Basic variable definition:

1) The distance between two points, p and o, is the difference between two points of data, where the trading volume distance is:

d 1 ( p , o ) = x 1 ( p ) − x 1 (0)

The distance of transaction success rate is:

d 2 ( p , o ) = x 2 ( p ) − x 2 (0)

The distance of response time distance is:

d 3 ( p , o ) = x 3 ( p ) − x 3 (0)

2) The k-th distance: The distance from the point k away from the point p to p, excluding p.

3) The k-th distance neighborhood: The k-th distance neighborhood of point p, that is, all points within the k-th distance of, including the k-th distance. Therefore, the number of k-th neighbors of p.

4) Reachable distance:

r e a c h - d i s t a n c e ( p , o ) = max { d k ( o ) , d ( p o ) }

5) Local accessible density: the higher the density is, the more likely it is to belong to the same cluster. The lower the density, the more likely it is to be an outlier. The local reachable density of point p is expressed as:

l r d k ( p ) = 1 ∑ o ∈ N k ( p ) r e a c h - d i s t ( p , o ) / | N k ( p ) |

6) Local outlier factor: indicates the degree of abnormality of the data objects, and its size reflects the degree of isolation of the data object relative to the points in its data area, which referred to as:

L O F k ( P ) = ∑ o ∈ N k ( p ) l r d k ( o ) l r d k ( p ) | N k ( p ) |

The basic operation is as follows [5] [6] [7] :

1) Query the neighborhood of each data object p in the overall data set d, and obtain the neighborhood N k ( p ) recalculation distance.

2) Sort the distance, and calculate the k-th distance and the k-th field.

3) Calculate the reachability density of each transaction data.

4) Calculate the local outlier factor for each transaction data.

5) Sort and output local outlier factors for each transaction data.

Based on the periods divided in question 1, the average transaction time, success rate, and response time for each of the eight periods were used to calculate the degree of outliers at each time point. Taking the maximum value of outliers as the abnormal condition under the mean value, the abnormal regions in each period are set as follows Table 3.

According to this, the degree of local outliers of the transaction data factors at any time of the day can be determined, and the abnormality can be determined based on the abnormality threshold. The following are the outlier excursions and abnormal point discrimination charts at each time on the 1.23 day (Figure 4, Figure 5).

Symbolic Aggregate Appro-Ximation (SAX) is a data compression and information extraction method that can discretize data sequences and convert them into

symbol sequences according to the characteristics of data density [8] . The algorithm steps are as follows:

1) Z-score standardization of all data is converted into data that conforms to the standard normal distribution. The conversion function is:

x * = x − μ σ

2) A segmented aggregate approximate conversion PAA is performed on the original time series. The total length is n, and the normalized time series are divided into w groups one by one in chronological order. Then find the arithmetic mean value m of each set of sequences, and use m to replace the value of the entire sequence set, reduce the dimension of the original data by about n/w, and change the fluctuating time series into a staircase sequence.

3) Divide the probability density curve of N(0, 1) into a interval functions according to probability, replace the PAA segment with discrete letters, and complete the symbolization of the sequence.

4) Similarity measure and comparison of symbol sequences. Assuming that P, Q are two symbol sequences, and denotes the value of the ith element of the corresponding symbol sequence, then the distance between symbol sequences is defined as:

D ( P , Q ) = n w ∑ i = 1 w ( d i s t ( p i , q i ) ) 2

where

d i s t ( p i , q i ) = { 0 ,     | p i − q i | ≤ 1 b max ( p i , q i ) − 1 − b min ( p i , q i ) − 1       | p i − q i | ≥ 1

b is the area split point under the normal distribution curve.

After eliminating the outliers in the original sequence, symbolic aggregation approximation processing is performed on the transaction data. Taking the 23rd in April transaction volume as an example, the PAA conversion graph is as follows Figure 6.

After replacing the interval segment with discrete letters, the symbolized data is as follows Figure 7.

Calculate the approximate result of the symbol aggregation for the average data of each time period, and calculate the distance between the symbolization result and the mean value at each period of the transaction data, and perform the following test:

1) If d i s t ( p i , q i ) = 0 , keep the original abnormal threshold;

2) If d i s t ( p i , q i ) > 0 , increase the abnormality threshold.

After expanding the abnormal threshold, new abnormal points are deleted,

and the data is checked and corrected again until all the time periods have passed the test. The correction of the threshold value can increase the sensitivity of the anomaly detection model and minimize the false alarms and omissions of abnormal data. Based on the initial abnormality threshold SAX test results are as follows Table 4.

From Table 4, it can be seen that the initial abnormality threshold of transaction volume is good, and the transaction success rate and response time abnormality thresholds need to be optimized. After optimization by the cyclic SAX test, the optimized abnormality threshold is as follows Table 5.

According to the initial abnormality threshold and the optimized abnormality threshold, the trading data is anomalously detected. The detection accuracy rate is as follows Table 6.

From Table 6, we can see that, except for the transaction volume threshold, the transaction success rate and response time anomaly detection accuracy rate are significantly improved, indicating that the optimization anomaly threshold has better properties than the initial anomaly threshold.