CN109034867A - click traffic detection method, device and storage medium - Google Patents
click traffic detection method, device and storage medium Download PDFInfo
- Publication number
- CN109034867A CN109034867A CN201810644161.2A CN201810644161A CN109034867A CN 109034867 A CN109034867 A CN 109034867A CN 201810644161 A CN201810644161 A CN 201810644161A CN 109034867 A CN109034867 A CN 109034867A
- Authority
- CN
- China
- Prior art keywords
- click
- logs
- frequency
- traffic
- measurement period
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q30/00—Commerce
- G06Q30/02—Marketing; Price estimation or determination; Fundraising
- G06Q30/0241—Advertisements
- G06Q30/0248—Avoiding fraud
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
- H04L63/1425—Traffic logging, e.g. anomaly detection
Landscapes
- Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Business, Economics & Management (AREA)
- Strategic Management (AREA)
- Computer Hardware Design (AREA)
- Computing Systems (AREA)
- General Engineering & Computer Science (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Accounting & Taxation (AREA)
- Development Economics (AREA)
- Finance (AREA)
- Entrepreneurship & Innovation (AREA)
- Game Theory and Decision Science (AREA)
- Economics (AREA)
- Marketing (AREA)
- Physics & Mathematics (AREA)
- General Business, Economics & Management (AREA)
- General Physics & Mathematics (AREA)
- Theoretical Computer Science (AREA)
- Management, Administration, Business Operations System, And Electronic Commerce (AREA)
- Data Exchanges In Wide-Area Networks (AREA)
Abstract
This application discloses a kind of click traffic detection methods, comprising: obtains the corresponding click time series of click traffic to be detected, the click time series includes the corresponding click volume of multiple default measurement periods；The click time series is subjected to time-frequency conversion, obtains frequency domain sequence, the frequency domain sequence includes the corresponding amplitude of multiple frequencies；According to the proportionate relationship in the amplitude for each frequency for being greater than frequency threshold in the frequency domain sequence and the frequency domain sequence between the amplitude of each frequency, determine whether the corresponding click traffic of the click time series is suspicious.Present invention also provides corresponding device and storage mediums.
Description
Technical field
This application involves Internet technical field more particularly to click traffic detection methods, device and storage medium.
Background technique
Currently, Internet advertising becomes advertisement with the rapid growth of Internet user's especially mobile interchange network users
The trend of rapid growth is also presented in the new form launched, the injected volume of Internet advertising.Most of Internet advertisings are to click
Meter takes, and under the driving of interests, exists and carries out malicious operation to the advertisement that flow upslide is put by the way of cheating, to be promoted
The behavior of click volume compromises the interests of advertiser.
For example, flow master provides a user various forms of Internet-based in the ecosystem of Internet advertising
Service (such as offer news, media play, game on line various forms), during user is using service ad system to
(webpage of application or user's access that such as user uses) launches advertisement in the service that user uses.When the user clicks when advertisement,
The click volume of advertisement increases, and the advertising resource that flow master is possessed based on itself is (such as the advertisement in application, the advertisement position in webpage
Deng) click volume of advertisement is consumed.But certain flow masters are in order to improve user in owned advertising resource upslide
The click volume for the advertisement put can carry out the advertisement that flow upslide is put by the way of cheating with obtaining more advertising incomes
Malicious operation, to improve the advertisements behavioral indicator such as click volume.
For another example the member in some Hei Chan cliques, carries out ad click by simulator, automatized script etc., these
The motivation of click be all it is false, any advertising conversion effect will not be generated, compromise the interests of advertiser.
Summary of the invention
The embodiment of the present application provides a kind of click traffic detection method, comprising:
The corresponding click time series of click traffic to be detected is obtained, the click time series includes multiple default systems
Count period corresponding click volume；
The click time series is subjected to time-frequency conversion, obtains frequency domain sequence, the frequency domain sequence includes multiple frequencies
Corresponding amplitude；
According to each frequency in the amplitude for each frequency for being greater than frequency threshold in the frequency domain sequence and the frequency domain sequence
Proportionate relationship between amplitude determines whether the corresponding click traffic of the click time series is suspicious.
The embodiment of the present application provides a kind of click traffic detection device, comprising:
Acquiring unit, to obtain the corresponding click time series of click traffic to be detected, the click time series
Including the corresponding click volume of multiple default measurement periods；
Time-frequency conversion unit obtains frequency domain sequence, the frequency domain the click time series is carried out time-frequency conversion
Sequence includes the corresponding amplitude of multiple frequencies；
Determination unit, to the amplitude and the frequency domain sequence according to each frequency for being greater than frequency threshold in the frequency domain sequence
Proportionate relationship in column between the amplitude of each frequency determines whether the corresponding click traffic of the click time series is suspicious.
Present application example provides a kind of computer readable storage medium, is stored with computer-readable instruction, can make to
A few processor executes method as described above.
It is more accurate to the detection of abnormal click traffic using above scheme provided by the present application.
Detailed description of the invention
In order to more clearly explain the embodiment of the invention or the technical proposal in the existing technology, to embodiment or will show below
There is attached drawing needed in technical description to be briefly described, it should be apparent that, the accompanying drawings in the following description is only this
Some embodiments of invention without any creative labor, may be used also for those of ordinary skill in the art
To obtain other drawings based on these drawings.
Fig. 1 is that the system architecture diagram that some examples of the application are related to is intended to；
Fig. 2 is the flow diagram of some embodiment click traffic detection methods of the application；
Fig. 3 is the flow diagram of some embodiment click traffic detection methods of the application；
Fig. 4 is the structural schematic diagram that time series is clicked in some embodiments of the application；
Fig. 5 is the structural schematic diagram of some embodiment frequency domain sequences of the application；
Fig. 6 is the flow diagram of some embodiment click traffic detection methods of the application；
Fig. 7 is the structural schematic diagram of some embodiment click traffic detection devices of the application；And
Fig. 8 is the calculating equipment composition structural schematic diagram in the embodiment of the present application.
Specific embodiment
Following will be combined with the drawings in the embodiments of the present invention, and technical solution in the embodiment of the present invention carries out clear, complete
Site preparation description, it is clear that the described embodiment is only a part of the embodiment of the present invention, instead of all the embodiments.Based on this
Embodiment in invention, every other reality obtained by those of ordinary skill in the art without making creative efforts
Example is applied, shall fall within the protection scope of the present invention.
For ease of description, following that simple introduction first is done to term involved in each embodiment.
Advertiser: advertiser refers to the user pay to the click volume for launching advertisement or service provider.Advertiser wishes
The ad click oneself paid every time is all effective click of real user, rather than practises fraud and click.
Flow master: flow master, which refers to, provides the carrier of customer flow, is often referred to media, website or software.In wechat advertisement
In platform, flow master can be the public platform for possessing certain bean vermicelli amount.Flow master can participate in the profit-sharing of advertisement, identical wide
It accuses under light exposure, clicking rate is higher, and the profit assigned to is also higher, thus flow master has stronger cheating motivation to promote advertisement
Click volume.
Machine cheating: general advertisement is charged according to exposure or the number clicked to advertiser, and machine cheating, which refers to, passes through foot
The technological means such as sheet, simulator cause false advertisement exposure, click behavior, to gain the expense of advertiser by cheating.
In some instances, judge whether user App is implanted malicious code section to quilt by analysis bottom code
Apparatus control.In this scenario, malicious code obtains difficulty height, in addition, bottom code needs to translate by Decompilation
The code that people can understand, manual verification are at high cost.In other examples, sentenced by analyzing several features with the presence or absence of abnormal
Whether disconnected is machine customer.Such as the features such as analysis user's gender, the pet name, region, type distribution judge with the presence or absence of abnormal
It whether is machine customer.The shortcomings that this scheme is to be easy missing feature.
In order to more effectively detect machine cheating, this application provides click traffic detection method, device and storage mediums.
Fig. 1 is the block diagram that the operating environment 100 of flow detection is clicked in the embodiment of the present invention.As shown in Figure 1, flow detection provider
102a provides flow detection server 112a.The flow detection server 112a passes through one or more networks 106, to multiple use
Family provides flow detection service, wherein the multiple user operates their respective user equipmenies 104 (for example, user sets respectively
Standby 104a-c).
In some embodiments, each user is by the client application 108 that executes on user equipment 104 (for example, visitor
Apply 108a-c in family end) it is connected to flow detection server 112a.Wherein, the client application 108 can be social application,
For example, wechat, QQ, microblogging etc.；Client application 108 can also be the multimedia application such as Video Applications, article application；Client
It can also be mailbox application using 108.Advertisement delivery system launches advertisement on the flow in client application 108, works as terminal
When user clicks on the advertisement shown in client application 108, client application 108 is to the sending point flow detection server 112a
Log is hit, flow detection server 112a will click on log and be stored in log database 110a.Flow detection server 112a
Machine cheating is detected according to the click logs of preservation.
The example of user equipment 104 includes but is not limited to palmtop computer, wearable computing devices, personal digital assistant
(PDA), tablet computer, laptop, desktop computer, mobile phone, smart phone, enhancement type general use grouping wireless industry
Be engaged in (EGPRS) mobile phone, media player, navigation equipment, game console, television set or any two or more this
The combination of a little data processing equipments or other data processing equipments.
The example of one or more networks 106 includes local area network (LAN) and such as internet wide area network (WAN).Optionally,
Any known network protocol can be used to realize one or more networks 106, including various wired or wireless agreements, it is all
Such as, Ethernet, universal serial bus (USB), FIREWIRE, global system for mobile communications (GSM), enhancing data GSM environment
(EDGE), CDMA (CDMA), time division multiple acess (TDMA), bluetooth, WiFi, ip voice (VoIP), Wi-MAX, or it is any other
Suitable communication protocol.
The flow detection server 112a can be in one or more independent data processing equipments or distributed computing
It is realized on machine network.In some embodiments, various virtual units and/or third also can be used in flow detection server 112a
The service of square service provider (for example, third party cloud service provider), to provide the bottom of flow detection server 112a
Computing resource and/or basic resource.
Each user equipment 104 optionally includes one or more internal peripherals module, or can be by wired
Or one or more peripheral equipments are wirelessly connected to (for example, navigation system, health monitor, climate controlling device, smart motion fill
Standby, bluetooth headset, smartwatch etc.).
In some instances, this application provides a kind of click traffic detection methods, are held by flow detection server 112a
Row.As shown in Figure 2, comprising the following steps:
S201: the corresponding click time series of click traffic to be detected is obtained, the click time series includes multiple
The default corresponding click volume of measurement period.
In some instances, obtain and save the corresponding click logs of click behavior, wherein the click logs include with
At least one of lower parameter: the click behavior corresponding click time, the corresponding user identifier of the click behavior, described
The corresponding flow principal mark of click behavior is known；
Determine the corresponding a plurality of click logs of click traffic to be detected；
According to a plurality of click logs, the corresponding click volume of the multiple preset measurement period is determined.To determine a little
Hit time series.
In some instances, click traffic to be detected is the click traffic of flow master, is determining click steam to be detected
When measuring corresponding a plurality of click logs, comprising steps of
Determine that flow principal mark to be detected is known；
Click logs corresponding with the flow principal mark knowledge are selected from the click logs of preservation；
It is described according to a plurality of click logs executing, determine the corresponding click volume of each preset measurement period
When, comprising steps of
For each preset measurement period, the system is determined in the click logs corresponding with the flow principal mark knowledge
Period corresponding one or more click logs are counted, and using the quantity of one or more click logs of the determination as described in
The corresponding click volume of measurement period.
In some instances, when the click traffic that click traffic to be detected is flow master, click to be detected is being determined
When the corresponding a plurality of click logs of flow, can with the following steps are included:
Determine that flow principal mark to be detected is known；
The selection click logs corresponding with the flow principal mark knowledge from each default measurement period corresponding click logs；
Wherein, described according to a plurality of click logs in execution, determine that each preset measurement period is corresponding
When click volume, comprising steps of
For each preset measurement period, the quantity that corresponding click logs are known with the flow principal mark that will be selected
As the corresponding click volume of the measurement period.
In some instances, click traffic to be detected is the click traffic of a user, is determining click to be detected
When the corresponding a plurality of click logs of flow, comprising steps of
Determine user identifier to be detected；
Click logs corresponding with the user identifier are selected from the click logs of preservation；
It is described according to a plurality of click logs executing, determine the corresponding click volume of each preset measurement period
When, comprising steps of
For each preset measurement period, the statistics is determined in the click logs corresponding with the user identifier
Period corresponding one or more click logs, and using the quantity of one or more click logs of the determination as the system
Count period corresponding click volume.
In some instances, to be detected determining when click traffic to be detected is the click traffic of a user
When the corresponding a plurality of click logs of click traffic, comprising steps of
Determine user identifier to be detected；
The selection click logs corresponding with the user identifier from each default measurement period corresponding click logs；
Wherein, described according to a plurality of click logs in execution, determine that each preset measurement period is corresponding
When click volume, comprising steps of
For each preset measurement period, the quantity for the click logs corresponding with the user identifier selected is made
For the corresponding click volume of the measurement period.
S202: the click time series is subjected to time-frequency conversion, obtains frequency domain sequence, the frequency domain sequence includes multiple
The corresponding amplitude of frequency.
In some instances, the time-frequency conversion is discrete Fourier transform or wavelet transformation.
S203: according to frequency each in the amplitude for each frequency for being greater than frequency threshold in the frequency domain sequence and the frequency domain sequence
Proportionate relationship between the amplitude of rate determines whether the corresponding click traffic of the click time series is suspicious.
In some instances, the sum of the amplitude for being greater than each frequency of frequency threshold is determined, with frequency each in the frequency domain sequence
The ratio of the sum of the amplitude of rate；
Determine whether the click traffic is suspicious according to the ratio.
In some instances, the quadratic sum for being greater than the amplitude of each frequency of frequency threshold is determined, in the frequency domain sequence
The ratio of the quadratic sum of the amplitude of each frequency；
Determine whether the click traffic is suspicious according to the ratio.
In some instances, if the ratio is greater than fractional threshold, it is determined that the corresponding point of the click behavior sequence
It is suspicious to hit flow；
Otherwise, the corresponding click traffic of the click behavior sequence is unsuspicious.
Using click traffic detection method provided by the present application, it will click on the corresponding click time series of flow and pass through time-frequency
Transformation obtains frequency domain sequence, determines whether click traffic is suspicious by the feature of frequency domain sequence.Specifically, by detecting at one section
Ad click time series in time is gone with the presence or absence of the periodical time series of high frequency to determine whether practising fraud there are machine
For so that more accurate to the detection clicked extremely.
Principle based on click traffic detection method provided by the present application includes:
(1) information asymmetry principle
Under normal conditions, expose or click the behaviors such as advertisement and all occur at random, thus flow master and terminal user without
Method controls the exposure or click volume of each moment advertisement, while flow master and terminal user can not also learn deep bid ad click amount
Annual distribution.Therefore, flow master or terminal user are practised fraud when by machine cheating come some advertisements, when the ad click of generation
Between sequence can be different from the click time series of normal users.
(2) maximum revenue principle
The flow master of cheating or the terminal user of cheating practised fraud by machine click advertisement when, for maximum gain,
Mass advertising click can be carried out by automation means, i.e., carry out a large amount of ad click, thus ad click in a short time
Certain high frequency can be presented in time series.
According to principles above, by the ad click time series of detection click traffic whithin a period of time with the presence or absence of height
The periodical of frequency is clicked, to complete the detection of abnormal flow.
Fig. 3 is the flow diagram for the click traffic detection method that some embodiments of the application provide, and is taken by flow detection
Business device 112a is executed.As shown in figure 3, detection method includes the following steps for the click traffic:
S301: obtaining and saves the corresponding click logs of click behavior.Wherein, the click logs include in following parameter
At least one: the click behavior corresponding click time, the corresponding user identifier of the click behavior, the click behavior
Corresponding flow principal mark is known.
When user at user equipment 104 clicks the advertisement of the displaying in client application 108, client application 108
Click logs are reported to flow detection server 112a.Flow detection server 112a is from bleeding point from multiple user equipmenies 104
Log is hit, log is will click on and is stored in log database 110a.Wherein, the format of click logs is such as: { current time；User
ID；Terminal device IP；Media content ID；The main ID of flow }, it include mainly current time, User ID, terminal device IP, in media
Hold ID, the main ID of flow.Wherein, current time is the time that click behavior occurs；User ID is user identifier, such as wechat user
Wechat account etc..Terminal device IP is the IP for the user equipment 104 that user uses, and the media content is the matchmaker for carrying advertisement
Body, for example, being added with the article of advertisement.For example, the flow master is wechat when the client application 108 is wechat APP
Public platform, when the user clicks when advertisement in an article in a wechat public platform, on flow detection server 112a
The click logs of report include: the wechat account (corresponding User ID) of user, the IP (counterpart terminal device IP) of user equipment, article
Mark (corresponding media content ID) and public platform mark (corresponding flow master).
S302: the corresponding click time series of click traffic to be detected is obtained.
Wherein, the click time series includes the corresponding click volume of multiple default measurement periods, the default measurement period
It can be one day, one hour, one minute etc., default measurement period be not limited in the scheme of the application.Click the time
The format of sequence can be with are as follows: { p0、p1、p2……pN-1, wherein PiFor the ad click amount in i-th of default measurement period.
The example is detected for the click traffic of a flow master, and the click traffic of detection flows master whether there is can
It doubts.In the corresponding click time series of the click traffic of acquisition flow master, flow master couple can be chosen in the log of preservation
One or more click logs answered, and then in determining one or more click logs, determine each default statistics
Period corresponding one or more click logs, using the quantity of the corresponding click logs of each default measurement period as each pre-
If the corresponding click volume of measurement period.Can also first be chosen in the log of preservation each default measurement period it is corresponding one or
A plurality of click logs preset measurement period for each, preset corresponding one or more click logs of measurement period at this
In, corresponding one or more click logs of the flow master are determined, using the quantity of determining click logs as described default
The corresponding click volume of measurement period.
In some instances, obtain click time series the following steps are included:
S3021: the corresponding a plurality of click logs of click traffic to be detected are determined.
In this example, the click traffic to be detected is the click traffic of flow master, whether is determining click traffic
It is whether the click volume of the corresponding all media contents of determining flow master is suspicious when suspicious, determines flow master with the presence or absence of cheating
The case where.For example, for a wechat public platform, the corresponding click logs of all articles under the wechat public platform are obtained, according to
The click logs of acquisition determine whether the wechat public platform is suspicious, and the corresponding bloger of the wechat public platform whether there is about click
The cheating of amount.
In the corresponding a plurality of click logs of the click traffic that determines flow master, comprising steps of
S30211: determine that flow principal mark to be detected is known；
S30212: click logs corresponding with the flow principal mark knowledge are selected from the click logs of preservation.
It mentions in the above content, includes the mark of flow master in click logs, according to the mark of flow master to be detected,
The a plurality of click logs of the mark including the flow master are searched in the click logs that the user equipment 104 of preservation uploads.
S3022: according to a plurality of click logs, the corresponding click volume of each preset measurement period is determined.
Click logs include the corresponding click volume of multiple preset measurement periods, are determining multiple preset measurement periods pair
When the click volume answered, comprising steps of
S30221: it is directed to each preset measurement period, in the click logs corresponding with the flow principal mark knowledge
Determine corresponding one or more click logs of the measurement period, and by the quantity of one or more click logs of the determination
As the corresponding click volume of the measurement period.
It include clicking the time in every click logs, according to each item for a plurality of click logs of determination in step S3021
The click time of click logs corresponds to each click logs in each default measurement period, and then determines each measurement period
The quantity of interior click logs, the quantity that will click on log are determined as the corresponding click volume of a measurement period.
S303: the click time series is subjected to time-frequency conversion, obtains frequency domain sequence.
In some instances, the time-frequency conversion is discrete Fourier transform or wavelet transformation.Carrying out discrete fourier
When transformation, discrete Fourier transform is carried out using following formula (1).
Wherein, xkIt is the amplitude of 2 π k/N of frequency, the time in time-domain is clicked by sequence by discrete Fourier transform
{p0、p1、p2……pN-1It is transformed into the frequency domain sequence in frequency domain, frequency domain sequence format can be with are as follows: { x0、x1、x2……xN-1}。
Flow in this example clicks detection method, the advertisement to launching in the resource of a flow master in a period of time
Click time series carry out Discrete Fourier Transform, the click time series of advertisement is transformed into frequency domain from time-domain.When
When clicking behavior in the presence of regular machine, is largely clicked when the click behavior of the main corresponding advertisement of the cheating flow and come from machine
When cheating is clicked, after Fourier transform, the energy of frequency domain sequence medium-high frequency fractional amplitude can be bigger than normal discharge master.Thus
The relationship of the ability of all frequencies in the energy and frequency domain sequence of high frequency section is determined in frequency domain sequence, it is true according to the relationship
Whether the flow of constant flow master is abnormal flow.
S304: according to frequency each in the amplitude for each frequency for being greater than frequency threshold in the frequency domain sequence and the frequency domain sequence
Proportionate relationship between the amplitude of rate determines whether the corresponding click traffic of the click time series is suspicious.
In some instances, when determining whether click traffic is suspicious, comprising steps of
S3041: the sum of the amplitude for being greater than each frequency of frequency threshold, the amplitude with each frequency in the frequency domain sequence are determined
The sum of ratio；Determine whether the click traffic is suspicious according to the ratio.
(2) determine the ratio according to the following formula:
Wherein, T is preset value, and 2 π (N-T)/k is the frequency threshold, and N is the number for the amplitude for including in frequency domain sequence.
When determining whether click traffic is suspicious according to ratio, if the ratio is greater than fractional threshold, it is determined that described
It is suspicious to click the corresponding click traffic of behavior sequence；Otherwise, the corresponding click traffic of the click behavior sequence is unsuspicious.Example
Such as, when λ is greater than θ, then show to determine that the flow of flow master is suspicious, wherein θ is containing abnormal period sequence in flow master
Preset fractional threshold.
For example, Fig. 4 is that click time series per minute in a certain flow master one week obtains after Discrete Fourier Transform
Energy (amplitude) to frequency domain is distributed, as shown in Figure 5.For example, frequency domain threshold value is 0.05HZ, the energy accounting of high frequency section is high
In preset threshold value, the click traffic cheating of flow master is determined.In Fig. 5, the unit of abscissa frequency is HZ, and ordinate is
The assignment of each frequency obtained after discrete Fourier transform is relative value.
In some instances, when determining whether click traffic suspicious, can with comprising steps of
S3042: the quadratic sum for being greater than the amplitude of each frequency of frequency threshold is determined, with each frequency in the frequency domain sequence
The ratio of the quadratic sum of amplitude；Determine whether the click traffic is suspicious according to the ratio.
It, can also be by the quadratic sum of the amplitude of each frequency of high frequency section and institute in the energy accounting for determining high frequency section
There is the ratio of the quadratic sum of the amplitude of frequency as the ability accounting.If the ratio is greater than fractional threshold, it is determined that institute
It is suspicious to state the corresponding click traffic of click behavior sequence；Otherwise, the corresponding click traffic of the click behavior sequence is unsuspicious.
Fig. 6 is the flow diagram for the click traffic detection method that some embodiments of the application provide, and is taken by flow detection
Business device 112a is executed.In this example, step S601-S604 is similar to the operation in step S301-S304 respectively, step
S6022 is similar to the operation in step S3022, and step S6041-S6042 is similar with the operation in step S3041-S3042,
This is repeated no more.In this example, it is executing step S6021: obtaining the corresponding click time series of click traffic to be detected
When, comprising steps of
S60211: user identifier to be detected is determined.
S60212: click logs corresponding with the user identifier are selected from the click logs of preservation.
When executing step S6022, comprising steps of
S60221: being directed to each preset measurement period, in the click logs corresponding with the user identifier really
Fixed corresponding one or more click logs of the measurement period, and the quantity of one or more click logs of the determination is made
For the corresponding click volume of the measurement period.
In this example, the click traffic of a terminal user is detected, whether detection user is cheating user.Its
In, the user identifier can log in the account of client application 108 for user, for example, wechat account.Flow detection server
112a searches a plurality of click logs including the user identifier in a plurality of click logs of preservation.When according to determining
A plurality of click logs when finally determining that click traffic is suspicious, illustrate the user for cheating user.
In the corresponding click time series of the click traffic of acquisition user, user couple can be chosen in the log of preservation
One or more click logs answered, and then in determining one or more click logs, determine each default statistics
Period corresponding one or more click logs, using the quantity of the corresponding click logs of each default measurement period as each pre-
If the corresponding click volume of measurement period.Can also first be chosen in the log of preservation each default measurement period it is corresponding one or
A plurality of click logs preset measurement period for each, preset corresponding one or more click logs of measurement period at this
In, corresponding one or more click logs of the user are determined, using the quantity of determining click logs as the default system
Count period corresponding click volume.
In other example, it is right that a media content (for example, article under a wechat public platform) can also be obtained
The a plurality of click logs answered are determined using click traffic detection method described above according to a plurality of click logs and are directed to institute
Whether the click traffic for stating media content is suspicious.In other embodiments, it is corresponding more that terminal device IP can also be obtained
Click logs, with detect the corresponding terminal device of terminal device IP whether be cheating terminal device.
Present invention also provides a kind of click traffic detection devices 700, as shown in fig. 7, comprises:
Acquiring unit 701, to obtain the corresponding click time series of click traffic to be detected, the click time sequence
Column include the corresponding click volume of multiple default measurement periods；
Time-frequency conversion unit 702, it is described to obtain frequency domain sequence for click time series progress time-frequency conversion
Frequency domain sequence includes the corresponding amplitude of multiple frequencies；
Determination unit 703, to according in the frequency domain sequence be greater than frequency threshold each frequency amplitude and the frequency
Proportionate relationship in the sequence of domain between the amplitude of each frequency determines that the corresponding click traffic of the click time series whether may be used
It doubts.
Using click traffic detection device provided by the present application, it will click on the corresponding click time series of flow and pass through time-frequency
Transformation obtains frequency domain sequence, determines whether click traffic is suspicious by the feature of frequency domain sequence.Specifically, by detecting at one section
Ad click time series in time is gone with the presence or absence of the periodical time series of high frequency to determine whether practising fraud there are machine
For so that more accurate to the abnormal detection for clicking behavior.
In some instances, the acquiring unit 701, also to:
Obtain and save the corresponding click logs of click behavior, wherein the click logs include in following parameter extremely
Few one: the click behavior corresponding clicks time, the corresponding user identifier of the click behavior, click behavior correspondence
Flow principal mark know；
Determine the corresponding a plurality of click logs of click traffic to be detected；
According to a plurality of click logs, the corresponding click volume of each preset measurement period is determined.
In some instances, the acquiring unit 701, also to:
Determine that flow principal mark to be detected is known；
Click logs corresponding with the flow principal mark knowledge are selected from the click logs of preservation；
For each preset measurement period, the system is determined in the click logs corresponding with the flow principal mark knowledge
Period corresponding one or more click logs are counted, and using the quantity of one or more click logs of the determination as described in
The corresponding click volume of measurement period.
In some instances, the acquiring unit 701, also to:
Determine that flow principal mark to be detected is known；
The selection click logs corresponding with the flow principal mark knowledge from each default measurement period corresponding click logs；
For each preset measurement period, the quantity that corresponding click logs are known with the flow principal mark that will be selected
As the corresponding click volume of the measurement period.In some instances, the acquiring unit 701, also to:
Determine user identifier to be detected；
Click logs corresponding with the user identifier are selected from the click logs of preservation；
For each preset measurement period, the statistics is determined in the click logs corresponding with the user identifier
Period corresponding one or more click logs, and using the quantity of one or more click logs of the determination as the system
Count period corresponding click volume.
In some instances, the acquiring unit 701, also to:
Determine user identifier to be detected；
The selection click logs corresponding with the user identifier from each default measurement period corresponding click logs；
For each preset measurement period, the quantity for the click logs corresponding with the user identifier selected is made
For the corresponding click volume of the measurement period.
In some instances, the determination unit 703, to:
The sum of the amplitude for being greater than each frequency of frequency threshold is determined, with the sum of the amplitude of each frequency in the frequency domain sequence
Ratio；
Determine whether the click traffic is suspicious according to the ratio.
In some instances, the determination unit 703, to:
The quadratic sum for being greater than the amplitude of each frequency of frequency threshold is determined, with the amplitude of each frequency in the frequency domain sequence
The ratio of quadratic sum；Determine whether the click traffic is suspicious according to the ratio.
In some instances, the determination unit 703, also to:
If the ratio is greater than fractional threshold, it is determined that the corresponding click traffic of the click behavior sequence is suspicious；It is no
Then, the corresponding click traffic of the click behavior sequence is unsuspicious.
In some instances, the time-frequency conversion is discrete Fourier transform or wavelet transformation.
Present invention also provides a kind of computer readable storage mediums, are stored with computer-readable instruction, can make at least
One processor executes method as described above.
Fig. 8 shows the composite structural diagram of the calculating equipment where click traffic detection device 700.As shown in figure 8, the meter
Calculating equipment includes one or more processor (CPU) 802, communication module 804, memory 806, user interface 810, Yi Jiyong
In the communication bus 808 for interconnecting these components.
Processor 802 can send and receive data by communication module 804 to realize network communication and/or local communication.
User interface 810 includes one or more output equipments 812 comprising one or more speakers and/or one
Or multiple visual displays.User interface 810 also includes one or more input equipments 814 comprising such as, keyboard, mouse
Mark, voice command input unit or loudspeaker, touch screen displays, touch sensitive tablet, posture capture camera or other inputs are pressed
Button or control etc..
Memory 806 can be high-speed random access memory, such as DRAM, SRAM, DDR RAM or other deposit at random
Take solid storage device；Or nonvolatile memory, such as one or more disk storage equipments, optical disc memory apparatus, sudden strain of a muscle
Deposit equipment or other non-volatile solid-state memory devices.
The executable instruction set of 806 storage processor 802 of memory, comprising:
Operating system 816, including the program for handling various basic system services and for executing hardware dependent tasks；
Using 818, including some or all of click traffic detection device 700 unit or module.Click traffic detection
At least one unit in device 700 can store machine-executable instruction.Processor 802 is by executing in memory 806
Machine-executable instruction in each unit at least one unit, so can be realized in above-mentioned each unit or module at least one
The function of a module.
It should be noted that step and module not all in above-mentioned each process and each structure chart be all it is necessary, can
To ignore certain steps or module according to the actual needs.Each step execution sequence be not it is fixed, can according to need into
Row adjustment.The division of each module is intended merely to facilitate the division functionally that description uses, and in actual implementation, a module can
It is realized with point by multiple modules, the function of multiple modules can also be realized by the same module, these modules can be located at same
In a equipment, it can also be located in different equipment.
Hardware module in each embodiment can in hardware or hardware platform adds the mode of software to realize.Above-mentioned software
Including machine readable instructions, it is stored in non-volatile memory medium.Therefore, each embodiment can also be presented as software product.
In each example, hardware can be by special hardware or the hardware realization of execution machine readable instructions.For example, hardware can be with
Permanent circuit or logical device (such as application specific processor, such as FPGA or ASIC) specially to design are used to complete specifically to grasp
Make.Hardware also may include programmable logic device or circuit by software provisional configuration (as included general processor or other
Programmable processor) for executing specific operation.
In addition, each example of the application can pass through the data processor by data processing equipment such as computer execution
To realize.Obviously, data processor constitutes the application.In addition, being commonly stored data processing in one storage medium
Program is by directly reading out storage medium or the storage by program being installed or being copied to data processing equipment for program
It is executed in equipment (such as hard disk and/or memory).Therefore, such storage medium also constitutes the application, and present invention also provides one
Kind non-volatile memory medium, wherein being stored with data processor, this data processor can be used for executing in the application
State any one of method example example.
The corresponding machine readable instructions of Fig. 8 module can make operating system operated on computer etc. described herein to complete
Some or all of operation.Non-volatile computer readable storage medium storing program for executing can be set in the expansion board in insertion computer
In the memory set or write the memory being arranged in the expanding element being connected to a computer.It is mounted on expansion board or expansion
Opening up CPU on unit etc. can be according to instruction execution part and whole practical operations.
The foregoing is merely illustrative of the preferred embodiments of the present invention, is not intended to limit the invention, all in essence of the invention
Within mind and principle, any modification, equivalent substitution, improvement and etc. done be should be included within the scope of the present invention.
Claims (15)
1. a kind of click traffic detection method characterized by comprising
The corresponding click time series of click traffic to be detected is obtained, the click time series includes multiple default statistics weeks
Phase corresponding click volume；
The click time series is subjected to time-frequency conversion, obtains frequency domain sequence, the frequency domain sequence includes that multiple frequencies are corresponding
Amplitude；
According to the amplitude of each frequency in the amplitude for each frequency for being greater than frequency threshold in the frequency domain sequence and the frequency domain sequence
Between proportionate relationship, determine whether the corresponding click traffic of the click time series suspicious.
2. according to the method described in claim 1, it is characterized by: the method further includes:
It obtains and saves the corresponding click logs of click behavior, wherein the click logs include at least one in following parameter
It is a: the click behavior corresponding click time, the corresponding user identifier of the click behavior, the corresponding stream of the click behavior
Principal mark is measured to know；
The corresponding click time series of click traffic to be detected that obtains includes:
Determine the corresponding a plurality of click logs of click traffic to be detected；
According to a plurality of click logs, the corresponding click volume of each preset measurement period is determined.
3. according to the method described in claim 2, it is characterized by: the corresponding a plurality of point of determination click traffic to be detected
Hitting log includes:
Determine that flow principal mark to be detected is known；
Click logs corresponding with the flow principal mark knowledge are selected from the click logs of preservation；
Wherein, described according to a plurality of click logs, determine that the corresponding click volume of each preset measurement period includes:
For each preset measurement period, statistics week is determined in the click logs corresponding with the flow principal mark knowledge
Phase corresponding one or more click logs, and using the quantity of one or more click logs of the determination as the statistics
Period corresponding click volume.
4. according to the method described in claim 2, it is characterized by: the corresponding a plurality of point of determination click traffic to be detected
Hitting log includes:
Determine that flow principal mark to be detected is known；
The selection click logs corresponding with the flow principal mark knowledge from each default measurement period corresponding click logs；
Wherein, described according to a plurality of click logs, determine that the corresponding click volume of each preset measurement period includes:
For each preset measurement period, will select with the flow principal mark know the quantity of corresponding click logs as
The corresponding click volume of the measurement period.
5. according to the method described in claim 2, it is characterized in that, the corresponding a plurality of point of determination click traffic to be detected
Hitting log includes:
Determine user identifier to be detected；
Click logs corresponding with the user identifier are selected from the click logs of preservation；
Wherein, described according to a plurality of click logs, determine that the corresponding click volume of each preset measurement period includes:
For each preset measurement period, the measurement period is determined in the click logs corresponding with the user identifier
Corresponding one or more click logs, and using the quantity of one or more click logs of the determination as the statistics week
Phase corresponding click volume.
6. according to the method described in claim 2, it is characterized in that, the corresponding a plurality of point of determination click traffic to be detected
Hitting log includes:
Determine user identifier to be detected；
The selection click logs corresponding with the user identifier from each default measurement period corresponding click logs；
Wherein, described according to a plurality of click logs, determine that the corresponding click volume of each preset measurement period includes:
For each preset measurement period, using the quantity for the click logs corresponding with the user identifier selected as institute
State the corresponding click volume of measurement period.
7. the method according to claim 1, wherein described according to being greater than frequency threshold in the frequency domain sequence
Proportionate relationship in the amplitude of each frequency and the frequency domain sequence between the amplitude of each frequency determines the click time series pair
Whether the click traffic answered is suspicious to include:
Determine the sum of the amplitude for being greater than each frequency of frequency threshold, the ratio with the sum of the amplitude of each frequency in the frequency domain sequence
Value；
Determine whether the click traffic is suspicious according to the ratio.
8. the method according to claim 1, wherein described according to being greater than frequency threshold in the frequency domain sequence
Proportionate relationship in the amplitude of each frequency and the frequency domain sequence between the amplitude of each frequency determines the click time series pair
Whether the click traffic answered is suspicious to include:
Determine the quadratic sum for being greater than the amplitude of each frequency of frequency threshold, square with the amplitude of each frequency in the frequency domain sequence
The ratio of sum；Determine whether the click traffic is suspicious according to the ratio.
9. method according to claim 7 or 8, which is characterized in that described to determine the click traffic according to the ratio
Whether suspicious include:
If the ratio is greater than fractional threshold, it is determined that the corresponding click traffic of the click behavior sequence is suspicious；
Otherwise, the corresponding click traffic of the click behavior sequence is unsuspicious.
10. the method according to claim 1, wherein the time-frequency conversion is discrete Fourier transform or small echo
Transformation.
11. a kind of click traffic detection device characterized by comprising
Acquiring unit, to obtain the corresponding click time series of click traffic to be detected, the click time series includes
The corresponding click volume of multiple default measurement periods；
Time-frequency conversion unit obtains frequency domain sequence, the frequency domain sequence the click time series is carried out time-frequency conversion
Including the corresponding amplitude of multiple frequencies；
Determination unit, in the amplitude and the frequency domain sequence according to each frequency for being greater than frequency threshold in the frequency domain sequence
Proportionate relationship between the amplitude of each frequency determines whether the corresponding click traffic of the click time series is suspicious.
12. device according to claim 11, it is characterised in that: the acquiring unit, also to:
It obtains and saves the corresponding click logs of click behavior, wherein the click logs include at least one in following parameter
It is a: the click behavior corresponding click time, the corresponding user identifier of the click behavior, the corresponding stream of the click behavior
Principal mark is measured to know；
Determine the corresponding a plurality of click logs of click traffic to be detected；
According to a plurality of click logs, the corresponding click volume of each preset measurement period is determined.
13. device according to claim 12, it is characterised in that: the acquiring unit, also to:
Determine that flow principal mark to be detected is known；
Click logs corresponding with the flow principal mark knowledge are selected from the click logs of preservation；
For each preset measurement period, statistics week is determined in the click logs corresponding with the flow principal mark knowledge
Phase corresponding one or more click logs, and using the quantity of one or more click logs of the determination as the statistics
Period corresponding click volume.
14. device according to claim 12, which is characterized in that the acquiring unit, also to:
Determine user identifier to be detected；
Click logs corresponding with the user identifier are selected from the click logs of preservation；
For each preset measurement period, the measurement period is determined in the click logs corresponding with the user identifier
Corresponding one or more click logs, and using the quantity of one or more click logs of the determination as the statistics week
Phase corresponding click volume.
15. a kind of computer readable storage medium, is stored with computer-readable instruction, at least one processor can be made to execute such as
The described in any item methods of claim 1-10.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201810644161.2A CN109034867B (en) | 2018-06-21 | 2018-06-21 | Click traffic detection method and device and storage medium |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201810644161.2A CN109034867B (en) | 2018-06-21 | 2018-06-21 | Click traffic detection method and device and storage medium |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN109034867A true CN109034867A (en) | 2018-12-18 |
| CN109034867B CN109034867B (en) | 2022-10-25 |
Family
ID=64610246
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201810644161.2A Active CN109034867B (en) | 2018-06-21 | 2018-06-21 | Click traffic detection method and device and storage medium |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN109034867B (en) |
Cited By (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN110781605A (en) * | 2019-11-05 | 2020-02-11 | 恩亿科(北京)数据科技有限公司 | Advertisement putting model testing method and device, computer equipment and storage medium |
| CN112465549A (en) * | 2020-11-30 | 2021-03-09 | 上海酷量信息技术有限公司 | System and method for identifying channel cheating |
| CN113610569A (en) * | 2021-07-27 | 2021-11-05 | 上海交通大学 | Advertisement click farm detection method, system, terminal and medium |
| CN115150159B (en) * | 2022-06-30 | 2023-11-10 | 深信服科技股份有限公司 | Flow detection method, device, equipment and readable storage medium |
Citations (7)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20070255821A1 (en) * | 2006-05-01 | 2007-11-01 | Li Ge | Real-time click fraud detecting and blocking system |
| CN101345664A (en) * | 2008-08-05 | 2009-01-14 | 成都市华为赛门铁克科技有限公司 | Detection method and apparatus for network flux exception |
| CN103235796A (en) * | 2013-04-07 | 2013-08-07 | 北京百度网讯科技有限公司 | Searching method and system based on clicking behavior of user |
| CN103577432A (en) * | 2012-07-26 | 2014-02-12 | 阿里巴巴集团控股有限公司 | Method and system for searching commodity information |
| CN103684910A (en) * | 2013-12-02 | 2014-03-26 | 北京工业大学 | Abnormality detecting method based on industrial control system network traffic |
| WO2016169193A1 (en) * | 2015-04-24 | 2016-10-27 | 百度在线网络技术（北京）有限公司 | Method and apparatus for detecting cheated clicks |
| CN108063698A (en) * | 2017-12-15 | 2018-05-22 | 东软集团股份有限公司 | Unit exception detection method and device, program product and storage medium |
-
2018
- 2018-06-21 CN CN201810644161.2A patent/CN109034867B/en active Active
Patent Citations (7)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20070255821A1 (en) * | 2006-05-01 | 2007-11-01 | Li Ge | Real-time click fraud detecting and blocking system |
| CN101345664A (en) * | 2008-08-05 | 2009-01-14 | 成都市华为赛门铁克科技有限公司 | Detection method and apparatus for network flux exception |
| CN103577432A (en) * | 2012-07-26 | 2014-02-12 | 阿里巴巴集团控股有限公司 | Method and system for searching commodity information |
| CN103235796A (en) * | 2013-04-07 | 2013-08-07 | 北京百度网讯科技有限公司 | Searching method and system based on clicking behavior of user |
| CN103684910A (en) * | 2013-12-02 | 2014-03-26 | 北京工业大学 | Abnormality detecting method based on industrial control system network traffic |
| WO2016169193A1 (en) * | 2015-04-24 | 2016-10-27 | 百度在线网络技术（北京）有限公司 | Method and apparatus for detecting cheated clicks |
| CN108063698A (en) * | 2017-12-15 | 2018-05-22 | 东软集团股份有限公司 | Unit exception detection method and device, program product and storage medium |
Cited By (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN110781605A (en) * | 2019-11-05 | 2020-02-11 | 恩亿科(北京)数据科技有限公司 | Advertisement putting model testing method and device, computer equipment and storage medium |
| CN110781605B (en) * | 2019-11-05 | 2023-08-25 | 恩亿科(北京)数据科技有限公司 | Advertisement putting model testing method and device, computer equipment and storage medium |
| CN112465549A (en) * | 2020-11-30 | 2021-03-09 | 上海酷量信息技术有限公司 | System and method for identifying channel cheating |
| CN113610569A (en) * | 2021-07-27 | 2021-11-05 | 上海交通大学 | Advertisement click farm detection method, system, terminal and medium |
| CN115150159B (en) * | 2022-06-30 | 2023-11-10 | 深信服科技股份有限公司 | Flow detection method, device, equipment and readable storage medium |
Also Published As
| Publication number | Publication date |
|---|---|
| CN109034867B (en) | 2022-10-25 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| US8788335B2 (en) | Content distribution system including cost-per-engagement based advertising | |
| US9846893B2 (en) | Systems and methods of serving parameter-dependent content to a resource | |
| US10630794B2 (en) | Multi computing device network based conversion determination based on computer network traffic | |
| CN109034867A (en) | click traffic detection method, device and storage medium | |
| US20170017986A1 (en) | Tracking digital design asset usage and performance | |
| AU2017334312B2 (en) | Objective based advertisement placement platform | |
| CN109426980A (en) | Determine method, apparatus, server and the storage medium of advertisement bidding | |
| US20150278868A1 (en) | Systems and methods for identifying and exposing content element density and congestion | |
| US20160078078A1 (en) | Auditing of web-based video | |
| CN108604350A (en) | Method and apparatus for the effect for measuring the information for being transmitted to mobile device | |
| US10601803B2 (en) | Tracking user activity for digital content | |
| US9720889B1 (en) | Systems and methods for detecting auto-redirecting online content | |
| US20130046850A1 (en) | Reporting focus duration to the advertiser | |
| US9392041B2 (en) | Delivery of two-way interactive content | |
| CN107993078B (en) | Method and device for evaluating information display effect and computing equipment | |
| US20230017558A1 (en) | Systems and methods for detecting data leakage of online content | |
| US11869033B2 (en) | Content item selection and measurement determination | |
| US10217142B1 (en) | Selective solicitation of user feedback for digital goods markets | |
| WO2019212748A1 (en) | System and method for managing content presentations | |
| US20130117071A1 (en) | Techniques for providing perceived quality metric analysis | |
| AU2015298135A1 (en) | Method and system for performing online advertisement monitoring | |
| RU2550546C2 (en) | Method of estimating efficiency of using invitations distributed from mobile website and system for implementing said method | |
| US20230351442A1 (en) | System and method for determining a targeted creative from multi-dimensional testing | |
| US20140324618A1 (en) | Restricting an auction to active bidders by excluding jumpers | |
| US20210174433A1 (en) | Content item selection and measurement determination |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |