CN109150845A - Monitor the method and system of terminal flow - Google Patents
Monitor the method and system of terminal flow Download PDFInfo
- Publication number
- CN109150845A CN109150845A CN201810836617.5A CN201810836617A CN109150845A CN 109150845 A CN109150845 A CN 109150845A CN 201810836617 A CN201810836617 A CN 201810836617A CN 109150845 A CN109150845 A CN 109150845A
- Authority
- CN
- China
- Prior art keywords
- decision
- data
- tree model
- vector
- flows
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
- H04L41/14—Network analysis or design
- H04L41/145—Network analysis or design involving simulating, designing, planning or modelling of a network
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
Landscapes
- Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Computer Hardware Design (AREA)
- Computing Systems (AREA)
- General Engineering & Computer Science (AREA)
- Data Exchanges In Wide-Area Networks (AREA)
Abstract
The invention discloses a kind of methods and system for monitoring terminal flow, this method comprises: S1, establishes decision-tree model using ID3 algorithm according to feature vector；S2 classifies to the data on flows of terminal according to the rule of decision-tree model.Above-mentioned technical proposal obtains terminal data on flows by using non-intrusion type, establishes decision-tree model using ID3 algorithm according to feature vector, classifies further according to this Decision Tree Rule to data on flows.The results showed that this method is to the recognition accuracy of terminal discharge pattern 92% or more.
Description
Technical field
The present invention relates to field of computer technology, it particularly relates to a kind of method and system for monitoring terminal flow.
Background technique
It is at present intrusive monitoring mostly to the safety monitoring of terminal applies, for example, in terminal installation monitoring client
Pass using condition code to server end analyze, directly to application installation package analyze, to end application extraction authority information into
Row analysis etc..
But intrusive monitoring has certain limitation, for example, being difficult to entirely to the flow service condition applied in terminal
Directional surveillance, and have to that client is installed in monitored terminal.
Aiming at the problem that software bad in existing terminal is difficult to monitor and identify, effective solution side is not yet proposed at present
Case.
Summary of the invention
Aiming at the problem that software bad in related art terminal is difficult to monitor and identify, the present invention provides a kind of monitorings eventually
Hold the method and system of flow.
The technical scheme of the present invention is realized as follows:
According to an aspect of the invention, there is provided a kind of method for monitoring terminal flow, comprising:
S1 establishes decision-tree model using ID3 algorithm according to feature vector；
S2 classifies to the data on flows of terminal according to the rule of decision-tree model.
According to an embodiment of the invention, step S1 includes: to obtain the mapping of the feature vector and final decision of multiple dimensions
Relationship；Wherein, influence of the vector to final decision that each dimension is differentiated by entropy obtains each dimension according to obtained entropy
Vector information gain.
According to an embodiment of the invention, step S1 further include: establish decision-tree model according to information gain.
According to an embodiment of the invention, step S1 further include: at each branch node of decision-tree model, pass through information
Gain selects feature vector.
According to an embodiment of the invention, feature includes second level link number feature, access time frequency characteristic, uplink and downlink flow
Any one or more among feature and total data stream measure feature.
According to an embodiment of the invention, before step S1 further include: obtain the data on flows that terminal generates；To flow number
According to carry out arrange formed establish decision-tree model needed for feature vector.
According to another aspect of the present invention, a kind of system for monitoring terminal flow is provided, comprising: model building module,
For establishing decision-tree model using ID3 algorithm according to feature vector；Categorization module, for according to decision-tree model to terminal
Data on flows is classified.
The present invention obtains terminal data on flows by using non-intrusion type, is determined according to feature vector using the foundation of ID3 algorithm
Plan tree-model classifies to data on flows further according to this Decision Tree Rule.The results showed that this method is to terminal class of traffic
The recognition accuracy of type is 92% or more.
Detailed description of the invention
It in order to more clearly explain the embodiment of the invention or the technical proposal in the existing technology, below will be to institute in embodiment
Attached drawing to be used is needed to be briefly described, it should be apparent that, the accompanying drawings in the following description is only some implementations of the invention
Example, for those of ordinary skill in the art, without creative efforts, can also obtain according to these attached drawings
Obtain other attached drawings.
Fig. 1 is the flow chart of the method for monitoring terminal flow according to an embodiment of the present invention；
Fig. 2 is terminal flow analysis monitoring of structures figure according to an embodiment of the present invention；
Fig. 3 is decision-tree model figure according to an embodiment of the present invention；
Fig. 4 is the decision-tree model figure of sample data according to an embodiment of the present invention；
Fig. 5 is classification results accuracy according to an embodiment of the present invention and error rate line chart.
Specific embodiment
Following will be combined with the drawings in the embodiments of the present invention, and technical solution in the embodiment of the present invention carries out clear, complete
Site preparation description, it is clear that described embodiments are only a part of the embodiments of the present invention, instead of all the embodiments.It is based on
Embodiment in the present invention, those of ordinary skill in the art's every other embodiment obtained belong to what the present invention protected
Range.
As shown in Figure 1, including the following steps the present invention provides a kind of method for monitoring terminal flow.First stage, number
According to extraction.
Step S10, data are extracted.Namely obtain the data on flows that terminal generates.The wireless network that terminal is connected
The data on flows packet capturing that exit generates, and formatted data loading is subjected to subsequent modeling and sort operation, to classification
Rear data visualization is simultaneously alerted to abnormal flow.Detailed process is as shown in Figure 2.
Step S20, data prediction.That is, carrying out arranging feature needed for decision-tree model is established in formation to data on flows
Vector.
Specifically, first the data deposited in database are handled according to modeling vector used, root before modeling
According to the MAC Address in request source and the target ip address of request, arranged.Uplink traffic summation is sorted out, downlink traffic is total
With, total data flow, the data such as second level link number that the address of access is included.And data preparation can be read at data mining
Format.Partial data wherein in database is as shown in table 1:
1 database part sample data of table
| Number | Accessed IP | Second level link | Access times | Uplink traffic | Downlink traffic |
| 1 | 1.189.72.178 | 2 | 2 | 767 | 20440 |
| 2 | 101.226.129.199 | 20 | 5 | 782 | 23676 |
| 3 | 110.246.47.22 | 1 | 2 | 68 | 730 |
| 4 | 123.125.80.74 | 4 | 2 | 1140 | 8979 |
| … | … | … | … | … | … |
Second stage, the foundation of decision tree.
Step S30 extracts training feature vector.
In one embodiment, feature includes second level link number feature, access time frequency characteristic, uplink and downlink traffic characteristic
With any one or more among total data stream measure feature.
Link number feature for page second level: normal software and Trojan software institute request path return the result that there are areas
Not, it can be distinguished according to the difference of the two, general in the page of normal web page browsing also includes multi-interface, and wooden horse is soft
Part access path is similar to downloading is uploaded, grade link or less exactly alike.
For access time frequency characteristic: it is longer in the page residence time when user accesses these pages by app, and
And there is very big probability then to click the link accessed on the page.User in this way accesses the time threshold of the address with regard to larger,
And the time threshold of Trojan software access URL is then relatively small.
For uplink and downlink traffic characteristic: normal use general downlink traffic when accessing network can be greater than upstream in terminal
Amount.Trojan software is controlled by server.Wood after sending specified order to terminal in remote control terminal, in terminal
Horse software carries out response processing, and order is uploaded in requisition for obtained data.Uplink traffic is generally larger than downlink traffic.
For total data stream measure feature: for malice advertisement or wooden horse application for, generally be accessed it is associated
Website after directly carry out flow expend it is huge using downloading task.It wherein may include wooden horse application.
Step S40 establishes decision-tree model using ID3 algorithm according to feature vector.
In one embodiment, step S40 includes: that the mapping of the feature vector and final decision that obtain multiple dimensions is closed
System.Wherein, influence of the vector to final decision that each dimension is differentiated by entropy obtains each dimension according to obtained entropy
The information gain of vector.In one embodiment, step S40 further include: decision-tree model is established according to information gain.At one
In embodiment, step S40 further include: at each branch node of decision-tree model, selected by information gain feature to
Amount.
Specifically, as shown in table 2, a rule is can be found that in the data grabbed, when the two-stage chain that URL includes
When connecing several higher, the threshold value of access time is also larger, and the access frequency in the unit time is also higher.So here to URL
Second level link number, uplink traffic and downlink traffic ratio, the total data flow for including are analyzed.
The data item that table 2 is analyzed
| URL second level links number | Uplink and downlink flow-rate ratio | Total data flow | Possible source |
| It is more | It is small | It is small | Normal APP |
| It is more | It is small | Greatly | Normal APP |
| It is more | It is small | Greatly | Malice APP |
| It is more | Greatly | Greatly | Normal APP |
| It is few | It is small | It is small | Normal APP |
| It is few | It is small | Greatly | Malice APP |
| It is few | Greatly | Greatly | Wooden horse APP |
| It is few | Greatly | It is small | Wooden horse APP |
Two pieces are splitted data into, X={ URL second level links number, uplink and downlink flow-rate ratio, total data flow }, Y={ may come
Source }.Purpose at this stage is to establish a decision tree, allows computer to look for most suitable mapping relations automatically, it may be assumed that Y=f
(X), X is referred to as sample, and Y is referred to as result (behavior/class).Sample is multidimensional, X={ x1, x2... xn, X={ URL here
Second level links number, uplink and downlink flow-rate ratio, total data flow }, by the observational record data of these different dimensions, and reply is not
With as a result, finding regular (mapping relations).The different data influence of the multidimensional of X the final decision of Y.The multidimensional data of X is fought to the finish
The influence of plan is not also identical, and the high influence to decision of priority is also relatively large.Influence degree and on correct result influence
Confidence level can be judged by training sample.
The confidence level of sample is measured by the entropy (Entropy) of information theory.For the public affairs of the entropy of the confusion degree measured
Formula are as follows:
In formula 2, if S is the set of s data sample.It is assumed that class label vector has m different value, m are defined
Different class Ci(i=1,2...m).If siIt is CiSample number in class.In this way formula 2 can give sample classification needed for the phase
Hope information.Wherein piIt is that i-th of sample vector belongs to CiProbability, and use si/sjEstimation.
In equation 1, if vector A has v different value { a1, a2..., av, S can be divided into v with vector A
Subset { S1, S2..., Sv, wherein SjComprising samples some in this way in S, they have value a on Aj.What formula 2 provided is basis
The entropy or expectation information of subset are divided by A.In formulaThe power of j-th of subset is served as, and is equal to subset (i.e.
A value is aj) in number of samples divided by the total sample number in S.Entropy is smaller, and the purity of subset division is higher.Wherein,It is SjIn sample belong to CiThe probability of class.
When information is consistent, all samples belong to a classification I, then entropy is 0, if sample completely random, entropy
It is 1, shows that this feature vector does not help the prediction of this result phase.
Influence of the data of each dimension in data item above to result is calculated below.Differentiated by calculating entropy.Its
In influence of each dimension to result it is as follows:
E (it is more that URL second level links number)=- (3/4) * log (3/4)-(1/4) * log (1/4)=0.2442
E (it is few that URL second level links number)=- (1/4) * log (1/4)=0.2442
E (it is few that URL second level links number)=- (1/4) * log (1/4)-(1/4) * log (1/4)-(2/4) * log (2/4)=
0.4515
E (uplink and downlink flow-rate ratio is small)=- (3/5) * log (3/5)-(2/5) * log (2/5)=0.2922
E (uplink and downlink flow-rate ratio is big)=- (1/3) * log (1/3)-(2/3) * log (2/3)=0.2764
E (total data flow is small)=- (3/4) * log (3/4)-(1/4) * log (1/4)=0.2442
E (total data flow is big)=- (2/5) * log (2/5)-(2/5) * log (2/5)-(1/5) * log (1/5)=
0.4581
After obtaining entropy, the confidence level of each dimension vector is measured with information gain again.In the mistake of construction decision-tree model
Using being greedy algorithm in journey, from top to bottom, recursively construction is set.It is all training at tree root when just starting construction tree
Sample, the vector of training sample be it is classifiable, discretization is carried out to it in advance if it is successive value.Then root
According to the vector of selection, the division of recursion is carried out to sample.Reference statistical metric such as information when selecting test vector
Yield value.Similarly when each branch node of decision number selects vector, also to be used using as decision tree selection vector
The methods of information gain selects vector.Vector is selected using information gain.When the sample on some node of tree belongs to
Identical class, all vectors are all used, and when currently without sample, stop partition tree.
Gain (Sample, Action)=E (Sample)-SUM (| Sample (v) |/Sample*E (Sample (v))) under
Face calculates the information gain of each vector:
Gain (URL second level links number)=E (S)-(4/8) * E (it is more that URL second level links number)-(4/8) * E (URL two-stage chain
It is few to connect number)=1- (4/8) * 0.2442- (4/8) * 0.4515=0.6521
Gain (uplink and downlink flow-rate ratio)=E (S)-(5/8) * E (uplink and downlink flow-rate ratio is small)-(3/8) * E (uplink and downlink flow-rate ratio
Greatly)=1- (5/8) * 0.2922- (3/8) * 0.2764=0.7137
Gain (total data flow)=E (S)-(3/8) * E (total data flow is small)-(5/8) * E (total data flow is big)=
1- (5/8) * 0.2442- (3/8) * 0.4581=0.6756
Then, the training of decision tree is carried out by information gain result.From tree root down successively with it is minimum and maximum into
Row construction decision tree, the information gain situation calculated above for coming out each dimension are as follows: uplink and downlink flow-rate ratio > total data flow > URL
Second level links number.
The decision tree established according to the information gain result of calculating is as shown in Figure 3.
S50 classifies to the data on flows of terminal according to the rule of decision-tree model.
The technical effect of the method for monitoring terminal flow of the invention is illustrated below.
Using ID3 algorithm, 1000 groups of samples are trained, Decision Tree Rule is established.The displaying of selected part sample data,
As shown in table 4.Data vector and vector classification in table is as shown in table 3:
3 data vector title of table and classification
4 training sample data of table
(1) LN indicates that the second level for including in network request link number, MLN indicate the second level for including in network request link number
It is higher, 4 second level links are above as the second level link higher situation of number.FLN indicates that second level link number is less, by 1 to 4
Second level links the number situation less as second level link number.NLN indicates the case where no second level link.
(2) TP indicates the ratio of uplink traffic and downlink traffic, and LTP indicates that uplink traffic and downlink traffic ratio are low, with
Uplink and downlink flow proportional is in 0.5 situation low as ratio below, higher than the situation high as the ratio more than value, table
It is shown as HTP, when downlink traffic is 0, is labeled as MTP.
(3) VF indicates the access frequency of unit time, and HVF indicates that the access frequency of unit time is high, will access per hour
Number 4 times or more high as access frequency, number is low lower than 4 expression access frequencys, is labeled as LVF.
(4) TT indicates total data traffic, that is, the sum of uplink traffic and downlink traffic.TY indicates discharge pattern.Stream
It is more as flow to measure the case where total amount is more than 1.5 times of training sample average flow rate total amount, otherwise the situation few as flow.
(5) TY indicates the discharge pattern, and SF indicates that normal discharge, DG indicate improper flow.
Using WEKA as tool, Decision Tree Rule is established using ID3 algorithm to training sample data, is trained, it is acquired
Decision-tree model it is as shown in Figure 4.The present invention also uses the decision tree that J48 algorithm constructs training sample data simultaneously
Experiment, obtained decision-tree model is same as shown in Figure 4.
According to Decision Tree Rule obtained above, system classifies to subsequent 2595 instance datas, while monitoring root
According to the accuracy rate of decision tree classification.
Instance data using more different numbers is classified, and application decision tree-model carries out decision to flow, is obtained
Result such as shown in following table 5 and table 6:
The evaluation of table 5ID3 classifying quality
| Example sum | Correct classification quantity | Accuracy | Mean absolute error | Root-mean-square error | Opposite absolute error |
| 500 | 470 | 94% | 0.0969 | 0.2232 | 22.6265% |
| 1000 | 940 | 94% | 0.1013 | 0.2267 | 23.0163% |
| 1500 | 1396 | 93.07% | 0.1139 | 0.2397 | 26.6148% |
| 2000 | 1861 | 93.05% | 0.1134 | 0.2385 | 27.122% |
| 2500 | 2318 | 92.72% | 0.1168 | 0.2421 | 27.4652% |
The evaluation of table 6J48 classifying quality
| Example sum | Correct classification quantity | Accuracy | Mean absolute error | Root-mean-square error | Opposite absolute error |
| 500 | 450 | 90% | 0.1 | 0.3162 | 23.3568% |
| 1000 | 890 | 89% | 0.11 | 0.3317 | 24.9841% |
| 1500 | 1253 | 83.53% | 0.1647 | 0.4058 | 38.4817% |
| 2000 | 1678 | 83.9% | 0.161 | 0.4012 | 38.5094% |
| 2500 | 2074 | 82.96% | 0.1704 | 0.4128 | 40.055% |
With the expansion of monitoring scale, the accuracy of application decision tree-model classification it can be seen from monitoring and test effect
It substantially maintains more smoothly horizontal at one.There is the accuracy of ID3 algorithm Decision Classfication to be maintained at 92% or more.Due to normal
It will appear similar situation, institute in some cases using the behavior that the behavior for generating flow and trojan horse application generate flow
It inevitably will appear some wrong reports when being classified, shown by the above test result, error rate can be controlled 8%
Below.
Fig. 5 has carried out a comparison by ID3 decision Tree algorithms, with the classification results of J48 algorithm in the present invention.Such as Fig. 5
Shown, the accuracy of monitoring can be maintained in a higher range by algorithm above when monitoring popularization, and ID3 is calculated
Method is more suitable for monitoring system, and accuracy rate is higher, while stability is also more preferable.
According to an embodiment of the invention, additionally providing a kind of system for monitoring terminal flow, comprising: model building module,
For establishing decision-tree model using ID3 algorithm according to feature vector；Categorization module, for according to decision-tree model to terminal
Data on flows is classified.
The foregoing is merely illustrative of the preferred embodiments of the present invention, is not intended to limit the invention, all in essence of the invention
Within mind and principle, any modification, equivalent replacement, improvement and so on be should all be included in the protection scope of the present invention.
Claims (7)
1. a kind of method for monitoring terminal flow characterized by comprising
S1 establishes decision-tree model using ID3 algorithm according to feature vector；
S2 classifies to the data on flows of terminal according to the rule of the decision-tree model.
2. the method for monitoring terminal flow according to claim 1, which is characterized in that step S1 includes:
Obtain the feature vector of multiple dimensions and the mapping relations of final decision；
Wherein, influence of the vector to final decision that each dimension is differentiated by entropy obtains each dimension according to obtained entropy
Vector information gain.
3. the method for monitoring terminal flow according to claim 2, which is characterized in that step S1 further include:
The decision-tree model is established according to the information gain.
4. the method for monitoring terminal flow according to claim 3, which is characterized in that step S1 further include:
At each branch node of decision-tree model, feature vector is selected by the information gain.
5. the method for monitoring terminal flow according to claim 1, which is characterized in that the feature includes second level link number
Any one or more among feature, access time frequency characteristic, uplink and downlink traffic characteristic and total data stream measure feature.
6. the method for monitoring terminal flow according to claim 1, which is characterized in that before step S1 further include:
Obtain the data on flows that the terminal generates；
The data on flows is carried out to arrange feature vector needed for decision-tree model is established in formation.
7. a kind of system for monitoring terminal flow characterized by comprising
Model building module, for establishing decision-tree model using ID3 algorithm according to feature vector；
Categorization module, for being classified according to data on flows of the decision-tree model to terminal.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201810836617.5A CN109150845A (en) | 2018-07-26 | 2018-07-26 | Monitor the method and system of terminal flow |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201810836617.5A CN109150845A (en) | 2018-07-26 | 2018-07-26 | Monitor the method and system of terminal flow |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN109150845A true CN109150845A (en) | 2019-01-04 |
Family
ID=64798278
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201810836617.5A Pending CN109150845A (en) | 2018-07-26 | 2018-07-26 | Monitor the method and system of terminal flow |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN109150845A (en) |
Cited By (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN110213784A (en) * | 2019-07-05 | 2019-09-06 | 中国联合网络通信集团有限公司 | A kind of method for predicting and device |
| CN111340727A (en) * | 2020-02-26 | 2020-06-26 | 电子科技大学 | Abnormal flow detection method based on GBR image |
| CN111835800A (en) * | 2019-04-17 | 2020-10-27 | 中国移动通信集团福建有限公司 | Internet of things service attribute identification method and device |
| CN113179221A (en) * | 2021-06-30 | 2021-07-27 | 北京浩瀚深度信息技术股份有限公司 | Internet traffic control method and system |
Citations (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US7792770B1 (en) * | 2007-08-24 | 2010-09-07 | Louisiana Tech Research Foundation; A Division Of Louisiana Tech University Foundation, Inc. | Method to indentify anomalous data using cascaded K-Means clustering and an ID3 decision tree |
| CN102271091A (en) * | 2011-09-06 | 2011-12-07 | 电子科技大学 | Method for classifying network abnormal events |
| CN106294667A (en) * | 2016-08-05 | 2017-01-04 | 四川九洲电器集团有限责任公司 | A kind of decision tree implementation method based on ID3 and device |
-
2018
- 2018-07-26 CN CN201810836617.5A patent/CN109150845A/en active Pending
Patent Citations (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US7792770B1 (en) * | 2007-08-24 | 2010-09-07 | Louisiana Tech Research Foundation; A Division Of Louisiana Tech University Foundation, Inc. | Method to indentify anomalous data using cascaded K-Means clustering and an ID3 decision tree |
| CN102271091A (en) * | 2011-09-06 | 2011-12-07 | 电子科技大学 | Method for classifying network abnormal events |
| CN106294667A (en) * | 2016-08-05 | 2017-01-04 | 四川九洲电器集团有限责任公司 | A kind of decision tree implementation method based on ID3 and device |
Non-Patent Citations (1)
| Title |
|---|
| 易军凯等: ""手机流量非侵入式监测的决策树算法"", 《计算机科学》 * |
Cited By (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN111835800A (en) * | 2019-04-17 | 2020-10-27 | 中国移动通信集团福建有限公司 | Internet of things service attribute identification method and device |
| CN111835800B (en) * | 2019-04-17 | 2023-10-27 | 中国移动通信集团福建有限公司 | Internet of things service attribute identification method and device |
| CN110213784A (en) * | 2019-07-05 | 2019-09-06 | 中国联合网络通信集团有限公司 | A kind of method for predicting and device |
| CN111340727A (en) * | 2020-02-26 | 2020-06-26 | 电子科技大学 | Abnormal flow detection method based on GBR image |
| CN113179221A (en) * | 2021-06-30 | 2021-07-27 | 北京浩瀚深度信息技术股份有限公司 | Internet traffic control method and system |
| CN113179221B (en) * | 2021-06-30 | 2021-09-21 | 北京浩瀚深度信息技术股份有限公司 | Internet traffic control method and system |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| WO2021189729A1 (en) | Information analysis method, apparatus and device for complex relationship network, and storage medium | |
| CN109150845A (en) | Monitor the method and system of terminal flow | |
| CN106570513B (en) | The method for diagnosing faults and device of big data network system | |
| CN104539484B (en) | A kind of method and system of dynamic evaluation network connection confidence level | |
| CN105069470A (en) | Classification model training method and device | |
| US20090089285A1 (en) | Method of detecting spam hosts based on propagating prediction labels | |
| CN112926045A (en) | Group control equipment identification method based on logistic regression model | |
| CN113205134A (en) | Network security situation prediction method and system | |
| CN108809989A (en) | A kind of detection method and device of Botnet | |
| CN112733146A (en) | Penetration testing method, device and equipment based on machine learning and storage medium | |
| CN111191720B (en) | Service scene identification method and device and electronic equipment | |
| CN115098650A (en) | Comment information analysis method based on historical data model and related device | |
| CN115204536A (en) | Building equipment fault prediction method, device, equipment and storage medium | |
| JP2007243459A (en) | Traffic state extracting apparatus and method, and computer program | |
| US11188949B2 (en) | Segment content optimization delivery system and method | |
| CN111612531B (en) | Click fraud detection method and system | |
| CN112035775B (en) | User identification method and device based on random forest model and computer equipment | |
| CN109657123A (en) | A kind of food safety affair clustering method based on comentropy | |
| CN106651630B (en) | Crucial electricity consumption industry recognition methods and system | |
| Wang et al. | A mixture model-based clustering method for fundamental diagram calibration applied in large network simulation | |
| CN111159508A (en) | Anomaly detection algorithm integration method and system based on algorithm diversity | |
| CN115392351A (en) | Risk user identification method and device, electronic equipment and storage medium | |
| CN105447148A (en) | Cookie identifier association method and apparatus | |
| CN115062013A (en) | Information recommendation method, device, equipment and storage medium | |
| CN111325246B (en) | Region selection method and device, computer equipment and storage medium |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| RJ01 | Rejection of invention patent application after publication | ||
| RJ01 | Rejection of invention patent application after publication |
Application publication date: 20190104 |