CN115204436A

CN115204436A - Method, device, equipment and medium for detecting abnormal reasons of business indexes

Info

Publication number: CN115204436A
Application number: CN202110397668.4A
Authority: CN
Inventors: 林岳
Original assignee: Tencent Technology Shenzhen Co Ltd
Current assignee: Tencent Technology Shenzhen Co Ltd
Priority date: 2021-04-14
Filing date: 2021-04-14
Publication date: 2022-10-18

Abstract

The application provides a method, a device, equipment and a medium for detecting abnormal reasons of business indexes, which relate to the technical field of artificial intelligence and are used for improving the accuracy of detecting the abnormal reasons of the business indexes.

Description

Method, device, equipment and medium for detecting abnormal reasons of business indexes

Technical Field

The application relates to the technical field of computers, in particular to the technical field of artificial intelligence, and provides a method, a device, equipment and a medium for detecting abnormal reasons of business indexes.

Background

In order to ensure normal operation of the service, most service platforms set corresponding service indexes for each service provided by the service platforms, and monitor each service index. Once it is detected that the service index is abnormal, the reason for the abnormal service index needs to be analyzed, and the overall condition of the service is followed up in time.

At present, the method for analyzing the cause of the abnormal business index is as follows: and manually analyzing the reasons of the abnormal business indexes based on historical experience. However, this method cannot fully consider various possible influence factors, and is highly subjective, resulting in low accuracy of analysis results.

Disclosure of Invention

The embodiment of the application provides a method, a device, equipment and a medium for detecting abnormal reasons of business indexes, which are used for improving the accuracy of detecting the abnormal reasons of the business indexes.

In one aspect, a method for detecting a cause of an abnormal service indicator is provided, including:

acquiring an abnormal service index of a target service in a current service period, wherein the abnormal service index refers to: the change rate between the current service period and the last service period meets the service index of a preset change rate condition;

acquiring a plurality of items of target service data associated with the target service in the current service period;

respectively determining the target association degrees between the plurality of items of target service data and the abnormal service indexes;

and determining an abnormal reason corresponding to the abnormal business index based on the target business data with the target relevance meeting the preset relevance condition.

The embodiment of the application provides a device for detecting a cause of a business index abnormality, which includes:

an abnormal service index obtaining module, configured to obtain an abnormal service index of a target service in a current service period, where the abnormal service index is: the change rate between the current service period and the last service period meets the service index of a preset change rate condition;

a service data acquisition module, configured to acquire multiple items of target service data associated with the target service in the current service period;

the association degree determining module is used for respectively determining the target association degrees between the multiple items of target service data and the abnormal service indexes;

and the abnormal reason determining module is used for determining the abnormal reason corresponding to the abnormal service index based on the target service data of which the target relevance meets the preset relevance condition.

In a possible embodiment, the relevancy determination module is specifically configured to:

respectively extracting the characteristics of the plurality of items of target service data to obtain the target service characteristics corresponding to the plurality of items of target service data;

and respectively determining the target association degree between each obtained target service characteristic and the abnormal service index.

In a possible embodiment, the association degree determining module is specifically configured to:

determining an abnormal type label to which the abnormal service index belongs according to the change rate;

inputting each target service characteristic and an abnormal type label to which the abnormal service index belongs into a trained target tree classification model, and respectively obtaining a first prediction association degree of each target service characteristic and the abnormal type label, wherein the trained target tree classification model is obtained by training based on training data, the training data comprises a sample abnormal type label corresponding to a sample service index in a historical service period, sample service characteristics corresponding to a plurality of sample service data associated with the target service in the historical service period, and real association degrees of the plurality of sample service data, and the sample service index and the abnormal service index are the same service index;

and respectively taking the obtained first prediction association degrees of each target business feature and the abnormal type label as the target association degrees between the corresponding target business feature and the abnormal business index.

if the change rate is greater than a first preset change rate, determining that an abnormal type label of the abnormal service index is a first abnormal type label, wherein the first abnormal type label is used for indicating that the service index is larger;

and if the change rate is smaller than a second preset change rate, determining that the abnormal type label of the abnormal service index is a second abnormal type label, wherein the second abnormal type label is used for indicating that the service index is smaller, and the second preset change rate is smaller than the first preset change rate.

In a possible embodiment, the association determining module is further configured to:

inputting the target business features and the abnormal type labels to which the abnormal business indexes belong into a trained target tree classification model, and determining a target tree classification model matched with the abnormal business indexes from the trained tree classification models before respectively obtaining the prediction association degrees of the target business features and the abnormal type labels;

each of the trained tree classification models is obtained by training according to a sample abnormal type label corresponding to a corresponding sample service index in a historical service period, sample service characteristics of multiple items of sample service data associated with the target service in the historical service period, and respective real association degrees of the multiple items of sample service data, and sample service indexes corresponding to any two tree classification models in the trained tree classification models are different service indexes corresponding to the target service.

In a possible embodiment, the trained target tree classification model is trained by:

performing multiple rounds of iterative training based on a sample abnormal type label corresponding to a sample service index in a historical service period, sample service characteristics corresponding to multiple items of sample service data associated with the target service in the historical service period, and respective real association degrees of the multiple items of sample service data, wherein each round of iterative training comprises:

fitting the residual error of the previous iteration training according to the second prediction relevance of the multiple items of sample service data output by the classifier of the previous iteration training and the real relevance of the multiple items of sample service data;

fitting a classifier of the iterative training of the current round based on the residual error;

inputting the sample abnormal type label corresponding to the sample service index in the historical service period and the sample service characteristics corresponding to the multiple items of sample service data associated with the target service in the historical service period into the classifier of the iterative training, and obtaining the second prediction association degree of the multiple items of sample service data corresponding to the iterative training;

and connecting a plurality of classifiers obtained by the multi-round iterative training to obtain a trained target tree classification model.

In a possible embodiment, the abnormality cause determining module is specifically configured to any one of:

taking at least one item of target service data with the target relevance not less than the relevance threshold as an abnormal reason corresponding to the abnormal service index;

and sequencing the obtained target relevance degrees from large to small according to the value, and taking N project mark service data meeting sequence conditions as abnormal reasons corresponding to the abnormal service indexes, wherein N is a positive integer.

In a possible embodiment, the target service is a resource transfer service, and the plurality of items of target service data are service data generated in a resource transfer process.

An embodiment of the present application provides a computer device, including:

at least one processor, and

a memory communicatively coupled to the at least one processor;

wherein the memory stores instructions executable by the at least one processor, and the at least one processor implements any of the methods of detecting a cause of a business metric anomaly as discussed above by executing the instructions stored by the memory.

Embodiments of the present application provide a computer storage medium, which stores computer instructions, and when the computer instructions are executed on a computer, the computer is caused to execute any one of the methods for detecting a cause of a service indicator abnormality as discussed above.

Due to the adoption of the technical scheme, the embodiment of the application has at least the following technical effects:

in the embodiment of the application, when determining that the service index of the target service in the current service period is abnormal, multiple items of target service data in the same service period can be obtained, and the association degree between each item of target service data and the abnormal service index is analyzed, that is, each item of target service data is comprehensively considered, so that the abnormal reason of the service index can be comprehensively and accurately analyzed. And moreover, the method for automatically analyzing the abnormal reasons of the business indexes is provided, manual participation is not needed, and the efficiency for detecting the abnormal reasons of the business indexes is improved.

Drawings

Fig. 1A is a schematic view of a first application scenario provided in an embodiment of the present application;

fig. 1B is a schematic diagram of an application scenario provided in the embodiment of the present application;

fig. 2 is a first flowchart of a method for detecting a cause of an abnormal service indicator according to an embodiment of the present application;

FIG. 3 is a flowchart of a method for determining a target relevance according to an embodiment of the present disclosure;

FIG. 4 is a flowchart of a method for training a target tree classification model according to an embodiment of the present disclosure;

FIG. 5 is a diagram illustrating an example of partitioning a decision tree in a gradient boosting decision tree model according to an embodiment of the present application;

fig. 6 is a diagram illustrating an example of interaction between a first server and a first terminal according to an embodiment of the present application;

fig. 7 is a first example diagram of an interface change for detecting a cause of an abnormality of a service indicator according to an embodiment of the present application;

fig. 8A is a flowchart of a method for detecting a cause of an abnormal service indicator according to an embodiment of the present application;

fig. 8B is a second example diagram of interface change for detecting an abnormal cause of a service indicator according to an embodiment of the present application;

fig. 9 is a schematic structural diagram of an apparatus for detecting a cause of an abnormal service indicator according to an embodiment of the present application;

fig. 10 is a schematic structural diagram of a computer device according to an embodiment of the present application.

Detailed Description

In order to better understand the technical solutions provided by the embodiments of the present application, the following detailed description is made with reference to the drawings and specific embodiments.

In order to facilitate a better understanding of the technical solutions of the present application for those skilled in the art, the following terms referred to in the present application are introduced.

1. Service indexes are as follows: the service is classified finely and then used for quantitatively describing some aspects of the service. One or more service indexes can be set for one service according to requirements. For example, the service is a resource transfer service, and service indexes corresponding to the resource transfer service are, for example: total frequency of resource transfer, total amount of resource transfer, etc. In addition, the service index has a time characteristic, that is, the value of the same service index is different in different time periods, for example: in the resource transfer service, the total frequency of resource transfer is 120 times in 3 months and 1 day in 2021; the total frequency of resource transfer in 2021, 3, month and 2 is 140 times.

2. Service period: the period for detecting the cause of the abnormal service index may be set according to actual requirements, for example: a month, a week, a day, etc.

3. Service data: refers to various service data related to services, and each service may correspond to one or more service data. Similar to the service index, the service data also has a time characteristic, that is, the value of the same service data is different in different time periods, for example, in the resource transfer service, the resource transfer frequency of the resource transfer performed by the user a is 1 time in 3 months and 1 day in 2021 year, and the resource transfer frequency of the resource transfer performed by the user a is 4 times in 3 months and 2 days in 2021 year.

4. Exception type tag and normal type tag: the method is used for indicating the specific type of the abnormal service index when the abnormal service index occurs in the corresponding service period. The abnormal type labels can be set according to actual requirements, and the abnormal type labels correspondingly set by different service indexes can be different or the same. For example, the service index is the total frequency of resource transfer, and the exception type tag of the total frequency of resource transfer includes: a first exception type label for indicating that the total frequency of resource transfer is greater, such as indicated by "1", and a second exception type label for indicating that the total frequency of resource transfer is less, such as indicated by "-1"; the service index is the message sending quantity, and the abnormal type label of the message sending quantity comprises: the message sending method comprises a first exception type label for indicating larger message sending quantity and a second exception type label for indicating smaller message sending quantity. In addition to the abnormal type tag, there may be a normal type tag indicating that the service index is normal, for example, indicated by "0".

5. The relevance degree is as follows: and may also be referred to as importance, which is used to indicate the degree of correlation between two data, and for convenience of description, the association between the target business data and the abnormal business index is referred to as a target association in this application.

6. Cloud technology (Cloud technology): based on the general names of network technology, information technology, integration technology, management platform technology, application technology and the like applied in the cloud computing business model, a resource pool can be formed and used as required, and the cloud computing business model is flexible and convenient. Cloud computing technology will become an important support. Background services of the technical network system require a large amount of computing and storage resources, such as video websites, picture-like websites and more web portals. With the high development and application of the internet industry, each article may have its own identification mark and needs to be transmitted to a background system for logic processing, data in different levels are processed separately, and various industrial data need strong system background support and can only be realized through cloud computing.

7. Cloud computing (cloud computing): the method is a computing mode, and distributes computing tasks on a resource pool formed by a large number of computers, so that various application systems can acquire computing power, storage space and information services according to needs. The network that provides the resources is referred to as the "cloud". Resources in the "cloud" appear to the user as if they are infinitely expandable and can be acquired at any time, used on demand, expanded at any time, and paid for use.

8. Artificial Intelligence (AI): the method is a theory, method, technology and application system for simulating, extending and expanding human intelligence by using a digital computer or a machine controlled by the digital computer, sensing the environment, acquiring knowledge and obtaining the best result by using the knowledge. In other words, artificial intelligence is a comprehensive technique of computer science that attempts to understand the essence of intelligence and produce a new intelligent machine that can react in a manner similar to human intelligence. Artificial intelligence is the research of the design principle and the realization method of various intelligent machines, so that the machines have the functions of perception, reasoning and decision making.

The artificial intelligence technology is a comprehensive subject and relates to the field of extensive technology, namely the technology of a hardware level and the technology of a software level. The artificial intelligence infrastructure generally includes technologies such as sensors, dedicated artificial intelligence chips, cloud computing, distributed storage, big data processing technologies, operation/interaction systems, mechatronics, and the like. The artificial intelligence software technology mainly comprises a computer vision technology, a voice processing technology, a natural language processing technology, machine learning/deep learning and the like.

9. Computer Vision technology (Computer Vision, CV): computer vision is a science for researching how to make a machine look, and in particular, it is a science for using a camera and a computer to replace human eyes to make machine vision of identifying, tracking and measuring target, and further making image processing, so that the computer processing becomes an image more suitable for human eyes observation or transmitting to an instrument for detection. As a scientific discipline, computer vision research-related theories and techniques attempt to build artificial intelligence systems that can capture information from images or multidimensional data. Computer vision technologies generally include image processing, image recognition, image semantic understanding, image retrieval, OCR, video processing, video semantic understanding, video content/behavior recognition, three-dimensional object reconstruction, 3D technologies, virtual reality, augmented reality, synchronous positioning, map construction, and other technologies, and also include common biometric technologies such as face recognition and fingerprint recognition.

10. Machine Learning (ML): the method is a multi-field cross discipline and relates to a plurality of disciplines such as probability theory, statistics, approximation theory, convex analysis, algorithm complexity theory and the like. The special research on how a computer simulates or realizes the learning behavior of human beings so as to acquire new knowledge or skills and reorganize the existing knowledge structure to continuously improve the performance of the computer. Machine learning is the core of artificial intelligence, is the fundamental approach for computers to have intelligence, and is applied to all fields of artificial intelligence. Machine learning and deep learning generally include techniques such as artificial neural networks, belief networks, reinforcement learning, transfer learning, inductive learning, and formal education learning.

It should be noted that "a plurality" in the embodiments of the present application means two or more, "at least one" means one or more.

At present, the reason for generating the abnormity of the business index is analyzed based on experience, the mode may ignore the existence of certain business data, and the reason for the abnormity may be subjectively determined as certain business data, so that the analyzed reason for the abnormity is inaccurate and has poor referential performance.

In view of this, embodiments of the present application provide a method, an apparatus, a device, and a medium for detecting a cause of a business index abnormality, and a design idea of the method for detecting a cause of a business index abnormality is introduced as follows:

in the method, when the business index of the target business is abnormal, a plurality of business data related to the target business can be obtained, the correlation degree between the plurality of business data and the abnormal business index is analyzed, the abnormal reason of the abnormal business index is analyzed according to each analyzed correlation degree, and the reason of the abnormal business index abnormality can be accurately analyzed due to the fact that the correlation degree between each business data and the abnormal business index is analyzed in real time. And when the abnormal reason of the business index is analyzed, the business data belonging to the same business period with the business index is selected for analysis, so that the synchronization of the business index and the business data in a time period can be ensured, and the referential of the analyzed abnormal reason is improved. Moreover, the method can automatically analyze the abnormal reasons of the service indexes without manual intervention, thereby improving the detection efficiency.

The preferred embodiments of the present application will be described below with reference to the accompanying drawings of the specification, it should be understood that the preferred embodiments described herein are merely for illustrating and explaining the present application, and are not intended to limit the present application, and that the embodiments and features of the embodiments in the present application may be combined with each other without conflict.

As shown in fig. 1A, which is a first application scenario schematic diagram in the embodiment of the present application, the first application scenario schematic diagram includes: a first terminal 110, a first software program 111 running in the first terminal 110, a first server 120 and a database 130. The first terminal 110 and the first server 120 may communicate with each other through a communication network, such as a wireless communication network or a wired communication network. In fig. 1A, two first terminals 110 are taken as an example, and the number of the first terminals is not limited in practice.

The first server 120 may be a backend server corresponding to the first software program 111, where the first software program 111 generally refers to various applications providing business services, such as payment applications, instant messaging applications, and the like, and the form of the first software program 111 is, for example: an application program preinstalled in the first terminal 110, a web version of a software program, or a software program (e.g., applet) embedded in a third party application, etc.

A user may perform a corresponding service operation through the first software program 111, and the first server 120 may record service data corresponding to the service operation according to the service operation. For example, the first software program 111 is a payment-type application, the user initiates a resource transfer operation through the first software program 111, and the first server 120 records a resource transfer record in the payment process according to the resource transfer operation. By analogy, the first server 120 may write the plurality of service data into the database 130 after obtaining the plurality of service data.

When the first server 120 determines that the service index corresponding to the target service is abnormal in the current service period, the first server 120 may obtain multiple service data associated with the target service from the database 130. The first server 120 may analyze the cause of the abnormal business index according to a plurality of business data, wherein a process related to analyzing the cause of the abnormal business index will be described below.

As shown in fig. 1B, it is an application scenario diagram ii of the embodiment of the present application, and the application scenario diagram includes: a first terminal 110, a first software program 111 running in the first terminal 110, a first server 120, a database 130, a second terminal 140, a second software program 141 running in the second terminal 140, and a second server 150.

The second server 150 may be a background server corresponding to the first software program 111, and the second server 150 may record corresponding service data according to a service operation performed by a user on the first software program 111. The content of the first software program 111 can refer to the content discussed above, and is not described here.

The first server 120 may be a backend server corresponding to the second software program 141. The second software program 141, for example: for the service indicator detection application, the specific form of the second software program 141 may refer to the specific form of the first software program 111, and is not described herein again. For example, the first server 120 may analyze the corresponding service index according to the detection operation of the service index performed by the worker on the second software program 141, when analyzing the service index, the first server 120 may obtain the corresponding service data from the second server 150, and the first server 120 may analyze the obtained cause of the abnormality of the service index according to the corresponding service data.

In one possible application scenario, the first server 120 may be configured to analyze a cause of the abnormal service index of the resource transfer service. First server 120 can also be applied to in virtual reality, augmented reality, unmanned, intelligent furniture, intelligent official working, intelligence are dressed, intelligent transportation, in the all kinds of application scenarios that relate to such as smart city, unmanned aerial vehicle, robot, this application does not restrict first server 120's specific use scenario.

In one possible application scenario, in order to reduce communication latency between the devices, the first server 120 and the second server 150 may each deploy servers in different regions. Or for load balancing, the first server 120 and the second server 150 may each be respectively served by different servers. The following description takes the first server 120 to respectively deploy multiple servers as an example:

the data sharing can be realized by a plurality of servers through the block chain, which is equivalent to a data sharing system. For example, a terminal is located at a site a and is in communication connection with one server, and another terminal is located at a site b and is in communication connection with a server other than the one server among the plurality of servers.

Each server in the data sharing system has a node identifier corresponding to the server, and each server in the data sharing system can store node identifiers of other servers in the data sharing system, so that the generated blocks are broadcast to the other servers in the data sharing system according to the node identifiers of the other servers. Each server may maintain a node identifier list as shown in the following table, and store the server name and the node identifier in the node identifier list correspondingly. The node identifier may be an Internet Protocol (IP) address and any other information that can be used to identify the node, and only the IP address is used as an example in table 1.

TABLE 1

Server name	Node identification
		Node
1	119.115.151.174
		Node 2	118.116.189.145
…	…
		Node N	119.124.789.258

The terminal is an electronic device used by a user, and the electronic device may be a computer device which has certain computing capability and runs instant messaging software and a website or social contact software and a website, such as a smart phone, a tablet computer, a notebook computer, a desktop computer, a smart sound box, a smart watch, a game device, a smart television or a smart wearable device. The first server 120 and the second server 150 may be independent physical servers, may also be a server cluster or a distributed system formed by a plurality of physical servers, and may also be cloud servers providing basic cloud computing services such as cloud service, a cloud database, cloud computing, a cloud function, cloud storage, network service, cloud communication, middleware service, domain name service, security service, content Delivery Network (CDN), big data, an artificial intelligence platform, and the like. Optionally, the first server 120 and the second server 150 may be implemented by cloud computing.

Based on the application scenarios discussed in fig. 1A to fig. 1B, the method for detecting a cause of a service indicator abnormality in the embodiment of the present application is described below by taking the first server as an example to execute the method for detecting a cause of a service indicator abnormality in the embodiment of the present application.

Please refer to fig. 2, which is a flowchart illustrating a method for detecting a cause of an abnormal service indicator according to an embodiment of the present application, where the flowchart includes:

s21, obtaining an abnormal service index of the target service in the current service period, wherein the abnormal service index refers to: the change rate between the current service period and the last service period meets the service index of the preset change rate condition.

The target service generally refers to a service used for detecting a service index, and may be any type of service, for example, one or more of a payment service, an instant messaging service, or a content service. The first server may periodically detect various service indexes corresponding to the target service, and service periods corresponding to any two service indexes may be the same or different. After the first server obtains the service index of the target service in the current period, whether the service index is abnormal or not can be judged.

For example, the first server may determine whether the service indicator is an abnormal service indicator by determining whether a change rate of the service indicator satisfies a preset change rate condition.

For example, the first server may calculate a change rate between the service index in the current period and the service index in the previous service period according to the value of the service index in the current period and the service index in the previous service period, where a calculation formula for calculating the change rate is as follows:

wherein c represents the change rate, a represents the service index in the current period, and b represents the service index in the last service period.

After the first server determines the rate of change, the first server may determine whether the rate of change satisfies a preset rate of change condition, such as: the rate of change is greater than a first predetermined rate of change, or the rate of change is less than a second predetermined rate of change. The second preset change rate is smaller than the first preset change rate, values of the first preset change rates corresponding to different service indexes may be different, and values of the second preset change rates corresponding to different service indexes may also be different. If the change rate of a certain service index meets the preset change rate condition, the fluctuation of the service index is large, and therefore the first server can determine the service index in the current service period as an abnormal service index.

It should be noted that, a target service may correspond to multiple service indexes, so that the first server may detect multiple abnormal service indexes in the current service period, and the first server may perform abnormality cause detection for each abnormal service index.

For example, the target service is an instant messaging service, the service index is a total number of instant messaging messages, the first server detects that the total number of instant messaging messages of a previous service period is 200 times, detects that the total number of instant messaging messages in a current service period is 300 times, and determines that the change rate is:

and if the first preset change rate is 0.3, the first server determines that the change rate is greater than the first preset change rate, so that the total quantity of the instant messaging messages in the current period is determined as the abnormal service index.

S22, acquiring a plurality of items of target service data associated with the target service in the current service period.

After determining that the service index is an abnormal service index, the first server may acquire a plurality of items of target service data associated with the target service in the current service period. For example, the first server may store data items of multiple items of target service data associated with the target service in advance, and when it is determined that the target service has an abnormal service index, the first server may obtain the target service data corresponding to the multiple items of data items from the database, or the first server may obtain the target service data corresponding to the multiple items of data items from the second server.

Continuing to take the target service as an example of the instant messaging service, the first server may obtain multiple items of target service data associated with the total number of the instant messaging messages, where the multiple items of target service data are shown in table 2 below:

TABLE 2

Data item corresponding to target service data	Target business data
		Number of instant messaging messages sent by user a	10 times of
Number of instant messaging messages sent by user B	20 times (twice)
		Device with highest frequency for instant communication messages sent by user A	Personal computer
Device with highest frequency of instant communication messages sent by user B	Mobile phone
		User A's place with the highest frequency of sending instant messaging messages	China
User B's place where instant messaging messages are sent most frequently	Switzerland

And S23, respectively determining the target association degrees between the plurality of items of target service data and the abnormal service indexes.

After the first server obtains multiple items of target service data, a target association degree between each item of target service data and the abnormal service index can be respectively determined, the target association degree actually represents the correlation between the target service data and the abnormal service index, and the influence degree of the target service data on the abnormal service index can be further understood.

For example, after obtaining multiple items of target service data, the first server may determine a target association degree between each item of target service data and an abnormal service index, where for example, the target association degree between each item of target service data and the abnormal service index is specifically shown in table 3 below:

TABLE 3

As shown in table 3, for example, the first server determines that the target association degrees corresponding to the abnormal service indicator and each of the number of instant messaging messages sent by the user a, the number of instant messaging messages sent by the user B, the device with the highest frequency of instant messaging messages sent by the user a, the device with the highest frequency of instant messaging messages sent by the user B, the location with the highest frequency of instant messaging messages sent by the user a, and the location with the highest frequency of instant messaging messages sent by the user B are respectively: 0.10, 0.34, 0.12, 0.30, 0.18 and 0.30.

And S24, determining an abnormal reason corresponding to the abnormal business index based on the target business data with the target relevance meeting the preset relevance condition.

After the first server determines the target relevance between the multiple items of target service data and the abnormal service index, the abnormal reason for the abnormal service index being abnormal can be analyzed according to the determined multiple target relevance.

For example, the first server determines at least one item of target service data whose target relevance is greater than or equal to a relevance threshold, where a larger target relevance between the at least one item of target service data and the abnormal service index indicates that the target service data is more likely to be a cause of an abnormality of the abnormal service index, so that the first server may determine the at least one item of target service data as an abnormality cause of the abnormality of the abnormal service index.

For example, continuing with the example in table 3, after determining the target association degrees between the multiple items of target service data and the abnormal service indicator, the first server determines that the association degree between the number of instant messaging messages sent by the user B and the abnormal service indicator is the largest, so that the number of instant messaging messages sent by the user B can be determined as the abnormal reason of the abnormal service indicator.

In the embodiment shown in fig. 2, after determining that the service index is an abnormal service index, the first server may analyze and determine the relationship between multiple items of target service data and the abnormal service index in real time, thereby determining the cause of the abnormality of the abnormal service index, implementing a method for automatically analyzing the abnormal service index, improving the efficiency of analyzing the cause of the abnormality of the service index, and analyzing the multiple items of target service data in combination with the target service, thereby accurately analyzing the cause of the abnormality of the service index. In addition, the first server analyzes the relationship between the target business data and the abnormal business index in the same time period, so that the time synchronization of the target business data and the business index is ensured, and the referential performance of the analyzed abnormal reason is improved.

In the following, a manner of determining the target association degree in S23 is described as an example, taking the determination of the target association degree between the project mark service data and the abnormal service index as an example:

determining a first target relevance degree mode:

respectively calculating correlation coefficients between the target service data and the abnormal service indexes;

and respectively taking the calculated correlation coefficients as the target association degrees between the corresponding target service data and the abnormal service indexes.

For example, the first server may calculate a correlation coefficient between the target traffic data and the abnormal traffic indicator according to a first variance of the target traffic data and a second variance corresponding to the abnormal traffic indicator.

The first server may divide the current service period into a plurality of sub-service periods, for example, the current service period is one day, and the plurality of sub-service periods may be 24 hours in one day respectively. The first server determines a first variance corresponding to each project mark service data in a plurality of sub-service periods, and determines a second variance corresponding to the abnormal service index. The first server may calculate a correlation coefficient between the target traffic data and the abnormal traffic index according to the first variance, the second variance, the abnormal traffic index and the corresponding target traffic data, and an example of a formula for calculating the correlation coefficient is as follows:

wherein, X _i The ith project mark service data in the current service period is represented, Y represents the abnormal service index in the current service period,

representing the correlation coefficient between the ith project mark service data and the abnormal service index, var (X) _i ) And representing a first variance corresponding to the target service data, and var (Y) representing a second variance corresponding to the abnormal service index.

By analogy, the first server can calculate the target association degree between the plurality of items of target service data and the abnormal service index.

In the first method for determining the target association degree, the correlation coefficient actually indicates the degree of correlation between the variation trend of the abnormal business index and the variation trend of the target business data, and the larger the correlation coefficient between the target business data and the abnormal business index is, the more likely the abnormal business index is affected by the target business data, that is, the greater the correlation between the target business data and the abnormal business index is, therefore, in the embodiment of the present application, the correlation coefficient is used to indicate the association degree between the abnormal business index and the target business data, and the relationship between the target business data and the business index can be accurately reflected. In addition, in the first mode of determining the target relevance, a mode of quantizing the relevance between the target business data and the abnormal business index is provided.

Determining a second target relevance degree mode:

s1.2, extracting the characteristics of the target service data to obtain the target service characteristics;

and S2.2, determining the target association degree between the target service characteristics and the abnormal service indexes.

The first server may perform feature extraction on the target business data, so as to obtain deeper or more standard target business features, where the target business features reflect corresponding features of the target business data in some dimensions, and a specific manner of feature extraction includes one or more of the following:

(1) And (4) Binning (Binning) treatment: the binning refers to segmenting data along a time dimension, for example, the first server may divide the total resource transfer frequency in one day into the total resource transfer frequency corresponding to each hour in 24 hours.

(2) One-Hot Encoding (One-Hot Encoding): for transcoding data to convert to a string that the first server can directly recognize, for example, if the target service data is a resource transfer frequent site: china, the Chinese character can be coded by single heat to obtain the character string form characteristics.

(3) And (2) carrying out characteristic hash (Hashing) processing: in a vectorization manner, for example, target service data in a text form may be converted into a hash vector.

(4) Embedding (embedding) processing: for mapping the target service data in text form into a vector, for example, if the target service data is in text form, the first server may perform embedded learning on the target service data, so as to convert the target service data into a corresponding vector.

(5) Log (Log Transformation) processing: for logarithm data to reduce the amount of data computation, for example, the logarithm may be taken for the target traffic data.

(6) Scaling (Scaling) processing: and carrying out scaling processing on the target service data so as to facilitate subsequent calculation.

(7) Normalization (Normalization) treatment: the values of all the data are controlled within a preset range, and the occurrence of overlarge or undersize target service data is avoided, for example, the target service data is subjected to standardized processing.

(8) Feature Interaction (Feature Interaction): the data with intersection is subjected to combined processing, for example, the resource transfer frequency of the user a today is 1, the resource transfer number is 100, and the resource transfer frequency and the resource transfer number can be subjected to combined analysis.

After the first server obtains the target service characteristic, the first server may calculate a cosine similarity between the target service characteristic and the abnormal service index, and determine the cosine similarity as a target association between the target service characteristic and the abnormal service index. The first server can also determine a target association degree between the target business features and the abnormal business indexes through the trained target tree classification model.

The following describes an example process of determining a target association degree between a target service feature and an abnormal service index through a trained target tree classification model, with reference to a flowchart of a method for determining a target association degree shown in fig. 3:

and S31, determining the abnormal type label of the abnormal service index according to the change rate.

The first server may calculate a change rate of the service indicator in the current service period, and the manner of calculating the change rate may refer to the content discussed above, which is not described herein again, and determine whether the service indicator is an abnormal service indicator according to the change rate. If the service index is determined to be an abnormal service index, the first server can also determine an abnormal type label to which the abnormal service index belongs. The meaning of the exception type tag can refer to the content discussed above and will not be described herein. The following describes an exemplary manner for determining an abnormal type tag to which an abnormal service indicator belongs:

if the change rate is greater than a first preset change rate, the first server may determine that the abnormal type tag of the abnormal service indicator is a first abnormal type tag; and if the change rate is smaller than the second preset change rate, determining that the abnormal type label of the abnormal service index is a second abnormal type label. The meaning of the first exception type tag and the second exception type tag may refer to the content discussed above, and will not be described herein.

For example, the first server determines that the change rate of the abnormal service indicator is greater than 5%, determines that the abnormal type tag of the abnormal service indicator is a first abnormal type tag, where the first abnormal type tag may be represented as "1"; the first server determines that the change rate of the abnormal service index is less than-5%, and the first server may determine that the abnormal type tag is a second abnormal type tag, where the second abnormal type tag may be denoted as "-1".

And S32, inputting each target service characteristic and the abnormal type label to which the abnormal service index belongs into the trained target tree classification model, and respectively obtaining the first prediction association degree of each target service characteristic and the abnormal type label.

The first server can input each target service characteristic and the abnormal type label corresponding to the abnormal service index into the target tree classification model, so that the first prediction association degree of each target service characteristic and the abnormal type label is obtained.

Illustratively, the trained target tree classification model is obtained by training according to training data, the training data includes a sample abnormal type label corresponding to a sample service index in a historical service period, sample service characteristics of multiple items of sample service data associated with a target service in the historical service period, and respective true association degrees of the multiple items of sample service data, and the sample service index and the abnormal service index are actually the same service index. The historical service period is a service period before the current service period, and the historical service period can be one or more.

For example, one type of training data may be found in table 4 below:

TABLE 4

Referring to table 4, the training data includes a sample abnormal type label (specifically 1) corresponding to a sample service index of a first historical service period (specifically 2021-3-1), sample service features a1, b1 and C1 corresponding to target service data A, B and C, and true association degrees corresponding to the sample service features a1, b1 and C1 respectively: 1,0 and 1. The real association degree is "1" to indicate that the target service data is one of the causes of abnormal service index abnormality, and the real association degree is "0" to indicate that the target service data is irrelevant to abnormal service index abnormality.

The training data further includes a sample abnormal type label (specifically-1) corresponding to a sample service index of a second historical service period (specifically 2021-3-2), sample service features a2, sample service features b2 and sample service features C2 corresponding to target service data A, B and C, and true relevance degrees corresponding to the sample service features a2, the sample service features b2 and the sample service features C2 respectively: 0,1 and 1.

And S33, respectively taking the obtained first prediction association degrees of each target service characteristic and the abnormal type label as the target association degrees between the corresponding target service characteristic and the abnormal service index.

The target tree classification model may output first prediction relevance degrees corresponding to multiple pieces of service data, so that the first server may obtain each first prediction relevance degree, and the first server may use each first prediction relevance degree as a target relevance degree between a corresponding target service feature and an abnormal service index.

In the embodiment of the application, the first server can quickly obtain the target association degree between the target service characteristics and the abnormal service indexes through the target tree classification model, and the target tree classification model is obtained by training based on related data in a historical service period, that is, the target tree classification model deeply learns the relationship between the abnormal service indexes and the target service characteristics in the historical service period, so that the target association degree can be accurately obtained, and the reason for generating the abnormality of the abnormal service indexes can be conveniently and accurately analyzed subsequently.

As an embodiment, the first server may pre-store a trained tree classification model corresponding to each service index, and before the first server performs S32, a target tree classification model matching an abnormal service index may be determined from a plurality of tree classification models corresponding to a plurality of service indexes.

And two sample service indexes corresponding to any two of the trained tree classification models are different service indexes corresponding to the target service. Each trained tree classification model is obtained by training according to a sample abnormal type label corresponding to a corresponding sample service index in a historical service period, sample service characteristics of multiple items of sample service data associated with the target service in the historical service period, and real association degrees of the multiple items of sample service data. After determining the abnormal service index, the first server may determine, according to the abnormal service index, a target tree classification model matched with the abnormal service index from the trained multiple tree classification models.

For example, the first server prestores a correspondence between the service index shown in table 5 below and the trained tree classification model:

TABLE 5

Service index	Trained tree classification model
		Service index
1	Tree classification model 1
		Service index 2	Tree classification model 2
Service index 3	Tree classification model 3

For example, referring to the example shown in table 5, the abnormal service indicator is service indicator 3, so the first server can obtain the trained tree classification model matched with the abnormal service indicator from table 5 as tree classification model 3.

The trained target tree classification model may be trained by the first server or obtained from other devices, which is not limited in this application. In the following, taking the first server training the target tree classification model as an example, and referring to the flowchart of the method for training the target tree classification model shown in fig. 4, an example of the training process of the target tree classification model is described:

s41, performing multiple rounds of iterative training based on training data, wherein each round of iterative training comprises the following steps:

s411, fitting a residual error of the previous iteration training according to the second prediction relevance of the multiple items of sample service data output by the classifier of the previous iteration training and the real relevance of the multiple items of sample service data;

as an example, the tree classification model may take any form of classification model, such as: random forests, gradient Boosting Decision Tree (GBDT) models, or other Decision trees, etc.

When performing iterative training based on training data, the related data in one historical service period may be regarded as one sample, for example, with continued reference to table 5 above, the first server may regard the sample anomaly type label, the sample service feature, and the true association degree corresponding to 2021-3-1 in table 5 above as one sample; the first server may also regard the related data of one user as one sample, for example, continuing with table 5 above as an example, the sample service feature a1 is obtained according to the target service data corresponding to the user a, the sample service feature B1 is obtained according to the target service data corresponding to the user B, and the first server may regard the sample service feature a1 and the sample service feature B1 as two samples, respectively.

During the first round of iterative training, the service characteristics of the multiple samples and the corresponding abnormal service labels can be input into a preset logic function, the output of the preset logic function is obtained, and the output of the preset logic function is used as the second prediction association degree of the service data of the multiple samples. The predetermined logic function can be regarded as a root node of a decision tree in the tree classification model.

And during the second round or the subsequent round of iterative training, the first server obtains respective second prediction relevance of the multiple items of sample service data output by the classifier of the previous round of iterative training, and determines the residual error of the previous round of iterative training based on the respective second prediction relevance and the respective real relevance.

S412, fitting the classifier of the iterative training of the current round based on the residual error;

the first server can use the residual error as the real association degree corresponding to the iterative training of the current round, so as to fit the classifier of the iterative training of the current round, wherein the fitted classifier is equivalent to a decision tree in the GBDT model.

If the preset depth of each decision tree is 2, a leaf node is directly fitted according to the residual error, so that the decision tree is obtained. If the preset depth of each decision tree is greater than 2, the first server may continue to split on the basis of the fitted leaf nodes until a preset number of leaf node positions are split.

When splitting is performed on a leaf node, the first server may use each sample service feature as a splitting point, respectively calculate the mean square loss of the left and right groups of data after splitting, determine the mean square loss of the left and right groups of data and the minimum sample service feature as the splitting point, and implement the process of splitting the leaf node. By analogy, splitting to obtain a decision tree meeting the preset depth.

S413, inputting a sample abnormal type label corresponding to the sample service index in the historical service period and sample service characteristics corresponding to multiple items of sample service data associated with the target service in the historical service period into a classifier of the iterative training to obtain a second prediction association degree of the multiple items of sample service data corresponding to the iterative training;

similarly, after the classifier of the iteration training of the current round is fitted, the sample abnormal type label corresponding to the sample service index in the historical service period and the sample service characteristics corresponding to the multiple items of sample service data associated with the target service in the historical service period can be input into the classifier of the iteration training of the current round, so as to obtain the second predicted association degree of the multiple items of sample service data corresponding to the classifier of the iteration training of the current round, and the classifier in the next iteration training process is fitted according to the second predicted association degree output by the classifier of the iteration training of the current round, and so on.

And S42, connecting a plurality of classifiers obtained by the multi-round iterative training to obtain a trained target tree classification model.

The first server can be connected with a plurality of classifiers obtained by a plurality of rounds of iterative training, so as to obtain a trained target tree classification model.

Because there may be data omission or data non-specification in the multiple items of service data, the first server may pre-process the multiple items of service data before performing S41, and the following process of pre-processing the service data is described:

s2.1, the first server obtains a plurality of sample service data of the sample service indexes in the historical service period, abnormal type labels corresponding to the sample service indexes and importance between each sample service data and each sample service index.

The first server may obtain multiple items of sample service data from the database, and may also obtain multiple items of sample service data from the second server, which is not limited in this application.

S2.2, the first server respectively extracts the characteristics of the plurality of sample service data in the historical service period to obtain the characteristics of each sample service.

The way of feature extraction includes: one or more of interpolation processing, binning processing, one-hot encoding, embedding processing, scaling processing, logarithmic processing, normalization processing, feature interaction. The interpolation process may be, for example, a linear interpolation or a nonlinear interpolation method, and may supplement a missing value that may be included in the per-project service data by the interpolation process. The processing manners of binning, unique hot coding, embedding, scaling, logarithm, normalization and feature interaction may refer to the contents discussed above, and are not described herein again.

As an embodiment, the training data may further include a normal service label corresponding to the sample service index in the historical service period, and sample service features corresponding to the multiple items of sample service data corresponding to the historical service period, where the normal service label may be represented as "0". The sample service index in this embodiment and the abnormal service index discussed above belong to the same service index, and the normal service label corresponding to the sample service index refers to a service index whose change rate in the previous historical service period does not satisfy the preset change rate condition, for example, the change rate is greater than the second preset change rate and less than the first preset change rate.

In the embodiment of the application, the training data can further include normal service labels corresponding to the sample service indexes, so that the training data can be enriched to avoid the overfitting condition of the tree classification model.

The following describes an example of the manner of determining the second prediction relevance in S413 by taking calculating the second prediction relevance corresponding to one item of sample service data as an example:

s3.1, calculating Gini corresponding to a certain node.

The calculation formula of Gini corresponding to the node m is exemplified as follows:

where K denotes K classes, e.g. training data comprising the firstWhen the business abnormal label and the sample corresponding to the second business abnormal label, the value of K is 2,p _mk The ratio of the class k in the node m is expressed, and it can also be understood that two samples are randomly extracted from the node m, and the probability that the corresponding class labels are inconsistent is obtained. Node m is a node on the decision tree in the GBDT model.

S3.2, calculating the importance of the sample service characteristics XjXj on a certain node.

The importance of the sample service feature XjXj in the node m can be expressed as a weighted impure reduction, and an example of a formula for calculating the importance of the sample service feature XjXj on a certain node is as follows:

GIl and GIr denote Gini indexes corresponding to the left child node l and the right child node r respectively after the node m is split, and Nm, nl and Nr denote the number of samples corresponding to the node m, the left child node l and the right child node r respectively.

And S3.3, calculating the importance of the sample service characteristics XjXj on the decision tree.

The sample traffic feature XjXj belongs to a certain node in the ith decision tree in the GBDT model, the ith decision tree corresponds to an M set, the M set includes each node in the ith decision data, and then the importance of the sample traffic feature XjXj in the ith decision tree can be represented as:

VIM _ij ＝∑ _m∈M VIM _jm

wherein, VIM _ij For the importance of the sample service features XjXj on the ith decision tree, VIM _jm Representing the importance of the sample traffic characteristics XjXj at node m in the ith decision tree.

S3.4, calculating the importance of the sample service features on the GBDT model:

wherein, VIM _j And representing the importance of the sample traffic characteristics on the GBDT model, namely the prediction relevance, and n represents the number of decision trees in the GBDT model.

For example, referring to the example diagram of the division of the decision tree in the GBDT model shown in fig. 5, gini of a first node corresponding to the sample traffic characteristic A3 on the GBDT model is 0.48, the number of samples corresponding to the first node is 15, the number of classes is 2, the value is 6 to 9, gini of a second node corresponding to the sample traffic characteristic A2 on the GBDT model is 0.4444, the number of samples corresponding to the second node is 9, the number of classes is 2, and the value is 6 to 3. The following describes a process of calculating the importance of each sample service feature on the decision tree, with reference to fig. 5 as an example:

1. the first server calculates the importance of the sample service characteristics on the first node as follows:

G _A3 ＝0.48×15-0.4444×9-0＝3.20040.48×15-0.4444×9-0＝3.2004。

similarly, the first server calculates the importance of the sample service features on the first node as follows:

G _A2 ＝0.4444×9-0-0＝3.99960.4444×9-0-0＝3.9996。

it can be seen in conjunction with fig. 5 that the decision tree does not involve the sample traffic features A1 and A4, and therefore the importance of the sample traffic features A1 and A4 on the decision tree is 0.

2. The first server calculates the weighted impurity reduction of all nodes in the decision tree as: 3.2004+3.9996=7.33.2004+3.9996=7.3;

3. the first server performs normalization operation on the importance of each sample service feature on the decision tree, and the importance of A1, A2, A3, and A4 corresponding to the decision tree is respectively: 0. 0.55555556, 0.44444444 and 0.

After the first server obtains the target association degrees between each of the multiple items of service data and the abnormal service index values, the first server may screen out, from the multiple items of service data, target service data whose abnormal service index satisfies the association degree condition, and use the target service data satisfying the association degree condition as an abnormal cause of the abnormal service index, where the association degree condition is described in the following:

firstly, the method comprises the following steps: and the association degree condition is at least one item of target business data of which the target association degree is not less than the association degree threshold.

In specific implementation, the first server may screen out at least one item of target service data with a target association degree not less than an association degree threshold from the multiple items of target service data, and determine the screened at least one item of target service data as an abnormal cause corresponding to the abnormal service index.

The association threshold may be set as required, and in different service periods, the association thresholds corresponding to the abnormal service indicators may be different or the same, for example, in a first service period, the association threshold of the abnormal service indicator is 0.5, and in a second service period, the association threshold of the abnormal service indicator is 0.6. After the first server obtains the target relevance degrees corresponding to the multiple service data, the first server may screen out at least one item of target service data, of which the target relevance degree is not less than the relevance degree threshold, from the multiple service data, so as to determine that the reason why the abnormal service index generates the abnormality is the at least one item of target service data.

In this embodiment, the target service data may be screened according to the relevance threshold, and the target service data more related to the abnormal service index may be determined, so as to quickly determine the reason why the abnormal service index is abnormal in the current service period.

II, secondly, the method comprises the following steps: the association degree condition is that an order condition is satisfied.

The first server can sort the target relevance degrees from large to small, and takes the N project mark service data meeting the order conditions as abnormal reasons corresponding to the abnormal service indexes, wherein N is positive data. The order condition is, for example, the top N terms, and N is a positive integer.

After calculating the target association degree corresponding to each item of target service data in the plurality of items of target service data, the first server may sort the plurality of items of target service data in a descending order of the target association degrees, and screen out N items of target service data satisfying the order condition from the sorted plurality of items of target service data.

In the embodiment, the target relevance degrees are sorted, and the target service data meeting the order condition is screened as the abnormal reason corresponding to the abnormal service index, so that the target service data meeting the requirement can be rapidly screened out, and the reason of the abnormal service index generating abnormality is determined.

Based on the application scenario diagram shown in fig. 1B, the following describes, with reference to the example diagram of interaction between the first server and the second terminal shown in fig. 6, a method for detecting a cause of a service indicator anomaly in an embodiment of the present application:

s61, the first server obtains an abnormal service index of the target service in the current service period, wherein the abnormal service index refers to: the change rate between the current service period and the last service period meets the service index of the preset change rate condition.

The first server monitors various service indexes corresponding to the target service in real time and determines abnormal service indexes in the current service period.

S62, the first server sends the abnormal service index to the second terminal.

The first server can feed the abnormal service indexes back to the second terminal, and the second terminal can display each abnormal service index in real time, so that a user can know the abnormal service indexes in time.

For example, referring to the example diagram of detecting the interface change of the abnormal cause of the service indicator shown in fig. 7, the analysis of the abnormal service indicator in the current service period by the first server is specifically as follows: the first server sends the abnormal service index to the second terminal, and the second terminal displays an abnormal service index display interface as shown in (1) in fig. 7, where an abnormal service index 710, specifically, the total resource transfer frequency and the sending frequency of the instant messaging message, is displayed in the abnormal service index display interface.

And S63, the second terminal responds to the detection operation aiming at the abnormal service index and generates an abnormal detection request.

The user may perform a corresponding detection operation on the abnormal service indicator, where the detection operation is used to indicate that the abnormal service indicator is detected, for example, the user may click a corresponding detection control, or may perform the detection operation by using a voice assistant. And the second terminal generates an abnormal detection request according to the detection operation, wherein the abnormal detection request is used for requesting the abnormal reason analysis of the abnormal service index.

For example, with reference to the example of fig. 7, when the user views the abnormal service indicator, the user may perform a detection operation on the abnormal service indicator, for example, the second terminal may click on the total resource transfer frequency shown in (1) in fig. 7, which corresponds to performing the detection operation, and the second terminal generates an abnormal detection request according to the detection operation.

And S64, the second terminal sends the abnormity detection request to the first server.

S65, the first server acquires a plurality of items of target service data associated with the target service in the current service period.

The meaning of the multiple items of target service data and the manner of acquiring the multiple items of target service data may refer to the contents discussed above, and are not described herein again.

S66, the first server respectively determines the target association degree between each item of target business data and the abnormal business index.

The manner of determining the target association degree may refer to the content discussed above, and is not described herein again.

S67, the first server determines an abnormal reason corresponding to the abnormal business index based on the target business data of which the target relevance meets the preset relevance condition.

The method for determining the abnormal reason corresponding to the abnormal service indicator may refer to the content discussed above, and is not described herein again.

And S68, the first server sends the abnormal reason to the second terminal.

And S69, displaying the abnormal reason by the second terminal.

And the second terminal displays the abnormal reason of the abnormal service index so that the user can timely acquire the reason of the abnormal service index.

For example, with reference to the example of fig. 7, when the user views the abnormal service indicator, after the user clicks the sending frequency of the instant messaging message shown in (1) in fig. 7, the second terminal requests the first server to analyze the abnormal reason of the abnormal service indicator according to the click operation, and after obtaining the abnormal reason analyzed by the first server, the second terminal displays the abnormal reason 720 shown in (2) in fig. 7, where the abnormal reason includes: the number of registered new users increases and the message transmission frequency of the user a is high.

The method for detecting the cause of the abnormal service indicator according to the embodiment of the present application is described below with reference to the flowchart of the method for detecting the cause of the abnormal service indicator shown in fig. 8A, by taking the method for detecting the cause of the abnormal service indicator executed by the first server as an example, and taking the target service as the resource transfer service as an example:

s81, obtaining the abnormal service index of the resource transfer service in the current service period.

For example, the first server determines the total number of resource transfers in the current traffic cycle as an abnormal traffic indicator.

Further, the first server may send the abnormal service indicator to the second terminal, so as to facilitate a second display of the abnormal service indicator.

For example, referring to fig. 8B, which is an exemplary diagram of detecting an interface change in a process of detecting a cause of an abnormal service indicator, after receiving the abnormal service indicator, the second terminal may display an abnormal service indicator 810 as shown in (1) in fig. 8B, specifically, the total amount of resource transfer as shown in (1) in fig. 8B.

S82, acquiring a plurality of items of target service data associated with the resource transfer service in the current service period.

The first server obtains multiple service data, and the multiple service data associated with the resource transfer service are specifically shown in table 6 below:

TABLE 6

Data item corresponding to target service data	Target business data
		Resource transfer times of user C	20 times (twice)
Resource transfer times of user D	30 times (twice)
		Number of resource transfers for user C	2000 yuan
Resource transfer amount of user D	10000 yuan
		User C's place with the highest resource transfer frequency	China
User D's place with the highest frequency of resource transfer	France

The service data items in table 6 specifically include: the resource transfer number, the resource transfer frequency, the location with the highest resource transfer frequency and the like corresponding to each user in the current service period are taken as examples in table 6, and the number of users is not limited actually.

S83, respectively determining the target association degree between the multiple items of target service data and the abnormal service indexes.

The manner of determining the target association degree may refer to the content discussed above, and is not described herein again. Continuing with the example shown in table 6, the first server determines the target association degrees between the respective target service data and the abnormal service indicator as shown in table 7 below:

TABLE 7

Referring to table 7 above, the target association degrees of the abnormal service index with the resource transfer frequency of user C, the resource transfer frequency of user D, the resource transfer number of user C, the resource transfer number of user D, the location with the highest resource transfer frequency of user C, and the location with the highest resource transfer frequency of user D are respectively: 0.12, 0.38, 0.35, 0.70, 0.1 and 0.02.

And S84, determining an abnormal reason corresponding to the abnormal business index based on the target business data with the target relevance meeting the preset relevance condition.

For example, the first server determines the resource transfer amount of a certain user in the current service period, and the target association degree between the resource transfer amount and the abnormal service index is relatively high, so that the resource transfer amount of the user in the current service period can be determined as the abnormal reason corresponding to the abnormal service index.

Continuing with the example shown in table 7, the first server may sort according to the target relevance degrees from large to small, and select the target service data corresponding to two target relevance degrees in the order before, specifically the resource transfer frequency of the user D and the resource transfer number of the user D, so that the first server determines the resource transfer frequency of the user D and the resource transfer number of the user D as the abnormal cause of the abnormal service index.

For example, continuing with the example shown in fig. 8B, the first server determines the reason for the abnormal service indicator to generate an abnormality, so as to display the abnormality reason 820 shown in (2) in fig. 8B, specifically, the resource transfer number of the user D and the resource transfer number of the user D shown in (2) in fig. 8B.

Based on the same inventive concept, an embodiment of the present application provides an apparatus for detecting a cause of an abnormal service indicator, where the apparatus can implement the function of the first server as discussed above, please refer to fig. 9, and the apparatus includes:

an abnormal service index obtaining module 901, configured to obtain an abnormal service index of a target service in a current service period, where the abnormal service index is: the change rate between the current service period and the last service period meets the service index of a preset change rate condition;

a service data acquiring module 902, configured to acquire multiple items of target service data associated with a target service in a current service period;

a relevance determining module 903, configured to determine target relevance between each of multiple items of target service data and the abnormal service index;

and an abnormal cause determining module 904, configured to determine an abnormal cause corresponding to the abnormal service index based on the target service data whose target relevance meets the preset relevance condition.

In a possible embodiment, the association degree determining module 903 is specifically configured to:

respectively extracting the characteristics of the multiple items of target service data to obtain target service characteristics corresponding to the multiple items of target service data;

inputting each target service characteristic and an abnormal type label to which an abnormal service index belongs into a trained target tree classification model, and respectively obtaining a first prediction association degree of each target service characteristic and the abnormal type label, wherein the trained target tree classification model is obtained by training based on training data, the training data comprises a sample abnormal type label corresponding to a sample service index in a historical service period, sample service characteristics corresponding to a plurality of sample service data associated with the target service in the historical service period, and respective real association degrees of the plurality of sample service data, and the sample service index and the abnormal service index are the same service index;

and respectively taking the obtained first prediction association degrees of each target service characteristic and the abnormal type label as the target association degrees between the corresponding target service characteristic and the abnormal service index.

if the change rate is larger than a first preset change rate, determining that an abnormal type label of the abnormal service index is a first abnormal type label, wherein the first abnormal type label is used for indicating that the service index is larger;

In one possible embodiment, the association determining module 903 is further configured to:

inputting each target service characteristic and an abnormal type label to which an abnormal service index belongs into a trained target tree classification model, and determining a target tree classification model matched with the abnormal service index from a plurality of trained tree classification models before respectively obtaining the prediction association degree of each target service characteristic and the abnormal type label;

each of the trained tree classification models is obtained by training according to a sample abnormal type label corresponding to a corresponding sample service index in a historical service period, sample service characteristics of multiple items of sample service data associated with a target service in the historical service period, and real association degrees of the multiple items of sample service data, wherein sample service indexes corresponding to any two of the trained tree classification models are different service indexes corresponding to the target service.

In one possible embodiment, the trained target tree classification model is trained as follows:

performing multiple rounds of iterative training based on a sample abnormal type label corresponding to a sample service index in a historical service period, sample service characteristics corresponding to multiple items of sample service data associated with a target service in the historical service period, and respective real association degrees of the multiple items of sample service data, wherein each round of iterative training comprises:

a sample abnormal type label corresponding to the sample service index in the historical service period, an

Inputting sample service characteristics corresponding to a plurality of sample service data associated with the target service in a historical service period into a classifier of the iterative training to obtain second prediction association degrees of the plurality of sample service data corresponding to the iterative training;

In a possible embodiment, the abnormality cause determining module 904 is specifically configured to any one of the following:

and sequencing the obtained target relevance degrees from large to small according to the value, and taking N project mark service data meeting the sequence condition as an abnormal reason corresponding to the abnormal service index, wherein N is a positive integer.

In a possible embodiment, the target service is a resource transfer service, and the plurality of target service data are service data generated in the resource transfer process.

It should be noted that the apparatus shown in fig. 9 may also implement any one of the methods for detecting a cause of a service indicator abnormality discussed above, and details are not described here.

Based on the same inventive concept, the embodiment of the present application provides a computer device, which can implement the functions of the first server discussed above, please refer to fig. 10, which is a schematic structural diagram of the computer device provided in the embodiment of the present application, and the computer device includes a processor 1001 and a memory 1002.

The processor 1001 may be a Central Processing Unit (CPU), or a digital processing unit, etc. The specific connection medium between the memory 1002 and the processor 1001 is not limited in the embodiment of the present application. In the embodiment of the present application, the memory 1002 and the processor 1001 are connected through the bus 1003 in fig. 10, the bus 1003 is represented by a thick line in fig. 10, and the connection manner between other components is only schematically illustrated and is not limited. The bus 1003 may be divided into an address bus, a data bus, a control bus, and the like. For ease of illustration, only one thick line is shown in FIG. 10, but this is not intended to represent only one bus or type of bus.

The memory 1002 may be a volatile memory (volatile memory), such as a random-access memory (RAM); the memory 1002 may also be a non-volatile memory (non-volatile memory) such as, but not limited to, a read-only memory (rom), a flash memory (flash memory), a Hard Disk Drive (HDD) or a solid-state drive (SSD), or the memory 1002 may be any other medium that can be used to carry or store desired program code in the form of instructions or data structures and that can be accessed by a computer. The memory 1002 may be a combination of the above.

The processor 1001, configured to execute the method for detecting the cause of the service indicator abnormality as discussed above when invoking the computer program stored in the memory 1002, may also be configured to implement the functions of the apparatus shown in fig. 9.

Based on the same inventive concept, embodiments of the present application provide a computer storage medium, where computer instructions are stored, and when the computer instructions are executed on a computer, the computer is caused to perform any one of the methods for detecting a cause of a service indicator abnormality discussed above.

As will be appreciated by one skilled in the art, embodiments of the present application may be provided as a method, system, or computer program product. Accordingly, the present application may take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment combining software and hardware aspects. Furthermore, the present application may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, and the like) having computer-usable program code embodied therein.

Based on the same inventive concept, the embodiments of the present application provide a computer program product, which includes computer instructions stored in a computer-readable storage medium. The processor of the computer device reads the computer instructions from the computer-readable storage medium, and executes the computer instructions, so that the computer device executes the method for detecting the cause of the abnormal business index.

Those of ordinary skill in the art will understand that: all or part of the steps for implementing the method embodiments may be implemented by hardware related to program instructions, and the program may be stored in a computer readable storage medium, and when executed, the program performs the steps including the method embodiments; and the aforementioned storage medium includes: various media capable of storing program codes, such as a removable Memory device, a Read-Only Memory (ROM), a Random Access Memory (RAM), a magnetic disk, or an optical disk.

Alternatively, the integrated unit described above may be stored in a computer-readable storage medium if it is implemented in the form of a software functional module and sold or used as a separate product. Based on such understanding, the technical solutions of the embodiments of the present application may be essentially implemented or portions thereof contributing to the prior art may be embodied in the form of a software product stored in a storage medium, and including several instructions for causing a computer device (which may be a personal computer, a server, or a network device) to execute all or part of the methods described in the embodiments of the present application. And the aforementioned storage medium includes: a removable storage device, a ROM, a RAM, a magnetic or optical disk, or various other media that can store program code.

It will be apparent to those skilled in the art that various changes and modifications may be made in the present application without departing from the spirit and scope of the application. Thus, if such modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is intended to include such modifications and variations as well.

Claims

1. A method for detecting the abnormal reason of a service index is characterized by comprising the following steps:

2. The method of claim 1, wherein said separately determining a target degree of association between each of said plurality of items of target traffic data and said abnormal traffic indicator comprises:

3. The method of claim 2, wherein the separately determining the respective target traffic characteristics obtained and the respective target association degrees between the abnormal traffic indicators comprises:

inputting each target service characteristic and an abnormal type label to which the abnormal service index belongs into a trained target tree classification model, and respectively obtaining a first prediction association degree of each target service characteristic and the abnormal type label, wherein the trained target tree classification model is obtained based on training data, the training data comprises a sample abnormal type label corresponding to a sample service index in a historical service period, sample service characteristics corresponding to a plurality of sample service data associated with the target service in the historical service period, and real association degrees of the plurality of sample service data, and the sample service index and the abnormal service index are the same service index;

4. The method of claim 3, wherein said determining an abnormal type tag to which the abnormal traffic indicator belongs according to the rate of change comprises:

5. The method according to claim 3, wherein before inputting the target business features and the abnormal type labels to which the abnormal business indicators belong into the trained target tree classification model and respectively obtaining the predicted association degrees of the target business features and the abnormal type labels, the method further comprises:

determining a target tree classification model matched with the abnormal service index from a plurality of trained tree classification models;

6. The method of claim 3, wherein the trained target tree classification model is trained by:

performing a plurality of rounds of iterative training based on the training data, wherein each round of iterative training comprises:

fitting a residual error of the previous iteration training according to the second prediction relevance of the multiple items of sample service data output by the classifier of the previous iteration training and the real relevance of the multiple items of sample service data;

7. The method according to any one of claims 1 to 6, wherein the determining of the abnormal cause corresponding to the abnormal service index based on the target service data whose target association satisfies the preset association condition includes any one of the following:

and sequencing the obtained multiple target relevance degrees from large to small according to the values, and taking N project mark service data meeting sequence conditions as abnormal reasons corresponding to the abnormal service indexes, wherein N is a positive integer.

8. The method according to any one of claims 1 to 6, wherein the target service is a resource transfer service, and the plurality of target service data are service data generated in a resource transfer process.

9. An apparatus for detecting a cause of an abnormality in a service indicator, comprising:

the association degree determining module is used for respectively determining the target association degrees between the plurality of items of target service data and the abnormal service indexes;

and the abnormal reason determining module is used for determining the abnormal reason corresponding to the abnormal business index based on the target business data of which the target association meets the preset association condition.

10. A computer device, comprising:

at least one processor, and

a memory communicatively coupled to the at least one processor;

wherein the memory stores instructions executable by the at least one processor, the at least one processor implementing the method of any one of claims 1-8 by executing the instructions stored by the memory.

11. A computer storage medium storing computer instructions which, when run on a computer, cause the computer to perform the method of any one of claims 1 to 8.