CN118505382A - Data processing method and device, electronic equipment and storage medium - Google Patents

Abstract

The present invention discloses a data processing method, device, electronic device and storage medium. The method comprises: constructing a graph association structure with transaction subjects in a target business scenario as nodes and association relationships between transaction subjects as edges; determining an abnormal value corresponding to each node based on the business information of the transaction subject indicated by each node in the graph association structure, the association relationship between the transaction subjects and a preset abnormal analysis rule; each abnormal value is used to indicate the abnormal fluctuation degree of the transaction of the transaction subject indicated by a node; the abnormal fluctuation degree is determined based on the transaction subject's own business information and the business information of other transaction subjects with which it has an association relationship; when the abnormal value corresponding to the first node is greater than a preset threshold, determining the first node as an abnormal node, and determining the transaction subject indicated by the first node as an abnormal transaction subject. The graph association structure is used to determine the abnormal value by integrating multiple factors to determine the comparison result, and the abnormal node is determined quickly and accurately.

Description

Data processing method, device, electronic device and storage medium

Technical Field

The present invention relates to the field of computer technology, and in particular to a data processing method, device, electronic equipment and storage medium.

Background Art

At present, in the huge trading network, there will be a huge amount of trading data and complex trading behavior relationships formed by trading entities every day. Therefore, when there are abnormal performances such as a sudden decrease in the number of transactions in the trading data, it is necessary to identify the trading entity that may have abnormal performance and take it as the abnormal trading entity to be optimized, so as to adjust and optimize the specific business strategy for the abnormal trading entity to ensure the normal operation of the trading network.

Therefore, how to determine the abnormal transaction subjects to be optimized has become a technical problem that needs to be solved urgently.

Summary of the invention

The embodiments of the present invention provide a data processing method, device, electronic device and storage medium, so that the method for determining the abnormal transaction subject to be optimized is more efficient and accurate.

In a first aspect, an embodiment of the present invention provides a data processing method, the method comprising:

Construct a graph association structure with transaction entities in the target business scenario as nodes and association relationships between transaction entities as edges;

Based on the business information of the transaction subject indicated by each node in the graph association structure, the association relationship between the transaction subjects and the preset abnormality analysis rules, the abnormality value corresponding to each node is determined; wherein each abnormality value is used to indicate the abnormal fluctuation degree of the transaction of the transaction subject indicated by a node; the abnormal fluctuation degree is determined based on the business information of the transaction subject itself and the business information of other transaction subjects with which it has an association relationship;

When the change value corresponding to the first node is greater than a preset threshold, the first node is determined to be a change node, and the transaction subject indicated by the first node is determined to be a change transaction subject.

In a possible implementation, based on the business information of the transaction subject indicated by each node in the graph association structure, the association relationship between the transaction subjects and the preset change analysis rule, determining the change value corresponding to each node includes:

Determine the fluctuation value of each node based on the business information of the transaction subject indicated by each node in the graph association structure and the first sub-rule in the preset abnormality analysis rule; the first sub-rule is used to perform magnitude normalization processing on the initial fluctuation value of the node obtained based on the business information of different magnitudes;

Based on the association relationship between the transaction entities and the second sub-rule in the preset abnormality analysis rule, the influence value of the fluctuation of the business information of each node affected by other nodes is determined; the second sub-rule is used to calculate the degree to which the lower-level node is affected by the fluctuation of the upper-level node, and the lower-level node and the upper-level node are determined based on the association relationship between the transaction entities;

According to the fluctuation value and the corresponding impact value of each node, the abnormal change value corresponding to each node is determined.

In a possible implementation, determining the fluctuation value of each node based on the business information of the transaction subject indicated by each node in the graph association structure and the first sub-rule in the preset abnormality analysis rule includes:

The business information of the transaction subject indicated by each node is respectively input into a preset time series attribution model to obtain the initial fluctuation value corresponding to each node output by the preset time series attribution model; the preset time series attribution model determines the initial fluctuation value of a transaction subject based on the business information of the transaction subject within a preset time period and a preset magnitude fluctuation evaluation rule; the preset magnitude fluctuation evaluation rule includes a plurality of mapping relationships, and different mapping relationships include numerical ranges corresponding to business information of different magnitudes, and initial fluctuation values corresponding to the numerical ranges;

The initial fluctuation value corresponding to each of the transaction entities is normalized to obtain the fluctuation value of each of the nodes.

In a possible implementation, the normalization process is implemented based on the following method:

Among them, _Si represents the fluctuation value of the node, _ri represents the initial fluctuation value corresponding to the node, and K is used to represent the total number of nodes in the graph association structure.

In a possible implementation manner, the second sub-rule is determined based on the following formula:

Among them, ep _ij represents the influence value of node i relative to node j, Δi represents the change value of the business information value of node i between two moments, Δj represents the change value of the business information value of node j between two moments, e _it represents the business information value of node i at moment t, e _it' represents the business information value of node i at moment t', e _jt represents the business information value of node j at moment t, e _jt' represents the business information value of node j at moment t', and node i and node j are any nodes in the graph association structure.

In a possible implementation, determining the change value corresponding to each node according to the fluctuation value and the corresponding impact value of each node includes:

Taking the influence value of an associated node associated with one of the nodes as a matrix factor, constructing an initial change iteration matrix;

According to the initial change iteration matrix and the fluctuation value corresponding to each node, the third sub-rule of the preset change analysis rule is substituted to determine the change value corresponding to each node respectively; the third sub-rule is used to iteratively optimize the fluctuation value of the node in combination with the influence values corresponding to all nodes that have an associated relationship with the node.

In a possible implementation manner, the third sub-rule is determined based on the following formula:

H ⁿ ←θH ^n-1 +d

Where H ⁿ represents the set of fluctuation values of all nodes, n is used to represent the number of iterations, when n is equal to 1, H ¹ ←θS′+d, S′ represents the set of fluctuation values of all nodes, S′＝{S ₁ , S ₂ , …, S _K }, ep _ij represents the influence value of node i relative to node j, node i and node j are any nodes in the graph association structure, S _k represents the fluctuation value of node k, d is a non-zero adjustment coefficient, and i and j are positive integers.

In a possible implementation manner, after determining that the first node is a changed node, the method further includes:

Based on the graph association structure, screening candidate paths including the first node, and using the candidate paths as change paths;

The change path is analyzed to obtain a change analysis result; the change analysis result is used to indicate an impact node associated with the change node, and based on the business information corresponding to the change node, the business of the transaction subject corresponding to the impact node is optimized.

In a second aspect, an embodiment of the present invention provides a data processing device, the device comprising:

A construction unit, used to construct a graph association structure with transaction subjects in the target business scenario as nodes and association relationships between transaction subjects as edges;

A determination unit, configured to determine an abnormal change value corresponding to each of the nodes based on the business information of the transaction subject indicated by each of the nodes in the graph association structure, the association relationship between the transaction subjects and the preset abnormal change analysis rules; wherein each of the abnormal change values is used to indicate the abnormal fluctuation degree of the transaction of the transaction subject indicated by a node; the abnormal fluctuation degree is determined based on the transaction subject's own business information and the business information of other transaction subjects with which it has an association relationship;

The processing unit is used to determine that the first node is a changed node when the change value corresponding to the first node is greater than a preset threshold, and determine the transaction subject indicated by the first node as the changed transaction subject.

In a possible implementation manner, the determining unit is specifically configured to:

Determine the fluctuation value of each node based on the business information of the transaction subject indicated by each node in the graph association structure and the first sub-rule in the preset abnormality analysis rule; the first sub-rule is used to perform magnitude normalization processing on the initial fluctuation value of the node obtained based on the business information of different magnitudes;

Based on the association relationship between the transaction entities and the second sub-rule in the preset abnormality analysis rule, the influence value of the fluctuation of the business information of each node affected by other nodes is determined; the second sub-rule is used to calculate the degree to which the lower-level node is affected by the fluctuation of the upper-level node, and the lower-level node and the upper-level node are determined based on the association relationship between the transaction entities;

According to the fluctuation value and the corresponding impact value of each node, the abnormal change value corresponding to each node is determined.

In a possible implementation manner, the determining unit is specifically configured to:

The business information of the transaction subject indicated by each node is respectively input into a preset time series attribution model to obtain the initial fluctuation value corresponding to each node output by the preset time series attribution model; the preset time series attribution model determines the initial fluctuation value of a transaction subject based on the business information of the transaction subject within a preset time period and a preset magnitude fluctuation evaluation rule; the preset magnitude fluctuation evaluation rule includes a plurality of mapping relationships, and different mapping relationships include numerical ranges corresponding to business information of different magnitudes, and initial fluctuation values corresponding to the numerical ranges;

The initial fluctuation value corresponding to each of the transaction entities is normalized to obtain the fluctuation value of each of the nodes.

In a possible implementation, the normalization process is implemented based on the following method:

Among them, _Si represents the fluctuation value of the node, _ri represents the initial fluctuation value corresponding to the node, and K is used to represent the total number of nodes in the graph association structure.

In a possible implementation manner, the second sub-rule is determined based on the following formula:

Among them, ep _ij represents the influence value of node i relative to node j, Δi represents the change value of the business information value of node i between two moments, Δj represents the change value of the business information value of node j between two moments, e _it represents the business information value of node i at moment t, e _it' represents the business information value of node i at moment t', e _jt represents the business information value of node j at moment t, e _jt' represents the business information value of node j at moment t', and node i and node j are any nodes in the graph association structure.

In a possible implementation manner, the determining unit is specifically configured to:

Taking the influence value of an associated node associated with one of the nodes as a matrix factor, constructing an initial change iteration matrix;

According to the initial change iteration matrix and the fluctuation value corresponding to each node, the third sub-rule of the preset change analysis rule is substituted to determine the change value corresponding to each node respectively; the third sub-rule is used to iteratively optimize the fluctuation value of the node in combination with the influence values corresponding to all nodes that have an associated relationship with the node.

In a possible implementation manner, the third sub-rule is determined based on the following formula:

H ⁿ ←θH ^n-1 +d

Where H ⁿ represents the set of fluctuation values of all nodes, n is used to represent the number of iterations, when n is equal to 1, H ¹ ←θS′+d, S′ represents the set of fluctuation values of all nodes, S′＝{S ₁ , S ₂ , …, S _K }, ep _ij represents the influence value of node i relative to node j, node i and node j are any nodes in the graph association structure, S _k represents the fluctuation value of node k, d is a non-zero adjustment coefficient, and i and j are positive integers.

In a possible implementation manner, after determining that the first node is a changed node, the device further includes an optimization unit, which is configured to:

Based on the graph association structure, screening candidate paths including the first node, and using the candidate paths as change paths;

The change path is analyzed to obtain a change analysis result; the change analysis result is used to indicate an impact node associated with the change node, and based on the business information corresponding to the change node, the business of the transaction subject corresponding to the impact node is optimized.

In a third aspect, an embodiment of the present invention provides an electronic device, comprising at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute any method provided in the embodiment of the first aspect of the present invention.

In a fourth aspect, an embodiment of the present invention provides a computer storage medium, wherein the computer-readable storage medium stores a computer program, and the computer program is used to enable a computer to execute any method provided by the embodiment of the first aspect of the present invention.

In a fifth aspect, an embodiment of the present invention provides a computer program product, comprising: a computer program code, when the computer program code is run on a computer, the computer executes any one of the methods provided in the embodiment of the first aspect.

The beneficial effects of the present invention are as follows:

In an embodiment of the present invention, a graph association structure can be constructed with the transaction subject in the target business scenario as a node and the association relationship between the transaction subjects as an edge; further, based on the business information of the transaction subject indicated by each node in the graph association structure, the association relationship between the transaction subjects and the preset abnormal analysis rules, the abnormal value corresponding to each node is determined; wherein each abnormal value is used to indicate the abnormal fluctuation degree of the transaction of the transaction subject indicated by a node; the abnormal fluctuation degree is determined based on the business information of the transaction subject itself and the business information of other transaction subjects with which it has an association relationship. It can be seen that in the embodiment of the present invention, the abnormal value corresponding to the node is determined from the perspective of the graph association structure, and the determination of the abnormal value simultaneously considers the business information of the transaction subject itself and the business information of other transaction subjects with which it has an association relationship, thereby improving the accuracy of the attribution analysis of the abnormal performance. In this way, when the abnormal value corresponding to the first node is greater than the preset threshold, the first node is determined to be an abnormal node, and the transaction subject indicated by the first node is determined to be an abnormal transaction subject, so that the abnormal transaction subject that causes the abnormal event can be accurately and efficiently determined.

Other features and advantages of the present invention will be described in the following description, and partly become apparent from the description, or understood by practicing the present invention. The purpose and other advantages of the present invention can be realized and obtained by the structures particularly pointed out in the written description, claims, and drawings.

BRIEF DESCRIPTION OF THE DRAWINGS

In order to more clearly illustrate the technical solutions in the embodiments of the present invention or related technologies, the drawings required for use in the embodiments or related technical descriptions are briefly introduced below. Obviously, the drawings in the following description are only embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying creative work.

FIG1 is an optional schematic diagram of an application scenario in an embodiment of the present invention;

FIG2 is an optional schematic diagram of an application scenario in an embodiment of the present invention;

FIG3 is a schematic flow chart of a data processing method according to an embodiment of the present invention;

FIG4 is a schematic diagram of a graph association structure according to an embodiment of the present invention;

FIG5 is a schematic diagram of a fluctuation value of a node in a graph association structure according to an embodiment of the present invention;

FIG6 is a schematic diagram of an influence value of a node in a graph association structure according to an embodiment of the present invention;

FIG7 is a schematic diagram of a calculation node corresponding to an abnormal value in an embodiment of the present invention;

FIG8 is a schematic diagram of an abnormal path in an embodiment of the present invention;

FIG9 is a schematic diagram of the structure of a data processing device according to an embodiment of the present invention;

FIG10 is a schematic structural diagram of an electronic device according to an embodiment of the present invention;

FIG. 11 is another schematic diagram of the structure of an electronic device according to an embodiment of the present invention.

DETAILED DESCRIPTION

In order to make the purpose, technical scheme and advantages of the present invention clearer, the technical scheme in the embodiment of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiment of the present invention. Obviously, the described embodiment is only a part of the embodiment of the present invention, not all of the embodiments. Based on the embodiments in the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention. In the absence of conflict, the embodiments in the present invention and the features in the embodiments can be combined with each other arbitrarily. In addition, although the logical order is shown in the flowchart, in some cases, the steps shown or described can be performed in an order different from that here.

The terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the terms used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in sequences other than those illustrated or described herein.

The word “exemplary” is used herein to mean “serving as an example, example, or illustration.” Any embodiment described as “exemplary” is not necessarily to be construed as preferred or advantageous over other embodiments.

The following is a description of exemplary embodiments of the present invention in conjunction with the accompanying drawings, which includes various details of the embodiments of the present invention to facilitate understanding, and they should be considered as merely exemplary. Therefore, those of ordinary skill in the art should recognize that various changes and modifications can be made to the embodiments described herein without departing from the scope of the present invention. Similarly, for the sake of clarity and conciseness, the description of well-known functions and structures is omitted in the following description. It should be noted that in the embodiments of the present invention, certain software, components, models and other existing solutions in the industry may be mentioned, which should be considered as exemplary, and their purpose is only to illustrate the feasibility of the implementation of the technical solution of the present invention, but it does not mean that the applicant has or will necessarily use the solution.

In the technical solution of the present invention, the collection, dissemination, and use of data are in compliance with the requirements of relevant national laws and regulations.

At present, as mentioned above, how to determine the abnormal transaction subjects to be optimized has become a technical problem that needs to be solved urgently.

In view of this, the embodiment of the present invention provides a data processing method, through which a graph association structure can be constructed with the transaction subject in the target business scenario as a node and the association relationship between the transaction subjects as an edge; further, based on the business information of the transaction subject indicated by each node in the graph association structure, the association relationship between the transaction subjects and the preset abnormal analysis rules, the abnormal value corresponding to each node is determined; wherein each abnormal value is used to indicate the abnormal fluctuation degree of the transaction of the transaction subject indicated by a node; the abnormal fluctuation degree is determined based on the business information of the transaction subject itself and the business information of other transaction subjects with which it has an association relationship. It can be seen that in the embodiment of the present invention, starting from the perspective of the graph association structure, the abnormal value corresponding to the node is determined, and the determination of the abnormal value simultaneously considers the business information of the transaction subject itself and the business information of other transaction subjects with which it has an association relationship, thereby improving the accuracy of the attribution analysis of the abnormal performance. In this way, when the abnormal value corresponding to the first node is greater than the preset threshold, the first node is determined to be an abnormal node, and the transaction subject indicated by the first node is determined to be an abnormal transaction subject, so that the abnormal transaction subject causing the abnormal event can be accurately and efficiently determined.

After introducing the design concept of the embodiment of the present invention, the following briefly introduces the application scenarios to which the technical solution of the embodiment of the present invention can be applied. It should be noted that the application scenarios introduced below are only used to illustrate the embodiment of the present invention and are not limited. In the specific implementation process, the technical solution provided by the embodiment of the present invention can be flexibly applied according to actual needs.

In an embodiment of the present invention, the data processing method provided by the embodiment of the present invention can be applied to any business scenario that requires abnormal attribution analysis, such as a business scenario in which abnormal attribution analysis is performed on each functional module in the software system of business A, a business scenario in which abnormal attribution analysis is performed on each functional unit in a network platform, etc. For example, a business scenario in which abnormal attribution analysis is performed on each subject in a payment system in the financial field, a business scenario in which abnormal attribution analysis is performed on each subject in a lending system in the financial field, a business scenario in which abnormal attribution analysis is performed on each subject in a manufacturing system in the manufacturing field, a business scenario in which abnormal attribution analysis is performed on each subject in an enterprise management system in the management field, etc., and this is not limited in the embodiment of the present invention.

Please refer to Figure 1, which is an application scenario to which the technical solution of the embodiment of the present invention can be applied. In the scenario diagram, there are devices 101 corresponding to multiple acquiring institutions, devices 102 corresponding to multiple payment subsidiaries, devices 103 corresponding to the payment head office, and devices 104 corresponding to the analysis system for performing abnormal attribution analysis on the payment system. It should be noted that acquiring institutions, payment subsidiaries and payment head offices can all be referred to as transaction entities.

The device 104 corresponding to each analysis system may include one or more processors 1041, a memory 1042, and an I/O interface 1043 for interacting with the device, etc. Furthermore, the devices 101, 102, 103, and 104, as well as the devices themselves, may be directly or indirectly connected to each other through one or more networks 105.

It should be noted that in the embodiment of the present invention, using device 101-1, device 101-2, ..., device 101-n, object 1, object 2, ..., object n, where n is a positive integer, payment transactions can be initiated at the same time. Of course, object 1 can initiate a transaction first, and object 2 can initiate a transaction later. The embodiment of the present invention does not limit this, so that the analysis system can receive a large amount of concurrent payment transaction data, and perform abnormal attribution analysis on the payment transaction data, that is, determine whether there is abnormal performance in the payment transaction data. Among them, the specific scheme for performing abnormal attribution analysis on payment transaction data can refer to the data processing method provided in the embodiment of the present invention, which is described in detail later and will not be repeated here.

For another example, please refer to FIG. 2, which is another application scenario to which the technical solution of the embodiment of the present invention can be applied. In the scenario diagram, there are devices 201 corresponding to multiple sales organizations, devices 202 corresponding to multiple manufacturing subsidiaries, devices 203 corresponding to the manufacturing head office, and devices 104 corresponding to the analysis system for performing attribution analysis on the sales system. It should be noted that the sales organizations, manufacturing subsidiaries, and the manufacturing head office can all be referred to as transaction entities.

The device 104 corresponding to each analysis system may include one or more processors 1041, a memory 1042, and an I/O interface 1043 for interacting with the device, etc. Furthermore, the devices 201, 202, 203, and 104, as well as the devices themselves, may be directly or indirectly connected to each other through one or more networks 105.

It should be noted that in the embodiment of the present invention, the sales agency 1, sales agency 2, ..., sales agency n, where n is a positive integer, using devices 201-1, 201-2, ..., and 201-n can initiate sales transactions at the same time. Of course, sales agency 1 can initiate sales transactions first, and then sales agency 2 can initiate sales transactions. There is no restriction on this in the embodiment of the present invention, so that the analysis system can receive a large amount of concurrent sales transaction data and perform abnormal attribution analysis on the sales transaction data, that is, determine whether there is abnormal performance in the sales transaction data. Among them, the specific scheme for performing abnormal attribution analysis on sales transaction data can refer to the data processing method provided in the embodiment of the present invention, which is described in detail later and will not be repeated here.

Among them, the devices in Figures 1 and 2 can be mobile phones, tablet computers (PADs), personal computers (PCs), smart TVs, smart watches, smart speakers, smart car devices, and wearable devices, but are not limited to these. These devices can have the function of logging in to and using the learning website.

In addition, the device in Figures 1 and 2 can also be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, content delivery networks (Content Delivery Network, CDN), as well as big data and artificial intelligence platforms, but is not limited to these.

The network 105 may be a wired network or a wireless network. For example, the wireless network may be a mobile cellular network or a Wireless-Fidelity (WIFI) network. Of course, it may also be other possible networks, which are not limited in the embodiments of the present invention.

Of course, the method provided in the embodiment of the present invention is not limited to the application scenarios shown in Figures 1 and 2, and can also be used in other possible application scenarios, which are not limited by the embodiment of the present invention.

To further illustrate the technical solution provided by the embodiment of the present invention, the following is a detailed description of this in conjunction with the accompanying drawings and specific implementation methods. Although the embodiment of the present invention provides the method operation steps shown in the following embodiments or drawings, more or fewer operation steps may be included in the method based on routine or no creative labor. In the steps where there is no necessary causal relationship logically, the execution order of these steps is not limited to the execution order provided by the embodiment of the present invention. The method may be executed in the order of the method shown in the embodiment or drawings or in parallel during the actual processing process or when the device is executed.

Please refer to Figure 3, which is a flow chart of a data processing method in an embodiment of the present invention, wherein the data processing method can be executed by the device 104 in the aforementioned Figures 1 and 2, and an analysis system for abnormal attribution analysis is deployed on the device 104.

Step 301: Construct a graph association structure with transaction entities in the target business scenario as nodes and association relationships between transaction entities as edges.

In an embodiment of the present invention, the electronic device may first determine the target business scenario, and the target business scenario is a business scenario of a payment system in the financial field as an example for explanation in the following text. Among them, the business scenario of the payment system in the financial field includes a payment company, multiple payment subsidiaries, and multiple acquiring institutions. The payment company, the payment subsidiary, and the acquiring institution can be understood as the subject that generates transaction data. For the sake of convenience of description, the subject is referred to as the transaction subject in the following text. Then, the association relationship between the payment company, the multiple payment subsidiaries, and the multiple acquiring institutions can be determined based on the business information. For example, if the business information is the number of merchants, it can be determined that there is an association relationship between the payment company and the payment subsidiary in terms of the number of merchants, and there is an association relationship between the payment subsidiary and the acquiring institution in terms of the number of merchants. For another example, if the business information is the number of transactions, it can be determined that there is an association relationship between the payment company and the payment subsidiary in terms of the number of transactions, and there is an association relationship between the payment subsidiary and the acquiring institution in terms of the number of transactions.

Furthermore, a graph association structure can be constructed with the transaction subjects in the target business scenario as nodes and the association relationships between the transaction subjects as edges.

For example, please refer to Figure 4, which is a schematic diagram of a graph association structure provided by an embodiment of the present invention. In Figure 4, the quadrilateral pattern is used to represent the node of the acquiring institution as the transaction subject, the pentagonal pattern is used to represent the node of the payment subsidiary as the transaction subject, and the hexagonal pattern is used to represent the node of the payment head office as the transaction subject.

Optionally, the graph association structure can also be expressed in a mathematical form, as follows:

G＝{V,ε}

Among them, V represents the node set included in the graph association structure, and ε represents the edge set of the graph association structure.

Step 302: Based on the business information of the transaction subject indicated by each node in the graph association structure, the association relationship between the transaction subjects and the preset abnormality analysis rules, determine the abnormality value corresponding to each node; wherein each abnormality value is used to indicate the degree of abnormal fluctuation of the transaction of the transaction subject indicated by a node; the abnormal fluctuation degree is determined based on the transaction subject's own business information and the business information of other transaction subjects with which it has an association relationship.

In the embodiment of the present invention, the electronic device may adopt but is not limited to the following steps to obtain the change value corresponding to each node:

Step A: Determine the fluctuation value of each node based on the business information of the transaction subject indicated by each node in the graph association structure and the first sub-rule in the preset abnormal change analysis rule; the first sub-rule is used to normalize the initial fluctuation value of the node obtained based on business information of different magnitudes.

In an embodiment of the present invention, the electronic device can input the business information of the transaction subject indicated by each node into a preset time series attribution model to obtain the initial fluctuation value corresponding to each node output by the preset time series attribution model; wherein the preset time series attribution model determines the initial fluctuation value of the transaction subject based on the business information of a transaction subject within a preset time period and a preset magnitude fluctuation evaluation rule. wherein the preset magnitude fluctuation evaluation rule includes multiple mapping relationships, and different mapping relationships include numerical ranges corresponding to business information of different magnitudes, and initial fluctuation values corresponding to the numerical ranges.

For example, assuming that the node is acquiring institution A, and the business information is the number of transactions counted monthly by acquiring institution A in the two years 2021-2023, the input to the preset time series attribution model is that the number of transactions counted monthly by acquiring institution A in the two years 2021-2023 is 100, so that based on the fluctuation evaluation rule, it can be determined that the numerical range corresponding to the number of transactions is 100-200, and the initial fluctuation value corresponding to the numerical range of 100-200 is 120%, then the output initial fluctuation value of the node in the order of transactions is determined to be 120%.

In addition, due to the different scales of different business values, for example, the number of transactions is at the level of hundreds of millions, while the number of merchants is at the level of tens of millions, that is, there is a huge difference in the magnitude of the two business values. Therefore, the initial fluctuation value corresponding to each transaction subject can be normalized, so that the magnitude can be uniformly evaluated. In other words, the initial fluctuation value corresponding to each transaction subject can be normalized to obtain the fluctuation value of each node. The fluctuation value is used to indicate the value of the business information of the transaction subject indicated by the node (hereinafter referred to as the business information value for the convenience of description) fluctuates.

Optionally, normalization is performed based on the following method:

Among them, _Si represents the fluctuation value of the node, _ri represents the initial fluctuation value corresponding to the node, and K is used to represent the total number of nodes in the graph association structure.

For example, please refer to Figure 5, which is a schematic diagram of the fluctuation value of a node in a graph association structure provided by an embodiment of the present invention. Among them, the quadrilateral pattern in Figure 5 is used to represent the node whose transaction subject is the acquiring institution, the pentagonal pattern is used to represent the node whose transaction subject is the payment subsidiary, and the hexagonal pattern is used to represent the node whose transaction subject is the payment head office. Among them, the fluctuation value of the node whose transaction subject is the acquiring institution represented by the quadrilateral pattern is 0.1, 0.1 = 120% / 1200%, wherein 120% is the year-on-year increase value of the business information of the transaction subject being the acquiring institution, and 1200% is the sum of the year-on-year increase values of the business information of the transaction subject indicated by all nodes except the node whose transaction subject is the head office.

Step B: Based on the association relationship between the transaction subjects and the second sub-rule in the preset abnormality analysis rule, determine the impact value of the fluctuation of the business information of each node affected by other nodes; the second sub-rule is used to calculate the degree to which the lower-level node is affected by the fluctuation of the upper-level node, and the lower-level node and the upper-level node are determined based on the association relationship between the transaction subjects;

In the embodiment of the present invention, the second sub-rule is determined based on the following formula:

Among them, ep _ij represents the influence value of node i relative to node j, Δi represents the change value of the business information value of node i between two time points, Δj represents the change value of the business information value of node j between two time points, e _it represents the business information value of node i at time t, e _it' represents the business information value of node i at time t', e _jt represents the business information value of node j at time t, e _jt' represents the business information value of node j at time t', and node i and node j are arbitrary nodes in the graph association structure.

In the embodiment of the present invention, after the second sub-rule is determined, the impact value of the fluctuation of the business information of each node affected by other nodes can be determined based on the association relationship between the transaction entities and the aforementioned second sub-rule.

For example, please refer to Figure 6, which is a schematic diagram of the influence value of a node in a graph association structure provided by an embodiment of the present invention. Among them, the quadrilateral pattern in Figure 6 is used to represent the node whose transaction subject is the acquiring institution, the pentagonal pattern is used to represent the node whose transaction subject is the payment subsidiary, and the hexagonal pattern is used to represent the node whose transaction subject is the payment head office. Among them, the influence value of the node whose transaction subject is the subsidiary payment company represented by the pentagonal pattern is 0.2, 0.2 = 30 million/150 million, among which 30 million is the change value of the number of transactions whose transaction subject is the payment subsidiary, and 150 million is the change value of the number of transactions whose transaction subject is the head office.

Step C: Determine the corresponding abnormal value of each node according to the fluctuation value of each node and the corresponding impact value.

In the embodiment of the present invention, the electronic device may use the influence value of an associated node that has an associated relationship with the node as the basis for constructing the initial change iteration matrix. For example, the initial change iteration matrix may be expressed as:

Among them, θ represents the initial altered iteration matrix, θ _i,j is a matrix factor in θ, ep _ij represents the influence value of node i relative to node j. Node i and node j are any nodes in the graph association structure, that is, i, j∈K. Among them, when there is no association relationship between node i and node j,

Furthermore, the electronic device can substitute the initial abnormality iteration matrix and the fluctuation value corresponding to each node into the third sub-rule of the preset abnormality analysis rule to determine the abnormality value corresponding to each node respectively; the third sub-rule is used to iteratively optimize the fluctuation value of the node in combination with the influence values corresponding to all nodes that have an associated relationship with the node.

Optionally, the third sub-rule is determined based on the following formula:

H ¹ ←θS′+d

H ² ←θH ¹ +d

...

H ⁿ ←θH ^n-1 +d

Among them, H represents the intermediate variable of the iteration process, ^Hn represents the result of the nth round of iteration, and the size of n is determined by the Euclidean distance between ^Hn and Hn ^-1 . Generally, the iteration can be stopped when the Euclidean distance between ^Hn and Hn ^-1 is less than 0.0001. θ represents the initial abnormal iteration matrix, S′ represents the set of fluctuation values of all nodes, S′＝{S ₁ , S ₂ , …, S _K }, d is a non-zero adjustment coefficient, and i and j are positive integers.

The final node abnormal value distribution is H ⁿ is The change value of node 1 is That is, the first element of the vector H ⁿ .

Optionally, the electronic device can also sort the abnormal values corresponding to all nodes from large to small to obtain the abnormal values of all nodes after sorting. For example, please refer to Figure 7, which is a schematic diagram of a calculation of abnormal values corresponding to nodes provided by an embodiment of the present invention. Among them, the quadrilateral pattern in Figure 7 is used to represent the node whose transaction subject is the acquiring institution, the pentagonal pattern is used to represent the node whose transaction subject is the payment subsidiary, and the hexagonal pattern is used to represent the node whose transaction subject is the payment head office.

Step 303: When the change value corresponding to the first node is greater than a preset threshold, the first node is determined to be a change node, and the transaction subject indicated by the first node is determined to be a change transaction subject.

In the embodiment of the present invention, after obtaining the change values corresponding to all nodes, a preset threshold value may be determined based on historical experience, and the preset threshold value may be, for example, 0.5. The middle value of the first four values in the sorting may also be used as the preset threshold value based on the sorting information of the change values corresponding to all nodes obtained. Of course, the preset threshold value may also be determined based on other methods, which are not limited in the embodiment of the present invention.

In the embodiment of the present invention, after the electronic device determines the preset threshold, it can filter out the first node whose change value corresponding to all nodes is greater than the preset threshold, and use the first node as the change node. That is, the first node can be a node or a group of nodes.

In an embodiment of the present invention, after the changed nodes are determined, the changed nodes can be put back into the constructed graph association structure for restoration, so that a clear association tracing path can be obtained to improve the convenience of attribution analysis of transaction entities.

In an embodiment of the present invention, the electronic device can screen candidate paths including the first node based on the graph association structure, and use the candidate paths as abnormal paths; analyze the abnormal paths to obtain abnormal analysis results; the abnormal analysis results are used to indicate the influencing nodes associated with the abnormal nodes, and optimize the business of the transaction subject corresponding to the influencing nodes based on the business information corresponding to the abnormal nodes.

For example, see FIG8 , which is a schematic diagram of an abnormal path provided by an embodiment of the present invention. The quadrilateral pattern in FIG8 is used to represent a node whose transaction subject is an acquiring institution, the pentagonal pattern is used to represent a node whose transaction subject is a payment subsidiary, and the hexagonal pattern is used to represent a node whose transaction subject is a payment head office. The node represented by the fully filled quadrilateral pattern in FIG8 is the first node, and the node, the node represented by the fully filled pentagonal pattern, and the node represented by the fully filled hexagonal pattern form an abnormal path.

In the embodiment of the present invention, the advantages of the graph association structure are utilized to further restore the association tracing path of the attribution analysis, that is, the change path, thereby improving the convenience of the transaction subject in performing the change attribution analysis, and further improving the strategy optimization effect on the actual business.

Based on the same inventive concept, an embodiment of the present invention further provides a data processing device. As shown in FIG9 , it is a schematic diagram of the structure of a data processing device 900, which may include:

A construction unit 901 is used to construct a graph association structure with transaction subjects in a target business scenario as nodes and association relationships between transaction subjects as edges;

The determination unit 902 is used to determine the abnormal value corresponding to each node based on the business information of the transaction subject indicated by each node in the graph association structure, the association relationship between the transaction subjects and the preset abnormal analysis rules; wherein each abnormal value is used to indicate the abnormal fluctuation degree of the transaction of the transaction subject indicated by a node; the abnormal fluctuation degree is determined based on the business information of the transaction subject itself and the business information of other transaction subjects with which it has an association relationship;

The processing unit 903 is used to determine that the first node is a changed node when the change value corresponding to the first node is greater than a preset threshold, and determine the transaction subject indicated by the first node as the changed transaction subject.

In a possible implementation manner, the determining unit 902 is specifically configured to:

Determine the fluctuation value of each node based on the business information of the transaction subject indicated by each node in the graph association structure and the first sub-rule in the preset abnormality analysis rule; the first sub-rule is used to perform magnitude normalization processing on the initial fluctuation value of the node obtained based on the business information of different magnitudes;

Based on the association relationship between the transaction entities and the second sub-rule in the preset abnormality analysis rule, the influence value of the fluctuation of the business information of each node affected by other nodes is determined; the second sub-rule is used to calculate the degree to which the lower-level node is affected by the fluctuation of the upper-level node, and the lower-level node and the upper-level node are determined based on the association relationship between the transaction entities;

According to the fluctuation value and the corresponding impact value of each node, the abnormal change value corresponding to each node is determined.

In a possible implementation manner, the determining unit 902 is specifically configured to:

The business information of the transaction subject indicated by each node is respectively input into a preset time series attribution model to obtain the initial fluctuation value corresponding to each node output by the preset time series attribution model; the preset time series attribution model determines the initial fluctuation value of a transaction subject based on the business information of the transaction subject within a preset time period and a preset magnitude fluctuation evaluation rule; the preset magnitude fluctuation evaluation rule includes a plurality of mapping relationships, and different mapping relationships include numerical ranges corresponding to business information of different magnitudes, and initial fluctuation values corresponding to the numerical ranges;

The initial fluctuation value corresponding to each of the transaction entities is normalized to obtain the fluctuation value of each of the nodes.

In a possible implementation, the normalization process is implemented based on the following method:

Among them, _Si represents the fluctuation value of the node, _ri represents the initial fluctuation value corresponding to the node, and K is used to represent the total number of nodes in the graph association structure.

In a possible implementation manner, the second sub-rule is determined based on the following formula:

Among them, ep _ij represents the influence value of node i relative to node j, Δi represents the change value of the business information value of node i between two moments, Δj represents the change value of the business information value of node j between two moments, e _it represents the business information value of node i at time t, e _it' represents the business information value of node i at time t', e _jt represents the business information value of node j at time t, e _jt' represents the business information value of node j at time t', and node i and node j are any nodes in the graph association structure.

In a possible implementation manner, the determining unit 902 is specifically configured to:

Taking the influence value of an associated node associated with one of the nodes as a matrix factor, constructing an initial change iteration matrix;

According to the initial change iteration matrix and the fluctuation value corresponding to each node, the third sub-rule of the preset change analysis rule is substituted to determine the change value corresponding to each node respectively; the third sub-rule is used to iteratively optimize the fluctuation value of the node in combination with the influence values corresponding to all nodes that have an associated relationship with the node.

In a possible implementation manner, the third sub-rule is determined based on the following formula:

H ⁿ ←θH ^n-1 +d

Where H ⁿ represents the set of fluctuation values of all nodes, n is used to represent the number of iterations, when n is equal to 1, H ¹ ←θS′+d, S′ represents the set of fluctuation values of all nodes, S′＝{S ₁ , S ₂ , …, S _K }, θ represents the initial fluctuation iteration matrix, θ _i,j are the matrix factors in θ, ep _ij represents the influence value of node i relative to node j, node i and node j are any nodes in the graph association structure, S _k represents the fluctuation value of node k, d is a non-zero adjustment coefficient, and i and j are positive integers.

In a possible implementation manner, after determining that the first node is a changed node, the device further includes an optimization unit, which is configured to:

Based on the graph association structure, screening candidate paths including the first node, and using the candidate paths as change paths;

The change path is analyzed to obtain a change analysis result; the change analysis result is used to indicate an impact node associated with the change node, and based on the business information corresponding to the change node, the business of the transaction subject corresponding to the impact node is optimized.

For the convenience of description, the above parts are divided into modules (or units) according to their functions and described separately. Of course, when implementing the present invention, the functions of each module (or unit) can be implemented in the same or multiple software or hardware.

After introducing the data processing method and apparatus according to the exemplary embodiment of the present invention, next, an electronic device according to another exemplary embodiment of the present invention is introduced.

It will be appreciated by those skilled in the art that various aspects of the present invention may be implemented as a system, method or program product. Therefore, various aspects of the present invention may be specifically implemented in the following forms, namely: a complete hardware implementation, a complete software implementation (including firmware, microcode, etc.), or a combination of hardware and software, which may be collectively referred to herein as a "circuit", "module" or "system".

Regarding the device in the above embodiment, the specific execution mode of each module therein has been described in detail in the embodiment of the method, and will not be elaborated here.

Based on the same inventive concept as the above-mentioned method embodiment of the present invention, an electronic device is also provided in the embodiment of the present invention. The principle of solving the problem by the electronic device is similar to the method of the above-mentioned embodiment. Therefore, the implementation of the electronic device can refer to the implementation of the above-mentioned method, and the repeated parts will not be repeated.

Referring to FIG. 10 , FIG. 10 is a block diagram of an electronic device 1000 according to an exemplary embodiment. The electronic device in the embodiment of the present invention includes at least one processor 1001 and a memory 1002 connected to the at least one processor 1001. The specific connection medium between the processor 1001 and the memory 1002 is not limited in the embodiment of the present invention. FIG. 10 takes the connection between the processor 1001 and the memory 1002 through a bus as an example. The bus is represented by a thick line in FIG. 10 . The connection mode between other components is only for schematic illustration and is not limited. The bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, FIG. 10 is represented by only one thick line, but it does not mean that there is only one bus or one type of bus.

In the embodiment of the present invention, the memory 1002 stores instructions that can be executed by at least one processor 1001. The at least one processor 1001 can execute the steps included in the aforementioned data processing method by executing the instructions stored in the memory 1002.

Among them, the processor 1001 is the control center of the electronic device, and can use various interfaces and lines to connect various parts of the entire fault detection device, and monitor the electronic device as a whole by running or executing instructions stored in the memory 1002 and calling data stored in the memory 1002, various functions of the electronic device and processing data. Optionally, the processor 1001 may include one or more processing units, and the processor 1001 may integrate an application processor and a modem processor, wherein the processor 1001 mainly processes the operating system, user interface, and application programs, and the modem processor mainly processes wireless communications. It is understandable that the above-mentioned modem processor may not be integrated into the processor 1001. In some embodiments, the processor 1001 and the memory 1002 may be implemented on the same chip, and in some embodiments, they may also be implemented separately on independent chips.

The processor 1001 may be a general-purpose processor, such as a central processing unit (CPU), a digital signal processor, an application-specific integrated circuit, a field programmable gate array or other programmable logic device, a discrete gate or transistor logic device, or a discrete hardware component, and may implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of the present invention. A general-purpose processor may be a microprocessor or any conventional processor, etc. The steps of the method disclosed in the embodiments of the present invention may be directly embodied as being executed by a hardware processor, or may be executed by a combination of hardware and software modules in the processor.

The memory 1002 is a non-volatile computer-readable storage medium that can be used to store non-volatile software programs, non-volatile computer executable programs and modules. The memory 1002 may include at least one type of storage medium, such as a flash memory, a hard disk, a multimedia card, a card-type memory, a random access memory (Random Access Memory, RAM), a static random access memory (Static Random Access Memory, SRAM), a programmable read-only memory (Programmable Read Only Memory, PROM), a read-only memory (Read Only Memory, ROM), an electrically erasable programmable read-only memory (Electrically Erasable Programmable Read-Only Memory, EEPROM), a magnetic memory, a disk, an optical disk, etc. The memory 1002 is any other medium that can be used to carry or store a desired program code in the form of an instruction or data structure and can be accessed by a computer, but is not limited thereto. The memory 1002 in the embodiment of the present invention can also be a circuit or any other device that can realize a storage function, for storing program instructions and/or data.

Based on the same inventive concept, the embodiment of the present invention also provides another schematic diagram of an electronic device, as shown in FIG11 , the electronic device 104 includes a display unit 1140, a processor 1180 and a memory 1120, wherein the display unit 1140 includes a display panel 1141, which is used to display information input by a user or information provided to a user and various object selection interfaces of the electronic device 104, etc., and in the embodiment of the present invention, it is mainly used to display the relevant operation interface, shortcut window, etc. of the analysis system installed in the electronic device 104. Optionally, the display panel 1141 can be configured in the form of LCD (Liquid Crystal Display) or OLED (Organic Light-Emitting Diode).

The processor 1180 is used to read the computer program and then execute the method defined by the computer program. For example, the processor 1180 reads the application program of the analysis system, thereby running the analysis system on the electronic device 104 and displaying the relevant operation interface of the analysis system on the display unit 1140. The processor 1180 may include one or more general-purpose processors and may also include one or more DSPs (Digital Signal Processors) to perform relevant operations to implement the technical solutions provided in the embodiments of the present invention.

The memory 1120 generally includes internal memory and external memory. The internal memory may be a random access memory (RAM), a read-only memory (ROM), and a cache (CACHE), etc. The external memory may be a hard disk, an optical disk, a USB disk, a floppy disk, or a tape drive, etc. The memory 1120 is used to store computer programs and other data. The computer program includes applications corresponding to various software, etc. Other data may include data generated after the operating system or application is run, and the data includes system data (such as configuration parameters of the operating system) and user data. In the embodiment of the present invention, program instructions are stored in the memory 1120, and the processor 1180 executes the program instructions stored in 1120 to implement the functions of the data processing method discussed above.

In addition, the electronic device 104 may also include a display unit 1140 for receiving input digital information, character information or contact touch operation/contactless gesture, and generating signal input related to user settings and function control of the electronic device 104. Specifically, in an embodiment of the present invention, the display unit 1140 may include a display panel 1141. The display panel 1141 is, for example, a touch screen, which can collect the user's touch operation on or near it (such as the target object using any suitable object or accessory such as a finger, stylus, etc. on the display panel 1141 or on the display panel 1141), and drive the corresponding connection device according to a pre-set program. Optionally, the display panel 1141 may include two parts: a touch detection device and a touch controller. Among them, the touch detection device detects the touch position of the user, detects the signal brought by the touch operation, and transmits the signal to the touch controller; the touch controller receives the touch information from the touch detection device, converts it into the touch point coordinates, and then sends it to the processor 1180, and can receive and execute the command sent by the processor 1180. In an embodiment of the present invention, if a user selects an associated subroutine, the touch detection device in the display panel 1141 detects the touch operation, and sends a signal corresponding to the detected touch operation to the touch controller. The touch controller converts the signal into touch point coordinates and sends them to the processor 1180. The processor 1180 determines the target business scenario selected by the user based on the received touch point coordinates, and controls the display panel 1141 to display the transaction subjects in the target business scenario.

Among them, the display panel 1141 can be implemented in various types such as resistive, capacitive, infrared, and surface acoustic wave. In addition to the display unit 1140, the electronic device 104 can also include an input unit 1130, and the input unit 1130 can include but is not limited to one or more of a physical keyboard, a function key (such as a volume control key, a switch key, etc.), a trackball, a mouse, and a joystick. FIG. 11 takes the input unit 1130 including an image input device 1131 and other input devices 1132 as an example.

In addition to the above, the electronic device 104 may also include a power supply 1190 for supplying power to other modules, an audio circuit 1160, a near field communication module 1170, and an RF circuit 1110. The electronic device 104 may also include one or more sensors 1150, such as an accelerometer, a light sensor, a pressure sensor, etc. The audio circuit 1160 specifically includes a speaker 1161 and a microphone 1162, etc. For example, the user can use voice control, the electronic device 104 can collect the user's voice through the microphone 1162, can be controlled by the user's voice, and when it is necessary to remind the user that there is an abnormal performance in the business information, the corresponding prompt tone is played through the speaker 1161.

In an exemplary embodiment, a storage medium including operations is also provided, such as a memory 1002 including operations, and the operations can be executed by a processor 1001 of an electronic device 1000 to complete the above method. Optionally, the storage medium can be a non-transitory computer-readable storage medium, for example, the non-transitory computer-readable storage medium can be a ROM, a random access memory (RAM), a CD-ROM, a magnetic tape, a floppy disk, an optical data storage device, etc.

Based on the same inventive concept as the above-mentioned method embodiments, various aspects of the data processing method provided by the present invention can also be implemented in the form of a program product, which includes program code. When the program product runs on an electronic device, the program code is used to enable the electronic device to execute the steps of the data processing method according to various exemplary embodiments of the present invention described above in this specification. For example, the electronic device can execute the steps shown in Figure 3.

The program product may use any combination of one or more readable media. The readable medium may be a readable signal medium or a readable storage medium. The readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of readable storage media (a non-exhaustive list) include: an electrical connection with one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above.

The program product of the embodiment of the present invention can adopt a portable compact disk read-only memory (CD-ROM) and include program code, and can be run on a server. However, the program product of the present invention is not limited to this. In this document, a readable storage medium can be any tangible medium containing or storing a program that can be used by or in combination with a command execution system, device or device.

The readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, wherein the readable program code is carried. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. The readable signal medium may also be any readable medium other than a readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with a command execution system, apparatus, or device.

The program code embodied on the readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wired, optical cable, RF, etc., or any suitable combination of the foregoing.

Although the preferred embodiments of the present invention have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the present invention.

Obviously, those skilled in the art can make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention fall within the scope of the claims of the present invention and their equivalents, the present invention is also intended to include these modifications and variations.

Claims (12)

1. A method of data processing, the method comprising:

Constructing a graph association structure taking a transaction main body in a target service scene as a node and an association relationship between the transaction main bodies as an edge;

Determining a transaction value corresponding to each node based on service information of transaction subjects indicated by each node in the graph association structure, association relations among the transaction subjects and a preset transaction analysis rule; wherein, each abnormal value is used for indicating the abnormal fluctuation degree of the transaction main body indicated by one node; the abnormal fluctuation degree is determined based on the self business information of the transaction main body and the business information of other transaction main bodies with association relation with the self business information;

when the transaction main body indicated by the first node is determined to be the transaction main body, the transaction main body indicated by the first node is determined to be the transaction main body.

2. The method of claim 1, wherein determining the transaction value corresponding to each node based on the transaction information of the transaction subjects indicated by each node in the graph association structure, the association relationship between the transaction subjects, and a preset transaction analysis rule comprises:

Determining a fluctuation value of each node based on the business information of the transaction main body indicated by each node in the graph association structure and a first sub-rule in the preset transaction analysis rule; the first sub-rule is used for carrying out order normalization processing on initial fluctuation values of nodes obtained based on service information of different orders;

determining an influence value of fluctuation of business information of each node affected by other nodes based on the association relation between the transaction main bodies and a second sub-rule in the preset transaction analysis rule respectively; the second sub-rule is used for calculating the degree of influence of fluctuation of the lower node by the upper node, and the lower node and the upper node are determined based on the association relation between transaction subjects;

And determining the corresponding fluctuation value of each node according to the fluctuation value and the corresponding influence value of each node.

3. The method of claim 2, wherein determining the fluctuation value of each of the nodes based on the traffic information of the transaction body indicated by each of the nodes in the graph association structure and the first sub-rule of the preset transaction analysis rule, respectively, comprises:

Respectively inputting the business information of the transaction main body indicated by each node into a preset time sequence attribution model to obtain an initial fluctuation value corresponding to each node output by the preset time sequence attribution model; the preset time sequence attribution model determines an initial fluctuation value of a transaction main body based on service information of the transaction main body in a preset time period and a preset magnitude fluctuation evaluation rule; the preset magnitude fluctuation evaluation rule comprises a plurality of mapping relations, wherein different mapping relations comprise numerical value ranges corresponding to different magnitude business information and initial fluctuation values corresponding to the numerical value ranges;

and carrying out normalization processing on the initial fluctuation value corresponding to each transaction main body to obtain the fluctuation value of each node.

4. A method as claimed in claim 3, wherein the normalization is effected on the basis of:

Wherein S _i represents a fluctuation value of the nodes, r _i represents an initial fluctuation value corresponding to the nodes, and K is used for representing the total number of nodes in the graph association structure.

5. The method of claim 2, wherein the second sub-rule is determined based on the following formula:

Wherein ep _ij represents the influence value of node i relative to node j, Δi represents the change value of the traffic information value between two times of node i, Δj represents the change value of the traffic information value between two times of node j, e _it represents the traffic information value of node i at time t, e _it' represents the traffic information value of node i at time t ', e _jt represents the traffic information value of node j at time t, e _jt' represents the traffic information value of node j at time t', and nodes i and j are any nodes in the graph association structure.

6. The method of any of claims 2-5, wherein determining a corresponding transaction value for each of the nodes based on the fluctuation value and the corresponding impact value for each of the nodes comprises:

Constructing an initial abnormal iteration matrix by taking an influence value of an associated node with an associated relation with one node as a matrix factor;

Substituting the initial abnormal iteration matrix and the fluctuation value corresponding to each node into a third sub-rule of the preset abnormal analysis rule, and respectively determining the abnormal value corresponding to each node; and the third sub-rule is used for iteratively optimizing the fluctuation value of the node by combining all the influence values corresponding to the nodes with the association relation with the node.

7. The method of claim 6, wherein the third sub-rule is determined based on the following formula:

Hⁿ←θH^n-1+d

Where H ⁿ represents a set of fluctuation values of all nodes, n is used to characterize the iteration round, when n is equal to 1, H ¹ ++s ' +d, S ' represents a set of fluctuation values of all nodes, S ' = { S ₁,S₂,……,S_K }, θ represents the initial fluctuation iteration matrix, θ _i,j is the matrix factor in θ, Ep _ij represents the influence value of the node i relative to the node j, the node i and the node j are any nodes in the graph association structure, S _k represents the fluctuation value of the node k, d is a non-zero adjustment coefficient, and i and j are positive integers.

8. The method of claim 1, wherein after determining that the first node is a transaction node, the method further comprises:

Screening candidate paths comprising a first node based on the graph association structure, and taking the candidate paths as transaction paths;

Analyzing the abnormal path to obtain an abnormal analysis result; the transaction analysis result is used for indicating an influence node associated with the transaction node, and optimizing the business of the transaction main body corresponding to the influence node based on the business information corresponding to the transaction node.

9. A data processing apparatus, the apparatus comprising:

the construction unit is used for constructing a graph association structure which takes a transaction main body in a target service scene as a node and an association relationship between the transaction main bodies as an edge;

The determining unit is used for determining a transaction value corresponding to each node based on the business information of the transaction subjects indicated by each node in the graph association structure, the association relation among the transaction subjects and a preset transaction analysis rule; wherein, each abnormal value is used for indicating the abnormal fluctuation degree of the transaction main body indicated by one node; the abnormal fluctuation degree is determined based on the self business information of the transaction main body and the business information of other transaction main bodies with association relation with the self business information;

and the processing unit is used for determining the first node as a transaction main body indicated by the first node as a transaction main body when the transaction value corresponding to the first node is larger than a preset threshold value.

10. An electronic device comprising a memory, a processor and a computer program stored on the memory and executable on the processor, characterized in that the processor implements the steps of the method of any of claims 1-8 when the computer program is executed.

11. A computer readable storage medium, characterized in that it comprises a program code for causing an electronic device to perform the steps of the method according to any of claims 1-8, when the program product is run on said electronic device.

12. A computer program product, the computer program product comprising: computer program code which, when run on a computer, causes the computer to perform the method of any of the preceding claims 1-8.