CN103164319A - Method of detecting and analyzing activity of application program - Google Patents
Method of detecting and analyzing activity of application program Download PDFInfo
- Publication number
- CN103164319A CN103164319A CN2011104255881A CN201110425588A CN103164319A CN 103164319 A CN103164319 A CN 103164319A CN 2011104255881 A CN2011104255881 A CN 2011104255881A CN 201110425588 A CN201110425588 A CN 201110425588A CN 103164319 A CN103164319 A CN 103164319A
- Authority
- CN
- China
- Prior art keywords
- application program
- activity
- time
- application
- program
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
Images
Landscapes
- Debugging And Monitoring (AREA)
Abstract
The invention discloses a method of detecting and analyzing activity of an application program. The method is characterized by comprising the steps of detecting and analyzing key indexes at operation time of the application program, comparing program activity time with overall time of program operation, and accounting and analyzing the activity of the application program through a mathematical model. In the operation process of the program, once one or a plurality of key indexes change, the application program is judged to be in an activity state, and therefore time is calculated in effective activity time, and once one or a plurality of key indexes do not change, the application program is judged to be in an non-activity state, and therefore time is not calculated in the effective activity time. The method is conducted in a dynamic monitoring and analyzing mode, and identifies whether a user operate the application program through detection of the key indexes of the application program, and therefore a set of evaluation statistical system can be set up, and requirements of enterprises and public institutions for evaluation systems are met.
Description
Technical field
The invention belongs to computer network communication safety technique field, relate in particular to a kind of the detection and the method for analysis application activity.
Background technology
Along with informationalized development, computing machine has had influence on different social sectors, becomes requisite instrument in people work, studying and living, especially in the generally use of workplace.For the enterprise customer, the universal use with computing machine can effectively be improved employee's work efficiency and work quality as the with no paper work of carrier, reduces enterprise cost and drops into, and makes enterprise can tackle more timely turn of the market.Simultaneously, abundant due to computer utility, also diversification more of the operation of employee on notebook, the employee may the working time go to be engaged in play games, thing that chat etc. and work are irrelevant.How effectively going to pass judgment on employee's work efficiency, is the key subjects that enterprise administrator faces.
In present checking system, statistics for staffing effectiveness, the line duration that generally is based on application program is added up, computation schema due to the computing machine multitask, the employee may open application program rear until After Hours just close, examination lacks degree of accuracy like this, is easy to avoid for the employee.
Summary of the invention
The invention provides a kind of also method of analysis application activity that detects, adopt the Dynamic Changes Analysis method, whether go to identify the user at operating application program by the detection of application programs key index, thereby can set up the examination statistics system of a cover, satisfy the requirement of enterprises and institutions' checking system.
To achieve these goals, the present invention adopts following technical scheme:
A kind of also method of analysis application activity that detects, wherein, described method comprises: when moving by application programs, key index detects and analyzes, program activity time and program operation are compared T.T., utilize mathematical model application programs activity to add up and analyze.
Further, when application program is moved, related key index detects and preserves, in program operation process, in case one or more key index changes, judge that application program is in active state, thus with Time Calculation in Effective activity time; If obvious change does not occur in application program related one or more key indexs in operation is shone, assert that application program is in inactive state, its time of this moment will not calculate in Effective activity time.
Whether movable key index is made of following described decision procedure:
System resource: comprise the resource indexs such as cpu busy percentage, internal memory;
Process: comprise the indexs such as the involved a plurality of processes of application program, process group;
Dll file: involved software or system's dll file when comprising application call;
Thread: comprise application program involved thread activity state index in service;
Further, program operation begin timing when T.T. beginning to create process with program and with it as the start time, with process end up being sign and with it as the concluding time, thereby can calculate T.T. of application program operation,
The end mark of process comprises:
Normally withdraw from: the process that causes due to the application program normal termination normally withdraws from;
Extremely withdraw from: improper the closing of program process that causes due to emergency case;
Other: because the process that the operating system reason causes is closed, comprise outage, blue screen etc.;
Further, system only has single application program when operation if detect when detecting key index, and its effective time is in application program activity effective time; If a plurality of application programs are arranged when operation, its time calculates separately, but effective time is all effective for a plurality of application programs;
Further, for single application program, the main metering formula that adopts of its Efficiency Statistics is:
In formula, the meaning that represents of each symbol is:
P1%: the number percent that accounts for total run time for the application program activity time;
N: the number of times of application program counting when the application program activity analysis;
An: be the timing of a single activity time of application program;
An: when a plurality of application program activity is arranged, the timing of an activity time of application program;
Tn: be the timing of a working time of single application program;
Further, for a plurality of application programs, the main metering formula that adopts of its total efficiency statistics is:
In formula, the meaning that represents of each symbol is:
P2%: the number percent that accounts for the total activity time for application program;
N: the number of times of application program counting when the application program activity analysis;
An (Bn ...): be the timing of a single activity time of application program;
An (bn ...): when a plurality of application program activity is arranged, the timing of application program activity time.
The invention provides a kind of also method of analysis application activity that detects, adopt the Dynamic Changes Analysis method, whether go to identify the user at operating application program by the detection of application programs key index, thereby can set up the examination statistics system of a cover, satisfy the requirement of enterprises and institutions' checking system.
Description of drawings
Fig. 1 is the detection method step schematic diagram of application program activity provided by the invention;
Fig. 2 is the statistical analysis technique step schematic diagram of application program activity provided by the invention;
Embodiment
Describe the present invention in detail below in conjunction with accompanying drawing, it illustrates principle of the present invention as the part of this instructions by embodiment, other aspects of the present invention, and feature and advantage thereof will become very clear by this detailed description.
As shown in Figure 1, 2, a kind of also method of analysis application activity that detects provided by the invention, wherein, described method comprises: when moving by application programs, key index detects and analyzes, program activity time and program operation are compared T.T., utilize mathematical model application programs activity to add up and analyze.
Further, when application program is moved, related key index detects and preserves, in program operation process, in case one or more key index changes, judge that application program is in active state, thus with Time Calculation in Effective activity time; If obvious change does not occur in application program related one or more key indexs in operation is shone, assert that application program is in inactive state, its time of this moment will not calculate in Effective activity time.
Whether movable key index is made of following described decision procedure:
System resource: comprise the resource indexs such as cpu busy percentage, internal memory;
Process: comprise the indexs such as the involved a plurality of processes of application program, process group;
Dll file: involved software or system's dll file when comprising application call;
Thread: comprise application program involved thread activity state index in service;
Further, program operation begin timing when T.T. beginning to create process with program and with it as the start time, with process end up being sign and with it as the concluding time, thereby can calculate T.T. of application program operation,
The end mark of process comprises:
Normally withdraw from: the process that causes due to the application program normal termination normally withdraws from;
Extremely withdraw from: improper the closing of program process that causes due to emergency case;
Other: because the process that the operating system reason causes is closed, comprise outage, blue screen etc.;
Further, system only has single application program when operation if detect when detecting key index, and its effective time is in application program activity effective time; If a plurality of application programs are arranged when operation, its time calculates separately, but effective time is all effective for a plurality of application programs;
Further, for single application program, the main metering formula that adopts of its Efficiency Statistics is:
In formula, the meaning that represents of each symbol is:
P1%: the number percent that accounts for total run time for the application program activity time;
N: the number of times of application program counting when the application program activity analysis;
An: be the timing of a single activity time of application program;
An: when a plurality of application program activity is arranged, the timing of an activity time of application program;
Tn: be the timing of a working time of single application program;
Further, for a plurality of application programs, the main metering formula that adopts of its total efficiency statistics is:
In formula, the meaning that represents of each symbol is:
P2%: the number percent that accounts for the total activity time for application program;
N: the number of times of application program counting when the application program activity analysis;
An (Bn ...): be the timing of a single activity time of application program;
An (bn ...): when a plurality of application program activity is arranged, the timing of application program activity time.
As shown in Figure 1, be below the specific descriptions of the detection method of a kind of application program activity of the present invention, step is as follows:
1) by system process is scanned, in case there is new process to occur, its related key index is followed the trail of, simultaneously its state is labeled as S1, application program number of run n=0, application program operation T.T. T1=0, the single utility program Effective activity time is A1=0, the multiple utility program Effective activity time is designated as a1=0;
Key technical index when 2) moving by application programs is carried out real-time listening, simultaneously its state (S2) is compared with S1;
3) if index changes, S1, n, A1, a 1 does not all change, and application program operation T.T. T1 carries out effective timing;
4) only have the related index of this application program to change if find when monitoring, the key index that state (S2) is at this moment related to is given S1, this moment, application program number of run n did not change, application program operation T.T. T1 effectively upgrades, single utility program Effective activity time A1 effectively upgrades, and multiple utility program Effective activity time a1 does not change;
5) if find to have the related index of a plurality of application programs that all changes occur when monitoring, the key index that state (S2) is at this moment related to is given S1, this moment, application program number of run n did not change, application program operation T.T. T1 effectively upgrades, single utility program Effective activity time A1 effectively upgrades, and multiple utility program Effective activity time a1 effectively upgrades;
6) if the system that detects withdraws from (normally or extremely withdrawing from), state parameter (S1, S2) is emptied, application program number of run n is updated to 1, application program operation T.T. T1 preserves, single utility program Effective activity time A1 preserves, and multiple utility program Effective activity time a1 preserves;
7) system scan of repeating step (1) detects, then the data in step (6) are read, data in step (1) are upgraded (n is updated to 1 application program operation T.T. T2=0, the single utility program Effective activity time is A2=0, the multiple utility program Effective activity time is designated as a2=0), repeating step (2)--step (6) then.
As shown in Figure 2, be below the specific descriptions of the statistical analysis technique of a kind of application program activity of the present invention, step is as follows:
1) choose the Application Type of required statistics, simultaneously the n value of reading and saving;
2) with n since 0 counting, then to Effective activity time (being An, an) summation that adds up of single application program, until n is maximal value;
3) with n since 0 the counting, then to the summation that adds up the working time (being Tn) of single application program, until n is maximal value;
4) with n since 0 the counting, the then Effective activity time of application programs (being An, Bn..., an, the bn...) summation that adds up is until n is maximal value;
5) result that step (3) is calculated is the efficiency value of single utility program divided by the result that step (4) obtains;
6) result that step (3) is calculated is divided by the result that step (5) obtains the efficiency value that a certain application program is used at total activity.
The invention provides a kind of also method of analysis application activity that detects, adopt the Dynamic Changes Analysis method, whether go to identify the user at operating application program by the detection of application programs key index, thereby can set up the examination statistics system of a cover, satisfy the requirement of enterprises and institutions' checking system.
Above disclosed is only the preferred embodiments of the present invention, certainly can not limit with this interest field of the present invention, and the equivalent variations of therefore doing according to the present patent application the scope of the claims still belongs to the scope that the present invention is contained.
Claims (7)
1. one kind is detected the also method of analysis application activity, it is characterized in that, described method comprises: when moving by application programs, key index detects and analyzes, program activity time and program operation are compared T.T., utilize mathematical model application programs activity to add up and analyze.
2. the method for detection as claimed in claim 1 and analysis application activity, it is characterized in that, when application program is moved, related key index detects and preserves, in program operation process, in case one or more key indexs change, judge that application program is in active state, thus with Time Calculation in Effective activity time; If obvious change does not occur in application program related one or more key indexs in operation is shone, assert that application program is in inactive state, its time of this moment will not calculate in Effective activity time.
3. the method for detection as claimed in claim 1 or 2 and analysis application activity, is characterized in that, whether movable key index is made of following described decision procedure:
System resource: comprise the resource indexs such as cpu busy percentage, internal memory;
Process: comprise the indexs such as the involved a plurality of processes of application program, process group;
Dll file: involved software or system's dll file when comprising application call;
Thread: comprise application program involved thread activity state index in service.
4. the method for detection as claimed in claim 1 and analysis application activity, it is characterized in that, program operation begin timing when T.T. beginning to create process with program and with it as the start time, with process end up being the sign and with it as the concluding time, thereby can calculate the T.T. of application program operation
The end mark of process comprises:
Normally withdraw from: the process that causes due to the application program normal termination normally withdraws from;
Extremely withdraw from: improper the closing of program process that causes due to emergency case;
Other: because the process that the operating system reason causes is closed, comprise outage, blue screen etc.
5. the method for detection as claimed in claim 1 and analysis application activity, is characterized in that, system only has single application program when operation if detect when detecting key index, and its effective time is in application program activity effective time; If a plurality of application programs are arranged when operation, its time calculates separately, but effective time is all effective for a plurality of application programs.
6. the method for detection as claimed in claim 1 and analysis application activity, is characterized in that, for single application program, the main metering formula that adopts of its Efficiency Statistics is:
In formula, the meaning that represents of each symbol is:
P1%: the number percent that accounts for total run time for the application program activity time;
N: the number of times of application program counting when the application program activity analysis;
An: be the timing of a single activity time of application program;
An: when a plurality of application program activity is arranged, the timing of an activity time of application program;
Tn: be the timing of a working time of single application program.
7. the method for detection as claimed in claim 1 and analysis application activity, is characterized in that, for a plurality of application programs, the main metering formula that adopts of its total efficiency statistics is:
In formula, the meaning that represents of each symbol is:
P2%: the number percent that accounts for the total activity time for application program;
N: the number of times of application program counting when the application program activity analysis;
An (Bn ...): be the timing of a single activity time of application program;
An (bn ...): when a plurality of application program activity is arranged, the timing of application program activity time.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN2011104255881A CN103164319A (en) | 2011-12-19 | 2011-12-19 | Method of detecting and analyzing activity of application program |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN2011104255881A CN103164319A (en) | 2011-12-19 | 2011-12-19 | Method of detecting and analyzing activity of application program |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN103164319A true CN103164319A (en) | 2013-06-19 |
Family
ID=48587425
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN2011104255881A Pending CN103164319A (en) | 2011-12-19 | 2011-12-19 | Method of detecting and analyzing activity of application program |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN103164319A (en) |
Cited By (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN106250289A (en) * | 2016-08-01 | 2016-12-21 | 珠海格力电器股份有限公司 | The treating method and apparatus of application program |
| CN110493075A (en) * | 2019-08-01 | 2019-11-22 | 京信通信系统（中国）有限公司 | The method, apparatus and system of equipment on-line duration monitoring |
Citations (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| WO2008005334A2 (en) * | 2006-06-30 | 2008-01-10 | American Express Travel Related Services Company, Inc. | Availability tracker |
| CN101349987A (en) * | 2007-07-19 | 2009-01-21 | 精品科技股份有限公司 | Statistical analysis method of computer using condition |
| CN101599140A (en) * | 2008-06-02 | 2009-12-09 | 鸿富锦精密工业（深圳）有限公司 | The system and method that daily record of work generates automatically |
-
2011
- 2011-12-19 CN CN2011104255881A patent/CN103164319A/en active Pending
Patent Citations (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| WO2008005334A2 (en) * | 2006-06-30 | 2008-01-10 | American Express Travel Related Services Company, Inc. | Availability tracker |
| CN101349987A (en) * | 2007-07-19 | 2009-01-21 | 精品科技股份有限公司 | Statistical analysis method of computer using condition |
| CN101599140A (en) * | 2008-06-02 | 2009-12-09 | 鸿富锦精密工业（深圳）有限公司 | The system and method that daily record of work generates automatically |
Non-Patent Citations (1)
| Title |
|---|
| 互普: "网络行为管理", 《HTTP://WWW.HUPU.NET/PROJECT/PROJECT_2.ASP》, 30 July 2005 (2005-07-30), pages 1 - 3 * |
Cited By (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN106250289A (en) * | 2016-08-01 | 2016-12-21 | 珠海格力电器股份有限公司 | The treating method and apparatus of application program |
| CN110493075A (en) * | 2019-08-01 | 2019-11-22 | 京信通信系统（中国）有限公司 | The method, apparatus and system of equipment on-line duration monitoring |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| WO2020038353A1 (en) | Abnormal behavior detection method and system | |
| CN102946468A (en) | Automatic mobile phone operating program abnormality alarming method and system | |
| CN102736725B (en) | A kind of energy saving of hard disks control method, device and central processing unit | |
| CN107301118B (en) | A kind of fault indices automatic marking method and system based on log | |
| JP2007094850A (en) | Communication analyzing device and method | |
| CN108717510A (en) | A kind of method, system and terminal by clustering file abnormal operation behavior | |
| Bornholt et al. | The model is not enough: Understanding energy consumption in mobile devices | |
| CN109933984A (en) | A kind of best cluster result screening technique, device and electronic equipment | |
| US8286192B2 (en) | Kernel subsystem for handling performance counters and events | |
| Zhang et al. | Taskinsight: A fine-grained performance anomaly detection and problem locating system | |
| Canali et al. | Automated clustering of VMs for scalable cloud monitoring and management | |
| US20170091454A1 (en) | Lbr-based rop/jop exploit detection | |
| CN110399377A (en) | Optimization method, device, electronic equipment and the computer readable storage medium of SQL | |
| WO2019029149A1 (en) | Insurance policy-type status information counting method, terminal apparatus and storage medium | |
| CN109344078A (en) | Using the embedded real-time operating system time performance test method of FPGA | |
| CN103034577B (en) | A kind ofly locate shutdown slow method and device | |
| CN105574666A (en) | Method and device for evaluating credit level of enterprise based on key data modeling | |
| CN114386034A (en) | Dynamic iterative multi-engine fusion malicious code detection method, device and medium | |
| CN102982037A (en) | Database node health condition detection method and detection device | |
| CN109086149A (en) | A kind of method that micro services interface calls analysis of central issue | |
| CN103164319A (en) | Method of detecting and analyzing activity of application program | |
| CN113949652B (en) | User abnormal behavior detection method and device based on artificial intelligence and related equipment | |
| CN102254096A (en) | Electronic intelligent examination system | |
| CN109995751A (en) | Equipment for surfing the net labeling method, device and storage medium, computer equipment | |
| CN107665260A (en) | A kind of log collection instrument based on Linux system |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| C06 | Publication | ||
| PB01 | Publication | ||
| C10 | Entry into substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| C02 | Deemed withdrawal of patent application after publication (patent law 2001) | ||
| WD01 | Invention patent application deemed withdrawn after publication |
Application publication date: 20130619 |