CN109284221A - A kind of early warning system and method - Google Patents
A kind of early warning system and method Download PDFInfo
- Publication number
- CN109284221A CN109284221A CN201811285176.0A CN201811285176A CN109284221A CN 109284221 A CN109284221 A CN 109284221A CN 201811285176 A CN201811285176 A CN 201811285176A CN 109284221 A CN109284221 A CN 109284221A
- Authority
- CN
- China
- Prior art keywords
- operand
- abnormal
- transaction
- server
- evidence
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/30—Monitoring
- G06F11/34—Recording or statistical evaluation of computer activity, e.g. of down time, of input/output operation ; Recording or statistical evaluation of user activity, e.g. usability assessment
- G06F11/3438—Recording or statistical evaluation of computer activity, e.g. of down time, of input/output operation ; Recording or statistical evaluation of user activity, e.g. usability assessment monitoring of user actions
Landscapes
- Engineering & Computer Science (AREA)
- General Engineering & Computer Science (AREA)
- Theoretical Computer Science (AREA)
- Computer Hardware Design (AREA)
- Quality & Reliability (AREA)
- Physics & Mathematics (AREA)
- General Physics & Mathematics (AREA)
- Financial Or Insurance-Related Operations Such As Payment And Settlement (AREA)
- Debugging And Monitoring (AREA)
Abstract
The invention discloses a kind of early warning system and methods, comprising: the default transaction of the continual automatic imitation of automated transaction server monitors default transaction first operand evidence in the process of implementation；Analysis server analyzes whether first operand evidence is abnormal data, and abnormal first operand evidence is sent to Analysis server；Analysis server judges whether the first record screen picture is abnormal, and abnormal record screen picture is sent to warning center server；Warning center server, according to analysis, determines abnormal cause and Forewarning Measures to first operand.In this way, can timely recognize the abnormal conditions of transaction, and determine Forewarning Measures.
Description
Technical field
The present invention relates to system early warning field more particularly to a kind of early warning systems and method.
Background technique
Currently, banking system will execute many transaction daily, sometimes due to system problem or network problem can be sent out
Raw blunt phenomenon of trading, but even if client has found that appearance is blunt, can't be complained at once.This for appearance is asked
Topic cannot achieve effective early warning to transaction system.
It is usually pre- to the carry out such as the service condition of CPU, hard drive space also, in the prior art, for the early warning of system
It is alert, and there is no the method for early warning to transaction system.
Summary of the invention
In view of this, the system includes: to realize transaction system the embodiment of the invention discloses a kind of early warning system and method
The method for early warning of system, and can recognize abnormal conditions immediately, and make corresponding Forewarning Measures.
The embodiment of the invention discloses a kind of early warning systems, comprising:
Automated transaction server, record screen video camera, Analysis server, warning center server；
The automated transaction server is used for, the default transaction of continual automatic imitation, and is monitored the default transaction and existed
The first of each operation executes the time in implementation procedure, and the first execution time is sent to the Analysis server；
Video camera is shielded in the record, executes for the continual default transaction to the automated transaction server automatic imitation
The display picture of process is recorded, and obtains the first record screen picture, and the first record screen picture is sent to the analysis in advance
Alert server；
The Analysis server, for the first operand to the default transaction received according to analyzing, it is determined whether
The first operand evidence is sent to the warning center service if first operation is abnormal data for abnormal data
Device；The first operand evidence of the default transaction includes: the first record screen picture and/or the first exchange hour；The warning center
Server for receiving abnormal first operand evidence, and analyzes the transaction and abnormal reason occurs, according to described abnormal
Reason determines Forewarning Measures.
Optionally, the Analysis server, comprising:
Time signal Analysis server and record screen picture analysis server；
The time signal Analysis server, for receiving the of the default transaction of the automated transaction server automatic imitation
One executes the time, judges that described first executes whether the time is abnormal, and send the early warning for the first abnormal execution time
Central server；
Whether record screen picture analysis server judges the first record screen picture for receiving the first record screen picture
It is abnormal, the warning center server is sent by the first abnormal record screen picture.
Optionally, the time signal Analysis server is specifically used for:
Judge that described first executes whether the time has been more than preset time threshold, will be more than preset time threshold
First execution time was sent to the warning center server；
Optionally, picture analysis server is shielded in the record, is used for:
Judge it is described first record screen picture it is whether consistent with the operation screen of the pre-stored default transaction, will with it is pre-
The first inconsistent record screen picture of the operation screen of the default transaction first stored is sent to the warning center server.
