPC interface for receiving registration requests of all analysis nodes; each analysis node provides a transaction analysis RPC interface for receiving transaction analysis tasks distributed by each management node; each management node is connected with an MQ (message queue) cluster, and cross-host collaboration, such as data synchronization, message notification and the like, is realized through the MQ (message queue) cluster.
Each management node provides a transaction monitoring analysis RPC interface, a monitoring rule adding RPC interface and a monitoring rule deleting RPC interface for external system call.
The system is a server-side program, is deployed and runs on a server, and interfaces and functions provided by all nodes (including a management node and an analysis node) support concurrent calling and processing.
In this embodiment, JAVA language coding is used, the database may be Oracle, mySQL, etc., the MQ (message queue) may be RocketMQ, rabbitMQ, etc., and the RPC framework may be Dubbo, spring-Cloud, etc.
In this embodiment, the management node is responsible for management of transaction information and analysis nodes and allocation of transaction analysis tasks, and the analysis nodes are responsible for analysis of transactions according to monitoring rules. The database stores transaction information, a monitoring rule set and analysis task logs, and can be arranged in a server arranged in addition, integrated in a storage device of a certain management node, or distributed and integrated in storage devices of a plurality of management nodes. The management node and the analysis node access the same database, the management node has new and updated operations on the data, and the analysis node only has query operations on the data. The system provides a transaction monitoring analysis RPC interface for the external system to call by each management node. RPC interface call: refers to a process on computer A that interfaces to a service provided by a process on computer B through a network. The calling party can transmit information to the called party through the parameters, and then can transmit the results processed by the called party back through the network to obtain the return data of the interface. This process is transparent to the developer.
In this embodiment, the transaction information includes attributes such as transaction id, transaction type, service code, application identifier, creation time, currency, transaction amount (score), terminal type, terminal identifier, terminal IP, transaction statement, authentication mode (such as payment password, electronic certificate, short message, face, etc., which may be plural), transaction status, payee account id, payee account level, payee certificate type, payee name (or name), payee certificate number, payee bank code, payee bank account name, payee bank account number, payee bank account type, payer account id, payer account level, payer certificate type, payer name (or name), payer certificate number, payer bank code, payer bank account name, payer bank account number, and payer bank account type. The transaction state comprises legal transaction and illegal transaction, when the transaction information is stored in the database, the initial default transaction state is legal transaction, and then the final transaction state is confirmed after transaction analysis.
In this embodiment, the monitoring rule set in the database is in the first form, and preferably, each monitoring rule in the database includes the following attributes:
Monitoring rule ID: monitoring a unique identifier of the rule;
Matching rules: expressing (or representing) by JAVA codes, constructing a complete JAVA class by using the attribute when the management node is started, compiling and instantiating, taking a compiled and instantiated object as a derivative attribute of the monitoring rule, and matching the monitoring rule and the transaction information by executing a matching method of the object (or the derivative attribute); the matching rule of the monitoring rule is expressed (or expressed) by the JAVA code, the matching rule has high flexibility, and when the monitoring rule is configured by a worker unfamiliar with the JAVA code, a code tool can be used for generating the JAVA code;
Polymerization period: can be any one of permanent, year, season, month, week, day and single pen; or may be a dynamically represented time interval;
Polymerization mode: any one of the total transaction amount, the average transaction amount, the median transaction amount and the variance transaction amount can be used, and particularly, when the attribute of the aggregation period is single, the aggregation mode must be the total transaction amount;
polymerization conditions: the SQL sentence fragment template consists of SQL sentences and EL expressions, and the content of the attribute is related to the names and field names of the transaction information tables in the database and the attribute names of the transaction information to be analyzed; for example:
PAYER_FINANCE_ACCOUNT_NUMBER＝′${payerFinanceAccountNumber}′AND PAY_TYPEIN(′INNERTRANS′,′REFUND′,′OUTERTRANS′), Wherein, "PAYER _ FINANCE _ ACCOUNT _number" is a "payer bank account NUMBER" field of the transaction information table, and "pay_type" is a "transaction TYPE" field of the transaction information table;
Illegal intervals: a closed interval consisting of a start value and an end value, for example: a start value of 201 and an end value of 500 indicate that the aggregate value is greater than or equal to 201 and less than or equal to 500 is an illegal transaction; if the ending value is null, infinity is indicated, for example: an initial value of 201 and an end value of null indicate that the aggregate value is greater than or equal to 201 and is illegal transaction;
Associated transaction types: the method comprises the steps of monitoring regular grouping cache to a memory; there may be multiple values, i.e., one monitoring rule may monitor and analyze multiple types of transactions, and one monitoring rule in the cache corresponds to multiple packets.
In this embodiment, to improve transaction analysis efficiency, preferably, each management node performs the following steps to cache the monitoring rule set in the memory when started:
Step one, a management node loads a monitoring rule set from a database, and executes each monitoring rule in the monitoring rule set: constructing a complete JAVA class by using the matching rule attribute of the monitoring rule, compiling and instantiating, and taking the compiled and instantiated object as the derivative attribute of the monitoring rule; wherein, the matching rule attribute of the monitoring rule is expressed in the form of JAVA codes. Specifically, all available monitoring rules are loaded from a database, complete JAVA classes are built by matching rule attributes (JAVA codes) of the monitoring rules (realizing TRANSMATCHER interfaces), the built complete JAVA classes are compiled and instantiated by using a JDK compiler (acquired by using a toolprovider. Getsystem JAVA compiler () method), the compiled and instantiated object is used as a derivative attribute of one TRANSMATCHER type of the monitoring rules, and the monitoring rules are matched with transaction information by executing a matching method (a method name is "matches") of the object, wherein the method is executed by logic represented by the matching rule attributes of the monitoring rules.
For example, the matching rule attribute of a certain monitoring rule is:
return″III″.equals(trans.getPayerAccountLevel())&&Utils.include(trans.getPayType(),″INNERTRANS″,″OUTERTRANS″,″REFUND″);
Wherein trans is a transaction information object, and the meaning of the code is as follows: this rule applies to transactions with an account rating of "III" for the payer and a transaction type of "INNERTRANS" (internal transfer) or "OUTERTRANS" (external transfer) or "REFUND" (REFUND).
The code for constructing the complete JAVA class (class name TRANSMATCHERPSIIITRANSYEAR W, format TRANSMATCHER + monitor rule ID) for the above example is as follows:
The code is compiled into a class file using a JDK compiler (acquired using the toolprovider.getsystem java compiler () method), the class file is instantiated using a reflection method (an instance object is created by calling the NEWINSTANCE () method of the class), and the instantiated object is used as a derivative attribute of TRANSMATCHER type of the monitoring rule.
And step two, the management node groups all the monitoring rules in the monitoring rule set according to the attribute of the 'associated transaction type' of the monitoring rules, wherein each transaction type corresponds to one group, each group comprises a plurality of monitoring rules, and each monitoring rule corresponds to more than one group. Specifically, the compiled monitoring rules are grouped according to the "associated transaction type" attribute of the monitoring rules, one transaction type corresponding to a set(s) of monitoring rules, one monitoring rule being associable with a plurality of transaction types. And finally, caching the grouped monitoring rule into a memory.
For example, an "associated transaction type" attribute of a certain monitoring rule is "INNERTRANS, OUTERTRANS, REFUND" indicating that the monitoring rule is applicable to all three transaction types, namely, INNERTRANS (internal transfer), OUTERTRANS (external transfer), refnd (REFUND) type transactions, i.e., all packets corresponding to the three transaction types contain the monitoring rule.
In this embodiment, the form of the monitoring rule that the management node compiles and instantiates the matching rule attribute according to the above steps and performs grouping and caching to the memory according to the "associated transaction type" attribute is called as a second form of the monitoring rule.
In this embodiment, preferably, in order to facilitate each management node to sense the operation state of each analysis node, the analysis node daemon is created when the analysis node is started, and the analysis node daemon executes: the analysis node initiates an analysis node registration request to each management node at regular time according to a first time interval, wherein parameters of the analysis node registration request comprise service IP and ports of the analysis node, the current system time of the analysis node, the CPU number of the analysis node hosting server, the CPU idle rate and the idle memory size.
In this embodiment, the first time interval is preferably, but not limited to, 10 to 20 seconds, such as 15 seconds. The first time interval is configured in each analysis node. The service IP and port of the registered RPC interface called by each management node for the analysis node are preconfigured in each analysis node. Each analysis node initiates a registration request of the analysis node to each management node by calling a registration RPC interface of each management node point to point at a first time interval, wherein parameters of the registration request of the analysis node comprise service IP and ports of the analysis node, the current system time (accurate to millisecond) of the analysis node, and resource information (specifically, the resource information can be acquired through a command or oshi component) of a host server of the analysis node such as the number of contained CPUs, CPU idle rate and idle memory size.
In this embodiment, in order to facilitate management of the analysis nodes and grasp the status of the analysis nodes, preferably, each management node has a routing table, where the routing table stores service IP and ports of each analysis node, creation time, latest registration time, network delay between the management node and the analysis node, and the number of CPUs, CPU idle rate and idle memory size of the host server of the analysis node.
In this embodiment, the network delay between the management node and the analysis node is the current system time of the management node minus the system time of the analysis node when the analysis node initiates a registration request to the management node, that is, the difference between the system time of the management node when the management node receives the registration request of the analysis node and the system time of the analysis node when the analysis node initiates the registration request to the management node, where the system time of the analysis node when the analysis node initiates the registration request to the management node is the parameter of the registration request initiated by the analysis node to the management node ("the current system time of the analysis node"). The resource information of the host server of the analysis node comprises the number of CPUs, the CPU idle rate and the idle memory size, which are parameters corresponding to the registration request initiated by the analysis node to the management node, and the parameters are stored in a routing table.
In this embodiment, when the analysis node initiates a registration request to the management node, the management node checks (uses the service ip+ port of the analysis node as a unique identifier) whether the analysis node exists in the routing table, if not, a new analysis node is created, for the newly created analysis node, the creation time is the current system time of the management node, the last registration time is also the current system time of the management node, and the service IP and port of the analysis node are parameters corresponding to the registration request initiated by the analysis node to the management node; if the analysis node exists in the routing table, updating the latest registration time of the analysis node as the current system time, and acquiring and updating network delay attributes of the management node and the analysis node and resource information of a host server of the analysis node in the same manner as the above, wherein the resource information comprises the number of CPUs, the CPU idle rate and the idle memory size.
In this embodiment, in order to ensure reliability of analysis nodes in the routing table of the management node, so that the transaction analysis task is smoothly executed by the analysis node, preferably, a routing table daemon thread is created when each management node is started, and the routing table daemon thread executes: the management node traverses the associated routing table at regular time according to the second time interval to remove the abnormal analysis node, wherein the abnormal analysis node is an analysis node which meets the requirement that the last registration time plus the overtime time is less than or equal to the current system time of the management node. The second time interval is preferably, but not limited to, 5 seconds to 15 seconds, preferably 10 seconds.
In this embodiment, the specific execution procedure of the routing table daemon thread is: traversing the routing table every second time interval, if the last registration time plus the timeout time of the analysis node in the routing table is less than or equal to the current system time of the management node, considering the corresponding analysis node to be an abnormal operation state, and removing the abnormal analysis node from the routing table, so that the management node does not distribute the analysis task to the analysis node any more, and the analysis node removal condition in the routing table needs to satisfy the following inequality:
Where c is the current system time (in milliseconds) of the management node, r is the last initiated registration time (in milliseconds) of the analysis node, A value that is a timeout function (rounded to an integer millisecond if the result of the calculation appears to be a fraction).
Timeout timeThe calculation formula of the function is as follows:
Wherein t is a time period for the analysis node to initiate a registration request to the management node, and is a first time interval; Mean value of network delay for the management node and each analysis node For the error function value of the network delay of the management node and each analysis node,D i represents the network delay from the ith analysis node to the management node in the routing table, and n represents the number of analysis nodes in the routing table of the management node. And when the analysis node does not initiate a registration request to the management node in two continuous registration request periods through the timeout time function, the management node regards the operation state of the corresponding analysis node as abnormal analysis node, and removes the abnormal analysis node from the routing table to ensure the availability of the analysis node in the routing table.
In this embodiment, the hosting servers that deploy the management nodes and the analysis nodes should be clocked through NTP service timing.
In this embodiment, each management node provides a transaction monitoring analysis RPC interface for an external system to call, and when the external system calls the transaction monitoring analysis RPC interface provided by the management node, the fund transaction analysis method of the fund transaction monitoring analysis system provided by the invention includes the following steps:
Step A, after receiving the transaction information of the transaction to be analyzed, each management node stores the transaction information of the transaction to be analyzed into a database (at this time, the transaction state defaults to a legal transaction), and executes: screening out a monitoring rule subset from the monitoring rule set cached in the memory based on the transaction information; selecting analysis nodes for each monitoring rule of the monitoring rule subset from the routing table of the management node in an asynchronous parallel mode, and sending transaction analysis tasks to the selected analysis nodes, so that the transaction analysis tasks are executed asynchronously and parallelly, the efficiency of transaction monitoring analysis is improved, and particularly if the number of the analysis nodes in the routing table of the management node is 0, the management node throws out abnormality and prompts 'no available analysis nodes' when the analysis nodes are selected for the monitoring rules in the monitoring rule subset; the parameters of the transaction analysis task comprise transaction information and one monitoring rule in the monitoring rule subset, the management node is defined to send the state of the monitoring rule in the transaction analysis task to the selected analysis node to be a third state, the monitoring rule of the third state comprises an unique ID attribute, an aggregation period attribute, an aggregation mode attribute, an aggregation rule template attribute and an illegal interval attribute of the monitoring rule, and the third state does not comprise a matching rule attribute and a derivative attribute which is formed by constructing JAVA class by the matching rule attribute and compiling and instantiating. The transaction information in the transaction analysis task sent to the analysis node contains all attributes of the transaction information.
Step B, each analysis node executes after receiving the transaction analysis task sent by the management node: and constructing an aggregation query SQL statement by utilizing the received parameters of the transaction analysis task, querying in a database through the aggregation query SQL statement to obtain an aggregation value, determining an analysis result based on the aggregation value and the illegal interval attribute of the monitoring rule, and returning the analysis result to a management node for issuing the transaction analysis task.
In this embodiment, specifically, step B includes:
And B.1, generating an aggregation rule (SQL statement) according to the aggregation rule template attribute of the monitoring rule and the transaction information. Generating an aggregation rule SQL sentence fragment by taking transaction information as a parameter and taking an aggregation rule template attribute of a monitoring rule as a template; calculating an aggregation time range according to the monitoring rule aggregation period attribute and generating an aggregation time range SQL sentence fragment; generating an aggregation mode SQL statement fragment according to the aggregation mode attribute of the monitoring rule; and finally splicing the SQL statement fragments into a complete aggregated query SQL statement.
The aggregated rule template attribute of the monitoring rule is in "SQL statement fragment+EL expression" format, for example, the aggregated rule template attribute of the monitoring rule is:
PAYER_FINANCE_ACCOUNT_NUMBER＝′${payerFinanceAccountNumber}′AND PAY_TYPE IN(′INNERTRANS′,′REFUND′,′OUTERTRANS′).
Wherein $ { payerFinanceAccountNumber } of the aggregation rule template attribute of the monitoring rule is an EL expression, when generating an aggregation rule SQL statement fragment, replacing the parameter with a value of a corresponding attribute in the transaction information, for example, payerFinanceAccountNumber (payer bank account number) attribute of the transaction information is "15987646541235254556", and the generated aggregation rule SQL statement fragment is:
PAYER_FINANCE_ACCOUNT_NUMBER＝′15987646541235254556′AND PAY_TYPE IN(′INNERTRANS′,′REFUND′,′OUTERTRANS′).
and calculating an aggregate time start-stop range according to the creation time attribute of the transaction information and the aggregation period of the monitoring rule, and generating an aggregate time range SQL sentence fragment. For example, the aggregate period attribute of the monitoring rule is "DAY" (the creation time attribute of the transaction information is "2024-01-11:53:54", the start and stop time of the time range is "2024-01-11:00:00.000-2024-01-11:23:59:59.999" (accurate to millisecond) by calculation, and the generated aggregate time range SQL sentence fragment is: CREATE_TIME > = '2024-01-11 00:00:00.000'AND CREATE_TIME < = '2024-01-11:59:59.999'.
Generating an aggregation mode SQL sentence fragment according to the aggregation mode attribute of the monitoring rule, for example, the value of the attribute is SUM (total transaction amount), and the generated aggregation mode SQL sentence fragment is: SELECT SUM (AMOUNT) FROM TRANS WHERE STATE = 'LEGAL' (where only transactions with "LEGAL transactions" status are aggregated).
Splicing the SQL statement fragments to obtain a complete aggregated query SQL statement comprises the following steps:
SELECT SUM(AMOUNT)FROM TRANS WHERE STATE＝′LEGAL′AND CREATE_TIME＞＝′2024-01-11 00:00:00.000′AND CREATE_TIME<＝′2024-01-11 23:59:59.999′AND PAYER_FINANCE_ACCOUNT_NUMBER＝′15987646541235254556′AND PAY_TYPE IN(′INNERTRANS′,′REFUND′,′OUTERTRANS′)
And B.2, inquiring the SQL sentence in a database (the analysis node and the management node use the same database) to obtain an aggregated value, namely an aggregated value.
And B.3, comparing the obtained aggregate value with an illegal section represented by an illegal section attribute of the monitoring rule, judging the transaction as illegal transaction if the aggregate value belongs to the illegal section of the monitoring rule, and judging the transaction as legal transaction if the aggregate value belongs to the illegal section of the monitoring rule.
And B.4, returning the analysis result to a management node for issuing a transaction analysis task.
In the embodiment, an SQL statement fragment+EL expression is adopted as an aggregation rule template of the monitoring rule, and an aggregation query SQL statement fragment is generated according to the attribute of the transaction information and the template, so that the flexibility of the aggregation rule is high, and the process of generating the aggregation query SQL statement fragment is simple and high in efficiency.
In this embodiment, two attributes, namely, the "aggregation period" and the "aggregation mode" attribute of the monitoring rule are used to generate the analysis node to generate the aggregated query SQL statement fragment. In the above step b.1, particularly, when the "aggregation period" attribute is "SINGLTEN (single stroke)", the "aggregation mode" attribute is only "SUM (total transaction amount)", and the value of the transaction amount attribute of the current transaction is directly compared with the illegal section represented by the illegal section attribute of the monitoring rule without generating the aggregation query SQL statement, if the value belongs to the illegal section of the monitoring rule, the transaction is judged as "illegal transaction", otherwise, the transaction is judged as "conforming to the transaction". In particular, when the "syndication period" attribute is "PERM (permanent)", the syndication time range SQL statement fragment is not generated, i.e., the time range of the syndication query is not limited. When the attribute of the aggregation period is "YEAR", according to the start-stop time of the natural YEAR in which the attribute of the creation time of the transaction information is located, and generating an aggregation time range SQL statement fragment, for example, when the attribute of the creation time of the transaction information is "2024-01-11:14:53:54", the aggregation period attribute is "YEAR", the generated aggregation time range SQL statement fragment is: CREATE_TIME > = '2024-01-01 00:00:00.000'AND CREATE_TIME < = '2024-12-31:59:59.999'; when the "aggregation period" attribute is "Month (MONTH)", generating an aggregation time range SQL sentence fragment according to the start-stop time of the natural MONTH in which the creation time attribute of the transaction information is located, for example, when the creation time attribute of the transaction information is "2024-01-11:14:53:54", the generated aggregation time range SQL sentence fragment is: CREATE_TIME > = '2024-01-01 00:00:00.000'AND CREATE_TIME < = '2024-01-31 23:59:59.999'; and so on.
When the "aggregation mode" attribute of the monitoring rule is "COUNT (total transaction number)", the generated aggregation mode SQL statement fragment is: SELECT COUNT (AMOUNT) FROM TRANS WHERE STATE = 'LEGAL'; when the "aggregation mode" attribute is "AVG (average transaction amount)", the resulting aggregation mode SQL statement fragment is: SELECT AVG (AMOUNT) FROM TRANS WHERE STATE = 'LEGAL'; and so on.
And C, counting analysis results returned by the plurality of selected analysis nodes and determining the final transaction state of the transaction to be analyzed.
The step C specifically comprises the following steps: the management node waits for and receives the analysis results returned by the analysis nodes (the analysis results returned by the analysis nodes are stored in the created Complet ionService objects, and a like method of the Complet ionService objects is called (the method is blocked until the analysis results of a plurality of selected analysis nodes are all returned) to acquire, and the number of the analysis results is equal to the number of the monitoring rules in the monitoring rule subset B. If the analysis result returned by the analysis node is that the number of illegal transactions is greater than 0, judging the final transaction state of the transaction corresponding to the transaction information of the transaction to be analyzed as illegal transaction, and updating the state of the corresponding transaction information record in the database as illegal transaction state; otherwise, judging the final transaction state of the transaction corresponding to the transaction information as legal transaction.
In this embodiment, the method further includes the step of the management node returning the determined final transaction status of the transaction to be analyzed to the external invocation system.
In a preferred embodiment, in order to improve the transaction analysis efficiency, in the step a, referring to fig. 2, the process of screening, by the management node, the subset of monitoring rules from the monitoring rule set cached in the memory based on the transaction information includes:
Step A-1, obtaining a monitoring rule group adapting to the transaction type attribute of the transaction information from a monitoring rule set cached in a memory, wherein the adapted monitoring rule group forms a monitoring rule set A;
And A-2, traversing the monitoring rule set A, matching the monitoring rule with the transaction information by executing a matching method of derivative attributes of the monitoring rule, extracting the monitoring rule matched with the transaction information, and forming the extracted monitoring rule into a monitoring rule subset B.
Specifically, the matching action is completed by executing a matching method (the method name is "matches", and the method is incorporated as all information of a transaction) of constructing JAVA code from the matching rule attribute of the monitoring rule and compiling the instantiated object (the object is taken as a derivative attribute of TRANSMATCHER types of monitoring rules to which the matching rule attribute belongs).
In this embodiment, a dynamic compiling and caching technology is adopted, that is, when the system is started (or newly added), the matching rule attribute (JAVA code) of the monitoring rule is constructed into a complete JAVA class, the JAVA class is compiled and instantiated, the instance object is used as a derivative attribute of the monitoring rule, then the monitoring rule is cached to the memory in groups according to the associated transaction type, the management node reduces the range of matching the monitoring rule through the transaction type attribute of the transaction information, the matching actions are completed in the memory, and the matching efficiency of the monitoring rule and the transaction information is improved.
In a preferred embodiment, to compromise network latency, idle level, load and processing capacity of the analysis node, the management node reasonably selects the analysis node from the routing table for each monitoring rule, so as to improve analysis efficiency. Preferably, in the above step a, an analysis node is selected from the routing table of the management node for each monitoring rule of the subset of monitoring rules (refer to step a-3 in fig. 2), and for the monitoring rule B, B e B in the subset of monitoring rules B, the method includes:
step A-3-1, obtaining first information of each analysis node in a routing table of a management node, wherein the first information comprises network delay between the analysis node and the management node, and the number of CPUs (central processing units) of a host server of the analysis node, CPU idle rate and idle memory size;
step A-3-2, calculating an evaluation value of each analysis node according to a preset first evaluation function based on the first information of each analysis node;
And step A-3-3, selecting an analysis node with the highest evaluation value as an analysis node of the monitoring rule b.
In this embodiment, it is further preferable that the first evaluation function is:
D represents the network delay of the analysis node and the management node, and in the practical application, the management node and the analysis node are both deployed in the same local area network with the unit of milliseconds, and the network delay is within 2 milliseconds; l represents the CPU idle rate (percentage, to be converted into a fraction between (0, 1)) of the host server of the analysis node; n' represents the number of CPUs of the host server of the analysis node; e is a natural logarithmic base. g (m) represents a normalized value of the free memory size m (in MB) of the host server of the analysis node, the value of the free memory size m under the set dimension MB is brought into a normalization function (arctangent function) to normalize to the interval (0, 1), Pi is the circumference ratio.
In a preferred embodiment, in order to consider network delay, idle degree, load and processing capacity of analysis nodes and the distribution condition of transaction analysis tasks corresponding to all monitoring rules processed by the analysis nodes in the system, the analysis nodes with strong processing capacity are selected, and meanwhile the transaction analysis tasks corresponding to all monitoring rules are uniformly distributed on all the analysis nodes, so that the robustness, safety and processing capacity of the system are enhanced, and the transaction analysis tasks of some monitoring rules are prevented from being concentrated on part of the analysis nodes. Preferably, in the step a, the step of selecting the analysis node from the routing table of the management node for each monitoring rule of the subset of monitoring rules (refer to step a-3 in fig. 2): respectively selecting analysis nodes for each monitoring rule in the monitoring rule subset B, and selecting the analysis nodes for the monitoring rules B, B epsilon B as follows:
Step A-3-1', retrieving an analysis task log table from a database, calculating the duty ratio distribution of the analysis tasks including the monitoring rule b by using data in the analysis task log table, and obtaining the duty ratio p of each analysis node for processing the transaction analysis tasks including the monitoring rule b according to the duty ratio distribution; the analysis task log table comprises three fields of analysis node ID, monitoring rule ID and transaction ID, and records are added to the table when the management node sends the transaction analysis task to the selected analysis node. In the above-mentioned duty distribution, each analysis node processes the duty cycle p e [0,1] of the transaction analysis task including the monitoring rule b, and the sum of the duty cycles of all analysis nodes processing the transaction analysis task including the monitoring rule b is equal to 1.
And step A-3-2', calculating the evaluation value of each analysis node according to the network delay between each analysis node and the management node in the routing table of the management node, the CPU number, the CPU idle rate and the idle memory size of the host server of the analysis node, the duty ratio p of the analysis node for processing the transaction analysis task containing the monitoring rule b and a preset second evaluation function.
The second evaluation function is expressed as:
and step A-3-3', selecting the analysis node with the largest evaluation value as the analysis node of the monitoring rule b.
In an application scenario of this embodiment, the detailed process of executing step a by the management node is:
Step 4.1, construct CompletionService objects with thread pools for asynchronous parallel scheduling execution: and selecting an analysis node for the monitoring rule b and sending a transaction analysis task to the selected analysis node, so that the proper analysis node asynchronously and parallelly processes the transaction analysis task.
And 4.2, traversing the monitoring rules in the monitoring rule subset B, creating an asynchronous transaction analysis task object by using the monitoring rules and the transaction information, and submitting the asynchronous transaction analysis task object to CompletionService objects for scheduling and executing, so that the created asynchronous transaction analysis task object is executed asynchronously and parallelly. The execution logic of the asynchronous transaction analysis task object is as follows:
Step 4.2.1, counting and calculating the distribution condition (the duty ratio p, p E [0,1 ]) of the transaction analysis task of each analysis node for processing the monitoring rule according to the designated monitoring rule ID from the analysis task log table (comprising three fields: analysis node ID, monitoring rule ID and transaction ID) of the database. For example, each analysis node of the monitoring rule (monitoring rule ID "INNERTRANSDAY CT") counts and calculates the distribution of transaction analysis tasks of the monitoring rule. The distribution of transaction analysis tasks of each analysis NODE for processing the monitoring rule is shown in fig. 4, the analysis_node_id field is the ID of the analysis stage, and the report field is the duty ratio of the transaction analysis task for processing the specified monitoring rule, i.e., p. If the analysis node is not present in the result of fig. 4, the value of p is 0.
Step 4.2.2, selecting an analysis node from the routing table of the management node for sending the current transaction analysis task to the node: according to the network delay between the analysis node and the management node, the resource information of the host server of the analysis node comprises the number of CPUs, the CPU idle rate, the idle memory size and the distribution condition comprehensive evaluation (using a second evaluation function) of the transaction analysis task of the analysis node processing the appointed monitoring rule, which is obtained in the step 4.2.1, the score is calculated, and one analysis node with the highest score is selected.
The second evaluation function is inversely related to the network delay of the analysis node and the management node, is inversely related to the number of CPUs, the CPU idle rate and the idle memory size of the host server of the analysis node, and is inversely related to the duty ratio of the transaction analysis task of the analysis node for processing the appointed monitoring rule. When the analysis node is selected to submit the transaction analysis task, the network delay of the analysis node is considered, the idle degree of the analysis node and the distribution condition of the transaction analysis task taking the monitoring rule as the dimension are considered; the transaction analysis tasks are uniformly distributed on each analysis node, and meanwhile, the load and the processing capacity of the analysis nodes are considered.
And 4.2.3, creating a proxy object of the transaction analysis RPC interface by using the analysis node object (including the service IP and the port of the analysis node) obtained in the step 4.2.2, wherein the created proxy object is cached according to the node IP, the port and the interface name, so that the efficiency is prevented from being influenced by creating the proxy object for multiple times.
Step 4.2.4 converting the monitoring rule parameters required by the analysis node (without transmitting all the attributes of the monitoring rule to the analysis node): monitoring rule ID, aggregation period, aggregation mode, aggregation condition template and illegal section.
And 4.2.5, recording analysis task logs, and storing the ID (the format is 'service IP of analysis node: port') of the analysis node object obtained in the step 4.2.2, the monitoring rule ID and the transaction ID as one analysis task log record to an analysis task log table of a database so as to count and calculate the distribution condition of the transaction analysis tasks of each analysis node for processing the monitoring rule in the step 4.2.1. An example of a record of an analysis task log table is shown in fig. 3.
In fig. 3, the analysis_node_id field is ID of the analysis stage, the meta_id field is monitoring rule ID, and the trans_id field is transaction ID.
And 4.2.6, transmitting the parameters and the transaction information converted in the step 4.2.4 to a corresponding analysis node through the transaction analysis RPC interface proxy object created in the step 4.2.3.
In a preferred embodiment, the plurality of management nodes synchronize the monitoring rules according to the following steps:
setting the management node set as J, wherein J and J ' are management node indexes, and J is not equal to J ', J is epsilon J, and J ' is epsilon J;
When the monitoring rule is newly added: each management node provides a new monitoring rule RPC interface for an external system, and the external system calls the new monitoring rule interface provided by the management node j; the management node j stores the monitoring rule to be newly added into a database, the management node j caches the newly added monitoring rule (constructs a complete JAVA class by matching rule attributes, compiles and instantiates the monitoring rule, takes a compiled and instantiated object as a derivative attribute of TRANSMATCHER types of the newly added monitoring rule, and caches the derivative attribute into a memory according to the attribute group of ' associated transaction types '), and synchronizes basic information of the newly added monitoring rule to the management node j ' in a broadcasting mode through an MQ (message queue) cluster; after receiving the message of the newly added monitoring rule synchronized by the MQ (message queue) cluster, the management node j' caches the newly added monitoring rule (constructs a complete JAVA class by matching rule attributes, compiles and instantiates, takes the compiled and instantiated object as a derivative attribute of one TRANSMATCHER type of the newly added monitoring rule, and caches the derivative attribute into a memory according to the associated transaction type attribute group.
When a monitoring rule is deleted: each management node provides a deletion monitoring rule RPC interface for an external system, and the external system calls the deletion monitoring rule interface provided by the management node j; the management node j deletes the monitoring rule to be deleted from the database, deletes the monitoring rule to be deleted from the monitoring rule set cached in the memory (removes the monitoring rule to be deleted from the monitoring rule cache grouped according to the transaction type according to the acquired associated transaction type), and synchronizes the basic information of the monitoring rule to be deleted to the management node j' in a broadcasting mode through an MQ (message queue) cluster; the management node j' deletes the monitoring rule to be deleted from the monitoring rule set of the memory cache (removes the monitoring rule to be deleted from the monitoring rule cache which has been grouped by "transaction type" according to the received "associated transaction type").
In this embodiment, the system of the present invention provides the monitoring rule adding/deleting RPC interface for the external system to call by the management node, so as to manage the monitoring rule. After the management node completes the new adding/deleting operation of the database monitoring rule record and the new adding/deleting operation of the monitoring rule in the cache of the management node, other management nodes are informed of the new adding/deleting information of the monitoring rule through the MQ (message queue) cluster, and the other management nodes perform the new adding/deleting operation on the monitoring rule cached in the memory after receiving the new adding/deleting information of the monitoring rule, so that the consistency of the data cached in the memory of the database and each management node is ensured.
In the description of the present specification, a description referring to terms "one embodiment," "some embodiments," "examples," "specific examples," or "some examples," etc., means that a particular feature, structure, material, or characteristic described in connection with the embodiment or example is included in at least one embodiment or example of the present invention. In this specification, schematic representations of the above terms do not necessarily refer to the same embodiments or examples. Furthermore, the particular features, structures, materials, or characteristics described may be combined in any suitable manner in any one or more embodiments or examples.
While embodiments of the present invention have been shown and described, it will be understood by those of ordinary skill in the art that: many changes, modifications, substitutions and variations may be made to the embodiments without departing from the spirit and principles of the invention, the scope of which is defined by the claims and their equivalents.
Claims (10)
1. An efficient funds transaction monitoring and analysis system, comprising:
And each management node executes after receiving the transaction information of the transaction to be analyzed: screening out a monitoring rule subset from the monitoring rule set cached in the memory based on the transaction information; selecting analysis nodes for each monitoring rule of the monitoring rule subset in an asynchronous parallel mode from a routing table of the management node, sending a transaction analysis task to the selected analysis nodes, and counting analysis results returned by a plurality of selected analysis nodes to determine the transaction state of the transaction to be analyzed, wherein parameters of the transaction analysis task comprise transaction information and one monitoring rule in the monitoring rule subset;
A plurality of analysis nodes, each analysis node executing, upon receiving a transaction analysis task: constructing an aggregation query SQL statement by utilizing the received parameters of the transaction analysis task, querying in a database through the aggregation query SQL statement to obtain an aggregation value, determining an analysis result based on the aggregation value, and returning the analysis result to a management node for issuing the transaction analysis task;
and the database stores transaction information.
2. An efficient funds transaction monitoring and analysis system according to claim 1, wherein the database stores a monitoring rule set, the management node, upon start-up, performing the steps of caching the monitoring rule set in memory:
The management node loads a monitoring rule set from the database, and executes for each monitoring rule in the monitoring rule set: constructing a complete JAVA class by using the matching rule attribute of the monitoring rule, compiling and instantiating, and taking the compiling and instantiating object as the derivative attribute of the monitoring rule; wherein, the matching rule attribute of the monitoring rule is expressed in the form of JAVA codes;
The management node groups all monitoring rules in the monitoring rule set according to the transaction type attribute of the monitoring rules, each transaction type corresponds to one group, each group comprises a plurality of monitoring rules, and each monitoring rule corresponds to more than one group.
3. The efficient funds transaction monitoring and analysis system of claim 2, wherein the management node screens out a subset of monitoring rules from the set of monitoring rules cached in the memory based on the transaction information, comprising:
acquiring a monitoring rule group adapting to the transaction type attribute of the transaction information from the cached monitoring rule set, wherein the adapted monitoring rule group forms a monitoring rule set A;
traversing the monitoring rule set A, matching the monitoring rule with the transaction information by executing a matching method of the derivative attribute of the monitoring rule, extracting the monitoring rule matched with the transaction information, and forming the extracted monitoring rule into a monitoring rule subset B.
4. A high efficiency funds transaction monitoring and analysis system according to any of claims 1 to 3, wherein an analysis node daemon thread is created at start-up, said analysis node daemon thread executing:
The analysis node initiates a node registration request to each management node at regular time according to a first time interval, wherein parameters of the analysis node registration request comprise service IP and ports of the analysis node, the current system time of the analysis node, the CPU number of the analysis node hosting server, the CPU idle rate and the idle memory size.
5. The system of claim 4, wherein each management node has a routing table, the routing table stores service IP and port of each analysis node, creation time, last registration time, network delay between the management node and the analysis node, CPU number of the host server of the analysis node, CPU idle rate and idle memory size;
each management node creates a routing table daemon thread at startup, which performs:
The management node traverses the routing table at regular time according to the second time interval to remove the abnormal analysis node, wherein the abnormal analysis node is an analysis node which meets the requirement that the time of the last registration plus the timeout time is less than or equal to the current system time of the management node.
6. An efficient funds transaction monitoring and analysis system according to claim 5, wherein the timeout periodThe calculation formula of (2) is as follows:
Wherein t is the first time interval; An average value of network delay of the management node and each analysis node; For the error function value of the network delay of the management node and each analysis node, d i represents the network delay from the ith analysis node to the management node in the routing table, n represents the number of analysis nodes in the routing table of the management node,
7. An efficient funds transaction monitoring and analysis system according to claim 5 or 6, wherein the selecting of analysis nodes from the routing table of the management node for each monitoring rule of a subset of monitoring rules, for monitoring rule B, B e B, of monitoring rule subset B, comprises:
Acquiring first information of each analysis node in a routing table of a management node, wherein the first information comprises network delay of the analysis node and the management node, and the number of CPUs (central processing units) of a host server of the analysis node, CPU idle rate and idle memory size;
calculating an evaluation value of each analysis node according to a preset first evaluation function based on the first information of each analysis node;
And selecting the analysis node with the highest evaluation value as the analysis node of the monitoring rule b.
8. The efficient funds transaction monitoring and analysis system of claim 7, wherein the first evaluation function is:
D represents the network delay of the analysis node and the management node; l represents the CPU idle rate of the host server of the analysis node, n' represents the number of CPUs of the host server of the analysis node, and g (m) represents the normalized value of the idle memory size m of the host server of the analysis node.
9. An efficient funds transaction monitoring and analysis system according to claim 5 or 6, wherein the step of selecting an analysis node from the routing table of the management node for each monitoring rule of a subset of monitoring rules is: respectively selecting analysis nodes for each monitoring rule in the monitoring rule subset B, and selecting the analysis nodes for the monitoring rules B, B epsilon B as follows:
the method comprises the steps of calling an analysis task log table from a database, obtaining the duty ratio distribution of analysis nodes for processing transaction analysis tasks containing monitoring rules b by using the analysis task log table, and obtaining the duty ratio p of each analysis node for processing the transaction analysis tasks containing the monitoring rules b according to the duty ratio distribution; the analysis task log table comprises an analysis node ID, a monitoring rule ID and a transaction ID;
according to the network delay between each analysis node and the management node in the routing table of the management node, the CPU number, CPU idle rate and idle memory size of the host server of the analysis node, and the duty ratio p of the analysis node to process the transaction analysis task containing the monitoring rule b, calculating an evaluation score according to a preset second evaluation function;
And selecting the analysis node with the largest evaluation value as the analysis node of the monitoring rule b.
10. An efficient funds transaction monitoring and analysis system according to claim 1 or 2 or 3 or 5 or 6 or 8, wherein a plurality of management nodes synchronize monitoring rules according to the steps of:
setting the management node set as J, wherein J and J ' are management node indexes, and J is not equal to J ', J is epsilon J, and J ' is epsilon J;
When the monitoring rule is newly added: each management node provides a new monitoring rule RPC interface for an external system, and the external system calls the new monitoring rule interface provided by the management node j; the management node j stores the monitoring rule to be added into a database, compiles and instantiates the monitoring rule to be added and groups and caches the monitoring rule to be added into a memory, and synchronizes the monitoring rule to be added to the management node j' in a broadcasting mode through an MQ cluster; after receiving the information of the monitoring rule to be newly added, which is synchronized by the MQ cluster, the management node j' compiles and instantiates the monitoring rule to be newly added and caches the monitoring rule to the memory in groups;
When a monitoring rule is deleted: each management node provides a deletion monitoring rule RPC interface for an external system, and the external system calls the deletion monitoring rule interface provided by the management node j; the management node j deletes the monitoring rule to be deleted from the database, deletes the monitoring rule to be deleted from the monitoring rule set cached in the memory, and synchronizes the monitoring rule to be deleted to the management node j' in a broadcasting mode through the MQ cluster; and after receiving the monitoring rule information to be deleted, which is synchronized by the MQ cluster, the management node j' respectively deletes the monitoring rule to be deleted from the monitoring rule set cached in the memory.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202410318377.5A CN118331758A (en) | 2024-03-19 | 2024-03-19 | Efficient fund transaction monitoring and analyzing system |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202410318377.5A CN118331758A (en) | 2024-03-19 | 2024-03-19 | Efficient fund transaction monitoring and analyzing system |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN118331758A true CN118331758A (en) | 2024-07-12 |
Family
ID=91771479
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202410318377.5A Pending CN118331758A (en) | 2024-03-19 | 2024-03-19 | Efficient fund transaction monitoring and analyzing system |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN118331758A (en) |
Citations (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20080162396A1 (en) * | 2005-02-10 | 2008-07-03 | Paul Kerley | Transaction Data Processing System |
| CN105590216A (en) * | 2015-11-18 | 2016-05-18 | 中国银联股份有限公司 | Method and system of real-time monitoring of transaction risk |
| CN111737274A (en) * | 2020-06-19 | 2020-10-02 | 中国工商银行股份有限公司 | Transaction data processing method and device and server |
-
2024
- 2024-03-19 CN CN202410318377.5A patent/CN118331758A/en active Pending
Patent Citations (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20080162396A1 (en) * | 2005-02-10 | 2008-07-03 | Paul Kerley | Transaction Data Processing System |
| CN105590216A (en) * | 2015-11-18 | 2016-05-18 | 中国银联股份有限公司 | Method and system of real-time monitoring of transaction risk |
| CN111737274A (en) * | 2020-06-19 | 2020-10-02 | 中国工商银行股份有限公司 | Transaction data processing method and device and server |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| US7107340B2 (en) | System and method for collecting and storing event data from distributed transactional applications | |
| US9652287B2 (en) | Using databases for both transactions and analysis | |
| US7313575B2 (en) | Data services handler | |
| CN108304554B (en) | File splitting method and device, computer equipment and storage medium | |
| US9020949B2 (en) | Method and system for centralized issue tracking | |
| US11947524B2 (en) | Transaction processing method and apparatus, computer device, and storage medium | |
| US20040230667A1 (en) | Loosely coupled intellectual capital processing engine | |
| CN111429241A (en) | Accounting processing method and device | |
| JP5038902B2 (en) | On-demand message-based financial network integration middleware | |
| CN111091358B (en) | Unified processing method and system for multiple payment channels | |
| CN103473696A (en) | Method and system for collecting, analyzing and distributing internet business information | |
| CN111400011A (en) | Real-time task scheduling method, system, equipment and readable storage medium | |
| US20040230442A1 (en) | Access control over dynamic intellectual capital content | |
| CN115186304B (en) | Transaction data verification method and system based on block chain | |
| CN112559525B (en) | Data checking system, method, device and server | |
| CN111782262B (en) | Data dynamic publishing method, device, system, equipment and storage medium | |
| US20040230982A1 (en) | Assembly of business process using intellectual capital processing | |
| CN115757552B (en) | Bank historical data management system based on distributed microservice | |
| CN113722114A (en) | Data service processing method and device, computing equipment and storage medium | |
| CN118331758A (en) | Efficient fund transaction monitoring and analyzing system | |
| US20040230567A1 (en) | Integrating intellectual capital into an intellectual capital management system | |
| US20040230691A1 (en) | Evolutionary development of intellectual capital in an intellectual capital management system | |
| US20040230618A1 (en) | Business intelligence using intellectual capital | |
| US20040230588A1 (en) | Methods and systems for publishing and subscribing to intellectual capital | |
| US20040230590A1 (en) | Asynchronous intellectual capital query system |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination |