CN118642929A - Login abnormality alarm method and device based on online small batch framework - Google Patents

Abstract

The present invention discloses a login abnormality alarm method and device based on an online small batch framework, which relates to the field of information security technology, financial technology or other related fields, wherein the method comprises: creating an abnormal monitoring project, wherein the abnormal monitoring project is set to monitor and alarm the customer login behavior of the target financial system, and the online small batch framework has been pre-added in the abnormal monitoring project, and the online small batch framework is used to process the customer login behavior data in the form of continuous stream data; based on the interval waiting time of the abnormal monitoring project and the online small batch framework, the abnormal monitoring project is started in the application container to obtain the monitoring result; when the monitoring result indicates that the customer login behavior is abnormal, the login behavior alarm is performed. The present invention solves the technical problem that the customer login information feedback is not timely and the hidden danger cannot be timely checked in the related technology.

Description

Login abnormality alarm method and device based on online small batch framework

Technical Field

The present invention relates to the field of information security technology, financial technology or other related fields, and in particular to a login abnormality alarm method and device based on an online small batch framework.

Background Art

In the operation of financial institutions, it is crucial to ensure the security of customer accounts and the flow of funds. Therefore, it is crucial to monitor the customer's login status on the mobile financial app in real time and handle abnormal problems in a timely manner.

In the related technology, although financial services can retrieve customer login information in batches every 15 minutes, the monitoring function has not yet met the requirements for shorter time intervals, resulting in untimely feedback of customer login information and failure to promptly detect potential security risks. In addition, the timed monitoring thread in the prior art is prone to repeated retrieval of customer data in a high-concurrency environment, which may lead to repeated notifications to customers or thread deadlocks, thereby affecting the stability and reliability of the system.

To address the above-mentioned problems, no effective solution has been proposed yet.

Summary of the invention

The embodiment of the present invention provides a login abnormality alarm method and device based on an online small batch framework, so as to at least solve the technical problem in the related technology that customer login information feedback is not timely and hidden dangers cannot be timely checked.

According to one aspect of an embodiment of the present invention, there is provided a method for alarming login anomalies based on an online small batch framework, comprising: creating an abnormal monitoring project, wherein the abnormal monitoring project is configured to monitor and alarm customer login behaviors of a target financial system, an online small batch framework has been pre-added to the abnormal monitoring project, and the online small batch framework is used to process customer login behavior data in the form of continuous stream data; based on an interval waiting time of the abnormal monitoring project and the online small batch framework, the abnormal monitoring project is started in an application container to obtain monitoring results; and when the monitoring results indicate that the customer login behavior is abnormal, a login behavior alarm is performed.

Furthermore, when the online small batch framework is pre-added to the exception monitoring project, it includes: analyzing the dependencies required by the exception monitoring project under the online small batch framework, and generating configuration information of the exception monitoring project, wherein the configuration information is used to record all the dependencies and dependency relationships; based on the configuration information, all the dependencies are added to the project object model of the exception monitoring project, and based on the dependency relationships, a project structure description is added to the project object model.

Furthermore, after adding the project structure description in the project object model based on the dependency relationship, it includes: determining the task scheduling method of the abnormal monitoring project during the project operation process based on the project structure description; generating a task scheduling construction package based on the task scheduling method, wherein the task scheduling construction package is used to instruct the application container to schedule the monitoring tasks corresponding to the abnormal monitoring project and execute the batch jobs corresponding to the monitoring tasks according to the task scheduling method.

Furthermore, when the online small batch framework is pre-added to the exception monitoring project, it includes: adding a startup annotation in the project startup class of the exception monitoring project, wherein the startup annotation is used to request the online small batch data processing method from the application container during the project operation.

Furthermore, when presetting the interval waiting time of the abnormal monitoring project, it includes: creating a project parameter table in the financial system database based on the online small batch framework, wherein the project parameter table is used to store the parameters required by the online small batch framework; configuring batch job parameters in the project parameter table, wherein the batch job parameters are used to generate an execution environment for batch jobs, and the batch job parameters include at least: the interval waiting time between the previous batch job and the next batch job.

Furthermore, the batch job parameters also include: a batch job path corresponding to the monitoring task, a monitoring task name, a task delay time, a database connection parameter, and an online small batch thread parameter.

Furthermore, after the online small batch framework is pre-added to the exception monitoring project, it also includes: configuring a thread serial mechanism in the application container and configuring the serial interval duration; after starting the exception monitoring project in the application container, it also includes: converting the exception monitoring project into N monitoring tasks, and generating N batch jobs based on the N monitoring tasks, wherein each of the monitoring tasks corresponds to one batch job, and N is a positive integer; establishing N task threads based on the thread serial mechanism, and allocating the task threads to the batch jobs, wherein the allocation principle is: each of the batch jobs occupies one task thread.

Furthermore, after the online small batch framework is pre-added to the exception monitoring project, it also includes: configuring a scenario trigger mechanism in the application container, and configuring R scenario trigger rules, where R is a positive integer; after starting the exception monitoring project in the application container, it also includes: for each task thread corresponding to the exception monitoring project, during the running process of the task thread, obtaining the real-time running information of the task thread; adjusting the running status of all the task threads based on the scenario trigger rules and the real-time running information.

Furthermore, the real-time operation information includes at least: the operation status and the current accumulated operation time. The step of adjusting the operation status of all the task threads based on the scenario triggering rules and the real-time operation information includes: based on the first scenario triggering rule, when the thread operation time of the first task thread is less than or equal to the first preset time, after the first task thread ends and the serial interval time is separated, triggering the second task thread, wherein the first task thread is the previous thread of the second task thread; based on the second scenario triggering rule, when the thread operation time of the first task thread is greater than the first preset time and less than or equal to the second preset time, triggering the second task thread after the first task thread ends; based on the third scenario triggering rule, when the thread operation time of the first task thread is greater than the second preset time, ending the first task thread and triggering the second task thread.

According to another aspect of an embodiment of the present invention, there is also provided a login anomaly alarm device based on an online small batch framework, including: a creation unit, used to create an abnormal monitoring project, wherein the abnormal monitoring project is configured to monitor and alarm the customer login behavior of the target financial system, and the online small batch framework has been pre-added to the abnormal monitoring project, and the online small batch framework is used to process customer login behavior data in the form of continuous stream data; a starting unit, used to start the abnormal monitoring project in an application container based on the interval waiting time of the abnormal monitoring project and the online small batch framework to obtain a monitoring result; an alarm unit, used to issue a login behavior alarm when the monitoring result indicates that the customer login behavior is abnormal.

Furthermore, the modules used by the login exception alarm device based on the online small batch framework when pre-adding the online small batch framework to the exception monitoring project include: an analysis module, used to analyze the dependencies required by the exception monitoring project under the online small batch framework, and generate configuration information of the exception monitoring project, wherein the configuration information is used to record all the dependencies and dependency relationships; a first adding module, used to add all the dependencies to the project object model of the exception monitoring project based on the configuration information, and add a project structure description in the project object model based on the dependency relationship.

Furthermore, the login anomaly alarm device based on the online small batch framework also includes: a determination module, used to determine the task scheduling method of the abnormal monitoring project during the project operation process based on the project structure description; a generation module, used to generate a task scheduling construction package based on the task scheduling method, wherein the task scheduling construction package is used to instruct the application container to schedule the monitoring tasks corresponding to the abnormal monitoring project and execute the batch jobs corresponding to the monitoring tasks according to the task scheduling method.

Furthermore, the login anomaly alarm device based on the online small batch framework also includes: a second adding module, used to add a startup annotation in the project startup class of the abnormal monitoring project, wherein the startup annotation is used to request an online small batch data processing method from the application container during the project operation.

Furthermore, the modules used by the login abnormality alarm device based on the online small batch framework when pre-setting the interval waiting time of the abnormal monitoring project include: a creation module, used to create a project parameter table in the financial system database based on the online small batch framework, wherein the project parameter table is used to store the parameters required for the online small batch framework; a first configuration module, used to configure batch job parameters in the project parameter table, wherein the batch job parameters are used to generate an execution environment for batch jobs, and the batch job parameters at least include: the interval waiting time between the previous batch job and the next batch job.

Furthermore, the batch job parameters also include: a batch job path corresponding to the monitoring task, a monitoring task name, a task delay time, a database connection parameter, and an online small batch thread parameter.

Furthermore, the login anomaly alarm device based on the online small batch framework also includes: a second configuration module, used to configure a thread serial mechanism in the application container and configure the serial interval duration; a conversion module, used to convert the anomaly monitoring project into N monitoring tasks after starting the anomaly monitoring project in the application container, and generate N batch jobs based on the N monitoring tasks, wherein each of the monitoring tasks corresponds to one batch job, and N is a positive integer; an establishment module, used to establish N task threads based on the thread serial mechanism, and allocate the task threads to the batch jobs, wherein the allocation principle is: each of the batch jobs occupies one task thread.

Furthermore, the login anomaly alarm device based on the online small batch framework also includes: a third configuration module, used to configure a scenario trigger mechanism in the application container, and configure R scenario trigger rules, where R is a positive integer; an acquisition module, after starting the abnormal monitoring project in the application container, for each task thread corresponding to the abnormal monitoring project, during the running process of the task thread, obtains the real-time running information of the task thread; an adjustment module, used to adjust the running status of all the task threads based on the scenario trigger rules and the real-time running information.

Furthermore, the real-time operation information includes at least: an operation status and a current accumulated operation time, and the adjustment module includes: a first trigger submodule, for triggering the second task thread based on a first scenario trigger rule, when the thread operation time of the first task thread is less than or equal to a first preset time, after the first task thread ends and after the serial interval time, wherein the first task thread is the previous thread of the second task thread; a second trigger submodule, for triggering the second task thread based on a second scenario trigger rule, when the thread operation time of the first task thread is greater than the first preset time and less than or equal to the second preset time, after the first task thread ends; a third trigger submodule, for ending the first task thread and triggering the second task thread based on a third scenario trigger rule, when the thread operation time of the first task thread is greater than the second preset time.

According to another aspect of an embodiment of the present invention, a computer-readable storage medium is also provided, wherein the computer-readable storage medium includes a stored computer program, wherein when the computer program is running, the device where the computer-readable storage medium is located is controlled to execute any one of the above-mentioned login abnormality alarm methods based on the online small batch framework.

According to another aspect of an embodiment of the present invention, there is also provided an electronic device, comprising one or more processors and a memory, wherein the memory is used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement any one of the above-mentioned login abnormality alarm methods based on an online small batch framework.

In the present invention, a login anomaly alarm method based on an online small batch framework is proposed. First, an abnormal monitoring project is created, wherein the abnormal monitoring project is set to monitor and alarm the customer login behavior of the target financial system. The online small batch framework has been pre-added to the abnormal monitoring project. The online small batch framework is used to process the customer login behavior data in the form of continuous stream data. Then, based on the interval waiting time of the abnormal monitoring project and the online small batch framework, the abnormal monitoring project is started in the application container to obtain the monitoring result. Finally, when the monitoring result indicates that the customer login behavior is abnormal, a login behavior alarm is performed.

In the present invention, an online small batch framework is introduced in the abnormal monitoring project for monitoring customer login status, so as to facilitate the processing of customer login behavior data in the form of continuous stream data. On this basis, a suitable interval waiting time is preset, and the abnormal monitoring project is started in the application container. The customer login status of the target financial system can be obtained regularly according to this time interval and abnormal login status can be checked, and then login behavior alarm can be performed. In the embodiment of the present invention, an online small batch framework is introduced, and the data stream processing function of the online small batch framework is used to realize the customized interval waiting time. By defining a shorter interval waiting time, the monitoring frequency can be maximized in a short time, abnormal login behavior can be effectively fed back, and the technical effect of real-time troubleshooting of hidden dangers can be achieved, thereby solving the technical problem of untimely feedback of customer login information and inability to timely troubleshoot hidden dangers in related technologies.

BRIEF DESCRIPTION OF THE DRAWINGS

The drawings described herein are used to provide a further understanding of the present invention and constitute a part of this application. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute an improper limitation of the present invention. In the drawings:

FIG1 is a flow chart of an optional login abnormality alarm method based on an online small batch framework according to an embodiment of the present invention;

2 is a flow chart of a method for providing feedback on abnormal login by a customer according to an embodiment of the present invention;

FIG3 is a schematic diagram of an optional thread triggering scenario process according to an embodiment of the present invention;

4 is a schematic diagram of an optional login abnormality alarm device based on an online small batch framework according to an embodiment of the present invention;

FIG5 is a hardware structure block diagram of an electronic device (or mobile device) for a login abnormality alarm method based on an online small batch framework according to an embodiment of the present invention.

DETAILED DESCRIPTION

In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

To facilitate those skilled in the art to understand the present invention, some terms or nouns involved in the embodiments of the present invention are explained below:

Online Mini-Batch Framework, a framework for machine learning and deep learning, designed to handle online learning tasks from continuous streaming data.

It should be noted that the abnormal login alarm method and device based on the online small batch framework in the present invention can be used in the field of information security technology when monitoring and investigating abnormal customer login behaviors, and can also be used in any field except the information security field when monitoring and investigating abnormal customer login behaviors. The present invention does not limit the application field of the abnormal login alarm method and device based on the online small batch framework.

It should be noted that the relevant information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in the present invention are all information and data authorized by the user or fully authorized by all parties, and the collection, storage, processing, transmission, provision, disclosure, use and processing of relevant data need to comply with the laws, regulations and standards of the relevant regions, take necessary confidentiality measures, do not violate public order and good customs, and provide corresponding operation entrances for users to choose to authorize or refuse. For example, an interface is set between this system and relevant users or organizations. Before obtaining relevant information, it is necessary to send an acquisition request to the aforementioned user or organization through the interface, and obtain relevant information after receiving the consent information fed back by the aforementioned user or organization.

The information collection (for example, user voice, video, and text collection) and analysis operations involved in the present invention have provided users with corresponding operation entrances when they are executed, allowing users to choose to agree or reject the automated decision results; if the user chooses to reject, the expert decision-making process will be entered.

The following embodiments of the present invention can be applied to various systems/applications/devices that need to monitor customer login behaviors and alarm abnormal behaviors, and can realize abnormal customer login monitoring and alarm based on an online small batch framework. The present invention introduces an online small batch framework and uses data stream processing functions to realize customized shorter interval waiting time, which can maximize the monitoring frequency in a short time, effectively feedback abnormal login behaviors, and achieve the technical effect of real-time troubleshooting of hidden dangers.

The present invention is described in detail below in conjunction with various embodiments.

Embodiment 1

According to an embodiment of the present invention, an embodiment of a login abnormality alarm method based on an online small batch framework is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although the logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

FIG. 1 is a flow chart of an optional login abnormality alarm method based on an online small batch framework according to an embodiment of the present invention. As shown in FIG. 1 , the method includes the following steps:

Step S101, creating an abnormal monitoring project.

Step S102: based on the interval waiting time of the abnormal monitoring project and the online small batch framework, the abnormal monitoring project is started in the application container to obtain the monitoring result.

Step S103: When the monitoring result indicates that the customer login behavior is abnormal, a login behavior alarm is issued.

Through the above steps, an exception monitoring project can be created first, wherein the exception monitoring project is set to monitor and alarm the customer login behavior of the target financial system. An online small batch framework has been pre-added to the exception monitoring project, and the online small batch framework is used to process customer login behavior data in the form of continuous stream data. Then, based on the interval waiting time of the exception monitoring project and the online small batch framework, the exception monitoring project is started in the application container to obtain the monitoring results. Finally, when the monitoring results indicate that the customer login behavior is abnormal, a login behavior alarm is issued.

In an embodiment of the present invention, an online small batch framework is introduced in the abnormal monitoring project for monitoring customer login status, so as to facilitate the processing of customer login behavior data in the form of continuous stream data. On this basis, a suitable interval waiting time is preset, and the abnormal monitoring project is started in the application container. The customer login status of the target financial system can be obtained regularly according to this time interval and abnormal login status can be checked, and then login behavior alarm can be issued. In an embodiment of the present invention, an online small batch framework is introduced, and the data stream processing function of the online small batch framework is used to realize the custom interval waiting time. By defining a shorter interval waiting time, the monitoring frequency can be maximized in a short time, abnormal login behavior can be effectively fed back, and the technical effect of real-time troubleshooting of hidden dangers can be achieved, thereby solving the technical problem of untimely feedback of customer login information and inability to timely troubleshoot hidden dangers in related technologies.

The embodiment of the present invention is described in detail below in combination with the above steps.

The implementing entity of the embodiment of the present invention can be a financial system, or a mobile financial APP connected to the financial system. The data stream processing system is constructed in combination with an online small batch framework to improve the streaming data processing speed and thus improve the monitoring frequency and efficiency, and timely feedback abnormal login information.

It should be noted that the online small batch framework, as an online learning framework that can process data from continuous streams, combines machine learning technology and deep learning technology to input the continuously influx of streaming data (customer login behavior data in this invention) into the data stream processing system in the form of small batches, judge and screen the customer login behavior information, and then realize real-time alarm for abnormal login situations.

Step S101, creating an abnormal monitoring project.

It should be noted that the abnormal monitoring project is set to monitor and alarm the customer login behavior of the target financial system. An online small batch framework has been pre-added to the abnormal monitoring project. The online small batch framework is used to process customer login behavior data in the form of continuous stream data.

Specifically, before executing step S101, it also includes: determining the goals and requirements of the abnormal monitoring project, including: monitoring objects (such as user login behavior), monitoring indicators (such as the number of abnormal logins, login locations, devices, etc.), expected responses and processing methods, etc.

The architecture of the exception monitoring project is designed based on the goals and needs, including process modules such as data collection, real-time processing, rule engine and notification mechanism, as well as the interaction between each process module. Then, appropriate technical tools are selected, such as stream processing engine, message queue, database, security encryption algorithm, etc., and then based on the technical tools, system process modules such as data collection module, real-time processing logic, rule engine, notification service, etc. are written. Finally, the process modules are connected according to the interaction relationship to obtain the exception monitoring project.

When the online small batch framework is introduced into the exception monitoring project, it includes: integrating the framework, integrating the online small batch framework into the project system according to the requirements and architecture design of the exception monitoring project, including data reception, processing, analysis and other links; configuring parameters, configuring the parameters of the online small batch framework according to project requirements, at least including the interval waiting time for data stream processing.

Step S102: based on the interval waiting time of the abnormal monitoring project and the online small batch framework, the abnormal monitoring project is started in the application container to obtain the monitoring result.

Specifically, when deploying and starting an exception monitoring project in an application container, the image file of the exception monitoring project (including the project code, dependencies, and configuration) is usually uploaded to the container registry, and then deployed and started through the container orchestration tool. After deployment, the exception monitoring project will run in the container and start receiving and processing data.

The application container will return monitoring results, usually through logs, API interfaces or message queues. The monitoring results may include detailed information about abnormal logins (such as user ID, login time, login location, login device, etc.), anomaly detection results (such as whether abnormal rules are triggered), and processing status (such as whether the operation and maintenance terminal has been notified).

Step S103: When the monitoring result indicates that the customer login behavior is abnormal, a login behavior alarm is issued.

By executing the above steps, an online small batch framework can be introduced to optimize the data processing capabilities of the exception monitoring system, achieve more efficient data stream processing, and thus improve the real-time performance of the monitoring system. Furthermore, the deployment and automated operation and maintenance of the exception monitoring project can improve the efficiency of the operation and maintenance personnel, help them to promptly discover and handle abnormal situations, reduce the impact of system failures on the business, reduce manual intervention and processing time, and improve the stability and reliability of the financial system.

In an embodiment of the present invention, in order to reduce the possibility of deployment and configuration errors, configuration information can be generated by explicitly analyzing the required dependencies, and the effect of reducing the complexity of project maintenance can also be achieved. Optionally, when the online small batch framework is pre-added to the exception monitoring project, it includes: analyzing the dependencies required for the exception monitoring project under the online small batch framework, and generating configuration information of the exception monitoring project, wherein the configuration information is used to record all dependencies and dependency relationships; based on the configuration information, all dependencies are added to the project object model of the exception monitoring project, and based on the dependency relationships, a project structure description is added to the project object model.

Specifically, dependencies refer to external components, libraries, and modules required during project development and operation, usually including: third-party libraries, frameworks, databases, message queues, and operating environments. Based on all dependencies, the original relationship model is established to clarify the dependencies between components, including but not limited to the calling relationship and initialization order of dependencies. By integrating all dependencies and dependency relationships, configuration information can be obtained, and the configuration information can guide the generation of the project object model. It should be noted that the project object model is used to manage and describe the overall structure of the project and the relationship between various components.

In order to ensure that the monitoring tasks can be executed according to the specified scheduling method during the project operation, a task scheduling construction package can also be used to provide scheduling instructions for the application container. Optionally, after adding the project structure description in the project object model based on the dependency relationship, it includes: determining the task scheduling method of the abnormal monitoring project during the project operation based on the project structure description; generating a task scheduling construction package based on the task scheduling method, wherein the task scheduling construction package is used to instruct the application container to schedule the monitoring tasks corresponding to the abnormal monitoring project and execute the batch jobs corresponding to the monitoring tasks according to the task scheduling method.

Specifically, the task scheduling method in the embodiment of the present invention refers to determining the time and frequency of execution of the monitoring task, and may also include strategies or rules for the execution of the monitoring task, including but not limited to: timed scheduling, event triggering, conditional triggering, etc., to ensure that the monitoring task is executed at the appropriate time, and to manage resources and process monitoring data in the most efficient way.

The embodiment of the present invention can facilitate the application container to recognize that the exception monitoring project should use the online small batch data processing method for data processing through annotations. Optionally, when the online small batch framework is pre-added to the exception monitoring project, it includes: adding a startup annotation to the project startup class of the exception monitoring project, wherein the startup annotation is used to request the online small batch data processing method to the application container during the project operation.

Specifically, the step of adding the startup annotation includes: importing the annotation class in the project startup class file of the exception monitoring project; before the class definition of the project startup class, using the annotation class to add annotations between the declaration lines of the project startup class. If there is no ready-made annotation class available in the project, you can customize an annotation class. Adding the annotation to the startup class of the project enables the startup class to be recognized by the application container at runtime and perform corresponding operations, such as requesting an online small batch data processing method.

In order to achieve the management and control of the batch job execution environment, a project parameter table can be created in the financial system database and batch job parameters can be configured. Optionally, when presetting the interval waiting time of the abnormal monitoring project, it includes: creating a project parameter table in the financial system database based on the online small batch framework, wherein the project parameter table is used to store the parameters required by the online small batch framework; configuring batch job parameters in the project parameter table, wherein the batch job parameters are used to generate the execution environment of the batch job, and the batch job parameters at least include: the interval waiting time between the previous batch job and the next batch job. The preset interval waiting parameters can ensure that the batch job can be scheduled according to the specified time interval during the execution process, thereby reasonably allocating system resources and ensuring the continuity of the monitoring task, which is conducive to maintaining the stability and reliability of the system and improving the operating efficiency of the abnormal monitoring system.

Furthermore, the batch job parameters also include: the batch job path corresponding to the monitoring task, the monitoring task name, the task delay time, the database connection parameters and the online small batch thread parameters.

It should be noted that the batch job path corresponding to the monitoring task refers to a specific package path specified in the online small batch application (referring to the application container instance after the abnormal monitoring task is started) for storing the code files of the batch task. By configuring this package path, the system can automatically scan the monitoring tasks under the path and add them to the scheduling of batch tasks, thereby realizing the automatic management and scheduling of these monitoring tasks.

Monitoring task naming refers to assigning a name or identifier to an online small batch application, which is used to uniquely identify an online small batch application. Different online small batch applications can be distinguished in the system to facilitate management and monitoring. It is usually specified in a configuration file or startup parameters.

Task delay time refers to setting a delayed start time in online small batch applications, that is, waiting for a period of time after the system starts before starting batch task scheduling, which is used to ensure that other components of the system have been fully started and are ready, and to avoid batch task execution problems caused by instability in the system startup phase.

Database connection parameters refer to the parameters required to configure a connection to a database in an online small batch application, including the database host address, port number, user name, database name, password, etc. By configuring database connection information, an online small batch application can establish a connection with the database and perform operations such as reading, writing, and managing data.

Online small batch thread parameters refer to the parameters related to configuring thread pools in online small batch applications, such as thread pool size, thread pool working mode (such as fixed size thread pool, cache thread pool, etc.), thread pool timeout settings, etc., which can optimize the performance and resource utilization of online small batch applications and ensure that batch tasks can be executed in an efficient and stable manner.

The login real-time monitoring and anti-duplicate mechanism in the embodiment of the present invention also relies on the serial mechanism pre-set in the online small batch framework. Optionally, after the online small batch framework is pre-added to the abnormal monitoring project, it also includes: configuring the thread serial mechanism in the application container, and configuring the serial interval duration; after starting the abnormal monitoring project in the application container, it also includes: converting the abnormal monitoring project into N monitoring tasks, and generating N batch jobs based on the N monitoring tasks, wherein each monitoring task corresponds to a batch job, and N is a positive integer; establishing N task threads based on the thread serial mechanism, and assigning task threads to batch jobs, wherein the allocation principle is: each batch job occupies one task thread.

For example, after the online small batch framework is loaded, the customer login real-time monitoring thread needs to be set to a mechanism that is triggered every minute. On this basis, a serial mechanism needs to be implemented in which the next thread can only wait before the previous thread is completed.

It should be noted that since it is impossible to ensure that the amount of data at each moment is completely uniform, perhaps in a high-concurrency login scenario, the amount of data processed by the monitoring thread at that moment may suddenly become too large. At this time, if the next thread starts on time, the two threads may simultaneously process data whose monitoring status has not been modified, resulting in deadlock and other problems.

The embodiment of the present invention can avoid the system problems caused by the above-mentioned special scenarios by configuring a scenario trigger mechanism. Optionally, after the online small batch framework is pre-added to the abnormal monitoring project, it also includes: configuring the scenario trigger mechanism in the application container, and configuring R scenario trigger rules, where R is a positive integer; after starting the abnormal monitoring project in the application container, it also includes: for each task thread corresponding to the abnormal monitoring project, during the running process of the task thread, obtaining the real-time running information of the task thread; adjusting the running status of all task threads based on the scenario trigger rules and the real-time running information.

It should be noted that the real-time operation information includes at least: the operation status and the current cumulative operation time, and may also include: task execution status, resource usage, exception information, task dependency and historical operation data.

Optionally, the step of adjusting the running status of all task threads based on scenario triggering rules and real-time running information includes: based on the first scenario triggering rule, when the thread running time of the first task thread is less than or equal to the first preset time, triggering the second task thread after the first task thread ends and the serial interval time is exceeded, wherein the first task thread is the previous thread of the second task thread; based on the second scenario triggering rule, when the thread running time of the first task thread is greater than the first preset time and less than or equal to the second preset time, triggering the second task thread after the first task thread ends; based on the third scenario triggering rule, when the thread running time of the first task thread is greater than the second preset time, ending the first task thread and triggering the second task thread.

For example, thread triggering scenarios are classified as:

1. If the previous thread finishes within 1 minute, the next thread will start on time after a 1-minute interval;

2. If the previous thread fails to finish within 1 minute, the next thread needs to wait until the previous thread finishes before starting;

3. If a thread runs for more than 3 minutes, the process is terminated immediately and the next thread is started.

Optionally, the embodiment of the present invention can also add serial annotations to all task threads through an annotation mechanism to implement serial execution of each monitoring process, thereby avoiding concurrent processes occupying resources and causing deadlock and other problems.

The embodiment of the present invention provides a method for online small batch data processing with real-time login alarm, which is mainly used in a financial distributed service architecture to monitor the login information of financial APP customers in real time and to alarm abnormal login behavior.

The embodiment of the present invention can realize high-frequency real-time monitoring of customer login status. Different from low-frequency monitoring, it can effectively monitor abnormal behavior, issue an alarm as early as possible, and protect customer information.

The anti-high concurrency mechanism of the embodiment of the present invention can greatly increase the success rate of thread operation and improve the overall monitoring efficiency.

The present invention is described below in conjunction with another specific implementation manner.

In order to solve the problem that the mobile financial APP in the financial system cannot timely feedback the customer login information and cannot timely check the customer login hidden dangers, the embodiment of the present invention combines the online small batch framework to propose a customer abnormal login feedback method. FIG2 is a flow chart of the customer abnormal login feedback method according to the embodiment of the present invention. As shown in FIG2, the method includes the following steps:

Step S201, introducing an online small batch dependency configuration into the target project, the target project is configured to periodically obtain the customer login information of the financial APP and perform abnormality identification.

Here, the target project is the abnormal monitoring project mentioned in Example 1, and the dependency configuration refers to the configuration information required to manage the external library or framework in the target project. The embodiment of the present invention can use the Project Object Model (POM) to describe the structure, dependency relationship and construction process of the target project through the project management construction tool. In the target project, the required external library or framework can be specified by adding dependencies in the POM file. When building the project, the project management construction tool will automatically download these dependencies and add them to the project class path.

Step S202: adding an online small batch application annotation to the project startup class of the target project.

It should be noted that the project startup class is usually a JAVA class that includes a main method. A startup annotation class is added before the class declaration line to identify that the target project is an online small batch application, so that the application container and application framework can recognize that the target project needs to use an online small batch method for data processing.

Step S203, configuring an online small batch parameter table in the financial database.

It should be noted that a table is created in the financial database to store the parameters required by the online small batch framework, such as the amount of data in each batch, the frequency of data processing, the source of data, and other information, so as to facilitate the dynamic adjustment and management of the behavior of the online small batch application without modifying the code. The online small batch framework is enabled and configured in the target project, so that the target project can realize real-time processing and updating of streaming data.

Step S204, configuring small batch file parameters based on the online small batch parameter table.

It should be noted that the small batch file parameters include but are not limited to: the waiting time between the previous batch job and the next batch job, the batch job path corresponding to the monitoring task, the monitoring task name, the task delay time, the database connection parameters and the online small batch thread parameters.

The preset interval waiting parameters can ensure that batch jobs can be scheduled according to the specified time interval during execution, thereby reasonably allocating system resources and ensuring the continuity of monitoring tasks, which is conducive to maintaining the stability and reliability of the system and improving the operating efficiency of the abnormal monitoring system.

The batch job path corresponding to the monitoring task refers to a specific package path specified in the online small batch application (the application container instance after starting the target task) to store the code files of the batch task. By configuring this package path, the system can automatically scan the monitoring tasks under the path and add them to the scheduling of batch tasks, thereby realizing automatic management and scheduling of these monitoring tasks.

Monitoring task naming refers to assigning a name or identifier to an online small batch application, which is used to uniquely identify an online small batch application. Different online small batch applications can be distinguished in the system to facilitate management and monitoring. It is usually specified in a configuration file or startup parameters.

Task delay time refers to setting a delayed start time in online small batch applications, that is, waiting for a period of time after the system starts before starting batch task scheduling, which is used to ensure that other components of the system have been fully started and are ready, and to avoid batch task execution problems caused by instability in the system startup phase.

Database connection parameters refer to the parameters required to configure a connection to a database in an online small batch application, including the database host address, port number, user name, database name, password, etc. By configuring database connection information, an online small batch application can establish a connection with the database and perform operations such as reading, writing, and managing data.

Online small batch thread parameters refer to the parameters related to configuring thread pools in online small batch applications, such as thread pool size, thread pool working mode (such as fixed size thread pool, cache thread pool, etc.), thread pool timeout settings, etc., which can optimize the performance and resource utilization of online small batch applications and ensure that batch tasks can be executed in an efficient and stable manner.

Step S205, starting the target project in the application container, and obtaining the customer login behavior that is determined to be an abnormal login.

Step S206: issuing an abnormal alarm for the customer login behavior that is determined to be an abnormal login.

Optionally, an anti-duplication mechanism can be added to the above-mentioned real-time login monitoring mechanism. For example, using the serial mechanism, after the online small batch framework is loaded, the customer login real-time monitoring thread needs to be set to be triggered every one minute. On this basis, it is also necessary to implement a serial mechanism that prohibits the next thread from starting before the previous thread is completed. Because it is impossible to guarantee that the amount of data at each moment is completely uniform, it may cause the monitoring thread to process too much data at that moment in a high-concurrency login scenario. At this time, if the next thread starts on time, it may cause the two threads to process data whose monitoring status has not been modified at the same time, resulting in deadlock and other problems.

Another optional embodiment, Figure 3 is a schematic diagram of an optional thread-triggered scenario process according to an embodiment of the present invention. As shown in Figure 3, the scenario process includes: 1. If the previous thread is completed within 1 minute, the next thread will wait until the 1-minute interval and start on time; 2. If the previous thread is not completed within 1 minute, the next thread needs to wait until the previous thread is completed before starting.

In addition, the implementation mode of the present invention can also set the thread trigger scenario as follows: if the running time of a thread exceeds the set timeout value, the process is terminated and the next thread starts; the entire real-time monitoring thread needs to be set to serial, and an annotation mechanism is added to implement the serial execution of each monitoring process through annotation, so as to avoid concurrent processes occupying resources and causing deadlock and other problems.

The present invention is described below in conjunction with another optional embodiment.

Embodiment 2

The login abnormality alarm device based on the online small batch framework provided in this embodiment includes multiple implementation units, and each implementation unit corresponds to each implementation step in the above-mentioned embodiment one.

FIG4 is a schematic diagram of an optional login abnormality alarm device based on an online small batch framework according to an embodiment of the present invention. As shown in FIG4 , the device may include: a creation unit 41 , a startup unit 42 , and an alarm unit 43 .

The creation unit 41 is used to create an abnormal monitoring project, wherein the abnormal monitoring project is set to monitor and alarm the customer login behavior of the target financial system, and an online small batch framework has been pre-added in the abnormal monitoring project, and the online small batch framework is used to process the customer login behavior data in the form of continuous stream data;

A starting unit 42, configured to start the abnormal monitoring project in an application container based on the interval waiting time of the abnormal monitoring project and the online small batch framework, and obtain a monitoring result;

The alarm unit 43 is used to issue a login behavior alarm when the monitoring result indicates that the client login behavior is abnormal.

The above-mentioned login anomaly alarm device based on the online small batch framework can first create an anomaly monitoring project through the creation unit 41, wherein the anomaly monitoring project is set to monitor and alarm the customer login behavior of the target financial system, and the online small batch framework has been pre-added to the anomaly monitoring project. The online small batch framework is used to process customer login behavior data in the form of continuous stream data, and then the startup unit 42 is used to start the anomaly monitoring project in the application container based on the interval waiting time of the anomaly monitoring project and the online small batch framework to obtain the monitoring result. Finally, the alarm unit 43 performs a login behavior alarm when the monitoring result indicates that the customer login behavior is abnormal.

In an embodiment of the present invention, an online small batch framework is introduced in the abnormal monitoring project for monitoring customer login status, so as to facilitate the processing of customer login behavior data in the form of continuous stream data. On this basis, a suitable interval waiting time is preset, and the abnormal monitoring project is started in the application container. The customer login status of the target financial system can be obtained regularly according to this time interval and abnormal login status can be checked, and then login behavior alarm can be issued. In an embodiment of the present invention, an online small batch framework is introduced, and the data stream processing function of the online small batch framework is used to realize custom interval waiting time. By defining a shorter interval waiting time, the monitoring frequency can be maximized in a short time, abnormal login behavior can be effectively fed back, and the technical effect of real-time troubleshooting of hidden dangers can be achieved, thereby solving the technical problem of untimely feedback of customer login information and inability to timely troubleshoot hidden dangers in related technologies.

Optionally, the modules used by the login exception alarm device based on the online small batch framework when pre-adding the online small batch framework to the exception monitoring project include: an analysis module, used to analyze the dependencies required by the exception monitoring project under the online small batch framework, and generate configuration information of the exception monitoring project, wherein the configuration information is used to record all dependencies and dependency relationships; a first adding module, used to add all dependencies to the project object model of the exception monitoring project based on the configuration information, and add a project structure description in the project object model based on the dependency relationship.

Optionally, the login anomaly alarm device based on the online small batch framework also includes: a determination module, which is used to determine the task scheduling method of the abnormal monitoring project during the project operation process based on the project structure description; a generation module, which is used to generate a task scheduling construction package based on the task scheduling method, wherein the task scheduling construction package is used to instruct the application container to schedule the monitoring tasks corresponding to the abnormal monitoring project and execute the batch jobs corresponding to the monitoring tasks according to the task scheduling method.

Optionally, the login anomaly alarm device based on the online small batch framework also includes: a second adding module, used to add a startup annotation in the project startup class of the abnormal monitoring project, wherein the startup annotation is used to request an online small batch data processing method from the application container during the project operation.

Optionally, the modules used by the login exception alarm device based on the online small batch framework when pre-setting the interval waiting time of the exception monitoring project include: a creation module, used to create a project parameter table in the financial system database based on the online small batch framework, wherein the project parameter table is used to store the parameters required for the online small batch framework; a first configuration module, used to configure batch job parameters in the project parameter table, wherein the batch job parameters are used to generate the execution environment of the batch job, and the batch job parameters include at least: the interval waiting time between the previous batch job and the next batch job.

Optionally, the batch job parameters also include: a batch job path corresponding to the monitoring task, a monitoring task name, a task delay duration, database connection parameters, and online small batch thread parameters.

Optionally, the login anomaly alarm device based on the online small batch framework also includes: a second configuration module, used to configure a thread serial mechanism in the application container, and configure the serial interval duration; a conversion module, used to convert the anomaly monitoring project into N monitoring tasks after starting the anomaly monitoring project in the application container, and generate N batch jobs based on the N monitoring tasks, wherein each monitoring task corresponds to a batch job, and N is a positive integer; an establishment module, used to establish N task threads based on the thread serial mechanism, and allocate task threads to batch jobs, wherein the allocation principle is: each batch job occupies one task thread.

Optionally, the login anomaly alarm device based on the online small batch framework also includes: a third configuration module, used to configure a scenario trigger mechanism in the application container, and configure R scenario trigger rules, where R is a positive integer; an acquisition module, after starting the anomaly monitoring project in the application container, for each task thread corresponding to the anomaly monitoring project, during the running process of the task thread, acquires the real-time running information of the task thread; an adjustment module, used to adjust the running status of all task threads based on the scenario trigger rules and the real-time running information.

Optionally, the real-time operation information includes at least: the operation status and the current accumulated operation time, and the adjustment module includes: a first trigger submodule, which is used to trigger the second task thread based on the first scenario trigger rule, when the thread operation time of the first task thread is less than or equal to the first preset time, after the first task thread ends and the serial interval time is exceeded, wherein the first task thread is the previous thread of the second task thread; a second trigger submodule, which is used to trigger the second task thread based on the second scenario trigger rule, when the thread operation time of the first task thread is greater than the first preset time and less than or equal to the second preset time, after the first task thread ends; a third trigger submodule, which is used to end the first task thread and trigger the second task thread based on the third scenario trigger rule, when the thread operation time of the first task thread is greater than the second preset time.

The above-mentioned login abnormality alarm device based on the online small batch framework can also include a processor and a memory. The above-mentioned creation unit 41, startup unit 42, alarm unit 43, etc. are all stored in the memory as program units, and the processor executes the above-mentioned program units stored in the memory to realize the corresponding functions.

The processor includes a kernel, which retrieves the corresponding program unit from the memory. One or more kernels can be set, and the kernel parameters are adjusted to start the abnormal monitoring project in the application container based on the interval waiting time of the abnormal monitoring project and the online small batch framework, and the monitoring results are obtained. When the monitoring results indicate that the customer login behavior is abnormal, a login behavior alarm is issued.

The above-mentioned memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and/or non-volatile memory, such as read-only memory (ROM) or flash RAM, and the memory includes at least one storage chip.

The present application also provides a computer program product, which, when executed on a data processing device, is suitable for executing a program that initializes the following method steps: creating an abnormal monitoring project, wherein the abnormal monitoring project is configured to monitor and alarm customer login behaviors of a target financial system, an online small batch framework has been pre-added to the abnormal monitoring project, and the online small batch framework is used to process customer login behavior data in the form of continuous stream data; based on the interval waiting time of the abnormal monitoring project and the online small batch framework, the abnormal monitoring project is started in an application container to obtain monitoring results; and when the monitoring results indicate that the customer login behavior is abnormal, a login behavior alarm is issued.

According to another aspect of an embodiment of the present invention, a computer-readable storage medium is also provided, the computer-readable storage medium including a stored computer program, wherein when the computer program is running, the device where the computer-readable storage medium is located is controlled to execute any one of the above-mentioned embodiments of the first embodiment, a login abnormality alarm method based on an online small batch framework.

According to another aspect of an embodiment of the present invention, there is also provided an electronic device, comprising one or more processors and a memory, the memory being used to store one or more programs, wherein when the one or more programs are executed by one or more processors, the one or more processors implement the login abnormality alarm method based on an online small batch framework of any one of the above-mentioned embodiments one.

FIG. 5 is a hardware structure block diagram of an electronic device (or mobile device) for a login abnormality alarm method based on an online small batch framework according to an embodiment of the present invention. As shown in FIG. 5 , the electronic device may include one or more (502a, 502b, ..., 502n are used in FIG. 5 to illustrate) processors 502 (the processor 502 may include but is not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA), and a memory 504 for storing data. In addition, it may also include: a display, an input/output interface (I/O interface), a universal serial bus (USB) port (which may be included as one of the ports of the I/O interface), a network interface, a keyboard, a power supply and/or a camera. It can be understood by a person skilled in the art that the structure shown in FIG. 5 is only for illustration, and it does not limit the structure of the above-mentioned electronic device. For example, the electronic device may also include more or fewer components than those shown in FIG. 5 , or have a configuration different from that shown in FIG. 5 .

The serial numbers of the above embodiments of the present invention are only for description and do not represent the advantages or disadvantages of the embodiments.

In the above embodiments of the present invention, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only schematic. For example, the division of units can be a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple units. Some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, disk or optical disk and other media that can store program codes.

The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principle of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims (12)

1. A login abnormity alarm method based on an online small batch framework is characterized by comprising the following steps:

Creating an abnormal monitoring item, wherein the abnormal monitoring item is set to monitor and alarm the client login behavior of a target financial system, an online small batch framework is added in the abnormal monitoring item in advance, and the online small batch framework is used for processing the client login behavior data in a continuous flow data form;

starting the abnormal monitoring items in an application container based on the interval waiting time of the abnormal monitoring items and the online small batch frame to obtain a monitoring result;

And under the condition that the monitoring result indicates that the client login behavior is abnormal, performing login behavior alarm.

2. The login anomaly alarm method according to claim 1, wherein when an online small lot frame is added to the anomaly monitoring item in advance, comprising:

Analyzing dependence items required by the abnormal monitoring items under the online small batch framework, and generating configuration information of the abnormal monitoring items, wherein the configuration information is used for recording all the dependence items and the dependence relations;

And adding all the dependent items to a project object model of the abnormal monitoring project based on the configuration information, and adding project structure description in the project object model based on the dependent relation.

3. The login anomaly alarm method according to claim 2, characterized by comprising, after adding a project structure description in the project object model based on the dependency relationship:

determining a task scheduling method of the abnormal monitoring project in the project operation process based on the project structure description;

And generating a task scheduling construction package based on the task scheduling method, wherein the task scheduling construction package is used for indicating the application container to schedule the monitoring task corresponding to the abnormal monitoring item and execute the batch job corresponding to the monitoring task according to the task scheduling method.

4. The login anomaly alarm method according to claim 1, wherein when an online small lot frame is added to the anomaly monitoring item in advance, comprising:

and adding a starting annotation in the project starting class of the abnormal monitoring project, wherein the starting annotation is used for requesting an online small batch data processing mode from the application container in the project running process.

5. The login anomaly alarm method according to claim 1, wherein when an interval waiting time period of the anomaly monitoring item is set in advance, comprising:

Creating a project parameter table in a financial system database based on the online small batch framework, wherein the project parameter table is used for storing parameters required by the online small batch framework;

Configuring batch job parameters in the item parameter table, wherein the batch job parameters are used for generating an execution environment of batch jobs, and the batch job parameters at least comprise: the interval between the last batch job and the next batch job waits for a period of time.

6. The login anomaly alarm method according to claim 5, wherein the batch job parameters further include: the method comprises the steps of monitoring a batch job path corresponding to a task, naming the monitoring task, delaying task time, database connection parameters and online small batch thread parameters.

7. The login anomaly alarm method according to claim 1, further comprising, after adding an online small lot frame to the anomaly monitoring item in advance:

configuring a thread serial mechanism in the application container, and configuring serial interval duration;

after the anomaly monitoring item is started in the application container, the method further comprises:

Converting the abnormal monitoring items into N monitoring tasks, and generating N batch jobs based on the N monitoring tasks, wherein each monitoring task corresponds to one batch job, and N is a positive integer;

Establishing N task threads based on the thread serial mechanism, and distributing the task threads for the batch job, wherein the distribution principle is as follows: each batch job occupies one task thread.

8. The login anomaly alarm method according to claim 7, further comprising, after adding an online small lot frame to the anomaly monitoring item in advance:

Configuring a scene trigger mechanism in the application container, and configuring R scene trigger rules, wherein R is a positive integer;

after the anomaly monitoring item is started in the application container, the method further comprises:

for each task thread corresponding to the abnormality monitoring project, acquiring real-time operation information of the task thread in the operation process of the task thread;

And adjusting the running conditions of all the task threads based on the scene triggering rules and the real-time running information.

9. The login anomaly alarm method according to claim 8, wherein the real-time operation information includes at least: the step of adjusting the running conditions of all the task threads based on the scene trigger rule and the real-time running information comprises the following steps:

based on a first scene triggering rule, triggering a second task thread after the first task thread is ended and the serial interval duration is spaced under the condition that the thread running duration of the first task thread is less than or equal to a first preset duration, wherein the first task thread is the last thread of the second task thread;

Based on a second scene triggering rule, triggering the second task thread after the first task thread is ended when the thread running time of the first task thread is longer than the first preset time length and is smaller than or equal to a second preset time length;

And ending the first task thread and triggering the second task thread under the condition that the thread running time length of the first task thread is longer than the second preset time length based on a third scene triggering rule.

10. A login abnormity alarm device based on an online small batch framework is characterized by comprising:

The system comprises a creation unit, a storage unit and a processing unit, wherein the creation unit is used for creating an abnormal monitoring item, the abnormal monitoring item is set to monitor and alarm the client login behavior of a target financial system, an online small batch framework is added in the abnormal monitoring item in advance, and the online small batch framework is used for processing the client login behavior data in a continuous flow data form;

The starting unit is used for starting the abnormal monitoring items in the application container based on the interval waiting time of the abnormal monitoring items and the online small batch frame to obtain monitoring results;

And the alarm unit is used for alarming the login behavior under the condition that the monitoring result indicates that the login behavior of the client is abnormal.

11. A computer readable storage medium, characterized in that the computer readable storage medium comprises a stored computer program, wherein the computer program when run controls a device in which the computer readable storage medium is located to execute the login anomaly alarm method based on the online small batch framework according to any one of claims 1 to 7.

12. An electronic device comprising one or more processors and a memory for storing one or more programs, wherein the one or more programs, when executed by the one or more processors, cause the one or more processors to implement the online small batch framework-based login anomaly alert method of any one of claims 1 to 7.