CN108647997A - A kind of method and device of detection abnormal data - Google Patents
A kind of method and device of detection abnormal data Download PDFInfo
- Publication number
- CN108647997A CN108647997A CN201810331315.2A CN201810331315A CN108647997A CN 108647997 A CN108647997 A CN 108647997A CN 201810331315 A CN201810331315 A CN 201810331315A CN 108647997 A CN108647997 A CN 108647997A
- Authority
- CN
- China
- Prior art keywords
- feature
- testing data
- data
- example combinations
- time window
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q30/00—Commerce
- G06Q30/02—Marketing; Price estimation or determination; Fundraising
- G06Q30/0201—Market modelling; Market analysis; Collecting market data
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q30/00—Commerce
- G06Q30/02—Marketing; Price estimation or determination; Fundraising
- G06Q30/0201—Market modelling; Market analysis; Collecting market data
- G06Q30/0203—Market surveys; Market polls
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q30/00—Commerce
- G06Q30/02—Marketing; Price estimation or determination; Fundraising
- G06Q30/0282—Rating or review of business operators or products
Landscapes
- Business, Economics & Management (AREA)
- Strategic Management (AREA)
- Engineering & Computer Science (AREA)
- Accounting & Taxation (AREA)
- Development Economics (AREA)
- Finance (AREA)
- Entrepreneurship & Innovation (AREA)
- Game Theory and Decision Science (AREA)
- Economics (AREA)
- Marketing (AREA)
- Physics & Mathematics (AREA)
- General Business, Economics & Management (AREA)
- General Physics & Mathematics (AREA)
- Theoretical Computer Science (AREA)
- Data Mining & Analysis (AREA)
- Information Retrieval, Db Structures And Fs Structures Therefor (AREA)
Abstract
The application provides a kind of method and device of detection abnormal data, and method includes：A plurality of testing data is obtained, includes multiple features in every testing data, and each feature includes signature identification and characteristic value；The unrelated feature combination of internal feature is generated according to the signature identification of a plurality of testing data；History feature example combinations are generated respectively according to the characteristic value of a plurality of testing data and feature combination；The statistical information of the preset kind of testing data described in each item is calculated according to the history feature example combinations；Determine whether testing data described in each item is abnormal according to the statistical information.The application can improve the accuracy rate of anomaly data detection, realize unsupervised anomaly data detection, without relying on positive negative sample, can simplify the process of anomaly data detection, improve detection efficiency.
Description
Technical field
This application involves technical field of data processing more particularly to a kind of method and devices of detection abnormal data.
Background technology
With the development of Internet technology, the quantity also sharp increase of network trading.Customer is led to before online purchase commodity
The evaluation information after sale that certain commodity can often be browsed, to judge the quality of the commodity according to the evaluation of history buyer, and then decision is
No purchase commodity.However, some bad businessmans by way of " brush is single ", forge the evaluation information after sale of magnanimity, interference cares for
Accurate judgement of the visitor to commodity.It thus accurately detects abnormal datas such as " brush are single ", the unreal letter of evaluation after sale can be eliminated
Breath, the sales behavior of management and control and specification businessman, and then protect the equity of consumer.
Existing anomaly data detection scheme be typically based on single features carry out anomaly data detection, and internet attack,
The events such as fraud typically exhibit group feature, and the accuracy that single features carry out the scheme of anomaly data detection is low, it is difficult to send out
Existing malicious user group.
Invention content
In view of this, the application provides a kind of method and device of detection abnormal data, it is abnormal based on the detection of multiple features
Data, it is ensured that the accuracy of anomaly data detection.
Specifically, the application is achieved by the following technical solution：
According to the first aspect of the application, it is proposed that a method of detection abnormal data, including：
A plurality of testing data is obtained, includes multiple features in every testing data, and each feature includes feature mark
Knowledge and characteristic value；
The unrelated feature combination of internal feature is generated according to the signature identification of a plurality of testing data；
History feature example combinations are generated respectively according to the characteristic value of a plurality of testing data and feature combination；
The statistical information of the preset kind of testing data described in each item is calculated according to the history feature example combinations；
Determine whether testing data described in each item is abnormal according to the statistical information.
In one embodiment, described that the unrelated feature of internal feature is generated according to the signature identification of a plurality of testing data
Combination, including：
The correlation between each two signature identification in the signature identification of a plurality of testing data is calculated, feature is generated and closes
It is matrix；
The unrelated feature combination of internal feature is generated according to the feature relationship matrix.
In one embodiment, in the signature identification for calculating a plurality of testing data between each two signature identification
Correlation, including：
The mutual information between the signature identification of each two feature in the multiple feature is calculated, by the calculating of the mutual information
As a result the correlation being determined as between the signature identification of described two features；Or,
The conditional entropy between the signature identification of each two feature in the multiple feature is calculated, by the calculating of the conditional entropy
As a result the correlation being determined as between the signature identification of described two features.
In one embodiment, described to generate go through respectively according to the characteristic value of a plurality of testing data and feature combination
History feature example combinations, including：
The a plurality of testing data is divided based on preset time window size, obtains the to be measured of M time window
Data, each M time window includes 1 actual time window and (M-1) a historical time window；
According to the testing data of actual time window and the feature combination producing current signature example combinations；
The testing data of each historical time window is filtered according to the current signature example combinations, was obtained
Testing data after filter；
History feature example combinations are generated according to the filtered testing data and the current signature example combinations.
In one embodiment, described to determine whether testing data described in each item is abnormal according to the statistical information, including：
Integration processing is carried out to the statistical information of a variety of preset kinds, obtains integrated results；
The integrated results and the predetermined threshold value are compared；
If the integrated results are more than the predetermined threshold value, it is determined that the corresponding testing data of the integrated results is abnormal
Data.
In one embodiment, the method further includes using in missing values processing, noise data filtering and feature coding
At least one a plurality of testing data to acquisition pre-processes；
It is described that the unrelated feature combination of internal feature is generated according to the signature identification of a plurality of testing data, including：
The unrelated feature combination of internal feature is generated according to the signature identification of pretreated a plurality of testing data.
According to the second aspect of the application, it is proposed that a kind of device of detection abnormal data, including：
Testing data acquisition module includes multiple features in every testing data for obtaining a plurality of testing data,
And each feature includes signature identification and characteristic value；
Feature combination producing module, it is unrelated for generating internal feature according to the signature identification of a plurality of testing data
Feature combines；
Example combinations generation module, for being given birth to respectively according to the characteristic value of a plurality of testing data and feature combination
At history feature example combinations；
Statistical information computing module, for calculating the pre- of testing data described in each item according to the history feature example combinations
If the statistical information of type；
Anomaly data detection module, for determining whether testing data described in each item is abnormal according to the statistical information.
In one embodiment, the example combinations generation module includes：
Testing data division unit divides a plurality of testing data for being based on preset time window size,
The testing data of M time window is obtained, each M time window includes 1 actual time window and (M-1) is a goes through
History time window；
Present combination generation unit, for current according to the testing data of actual time window and the feature combination producing
Feature example combinations；
Historical data filter element, for being waited for each historical time window according to the current signature example combinations
Measured data is filtered, and obtains filtered testing data；
Example combinations generation unit, for being given birth to according to the filtered testing data and the current signature example combinations
At history feature example combinations.
According to the third aspect of the application, it is proposed that a kind of equipment of detection abnormal data, which is characterized in that including：
Processor；
It is configured as the memory of storage processor-executable instruction；
Wherein, the processor is configured as the method for executing any of the above-described detection abnormal data.
According to the fourth aspect of the application, it is proposed that a kind of computer readable storage medium, the storage medium are stored with
Computer program, the method that the computer program is used to execute any of the above-described detection abnormal data.By the above technology
Scheme is as it can be seen that the application generates inside by obtaining a plurality of testing data, and according to the signature identification of a plurality of testing data
The unrelated feature combination of feature, history feature is generated according to the characteristic value of a plurality of testing data and feature combination respectively
Example combinations, and the statistical information of the preset kind of testing data described in each item is calculated according to the history feature example combinations,
And then determine whether testing data described in each item is abnormal according to the statistical information, it may be implemented based on " whole unrelated feature
Combine and generate correlation phenomenon on local value " excavation carry out anomaly data detection, also, by increasing characteristic dimension,
The accuracy rate that anomaly data detection can be improved realizes unsupervised anomaly data detection, due to needing not rely upon positive negative sample,
The process that anomaly data detection can be simplified improves the efficiency of anomaly data detection.
Description of the drawings
Fig. 1 is a kind of flow chart of the method for detection abnormal data shown in one exemplary embodiment of the application；
Fig. 2 is how internal according to the generation of the signature identification of a plurality of testing data shown in one exemplary embodiment of the application
The flow chart of the unrelated feature combination of feature；
Fig. 3 is how to be combined according to the characteristic value and feature of a plurality of testing data shown in one exemplary embodiment of the application
The flow chart of history feature example combinations is generated respectively；
Fig. 4 is how according to statistical information to determine whether each testing data be different shown in one exemplary embodiment of the application
Normal flow chart；
Fig. 5 is a kind of flow chart of the method for detection abnormal data shown in the application another exemplary embodiment；
Fig. 6 is a kind of structure diagram of the device of detection abnormal data shown in one exemplary embodiment of the application；
A kind of structure diagram of the device of detection abnormal data shown in Fig. 7 the application another exemplary embodiments；
A kind of structure diagram of the equipment of detection abnormal data shown in one exemplary embodiment of Fig. 8 the application.
Specific implementation mode
Example embodiments are described in detail here, and the example is illustrated in the accompanying drawings.Following description is related to
When attached drawing, unless otherwise indicated, the same numbers in different drawings indicate the same or similar elements.Following exemplary embodiment
Described in embodiment do not represent all embodiments consistent with the application.On the contrary, they be only with it is such as appended
The example of consistent device and method of some aspects be described in detail in claims, the application.
It is the purpose only merely for description specific embodiment in term used in this application, is not intended to be limiting the application.
It is also intended to including majority in the application and "an" of singulative used in the attached claims, " described " and "the"
Form, unless context clearly shows that other meanings.It is also understood that term "and/or" used herein refers to and wraps
Containing one or more associated list items purposes, any or all may be combined.
It will be appreciated that though various information, but this may be described using term first, second, third, etc. in the application
A little information should not necessarily be limited by these terms.These terms are only used for same type of information being distinguished from each other out.For example, not departing from
In the case of the application range, the first information can also be referred to as the second information, and similarly, the second information can also be referred to as
One information.Depending on context, word as used in this " if " can be construed to " ... when " or " when ...
When " or " in response to determination ".
Fig. 1 is a kind of flow chart of the method for detection abnormal data shown in one exemplary embodiment of the application；The implementation
Example can be used for terminal device (for example, smart mobile phone, tablet computer and desk-top notebook etc.), can be used for server-side (example
Such as, the server cluster etc. of a server and multiple servers composition).As shown in Figure 1, the method comprising the steps of S101-
S105：
S101：A plurality of testing data is obtained, includes multiple features in every testing data, and each feature includes spy
Sign mark and characteristic value.
In one embodiment, above-mentioned testing data can be transaction data, such as order data, the present embodiment to this not into
Row limits.
In one embodiment, if testing data is transaction data, the multiple features for including in testing data may include
Transaction event identifies (e.g., order number), user identifier (e.g., user name), shops's mark (e.g., shops number), user equipment model
(e.g., apple iphoneX, Huawei Mate10 etc.), user geographical location (e.g., Shanghai, Beijing etc.) and shops geographical location
(e.g., Shanghai, Beijing etc.).
It is worth noting that the feature of above-mentioned testing data can be carried by developer according to different business scenarios
It takes, the present embodiment is to this without limiting.
In one embodiment, above-mentioned a plurality of transaction data can be handled as the form of following table one：
Table one
Wherein, Tid is the unique mark of transaction event, and Userid is user identifier, and Features is every transaction data
The feature that can be extracted in (or every order).
It is worth noting that above-mentioned transaction data allows the missing there are partial value, as Tid=2 transaction data in, not
User geographical location is got, therefore user geographical location can be sky.
As shown in upper table one, each feature of above-mentioned transaction data includes signature identification and characteristic value, with feature " door
Shop id:For 123 ", then its signature identification is " shops id ", and characteristic value is " 123 ", and the structure of other features is similar, herein not
It is repeated.
S102：The unrelated feature combination of internal feature is generated according to the signature identification of a plurality of testing data.
It in one embodiment, can be according to the feature mark of a plurality of testing data after obtaining above-mentioned a plurality of testing data
Know the feature combination for generating internal feature unrelated (i.e. correlation is relatively low).
In one embodiment, features described above combination can be the correlation rule shaped like M → N, wherein M is respectively to be associated with N
Rule guide (antecedent or left-hand-side, LHS) and it is subsequent (consequent or right-hand-side,
RHS).For example, shops id → unit type, shops id → user geographical location+unit type and user geographical location+equipment type
Number → shops id etc..
By taking feature combines " shops id → user geographical location+unit type " as an example, if the phase of shops id → unit type
Closing property (relation) is 0.2, and the relation in shops id → user geographical location is 0.6, then " shops id → user's geography position
Set+unit type " take the maximum value 0.6 of above-mentioned feature correlation two-by-two, it is assumed that and the predetermined threshold value α of correlation takes 0.3, then the group
It is not the unrelated feature combination of internal feature to close " shops id → user geographical location+unit type ", can be filtered this out；And
Since the correlation that feature combines " shops id → unit type " is less than predetermined threshold value (0.2<0.3), thus the combination be internal
The unrelated feature combination of feature, can be retained.
In one embodiment, the unrelated feature combination of above-mentioned internal feature is that inside includes multiple features, and wherein every two
The unrelated feature combination of a feature.
It in one embodiment, can be by calculating the correlation in above-mentioned multiple features between each two feature, and by phase
Closing property is determined as unrelated less than two features of predetermined threshold value.
In one embodiment, the generating mode of the unrelated feature combination of above-mentioned internal feature is referring also to following Fig. 2 institutes
Show embodiment, herein first without being described in detail.
S103：It is real that history feature combination is generated respectively according to the characteristic value of a plurality of testing data and feature combination
Example.
It in one embodiment, can be to be measured by each in above-mentioned a plurality of testing data after generating features described above combination
The characteristic value of data combines with corresponding feature be associated respectively, generates history feature example combinations.
In one embodiment, above-mentioned a plurality of testing data can be divided according to preset time period, when obtaining different
Between section testing data, wherein include at least one testing data in each period.And then it can utilize apart from current time
The testing data of nearest period (i.e. current slot) generates current slot feature example combinations, and then current according to this
Period feature example combinations are filtered the testing data of the period (i.e. historical time section) except current slot, with
Outdated data in historical time section is filtered out, and then regenerates history feature example combinations.
In one embodiment, the generating mode of above-mentioned history feature example combinations can also be implemented with reference to shown in following Fig. 4
Example, herein first without being described in detail.
S104：The statistics letter of the preset kind of testing data described in each item is calculated according to the history feature example combinations
Breath.
It in one embodiment, can be according to the history feature example combinations after obtaining above-mentioned history feature example combinations
In data calculate the default statistical information of every testing data.
In one embodiment, above-mentioned default statistical information can be configured by developer according to practical business scene,
It is such as set as M → N and combines associated number of users, the associated number of users of M characteristic sets, M → N combination association users and M feature sets
It closes the ratio of associated number of users, be based on the calculated χ of historical rethinking2Etc., P-value values etc., the present embodiment to this not into
Row limits.
S105：Determine whether testing data described in each item is abnormal according to the statistical information.
It in one embodiment, can be by the default statistics after obtaining the default statistical information of above-mentioned each testing data
Information is compared with pre-set threshold value, however, it is determined that the statistical information is more than predetermined threshold value, then can determine that this is to be measured
Data are abnormal data, and then can the associated user of the abnormal data (groups of users) be determined as abnormal user (user group
Group), for example, brush single user (or brush single user group), and the associated event of the abnormal data (event group) is determined as different
Ordinary affair part (anomalous event group).
It is worth noting that if final calculated statistical information has been more than predetermined threshold value, can determine have occurred it is " whole
The unrelated feature of body is combined generates correlation phenomenon on local value ", and then this testing data can be determined as to abnormal number
According to.
In an embodiment, determine each testing data whether abnormal mode can also with reference to following embodiment illustrated in fig. 5,
Herein first without being described in detail.
Seen from the above description, the present embodiment is by obtaining a plurality of testing data, and according to a plurality of testing data
Signature identification generates the unrelated feature combination of internal feature, the characteristic value further according to a plurality of testing data and the feature group
It closes and generates history feature example combinations respectively, and testing data described in each item is calculated according to the history feature example combinations
The statistical information of preset kind, and then determine whether testing data described in each item is abnormal, may be implemented according to the statistical information
Anomaly data detection is carried out based on the excavation of " whole unrelated feature is combined generates correlation phenomenon on local value ", and
And by increase characteristic dimension, the accuracy rate of anomaly data detection can be improved, realize unsupervised anomaly data detection, by
In needing not rely upon positive negative sample, the process of anomaly data detection can be simplified, improve the efficiency of anomaly data detection.
Fig. 2 is how internal according to the generation of the signature identification of a plurality of testing data shown in one exemplary embodiment of the application
The flow chart of the unrelated feature combination of feature；The present embodiment on the basis of the above embodiments, with how according to a plurality of number to be measured
According to signature identification generate internal feature it is unrelated feature combination for illustrate.As shown in Fig. 2, in step S102
It is described that the unrelated feature combination of internal feature is generated according to the signature identification of a plurality of testing data, it may comprise steps of
S201-S202：
S201：The correlation between each two signature identification in the signature identification of a plurality of testing data is calculated, is generated
Feature relationship matrix.
In one embodiment, the element in features described above relational matrix can be the feature mark of two features of corresponding ranks
Correlation between knowledge.For example, the correlation in the signature identification of above-mentioned a plurality of testing data between each two signature identification
Property can be as shown in following table two：
Table two
| Shops id | Unit type | User geographical location | Shops geographical location | |
| Shops id | 1 | 0.2 | 0.6 | 1 |
| Unit type | 0.3 | 1 | 0.05 | 0.5 |
| User geographical location | 0.3 | 0.2 | 1 | 0.5 |
| Shops geographical location | 1 | 0.1 | 0.5 | 1 |
In one embodiment, the mutual information between the signature identification of each two feature in the multiple feature is calculated, by institute
The result of calculation for stating mutual information is determined as correlation between the signature identification of described two features；Or, calculating the multiple spy
The result of calculation of the conditional entropy is determined as described two features by the conditional entropy in sign between the signature identification of each two feature
Signature identification between correlation.
It is worth noting that the correlation between above-mentioned calculating each two signature identification is except through calculating each two feature
Signature identification between mutual information or conditional entropy except determining, can also choose other measurement sides according to actual needs
Formula, the present embodiment is to this without limiting.
S202：The unrelated feature combination of internal feature is generated according to the feature relationship matrix.
It in one embodiment, can be according to this feature relational matrix production Methods after generating features described above relational matrix
It is worth lower M ranks → N rank features combination, wherein M ranks internal feature is unrelated two-by-two, and N rank internal features are unrelated two-by-two, and in M ranks
Portion's arbitrary characteristics are all unrelated with N rank internal features；And feature combination meets following 3 conditions, x, y are characterized：
(a)、relation(x→y)<α&relation(y→x)<α；
(b)、relation(x→y)<α&relation(y→x)<α；
(c)、Y ∈ N, relation (x → y)<α.
Wherein, α is predetermined threshold value, is used to judge whether (be more than α to indicate with correlation with correlation between two features
Property).
It is worth noting that correlation between set M and N be relation (M → N)=Max (relation (x →
Y)), x ∈ M, y ∈ N, that is, the correlation between gathering are the maximum correlations of feature in feature combination.
Seen from the above description, each two feature in signature identification of the present embodiment by calculating a plurality of testing data
Correlation between mark generates feature relationship matrix, and generates the unrelated spy of internal feature according to the feature relationship matrix
Sign combination may be implemented to accurately generate the unrelated feature combination of internal feature, base established for the follow-up anomaly data detection that carries out
Plinth.
Fig. 3 is how to be combined according to the characteristic value and feature of a plurality of testing data shown in one exemplary embodiment of the application
The flow chart of history feature example combinations is generated respectively；The present embodiment on the basis of the above embodiments, with how according to a plurality of
Characteristic value and the feature combination of testing data illustrate for generating history feature example combinations respectively.Such as Fig. 3 institutes
Show, history feature group is generated according to the characteristic value of a plurality of testing data and feature combination respectively described in step S103
Example is closed, S301-S304 is may comprise steps of：
S301：The a plurality of testing data is divided based on preset time window size, obtains M time window
Testing data, each M time window include 1 actual time window (when i.e. apart from current time recently one
Between window) and M-1 historical time window.Wherein, M is positive integer.
In one embodiment, above-mentioned preset time window size can be set by developer according to actual business requirement
It sets, such as could be provided as 1 month, 1 season or 1 year etc., the present embodiment is to this without limiting.
S301：According to the testing data of actual time window and the feature combination producing current signature example combinations.
In one embodiment, features described above combination can be generated according to all or part of testing data currently obtained, this
Embodiment is to this without limiting.
It in one embodiment, can be according to the number to be measured of the actual time window of division after generating features described above combination
According to features described above combination producing current signature example combinations mi→nj, and miAssociation user number is more than predetermined threshold value θ.Citing comes
It says, the current signature example combinations of generation can be as shown in following table three：
Table three
S301：The testing data of each historical time window is filtered according to the current signature example combinations,
Obtain filtered testing data.
In one embodiment, after obtaining current signature example combinations, current signature example combinations can be utilized to history
The testing data of time window is filtered, to filter out the data (example for not meeting current practice in historical time window
Such as, corresponding transaction data of certain old unit types etc.).
S301：It is real that history feature combination is generated according to the filtered testing data and the current signature example combinations
Example.
In one embodiment, after the testing data to historical time window is filtered, can be according to the filtering after
Testing data and the current signature example combinations generate history feature example combinations.
For example, after the testing data to historical time window is filtered, can be based on filtered data with
Above-mentioned current signature example combinations mi→njGenerate the m of w time windowi→njFeature example combinations and then these determining combinations
The features such as user id and event id associated by example.
Seen from the above description, the present embodiment carries out a plurality of testing data by being based on preset time window size
Divide, obtain the testing data of actual time window and historical time window, and according to the testing data of actual time window and
The feature combination producing current signature example combinations, further according to the current signature example combinations to each historical time window
Mouthful testing data be filtered, obtain filtered testing data, and then according to the filtered testing data and described
Current signature example combinations generate history feature example combinations, and the data of current practice can not will be met in historical data
It filters out, operand can be greatly reduced, and then improve the efficiency being detected to abnormal data.
Fig. 4 is how according to statistical information to determine whether each testing data be different shown in one exemplary embodiment of the application
Normal flow chart；The present embodiment on the basis of the above embodiments, how to determine that each testing data is according to statistical information
It is illustrated for no exception.As shown in figure 4, being determined described in each item according to the statistical information described in step S105
Whether testing data is abnormal, may comprise steps of S401-S403：
S401：Integration processing is carried out to the statistical information of a variety of preset kinds, obtains integrated results.
In one embodiment, if calculating the statistical information of a variety of preset kinds for above-mentioned history feature example combinations,
Further integration processing can be carried out to a variety of statistical informations, to obtain a final integrated results.
In one embodiment, can be that corresponding weight is arranged in various types of statistical informations, and then can calculate in advance
The weighted sum of these statistical informations, and the weighted sum is determined as to final integrated results.
In one embodiment, the corresponding weight of above-mentioned various types of statistical informations can be by developer according to practical industry
Business needs to be configured, such as could be provided as identical weight or different weights, and the present embodiment is to this without limiting.
S402：The integrated results and the predetermined threshold value are compared.
In one embodiment, after obtaining above-mentioned integrated results, the integrated results and pre-set statistics can be believed
The predetermined threshold value of breath is compared, to determine whether data to be tested are abnormal according to the result of the comparison.
In one embodiment, the predetermined threshold value of above-mentioned statistical information can be carried out by developer according to actual business requirement
Setting, such as 0.5 is could be provided as, the present embodiment is to this without limiting.
S403：If the integrated results are more than the predetermined threshold value, it is determined that the corresponding testing data of the integrated results
For abnormal data.
In one embodiment, if obtained integrated results were 0.6 (being more than 0.5), it can determine that the integrated results correspond to
Testing data be abnormal data, and then determine the associated user of the abnormal data (or group) be abnormal user (or group),
Associated event (or group) is anomalous event (or group).
For example, if above-mentioned statistical information is the ratio that M → N combines association user and the associated number of users of M characteristic sets
Value, then the result of calculation of the statistical information can be as shown in following table four：
Table four
On this basis, if it is 0.5 to pre-set threshold value, " shops id can be determined:123 → unit type:
The corresponding testing datas of iPhoneX " are abnormal data.
Seen from the above description, the present embodiment carries out integration processing by the statistical information to a variety of preset kinds,
Integrated results are obtained, and the integrated results and the predetermined threshold value are compared, and then when the integrated results are more than institute
When stating predetermined threshold value, determines that the corresponding testing data of the integrated results is abnormal data, may be implemented true according to statistical information
Determine abnormal data, the accuracy rate and efficiency being detected to abnormal data can be improved.
In another embodiment, above-mentioned to determine that the whether abnormal mode of testing data described in each item also according to statistical information
It is realized based on the machine learning method for having supervision with using.
For example, the history feature example combinations that can be directed to a plurality of sample data calculate the statistics of a variety of preset kinds
Then information can carry out further integration processing, to obtain a final integrated results, Jin Erke to a variety of statistical informations
It is corresponding to mark every sample data each sample data to be marked according to the integrated results of every sample data
Whether groups of users is abnormal, as shown in following table five：
Table five
| Label | M | N | Relation | user_cnt(MN) | …… |
| 1 | m1 | n1 | relation(m1→n1) | user_cnt(m1n1) | …… |
| 0 | m2 | n2 | relation(m2→n2) | user_cnt(m2n2) | …… |
| … | … | … | … | …… | …… |
On this basis, statistical nature (such as user_cnt) and label value Label that can be based on each sample data
One grader of training, after the completion of the classifier training, can be used for determining abnormal user based on the statistical nature of testing data
Group.
It is worth noting that since various statistical natures are unrelated with business scenario, it is not much different in data distribution
Under the premise of, which is suitable for different scenes, different time window.Fig. 5 is that the application another exemplary embodiment is shown
A kind of detection abnormal data method flow chart；The embodiment can be used for terminal device (for example, smart mobile phone, tablet
Computer and desk-top notebook etc.), server-side is can be used for (for example, the server of a server and multiple servers composition
Cluster etc.).As shown in figure 5, the method comprising the steps of S501-S506：
S501：A plurality of testing data is obtained, includes multiple features in every testing data, and each feature includes spy
Sign mark and characteristic value.
S502：The a plurality of of acquisition is waited for using at least one of missing values processing, noise data filtering and feature coding
Measured data is pre-processed.
In one embodiment, after obtaining a plurality of testing data, which can be processed into identical lattice
Formula, and then when determining that each testing data has missing values, this testing data can be carried out missing values processing (such as with
Default value is supplemented or is directly disposed as in " sky " etc.).
In one embodiment, when determining that each testing data has noise, noise can be carried out to this testing data
Filtering, to execute subsequent step according to filtered data.
In one embodiment, coded treatment can also be carried out to the feature of each testing data, to reach authority data lattice
Formula shortens the purpose of data length, facilitates execution subsequent step.
S503：The unrelated feature combination of internal feature is generated according to the signature identification of pretreated a plurality of testing data.
S504：It is real that history feature combination is generated respectively according to the characteristic value of a plurality of testing data and feature combination
Example.
S505：The statistics letter of the preset kind of testing data described in each item is calculated according to the history feature example combinations
Breath.
S506：Determine whether testing data described in each item is abnormal according to the statistical information.
Wherein, the relevant explanation of above-mentioned steps S501, S503-S506 and explanation may refer to above-described embodiment, herein not
It is repeated.
Seen from the above description, the present embodiment is by using sides such as missing values processing, noise data filtering and feature codings
Formula pre-processes a plurality of testing data of acquisition, specification testing data format may be implemented, shorten testing data length etc.
Purpose facilitates and executes follow-up anomaly data detection step.
It is worth noting that above-mentioned all optional technical solutions, may be used the optional reality that any combination forms the disclosure
Example is applied, this is no longer going to repeat them.
Corresponding with the aforementioned detection embodiment of method of abnormal data, present invention also provides the dresses of detection abnormal data
The embodiment set.
Fig. 6 is a kind of structure diagram of the device of detection abnormal data shown in one exemplary embodiment of the application；Such as Fig. 6
Shown, which includes：Testing data acquisition module 110, feature combination producing module 120, example combinations generation module 130,
Statistical information computing module 140 and anomaly data detection module 150, wherein：
Testing data acquisition module 110 includes multiple spies in every testing data for obtaining a plurality of testing data
Sign, and each feature includes signature identification and characteristic value；
Feature combination producing module 120, for according to the signature identification of a plurality of testing data generate internal feature without
The feature of pass combines；
Example combinations generation module 130, for according to the characteristic value of a plurality of testing data and feature combination point
It Sheng Cheng not history feature example combinations；
Statistical information computing module 140, for calculating testing data described in each item according to the history feature example combinations
Preset kind statistical information；
Anomaly data detection module 150, for determining whether testing data described in each item is abnormal according to the statistical information.
Seen from the above description, the present embodiment is by obtaining a plurality of testing data, and according to a plurality of testing data
Signature identification generates the unrelated feature combination of internal feature, the characteristic value further according to a plurality of testing data and the feature group
It closes and generates history feature example combinations respectively, and testing data described in each item is calculated according to the history feature example combinations
The statistical information of preset kind, and then determine whether testing data described in each item is abnormal, may be implemented according to the statistical information
Anomaly data detection is carried out based on the excavation of " whole unrelated feature is combined generates correlation phenomenon on local value ", and
And by increase characteristic dimension, the accuracy rate of anomaly data detection can be improved, realize unsupervised anomaly data detection, by
In needing not rely upon positive negative sample, the process of anomaly data detection can be simplified, improve the efficiency of anomaly data detection.
A kind of structure diagram of the device of detection abnormal data shown in Fig. 7 the application another exemplary embodiments；Wherein,
Testing data acquisition module 210, feature combination producing module 230, example combinations generation module 240, statistical information computing module
250 and anomaly data detection module 260 combined with the testing data acquisition module 110 in aforementioned embodiment illustrated in fig. 6, feature
Generation module 120, example combinations generation module 130, statistical information computing module 140 and anomaly data detection module 150
Function is identical, herein without repeating.As shown in fig. 7, feature combination producing module 230 may include：
Relational matrix generation unit 231, each two feature mark in the signature identification for calculating a plurality of testing data
Correlation between knowledge generates feature relationship matrix；
Feature combination producing unit 232, for generating the unrelated feature group of internal feature according to the feature relationship matrix
It closes.
In one embodiment, relational matrix generation unit 231 can be also used for：
The mutual information between the signature identification of each two feature in the multiple feature is calculated, by the calculating of the mutual information
As a result the correlation being determined as between the signature identification of described two features；Or,
The conditional entropy between the signature identification of each two feature in the multiple feature is calculated, by the calculating of the conditional entropy
As a result the correlation being determined as between the signature identification of described two features.
In one embodiment, example combinations generation module 240 may include：
Testing data division unit 241 draws a plurality of testing data for being based on preset time window size
Point, the testing data of M time window is obtained, each M time window includes 1 actual time window and (M-1)
A historical time window；
Present combination generation unit 242 is used for the testing data according to actual time window and the feature combination producing
Current signature example combinations；
Historical data filter element 243 is used for according to the current signature example combinations to each historical time window
Testing data be filtered, obtain filtered testing data；
Example combinations generation unit 244, it is real for being combined according to the filtered testing data and the current signature
Example generates history feature example combinations.
In one embodiment, anomaly data detection module 260 may include：
Statistical Information Integration unit 261 carries out integration processing for the statistical information to a variety of preset kinds, obtains
Integrated results；
Integrated results comparison unit 262, for comparing the integrated results and the predetermined threshold value；
Abnormal data determination unit 263, for when the integrated results are more than the predetermined threshold value, determining the integration
As a result corresponding testing data is abnormal data.
In one embodiment, described device can also include：
Preprocessing module 220, for using at least one of missing values processing, noise data filtering and feature coding pair
The a plurality of testing data obtained is pre-processed；
On this basis, feature combination producing module 230 can be also used for according to pretreated a plurality of testing data
Signature identification generates the unrelated feature combination of internal feature.
It is worth noting that above-mentioned all optional technical solutions, may be used the optional reality that any combination forms the disclosure
Example is applied, this is no longer going to repeat them.
The embodiment of the device of the detection abnormal data of the present invention can be applied on network devices.Device embodiment can be with
By software realization, can also be realized by way of hardware or software and hardware combining.For implemented in software, patrolled as one
Device in volume meaning is by the processor of equipment where it by corresponding computer program instructions in nonvolatile memory
Read what operation in memory was formed, wherein computer program is used to execute the detection that above-mentioned Fig. 1~embodiment illustrated in fig. 5 provides
The method of abnormal data.For hardware view, as shown in figure 8, the hardware knot of the equipment for the detection abnormal data of the present invention
Composition, other than processor shown in Fig. 8, network interface, memory and nonvolatile memory, the equipment usually may be used also
To include other hardware, such as it is responsible for the forwarding chip of processing message；The equipment is also possible to be point from hardware configuration
The equipment of cloth may include multiple interface cards, to carry out the extension of Message processing in hardware view.
On the other hand, present invention also provides a kind of computer readable storage medium, storage medium is stored with computer journey
Sequence, the method that computer program is used to execute the detection abnormal data that above-mentioned Fig. 1~embodiment illustrated in fig. 5 provides.
For device embodiments, since it corresponds essentially to embodiment of the method, so related place is referring to method reality
Apply the part explanation of example.The apparatus embodiments described above are merely exemplary, wherein described be used as separating component
The unit of explanation may or may not be physically separated, and the component shown as unit can be or can also
It is not physical unit, you can be located at a place, or may be distributed over multiple network units.It can be according to actual
It needs that some or all of module therein is selected to realize the purpose of application scheme.Those of ordinary skill in the art are not paying
In the case of going out creative work, you can to understand and implement.
Those skilled in the art after considering the specification and implementing the invention disclosed here, will readily occur to its of the application
Its embodiment.This application is intended to cover any variations, uses, or adaptations of the application, these modifications, purposes or
Person's adaptive change follows the general principle of the application and includes the undocumented common knowledge in the art of the application
Or conventional techniques.The description and examples are only to be considered as illustrative, and the true scope and spirit of the application are by following
Claim is pointed out.
It should also be noted that, the terms "include", "comprise" or its any other variant are intended to nonexcludability
Including so that process, method, commodity or equipment including a series of elements include not only those elements, but also wrap
Include other elements that are not explicitly listed, or further include for this process, method, commodity or equipment intrinsic want
Element.In the absence of more restrictions, the element limited by sentence "including a ...", it is not excluded that wanted including described
There is also other identical elements in the process of element, method, commodity or equipment.
The foregoing is merely the preferred embodiments of the application, not limiting the application, all essences in the application
With within principle, any modification, equivalent substitution, improvement and etc. done should be included within the scope of the application protection god.
Claims (10)
1. a kind of method of detection abnormal data, which is characterized in that including：
Obtain a plurality of testing data, include multiple features in every testing data, and each feature include signature identification and
Characteristic value；
The unrelated feature combination of internal feature is generated according to the signature identification of a plurality of testing data；
History feature example combinations are generated respectively according to the characteristic value of a plurality of testing data and feature combination；
The statistical information of the preset kind of testing data described in each item is calculated according to the history feature example combinations；
Determine whether testing data described in each item is abnormal according to the statistical information.
2. according to the method described in claim 1, it is characterized in that, described give birth to according to the signature identification of a plurality of testing data
At the feature combination that internal feature is unrelated, including：
The correlation between each two signature identification in the signature identification of a plurality of testing data is calculated, characteristic relation square is generated
Battle array；
The unrelated feature combination of internal feature is generated according to the feature relationship matrix.
3. according to the method described in claim 2, it is characterized in that, in the signature identification for calculating a plurality of testing data
Correlation between each two signature identification, including：
The mutual information between the signature identification of each two feature in the multiple feature is calculated, by the result of calculation of the mutual information
The correlation being determined as between the signature identification of described two features；Or,
The conditional entropy between the signature identification of each two feature in the multiple feature is calculated, by the result of calculation of the conditional entropy
The correlation being determined as between the signature identification of described two features.
4. according to the method described in claim 1, it is characterized in that, the characteristic value and institute according to a plurality of testing data
It states feature combination and generates history feature example combinations respectively, including：
The a plurality of testing data is divided based on preset time window size, obtains the testing data of M time window,
Each M time window includes 1 actual time window and (M-1) a historical time window；
According to the testing data of actual time window and the feature combination producing current signature example combinations；
The testing data of each historical time window is filtered according to the current signature example combinations, after obtaining filtering
Testing data；
History feature example combinations are generated according to the filtered testing data and the current signature example combinations.
5. according to the method described in claim 1, it is characterized in that, it is described determined according to the statistical information it is to be measured described in each item
Whether data are abnormal, including：
Integration processing is carried out to the statistical information of a variety of preset kinds, obtains integrated results；
The integrated results and the predetermined threshold value are compared；
If the integrated results are more than the predetermined threshold value, it is determined that the corresponding testing data of the integrated results is abnormal number
According to.
6. according to the method described in claim 1, it is characterized in that, the method further includes using missing values processing, noise number
The a plurality of testing data of acquisition is pre-processed according at least one of filtering and feature coding；
It is described that the unrelated feature combination of internal feature is generated according to the signature identification of a plurality of testing data, including：
The unrelated feature combination of internal feature is generated according to the signature identification of pretreated a plurality of testing data.
7. a kind of device of detection abnormal data, which is characterized in that including：
Testing data acquisition module includes multiple features in every testing data, and every for obtaining a plurality of testing data
A feature includes signature identification and characteristic value；
Feature combination producing module, for generating the unrelated feature of internal feature according to the signature identification of a plurality of testing data
Combination；
Example combinations generation module, for generating go through respectively according to the characteristic value of a plurality of testing data and feature combination
History feature example combinations；
Statistical information computing module, the default class for calculating testing data described in each item according to the history feature example combinations
The statistical information of type；
Anomaly data detection module, for determining whether testing data described in each item is abnormal according to the statistical information.
8. device according to claim 7, which is characterized in that the example combinations generation module includes：
Testing data division unit divides a plurality of testing data for being based on preset time window size, obtains M
The testing data of a time window, when each M time window includes 1 actual time window and (M-1) a history
Between window；
Present combination generation unit is used for the testing data according to actual time window and the feature combination producing current signature
Example combinations；
Historical data filter element is used for according to the current signature example combinations to the number to be measured of each historical time window
According to being filtered, filtered testing data is obtained；
Example combinations generation unit, for being gone through according to the filtered testing data and current signature example combinations generation
History feature example combinations.
9. a kind of equipment of detection abnormal data, which is characterized in that it is characterised in that it includes：
Processor；
It is configured as the memory of storage processor-executable instruction；
Wherein, the processor is configured as the method for executing any detection abnormal datas of the claims 1-6.
10. a kind of computer readable storage medium, which is characterized in that the storage medium is stored with computer program, the meter
The method that calculation machine program is used to execute any detection abnormal datas of the claims 1-6.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201810331315.2A CN108647997A (en) | 2018-04-13 | 2018-04-13 | A kind of method and device of detection abnormal data |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201810331315.2A CN108647997A (en) | 2018-04-13 | 2018-04-13 | A kind of method and device of detection abnormal data |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN108647997A true CN108647997A (en) | 2018-10-12 |
Family
ID=63746023
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201810331315.2A Pending CN108647997A (en) | 2018-04-13 | 2018-04-13 | A kind of method and device of detection abnormal data |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN108647997A (en) |
Cited By (8)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN110033360A (en) * | 2019-03-11 | 2019-07-19 | 阿里巴巴集团控股有限公司 | Method for detecting abnormality, device and the equipment of fund flow data |
| CN110502714A (en) * | 2019-08-27 | 2019-11-26 | 北京达佳互联信息技术有限公司 | Method, apparatus, electronic equipment and the storage medium of infomation detection |
| CN110610598A (en) * | 2019-08-08 | 2019-12-24 | 横琴善泊投资管理有限公司 | Unmanned parking lot central control management system and method based on event mechanism |
| CN110647913A (en) * | 2019-08-15 | 2020-01-03 | 中国平安财产保险股份有限公司 | Abnormal data detection method and device based on clustering algorithm |
| CN110764944A (en) * | 2019-10-22 | 2020-02-07 | 东软睿驰汽车技术（沈阳）有限公司 | Anomaly detection method and device |
| WO2020143322A1 (en) * | 2019-01-08 | 2020-07-16 | 平安科技（深圳）有限公司 | User request detection method and apparatus, computer device, and storage medium |
| CN113067741A (en) * | 2020-01-02 | 2021-07-02 | 中国移动通信有限公司研究院 | Information processing method, device, terminal and storage medium |
| WO2022170853A1 (en) * | 2021-02-09 | 2022-08-18 | 北京沃东天骏信息技术有限公司 | Information generation method and apparatus, electronic device, and computer readable medium |
Citations (7)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN1564557A (en) * | 2004-04-15 | 2005-01-12 | 上海交通大学 | Intelligent maintenance system of colour spraying draught machine based on network |
| CN101470426A (en) * | 2007-12-27 | 2009-07-01 | 北京北方微电子基地设备工艺研究中心有限责任公司 | Fault detection method and system |
| CN102779281A (en) * | 2012-06-25 | 2012-11-14 | 同济大学 | Vehicle type identification method based on support vector machine and used for earth inductor |
| CN105005786A (en) * | 2015-06-19 | 2015-10-28 | 南京航空航天大学 | Texture image classification method based on BoF and multi-feature fusion |
| US9372893B2 (en) * | 2012-07-20 | 2016-06-21 | Alibaba Group Holding Limited | Method and system of ranking search results, and method and system of optimizing search result ranking |
| CN106557955A (en) * | 2016-11-29 | 2017-04-05 | 流量海科技成都有限公司 | Net about car exception order recognition methodss and system |
| CN107543588A (en) * | 2017-07-27 | 2018-01-05 | 成都亿盟恒信科技有限公司 | A kind of vehicle oil consumption monitoring method based on ultrasonic listening oil consumption fluctuation filtering |
-
2018
- 2018-04-13 CN CN201810331315.2A patent/CN108647997A/en active Pending
Patent Citations (7)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN1564557A (en) * | 2004-04-15 | 2005-01-12 | 上海交通大学 | Intelligent maintenance system of colour spraying draught machine based on network |
| CN101470426A (en) * | 2007-12-27 | 2009-07-01 | 北京北方微电子基地设备工艺研究中心有限责任公司 | Fault detection method and system |
| CN102779281A (en) * | 2012-06-25 | 2012-11-14 | 同济大学 | Vehicle type identification method based on support vector machine and used for earth inductor |
| US9372893B2 (en) * | 2012-07-20 | 2016-06-21 | Alibaba Group Holding Limited | Method and system of ranking search results, and method and system of optimizing search result ranking |
| CN105005786A (en) * | 2015-06-19 | 2015-10-28 | 南京航空航天大学 | Texture image classification method based on BoF and multi-feature fusion |
| CN106557955A (en) * | 2016-11-29 | 2017-04-05 | 流量海科技成都有限公司 | Net about car exception order recognition methodss and system |
| CN107543588A (en) * | 2017-07-27 | 2018-01-05 | 成都亿盟恒信科技有限公司 | A kind of vehicle oil consumption monitoring method based on ultrasonic listening oil consumption fluctuation filtering |
Cited By (11)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| WO2020143322A1 (en) * | 2019-01-08 | 2020-07-16 | 平安科技（深圳）有限公司 | User request detection method and apparatus, computer device, and storage medium |
| CN110033360A (en) * | 2019-03-11 | 2019-07-19 | 阿里巴巴集团控股有限公司 | Method for detecting abnormality, device and the equipment of fund flow data |
| CN110610598A (en) * | 2019-08-08 | 2019-12-24 | 横琴善泊投资管理有限公司 | Unmanned parking lot central control management system and method based on event mechanism |
| CN110610598B (en) * | 2019-08-08 | 2021-02-26 | 善泊科技(珠海)有限公司 | Unmanned parking lot central control management system and method based on event mechanism |
| CN110647913A (en) * | 2019-08-15 | 2020-01-03 | 中国平安财产保险股份有限公司 | Abnormal data detection method and device based on clustering algorithm |
| CN110647913B (en) * | 2019-08-15 | 2024-04-05 | 中国平安财产保险股份有限公司 | Abnormal data detection method and device based on clustering algorithm |
| CN110502714A (en) * | 2019-08-27 | 2019-11-26 | 北京达佳互联信息技术有限公司 | Method, apparatus, electronic equipment and the storage medium of infomation detection |
| CN110764944A (en) * | 2019-10-22 | 2020-02-07 | 东软睿驰汽车技术（沈阳）有限公司 | Anomaly detection method and device |
| CN113067741A (en) * | 2020-01-02 | 2021-07-02 | 中国移动通信有限公司研究院 | Information processing method, device, terminal and storage medium |
| WO2021136434A1 (en) * | 2020-01-02 | 2021-07-08 | 中国移动通信有限公司研究院 | Information processing method and apparatus, node device, server, and storage medium |
| WO2022170853A1 (en) * | 2021-02-09 | 2022-08-18 | 北京沃东天骏信息技术有限公司 | Information generation method and apparatus, electronic device, and computer readable medium |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN108647997A (en) | A kind of method and device of detection abnormal data | |
| Dey et al. | Estimating age privacy leakage in online social networks | |
| CN108156237A (en) | Product information method for pushing, device, storage medium and computer equipment | |
| CN106709318B (en) | A kind of recognition methods of user equipment uniqueness, device and calculate equipment | |
| CN103905532B (en) | The recognition methods of microblogging marketing account and system | |
| WO2019169704A1 (en) | Data classification method, apparatus, device and computer readable storage medium | |
| CN107292154A (en) | A kind of terminal feature recognition methods and system | |
| CN108932582A (en) | Risk information determines method, apparatus, computer equipment and storage medium | |
| CN108769026A (en) | User account detecting system and method | |
| CN110648180B (en) | Method and device for adjusting delivery channel and electronic equipment | |
| CN111090807A (en) | Knowledge graph-based user identification method and device | |
| CN106227743B (en) | Advertisement target group touching reaches ratio estimation method and device | |
| CN109308615B (en) | Real-time fraud transaction detection method, system, storage medium and electronic terminal based on statistical sequence characteristics | |
| CN109947814A (en) | Method and apparatus for the abnormal data group in detection data set | |
| CN109547426A (en) | Service response method and server | |
| CN108961019A (en) | A kind of detection method and device of user account | |
| CN108985048A (en) | Simulator recognition methods and relevant apparatus | |
| CN109313541A (en) | For showing and the user interface of comparison attacks telemetering resource | |
| CN104731937B (en) | The processing method and processing device of user behavior data | |
| CN115545103A (en) | Abnormal data identification method, label identification method and abnormal data identification device | |
| CN106257507A (en) | The methods of risk assessment of user behavior and device | |
| Irissappane et al. | A Framework to Choose Trust Models for Different E-Marketplace Environments. | |
| CN109063120A (en) | A kind of collaborative filtering recommending method and device based on cluster | |
| CN104933082B (en) | Evaluation information processing method and its device | |
| CN107665307A (en) | Application identification method and device, electronic equipment and storage medium |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| RJ01 | Rejection of invention patent application after publication | ||
| RJ01 | Rejection of invention patent application after publication |
Application publication date: 20181012 |