CN111030893A

CN111030893A - Method and device for analyzing user behaviors in cloud communication application scene

Info

Publication number: CN111030893A
Application number: CN201911408139.9A
Authority: CN
Inventors: 粟玉雄; 李佻伦; 王凯航
Original assignee: Shanghai Toupigeon Data Technology Co Ltd
Current assignee: Shanghai Toupigeon Data Technology Co Ltd
Priority date: 2019-12-31
Filing date: 2019-12-31
Publication date: 2020-04-17

Abstract

The invention provides a method and a device for analyzing user behaviors in a cloud communication application scene, wherein the method comprises the following steps: capturing flow data of a network port by using a root authority opened by a cloud communication terminal, extracting and filtering key data information from the flow data, and compressing the extracted key data information; the cloud communication terminal periodically uploads the compressed key information data to the platform server, so that the platform server conjectures user behaviors according to the key data information to obtain an industry big data analysis result and excavates the industry big data analysis result; the cloud communication terminal obtains mining results based on industry big data analysis result depth from the platform server, and accurately controls the mobile user terminal according to the mining results. The invention deepens the commercial value by accurately analyzing the user behavior.

Description

Method and device for analyzing user behaviors in cloud communication application scene

Technical Field

The embodiment of the invention relates to the technical field of cloud communication, in particular to a method and a device for analyzing user behaviors in a cloud communication application scene.

Background

The related data show that the outbound journey is as many as 1.3 hundred million people in 2017, and the market potential of the global outbound journey is undoubtedly huge. As a cloud communication terminal meeting the demand for surfing the internet, the market potential is naturally and non-vanishingly large. However, almost all companies currently play the role of reselling traffic in the industry of cloud communication technology applications. They purchase various traffic on a global scale and then resell the traffic to customers in a new form by using cloud communication technology. Although the cloud communication terminal, the SIM card and the traffic are efficiently managed and utilized, the traffic difference is essentially earned, and the old business model is easy to imitate, has overhigh operation cost, does not have strong expansion force and does not accord with the economic characteristics of the Internet. And as the industry competition is increasingly intense, the profit margin is smaller and smaller, and many companies struggle at the loss margin. If the ink keeps on the regular operation mode, the development and the growth of the ink are difficult to develop. Domestic roaming has been completely cancelled in 7.1.2018 in China, and the traffic charges of global operators are also reduced year by year, however, various expenses such as purchasing cost, operating cost, intangible loss and the like of the industry cannot be completely erased, so that the method becomes a key proposition that survival is still killed. By utilizing a big data means, business value is deepened and old operation mode is changed through user behavior analysis, so that the method is an effective means and also indicates a new direction for sustainable development of similar companies.

The prior art also tries to collect big data so as to be able to analyze user behaviors, but the prior art cannot be directly applied to a cloud communication scheme based on data traffic resources, terminal computing capacity, aspects and elements concerned by the data and other factors. There are also companies on the market that provide data analysis for mobile terminals, but they are limited to aggregate statistical traffic consumption.

It should be noted that the above background description is only for the sake of clarity and complete description of the technical solutions of the present invention and for the understanding of those skilled in the art. Such solutions are not considered to be known to the person skilled in the art merely because they have been set forth in the background section of the invention.

Disclosure of Invention

In view of the above problems, an object of the embodiments of the present invention is to provide a method and an apparatus for analyzing user behaviors in a cloud communication application scenario, which are suitable for accurately analyzing user behaviors in the cloud communication application scenario, thereby deepening business values.

In order to achieve the above object, an embodiment of the present invention provides a method for analyzing user behavior in a cloud communication application scenario, where the method is applied to a cloud communication terminal, and the method includes: capturing flow data of a network port by using a root authority opened by a cloud communication terminal, extracting and filtering key data information from the flow data, and compressing the extracted key data information; the cloud communication terminal periodically uploads the compressed key information data to the platform server, so that the platform server conjectures user behaviors according to the key data information to obtain an industry big data analysis result and excavates the industry big data analysis result; the cloud communication terminal obtains mining results based on industry big data analysis result depth from the platform server, and accurately controls the mobile user terminal according to the mining results.

Further, the cloud communication terminal captures flow data of a network port connected with the mobile user terminal and analyzes the data into a data packet; dividing the data packet into a non-value information data packet and a value information data packet according to the protocol type, filtering the non-value information data packet, and extracting and filtering key data information from the value information data packet; and carrying out byte number compression on the extracted key data information.

Further, packet filtering based on the dhcp, eqpol protocol is not used; the data packet based on the arp protocol at least extracts the following information from the data packet: mac, ip information; the data packet based on the icmp protocol at least extracts the following information in the data packet: time, transmission direction, destination address, link status information of the data packet; setting a count field for recording repeated icmp packets, and filtering the repeated icmp packets without using; the data packet based on the dns protocol at least extracts the following information from the data packet: the domain name server address, the domain name and the corresponding analysis result of the data packet, a request source ip, request time, the number of uplink packets, the size of the uplink packets, the number of downlink packets, the size of the downlink packets, the total uplink packet data of a user, the total uplink packet size of the user, the total downlink packet data of the user and the total downlink packet size data of the user; extracting at least one piece of following information in the data packet based on the data packet of the http, tcp, udp, https, ntp and ssh protocols: according to the consistency of the source address, the source port, the destination address and the destination port of the request, the access flow is regarded as the same access flow, and the starting timestamp, the ending timestamp, the source address, the source port, the destination address, the destination port, the number of uplink packets, the size of the uplink packets, the number of downlink packets and the size of the downlink packets of the flow are extracted; wherein the http protocol based data packet also extracts url information.

Further, waking up the cloud communication terminal at a preset frequency, periodically analyzing and reporting the compressed key information data, and enabling the cloud communication terminal to enter a deep sleep state during non-wake-up time; when the key information data is awakened, efficient language is adopted, extraction, filtration and analysis are carried out on the compressed key information data at the same time, and one-time full traversal is carried out; the log printing is classified in advance, and the detail degree of the log printing is gradually reduced according to the level in the analysis process; after the analysis is finished, storing the analysis result in a local database, when the accumulated data number of the analysis result reaches a preset number or the accumulated data size reaches a preset size, periodically uploading the analysis result to a platform, enabling the platform to receive the analysis result, then matching and comparing key data information with data in a feature library, identifying application to which a network request stream belongs, adding the identification result to the end of the network request stream and storing the end of the network request stream in the platform database, inferring user behaviors according to the identification result, obtaining a user feature model based on a series of user behaviors, obtaining a business big data analysis result according to the user feature model, and performing visual presentation, wherein the visual presentation comprises at least one of the following: the method comprises the steps of total consumption of the whole network, country classified consumption, traffic type consumption, user traffic use ranking list, traffic classified by application type, association relationship between a mobile user terminal and a cloud communication terminal, a file of the mobile user terminal, terminal network performance evaluation, whole network cumulative statistics, mobile user terminal type proportion statistics and authentication statistics. Further, based on the mining result of the industry big data analysis result, the cloud communication terminal identifies the mobile user terminal and controls the mobile user terminal to perform at least one of the following: dynamically controlling a black and white list of the destination address; dynamically controlling the traffic type flow, and carrying out speed limit control aiming at the traffic type of which the flow consumption exceeds a preset flow value; and dynamically controlling the application type flow control, and preferentially ensuring the network request of the specified application.

The embodiment of the invention also provides a cloud communication terminal, which is applied to analyzing user behaviors in a cloud communication application scene and comprises the following steps: the extraction and filtration module is used for starting root authority, capturing flow data of the internet access, extracting and filtering key data information of the flow data, compressing the extracted key data information to obtain the root authority of the cloud communication terminal, capturing the flow data of the internet access, extracting and filtering key data information of the flow data, and compressing the extracted key data information; the uploading analysis module is used for periodically uploading the compressed key information data to a platform server, so that the platform server can infer user behaviors according to the key data information to obtain an industry big data analysis result, mining the industry big data analysis result, periodically uploading the compressed key information data to the platform, and enabling the platform to infer the user behaviors according to the key data information to obtain an industry big data analysis result; and the mining control module is used for acquiring a mining result of the industry big data analysis result from the platform server and controlling the mobile user terminal according to the mining result.

The embodiment of the invention also provides a method for analyzing user behaviors in a cloud communication application scene, which is used for a platform server of a cloud communication terminal and comprises the following steps: the method comprises the steps that a platform server receives key information data uploaded by a cloud communication terminal, wherein the key information data are data obtained by starting root authority of the cloud communication terminal, capturing flow data of a network port, extracting and filtering key data information of the flow data and compressing the extracted key data information; the platform server conjectures user behaviors according to the key data information to obtain a business big data analysis result and excavates the business big data analysis result; and the platform server sends the mining result of the industry big data analysis result to the cloud communication terminal so that the cloud communication terminal controls the mobile user terminal according to the mining result.

Further, the platform server matches and compares the received key data information with the data of the feature library, identifies the application to which the network request flow belongs, conjectures the user behavior according to the identification result, and adds the identification result to the network request flow to be stored in the platform database; obtaining a user characteristic model based on a series of inferred user behaviors, obtaining a business big data analysis result according to the user characteristic model, and performing visual presentation, wherein the visual presentation comprises at least one of the following: the method comprises the steps of total consumption of the whole network, country classified consumption, traffic type consumption, user traffic use ranking list, traffic classified by application type, association relationship between a mobile user terminal and a cloud communication terminal, a file of the mobile user terminal, terminal network performance evaluation, whole network cumulative statistics, mobile user terminal type proportion statistics and authentication statistics.

Further, mining the industry big data analysis result, wherein the mining comprises one or a combination of the following steps: counting the user viscosity according to the application use duration and the application type use duration, and establishing a relation with a user trip destination; counting the viscosity of the user according to the time length of the user using the cloud communication terminal, and establishing the association with the user travel destination; deducing user interest points and internet access habits according to the frequency of the application of each network request of the mobile user terminal; collecting search keywords, counting the popularity of the keywords, and establishing the association with the travel destination and time of the user; obtaining a user trip country ranking list according to frequency statistics of user trip countries; and obtaining a user trip geographical position ranking list according to the frequency statistics of the user trip destination.

The embodiment of the invention also provides a platform server, which is applied to analyzing user behaviors in a cloud communication application scene and comprises the following steps: the receiving module is used for receiving key information data uploaded by the cloud communication terminal, wherein the key information data is data obtained by starting root authority of the cloud communication terminal, capturing flow data of a network port, extracting and filtering key data information from the flow data and compressing the extracted key data information; the analysis and mining module is used for the platform server to conjecture user behaviors according to the key data information to obtain a business big data analysis result and mining the business big data analysis result; and the sending module is used for sending the mining result of the industry big data analysis result to the cloud communication terminal so that the cloud communication terminal can control the mobile user terminal according to the mining result.

As can be seen from the above, according to the method for analyzing user behaviors in a cloud communication application scenario and the cloud communication terminal provided by the embodiment of the invention, on the cloud communication terminal with limited computing capability, the key data information is extracted and filtered from the traffic data, and the extracted key data information is compressed, so that the traffic data packet captured by the internet access can be compressed into a smaller data volume, so as to meet the use requirements of the cloud communication mobile terminal. The compressed key information data are periodically uploaded and sleep in a strategy, so that the power consumption can be reduced, and the standby time of the cloud communication mobile terminal can be prolonged. The platform analyzes with high-efficiency language, only carries out once full traversal and grades the log printing, thereby reducing the flow consumption. In addition, the platform also conjectures user behaviors according to the key data information to obtain an industry big data analysis result, so that the requirement of a cloud communication market can be well met, advertisements and economic benefits are directly generated, the operation cost transfer is realized, and the enterprise profit rate is improved. The deep mining of the industrial big data analysis result is accurately controlled, the diversity of the outbound cloud communication products is greatly enriched, high-quality and convenient services are provided for consumers, flexible and changeable service modes and product styles can be provided for merchants, and a brand-new development direction is pointed out for deepening commercial values and changing old operation modes of the merchants.

Drawings

In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings needed to be used in the embodiments or the description in the prior art are briefly introduced below, and it is obvious that the drawings in the following description are some embodiments of the present invention, and for those skilled in the art, other drawings can be obtained according to these drawings without creative efforts.

Fig. 1 is a schematic flowchart of a method for analyzing user behavior in a cloud communication application scenario based on a cloud communication terminal according to an embodiment of the present invention;

fig. 2 is a schematic structural diagram of a cloud communication terminal according to an embodiment of the present invention;

fig. 3 is a schematic flowchart of a method for analyzing user behavior in a cloud communication application scenario based on a platform server according to an embodiment of the present invention;

fig. 4 is a schematic structural diagram of a platform server according to an embodiment of the present invention.

Detailed Description

In order to make the objects, technical solutions and advantages of the embodiments of the present invention more apparent, the technical solutions of the embodiments of the present invention will be described clearly and completely with reference to the accompanying drawings of the embodiments of the present invention, and it is obvious that the described embodiments are some, but not all embodiments of the present invention. All other embodiments, which can be obtained by a person skilled in the art without any inventive step based on the embodiments of the present invention, are within the scope of the present invention. Furthermore, as used in the examples of the invention and the appended claims, the singular forms "a," "an," and "the" are intended to include the plural forms as well, unless the context clearly indicates otherwise.

Reference herein to "an embodiment" means that a particular feature, structure, or characteristic described in connection with the embodiment can be included in at least one embodiment of the invention. The appearances of the phrase in various places in the specification are not necessarily all referring to the same embodiment, nor are separate or alternative embodiments mutually exclusive of other embodiments. It is explicitly and implicitly understood by one skilled in the art that the embodiments described herein can be combined with other embodiments.

The reference to "mobile user terminal" in this document refers to an electronic device actually used by a user, such as a mobile phone or a tablet computer; the cloud communication terminal is a special device, can collect and extract a flow data packet generated in the use of the mobile user terminal, and compresses and uploads a valuable information data packet to a platform; the platform is a software system for further processing the uploaded data, so that the processed data information reaches the standard easy to analyze and use.

In order to make the technical solutions of the present invention better understood by those skilled in the art, the technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings.

DPI (Deep Packet Inspection ) is a Deep Inspection technology based on data packets, and an operator can deploy a DPI program at a gateway node for Deep Inspection, but in the process of implementing the present invention, the inventors find that the prior art has at least the following problems:

the traditional DPI cannot be directly applied to the application scene of the cloud communication terminal. Firstly, the cloud communication terminal network architecture is greatly different from the complex structure of the traditional telecommunication network; secondly, the cloud communication terminal has limited computing capacity, very limited battery power and precious traffic resources, so that the analysis speed is increased, analysis results are extracted, filtered and compressed, the power consumption of the terminal is reduced, and the like. In addition, in a cloud communication terminal scene, the side points of interest are greatly different from the traditional data analysis, the layers and elements concerned by the traditional data monitoring cannot be matched with the scene key points of the user in the outbound trip in a refined manner, for example, based on the data packet detection, the cloud communication terminal scene may hope to obtain the maximum interest point ranking list similar to the user in the outbound trip, or the large data conclusion that the network experience of the operator used by the user in which places is not good enough, and the like. There are also companies on the market that provide data analysis for mobile terminals, but the existing data only summarize the total traffic consumption, or the traffic consumption of different types of services, such as control data interaction or user data. The prior art is not capable of obtaining more accurate data at efficient flow rates.

The embodiment of the invention provides a method for analyzing user behaviors in a cloud communication application scene. The implementation premise requires that network communication can be established between the mobile user terminal and the cloud communication terminal and between the cloud communication terminal and the platform. With the above-mentioned premise ensured, the implementation method is shown in fig. 1, and the method comprises the following steps:

step S101, the cloud communication terminal starts root authority, captures flow data of the internet access, extracts and filters key data information of the flow data, and compresses the extracted key data information.

In this step, the traffic resource of the cloud communication terminal is precious, and each byte needs to be paid, so the smaller the data volume, the better. The method comprises the steps that a program module in the cloud communication terminal obtains root authority of the terminal, and a source opening tool (for example, tcpdump, a network card is set to be in a hybrid mode) is used for capturing flow data of a mobile user terminal and a network port connected with the cloud communication terminal.

And analyzing the flow data packet in real time through a specific algorithm, and extracting and filtering key data information. Specifically, the packet capture data is read first, the data is parsed into one data packet, and the memory data structure is used to store the time stamp, the packet size (e.g., the number of bytes), the transmission direction (e.g., uplink, downlink, broadcast, multicast, etc.), the protocol version (e.g., ipv4 or ipv 6), the ip layer protocol type (e.g., icmp), the transport layer protocol type (e.g., tcp, udp), the user layer protocol type (e.g., http, https, ssh, ntp, dns, dhcp, epol, arp, icmp, etc.), the user data content, and the like of the packet. However, the data volume is still large when the packet capturing data is analyzed, and further processing is needed, that is, the data packet is further divided into a non-value information data packet and a value information data packet according to the protocol type, and the key data information is extracted and filtered from the value information data packet, that is, only the value information in the data packet needs to be paid attention to.

For packets of worthless information, for example, packets based on protocols such as dhcp, eqpol, etc., most of the packets are worthless information, and no actual carrier traffic consumption is generated, so filtering is not used.

For valuable information packets, such as packets based on the arp protocol, it is known which mobile user terminals are connected to the cloud communication terminal, and meanwhile, the mac of the mobile terminal can be mapped to the ip, so that only the mac and the ip information in the arp packet need to be extracted. For example, data packets based on the icmp protocol may reflect the network connectivity status, and therefore record the time, transmission direction, destination address, and link status information of each data packet, but since there may be a large number of data packets with the same time, transmission direction, destination address, and link status information, a count field is set for recording repeated icmp packets, so as to achieve the purpose of further compressing the data volume. For example, a data packet based on the dns protocol extracts data such as a domain name server address, a domain name and a corresponding resolution result (ip address), a request source ip, a request time, an uplink packet number, an uplink packet size, a downlink packet number, a downlink packet size, a user total uplink packet data, a user total uplink packet size, a user total downlink packet data, a user total downlink packet size, and the like. For the data packets based on the http, tcp, udp, https, ntp and ssh protocols, the same access flow is considered as if the source address, the source port, the destination address and the destination port of the request are consistent, the starting timestamp, the ending timestamp, the source address, the source port, the destination address, the destination port, the number of the uplink packets, the size of the uplink packets, the number of the downlink packets and the size of the downlink packets of the flow are extracted, and the data packets based on the http protocol further extract the url fields to store the url information.

In addition, after the use protocol of the data packet of the valuable information is judged, the data extraction depth under the protocol can be controlled by modifying the configuration file in the extraction and filtering module according to the fixity of the protocol format, so that the effect of extracting the key information is achieved.

By extracting filter-critical data information, e.g., about 50M of packet-grabbing data, it can be compressed into about 18KB of data. The key data information can be further compressed, for example, the number of bytes is compressed by zlib, which can become about 6.5KB of resolution result. Therefore, the traffic data packet captured through the internet access is compressed into a smaller data volume so as to conform to the use scene of the cloud communication mobile terminal.

And S102, periodically uploading the compressed key information data to a platform server, so that the platform server can conjecture user behaviors according to the key information data to obtain a business big data analysis result and mine the business big data analysis result.

In this step, the compressed key data information is uploaded to the platform server. The cloud communication terminal needs to consider the data volume and also the power consumption. In this embodiment, the cloud communication terminal wakes up once at a preset frequency (for example, 5 minutes) to perform periodic analysis and reporting, and all wake-up locks can be released at other times, so that the cloud communication terminal enters a deep sleep state, and the electric quantity is saved to the greatest extent.

To achieve a short wake-up time, a very efficient operation speed is required. In order to minimize the parsing time, firstly, an efficient language (such as C language) is used for coding; secondly, an efficient analysis process is needed, and the loop traversal is reduced. In this embodiment, the whole process of parsing, extracting, and filtering a single data packet is used as a loop, and processing of multiple data packets can be guaranteed to be completed only by one traversal. The journal printing is a means which is necessary to rely on in the development and debugging process of the program module and the analysis of the daily operation condition, but the journal printing also causes the increase of the execution time consumption so as to reduce the analysis operation speed, so the journal printing is graded (for example, graded into four grades, namely DEBUG, INFO, WARN and ERROR), the detailed degree of the journal printing is gradually reduced according to the grade, and unnecessary content analysis is reduced (of course, all the grades of journal printing can also be closed).

In a 5-minute 4G network environment, a lot of traffic is consumed, and the more traffic is consumed, the more content needs to be analyzed. In this embodiment, assuming a 5-minute 4G network with high load, by reducing the time consumed for analysis, the actual analysis operation can be completed within 3.5 seconds, which better conforms to the usage scenario of the cloud communication mobile terminal.

In the embodiment, if any one of the following conditions is met, ① cumulative data number can be reported to reach a preset number (for example, 5 pieces of data), ② cumulative data size reaches a preset size (for example, 15K), so that the success rate and reliability of reporting can be ensured, data loss can be prevented, and the purpose of saving power consumption can be achieved.

After receiving the analysis result, the platform server matches and compares the key data information (such as address port information, url and user data) with an identification feature library built by the platform through a specific algorithm, and identifies the application corresponding to the attribution. And intelligently guessing and exploring user behaviors according to the association relationship between the application and analysis results and the original user terminal network request flow, and finally storing the identification result into a database at the platform side.

And obtaining a user characteristic model based on a series of user behaviors, and easily designing algorithms in different modes according to the user characteristic model to process the recognition result to obtain an industry big data analysis result and visually present the industry big data analysis result. Of course, the present invention is not limited to the following presentation, and different visual presentations may be performed as needed:

total consumption of the whole network: assuming a set of numbers (e.g., total flow, up, down) are counted per hour, a graph is drawn showing the trend of the total flow consumption over the past 12 hours;

national classification consumption: assuming that the top ten countries (for example, country classification based on geographical location identification) consuming the traffic for the past 12 hours are selected, drawing a histogram to show a comparison of the total traffic consumed by the countries (for example, including uplink and downlink traffic);

traffic type consumption: it is assumed that the user consumption flow, the flow for the system itself, and the flow used by each application in the system are displayed in a pie chart, respectively, based on how much traffic is used (for example, the total flow in the past 12 hours);

user traffic uses a ranking list (national dimension can be increased): assuming that all users in the whole network have used traffic size ranking in the past 12 hours;

traffic is classified by application (national dimension can be increased): assume that it is presented by way of graph join (e.g., how much traffic is consumed by applications such as WeChat, today's headline, qq, Taobao, Portable, Royal, etc., respectively);

traffic is classified by application type (national dimension can be increased): assume that the presentation is by way of graph combination (e.g., how much traffic is consumed by social, music, movie, short video, news information, etc., respectively);

the association relationship between the mobile user terminal and the cloud communication terminal is as follows: the cloud communication terminal can be searched from the mobile terminal, and the mobile user terminal information can be searched from the cloud communication terminal;

archives of the cloud communication terminal: the serial number, mac, first online time, latest active time, traffic used today, and the like of the terminal device;

profile of mobile user terminal: the method comprises the following steps that a mobile terminal mac, a mobile terminal manufacturer, a mobile terminal model, the time for using the cloud communication network for the first time, the time for using the cloud communication network recently, the accumulated use flow (such as uplink and downlink), the installed application of the mobile terminal, the frequency of using the cloud communication network, an attribution user group and the like are obtained;

and calculating network performance parameters according to the reported information to obtain terminal network performance evaluation (the national dimensionality can be increased): network speed estimation, time delay estimation and network stability evaluation;

counting the total accumulated terminal number, daily living card number and highest online number;

the method comprises the following steps of carrying out statistics on the type ratio of mobile user terminals, and carrying out statistics on the occurrence frequency of mobile terminals of various manufacturers to assist in building a user model;

authentication statistics (for example, card dimensions) are adopted, reported information includes requests and replies of cloud communication terminal authentication, and the information can be integrated to know the authentication frequency of the operator cards at time and place to assist performance analysis of the operator cards; based on the performance analysis result of the operator card, a KPI evaluation system of the operator card can be constructed, and valuable reference data is provided for the decision of card flow purchasing; meanwhile, in the actual operation process, the direction can be indicated for the design of the card changing strategy based on the performance analysis data, so that the user experience satisfaction degree is improved.

In addition, by accessing the data showing platform, the business showing is carried out on the data which does not relate to the privacy of the user after desensitization, the subsidy of the user is realized, and the use cost of the user is reduced in a variable way; even the users of partial lines can be free, thereby rapidly expanding the number of users; meanwhile, through the rapid increase of the number of users, data samples are greatly enriched, the data value is improved again, more revenues are generated, and accordingly a benign development closed loop is formed.

And S103, acquiring a mining result based on the industry big data analysis result depth from the platform server, and controlling the mobile user terminal according to the mining result by the cloud communication terminal.

In this step, further deep mining may be performed on the industry big data analysis result in the following manner (deep mining may also be performed in other manners, and is not limited to this):

counting the user viscosity according to the application use duration and the application type use duration, and establishing a relation with a user trip destination;

counting the viscosity of the user according to the time length of the user using the cloud communication terminal, and establishing the association with the user travel destination;

deducing interest points of the user and internet access habits (geography, time dimension and the like can be increased) according to the frequency of the application of each network request of the mobile user terminal;

searching keyword collection (geography and time dimension can be increased), counting the popularity of the keywords, and establishing association with the travel destination and time of the user;

obtaining a user trip country ranking list according to frequency statistics of user trip countries;

and (4) obtaining a ranking list of the trip geographical position (which can correspond to the scenic spot) of the user according to the frequency statistics of the trip destination of the user.

In addition, by deep mining of industry big data analysis results, the cloud communication terminal can accurately identify the mobile user terminal, and further, the accurate control of the mobile user terminal can be realized, for example, the following control is performed, but other controls can be performed as required, and the method is not limited to the following:

black and white list of destination addresses: the cloud communication terminal is usually in an open hotspot form, and a mobile user terminal or other terminals access the cloud communication terminal in a WiFi connection mode to achieve the purpose of sharing a network. Therefore, for the mobile user terminal, a large amount of background application upgrades or network synchronization behaviors may occur, so that a large amount of traffic which is not subjective and desired by the user is consumed, which has a negative effect on the cloud communication terminal with precious traffic resources. Therefore, by deeply mining the industry big data analysis result, the mobile user terminal can be accurately identified, which requests are not subjective behaviors of the user can be determined, and the user experience is not influenced after the requests are set as the blacklist, so that unnecessary traffic waste is avoided. The black and white list function of the existing cloud communication terminal is manually set in advance, and the adjustment is inflexible and inconvenient, and cannot be accurately controlled. In the embodiment, the black-and-white list function of the cloud communication terminal is that the cloud communication terminal can flexibly and dynamically perform accurate control on the mobile user terminal on the basis of accurately identifying the mobile user terminal.

And controlling the service type flow: at present, the unlimited amount promised by a cloud communication terminal service provider is generally limited after a user uses the cloud communication terminal service provider to reach a certain flow, and a network becomes almost unavailable when the speed is limited to a certain degree. Because the flow provided by the service provider is cost-demanding, it is practically impossible to completely unlimited flow to the user, and the user can only consume the flow within a certain controllable range to fully guarantee their profit. In conclusion, on the basis of accurate identification of the mobile user terminal, the speed limit control can be performed on specific service types (such as large file downloading, video streaming media and the like) with serious traffic consumption instead of the whole speed limit mode of the terminal, and the service types with less traffic consumption, such as news information, social communication and the like, are not limited, so that the benefits of the user are guaranteed, the network provided by the cloud communication terminal cannot be used, and the user perception and the brand public praise are improved.

Application type flow control: on the basis of accurately identifying the mobile user terminal, the cloud communication terminal service can cooperate with some applications, and the network requests of cooperative applications are preferentially guaranteed under the conditions of poor network conditions and insufficient bandwidth.

It should be understood that, although the steps in the flowcharts of the figures are shown in order as indicated by the arrows, the steps are not necessarily performed in order as indicated by the arrows. The steps are not performed in the exact order shown and may be performed in other orders unless explicitly stated herein. Moreover, at least a portion of the steps in the flow chart of the figure may include multiple sub-steps or multiple stages, which are not necessarily performed at the same time, but may be performed at different times, which are not necessarily performed in sequence, but may be performed alternately or alternately with other steps or at least a portion of the sub-steps or stages of other steps.

With further reference to fig. 2, an embodiment of the present invention further provides a cloud communication terminal, which is applied to analyzing user behaviors in a cloud communication application scenario, and includes:

the extraction and filtration module is used for starting root authority, capturing flow data of the internet access, extracting and filtering key data information of the flow data, and compressing the extracted key data information;

the uploading analysis module is used for periodically uploading the compressed key information data to a platform server, so that the platform server can conjecture user behaviors according to the key data information to obtain a business big data analysis result and mine the business big data analysis result;

and the mining control module is used for acquiring a mining result of the industry big data analysis result from the platform server and controlling the mobile user terminal according to the mining result.

The extraction and filtration module is specifically configured to:

capturing flow data of a network port connected with a mobile user terminal, and analyzing the data into a data packet; dividing the data packet into a non-value information data packet and a value information data packet according to the protocol type, filtering the non-value information data packet, and extracting key data information from the value information data packet; compressing the extracted key data information by byte number; the filtering of the worthless information data packet is not needed, and the filtering specifically comprises the following steps: data packet filtering based on the dhcp and eqpol protocols is not used; extracting and filtering key data information from the valuable information data packet, wherein the extracting and filtering key data information specifically comprises one or a combination of the following steps: the data packet based on the arp protocol at least extracts the following information from the data packet: mac, ip information; the data packet based on the icmp protocol at least extracts the following information in the data packet: time, transmission direction, destination address, link status information of the data packet; setting a count field for recording repeated icmp packets, and filtering the repeated icmp packets without using; the data packet based on the dns protocol at least extracts the following information from the data packet: the domain name server address, the domain name and the corresponding analysis result of the data packet, a request source ip, request time, the number of uplink packets, the size of the uplink packets, the number of downlink packets, the size of the downlink packets, the total uplink packet data of a user, the total uplink packet size of the user, the total downlink packet data of the user and the total downlink packet size data of the user; extracting at least one piece of following information in the data packet based on the data packet of the http, tcp, udp, https, ntp and ssh protocols: according to the consistency of the source address, the source port, the destination address and the destination port of the request, the access flow is regarded as the same access flow, and the starting timestamp, the ending timestamp, the source address, the source port, the destination address, the destination port, the number of uplink packets, the size of the uplink packets, the number of downlink packets and the size of the downlink packets of the flow are extracted; wherein the http protocol based data packet also extracts url information.

The extraction filtering module is further specifically configured to include one or a combination of the following before periodically uploading the compressed key information data to the platform server: adopting efficient language, extracting, filtering and analyzing the compressed key information data at the same time, and performing one-time full traversal; in the analysis process, determining the detail degree of log printing according to the level of the pre-divided log printing; and after the analysis is finished, storing the analysis result in a local database, and periodically uploading the analysis result to the platform server when the accumulated data number of the analysis result reaches a preset number or the accumulated data size reaches a preset size. The upload analysis module is specifically configured to: waking up the cloud communication terminal at a preset frequency, periodically analyzing and reporting the compressed key information data, and enabling the cloud communication terminal to enter a deep sleep state during a non-wake-up time; when the key information data is awakened, efficient language is adopted, extraction, filtration and analysis are carried out on the compressed key information data at the same time, and one-time full traversal is carried out; the log printing is classified in advance, and the detail degree of the log printing is gradually reduced according to the level in the analysis process; after the analysis is finished, storing the analysis result in a local database, uploading the analysis result to a platform when the accumulated data number of the analysis result reaches a preset number or the accumulated data size reaches a preset size, enabling the platform to receive the analysis result, then matching and comparing key data information with data of a feature library, identifying the application to which the network request flow belongs, adding the identification result to the end of the network request flow and storing the end of the network request flow in the platform database, inferring user behaviors according to the identification result, obtaining a user feature model based on a series of user behaviors, obtaining a business big data analysis result according to the user feature model, and visually presenting the business big data analysis result;

the excavation control module is specifically configured to: based on the deep mining result of the industry big data analysis result, the cloud communication terminal accurately identifies the mobile user terminal, and the cloud communication terminal accurately controls at least one of the following mobile user terminals: dynamically controlling a black and white list of the destination address; dynamically controlling the traffic type flow, and carrying out speed limit control aiming at the traffic type of which the flow consumption exceeds a preset flow value; and dynamically controlling the application type flow control, and preferentially ensuring the network request of the specified application.

The specific technical details of the cloud communication terminal and the method for analyzing the user behavior in the cloud communication application scenario are similar, and the technical effect achieved in the implementation of the cloud communication terminal can also be achieved in the implementation of the method for analyzing the user behavior in the cloud communication application scenario, and are not repeated here in order to reduce repetition. Accordingly, the related technical details mentioned in the implementation of the cloud communication terminal may also be applied in the implementation of the method for analyzing the user behavior in the cloud communication application scenario.

As shown in fig. 3, an embodiment of the present invention further provides a method for analyzing user behaviors in a cloud communication application scenario, where the method is used for a platform server of a cloud communication terminal, and includes:

step 301, a platform server receives key information data uploaded by a cloud communication terminal, wherein the key information data is data obtained by starting root authority of the cloud communication terminal, capturing flow data of a network port, extracting and filtering key data information from the flow data, and compressing the extracted key data information.

And 302, the platform server conjectures user behaviors according to the key data information to obtain a business big data analysis result and mines the business big data analysis result.

In the step, the platform server matches and compares the received key data information with the data of the feature library, identifies the application to which the network request stream belongs, conjectures the user behavior according to the identification result, and adds the identification result to the network request stream to be stored in the platform database; obtaining a user characteristic model based on a series of inferred user behaviors, obtaining a business big data analysis result according to the user characteristic model, and performing visual presentation, wherein the visual presentation comprises at least one of the following: the method comprises the steps of total consumption of the whole network, country classified consumption, traffic type consumption, user traffic use ranking list, traffic classified by application type, association relationship between a mobile user terminal and a cloud communication terminal, a file of the mobile user terminal, terminal network performance evaluation, whole network cumulative statistics, mobile user terminal type proportion statistics and authentication statistics.

Wherein mining the industry big data analysis result comprises one or a combination of the following: counting the user viscosity according to the application use duration and the application type use duration, and establishing a relation with a user trip destination; counting the viscosity of the user according to the time length of the user using the cloud communication terminal, and establishing the association with the user travel destination; deducing user interest points and internet access habits according to the frequency of the application of each network request of the mobile user terminal; collecting search keywords, counting the popularity of the keywords, and establishing the association with the travel destination and time of the user; obtaining a user trip country ranking list according to frequency statistics of user trip countries; and obtaining a user trip geographical position ranking list according to the frequency statistics of the user trip destination.

And 303, the platform server sends the mining result of the industry big data analysis result to the cloud communication terminal so that the cloud communication terminal controls the mobile user terminal according to the mining result.

As shown in fig. 4, an embodiment of the present invention further provides a platform server, which is applied to analyzing user behaviors in a cloud communication application scenario, and includes:

the receiving module is used for receiving key information data uploaded by the cloud communication terminal, wherein the key information data is data obtained by starting root authority of the cloud communication terminal, capturing flow data of a network port, extracting and filtering key data information from the flow data and compressing the extracted key data information;

the analysis and mining module is used for the platform server to conjecture user behaviors according to the key data information to obtain a business big data analysis result and mining the business big data analysis result;

and the sending module is used for sending the mining result of the industry big data analysis result to the cloud communication terminal so that the cloud communication terminal can control the mobile user terminal according to the mining result.

The specific technical details of the platform server are similar to those of the method for analyzing the user behavior in the cloud communication application scenario, and are not repeated here to reduce repetition.

The embodiments in the present specification are described in a progressive manner, and the same and similar parts among the embodiments can be referred to each other, and each embodiment focuses on the differences from the other embodiments.

Finally, it should be noted that: the foregoing description of various embodiments of the invention is provided to those skilled in the art for the purpose of illustration. It is not intended to be exhaustive or to limit the invention to a single disclosed embodiment. Various alternatives and modifications of the invention, as described above, will be apparent to those skilled in the art. Thus, while some alternative embodiments have been discussed in detail, other embodiments will be apparent or relatively easy to derive by those of ordinary skill in the art. The present invention is intended to embrace all such alternatives, modifications, and variances which have been discussed herein, and other embodiments which fall within the spirit and scope of the above application.

Claims

1. A method for analyzing user behaviors in a cloud communication application scene is applied to a cloud communication terminal, and is characterized by comprising the following steps:

the cloud communication terminal starts root authority, captures flow data of the internet access, extracts and filters key data information of the flow data, and compresses the extracted key data information;

the cloud communication terminal periodically uploads the compressed key information data to the platform server, so that the platform server conjectures user behaviors according to the key data information to obtain an industry big data analysis result and excavates the industry big data analysis result;

and the cloud communication terminal acquires a mining result of the industry big data analysis result from the platform server and controls the mobile user terminal according to the mining result.

2. The method for analyzing user behavior in the cloud communication application scenario according to claim 1, wherein the extracting and filtering of the traffic data and the compression of the extracted key data information specifically include:

the cloud communication terminal captures flow data of a network port connected with the mobile user terminal and analyzes the data into a data packet;

dividing the data packet into a non-value information data packet and a value information data packet according to the protocol type, filtering the non-value information data packet, and extracting key data information from the value information data packet;

and carrying out byte number compression on the extracted key data information.

3. The method for analyzing the user behavior in the cloud communication application scenario according to claim 2, wherein the filtering of the worthless information data packet is not used, and specifically comprises:

packet filtering based on the dhcp, eqpol protocol is not used.

4. The method for analyzing user behavior in the cloud communication application scenario according to claim 2, wherein the extracting valuable information data packets and filtering key data information specifically include one or a combination of the following:

the data packet based on the arp protocol at least extracts the following information from the data packet: mac, ip information;

the data packet based on the icmp protocol at least extracts the following information in the data packet: time, transmission direction, destination address, link status information of the data packet; setting a count field for recording repeated icmp packets, and filtering the repeated icmp packets without using;

the data packet based on the dns protocol at least extracts the following information from the data packet: the domain name server address, the domain name and the corresponding analysis result of the data packet, a request source ip, request time, the number of uplink packets, the size of the uplink packets, the number of downlink packets, the size of the downlink packets, the total uplink packet data of a user, the total uplink packet size of the user, the total downlink packet data of the user and the total downlink packet size data of the user;

extracting at least one piece of following information in the data packet based on the data packet of the http, tcp, udp, https, ntp and ssh protocols: according to the consistency of the source address, the source port, the destination address and the destination port of the request, the access flow is regarded as the same access flow, and the starting timestamp, the ending timestamp, the source address, the source port, the destination address, the destination port, the number of uplink packets, the size of the uplink packets, the number of downlink packets and the size of the downlink packets of the flow are extracted; wherein the http protocol based data packet also extracts url information.

5. The method for analyzing the user behavior in the cloud communication application scenario according to claim 1, wherein the periodically uploading the compressed key information data to a platform specifically includes:

and awakening the cloud communication terminal at a preset frequency, periodically analyzing and reporting the compressed key information data, and enabling the cloud communication terminal to enter a deep sleep state during the non-awakening time.

6. The method for analyzing the user behavior in the cloud communication application scenario according to claim 5, wherein before the compressed key information data is periodically uploaded to the platform server, one or a combination of the following is further included:

adopting efficient language, extracting, filtering and analyzing the compressed key information data at the same time, and performing one-time full traversal;

in the analysis process, determining the detail degree of log printing according to the level of the pre-divided log printing;

and after the analysis is finished, storing the analysis result in a local database, and periodically uploading the analysis result to the platform server when the accumulated data number of the analysis result reaches a preset number or the accumulated data size reaches a preset size.

7. The method for analyzing the user behavior in the cloud communication application scenario according to claim 1, wherein the cloud communication terminal controls the mobile user terminal, and specifically comprises:

based on the mining result of the industry big data analysis result, the cloud communication terminal identifies the mobile user terminal and controls the mobile user terminal to perform at least one of the following controls:

dynamically controlling a black and white list of the destination address;

dynamically controlling the traffic type flow, and carrying out speed limit control aiming at the traffic type of which the flow consumption exceeds a preset flow value;

and dynamically controlling the application type flow control, and preferentially ensuring the network request of the specified application.

8. The utility model provides a cloud communication terminal, is applied to analysis user's action under the cloud communication application scene, its characterized in that includes:

9. The cloud communication terminal according to claim 8, wherein the extraction and filtering module is specifically configured to:

capturing flow data of a network port connected with a mobile user terminal, and analyzing the data into a data packet; dividing the data packet into a non-value information data packet and a value information data packet according to the protocol type, filtering the non-value information data packet, and extracting key data information from the value information data packet; compressing the extracted key data information by byte number;

the filtering of the worthless information data packet is not needed, and the filtering specifically comprises the following steps: data packet filtering based on the dhcp and eqpol protocols is not used; extracting and filtering key data information from the valuable information data packet, wherein the extracting and filtering key data information specifically comprises one or a combination of the following steps: the data packet based on the arp protocol at least extracts the following information from the data packet: mac, ip information; the data packet based on the icmp protocol at least extracts the following information in the data packet: time, transmission direction, destination address, link status information of the data packet; setting a count field for recording repeated icmp packets, and filtering the repeated icmp packets without using; the data packet based on the dns protocol at least extracts the following information from the data packet: the domain name server address, the domain name and the corresponding analysis result of the data packet, a request source ip, request time, the number of uplink packets, the size of the uplink packets, the number of downlink packets, the size of the downlink packets, the total uplink packet data of a user, the total uplink packet size of the user, the total downlink packet data of the user and the total downlink packet size data of the user; extracting at least one piece of following information in the data packet based on the data packet of the http, tcp, udp, https, ntp and ssh protocols: according to the consistency of the source address, the source port, the destination address and the destination port of the request, the access flow is regarded as the same access flow, and the starting timestamp, the ending timestamp, the source address, the source port, the destination address, the destination port, the number of uplink packets, the size of the uplink packets, the number of downlink packets and the size of the downlink packets of the flow are extracted; wherein the http protocol based data packet also extracts url information.

10. The cloud communication terminal according to claim 8, wherein the extraction and filtering module is further specifically configured to include one or a combination of the following before periodically uploading the compressed key information data to the platform server:

adopting efficient language, extracting, filtering and analyzing the compressed key information data at the same time, and performing one-time full traversal; in the analysis process, determining the detail degree of log printing according to the level of the pre-divided log printing; and after the analysis is finished, storing the analysis result in a local database, and periodically uploading the analysis result to the platform server when the accumulated data number of the analysis result reaches a preset number or the accumulated data size reaches a preset size.

11. The cloud communication terminal of claim 8, wherein the mining control module is specifically configured to:

based on the deep mining result of the industry big data analysis result, the cloud communication terminal accurately identifies the mobile user terminal, and the cloud communication terminal accurately controls at least one of the following mobile user terminals: dynamically controlling a black and white list of the destination address; dynamically controlling the traffic type flow, and carrying out speed limit control aiming at the traffic type of which the flow consumption exceeds a preset flow value; and dynamically controlling the application type flow control, and preferentially ensuring the network request of the specified application.

12. A method for analyzing user behaviors in a cloud communication application scene is used for a platform server of a cloud communication terminal, and is characterized by comprising the following steps:

the method comprises the steps that a platform server receives key information data uploaded by a cloud communication terminal, wherein the key information data are data obtained by starting root authority of the cloud communication terminal, capturing flow data of a network port, extracting and filtering key data information of the flow data and compressing the extracted key data information;

the platform server conjectures user behaviors according to the key data information to obtain a business big data analysis result and excavates the business big data analysis result;

and the platform server sends the mining result of the industry big data analysis result to the cloud communication terminal so that the cloud communication terminal controls the mobile user terminal according to the mining result.

13. The method for analyzing the user behavior in the cloud communication application scenario according to claim 12, wherein the platform server speculates the user behavior according to the key data information to obtain a business big data analysis result and mine the business big data analysis result, and specifically includes:

the platform server matches and compares the received key data information with the data of the feature library, identifies the application to which the network request flow belongs, conjectures the user behavior according to the identification result, and adds the identification result to the network request flow to be stored in the platform database;

obtaining a user characteristic model based on a series of inferred user behaviors, obtaining a business big data analysis result according to the user characteristic model, and performing visual presentation, wherein the visual presentation comprises at least one of the following: the method comprises the steps of total consumption of the whole network, country classified consumption, traffic type consumption, user traffic use ranking list, traffic classified by application type, association relationship between a mobile user terminal and a cloud communication terminal, a file of the mobile user terminal, terminal network performance evaluation, whole network cumulative statistics, mobile user terminal type proportion statistics and authentication statistics.

14. The method for analyzing the user behavior in the cloud communication application scenario according to claim 12, wherein mining the industry big data analysis result includes one or a combination of the following:

deducing user interest points and internet access habits according to the frequency of the application of each network request of the mobile user terminal;

collecting search keywords, counting the popularity of the keywords, and establishing the association with the travel destination and time of the user;

and obtaining a user trip geographical position ranking list according to the frequency statistics of the user trip destination.

15. The utility model provides a platform server, is applied to analysis user's action under the cloud communication application scene, its characterized in that includes: the receiving module is used for receiving key information data uploaded by the cloud communication terminal, wherein the key information data is data obtained by starting root authority of the cloud communication terminal, capturing flow data of a network port, extracting and filtering key data information from the flow data and compressing the extracted key data information;

16. The platform server of claim 15, wherein the analytics mining module is specifically configured to:

matching and comparing the received key data information with data of a feature library, identifying the application to which the network request flow belongs, inferring user behavior according to the identification result, and adding the identification result to the network request flow to store in a platform database; obtaining a user characteristic model based on a series of inferred user behaviors, obtaining a business big data analysis result according to the user characteristic model, and performing visual presentation, wherein the visual presentation comprises at least one of the following: the method comprises the steps of total consumption of the whole network, country classified consumption, traffic type consumption, user traffic use ranking list, traffic classified by application type, association relationship between a mobile user terminal and a cloud communication terminal, a file of the mobile user terminal, terminal network performance evaluation, whole network cumulative statistics, mobile user terminal type proportion statistics and authentication statistics.

17. The platform server of claim 16, wherein the analysis mining module is configured to mine the analysis result of the business big data, and the mining result specifically includes one or a combination of the following: counting the user viscosity according to the application use duration and the application type use duration, and establishing a relation with a user trip destination; counting the viscosity of the user according to the time length of the user using the cloud communication terminal, and establishing the association with the user travel destination; deducing user interest points and internet access habits according to the frequency of the application of each network request of the mobile user terminal; collecting search keywords, counting the popularity of the keywords, and establishing the association with the travel destination and time of the user; obtaining a user trip country ranking list according to frequency statistics of user trip countries; and obtaining a user trip geographical position ranking list according to the frequency statistics of the user trip destination.