CN112261001A - Server behavior monitoring method based on flow data analysis - Google Patents
Server behavior monitoring method based on flow data analysis Download PDFInfo
- Publication number
- CN112261001A CN112261001A CN202011026216.7A CN202011026216A CN112261001A CN 112261001 A CN112261001 A CN 112261001A CN 202011026216 A CN202011026216 A CN 202011026216A CN 112261001 A CN112261001 A CN 112261001A
- Authority
- CN
- China
- Prior art keywords
- data
- server
- behavior
- access request
- information
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Withdrawn
Links
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
- G06F16/90—Details of database functions independent of the retrieved data types
- G06F16/906—Clustering; Classification
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L43/00—Arrangements for monitoring or testing data switching networks
- H04L43/06—Generation of reports
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L43/00—Arrangements for monitoring or testing data switching networks
- H04L43/16—Threshold monitoring
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L67/00—Network arrangements or protocols for supporting network services or applications
- H04L67/50—Network services
- H04L67/535—Tracking the activity of the user
Landscapes
- Engineering & Computer Science (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- General Engineering & Computer Science (AREA)
- Computer Hardware Design (AREA)
- Computer Security & Cryptography (AREA)
- Computing Systems (AREA)
- Databases & Information Systems (AREA)
- Theoretical Computer Science (AREA)
- Data Mining & Analysis (AREA)
- Physics & Mathematics (AREA)
- General Physics & Mathematics (AREA)
- Data Exchanges In Wide-Area Networks (AREA)
Abstract
A server behavior monitoring method based on traffic data analysis comprises the following steps: s1, acquiring original internet traffic data; s2, recording target behavior information and corresponding flow; s3, filling the flow data; s4, classifying the data after the filling processing by adopting a deep learning method; s5, data mining is carried out, and the obtained data are classified according to the keywords; s6, determining the times of executing a certain action by the server in a set time length; s7, judging whether the times of a certain behavior reaches a first threshold value; s8, judging whether the times of a certain behavior reach a second threshold value; and S9, storing and backing up the behavior data of the server, and analyzing the behavior of the server. The invention monitors the server behavior based on the traffic data analysis, solves the problem of inaccurate analysis of the server behavior at present, realizes effective monitoring of the server by reading the traffic data of the server, and has excellent use effect.
Description
Technical Field
The invention relates to the technical field of servers, in particular to a server behavior monitoring method based on flow data analysis.
Background
A server refers to a computer, also called a server, that manages resources and provides services to users; since the server needs to respond to and process the service request, the server generally has the capability of bearing and guaranteeing the service, and the server comprises a processor, a hard disk, a memory, a system bus and the like, and is similar to a general computer architecture, but the server needs to provide highly reliable service, so that the server has high requirements on processing capability, stability, reliability, safety, expandability, manageability and the like; under the network environment, the system is divided into a file server, a database server, an application program server, a WEB server and the like according to different service types provided by the server; compared with the common PC, the server has higher requirements on stability, safety, performance and the like, so that the hardware such as a CPU (central processing unit), a chipset, a memory, a disk system, a network and the like is different from the common PC, and the function of the server is more complex compared with the PC; at present, in the using process of a server, the behavior of the server is difficult to monitor, the analyzing effect of the server behavior is poor, and improvement is needed.
Disclosure of Invention
Objects of the invention
In order to solve the technical problems in the background art, the invention provides a server behavior monitoring method based on flow data analysis, which monitors the server behavior based on the flow data analysis, can realize statistics and analysis of server access behaviors and access flows, solves the problem that the server behavior analysis is inaccurate at present, realizes effective monitoring of a server by reading the flow data of the server, and has an excellent use effect.
(II) technical scheme
The invention provides a server behavior monitoring method based on flow data analysis, which comprises the following steps:
s1, acquiring original internet traffic data, monitoring access request information of a server and identifying an identifier of the server by terminal monitoring equipment, wherein the access request information carries an access link of a target page;
s2, setting preset behavior conditions, recognizing the behavior information of the server to the target page by the terminal monitoring equipment according to the server identification, and recording the target behavior information and corresponding flow;
s3, the terminal monitoring equipment acquires access flow data according to the access request information and the behavior information, and performs filling processing on the acquired flow data;
s4, classifying the filled data by adopting a deep learning method based on an infinite deep neural network to obtain classification results of the flow data, and extracting keywords from each classification result;
s5, setting preset parameters, performing data mining according to classification results, comparing and analyzing the extracted keywords with the preset parameters to obtain analysis results, acquiring data related to the preset parameters from flow data through a packet capturing tool, and classifying the acquired data according to the keywords;
s6, according to the keywords and the classification results related to the keywords, the terminal monitoring equipment determines the times that the server corresponding to the identifier executes a certain action within a set time length;
s7, the terminal monitoring equipment judges whether the times of a certain action reaches a first threshold value, and when the times of the certain action reaches the first threshold value, the terminal monitoring equipment sends a prompt to the server, otherwise, the terminal monitoring equipment does not send the prompt;
s8, the terminal monitoring equipment judges whether the behavior frequency reaches a second threshold value, wherein the second threshold value is larger than the first threshold value; when the second threshold is reached, the server is instructed to input the verification code, the access request is responded when the input verification code passes the authentication, otherwise, the access request is not responded;
and S9, the terminal monitoring equipment stores and backs up the behavior data of the server, analyzes the behavior of the server and generates an analysis report.
Preferably, in S1, the access request corresponding to the access request information is used to request the relevant website, and send the page information of the target page to the terminal monitoring device, so that the terminal monitoring device displays the target page according to the page information and obtains the target page information.
Preferably, in S2, the method further includes the steps of:
determining the layout of a target page and acquiring the layout content of each page layout, wherein one layout position corresponds to one page layout; and generating layout information and layout block content information of the target page according to the layout of the target page and the layout block content of each page layout block.
Preferably, S3 includes the steps of:
acquiring an access request of a server, and extracting a page URL of an analysis object from the access request;
the method comprises the steps of obtaining access flow data and search engine data according to a page URL, extracting initial access flow data of preset time according to the URL, and classifying the initial access flow data according to preset types to obtain the access flow data and the search engine data.
Preferably, in S4, the method further includes determining the number and ranking of each keyword, and generating a real-time statistical table related to the behavior keywords.
Preferably, in S5, the method further includes the steps of:
setting a preset attribute table, and storing the keyword data in the preset attribute table;
and comparing the data in the preset attribute table with preset parameters to obtain an analysis result.
Preferably, in S8, after the set duration is over, the terminal monitoring device instructs the server to input the verification code again when receiving the behavior access request including the recorded server, and responds to the access request of the server when the input verification code passes authentication, and does not respond to the access request otherwise.
Preferably, in S3, the padding process is performed by using an incomplete data padding algorithm that merges the N-neighbor padding algorithm and the threshold padding algorithm.
Preferably, the filling treatment comprises the following specific steps:
carrying out noise cleaning on the acquired flow data to obtain data after the noise cleaning;
dividing the data after noise cleaning into a complete data set A and an incomplete data set B according to whether the data is complete or not; the data in the step B is executed in the next step, and the data in the step A is directly executed in the last step;
searching neighbor data in the data B in the data A, judging whether the neighbor data most similar to the data of the data can be found in the data A or not, if so, taking the mean value of the neighbor data as the data, filling the data with the complete data and executing the last step, otherwise, deleting the data from the data B;
and performing data integration, data conversion and data specification on the filled data.
Preferably, in S2, when the target behavior information does not meet the preset behavior condition, a notification is sent to the server.
The technical scheme of the invention has the following beneficial technical effects:
firstly, acquiring original internet traffic data; then identifying the behavior information of the server to the target page, and recording the target behavior information and the corresponding flow; then, filling the acquired flow data; then, classifying the data after filling processing by adopting a deep learning method, and extracting keywords from each classification result; then, data mining is carried out according to the classification result, data related to preset parameters are obtained from the flow data through a packet capturing tool, and the obtained data are classified according to keywords; then determining the times that the server corresponding to the identifier executes a certain action within a set time length; then the terminal monitoring equipment judges whether the times of a certain action reaches a first threshold value; then the terminal monitoring equipment judges whether the times of a certain action reaches a second threshold value; finally, the terminal monitoring equipment stores and backups all the behavior data of the server, analyzes the behavior of the server and generates an analysis report;
the invention monitors the server behavior based on the traffic data analysis, can realize the statistics and analysis of the server access behavior and the access traffic, solves the problem of inaccurate analysis of the server behavior at present, realizes the effective monitoring of the server by reading the traffic data of the server, and has excellent use effect.
Drawings
Fig. 1 is a flowchart of a server behavior monitoring method based on traffic data analysis according to the present invention.
Detailed Description
In order to make the objects, technical solutions and advantages of the present invention more apparent, the present invention will be described in further detail with reference to the accompanying drawings in conjunction with the following detailed description. It should be understood that the description is intended to be exemplary only, and is not intended to limit the scope of the present invention. Moreover, in the following description, descriptions of well-known structures and techniques are omitted so as to not unnecessarily obscure the concepts of the present invention.
As shown in fig. 1, the server behavior monitoring method based on traffic data analysis provided by the present invention includes the following steps:
s1, acquiring original internet traffic data, monitoring access request information of a server and identifying an identifier of the server by terminal monitoring equipment, wherein the access request information carries an access link of a target page;
s2, setting preset behavior conditions, recognizing the behavior information of the server to the target page by the terminal monitoring equipment according to the server identification, and recording the target behavior information and corresponding flow; when the target behavior information does not accord with the preset behavior condition, sending a reminding notice to the server;
s3, the terminal monitoring equipment acquires access flow data according to the access request information and the behavior information, and performs filling processing on the acquired flow data;
s4, classifying the filled data by adopting a deep learning method based on an infinite deep neural network to obtain classification results of the flow data, and extracting keywords from each classification result;
s5, setting preset parameters, performing data mining according to classification results, comparing and analyzing the extracted keywords with the preset parameters to obtain analysis results, acquiring data related to the preset parameters from flow data through a packet capturing tool, and classifying the acquired data according to the keywords;
s6, according to the keywords and the classification results related to the keywords, the terminal monitoring equipment determines the times that the server corresponding to the identifier executes a certain action within a set time length;
s7, the terminal monitoring equipment judges whether the times of a certain action reaches a first threshold value, and when the times of the certain action reaches the first threshold value, the terminal monitoring equipment sends a prompt to the server, otherwise, the terminal monitoring equipment does not send the prompt;
s8, the terminal monitoring equipment judges whether the behavior frequency reaches a second threshold value, wherein the second threshold value is larger than the first threshold value; when the second threshold is reached, the server is instructed to input the verification code, the access request is responded when the input verification code passes the authentication, otherwise, the access request is not responded;
and S9, the terminal monitoring equipment stores and backs up the behavior data of the server, analyzes the behavior of the server and generates an analysis report.
In S1, the access request corresponding to the access request information is used to request the relevant website, and send the page information of the target page to the terminal monitoring device, so that the terminal monitoring device displays the target page according to the page information and obtains the target page information.
In an optional embodiment, in S2, the method further includes the following steps: determining the layout of a target page and acquiring the layout content of each page layout, wherein one layout position corresponds to one page layout; and generating layout information and layout block content information of the target page according to the layout of the target page and the layout block content of each page layout block.
In an alternative embodiment, S3 includes the steps of: acquiring an access request of a server, and extracting a page URL of an analysis object from the access request; the method comprises the steps of obtaining access flow data and search engine data according to a page URL, extracting initial access flow data of preset time according to the URL, and classifying the initial access flow data according to preset types to obtain the access flow data and the search engine data.
In an alternative embodiment, in S4, the method further includes determining the number and ranking of each keyword, and generating a real-time statistical table related to the behavior keywords.
In an optional embodiment, in S5, the method further includes the following steps: setting a preset attribute table, and storing the keyword data in the preset attribute table; and comparing the data in the preset attribute table with preset parameters to obtain an analysis result.
In an alternative embodiment, in S8, after the set duration is over, the terminal monitoring device instructs the server to input the verification code again if receiving the behavior access request including the recorded server, and responds to the access request of the server if the input verification code passes the authentication, otherwise, does not respond to the access request.
In an alternative embodiment, in S3, the padding process uses an incomplete data padding algorithm that merges the N-nearest neighbor padding algorithm and the threshold padding algorithm, and the specific steps of the padding process are as follows: carrying out noise cleaning on the acquired flow data to obtain data after the noise cleaning; dividing the data after noise cleaning into a complete data set A and an incomplete data set B according to whether the data is complete or not; the data in the step B is executed in the next step, and the data in the step A is directly executed in the last step; searching neighbor data in the data B in the data A, judging whether the neighbor data most similar to the data of the data can be found in the data A or not, if so, taking the mean value of the neighbor data as the data, filling the data with the complete data and executing the last step, otherwise, deleting the data from the data B; and performing data integration, data conversion and data specification on the filled data.
When the method is used, original internet flow data are firstly obtained, the terminal monitoring equipment monitors access request information of the server and identifies the identifier of the server, the access request information carries an access link of a target page, an access request corresponding to the access request information is used for requesting a related website, and page information of the target page is sent to the terminal monitoring equipment, so that the terminal monitoring equipment displays the target page according to the page information and obtains the target page information; then setting a preset behavior condition, identifying the behavior information of the server to a target page by the terminal monitoring equipment according to the server identification, recording the target behavior information and corresponding flow, and sending a reminding notice to the server when the target behavior information does not accord with the preset behavior condition;
then the terminal monitoring equipment acquires access flow data according to the access request information and the behavior information, and performs filling processing on the acquired flow data, wherein the filling processing adopts an incomplete data filling algorithm which integrates an N neighbor filling algorithm and a threshold filling algorithm; classifying the filled data by adopting a deep learning method based on an infinite deep neural network to obtain classification results of the flow data, extracting keywords from the classification results, determining the number and the ranking of the keywords and generating a real-time statistical table related to the behavior keywords of the keywords;
then setting preset parameters, carrying out data mining according to the classification result, setting a preset attribute table, storing the keyword data in the preset attribute table, comparing the data in the preset attribute table with the preset parameters to obtain an analysis result, acquiring data related to the preset parameters from the flow data through a packet capturing tool, and classifying the acquired data according to the keywords; then according to the keywords and the classification results related to the keywords, the terminal monitoring equipment determines the times that the server corresponding to the identifier executes a certain action within a set time length;
then the terminal monitoring equipment judges whether the times of a certain action reaches a first threshold value, if so, the terminal monitoring equipment sends a prompt to the server, otherwise, the terminal monitoring equipment does not send the prompt; then the terminal monitoring equipment judges whether the behavior frequency reaches a second threshold value, when the behavior frequency reaches the second threshold value, the terminal monitoring equipment instructs the server to input a verification code, and when the input verification code passes the authentication, the terminal monitoring equipment responds to the access request, otherwise, the terminal monitoring equipment does not respond to the access request; and finally, the terminal monitoring equipment stores and backups the behavior data of the server, analyzes the behavior of the server and generates an analysis report.
The invention monitors the server behavior based on the traffic data analysis, can realize the statistics and analysis of the server access behavior and the access traffic, solves the problem of inaccurate analysis of the server behavior at present, realizes the effective monitoring of the server by reading the traffic data of the server, and has excellent use effect.
It is to be understood that the above-described embodiments of the present invention are merely illustrative of or explaining the principles of the invention and are not to be construed as limiting the invention. Therefore, any modification, equivalent replacement, improvement and the like made without departing from the spirit and scope of the present invention should be included in the protection scope of the present invention. Further, it is intended that the appended claims cover all such variations and modifications as fall within the scope and boundaries of the appended claims or the equivalents of such scope and boundaries.
Claims (10)
1. A server behavior monitoring method based on traffic data analysis is characterized by comprising the following steps:
s1, acquiring original internet traffic data, monitoring access request information of a server and identifying an identifier of the server by terminal monitoring equipment, wherein the access request information carries an access link of a target page;
s2, setting preset behavior conditions, recognizing the behavior information of the server to the target page by the terminal monitoring equipment according to the server identification, and recording the target behavior information and corresponding flow;
s3, the terminal monitoring equipment acquires access flow data according to the access request information and the behavior information, and performs filling processing on the acquired flow data;
s4, classifying the filled data by adopting a deep learning method based on an infinite deep neural network to obtain classification results of the flow data, and extracting keywords from each classification result;
s5, setting preset parameters, performing data mining according to classification results, comparing and analyzing the extracted keywords with the preset parameters to obtain analysis results, acquiring data related to the preset parameters from flow data through a packet capturing tool, and classifying the acquired data according to the keywords;
s6, according to the keywords and the classification results related to the keywords, the terminal monitoring equipment determines the times that the server corresponding to the identifier executes a certain action within a set time length;
s7, the terminal monitoring equipment judges whether the times of a certain action reaches a first threshold value, and when the times of the certain action reaches the first threshold value, the terminal monitoring equipment sends a prompt to the server, otherwise, the terminal monitoring equipment does not send the prompt;
s8, the terminal monitoring equipment judges whether the behavior frequency reaches a second threshold value, wherein the second threshold value is larger than the first threshold value; when the second threshold is reached, the server is instructed to input the verification code, the access request is responded when the input verification code passes the authentication, otherwise, the access request is not responded;
and S9, the terminal monitoring equipment stores and backs up the behavior data of the server, analyzes the behavior of the server and generates an analysis report.
2. The method for monitoring server behavior based on traffic data analysis according to claim 1, wherein in S1, the access request corresponding to the access request information is used to request a related website, and the page information of the target page is sent to the terminal monitoring device, so that the terminal monitoring device displays the target page according to the page information and obtains the target page information.
3. The method for monitoring server behavior based on traffic data analysis according to claim 1, wherein in S2, the method further comprises the following steps:
determining the layout of a target page and acquiring the layout content of each page layout, wherein one layout position corresponds to one page layout; and generating layout information and layout block content information of the target page according to the layout of the target page and the layout block content of each page layout block.
4. The method for monitoring server behavior based on traffic data analysis as claimed in claim 1, wherein S3 includes the following steps:
acquiring an access request of a server, and extracting a page URL of an analysis object from the access request;
the method comprises the steps of obtaining access flow data and search engine data according to a page URL, extracting initial access flow data of preset time according to the URL, and classifying the initial access flow data according to preset types to obtain the access flow data and the search engine data.
5. The method for monitoring server behavior based on traffic data analysis of claim 1, further comprising determining the number and ranking of each keyword and generating a real-time statistical table related to the behavior keyword at S4.
6. The method for monitoring server behavior based on traffic data analysis according to claim 4, wherein in S5, the method further comprises the following steps:
setting a preset attribute table, and storing the keyword data in the preset attribute table;
and comparing the data in the preset attribute table with preset parameters to obtain an analysis result.
7. The method for monitoring server behavior based on traffic data analysis of claim 1, wherein in S8, after the set duration is over, the terminal monitoring device instructs the server to input the verification code again when receiving the behavior access request containing the recorded server, and responds to the access request of the server when the input verification code passes authentication, otherwise, does not respond to the access request.
8. The method for monitoring server behavior based on traffic data analysis according to claim 1, wherein in S3, the padding process is performed by using an incomplete data padding algorithm that merges an N-neighbor padding algorithm and a threshold padding algorithm.
9. The method for monitoring the server behavior based on the traffic data analysis according to claim 8, wherein the filling process specifically comprises the following steps:
carrying out noise cleaning on the acquired flow data to obtain data after the noise cleaning;
dividing the data after noise cleaning into a complete data set A and an incomplete data set B according to whether the data is complete or not; the data in the step B is executed in the next step, and the data in the step A is directly executed in the last step;
searching neighbor data in the data B in the data A, judging whether the neighbor data most similar to the data of the data can be found in the data A or not, if so, taking the mean value of the neighbor data as the data, filling the data with the complete data and executing the last step, otherwise, deleting the data from the data B;
and performing data integration, data conversion and data specification on the filled data.
10. The method for monitoring server behavior based on traffic data analysis according to claim 1, wherein in S2, when the target behavior information does not meet the preset behavior condition, a notification is sent to the server.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202011026216.7A CN112261001A (en) | 2020-09-25 | 2020-09-25 | Server behavior monitoring method based on flow data analysis |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202011026216.7A CN112261001A (en) | 2020-09-25 | 2020-09-25 | Server behavior monitoring method based on flow data analysis |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN112261001A true CN112261001A (en) | 2021-01-22 |
Family
ID=74234235
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202011026216.7A Withdrawn CN112261001A (en) | 2020-09-25 | 2020-09-25 | Server behavior monitoring method based on flow data analysis |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN112261001A (en) |
Cited By (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN114095224A (en) * | 2021-11-12 | 2022-02-25 | 湖北天融信网络安全技术有限公司 | Message detection method and device, electronic equipment and storage medium |
-
2020
- 2020-09-25 CN CN202011026216.7A patent/CN112261001A/en not_active Withdrawn
Cited By (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN114095224A (en) * | 2021-11-12 | 2022-02-25 | 湖北天融信网络安全技术有限公司 | Message detection method and device, electronic equipment and storage medium |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN109241427B (en) | Information pushing method, device, computer equipment and storage medium | |
| Viswanath et al. | Towards detecting anomalous user behavior in online social networks | |
| US20240111818A1 (en) | Method for training isolation forest, and method for recognizing web crawler | |
| CN105868256A (en) | Method and system for processing user behavior data | |
| CN108334641B (en) | Method, system, electronic equipment and storage medium for collecting user behavior data | |
| CN108023868B (en) | Malicious resource address detection method and device | |
| CN107977678B (en) | Method and apparatus for outputting information | |
| CN114915479A (en) | Web attack phase analysis method and system based on Web log | |
| CN114528457A (en) | Web fingerprint detection method and related equipment | |
| CN111586005A (en) | Scanner scanning behavior identification method and device | |
| Sujatha | Improved user navigation pattern prediction technique from web log data | |
| CN106294406B (en) | Method and equipment for processing application access data | |
| CN110929129B (en) | Information detection method, equipment and machine-readable storage medium | |
| CN110955890B (en) | Method and device for detecting malicious batch access behaviors and computer storage medium | |
| CN113535823B (en) | Abnormal access behavior detection method and device and electronic equipment | |
| CN112261001A (en) | Server behavior monitoring method based on flow data analysis | |
| CN107704494B (en) | User information collection method and system based on application software | |
| JP6872853B2 (en) | Detection device, detection method and detection program | |
| US10313127B1 (en) | Method and system for detecting and alerting users of device fingerprinting attempts | |
| CN111241821B (en) | Method and device for determining behavior characteristics of user | |
| CN110069691A (en) | For handling the method and apparatus for clicking behavioral data | |
| CN111031397B (en) | Method, device, equipment and storage medium for collecting clip comments | |
| CN113453076B (en) | User video service quality evaluation method, device, computing equipment and storage medium | |
| US11290384B2 (en) | Access origin classification apparatus, access origin classification method and program | |
| US20070245029A1 (en) | Method for Determining Validity of Command and System Thereof |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| WW01 | Invention patent application withdrawn after publication |
Application publication date: 20210122 |
|
| WW01 | Invention patent application withdrawn after publication |