Optionally, further includes:
Monitor terminal executes the second operand evidence in the implementation procedure of default transaction for acquiring pre-set user, and will
The second operand is according to the Analysis server is sent to, so that second operation of the Analysis server to receiving
Data are analyzed, and determine whether the second operand evidence is abnormal data, if second operand evidence is abnormal data,
The second operand evidence is sent to the warning center server, the second operation described in the warning center server analysis
The reason of data are abnormal data, and according to the second operand according to being abnormal data the reason of, determine that corresponding early warning is arranged
It applies；The second operand is according to including: that the second record screen picture recorded during user executes default transaction and/or user hold
The second of each operation monitored in the default process of exchange of row executes the time.
Optionally, the Analysis server is also used to:
To not occur abnormal first operand according to or do not occur abnormal second operand according to being sent to warning center clothes
Business device, so that the warning center server is long according to the preset time is saved by the first operand evidence or second operand
Degree.
Optionally, the warning center server is also used to:
In the first operand according to there are when abnormal operation, transfer second operand relevant to first object transaction
According to, and determine that the reason of abnormal operation occurs in operation for the first time according to the abnormal conditions of the second operand evidence；The target
Transaction is the generation first operand according to performed transaction；
Or
When the second operand is according to having abnormal, first operand relevant to the second target transaction is transferred
According to, and determine that abnormal reason occurs in second operation according to the abnormal conditions of the first operand evidence.
The embodiment of the invention also discloses a kind of method for early warning, the method is applied to the early warning system, comprising:
The default transaction of continual automatic imitation；
Monitor operation data during simulation default transaction；The operation data, which includes: that simulation is default, traded
The the first record screen picture recorded in process of exchange is preset in the first execution time of each operation and simulation in journey；
Judge whether the operation data is abnormal data；
If the operation data is abnormal data, the reason of first operand is according to being abnormal data is analyzed；
The reason of according to the first operand according to being abnormal data, determine corresponding Forewarning Measures.
Optionally, further includes:
Acquire user's second operand evidence during executing default transaction；The second operand evidence includes: user
The the second execution time and user for executing each operation in default process of exchange execute the recorded in the default process of exchange
Two record screen pictures；
Judge whether the second operand evidence is abnormal data；
If the second operand analyzes the reason of second operand is according to being abnormal data according to being abnormal data；
The reason of according to the second operand according to being abnormal data, determine corresponding Forewarning Measures.
Optionally, further includes:
In the first operand according to there are when abnormal operation, transfer second operand relevant to first object transaction
According to, and determine that the reason of abnormal operation occurs in operation for the first time according to the abnormal conditions of the second operand evidence；The target
Transaction is the generation first operand according to performed transaction；
Or
When the second operand is according to having abnormal, first operand relevant to the second target transaction is transferred
According to, and determine that abnormal reason occurs in second operation according to the abnormal conditions of the first operand evidence.
The embodiment of the invention discloses a kind of early warning system and method, which includes: that automated transaction server is used for, no
The default transaction of intermittent automatic imitation, and monitor the first of default each operation in the process of implementation of trading and execute the time,
The first execution time is sent to the Analysis server；Record screen video camera, for continual to automated transaction service
The display picture of the default transaction implementation procedure of device automatic imitation is recorded, and obtains the first record screen picture, and the first record is shielded
Picture is sent to Analysis server；Analysis server, for the first operand to the default transaction received according to analyzing,
Determine whether that first operand evidence is sent to warning center server if the first operation is abnormal data for abnormal data；In advance
If the first operand evidence of transaction includes: the first record screen picture and/or the first exchange hour；Warning center server, for connecing
Abnormal first operand evidence is received, and analyzes transaction and abnormal reason occurs, Forewarning Measures are determined according to abnormal reason.In this way
The method for early warning of transaction system is realized, and can recognize abnormal conditions immediately, and determine corresponding Forewarning Measures.
Detailed description of the invention
In order to more clearly explain the embodiment of the invention or the technical proposal in the existing technology, to embodiment or will show below
There is attached drawing needed in technical description to be briefly described, it should be apparent that, the accompanying drawings in the following description is only this
The embodiment of invention for those of ordinary skill in the art without creative efforts, can also basis
The attached drawing of offer obtains other attached drawings.
Fig. 1 shows a kind of structural schematic diagram of early warning system provided in an embodiment of the present invention；
Fig. 2 shows a kind of another schematic diagrames of early warning system provided in an embodiment of the present invention；
Fig. 3 shows a kind of another structural schematic diagram of early warning system provided in an embodiment of the present invention；
Fig. 4 shows the structural schematic diagram of monitor terminal provided in an embodiment of the present invention；
Fig. 5 shows a kind of flow diagram of method for early warning provided in an embodiment of the present invention；
Fig. 6 shows a kind of another flow diagram of method for early warning provided in an embodiment of the present invention.
Specific embodiment
Following will be combined with the drawings in the embodiments of the present invention, and technical solution in the embodiment of the present invention carries out clear, complete
Site preparation description, it is clear that described embodiments are only a part of the embodiments of the present invention, instead of all the embodiments.It is based on
Embodiment in the present invention, it is obtained by those of ordinary skill in the art without making creative efforts every other
Embodiment shall fall within the protection scope of the present invention.
With reference to Fig. 1, a kind of structural schematic diagram of early warning system provided in an embodiment of the present invention is shown, in the present embodiment
In, which includes:
Automated transaction server 100, record screen video camera 200, Analysis server 300, warning center server 400；
The automated transaction server 100 is used for, the default transaction of continual automatic imitation, and monitors the default transaction
The first of each operation executes the time in the process of implementation, and the first execution time is sent to the Analysis server；
Wherein, automated transaction server 100 can adjust some to trade automatically, and execute automatically.Such as: automated transaction clothes
Business device can use Selenium WebDriver tool, and script according to the pre-stored data adjust some to trade, automatically automatically
Open transaction page, automatic form filling list, automatically clicking transmission etc..
In the present embodiment, the execution for each transaction includes multiple operating process, for example, trade for inquiry into balance,
It may include: to open the page, input identity information, click inquiry button, pop-up remaining sum interface etc., the execution time of each operation
It requires to be recorded.
Video camera 200 is shielded in the record, for the continual default friendship to 100 automatic imitation of automated transaction server
The display picture of easy implementation procedure is recorded, and the first record screen picture is obtained, and the first record screen picture is sent to described
Analysis and early warning server；
For example: when being simulated to each transaction execution, when being operated in financial transaction system, operating
During execution, showing will appear the operation interface after each operation executes in equipment, and record screen video camera can set display
The operation interface of standby upper appearance is recorded, and the record screen picture operated in transaction implementation procedure is obtained.
The Analysis server 300, for the first operand to the default transaction received according to analyzing, determination is
No is abnormal data, if first operation is abnormal data, the first operand is taken according to the warning center is sent to
Business device；The first operand evidence of the default transaction includes: the first record screen picture and/or the first exchange hour；
The warning center server 400, for receiving abnormal first operand evidence, and it is different to analyze the transaction appearance
Normal reason determines Forewarning Measures according to the abnormal reason.
In the present embodiment, different users operate some transaction when, due to client installation various plug-in units difference,
Or since different geographical network condition is also different, abnormal conditions Producing reason is also different, it is therefore desirable to different situations
It is simulated.In this way, in the present embodiment, different trading servers can simulate different trading environment and different networks
Environment, specifically, the different trading server includes different trading environment and/or in different network environments.
Wherein, different trading environment can be expressed as the running environment of transaction, such as: different operation plug-in unit, difference
Browser etc..Different network environments can be expressed as the Network status of transaction operation, for example, the Network status of different geographical
May be different, therefore can be by automated transaction server distribution to different geographical.
It is continual by the implementation procedure of the continual automatic imitation transaction of automated transaction server in the present embodiment
It is automatic to execute process of exchange, and operation data in process of exchange is recorded, and operation data is sent to Analysis server,
Analysis server analyzes whether operation data is abnormal data, if the operation data is abnormal data, by the operand of the exception
According to being sent to warning center server, and then determine abnormal cause and Forewarning Measures.The early warning of transaction system has been achieved
Method, and can timely recognize abnormal conditions, and make corresponding Forewarning Measures.
Embodiment two:
With reference to Fig. 2, Analysis server 300 includes:
Time signal Analysis server 301 and record screen picture analysis server 302；
The time signal Analysis server 301, for receiving, 100 automatic imitation of automated transaction server is default to be handed over
Easy first executes the time, judges that described first executes whether the time is abnormal, and send institute for the first abnormal execution time
State warning center server；
Record screen picture analysis server 302 judges that the first record screen picture is for receiving the first record screen picture
The first abnormal record screen picture is sent the warning center server by no exception.
In the present embodiment, to the first execution time whether with the judgment methods of abnormal conditions may include it is a variety of, in this reality
It applies in example, without restriction, such as can be by judging whether the first execution time was greater than some threshold value, specifically, when described
Between signal receive server 200, be used for:
Judge that described first executes whether the time has been more than corresponding time threshold, will be more than corresponding time threshold
First execution time was sent to the warning center server.
It is understood that each operation corresponds to an execution time, each since each transaction includes multiple operations
Execute time corresponding time threshold can be it is identical be also possible to it is different.
For example: when executing inquiry transaction, comprising: input account, Password Operations, response account number cipher display inquiry
Interface operation etc..Early warning system can be monitored the execution time of each operation of transaction, wherein for example: when execution
Between can be understood as since jump to related interfaces begin to user determine execute complete time.
In the present embodiment, the analysis of picture, such as the picture that can be generated according to the normal operating of transaction are shielded for the first record
The the first record screen picture generated in face of mock trading is analyzed, specifically, picture analysis server 302 is shielded in the record, specifically
For:
Judge it is described first record screen picture it is whether consistent with the operation screen of the pre-stored default transaction, will with it is pre-
The first inconsistent record screen picture of the operation screen of the default transaction first stored is sent to the warning center server.
Wherein, user to record screen picture analyze when, can by a variety of image processing methods, in the present embodiment,
Without restriction, such as can be using Graph analysis methods such as edge detections.
In the present embodiment, exception is analyzed in time signal Analysis server 301 or record screen picture analysis server 302
Afterwards, the first abnormal picture of the first abnormal execution time or exception is sent to center Warning Service device 400, so that center is pre-
Alert server analyzes abnormal cause.
It is continual by the implementation procedure of the continual automatic imitation transaction of automated transaction server in the present embodiment
It is automatic to execute process of exchange, and in process of exchange the first execution time and the first record screen picture record, and by first
It executes the time and the first record screen picture is sent to Analysis server, Analysis server is by dividing execution time and display picture
Analysis, and the first abnormal execution time and the first abnormal record screen picture are sent to warning center server, and then determine
Abnormal cause and Forewarning Measures.The method for early warning of transaction system has been achieved, and can timely recognize abnormal conditions,
And make corresponding Forewarning Measures.
Embodiment three:
In the case of the sluggishness or mistake of appearance, including a variety of reasons, it may be possible to transaction system or network
Caused by reason, these situations can be detected by way of automatic imitation, but it is also possible that user's habit causes
Greatly, this kind of situation can not be detected by way of automatic imitation, therefore, more accurate abnormal cause in order to obtain, this reality
It applies in example, is monitored by use habit to some sample users and implementation procedure, specifically, with reference to Fig. 3, the early warning
The structure of system can also include:
Monitor terminal 500 executes the second operand evidence in the implementation procedure of default transaction for acquiring pre-set user, and
The second operand evidence is sent to the Analysis server；The second operand evidence includes: that user executes default transaction
During the second record screen picture for recording and/or user execute second monitored in default process of exchange and execute the time.
Wherein, with reference to Fig. 4, the monitor terminal 500 may include: that the second execution time monitoring module 501 and record screen are set
Standby 502；
Described second executes time monitoring module 501, executes each operation in default process of exchange for monitoring user
Second executes the time；
The record screen equipment 502, the second record screen picture recorded during executing default transaction for user.
Wherein, Analysis server 300 is used for, and is receiving second operand after, second operation to receiving
Data are analyzed, and determine whether the second operand evidence is abnormal data, if second operand evidence is abnormal data,
The second operand evidence is sent to the warning center server 400；
Wherein, warning center server 400 is used for, and the evidence of second operand described in the warning center server analysis is different
The reason of regular data, and according to the second operand according to being abnormal data the reason of, determine corresponding Forewarning Measures.This implementation
In example, to the second execution time whether with the judgment methods of abnormal conditions may include it is a variety of, in the present embodiment, without limit
It is fixed, such as can be by judging whether the second execution time was greater than some threshold value, specifically, including:
Judge that described second executes whether the time has been more than preset time threshold, if the second execution time has been more than pre-
If time threshold, then it represents that described second to execute the time be abnormal data.
It is understood that each operation corresponds to an execution time, each since each transaction includes multiple operations
Execute time corresponding time threshold can be it is identical be also possible to it is different.
For example: when executing inquiry transaction, comprising: input account, Password Operations, response account number cipher display inquiry
Interface operation etc..Early warning system can be monitored the execution time of each operation of transaction, wherein for example: when execution
Between can be understood as since jump to related interfaces begin to user determine execute complete time.
In the present embodiment, the analysis of picture, such as the picture that can be generated according to the normal operating of transaction are shielded for the first record
The the first record screen picture generated in face of mock trading is analyzed, specifically, picture analysis server 302 is shielded in the record, specifically
For:
Judge it is described first record screen picture it is whether consistent with the operation screen of the pre-stored default transaction, will with it is pre-
The first inconsistent record screen picture of the operation screen of the default transaction first stored is sent to the warning center server.
Wherein, user to record screen picture analyze when, can by a variety of image processing methods, in the present embodiment,
Without restriction, such as can be using Graph analysis methods such as edge detections.
In the present embodiment, by the monitoring to artificial use habit, the second record screen picture is obtained, and to the second record screen picture
Face is analyzed, and can monitor the abnormal conditions as caused by the use habit of user in this way, and then available more quasi-
True Forewarning Measures.
Example IV
In the present embodiment, first operand evidence or second operand is caused to have much according to there is the reason of abnormal conditions,
The problem of the problem of may be operating system, network, it is also possible to the problem of user's operation etc., wherein operating system problem category
In the general character the problem of, the problem of the problem of network problem good user's operation is not belonging to general character, it can be expressed as individual character herein
Problem；Aiming at the problem that general character, if such as some area operating system go wrong, then either automatic imitation trade
Or user can generate abnormal operation data when executing transaction；But aiming at the problem that individual character, behaviour that automatic imitation obtains
Very big gap can be occurred from the operation data that operation obtains by making data and user.Therefore, more accurately abnormal in order to obtain
The reason of happening, center Warning Service device can be to the sample of users for the first operand evidence and use that automatic imitation generates
Second operand according to carry out cross validation, specifically, center Warning Service device is also used to:
In the first operand according to there are when abnormal operation, transfer second operand relevant to first object transaction
According to, and determine that the reason of abnormal operation occurs in operation for the first time according to the abnormal conditions of the second operand evidence；The target
Transaction is the generation first operand according to performed transaction；
Or
When the second operand is according to having abnormal, first operand relevant to the second target transaction is transferred
According to, and determine that abnormal reason occurs in second operation according to the abnormal conditions of the first operand evidence.
Wherein, the first operand generated in automatic imitation is according to there are in the case where abnormal operation, transfer and the first mesh
Mark trades related second operand according to being to need to meet certain condition, specifically, the condition may include:
The second operand relevant to first object transaction transferred evidence is expressed as the second object run data first,
In, according to the time consistency of generation, this is unanimously not necessarily completely for the time of the second object run data generation and first operand
It is identical, can be the preset time interval of difference, and what is transferred should be the same area, for example, if the first operation
Data are the data that Weifang Prefecture generates, and the second object run data should also be the data of Weifang Prefecture's generation.
Correspondingly, acquisition user's operation generate second operand according to there are in the case where abnormal operation, transfer with
The relevant first operand of second target transaction is according to being also to need to meet above-mentioned condition, it may be assumed that will transfer and the second mesh first
Mark trades relevant first operand according to being expressed as first object operation data, wherein first object operation data generate when
Between and second operand according to the time consistency of generation, this is unanimously not necessarily complete identical, can be the difference preset time
Interval, and what is transferred should be the same area, for example, if second operand evidence is the data that Weifang Prefecture generates, the
One object run data should also be the data of Weifang Prefecture's generation.
With reference to Fig. 5, a kind of flow diagram of method for early warning provided in an embodiment of the present invention is shown, in the present embodiment
In, this method comprises:
S501: the default transaction of continual automatic imitation；
S502: operation data during simulation default transaction is monitored；The operation data, which includes: that simulation is default, to be handed over
The first of each operation, which executes the time and simulate the first record recorded in default process of exchange, during easily shields picture；
S503: judge whether the operation data is abnormal data；
S504: if the operation data is abnormal data, the reason of first operand is according to being abnormal data is analyzed；
S505: the reason of according to the first operand according to being abnormal data, corresponding Forewarning Measures are determined.
It can be by a variety of methods, in the present embodiment, without limiting, for example including as follows to the judgement of abnormal conditions
Two ways:
Mode one:
Judge that described first executes whether the time has been more than preset time threshold；
If being more than preset time threshold, then it represents that sluggish abnormal conditions occur.
Mode two:
Judge whether the first record screen picture is consistent with pre-stored display picture；
If inconsistent, then it represents that occur executing the abnormal conditions of mistake.
In the present embodiment, for transaction simulation can under different trading environment or different network environments into
Row.
Wherein, different trading environment can be expressed as the running environment of transaction, such as: different operation plug-in unit, difference
Browser etc..Different network environments can be expressed as the Network status of transaction operation.
In the present embodiment, the default transaction of the continual automatic imitation of automated transaction server, and monitor default transaction and holding
The first of each operation executes the time during row, and the first execution time was sent to time signal and receives server；Time letter
Number server is received, receive first and execute the time, judge whether the first execution time is abnormal, executed the time for abnormal first and send out
It is sent to warning center server；In the implementation procedure of transaction, it is also necessary to video camera is shielded by record, it is continual to default transaction
The display picture of implementation procedure recorded, obtain the first record screen information, and it is pre- that the first record screen information is sent to analysis
Alert server.Analysis and early warning server receives the first record screen picture, judge whether the first record screen picture is abnormal, and by exception
Record screen picture is sent to warning center server；Warning center server, to abnormal first received execute the time and/or
The first abnormal record screen picture is analyzed, and determines abnormal cause, and determine Forewarning Measures according to the abnormal cause.
In the present embodiment, in the case of the sluggishness or mistake of appearance, it may be possible to caused by user is accustomed to, therefore,
More accurate abnormal cause in order to obtain in the present embodiment, passes through the use habit and implementation procedure to some sample users
It is monitored, specifically, with reference to Fig. 6, further includes:
S601: acquisition user second operand evidence during executing default transaction；The second operand is according to including:
User executes the second execution time of each operation in default process of exchange and user executes and records in the default process of exchange
Second record screen picture；
S602: judge whether the second operand evidence is abnormal data；
S603: if the second operand analyzes the second operand according to the original for being abnormal data according to being abnormal data
Cause；
S604: the reason of according to the second operand according to being abnormal data, corresponding Forewarning Measures are determined.
In the present embodiment, by the monitoring to artificial use habit, the second record screen picture is obtained, and to the second record screen picture
Face is analyzed, and can monitor the abnormal conditions as caused by the use habit of user in this way, and then available more quasi-
True Forewarning Measures.
In the present embodiment, first operand evidence or second operand is caused to have much according to there is the reason of abnormal conditions,
The problem of the problem of may be operating system, network, it is also possible to the problem of user's operation etc., wherein operating system problem category
In the general character the problem of, the problem of the problem of network problem good user's operation is not belonging to general character, it can be expressed as individual character herein
Problem；Aiming at the problem that general character, if such as some area operating system go wrong, then either automatic imitation trade
Or user can generate abnormal operation data when executing transaction；But aiming at the problem that individual character, behaviour that automatic imitation obtains
Very big gap can be occurred from the operation data that operation obtains by making data and user.Therefore, more accurately abnormal in order to obtain
The reason of happening can also be verified by following step:
In the first operand according to there are when abnormal operation, transfer second operand relevant to first object transaction
According to, and determine that the reason of abnormal operation occurs in operation for the first time according to the abnormal conditions of the second operand evidence；The target
Transaction is the generation first operand according to performed transaction；
Or
When the second operand is according to having abnormal, first operand relevant to the second target transaction is transferred
According to, and determine that abnormal reason occurs in second operation according to the abnormal conditions of the first operand evidence.
Wherein, the first operand generated in automatic imitation is according to there are in the case where abnormal operation, transfer and the first mesh
Mark trades related second operand according to being to need to meet certain condition, specifically, the condition may include:
The second operand relevant to first object transaction transferred evidence is expressed as the second object run data first,
In, according to the time consistency of generation, this is unanimously not necessarily completely for the time of the second object run data generation and first operand
It is identical, can be the preset time interval of difference, and what is transferred should be the same area, for example, if the first operation
Data are the data that Weifang Prefecture generates, and the second object run data should also be the data of Weifang Prefecture's generation.
Correspondingly, acquisition user's operation generate second operand according to there are in the case where abnormal operation, transfer with
The relevant first operand of second target transaction is according to being also to need to meet above-mentioned condition, it may be assumed that will transfer and the second mesh first
Mark trades relevant first operand according to being expressed as first object operation data, wherein first object operation data generate when
Between and second operand according to the time consistency of generation, this is unanimously not necessarily complete identical, can be the difference preset time
Interval, and what is transferred should be the same area, for example, if second operand evidence is the data that Weifang Prefecture generates, the
One object run data should also be the data of Weifang Prefecture's generation.
In the present embodiment, by above-mentioned cross validation, available more accurate abnormal cause.
It should be noted that all the embodiments in this specification are described in a progressive manner, each embodiment weight
Point explanation is the difference from other embodiments, and the same or similar parts between the embodiments can be referred to each other.
The foregoing description of the disclosed embodiments enables those skilled in the art to implement or use the present invention.
Various modifications to these embodiments will be readily apparent to those skilled in the art, as defined herein
General Principle can be realized in other embodiments without departing from the spirit or scope of the present invention.Therefore, of the invention
It is not intended to be limited to the embodiments shown herein, and is to fit to and the principles and novel features disclosed herein phase one
The widest scope of cause.
Claims (10)
1. a kind of early warning system characterized by comprising
Automated transaction server, record screen video camera, Analysis server, warning center server；
The automated transaction server is used for, the default transaction of continual automatic imitation, and is monitored the default transaction and executed
The first of each operation executes the time in the process, and the first execution time is sent to the Analysis server；
Video camera, the execution for the continual default transaction to the automated transaction server automatic imitation are shielded in the record
The display picture of journey is recorded, and obtains the first record screen picture, and the first record screen picture is sent to the analysis and early warning
Server；
The Analysis server, for the first operand to the default transaction received according to analyzing, it is determined whether be different
The first operand evidence is sent to the warning center server if first operation is abnormal data by regular data；Institute
The first operand evidence for stating default transaction includes: the first record screen picture and/or the first exchange hour；The warning center service
Device for receiving abnormal first operand evidence, and analyzes the transaction and abnormal reason occurs, according to the abnormal reason
Determine Forewarning Measures.
2. early warning system according to claim 1, which is characterized in that the Analysis server, comprising:
Time signal Analysis server and record screen picture analysis server；
The time signal Analysis server, first for receiving the default transaction of the automated transaction server automatic imitation holds
The row time judges that described first executes whether the time is abnormal, and sends the warning center for the first abnormal execution time
Server；
Record screen picture analysis server shields picture for receiving first record, judges whether the first record screen picture is abnormal,
The warning center server is sent by the first abnormal record screen picture.
3. early warning system according to claim 2, which is characterized in that the time signal Analysis server is specifically used for:
Judge that described first executes whether the time has been more than preset time threshold, will be more than the first of preset time threshold
The execution time is sent to the warning center server.
4. early warning system according to claim 2, which is characterized in that picture analysis server is shielded in the record, is used for:
Judge it is described first record screen picture it is whether consistent with the operation screen of the pre-stored default transaction, will with deposit in advance
The first inconsistent record screen picture of the operation screen of the default transaction of storage is sent to the warning center server.
5. early warning system according to claim 1, which is characterized in that further include:
Monitor terminal executes the second operand evidence in the implementation procedure of default transaction for acquiring pre-set user, and will be described
Second operand is according to the Analysis server is sent to, so that the Analysis server is to the second operand evidence received
It is analyzed, determines the second operand according to whether being abnormal data, if second operand evidence is abnormal data, by institute
It states second operand evidence and is sent to the warning center server, second operand evidence described in the warning center server analysis
The reason of for abnormal data, and according to the second operand according to being abnormal data the reason of, determine corresponding Forewarning Measures；Institute
Stating second operand evidence includes: that the second record recorded during transaction is preset in user's execution shields picture and/or user's execution in advance
If the second of each operation monitored in process of exchange executes the time.
6. early warning system according to claim 5, which is characterized in that the Analysis server is also used to:
To not occur abnormal first operand according to or do not occur abnormal second operand according to being sent to warning center server,
So that the warning center server is by the first operand evidence or second operand according to the preset time span of preservation.
7. early warning system according to claim 6, which is characterized in that the warning center server is also used to:
In the first operand according to there are when abnormal operation, transferring second operand evidence relevant to first object transaction, and
Determine that the reason of abnormal operation occurs in operation for the first time according to the abnormal conditions of the second operand evidence；The target transaction is
The first operand is generated according to performed transaction；
Or
When the second operand is according to having abnormal, first operand evidence relevant to the second target transaction is transferred,
And determine that abnormal reason occurs in second operation according to the abnormal conditions of the first operand evidence.
8. a kind of method for early warning, which is characterized in that the method is applied to the early warning system, comprising:
The default transaction of continual automatic imitation；
Monitor operation data during simulation default transaction；The operation data includes: to simulate in default process of exchange
The the first record screen picture recorded in first execution time of each operation and the default process of exchange of simulation；
Judge whether the operation data is abnormal data；
If the operation data is abnormal data, the reason of first operand is according to being abnormal data is analyzed；
The reason of according to the first operand according to being abnormal data, determine corresponding Forewarning Measures.
9. method for early warning according to claim 8, which is characterized in that further include:
Acquire user's second operand evidence during executing default transaction；The second operand evidence includes: user's execution
The second execution time of each operation and user execute the second record recorded in the default process of exchange in default process of exchange
Shield picture；
Judge whether the second operand evidence is abnormal data；
If the second operand analyzes the reason of second operand is according to being abnormal data according to being abnormal data；
The reason of according to the second operand according to being abnormal data, determine corresponding Forewarning Measures.
10. method for early warning according to claim 9, which is characterized in that further include:
In the first operand according to there are when abnormal operation, transferring second operand evidence relevant to first object transaction, and
Determine that the reason of abnormal operation occurs in operation for the first time according to the abnormal conditions of the second operand evidence；The target transaction is
The first operand is generated according to performed transaction；
Or
When the second operand is according to having abnormal, first operand evidence relevant to the second target transaction is transferred,
And determine that abnormal reason occurs in second operation according to the abnormal conditions of the first operand evidence.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201811285176.0A CN109284221B (en) | 2018-10-31 | 2018-10-31 | Early warning system and method |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201811285176.0A CN109284221B (en) | 2018-10-31 | 2018-10-31 | Early warning system and method |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN109284221A true CN109284221A (en) | 2019-01-29 |
| CN109284221B CN109284221B (en) | 2022-06-03 |
Family
ID=65174609
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201811285176.0A Active CN109284221B (en) | 2018-10-31 | 2018-10-31 | Early warning system and method |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN109284221B (en) |
Cited By (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN110225196A (en) * | 2019-05-30 | 2019-09-10 | 维沃移动通信有限公司 | Terminal control method and terminal device |
| CN110519558A (en) * | 2019-07-19 | 2019-11-29 | 苏州浪潮智能科技有限公司 | The processing method and its Baseboard Management Controller of video data |
| CN113596402A (en) * | 2021-07-29 | 2021-11-02 | 上海浦东发展银行股份有限公司 | In-service monitoring method, device, equipment, system and storage medium |
Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN105589783A (en) * | 2014-11-18 | 2016-05-18 | 广州市动景计算机科技有限公司 | Application program lag problem data obtaining method and device |
| CN105913088A (en) * | 2016-04-13 | 2016-08-31 | 厦门美图移动科技有限公司 | Lag identification method, lag identification device and computing equipment |
| CN106297130A (en) * | 2016-08-22 | 2017-01-04 | 国家电网公司 | Transmission line of electricity video analysis early warning system |
| US20180302494A1 (en) * | 2017-04-12 | 2018-10-18 | Wyse Technology L.L.C. | Analytics driven update notification |
-
2018
- 2018-10-31 CN CN201811285176.0A patent/CN109284221B/en active Active
Patent Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN105589783A (en) * | 2014-11-18 | 2016-05-18 | 广州市动景计算机科技有限公司 | Application program lag problem data obtaining method and device |
| CN105913088A (en) * | 2016-04-13 | 2016-08-31 | 厦门美图移动科技有限公司 | Lag identification method, lag identification device and computing equipment |
| CN106297130A (en) * | 2016-08-22 | 2017-01-04 | 国家电网公司 | Transmission line of electricity video analysis early warning system |
| US20180302494A1 (en) * | 2017-04-12 | 2018-10-18 | Wyse Technology L.L.C. | Analytics driven update notification |
Cited By (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN110225196A (en) * | 2019-05-30 | 2019-09-10 | 维沃移动通信有限公司 | Terminal control method and terminal device |
| CN110519558A (en) * | 2019-07-19 | 2019-11-29 | 苏州浪潮智能科技有限公司 | The processing method and its Baseboard Management Controller of video data |
| CN113596402A (en) * | 2021-07-29 | 2021-11-02 | 上海浦东发展银行股份有限公司 | In-service monitoring method, device, equipment, system and storage medium |
Also Published As
| Publication number | Publication date |
|---|---|
| CN109284221B (en) | 2022-06-03 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| US10453161B2 (en) | Watermarking and scalability techniques for a virtual desktop planning tool | |
| US9935854B2 (en) | Infrastructure performance monitoring | |
| US9647909B2 (en) | Monitor a data center infrastructure | |
| US10002144B2 (en) | Identification of distinguishing compound features extracted from real time data streams | |
| US10268750B2 (en) | Log event summarization for distributed server system | |
| US6687750B1 (en) | Network traffic visualization | |
| CN109284221A (en) | A kind of early warning system and method | |
| Sun et al. | Non-intrusive anomaly detection with streaming performance metrics and logs for DevOps in public clouds: a case study in AWS | |
| CN108449609A (en) | The recognition methods of direct broadcasting room event and device, electronic equipment, machine readable media | |
| EP3191999A1 (en) | Next generation of security operations service | |
| CN108322350A (en) | Business monitoring method and device and electronic equipment | |
| CN112219175A (en) | Method and system for managing technical installations | |
| CN114553596B (en) | Multi-dimensional security condition real-time display method and system suitable for network security | |
| CN110401580A (en) | Webpage status monitoring method and relevant device based on heartbeat mechanism | |
| CN106921518A (en) | Monitoring view methods of exhibiting and device | |
| CN106357466B (en) | A kind of internet product monitoring method and monitoring system | |
| CN104333584B (en) | CDN document distribution systems and method | |
| KR101975385B1 (en) | Visualization monitoring system and monitoring method for network security-situation | |
| CN110262955A (en) | Application performance monitoring tools based on pinpoint | |
| Aberathne et al. | Smart mobile bot detection through behavioral analysis | |
| CN114040192B (en) | Pressure measurement method, device, equipment and medium for audio and video conference | |
| CN106790339A (en) | Metadata server, network device, and automatic resource management method | |
| CN112269741B (en) | Application program compatibility testing method and related equipment | |
| EP4004739B1 (en) | Multi-source trace processing in computing systems | |
| JP2023523079A (en) | Endpoint security using behavior prediction model |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |