CN118505382A

CN118505382A - Data processing method and device, electronic equipment and storage medium

Info

Publication number: CN118505382A
Application number: CN202410432948.8A
Authority: CN
Inventors: 顾河建; 潘婧; 刘红宝; 李晓刚; 陈滢; 赵金涛; 高鹏飞
Original assignee: China Unionpay Co Ltd
Current assignee: China Unionpay Co Ltd
Priority date: 2024-04-10
Filing date: 2024-04-10
Publication date: 2024-08-16

Abstract

The invention discloses a data processing method, a device, electronic equipment and a storage medium, wherein the method comprises the following steps: constructing a graph association structure taking a transaction main body in a target service scene as a node and an association relationship between the transaction main bodies as an edge; determining a transaction value corresponding to each node based on service information of transaction subjects indicated by each node in the graph association structure, association relations among the transaction subjects and preset transaction analysis rules; each abnormal value is used for indicating the abnormal fluctuation degree of the transaction main body indicated by one node; the abnormal fluctuation degree is determined based on the self business information of the transaction main body and the business information of other transaction main bodies with association relation with the self business information; when the transaction main body indicated by the first node is determined to be the transaction main body, the transaction main body indicated by the first node is determined to be the transaction main body. And determining the abnormal value by utilizing the graph association structure and fusing various factors so as to determine the comparison result, and rapidly and accurately determining the abnormal node.

Description

Data processing method and device, electronic equipment and storage medium

Technical Field

The present invention relates to the field of computer technologies, and in particular, to a data processing method, a data processing device, an electronic device, and a storage medium.

Background

Currently, in a huge transaction network, a great deal of transaction data and complex transaction behavior relations consisting of transaction subjects are generated every day. Therefore, when transaction data show transaction strokes suddenly reduced and other abnormal expressions, a transaction main body with the possible abnormal expressions needs to be determined, and the transaction main body is used as an abnormal transaction main body to be optimized, so that a specific operation strategy of the abnormal transaction main body is adjusted and optimized, and the normal operation of a transaction network is ensured.

Therefore, how to determine the transaction subject to be optimized becomes a technical problem to be solved.

Disclosure of Invention

The embodiment of the invention provides a data processing method, a data processing device, electronic equipment and a storage medium, so that the efficiency and the accuracy of a method for determining a transaction main body to be optimized are higher.

In a first aspect, an embodiment of the present invention provides a data processing method, where the method includes:

Constructing a graph association structure taking a transaction main body in a target service scene as a node and an association relationship between the transaction main bodies as an edge;

Determining a transaction value corresponding to each node based on service information of transaction subjects indicated by each node in the graph association structure, association relations among the transaction subjects and a preset transaction analysis rule; wherein, each abnormal value is used for indicating the abnormal fluctuation degree of the transaction main body indicated by one node; the abnormal fluctuation degree is determined based on the self business information of the transaction main body and the business information of other transaction main bodies with association relation with the self business information;

when the transaction main body indicated by the first node is determined to be the transaction main body, the transaction main body indicated by the first node is determined to be the transaction main body.

In one possible implementation manner, determining the transaction value corresponding to each node based on the service information of the transaction subjects indicated by each node in the graph association structure, the association relationship between the transaction subjects, and a preset transaction analysis rule includes:

Determining a fluctuation value of each node based on the business information of the transaction main body indicated by each node in the graph association structure and a first sub-rule in the preset transaction analysis rule; the first sub-rule is used for carrying out order normalization processing on initial fluctuation values of nodes obtained based on service information of different orders;

determining an influence value of fluctuation of business information of each node affected by other nodes based on the association relation between the transaction main bodies and a second sub-rule in the preset transaction analysis rule respectively; the second sub-rule is used for calculating the degree of influence of fluctuation of the lower node by the upper node, and the lower node and the upper node are determined based on the association relation between transaction subjects;

And determining the corresponding fluctuation value of each node according to the fluctuation value and the corresponding influence value of each node.

In one possible implementation manner, determining the fluctuation value of each node based on the business information of the transaction main body indicated by each node in the graph association structure and the first sub-rule in the preset transaction analysis rule respectively includes:

Respectively inputting the business information of the transaction main body indicated by each node into a preset time sequence attribution model to obtain an initial fluctuation value corresponding to each node output by the preset time sequence attribution model; the preset time sequence attribution model determines an initial fluctuation value of a transaction main body based on service information of the transaction main body in a preset time period and a preset magnitude fluctuation evaluation rule; the preset magnitude fluctuation evaluation rule comprises a plurality of mapping relations, wherein different mapping relations comprise numerical value ranges corresponding to business information of different magnitudes and initial fluctuation values corresponding to the numerical value ranges;

and carrying out normalization processing on the initial fluctuation value corresponding to each transaction main body to obtain the fluctuation value of each node.

In one possible implementation, the normalization process is implemented based on the following:

Wherein S _i represents a fluctuation value of the nodes, r _i represents an initial fluctuation value corresponding to the nodes, and K is used for representing the total number of nodes in the graph association structure.

In one possible implementation, the second sub-rule is determined based on the following formula:

Wherein ep _ij represents the influence value of node i relative to node j, Δi represents the change value of the traffic information value between two times of node i, Δj represents the change value of the traffic information value between two times of node j, e _it represents the traffic information value of node i at time t, e _it' represents the traffic information value of node i at time t ', e _jt represents the traffic information value of node j at time t, e _jt' represents the traffic information value of node j at time t', and nodes i and j are any nodes in the graph association structure.

In one possible implementation manner, determining the corresponding transaction value of each node according to the fluctuation value and the corresponding influence value of each node includes:

Constructing an initial abnormal iteration matrix by taking an influence value of an associated node with an associated relation with one node as a matrix factor;

Substituting the initial abnormal iteration matrix and the fluctuation value corresponding to each node into a third sub-rule of the preset abnormal analysis rule, and respectively determining the abnormal value corresponding to each node; and the third sub-rule is used for iteratively optimizing the fluctuation value of the node by combining all the influence values corresponding to the nodes with the association relation with the node.

In one possible implementation, the third sub-rule is determined based on the following formula:

Hⁿ←θH^n-1+d

Where H ⁿ represents the set of fluctuation values of all nodes, n is used to characterize the iteration round, when n is equal to 1, H ¹ +.θs ' +d, S ' represents the set of fluctuation values of all nodes, S ' = { S ₁,S₂,……,S_K }, Ep _ij represents the influence value of the node i relative to the node j, the node i and the node j are any nodes in the graph association structure, S _k represents the fluctuation value of the node k, d is a non-zero adjustment coefficient, and i and j are positive integers.

In one possible implementation, after determining that the first node is a transaction node, the method further includes:

Screening candidate paths comprising a first node based on the graph association structure, and taking the candidate paths as transaction paths;

Analyzing the abnormal path to obtain an abnormal analysis result; the transaction analysis result is used for indicating an influence node associated with the transaction node, and optimizing the business of the transaction main body corresponding to the influence node based on the business information corresponding to the transaction node.

In a second aspect, an embodiment of the present invention provides a data processing apparatus, the apparatus including:

the construction unit is used for constructing a graph association structure which takes a transaction main body in a target service scene as a node and an association relationship between the transaction main bodies as an edge;

The determining unit is used for determining a transaction value corresponding to each node based on the business information of the transaction subjects indicated by each node in the graph association structure, the association relation among the transaction subjects and a preset transaction analysis rule; wherein, each abnormal value is used for indicating the abnormal fluctuation degree of the transaction main body indicated by one node; the abnormal fluctuation degree is determined based on the self business information of the transaction main body and the business information of other transaction main bodies with association relation with the self business information;

and the processing unit is used for determining the first node as a transaction main body indicated by the first node as a transaction main body when the transaction value corresponding to the first node is larger than a preset threshold value.

In a possible embodiment, the determining unit is specifically configured to:

Hⁿ←θH^n-1+d

In a possible implementation manner, after determining that the first node is a transaction node, the apparatus further includes an optimizing unit, configured to:

In a third aspect, an embodiment of the present invention provides an electronic device, including at least one processor; and a memory communicatively coupled to the at least one processor; wherein the memory stores instructions executable by the at least one processor to enable the at least one processor to perform any one of the methods provided by the embodiments of the first aspect of the present invention.

In a fourth aspect, embodiments of the present invention provide a computer storage medium, where the computer readable storage medium stores a computer program for causing a computer to perform any of the methods provided by the embodiments of the first aspect of the present invention.

In a fifth aspect, embodiments of the present invention provide a computer program product comprising: computer program code which, when run on a computer, causes the computer to perform any of the methods provided by the embodiments of the first aspect.

The invention has the following beneficial effects:

In the embodiment of the invention, a graph association structure which takes a transaction main body in a target service scene as a node and an association relationship between the transaction main bodies as an edge can be constructed; further, determining a transaction value corresponding to each node based on the business information of the transaction subjects indicated by each node in the graph association structure, the association relationship among the transaction subjects and a preset transaction analysis rule; wherein, each abnormal value is used for indicating the abnormal fluctuation degree of the transaction main body indicated by one node; the degree of abnormal fluctuation is determined based on the own business information of the transaction body and the business information of other transaction bodies having an association relationship with the own business information. Therefore, in the embodiment of the invention, from the view of the graph association structure, the abnormal value corresponding to the node is determined, and the determination of the abnormal value simultaneously considers two aspects of the self business information of the transaction main body and the business information of other transaction main bodies with association relation, thereby improving the accuracy of attribution analysis of abnormal behavior. Thus, when the transaction value corresponding to the first node is larger than the preset threshold, the first node is determined to be the transaction main body, and the transaction main body indicated by the first node is determined to be the transaction main body, so that the transaction main body causing the transaction matters can be accurately and efficiently determined.

Additional features and advantages of the invention will be set forth in the description which follows, and in part will be obvious from the description, or may be learned by practice of the invention. The objectives and other advantages of the invention will be realized and attained by the structure particularly pointed out in the written description and claims thereof as well as the appended drawings.

Drawings

In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the related art, the drawings that are required to be used in the embodiments or the related technical descriptions will be briefly described, and it is apparent that the drawings in the following description are only embodiments of the present invention, and other drawings may be obtained according to the provided drawings without inventive effort for those skilled in the art.

FIG. 1 is an alternative schematic diagram of an application scenario in an embodiment of the present invention;

FIG. 2 is an alternative schematic diagram of an application scenario in an embodiment of the present invention;

FIG. 3 is a flow chart of a data processing method according to an embodiment of the invention;

FIG. 4 is a schematic diagram of a diagram association structure according to an embodiment of the present invention;

FIG. 5 is a schematic diagram of a fluctuation value of a node in a graph correlation structure according to an embodiment of the present invention;

FIG. 6 is a schematic diagram of an impact value of a node in a graph correlation structure according to an embodiment of the present invention;

FIG. 7 is a schematic diagram of calculating a transaction value corresponding to a node according to an embodiment of the present invention;

FIG. 8 is a schematic diagram of a transaction path according to an embodiment of the present invention;

FIG. 9 is a schematic diagram of a data processing apparatus according to an embodiment of the present invention;

FIG. 10 is a schematic diagram of an electronic device according to an embodiment of the present invention;

fig. 11 is a schematic structural diagram of an electronic device according to an embodiment of the present invention.

Detailed Description

For the purpose of making the objects, technical solutions and advantages of the present invention more apparent, the technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present invention, and it is apparent that the described embodiments are only some embodiments of the present invention, not all embodiments of the present invention. All other embodiments, which can be made by those skilled in the art based on the embodiments of the invention without making any inventive effort, are intended to be within the scope of the invention. Embodiments of the invention and features of the embodiments may be combined with one another arbitrarily without conflict. Also, while a logical order is depicted in the flowchart, in some cases, the steps depicted or described may be performed in a different order than presented herein.

The terms first, second and the like in the description and in the claims and in the above-described figures are used for distinguishing between similar elements and not necessarily for describing a particular sequential or chronological order. It is to be understood that the data so used may be interchanged where appropriate such that the embodiments of the invention described herein may be capable of operation in sequences other than those illustrated or otherwise described.

The word "exemplary" is used herein to mean "serving as an example, embodiment, or illustration. Any embodiment described as "exemplary" is not necessarily to be construed as preferred or advantageous over other embodiments.

Exemplary embodiments of the present invention will now be described with reference to the accompanying drawings, in which various details of the embodiments of the present invention are included to facilitate understanding, and are to be considered merely exemplary. Accordingly, one of ordinary skill in the art will recognize that various changes and modifications of the embodiments described herein can be made without departing from the scope of the present disclosure. Also, descriptions of well-known functions and constructions are omitted in the following description for clarity and conciseness. It should be noted that, in the embodiments of the present invention, some existing solutions in the industry such as software, components, models, etc. may be mentioned, and they should be regarded as exemplary, only for illustrating the feasibility of implementing the technical solution of the present invention, but it does not mean that the applicant has or must not use the solution.

In the technical scheme of the invention, the data is collected, transmitted, used and the like, and all meet the requirements of national relevant laws and regulations.

At present, as described above, how to determine a transaction subject to be optimized becomes a technical problem to be solved.

In view of this, the embodiment of the present invention provides a data processing method, by which a graph association structure with a transaction subject in a target service scenario as a node and an association relationship between transaction subjects as an edge can be constructed; further, determining a transaction value corresponding to each node based on the business information of the transaction subjects indicated by each node in the graph association structure, the association relationship among the transaction subjects and a preset transaction analysis rule; wherein, each abnormal value is used for indicating the abnormal fluctuation degree of the transaction main body indicated by one node; the degree of abnormal fluctuation is determined based on the own business information of the transaction body and the business information of other transaction bodies having an association relationship with the own business information. Therefore, in the embodiment of the invention, from the view of the graph association structure, the abnormal value corresponding to the node is determined, and the determination of the abnormal value simultaneously considers two aspects of the self business information of the transaction main body and the business information of other transaction main bodies with association relation, thereby improving the accuracy of attribution analysis of abnormal behavior. Thus, when the transaction value corresponding to the first node is larger than the preset threshold, the first node is determined to be the transaction main body, and the transaction main body indicated by the first node is determined to be the transaction main body, so that the transaction main body causing the transaction matters can be accurately and efficiently determined.

After the design idea of the embodiment of the present invention is introduced, some simple descriptions are made below for application scenarios applicable to the technical solution of the embodiment of the present invention, and it should be noted that the application scenarios described below are only used for illustrating the embodiment of the present invention and are not limiting. In the specific implementation process, the technical scheme provided by the embodiment of the invention can be flexibly applied according to actual needs.

In the embodiment of the invention, the data processing method provided by the embodiment of the invention can be applied to any business scene needing abnormal attribution analysis, such as a business scene carrying out abnormal attribution analysis on each functional module in a software system of A business, a business scene carrying out abnormal attribution analysis on each functional unit in a network platform, and the like, and also such as a business scene carrying out abnormal attribution analysis on each main body in a payment system of the financial field, a business scene carrying out abnormal attribution analysis on each main body in a lending system of the financial field, a business scene carrying out abnormal attribution analysis on each main body in a manufacturing system of the manufacturing field, a business scene carrying out abnormal attribution analysis on each main body in an enterprise management system of the management field, and the like.

Referring to fig. 1, fig. 1 is an application scenario to which the technical solution of the embodiment of the present invention is applicable. In this scene diagram, a plurality of devices 101 corresponding to acquirers, a plurality of devices 102 corresponding to payment subsidiaries, a device 103 corresponding to a payment subsidiaries, and a device 104 corresponding to an analysis system for performing transaction attribution analysis on a payment system are included. Note that, the acquirer, the payment sub-company, and the payment main company may be referred to as a transaction entity.

The devices 104 corresponding to each analysis system may include one or more processors 1041, memory 1042, and I/O interfaces 1043 to interact with the devices, among others. And, devices 101, 102, 103, and 104, and each may be connected directly or indirectly via one or more networks 105.

It should be noted that, in the embodiment of the present invention, the device 101-1, the devices 101-2, … …, the object 1 of the device 101-n, the object 2, … …, and the object n, n are positive integers, and may initiate a payment transaction at the same time, or of course, the object 1 initiates a transaction first, and the object 2 initiates a transaction again. The specific scheme of performing transaction attribute analysis on payment transaction data can refer to a data processing method provided by the embodiment of the present invention, and is described in detail later, and is not described herein.

For example, referring to fig. 2, fig. 2 is a schematic view of another application scenario to which the technical solution of the embodiment of the present invention may be applied, where the scenario includes a plurality of devices 201 corresponding to vending mechanisms, a plurality of devices 202 corresponding to manufacturing sub-companies, a device 203 corresponding to manufacturing companies, and a device 104 corresponding to an analysis system for performing abnormal attribution analysis on vending systems. The selling institution, the manufacturing subsidiary, and the manufacturing head office may be referred to as a transaction entity.

The devices 104 corresponding to each analysis system may include one or more processors 1041, memory 1042, and I/O interfaces 1043 to interact with the devices, among others. And devices 201, 202, 203, and 104, and each may be connected directly or indirectly via one or more networks 105.

It should be noted that, in the embodiment of the present invention, the vending mechanism 1, the vending mechanism 2, … …, and the vending mechanism n, n of the device 201-1, the device 201-2, … …, and the device 201-n are positive integers, and may initiate the vending transaction at the same time, or of course, the vending mechanism 1 initiates the vending transaction first, and the vending mechanism 2 initiates the vending transaction again. Wherein, the specific scheme of carrying out abnormal attribution analysis on the vending transaction data can refer to the data processing method provided by the embodiment of the invention, and are described in detail later, and are not described in detail here.

Each device in fig. 1 and fig. 2 may be a mobile phone, a tablet personal computer (PAD), a personal computer (Personal computer, PC), a smart television, a smart watch, a smart speaker, a smart car device, a wearable device, or the like, but not limited thereto, and these devices may have a function of logging in and using a learning website.

The devices in fig. 1 and fig. 2 may be independent physical servers, or may be a server cluster or a distributed system formed by a plurality of physical servers, or may be cloud servers for providing cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, content delivery networks (Content Delivery Network, CDN), and basic cloud computing services such as big data and artificial intelligence platforms, but are not limited thereto.

The network 105 may be a wired network, or may be a Wireless network, for example, a mobile cellular network, or may be a Wireless-Fidelity (WIFI) network, or may be other possible networks, which the embodiments of the present invention are not limited to.

Of course, the method provided by the embodiment of the present invention is not limited to the application scenario shown in fig. 1 and fig. 2, but may be used in other possible application scenarios, and the embodiment of the present invention is not limited.

In order to further explain the technical solution provided by the embodiments of the present invention, the following details are described with reference to the accompanying drawings and the detailed description. Although embodiments of the present invention provide the method operational steps shown in the following embodiments or figures, more or fewer operational steps may be included in the method, either on a routine or non-inventive basis. In steps where there is logically no necessary causal relationship, the execution order of the steps is not limited to the execution order provided by the embodiments of the present invention. The methods may be performed sequentially or in parallel as shown in the embodiments or the drawings when the actual processing or the apparatus is performed.

Referring to fig. 3, fig. 3 is a flow chart of a data processing method according to an embodiment of the present invention, where the data processing method may be performed by the device 104 in fig. 1 and 2, and an analysis system for abnormal motion attribute analysis is disposed on the device 104.

Step 301: and constructing a graph association structure taking the transaction subjects in the target business scene as nodes and the association relationship between the transaction subjects as edges.

In the embodiment of the invention, the electronic device may determine the target service scenario first, and then the target service scenario is taken as an example for explaining the service scenario of the payment system in the financial field. The business scenario of the payment system in the financial field includes a payment head office, a plurality of payment sub-offices, and a plurality of acquirers, which may be understood as a main body for generating transaction data, which is hereinafter referred to as a transaction main body for convenience of description. Then, the association relationship among the payment head office, the plurality of payment sub-offices and the plurality of acquirers can be determined based on the service information, for example, if the service information is the number of business units, the association relationship between the payment head office and the payment sub-offices, and the association relationship between the payment sub-offices and the acquirers of the number of business units can be determined. For another example, if the service information is transaction amount, it may be determined that the payment head office and the payment sub-office have an association relationship of transaction amount, and the payment sub-office and the acquiring organization have an association relationship of transaction amount.

Furthermore, a graph association structure taking transaction subjects in the target business scene as nodes and the association relationship between the transaction subjects as edges can be constructed.

For example, referring to fig. 4, fig. 4 is a schematic diagram of a graph association structure according to an embodiment of the present invention. The quadrangle pattern in fig. 4 is used for representing nodes of the transaction main body as an order receiving organization, the pentagon pattern is used for representing nodes of the transaction main body as a payment sub-company, and the hexagon pattern is used for representing nodes of the transaction main body as a payment main company.

Alternatively, the graph association structure may be expressed in mathematical form, as follows:

G＝{V,ε}

Where V represents the set of nodes that the graph association structure includes and ε represents the set of edges of the graph association structure.

Step 302: determining a transaction value corresponding to each node based on service information of transaction subjects indicated by each node in the graph association structure, association relations among the transaction subjects and preset transaction analysis rules; wherein, each abnormal value is used for indicating the abnormal fluctuation degree of the transaction main body indicated by one node; the degree of abnormal fluctuation is determined based on the own business information of the transaction body and the business information of other transaction bodies having an association relationship with the own business information.

In the embodiment of the present invention, the electronic device may use, but is not limited to, the following transaction values corresponding to each node:

Step A: determining a fluctuation value of each node based on the business information of the transaction main body indicated by each node in the graph association structure and a first sub-rule in a preset transaction analysis rule; the first sub-rule is used for carrying out order normalization processing on initial fluctuation values of nodes obtained based on service information of different orders.

In the embodiment of the invention, the electronic equipment can respectively input the business information of the transaction main body indicated by each node into the preset time sequence attribution model to obtain the initial fluctuation value corresponding to each node output by the preset time sequence attribution model; the preset time sequence attribution model determines an initial fluctuation value of a transaction body based on business information of the transaction body in a preset time period and a preset magnitude fluctuation evaluation rule. The preset magnitude fluctuation evaluation rule comprises a plurality of mapping relations, and different mapping relations comprise numerical value ranges corresponding to business information of different magnitudes and initial fluctuation values corresponding to the numerical value ranges.

For example, assuming that the node is the acquiring organization a and the service information is the monthly transaction count of the acquiring organization a within 2 years of 2021-2023, the monthly transaction count of the acquiring organization a within 2 years of 2021-2023 is 100 to be input to the preset time sequence attribution model, so that the numerical range corresponding to the transaction count can be determined to be 100-200 based on the fluctuation evaluation rule, the initial fluctuation value corresponding to the numerical range is 120%, and the initial fluctuation value of the node in the order of the transaction count is determined to be 120%.

Furthermore, due to the different scales of different traffic values, for example: the number level of transaction numbers is hundreds of millions, and the number level of business numbers is tens of millions, namely, the magnitudes of two business values have great difference, so that the normalization processing can be carried out on the initial fluctuation value corresponding to each transaction main body, and the magnitudes can be uniformly evaluated. That is, the initial fluctuation value corresponding to each transaction body may be normalized to obtain the fluctuation value of each node. The fluctuation value is used to indicate a case where a fluctuation occurs in a value of the traffic information of the transaction subject indicated by the node (hereinafter, referred to as a traffic information value for convenience of description).

Optionally, the normalization process is implemented based on the following:

Wherein S _i represents a fluctuation value of the nodes, r _i represents an initial fluctuation value corresponding to the nodes, and K is used for representing the total number of the nodes in the graph association structure.

For example, referring to fig. 5, fig. 5 is a schematic diagram of a fluctuation value of a node in a graph association structure according to an embodiment of the present invention. The quadrangle pattern in fig. 5 is used for representing nodes of the transaction main body as an order receiving organization, the pentagon pattern is used for representing nodes of the transaction main body as a payment sub-company, and the hexagon pattern is used for representing nodes of the transaction main body as a payment main company. The fluctuation value of the nodes of the transaction main body represented by the quadrilateral pattern as the acquiring mechanism is 0.1,0.1 =120%/1200%, wherein 120% is the same-ratio increment value of the business information of the transaction main body as the acquiring mechanism, and 1200% is the sum of the same-ratio increment values of the business information of the transaction main bodies indicated by all nodes except the nodes of the transaction main body as the main company.

And (B) step (B): determining an influence value of fluctuation of business information of each node affected by other nodes based on the association relation between transaction subjects and a second sub-rule in a preset transaction analysis rule respectively; the second sub-rule is used for calculating the degree of influence of fluctuation of the lower node by the upper node, and the lower node and the upper node are determined based on the association relation between transaction subjects;

in an embodiment of the present invention, the second sub-rule is determined based on the following formula:

Wherein ep _ij represents the influence value of node i relative to node j, Δi represents the change value of the traffic information value between two times of node i, Δj represents the change value of the traffic information value between two times of node j, e _it represents the traffic information value of node i at time t, e _it' represents the traffic information value of node i at time t ', e _jt represents the traffic information value of node j at time t, e _jt' represents the traffic information value of node j at time t', and nodes i and j are arbitrary nodes in the graph association structure.

In the embodiment of the present invention, after the second sub-rule is determined, an influence value of the fluctuation of the service information of each node affected by other nodes may be determined based on the association relationship between transaction subjects and the aforementioned second sub-rule.

For example, referring to fig. 6, fig. 6 is a schematic diagram of an influence value of a node in a graph association structure according to an embodiment of the present invention. The quadrangle pattern in fig. 6 is used for representing nodes of the transaction main body as an order receiving organization, the pentagon pattern is used for representing nodes of the transaction main body as a payment sub-company, and the hexagon pattern is used for representing nodes of the transaction main body as a payment main company. The influence value of the node of the sub-payment company of the transaction main body represented by the pentagon pattern is 0.2,0.2 =3000 ten thousand/1.5 hundred million, wherein 3000 ten thousand is the transaction number change value of the payment sub-company of the transaction main body, and 1.5 hundred million is the transaction number change value of the main company of the transaction main body.

Step C: and determining the corresponding abnormal value of each node according to the fluctuation value and the corresponding influence value of each node.

In the embodiment of the invention, the electronic equipment can take the influence value of one association node with an association relation with one node as the initial abnormal iteration matrix. For example, the initial transaction iteration matrix may be expressed as:

Wherein θ represents an initial transaction iteration matrix, θ _i,j is one matrix factor in θ, Ep _ij represents the influence value of node i relative to node j, where node i and node j are any nodes in the graph association structure, i.e., i, j e K. Wherein when the association relationship between the node i and the node j does not exist,

Further, the electronic device may determine, according to the initial transaction iteration matrix and the fluctuation value corresponding to each node, a transaction value corresponding to each node in a third sub-rule of the preset transaction analysis rule; and the third sub-rule is used for iteratively optimizing the fluctuation value of the node by combining all the influence values corresponding to the nodes with the association relation with the node.

Optionally, the third sub-rule is determined based on the following formula:

H¹←θS′+d

H²←θH¹+d

...

Hⁿ←θH^n-1+d

Wherein, H represents an intermediate variable of the iteration process, H ⁿ represents an n-th round of iteration result, n is determined according to the euclidean distance between H ⁿ and H ^n-1, and the iteration can be stopped generally when the euclidean distance between H ⁿ and H ^n-1 is less than 0.0001. θ represents an initial heterogenous iteration matrix, S 'represents a set of fluctuating values for all nodes, S' = { S ₁,S₂,……,S_K }, d is a non-zero adjustment coefficient, i, j is a positive integer.

The final node has a transaction value distribution of H ⁿ ofWherein the transaction value of the node 1 isI.e. the first element of vector H ⁿ.

Optionally, the electronic device may further sort the transaction values corresponding to all the nodes from large to small, to obtain the transaction values of all the nodes after sorting. For example, referring to fig. 7, fig. 7 is a schematic diagram of a transaction value corresponding to a computing node according to an embodiment of the present invention. The quadrangle pattern in fig. 7 is used for representing nodes of the transaction main body as an order receiving organization, the pentagon pattern is used for representing nodes of the transaction main body as a payment sub-company, and the hexagon pattern is used for representing nodes of the transaction main body as a payment main company.

Step 303: when the transaction main body indicated by the first node is determined to be the transaction main body, the transaction main body indicated by the first node is determined to be the transaction main body.

In the embodiment of the present invention, after obtaining the transaction values corresponding to all the nodes, a preset threshold value may be determined according to historical experience, where the preset threshold value is, for example, 0.5. The intermediate values of the first 4 of the sorting can be used as a preset threshold based on the sorting information of the transaction values corresponding to all the obtained nodes, and of course, the preset threshold can be determined based on other modes, which is not limited in the embodiment of the invention.

In the embodiment of the invention, after the electronic equipment determines the preset threshold, the first nodes with the abnormal values larger than the preset threshold corresponding to all the nodes can be screened out, and the first nodes are taken as abnormal nodes. That is, the first node may be a node or a group of nodes.

In the embodiment of the invention, after the abnormal node is determined, the abnormal node can be returned to the constructed graph association structure for restoration, so that a clear association tracing path can be obtained, and the convenience of attribution analysis of a transaction main body is improved.

In the embodiment of the invention, the electronic equipment can screen the candidate path comprising the first node based on the graph association structure, and take the candidate path as the transaction path; analyzing the abnormal path to obtain an abnormal analysis result; the transaction analysis result is used for indicating the influence node associated with the transaction node, and optimizing the business of the transaction main body corresponding to the influence node based on the business information corresponding to the transaction node.

For example, referring to fig. 8, fig. 8 is a schematic diagram of a transaction path according to an embodiment of the present invention. The quadrangle pattern in fig. 8 is used for representing nodes of the transaction main body as an order receiving organization, the pentagon pattern is used for representing nodes of the transaction main body as a payment subsidiary, and the hexagon pattern is used for representing nodes of the transaction main body as a payment main company. The node represented by the fully filled quadrilateral pattern in fig. 8 is the first node and forms a transaction path with the node represented by the fully filled pentagon pattern and the node represented by the fully filled hexagonal pattern.

In the embodiment of the invention, the advantage of the graph association structure is utilized to further restore the association trace path of attribution analysis, namely the transaction path, so that the convenience of transaction main body for carrying out transaction attribution analysis is improved, and the policy optimization effect on actual business is further improved.

Based on the same inventive concept, the embodiment of the invention also provides a data processing device. As shown in fig. 9, which is a schematic structural diagram of the data processing apparatus 900, may include:

a construction unit 901, configured to construct a graph association structure with a transaction subject in a target service scenario as a node and an association relationship between transaction subjects as an edge;

A determining unit 902, configured to determine a transaction value corresponding to each node based on service information of a transaction main body indicated by each node in the graph association structure, an association relationship between transaction main bodies, and a preset transaction analysis rule; wherein, each abnormal value is used for indicating the abnormal fluctuation degree of the transaction main body indicated by one node; the abnormal fluctuation degree is determined based on the self business information of the transaction main body and the business information of other transaction main bodies with association relation with the self business information;

The processing unit 903 is configured to determine that the first node is a transaction entity indicated by the first node as a transaction entity when the transaction value corresponding to the first node is greater than a preset threshold.

In a possible implementation manner, the determining unit 902 is specifically configured to:

Respectively inputting the business information of the transaction main body indicated by each node into a preset time sequence attribution model to obtain an initial fluctuation value corresponding to each node output by the preset time sequence attribution model; the preset time sequence attribution model determines an initial fluctuation value of a transaction main body based on service information of the transaction main body in a preset time period and a preset magnitude fluctuation evaluation rule; the preset magnitude fluctuation evaluation rule comprises a plurality of mapping relations, wherein different mapping relations comprise numerical value ranges corresponding to different magnitude business information and initial fluctuation values corresponding to the numerical value ranges;

Hⁿ←θH^n-1+d

Where H ⁿ represents a set of fluctuation values of all nodes, n is used to characterize the iteration round, when n is equal to 1, H ¹ ++s ' +d, S ' represents a set of fluctuation values of all nodes, S ' = { S ₁,S₂,……,S_K }, θ represents the initial fluctuation iteration matrix, θ _i,j is the matrix factor in θ, Ep _ij represents the influence value of the node i relative to the node j, the node i and the node j are any nodes in the graph association structure, S _k represents the fluctuation value of the node k, d is a non-zero adjustment coefficient, and i and j are positive integers.

For convenience of description, the above parts are described as being functionally divided into modules (or units) respectively. Of course, the functions of each module (or unit) may be implemented in the same piece or pieces of software or hardware when implementing the present invention.

Having described the data processing method and apparatus of an exemplary embodiment of the present invention, next, an electronic device according to another exemplary embodiment of the present invention is described.

Those skilled in the art will appreciate that the various aspects of the invention may be implemented as a system, method, or program product. Accordingly, aspects of the invention may be embodied in the following forms, namely: an entirely hardware embodiment, an entirely software embodiment (including firmware, micro-code, etc.) or an embodiment combining hardware and software aspects may be referred to herein as a "circuit," module "or" system.

The specific implementation manner of each module in the apparatus in the above embodiment has been described in detail in the embodiment related to the method, and will not be described in detail herein.

The principle of solving the problem of the electronic device is similar to that of the method of the above embodiment, so that the implementation of the electronic device can be referred to the implementation of the method, and the repetition is omitted.

Referring to fig. 10, fig. 10 is a block diagram of an electronic device 1000 according to an exemplary embodiment, where the electronic device includes at least one processor 1001 and a memory 1002 connected to the at least one processor 1001, and the embodiment of the present invention is not limited to a specific connection medium between the processor 1001 and the memory 1002, and fig. 10 is an example where the processor 1001 and the memory 1002 are connected by a bus, the bus is shown in fig. 10 with a thick line, and a connection manner between other components is merely illustrative and not limited to the example. The buses may be divided into address buses, data buses, control buses, etc., and are represented by only one thick line in fig. 10 for ease of illustration, but do not represent only one bus or one type of bus.

In an embodiment of the present invention, the memory 1002 stores instructions executable by the at least one processor 1001, and the at least one processor 1001 may perform the steps included in the aforementioned data processing method by executing the instructions stored in the memory 1002.

The processor 1001 is a control center of the electronic device, and may connect various parts of the entire fault detection device using various interfaces and lines, and by executing or executing instructions stored in the memory 1002 and invoking data stored in the memory 1002, various functions of the electronic device and processing data, thereby performing overall monitoring of the electronic device. Alternatively, the processor 1001 may include one or more processing units, and the processor 1001 may integrate an application processor and a modem processor, wherein the processor 1001 mainly processes an operating system, a user interface, an application program, and the like, and the modem processor mainly processes wireless communication. It will be appreciated that the modem processor described above may not be integrated into the processor 1001. In some embodiments, the processor 1001 and the memory 1002 may be implemented on the same chip, and in some embodiments they may be implemented separately on separate chips.

The processor 1001 may be a general purpose processor, such as a Central Processing Unit (CPU), digital signal processor, application specific integrated circuit, field programmable gate array or other programmable logic device, discrete gate or transistor logic device, discrete hardware components, which may implement or perform the methods, steps and logic block diagrams disclosed in embodiments of the present invention. The general purpose processor may be a microprocessor or any conventional processor or the like. The steps of a method disclosed in connection with the embodiments of the present invention may be embodied directly in a hardware processor for execution, or in a combination of hardware and software modules in the processor for execution.

The memory 1002 is a non-volatile computer-readable storage medium that can be used to store non-volatile software programs, non-volatile computer-executable programs, and modules. The Memory 1002 may include at least one type of storage medium, and may include, for example, flash Memory, hard disk, multimedia card, card Memory, random access Memory (Random Access Memory, RAM), static random access Memory (Static Random Access Memory, SRAM), programmable Read-Only Memory (Programmable Read Only Memory, PROM), read-Only Memory (ROM), charged erasable programmable Read-Only Memory (ELECTRICALLY ERASABLE PROGRAMMABLE READ-Only Memory, EEPROM), magnetic Memory, magnetic disk, optical disk, and the like. Memory 1002 is any other medium that can be used to carry or store desired program code in the form of instructions or data structures and that can be accessed by a computer, but is not limited to such. The memory 1002 in embodiments of the present invention may also be circuitry or any other device capable of performing memory functions for storing program instructions and/or data.

Based on the same inventive concept, an embodiment of the present invention further provides a further schematic diagram of an electronic device, referring to fig. 11, where the electronic device 104 includes a display unit 1140, a processor 1180, and a memory 1120, where the display unit 1140 includes a display panel 1141 for displaying information input by a user or provided to the user, and various object selection interfaces of the electronic device 104, and is mainly used for displaying related operation interfaces, shortcut windows, and the like of an analysis system installed in the electronic device 104 in the embodiment of the present invention. Alternatively, the display panel 1141 may be configured in the form of an LCD (Liquid CRYSTAL DISPLAY) or an OLED (Organic Light-Emitting Diode) or the like.

The processor 1180 is configured to read the computer program and then execute a method defined by the computer program, for example, the processor 1180 reads an application program of the analysis system, so as to run the analysis system on the electronic device 104, and display an operation interface related to the analysis system on the display unit 1140. The Processor 1180 may include one or more general-purpose processors and may further include one or more DSPs (DIGITAL SIGNAL processors ) for performing related operations to implement the technical solutions provided by the embodiments of the present invention.

Memory 1120 typically includes memory and external memory, which may be Random Access Memory (RAM), read Only Memory (ROM), and CACHE memory (CACHE), among others. The external memory can be a hard disk, an optical disk, a USB disk, a floppy disk, a tape drive, etc. The memory 1120 is used to store computer programs including applications corresponding to respective software, etc., and other data, which may include data generated after the operating system or the applications are run, including system data (e.g., configuration parameters of the operating system) and user data. In the embodiment of the present invention, the program instructions are stored in the memory 1120, and the processor 1180 executes the program instructions stored in the memory 1120 to implement the functions of the data processing method discussed above.

In addition, the electronic device 104 may further include a display unit 1140 for receiving input digital information, character information, or touch operation/noncontact gestures, and generating signal inputs related to user settings and function controls of the electronic device 104, and the like. Specifically, in an embodiment of the present invention, the display unit 1140 may include a display panel 1141. The display panel 1141, e.g., a touch screen, may collect touch operations thereon or thereabout by a user (e.g., operations of a target object on the display panel 1141 or on the display panel 1141 using any suitable object or accessory such as a finger, a stylus, etc.), and drive the corresponding connection device according to a predetermined program. Alternatively, the display panel 1141 may include two parts, a touch detection device and a touch controller. The touch detection device comprises a touch controller, a touch detection device and a touch control device, wherein the touch detection device is used for detecting a touch direction of a user, detecting a signal brought by touch operation and transmitting the signal to the touch controller; the touch controller receives touch information from the touch sensing device and converts it into touch point coordinates, which are then sent to the processor 1180, and can receive commands from the processor 1180 and execute them. In the embodiment of the present invention, if the user performs the selection operation on the associated subroutine, the touch detection device in the display panel 1141 detects the touch operation, and then the touch controller sends a signal corresponding to the detected touch operation, the touch controller converts the signal into the touch point coordinates and sends the touch point coordinates to the processor 1180, and the processor 1180 determines the target service scene selected by the user according to the received touch point coordinates and controls the display panel 1141 to display the transaction main body in the target service scene.

The display panel 1141 may be implemented by various types such as resistive, capacitive, infrared, and surface acoustic wave. In addition to the display unit 1140, the electronic device 104 may also include an input unit 1130, which may include, but is not limited to, one or more of a physical keyboard, function keys (e.g., volume control keys, switch keys, etc.), a trackball, a mouse, a joystick, etc. In fig. 11, the input unit 1130 includes an image input device 1131 and other input devices 1132 as an example.

In addition to the above, the electronic device 104 may also include a power supply 1190 for powering other modules, audio circuitry 1160, near field communication module 1170, and RF circuitry 1110. The electronic device 104 may also include one or more sensors 1150, such as acceleration sensors, light sensors, pressure sensors, and the like. The audio circuit 1160 specifically includes a speaker 1161, a microphone 1162, etc., for example, a user may use voice control, the electronic device 104 may collect a user's voice through the microphone 1162, and may control the user's voice, and when a transaction is required to be prompted in the user's service information, a corresponding prompt tone is played through the speaker 1161.

In an exemplary embodiment, a storage medium is also provided that includes operations, such as memory 1002 including operations that are executable by processor 1001 of electronic device 1000 to perform the methods described above. Alternatively, the storage medium may be a non-transitory computer readable storage medium, which may be, for example, ROM, random Access Memory (RAM), CD-ROM, magnetic tape, floppy disk, optical data storage device, and the like.

The various aspects of the data processing method provided by the present invention may also be implemented in the form of a program product based on the same inventive concept as the above-described method embodiments, which comprises program code for causing an electronic device to perform the steps of the data processing method according to the various exemplary embodiments of the invention described in this specification, when the program product is run on an electronic device, e.g. the electronic device may perform the steps as shown in fig. 3.

The program product may employ any combination of one or more readable media. The readable medium may be a readable signal medium or a readable storage medium. The readable storage medium can be, for example, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or a combination of any of the foregoing. More specific examples (a non-exhaustive list) of the readable storage medium would include the following: an electrical connection having one or more wires, a portable disk, a hard disk, random Access Memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

The program product of embodiments of the present invention may employ a portable compact disc read only memory (CD-ROM) and include program code and may run on a server. However, the program product of the present invention is not limited thereto, and in this document, a readable storage medium may be any tangible medium that can contain, or store a program for use by or in connection with a command execution system, apparatus, or device.

The readable signal medium may include a data signal propagated in baseband or as part of a carrier wave with readable program code embodied therein. Such a propagated data signal may take any of a variety of forms, including, but not limited to, electro-magnetic, optical, or any suitable combination of the foregoing. A readable signal medium may also be any readable medium that is not a readable storage medium and that can communicate, propagate, or transport a program for use by or in connection with a command execution system, apparatus, or device.

Program code embodied on a readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wireline, optical fiber cable, RF, etc., or any suitable combination of the foregoing.

While preferred embodiments of the present invention have been described, additional variations and modifications in those embodiments may occur to those skilled in the art once they learn of the basic inventive concepts. It is therefore intended that the following claims be interpreted as including the preferred embodiments and all such alterations and modifications as fall within the scope of the invention.

It will be apparent to those skilled in the art that various modifications and variations can be made to the present invention without departing from the spirit or scope of the invention. Thus, it is intended that the present invention also include such modifications and alterations insofar as they come within the scope of the appended claims or the equivalents thereof.

Claims

1. A method of data processing, the method comprising:

2. The method of claim 1, wherein determining the transaction value corresponding to each node based on the transaction information of the transaction subjects indicated by each node in the graph association structure, the association relationship between the transaction subjects, and a preset transaction analysis rule comprises:

3. The method of claim 2, wherein determining the fluctuation value of each of the nodes based on the traffic information of the transaction body indicated by each of the nodes in the graph association structure and the first sub-rule of the preset transaction analysis rule, respectively, comprises:

4. A method as claimed in claim 3, wherein the normalization is effected on the basis of:

5. The method of claim 2, wherein the second sub-rule is determined based on the following formula:

6. The method of any of claims 2-5, wherein determining a corresponding transaction value for each of the nodes based on the fluctuation value and the corresponding impact value for each of the nodes comprises:

7. The method of claim 6, wherein the third sub-rule is determined based on the following formula:

Hⁿ←θH^n-1+d

8. The method of claim 1, wherein after determining that the first node is a transaction node, the method further comprises:

9. A data processing apparatus, the apparatus comprising:

10. An electronic device comprising a memory, a processor and a computer program stored on the memory and executable on the processor, characterized in that the processor implements the steps of the method of any of claims 1-8 when the computer program is executed.

11. A computer readable storage medium, characterized in that it comprises a program code for causing an electronic device to perform the steps of the method according to any of claims 1-8, when the program product is run on said electronic device.

12. A computer program product, the computer program product comprising: computer program code which, when run on a computer, causes the computer to perform the method of any of the preceding claims 1-8.