CN116720147A - Abnormal behavior detection method and device, electronic equipment and storage medium - Google Patents

Abnormal behavior detection method and device, electronic equipment and storage medium Download PDF

Info

Publication number
CN116720147A
CN116720147A CN202210190446.XA CN202210190446A CN116720147A CN 116720147 A CN116720147 A CN 116720147A CN 202210190446 A CN202210190446 A CN 202210190446A CN 116720147 A CN116720147 A CN 116720147A
Authority
CN
China
Prior art keywords
conversion
class
multimedia resources
objects
determining
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Pending
Application number
CN202210190446.XA
Other languages
Chinese (zh)
Inventor
周忠
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Tencent Technology Shenzhen Co Ltd
Original Assignee
Tencent Technology Shenzhen Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Tencent Technology Shenzhen Co Ltd filed Critical Tencent Technology Shenzhen Co Ltd
Priority to CN202210190446.XA priority Critical patent/CN116720147A/en
Publication of CN116720147A publication Critical patent/CN116720147A/en
Pending legal-status Critical Current

Links

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F17/00—Digital computing or data processing equipment or methods, specially adapted for specific functions
    • G06F17/10—Complex mathematical operations
    • G06F17/18—Complex mathematical operations for evaluating statistical data, e.g. average values, frequency distributions, probability functions, regression analysis
    • Y—GENERAL TAGGING OF NEW TECHNOLOGICAL DEVELOPMENTS; GENERAL TAGGING OF CROSS-SECTIONAL TECHNOLOGIES SPANNING OVER SEVERAL SECTIONS OF THE IPC; TECHNICAL SUBJECTS COVERED BY FORMER USPC CROSS-REFERENCE ART COLLECTIONS [XRACs] AND DIGESTS
    • Y02—TECHNOLOGIES OR APPLICATIONS FOR MITIGATION OR ADAPTATION AGAINST CLIMATE CHANGE
    • Y02D—CLIMATE CHANGE MITIGATION TECHNOLOGIES IN INFORMATION AND COMMUNICATION TECHNOLOGIES [ICT], I.E. INFORMATION AND COMMUNICATION TECHNOLOGIES AIMING AT THE REDUCTION OF THEIR OWN ENERGY USE
    • Y02D10/00—Energy efficient computing, e.g. low power processors, power management or thermal management

Landscapes

  • Engineering & Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • Data Mining & Analysis (AREA)
  • General Physics & Mathematics (AREA)
  • Mathematical Optimization (AREA)
  • Pure & Applied Mathematics (AREA)
  • Theoretical Computer Science (AREA)
  • Mathematical Physics (AREA)
  • Computational Mathematics (AREA)
  • Mathematical Analysis (AREA)
  • Life Sciences & Earth Sciences (AREA)
  • Operations Research (AREA)
  • Probability & Statistics with Applications (AREA)
  • Bioinformatics & Cheminformatics (AREA)
  • Algebra (AREA)
  • Evolutionary Biology (AREA)
  • Databases & Information Systems (AREA)
  • Software Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Bioinformatics & Computational Biology (AREA)
  • Debugging And Monitoring (AREA)

Abstract

The application relates to the technical field of multimedia resources, in particular to a method and a device for detecting abnormal behaviors, electronic equipment and a storage medium, which are used for determining various objects to be used and respectively aiming at reference transformation parameters of various multimedia resources; reference transformation parameters characterization: parameters of a type of history conversion quantity generated by a type of usage object aiming at a type of multimedia resources associated with a history flow carrier; determining various use objects, and respectively aiming at flow conversion parameters of various multimedia resources; flow conversion parameter characterization: parameters of current conversion quantity generated by a class of usage objects aiming at a class of multimedia resources associated with a target flow carrier; determining a conversion anomaly of the target flow carrier based on the overall degree of deviation between each reference conversion parameter and each flow conversion parameter; based on the conversion anomaly degree, an abnormal behavior detection result of the target flow carrier is determined, so that the accuracy of abnormal behavior detection can be improved.

Description

Abnormal behavior detection method and device, electronic equipment and storage medium
Technical Field
The present application relates to the field of multimedia resources, and in particular, to a method and apparatus for detecting abnormal behavior, an electronic device, and a storage medium.
Background
At present, with the development of internet technology, a flow carrier can display multimedia resources in an application program, so that corresponding benefits are obtained; for example, when the multimedia resource is an advertisement, the advertisement can be put in the application program, and through clicking, downloading, installing and other actions, the advertisement conversion is brought to the resource supply object, and meanwhile, the flow supply object can obtain corresponding benefits.
Therefore, in order to obtain more benefits, the traffic carrier generally sets text or images for inducing clicking on the multimedia resource in the application program, so as to obtain high clicking amount and high exposure. However, since such abnormal behavior is difficult to produce a realistic resource conversion effect, detection of the abnormal behavior is required.
In the related art, the abnormal behavior is usually detected by calculating the conversion rate of each object to be used for multimedia resources and judging whether the calculated conversion rate is too high or too low.
However, if the interest of the usage object in the specific category of multimedia resources is high, the calculated conversion rate will be high, so that erroneous judgment will occur in abnormal behavior detection.
For example: the female clicks and conversion amount of the multimedia resource of the cosmetic category are high, so that the calculated conversion rate exceeds a threshold value, and the system can judge that the flow supply object has abnormal behaviors.
Therefore, the accuracy of such abnormal behavior detection means in the related art is not high.
Disclosure of Invention
The embodiment of the application provides an abnormal behavior detection method, an abnormal behavior detection device, electronic equipment and a storage medium, so as to improve the accuracy of detecting abnormal behaviors.
The specific technical scheme provided by the embodiment of the application is as follows:
the abnormal behavior detection method provided by the embodiment of the application comprises the following steps:
determining various use objects based on the historical operation data of each historical flow carrier, and respectively aiming at the reference conversion parameters of various multimedia resources; wherein each reference transformation parameter characterizes: parameters of a type of history conversion quantity generated by a type of usage object aiming at a type of multimedia resources associated with a history flow carrier;
determining various types of use objects based on the current operation data of the target flow carrier, and respectively aiming at flow conversion parameters of various types of multimedia resources; wherein each flow conversion parameter characterizes: parameters of current conversion quantity generated by a class of usage objects aiming at a class of multimedia resources associated with the target flow carrier;
determining a conversion anomaly of the target flow carrier based on the overall degree of deviation between each reference conversion parameter and each flow conversion parameter;
And determining an abnormal behavior detection result of the target flow carrier based on the conversion abnormality.
The device for detecting abnormal behavior provided by the embodiment of the application comprises the following components:
the first determining module is used for determining various types of using objects based on the historical operation data of each historical flow carrier and respectively aiming at the reference conversion parameters of various types of multimedia resources; wherein each reference transformation parameter characterizes: parameters of a type of history conversion quantity generated by a type of usage object aiming at a type of multimedia resources associated with a history flow carrier;
the second determining module is used for determining various types of using objects based on the current operation data of the target flow carrier, and the flow conversion parameters of various types of multimedia resources are respectively aimed at; wherein each flow conversion parameter characterizes: parameters of current conversion quantity generated by a class of usage objects aiming at a class of multimedia resources associated with the target flow carrier;
a processing module for determining a conversion anomaly of the target flow carrier based on the overall degree of deviation between each reference conversion parameter and each flow conversion parameter;
and the detection module is used for determining an abnormal behavior detection result of the target flow carrier based on the conversion abnormality degree.
Optionally, the processing module is further configured to:
for the various types of use objects, the following operations are respectively executed: determining the sub-degree of abnormality of a class of using objects aiming at the corresponding class of multimedia resources based on the respective flow conversion parameters of the class of using objects aiming at the various types of multimedia resources and the associated reference conversion parameters;
based on the obtained individual child anomalies, a transformation anomaly of the target flow carrier is determined.
Optionally, when determining the class of usage objects according to the class of usage objects, the traffic conversion parameters of each class of multimedia resources, and the associated reference conversion parameters, the processing module is further configured to:
for the various multimedia resources, the following operations are respectively executed:
obtaining a parameter average value among all reference conversion parameters associated with a type of multimedia resources, and obtaining a parameter standard deviation among all the reference conversion parameters associated with the type of multimedia resources;
and determining the sub-anomaly of the class of using objects for the class of multimedia resources based on the flow conversion parameters, the parameter mean value and the parameter standard deviation of the class of multimedia resources.
Optionally, when determining the sub-anomaly of the class of usage objects for the class of multimedia resources based on the traffic conversion parameter, the parameter mean value and the parameter standard deviation of the class of multimedia resources, the processing module is further configured to:
obtaining a parameter difference value of the type of multimedia resources based on the flow conversion parameters of the type of multimedia resources and the parameter average value;
and taking the ratio between the parameter difference value and the parameter standard deviation as a class of using objects, and aiming at the sub-anomaly degree of the class of multimedia resources.
Optionally, when determining the conversion anomaly of the target flow carrier based on the obtained anomaly of each sub-anomaly, the processing module is further configured to:
respectively taking the ratio of the click quantity of the various using objects aiming at the various multimedia resources and the sum of the click quantity of the target flow carrier as the abnormality degree weight of the corresponding using objects aiming at the corresponding multimedia resources;
and determining the conversion anomaly degree of the target flow carrier based on the obtained anomaly degree of each sub-and the anomaly degree weight corresponding to each sub-anomaly degree.
Optionally, the historical operating data includes: each historical conversion amount and each historical click amount, the first determination module is further configured to:
For each historical traffic carrier, the following operations are performed respectively:
based on various using objects using a historical flow carrier, each reference conversion parameter is obtained according to the respective historical conversion quantity and the historical click quantity of various multimedia resources.
Optionally, the current operation data includes: each current conversion amount and each current click amount, the second determining module is further configured to:
for various types of use objects, the following operations are respectively executed:
and obtaining flow conversion parameters of the class of the use objects aiming at the corresponding class of the multimedia resources based on the current conversion quantity and the current click quantity of the class of the use objects aiming at the various classes of the multimedia resources.
Optionally, the detection module is further configured to:
and when the conversion anomaly degree reaches a preset anomaly degree threshold value, determining that the anomaly behavior detection result of the target flow carrier is abnormal.
Optionally, the detection module is further configured to:
determining the number of objects corresponding to the use objects with the registration time later than a preset registration time threshold based on the registration time corresponding to each use object associated with the target flow carrier;
determining a registration proportion corresponding to each use object based on the number of the objects and the total number of the objects of each use object;
And when the registration proportion is determined to be larger than a preset proportion threshold value and the conversion anomaly degree is determined to be larger than an anomaly degree threshold value, determining that the anomaly behavior detection result of the target flow carrier is abnormal.
In one aspect, an embodiment of the present application provides an electronic device, including a processor and a memory, where the memory stores program code that, when executed by the processor, causes the processor to perform any one of the steps of the abnormal behavior detection method described above.
In one aspect, embodiments of the present application provide a computer storage medium storing computer instructions that, when executed on a computer, cause the computer to perform the steps of any of the abnormal behavior detection methods described above.
In one aspect, embodiments of the present application provide a computer program product comprising computer instructions stored in a computer-readable storage medium; when the processor of the electronic device reads the computer instructions from the computer-readable storage medium, the processor executes the computer instructions so that the electronic device performs the steps of any of the abnormal behavior detection methods described above.
Due to the adoption of the technical scheme, the embodiment of the application has at least the following technical effects:
classifying each use object, classifying each multimedia resource, determining each type of use object, respectively aiming at the standard conversion parameters of each type of multimedia resource, determining each type of use object, respectively aiming at the flow conversion parameters of each type of multimedia resource, then determining the conversion anomaly degree of the target flow carrier based on the total deviation degree between each standard conversion parameter and each flow conversion parameter, and finally determining the abnormal behavior detection result of the target flow carrier based on the conversion anomaly degree, thus, when abnormal behaviors are detected, the different types of use objects respectively determine the deviation degree aiming at the different types of multimedia resources, and if the interest of the use object on the specific type of multimedia resource is higher, the abnormal behavior detection is not misjudged because the calculated flow conversion parameter is higher, thereby improving the accuracy of the abnormal behavior detection.
In addition, by the method in the embodiment of the application, the bottom code of the target flow carrier is not required to be analyzed, and the conversion anomaly degree of the target flow carrier can be determined directly based on the reference conversion parameter and the flow conversion parameter, so that the efficiency of detecting the abnormal behavior can be improved, and the manual verification cost can be reduced.
Drawings
The accompanying drawings, which are included to provide a further understanding of the application and are incorporated in and constitute a part of this specification, illustrate embodiments of the application and together with the description serve to explain the application and do not constitute a limitation on the application. In the drawings:
FIG. 1A is a schematic diagram of a first interface of a multimedia resource according to an embodiment of the present application;
FIG. 1B is a schematic diagram of a second interface of a multimedia resource according to an embodiment of the present application;
FIG. 1C is a diagram illustrating a third interface of a multimedia resource according to an embodiment of the present application;
fig. 2A is a schematic diagram of an application scenario in an embodiment of the present application;
FIG. 2B is a schematic diagram of a data sharing system according to an embodiment of the present application;
FIG. 2C is a block chain diagram of an embodiment of the present application;
FIG. 2D is a block generation flow chart according to an embodiment of the application;
FIG. 3A is a flowchart illustrating a method for detecting abnormal behavior according to an embodiment of the present application;
FIG. 3B is a schematic diagram of advertisement types according to an embodiment of the present application;
FIG. 3C is a schematic diagram of object types used in an embodiment of the present application;
FIG. 3D is an exemplary diagram of determining baseline conversion parameters in an embodiment of the present application;
FIG. 3E is an exemplary diagram of determining traffic conversion parameters for various types of multimedia resources in accordance with an embodiment of the present application;
FIG. 3F is an exemplary diagram of determining flow conversion parameters in an embodiment of the present application;
FIG. 3G is a flow chart of determining conversion anomaly in an embodiment of the present application;
FIG. 3H is a first exemplary diagram of determining child anomalies in accordance with an embodiment of the present application;
FIG. 3I is a flow chart of determining child anomalies according to an embodiment of the present application;
FIG. 3J is a flowchart of a method for determining child anomalies in accordance with an embodiment of the present application;
FIG. 3K is a flow chart of determining the degree of conversion anomaly in an embodiment of the present application;
FIG. 3L is a flowchart illustrating a determination of an abnormal behavior detection result according to an embodiment of the present application;
FIG. 3M is an exemplary diagram of determining abnormal behavior detection results in an embodiment of the present application;
FIG. 4 is a flowchart of a method for detecting abnormal behavior according to an embodiment of the present application;
FIG. 5 is an exemplary diagram of abnormal behavior detection in an embodiment of the present application;
FIG. 6 is a schematic diagram of an abnormal behavior detection device according to an embodiment of the present application;
fig. 7 is a schematic diagram of a hardware composition structure of an electronic device to which the embodiment of the present application is applied.
Detailed Description
For the purpose of making the objects, technical solutions and advantages of the embodiments of the present application more apparent, the technical solutions of the present application will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present application, and it is apparent that the described embodiments are some embodiments of the technical solutions of the present application, but not all embodiments. All other embodiments, based on the embodiments described in the present document, which can be obtained by a person skilled in the art without any creative effort, are within the scope of protection of the technical solutions of the present application.
The terms first, second and the like in the description and in the claims and in the above-described figures, are used for distinguishing between similar elements and not necessarily for describing a particular sequential or chronological order. It is to be understood that the data so used may be interchanged where appropriate such that the embodiments of the application described herein may be capable of operation in sequences other than those illustrated or otherwise described.
Some terms in the embodiments of the present application are explained below to facilitate understanding by those skilled in the art.
Flow carrier: the traffic carrier may be media, website, software, network IP, etc., and is not limited in this embodiment of the present application.
For example, in a software advertising platform, the flow carrier is a public number with a certain vermicelli quantity, the flow carrier can participate in profit division of advertisements, and the higher the click rate is, the higher the profit is.
Operation data: the operation data generated when the multimedia resource is operated by the user object using the traffic carrier is characterized, and the operation data includes the click rate and the conversion rate, but is not limited thereto.
The object of use: characterizing an object using a traffic bearer, clicking on the multimedia resource using the object through the traffic bearer.
For example, the use object is a user who browses advertisements using software.
Multimedia resources: the multimedia resource may be an advertisement or a video, which is not limited in the embodiment of the present application.
For example, referring to fig. 1A, a first interface schematic diagram of a multimedia resource in an embodiment of the present application is shown, where "here, a recommended article in purchase" is an advertisement set in an article, referring to fig. 1B, a second interface schematic diagram of a multimedia resource in an embodiment of the present application is shown, where "advertisement" operation control is an advertisement set in an applet, referring to fig. 1C, a third interface schematic diagram of a multimedia resource in an embodiment of the present application is shown, where "advertisement" operation space is an advertisement set in a game applet.
Click-to-charge (CPC) advertisement: the cost per advertisement click is characterized. In this mode, the advertiser only pays for the behavior of clicking the advertisement by the user, but no longer pays for the exposure of the advertisement, and for the advertiser, CPC advertisement avoids the risk of not clicking only by exposure, which is one of the current mainstream advertisement charging modes.
An advertiser: characterizing users who pay to place advertisements, advertisers want each paid advertisement click by themselves to be a valid click by a real user.
Advertisement delivery: and (3) representing the process that the advertisement platform displays advertisements on the page of the flow carrier, wherein a user browsing the page has what kind of interest and what kind of advertisements are displayed.
Advertisement position: media location identifiers that characterize ad placement, e.g., ads on articles are classified into top ad slots, text ad slots, and bottom ad slots based on where the ads appear in the articles, and in addition, ads on applets are classified into Banner ads, incentive video ads, screen inserts, etc., based on where they appear.
Abnormal behavior: the characterization is in links such as multimedia resource exposure, clicking, effect, etc., and for some malicious purpose, there are behaviors of brushing multimedia resource exposure, clicking, conversion.
Abnormal behavior detection: the characterization checks links such as multimedia resource exposure, clicking, conversion and the like, and judges whether the multimedia resource exposure, clicking, effect and the like are normal or not.
Click rate: characterizing the click-to-exposure ratio, for example, assuming that the advertisement has an exposure number of M and a click number of N, the click rate ctr=n/M.
Transformation parameters: characterizing a ratio or score between the amount of conversion brought by the multimedia asset and the click through of the multimedia asset during the delivery of the multimedia asset. For different popularization targets, the corresponding conversion targets are different. For example, assuming that the multimedia resource is an e-commerce advertisement, the conversion target refers to an order placed by the advertisement, and thus the conversion parameter is a ratio of an order placed by the e-commerce advertisement to a click-through amount, and for example, assuming that the multimedia resource is a download-type advertisement, the conversion refers to application software activation by the advertisement, and thus the conversion parameter is a ratio of an application software activation amount by the advertisement to a click-through amount.
The following briefly describes the design concept of the embodiment of the present application:
at present, with the development of internet technology, a program developer can be used as a flow carrier by applying for opening a multimedia resource display position, so that corresponding benefits are obtained.
For example, when the multimedia resource is an advertisement, the program developer can apply to open the advertisement space to become a traffic carrier, and when the user uses the object to expose and click the advertisement on the applet, the traffic carrier can obtain benefits. In CPC advertising, the larger the click-through of the advertisement, the more revenue the traffic vector receives.
Therefore, in order to obtain more benefits, the traffic carrier usually adopts a large number of machine objects to click on the multimedia resources, and sets characters or images for inducing clicking on the multimedia resources in the application program so as to obtain high click rate and high exposure. However, since such abnormal behavior is difficult to produce a realistic resource conversion effect, detection of the abnormal behavior is required.
In the related art, when detecting abnormal behavior, it is generally achieved by the following two ways:
the first way is: the abnormal behavior is detected by calculating the conversion rate of each using object to the multimedia resource and judging whether the calculated conversion rate is too high or too low, however, if a single conversion rate threshold value is adopted for detecting the abnormal behavior, erroneous judgment is easy to occur.
The second way is: whether the click behavior of the used object is similar to the machine behavior is judged, however, with the development of computer technology, the machine behavior tends to use the click behavior of the object more and more, and therefore, the accuracy of abnormal behavior detection is lowered.
In view of the above, the embodiment of the application provides an abnormal behavior detection method, an abnormal behavior detection device, an electronic device and a storage medium. Classifying all the using objects, classifying all the multimedia resources, determining all the using objects, respectively aiming at the basic transformation parameters of all the multimedia resources, determining all the using objects, respectively aiming at the flow transformation parameters of all the multimedia resources, then determining the transformation anomaly degree of the target flow carrier based on the basic transformation parameters and the total deviation degree of the flow transformation parameters, and finally determining the abnormal behavior detection result of the target flow carrier based on the transformation anomaly degree. Therefore, under the target flow carrier, the flow conversion parameters of a certain class of the use object for a class of the multimedia resource are consistent with the reference conversion parameters of a class of the use object for a large disk for the class of the multimedia resource, so that the accuracy of abnormal behavior detection is improved by classifying the multimedia resource and classifying the use object to judge whether the flow conversion parameters of various types of the use object for various types of the multimedia resource deviate from the large disk, so that the abnormal behavior of the target flow carrier can be identified.
The preferred embodiments of the present application will be described below with reference to the accompanying drawings of the specification, it being understood that the preferred embodiments described herein are for illustration and explanation only, and not for limitation of the present application, and that the embodiments of the present application and the features of the embodiments may be combined with each other without conflict.
Fig. 2A is a schematic diagram of an application scenario in an embodiment of the present application. The application scenario diagram includes a client 200, a base computing server 210, and an anomaly detection server 220.
The client 200 includes, but is not limited to, a cell phone, a computer, an intelligent voice interaction device, an intelligent home appliance, a vehicle-mounted terminal, an aircraft, etc. The client 200 may be a client installed with a function for browsing multimedia resources.
The base computing server 210 is configured to upload operation data to the base computing server 210 after the user clicks on the multimedia resource in the client 200, where the uploaded operation data includes, but is not limited to: current time, usage object ID, scene, usage object IP, traffic bearer ID, etc.
The base computing server 210 queries in the multimedia resource database through the multimedia resource ID to obtain the resource type of the multimedia resource, and simultaneously queries in the use object database through the use object ID to obtain the object type corresponding to the use object, and finally, determines the reference conversion parameters of each type of use object for each type of multimedia resource based on the historical operation data, and determines the flow conversion parameters of each type of use object for each type of multimedia resource based on the current operation data.
The base computing server 210 stores a multimedia resource database, uses the multimedia resource ID as a keyword, stores attribute data of each multimedia resource, for example, the attribute data may be a resource type, and includes: travel, education, shoe bags, etc.
The base computing server 210 also stores therein a usage object database, which stores an object type of each usage object, such as travel, cosmetics, shoe bags, etc., using the object ID as a keyword.
The basic computing server 210 may be an independent physical server, a server cluster or a distributed system formed by a plurality of physical servers, or a cloud server providing cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, CDNs, basic cloud computing services such as big data and artificial intelligence platforms, and the like. The communication between the client 200 and the base computing server 210 may be performed through a communication network, and in an alternative embodiment, the communication network may be a wired network or a wireless network, so that the client 200 and the base computing server 210 may be directly or indirectly connected through wired or wireless communication, and embodiments of the present application are not limited herein.
The anomaly detection server 220 is configured to determine a total deviation degree between the flow conversion parameters of the various multimedia resources and the reference conversion parameters under the target flow carrier, so as to determine an anomaly detection result of the target flow carrier.
The anomaly detection server 220 may be an independent physical server, a server cluster or a distributed system formed by a plurality of physical servers, or a cloud server providing cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, CDNs, basic cloud computing services such as big data and artificial intelligence platforms.
The base computing server 210 and the anomaly detection server 220 may communicate via a communication network, and in an alternative embodiment, the communication network may be a wired network or a wireless network, so that the base computing server 210 and the anomaly detection server 220 may be directly or indirectly connected via wired or wireless communication, and embodiments of the present application are not limited in this regard.
The method in the embodiment of the application can be applied to the scene of detecting the abnormal behavior of the advertisement, determines each flow conversion parameter of the target flow carrier based on the click quantity and conversion quantity of the advertisement, and determines the conversion abnormality degree of the target flow carrier based on the total deviation degree between the flow conversion parameter and each reference conversion parameter, thereby determining whether the abnormal behavior occurs in the advertisement putting process based on the conversion abnormality degree.
The method in the embodiment of the application can also be applied to the scene of abnormal behavior detection of the video, determine each flow conversion parameter of the target flow carrier based on the click quantity and conversion quantity of the video, and determine the conversion abnormality degree of the target flow carrier based on the total deviation degree between the flow conversion parameter and each reference conversion parameter, thereby determining whether abnormal behavior occurs in the video playing process.
In one possible application scenario, the plurality of base computing servers 210 and the plurality of anomaly detection servers 220 may share data through a blockchain, and the plurality of base computing servers 210 and the plurality of anomaly detection servers 220 correspond to a data sharing system formed by a plurality of servers.
Referring to fig. 2B, a schematic diagram of a data sharing system according to an embodiment of the present application is shown, where the data sharing system 230 is a system for sharing data between nodes, and the data sharing system may include a plurality of nodes 231, and the plurality of nodes 231 may be each base computing server 210 and each anomaly detection server 220 in the data sharing system. Each node 231 may receive input information during normal operation and maintain shared data within the data sharing system based on the received input information. In order to ensure the information intercommunication in the data sharing system, information connection can exist between each node in the data sharing system, and the nodes can transmit information through the information connection. For example, when any node in the data sharing system receives input information, other nodes in the data sharing system acquire the input information according to a consensus algorithm, and store the input information as data in the shared data, so that the data stored on all nodes in the data sharing system are consistent.
Each node in the data sharing system has a node identifier corresponding to the node identifier, and each node in the data sharing system can store the node identifiers of other nodes in the data sharing system, so that the generated block can be broadcast to other nodes in the data sharing system according to the node identifiers of other nodes. Each node can maintain a node identification list shown in the following table, and the node names and the node identifications are correspondingly stored in the node identification list. The node identifier may be an IP (Internet Protocol, protocol of interconnection between networks) address and any other information that can be used to identify the node, and is shown in table 1, where the table 1 only illustrates an IP address as an example.
Table 1.
Node name Node identification
Node 1 117.114.151.174
Node 2 117.116.189.145
… …
Node N 119.123.789.258
Each node in the data sharing system stores one and the same blockchain. Referring to fig. 2C, a block chain diagram of an embodiment of the present application is shown, wherein the block chain is composed of a plurality of blocks, the starting block includes a block header and a block body, the block header stores an input information characteristic value, a version number, a timestamp and a difficulty value, and the block body stores input information; the next block of the starting block takes the starting block as a father block, the next block also comprises a block head and a block main body, the block head stores the input information characteristic value of the current block, the block head characteristic value of the father block, the version number, the timestamp and the difficulty value, and the like, so that the block data stored in each block in the block chain are associated with the block data stored in the father block, and the safety of the input information in the block is ensured.
When each block in the blockchain is generated, referring to fig. 2D, a flow diagram is generated for the blocks in the embodiment of the application, when the node where the blockchain is located receives the input information, the input information is checked, after the checking is completed, the input information is stored in the memory pool, and the hash tree for recording the input information is updated; then, updating the update time stamp to the time of receiving the input information, trying different random numbers, and calculating the characteristic value for a plurality of times, so that the calculated characteristic value can meet the following formula:
SHA256(SHA256(version+prev hash +merkle root +ntime+nbits+x))<TARGET
wherein SHA256 is a eigenvalue algorithm used to calculate eigenvalues; version (version number) is version information of the related block protocol in the block chain; prev hash A block header characteristic value of a parent block of the current block; merkle (R) root Is a characteristic value of the input information; ntime is the update time of the update timestamp; the nbits is the current difficulty, is a fixed value in a period of time, and is determined again after exceeding a fixed period of time; x is a random number; TARGET is a eigenvalue threshold that can be determined from nbits.
Thus, when the random number meeting the formula is calculated, the information can be correspondingly stored to generate the block head and the block main body, and the current block is obtained. And then, the node where the blockchain is located sends the newly generated blocks to other nodes in the data sharing system where the newly generated blocks are located according to the node identification of other nodes in the data sharing system, the other nodes verify the newly generated blocks, and the newly generated blocks are added into the blockchain stored in the newly generated blocks after the verification is completed.
The abnormal behavior detection method provided by the exemplary embodiment of the present application will be described below with reference to the accompanying drawings in conjunction with the application scenario described above, and it should be noted that the application scenario described above is only shown for the convenience of understanding the spirit and principle of the present application, and the embodiment of the present application is not limited in any way in this respect.
Based on the above embodiments, referring to fig. 3A, a flow chart of an abnormal behavior detection method in an embodiment of the present application specifically includes:
s30: and determining various types of using objects based on the historical operation data of each historical flow carrier, and respectively aiming at the reference conversion parameters of various types of multimedia resources.
Wherein each reference transformation parameter characterizes: parameters of a class of usage objects for a class of multimedia resources associated with a class of historical traffic vectors, the class of usage objects generating a class of historical conversion.
Firstly, determining a resource type corresponding to a multimedia resource by querying a multimedia resource database, and acquiring an object type corresponding to a use object by querying a use object database.
The multimedia resource database divides the resource types into several types, and in this embodiment of the present application, the resource types are described below by taking the multimedia resource as an advertisement, and referring to fig. 3B, which is a schematic diagram of advertisement types in this embodiment of the present application, each advertisement type and a corresponding advertisement type ID are stored in the resource database, where each advertisement type corresponds to one advertisement type ID, for example, the advertisement type ID corresponding to the advertisement type "network service" is 1, and the advertisement type ID corresponding to the advertisement type "education training" is 3.
The object database is used to divide each object according to interest, which is approximately consistent with the resource type, and the object type of the object in the embodiment of the present application is described below by taking the multimedia resource as an advertisement as an example, referring to fig. 3C, which is a schematic diagram of the object type used in the embodiment of the present application, the usage object database stores usage object types and corresponding object type IDs, wherein each usage object type corresponds to one object type ID, for example, the object type ID corresponding to the usage object type 'education' is 1, and the object type ID corresponding to the usage object type 'travel' is 2.
And then, acquiring the historical operation data of each historical flow carrier, and determining various types of using objects based on the historical operation data of each historical flow carrier, wherein the standard conversion parameters are respectively aimed at various types of multimedia resources.
It should be noted that the same multimedia resource is put under different flow carriers, and the selection of the put is only related to the type of the object for reading the article, but not related to the article itself, so that the abnormal behavior object cannot know which specific flow carriers can display the multimedia resource, cannot know the reference conversion parameters of the multimedia resource, and cannot enable the flow conversion parameters of the multimedia resource to be consistent with the large disk when abnormal behaviors occur, that is, the multimedia resource is put randomly, and the classification of the multimedia resource and the classification of the object to be used can be performed, thereby improving the accuracy of abnormal behavior detection.
Optionally, in the embodiment of the present application, first, when executing S30, it is required to determine various usage objects using each historical traffic bearer, and specifically, taking any historical traffic bearer (hereinafter referred to as a historical traffic bearer a) as an example, a process of obtaining each reference conversion parameter is described as follows:
and obtaining each reference conversion parameter according to the respective historical conversion quantity and the historical click quantity of each multimedia resource based on each type of use object using the historical flow carrier a.
In the embodiment of the application, the following operations are respectively executed for various types of use objects of the use history traffic carrier a:
based on the class of the use objects, the class of the use objects is obtained aiming at the respective historical conversion quantity and the corresponding historical click quantity of various multimedia resources, and the reference conversion parameters of the corresponding class of the multimedia resources are obtained.
It should be noted that, when calculating the reference conversion parameters of a class of usage objects for a corresponding class of multimedia resources, the reference conversion parameters are obtained by calculating the ratio between the historical conversion amount and the corresponding historical click amount, and of course, the reference conversion parameters can also be implemented in other manners, which is not limited in the embodiment of the present application.
Taking i-class use objects as an example, the process of determining the reference conversion parameter in the embodiment of the present application is described below, referring to fig. 3D, which is an example diagram for determining the reference conversion parameter in the embodiment of the present application, assuming that multimedia resources are divided into three types, namely, web service, education training and travel, based on the historical conversion 20 and the historical click 2000 of the i-class use objects for "web service", the reference conversion parameter of the i-class use objects for "web service" is determined to be 1%, based on the historical conversion of the i-class use objects for "education training" is determined to be 10, the historical click 1000, the reference conversion parameter of the i-class use objects for "education training" is determined to be 1%, and based on the historical conversion of the i-class use objects for "travel" is determined to be 2, the historical click 1000, and the reference conversion parameter of the i-class use objects for "travel" is determined to be 0.2%.
In this way, the used objects are classified, and the multimedia resources are classified, so that the reference conversion rate of the used objects is calculated through the historical conversion rate and the historical click rate of the used objects for the corresponding type of multimedia resources, the reference conversion rates of different types of used objects for the various types of multimedia resources can be calculated respectively, and the accuracy of the abnormal detection result of the target flow carrier is improved.
S31: based on the current operation data of the target flow carrier, various use objects are determined, and flow conversion parameters for various multimedia resources are respectively determined.
Wherein each flow conversion parameter characterizes: and generating parameters of the current conversion quantity by using the objects aiming at the multimedia resources related to the target flow carrier.
In the embodiment of the application, the current operation data of the target flow carrier is obtained, various use objects are determined based on the current operation data of the target flow carrier, and the flow conversion parameters of various multimedia resources are respectively aimed at.
For example, referring to fig. 3E, which is an exemplary diagram for determining traffic transformation parameters of various multimedia resources in an embodiment of the present application, it is assumed that, for a target traffic bearer, n types of usage object exist in clicking on each usage object of the multimedia resource: for the target traffic carrier, m multimedia resource types exist in each multimedia resource of clicking multimedia resources in the i1 class, the i2 class and the i3 class: class j1, class j2, class j3, so the class i1 use object has a traffic conversion parameter of cvr for the class j1 multimedia asset, the class i1 use object has a traffic conversion parameter of cvr2 for the class j2 multimedia asset, the class i1 use object has a traffic conversion parameter of cvr3 for the class j3 multimedia asset, the class i2 use object has a traffic conversion parameter of cvr4 for the class j1 multimedia asset, the class i2 use object has a traffic conversion parameter of cvr for the class j2 multimedia asset, the class i2 use object has a traffic conversion parameter of cvr for the class j3 multimedia asset, and since the class i3 use object only uses the target traffic carrier to click on the class j1 multimedia asset, the class i3 use object corresponds to only one traffic conversion parameter, and the class i3 use object has a traffic conversion parameter of cvr for the class j1 multimedia asset.
Optionally, in the embodiment of the present application, a possible implementation manner is provided for executing S31, and in the following description, a process of obtaining each flow conversion parameter in the embodiment of the present application is specifically described, including:
and obtaining a class of use objects according to the current conversion quantity and the current click quantity of the class of use objects for various multimedia resources, and obtaining flow conversion parameters of the class of use objects for the corresponding class of multimedia resources.
In the embodiment of the present application, when executing S31, a class of usage objects needs to be determined, and the process of obtaining each flow conversion parameter is specifically described below by taking any class of usage objects (hereinafter referred to as class i usage objects) and any class of multimedia resources (hereinafter referred to as class j multimedia resources) as examples, where each class of usage objects is respectively aimed at each class of multimedia resources:
and respectively obtaining the class i use object and the flow conversion parameter of the class j multimedia resource according to the current conversion quantity and the current click quantity of the class j multimedia resource based on the class i use object.
It should be noted that, when calculating the flow conversion parameter of the i-class usage object for the j-class multimedia resource, the flow conversion parameter is obtained by calculating the ratio between the current conversion amount and the corresponding historical click amount, and of course, the flow conversion parameter can also be implemented in other manners, which is not limited in the embodiment of the present application.
Taking i-class use objects as an example, the process of determining flow conversion parameters in the embodiment of the present application is described below, referring to fig. 3F, which is an example diagram of determining flow conversion parameters in the embodiment of the present application, assuming that multimedia resources are divided into three classes, namely education training, food and skin care color cosmetics, based on that the current conversion amount of the i-class use objects for the "education training" is 10 and the current click amount is 1000, the flow conversion parameters of the i-class use objects for the "education training" are determined to be 1%, based on that the current conversion amount of the i-class use objects for the "food" is 50 and the current click amount is 1000, the flow conversion parameters of the i-class use objects for the "food" are determined to be 5%, and based on that the current conversion amount of the i-class use objects for the "skin care color cosmetics" is 10 and the current click amount of the i-class use objects for the "skin care color cosmetics" is 2000, the flow conversion parameters of the i-class use objects for the "skin care color cosmetics" is determined to be 0.5%.
In this way, the method classifies the used objects and classifies the multimedia resources, so that the flow conversion parameters of the used objects are calculated through the current click rate and the current click rate of the used objects for the corresponding type of multimedia resources, and the flow conversion parameters of the used objects in different types for the various types of multimedia resources can be calculated respectively for the subsequent calculation of the conversion anomaly degree of the target flow carrier.
It should be noted that, in the embodiment of the present application, the target flow carrier may be one of the historical flow carriers, so when calculating each flow conversion parameter of the target flow carrier, a corresponding historical flow carrier may be determined from each historical flow carrier, and each reference conversion parameter corresponding to the determined historical flow carrier is used as each flow conversion parameter of the target flow carrier.
S32: the degree of conversion anomaly of the target flow carrier is determined based on the degree of overall deviation between each reference conversion parameter and each flow conversion parameter.
In the embodiment of the application, the total deviation degree between each reference conversion parameter and each flow conversion parameter is determined based on each reference conversion parameter and each flow conversion parameter, and the conversion anomaly degree of the target flow carrier is determined based on the determined total deviation degree.
Optionally, in the embodiment of the present application, a possible implementation manner is provided for executing S32, and referring to fig. 3G, a schematic flow chart of determining the degree of conversion anomaly in the embodiment of the present application is shown, and in the following description, with reference to fig. 3G, the process of determining the degree of conversion anomaly in the embodiment of the present application is described as follows:
S321: for various types of use objects, the following operations are respectively executed: and determining a class of use objects according to the respective flow conversion parameters of the class of use objects for various types of multimedia resources and the associated reference conversion parameters, and determining the sub-anomaly degree of the class of use objects for the corresponding class of multimedia resources.
In the embodiment of the application, the following operations are respectively executed for various use objects: and determining the sub-anomaly degree of the class of the use object aiming at the corresponding class of the multimedia resources based on the respective flow conversion parameters of the class of the use object aiming at the various types of the multimedia resources and the respective reference conversion parameters related to the various types of the multimedia resources.
Therefore, in the embodiment of the application, each class of the usage object corresponds to one sub-anomaly degree aiming at one class of the multimedia resource.
For example, referring to fig. 3H, in the embodiment of the present application, a first example graph of the degree of sub-anomaly is determined, where each usage object may be classified into two categories, namely education and travel, each multimedia resource may be classified into two categories, namely travel and web service, so that, based on the usage object of the "education" category, the traffic conversion parameter b1 for the multimedia resource of the "travel" category, and the associated reference conversion parameters c1 and c2, the usage object of the "education" category is determined, the degree of sub-anomaly d1 for the multimedia resource of the "travel" category, the traffic conversion parameter b2 for the multimedia resource of the "web service" category, and the associated reference conversion parameters c3 and c4, the usage object of the "education" category is determined, the degree of sub-anomaly d2 for the multimedia resource of the "web service" category, the usage object based on the "travel" category, the traffic conversion parameter b3 for the multimedia resource of the "travel" category, and the associated reference conversion parameters c5 for the multimedia resource of the "travel" category, and the associated reference conversion parameters c4 for the "travel" category, and the associated reference conversion parameters c3 and c4 for the multimedia resource of the "travel" category, and the associated reference conversion parameters c4 for the "category.
Optionally, in the embodiment of the present application, in order to determine a class of usage objects, a possible implementation manner is provided for the sub-anomaly degree of the corresponding class of multimedia resources, and specifically, taking the class I usage objects and the class j multimedia resources as examples, a process of obtaining the sub-anomaly degree is described as follows, referring to fig. 3I, which is a schematic flow diagram of determining the sub-anomaly degree in the embodiment of the present application, and in the following, a process of determining the sub-anomaly degree in the embodiment of the present application is described in detail with reference to fig. 3I:
s3211: and obtaining a parameter average value among all the reference conversion parameters associated with the j-class multimedia resources, and obtaining a parameter standard deviation among all the reference conversion parameters associated with the j-class multimedia resources.
In the embodiment of the application, the parameter average value among the reference conversion parameters is obtained based on the reference conversion parameters associated with the j-class multimedia resources, and the parameter standard deviation among the reference conversion parameters associated with the j-class multimedia resources is obtained based on the reference conversion parameters and the parameter average value.
Wherein, when obtaining the parameter mean value, the method can be realized by the following steps: firstly, adding all reference conversion parameters related to j types of multimedia resources to obtain a parameter addition result, and then calculating the ratio between the parameter addition result and the carrier number of each historical flow carrier to obtain a parameter average value among all the reference conversion parameters.
Specifically, in the embodiment of the present application, the parameter average value may be expressed as:
wherein K is the number of each historical flow carrier, i is the i-th class of use object, j is the j-th class of multimedia resource, mu ij Is the parameter mean value.
When the parameter standard deviation is obtained, the following manner can be adopted: firstly, calculating the variance among the reference conversion parameters, and calculating the arithmetic square root of the variance to obtain the parameter standard deviation among the reference conversion parameters associated with the j-type multimedia resources.
Specifically, in the embodiment of the present application, the parameter standard deviation may be expressed as:
wherein K is the total number of each historical flow carrier, i is an object type ID, represents an ith class of use object, j is a resource type ID, represents a jth class of multimedia resource, and mu ij As the mean value of the parameters,reference transformation parameters for the j-th class of multimedia resources for the i-th class of usage objects of the usage history traffic carrier k.
S3212: and determining the sub-anomaly of the i-class using object for the j-class multimedia resource based on the flow conversion parameter, the parameter mean value and the parameter standard deviation of the j-class multimedia resource.
In the embodiment of the application, after the parameter mean value and the parameter standard deviation are obtained, the sub-anomaly degree of one class of using objects for the j classes of multimedia resources is determined based on the flow conversion parameter, the parameter mean value and the parameter standard deviation corresponding to the j classes of multimedia resources, so that when the target flow carrier meets normal distribution, the sub-anomaly degree of one class of using objects for the class of multimedia resources can be calculated based on the flow conversion parameter, the parameter mean value and the parameter standard deviation, unsupervised detection is realized, and the abnormal behavior detection efficiency is improved.
Optionally, in the embodiment of the present application, the multiple exceeding the reference transformation parameter may be taken as a sub-anomaly degree of a class of usage objects for a class of multimedia resources, and the method for determining the sub-anomaly degree in the embodiment of the present application is described below by taking the above J classes of multimedia resources as examples, and referring to fig. 3J, a flowchart of a method for determining the sub-anomaly degree in the embodiment of the present application is shown, and specifically includes:
s3212-1: and obtaining the parameter difference value of the j-class multimedia resource based on the flow conversion parameter and the parameter average value of the j-class multimedia resource.
In the embodiment of the application, the flow conversion parameters of the i-class use object aiming at the j-class multimedia resource are subtracted from the parameter mean value, so as to obtain the parameter difference value corresponding to the i-class use object aiming at the j-class multimedia resource.
S3212-2: and taking the ratio of the parameter difference value to the parameter standard deviation as an i-class using object, and aiming at the sub-anomaly degree of j-class multimedia resources.
In the embodiment of the application, the ratio between the parameter difference value and the parameter standard deviation is calculated, and the calculated ratio is used as an i-class use object to aim at the sub-anomaly degree of j-class multimedia resources.
Wherein, the sub-anomaly of the i-class usage object for the j-class multimedia resource can be expressed as:
Wherein mu ij As parameter mean value, sigma ij As the standard deviation of the parameters,flow transformation parameters for class i usage object for class j multimedia resources for class i usage object using target flow bearer k,/for class j multimedia resources>Sub-anomalies of the object for class i for class j multimedia resources are used for class i.
In this way, in the embodiment of the application, based on the principle of a small probability event, when the deviation degree between the flow conversion parameter and the reference conversion parameter is larger, the abnormality degree of the flow conversion parameter is determined to be higher, therefore, the parameter mean value is taken as the reference, the multiple exceeding the reference is taken as the sub-abnormality degree, the abnormal behavior can be detected through the sub-abnormality degree without a malicious sample, and the labor cost is reduced. In addition, in the embodiment of the application, the multiple exceeding the parameter mean value is taken as the sub-abnormality degree, so that the dimension can be eliminated.
S322: based on the obtained degree of abnormality of each sub, the degree of abnormality of the conversion of the target flow carrier is determined.
In the embodiment of the application, after obtaining the abnormal degrees of all the sub-abnormal degrees related to the target flow carrier, determining the conversion abnormal degree corresponding to the target flow carrier based on the obtained abnormal degrees of all the sub-abnormal degrees.
Alternatively, in the embodiment of the present application, two possible embodiments are provided for determining the conversion anomaly degree of the target flow carrier, and two embodiments for determining the conversion anomaly degree of the target flow carrier in the embodiment of the present application are described below.
First embodiment:
the method specifically comprises the following steps: and adding the obtained sub-abnormal degrees to obtain an addition result among the sub-abnormal degrees, and taking the obtained addition result as the conversion abnormal degree of the target flow carrier.
For example: assuming that the obtained degree of abnormality of each sub is g1, g2, g3, g4, the degree of abnormality of each sub is added to obtain the result of addition between the degree of abnormality of each sub is g1+g2+g3+g4, and g1+g2+g3+g4 is taken as the conversion degree of abnormality of the target flow carrier.
Second embodiment:
referring to fig. 3K, a flow chart of determining the degree of conversion anomaly in an embodiment of the present application specifically includes:
s3221: and respectively taking the ratio of the click quantity of various types of using objects aiming at various types of multimedia resources and the sum of the click quantity of the target flow carrier as the abnormality degree weight of the corresponding type of using objects aiming at the corresponding type of multimedia resources.
In the embodiment of the application, firstly, various use objects using the target flow carrier are counted, the sum of the click volumes of the target flow carrier is obtained aiming at the sum of the click volumes of various multimedia resources, and then, the following operations are respectively executed aiming at the various use objects:
And respectively taking the ratio of the click rate of the class of the using object aiming at various multimedia resources and the sum of the click rate as the abnormality degree weight of the corresponding class of the multimedia resources.
In the embodiment of the present application, the abnormality degree weight of the multimedia resource may be expressed as:
wherein, the liquid crystal display device comprises a liquid crystal display device,the i-class usage object using the target traffic carrier k is characterized, and the total_clk is used for indicating the click rate sum of the j-class multimedia resources.
S3222: and determining the conversion anomaly degree of the target flow carrier based on the obtained anomaly degree of each sub-and the anomaly degree weight corresponding to each sub-anomaly degree.
In the embodiment of the application, the obtained sub-abnormal degrees are multiplied by the corresponding abnormal degree weights respectively to obtain multiplication results, the obtained multiplication results are added to obtain addition results, and after the addition results corresponding to the using objects are obtained, the addition results are added to obtain the converted abnormal degree of the target flow carrier.
Wherein, the degree of conversion anomaly of the target flow carrier can be expressed as:
in this way, by using the click ratio as the weight, the specific gravity of the higher click ratio child anomaly in the conversion anomaly can be increased, and the detection accuracy can be further improved.
In the embodiment of the present application, the conversion anomaly degree of the target flow carrier may be determined based on the box diagram, each reference conversion parameter and each flow conversion parameter, which is not limited in the embodiment of the present application.
S33: and determining an abnormal behavior detection result of the target flow carrier based on the conversion abnormality degree.
In the embodiment of the application, after the conversion anomaly degree corresponding to the target flow carrier is obtained, the abnormal behavior detection result of the target flow carrier is determined based on the conversion anomaly degree.
Optionally, in the embodiment of the present application, two possible implementations are provided for determining the abnormal behavior detection result of the target flow carrier, and in the embodiment of the present application, a process for determining the target flow carrier is described below, which specifically includes:
the first way.
The executing S33 specifically includes:
when the conversion abnormality degree is determined to reach a preset abnormality degree threshold value, determining that an abnormality exists in the abnormal behavior detection result of the target flow carrier.
In the embodiment of the application, whether the abnormal transformation degree reaches the preset abnormal degree threshold value is judged, if the transformation abnormal degree reaches the preset abnormal degree threshold value, the abnormal behavior detection result of the target flow carrier is determined to be abnormal, and if the transformation abnormal degree does not reach the preset abnormal degree threshold value, the abnormal behavior detection result of the target flow carrier is determined to be abnormal, so that the abnormal behavior detection of the target flow carrier can be realized, and the detection accuracy is improved.
The second way.
When the abnormal detection result of the target flow carrier is determined by the second mode in the embodiment of the application, flexible judgment can be performed by combining different abnormal dimensions, for example, the abnormal detection result of the target flow carrier can be determined together by the registration proportion and the conversion abnormality degree. The process of determining the abnormal behavior detection result of the target flow carrier in the embodiment of the present application is described below by taking the abnormal dimension as the registration proportion and the conversion anomaly degree as an example, referring to fig. 3L, which is a schematic flow chart of determining the abnormal behavior detection result in the embodiment of the present application, and referring to fig. 3L, the process of determining the abnormal behavior detection result in the embodiment of the present application is described below:
s331: and determining the number of the objects corresponding to the use objects with the registration time later than a preset registration time threshold based on the registration time corresponding to each use object associated with the target flow carrier.
In the embodiment of the application, the registration time corresponding to each of the using objects of the multimedia resources is determined by clicking the using target traffic carrier, and the number of the objects corresponding to the using objects with the registration time later than the preset registration time threshold is determined from the using objects based on the determined registration time.
S332: based on the number of objects and the total number of objects of each use object, a registration ratio corresponding to each use object is determined.
In the embodiment of the application, the total number of objects corresponding to each object used for clicking each multimedia resource by using the target flow carrier is determined, the ratio between the number of objects and the total number of objects is calculated, and the calculated ratio is used as the registration ratio corresponding to each object used.
S333: and when the registration proportion is determined to be larger than a preset proportion threshold value and the conversion anomaly degree is determined to be larger than an anomaly degree threshold value, determining that the anomaly behavior detection result of the target flow carrier is abnormal.
In the embodiment of the application, whether the registration proportion is larger than a preset proportion threshold value is judged, meanwhile, whether the conversion abnormal degree is larger than an abnormal degree threshold value is judged, when the registration proportion is larger than the proportion threshold value and the conversion abnormal degree is determined to be larger than the abnormal degree threshold value, the abnormal behavior detection result of the target flow carrier is determined to be abnormal, and if the registration proportion is determined not to be larger than the proportion threshold value or the conversion abnormal degree is determined not to be larger than the abnormal degree threshold value, the abnormal behavior detection result of the target flow carrier is determined to be abnormal. Therefore, the degree of abnormality is converted, the flexibility judgment is carried out by combining other abnormal dimensions, the combination is flexible, and the detection accuracy and coverage rate can be considered.
For example, the degree of conversion abnormality is 0.7 minutes and the registration ratio of the use object is 30%, the abnormal behavior detection result of the target flow carrier is determined to be abnormal, and for example, the degree of conversion abnormality is 0.9 minutes and the registration ratio of the use object is 20%, the abnormal behavior detection result of the target flow carrier is determined to be abnormal.
The following describes a process of determining the abnormal behavior detection result in the embodiment of the present application by using a specific example, referring to fig. 3M, which is an exemplary diagram of determining the abnormal behavior detection result in the embodiment of the present application, assuming that each usage object using the target traffic bearer is: s1, s2, s3 and s4, the registration time corresponding to the use object s1 is 9 months 23 days, the registration time corresponding to the use object s2 is 9 months 25 days, the registration time corresponding to the use object s3 is 9 months 21 days, the registration time corresponding to the use object s4 is 9 months 27 days, the registration time threshold is assumed to be 9 months 24 days, that is, when the registration time is later than 9 months 24 days, the use objects are determined to be new registration objects, that is, the use object s2 and the use object s4 are the use objects later than the preset registration time threshold, the number of objects is 2, then, based on the number of objects 2 and the total number of objects 4, the registration ratio corresponding to each use object is determined to be 50%, the conversion anomaly degree is assumed to be 0.9, the anomaly degree threshold is greater than 0.8, and the registration ratio 50% is greater than the preset ratio threshold 20%, so that the anomaly behavior detection result of the target flow carrier is determined to be abnormal.
In the embodiment of the application, the multimedia resources are classified, the used objects are classified, and whether the target flow carrier is abnormal or not is judged, so that the accuracy and coverage rate of abnormal behavior detection can be improved.
Based on the foregoing embodiments, referring to fig. 4, another flowchart of a method for detecting abnormal behavior in an embodiment of the present application specifically includes:
s400: and counting each resource type of each historical flow carrier and the reference conversion parameters of each class of use object aiming at various multimedia resources respectively.
S410: based on each baseline conversion parameter, a conversion mean and a conversion standard deviation for each historical flow carrier are calculated.
S420: based on the principle of the small probability event, the conversion anomaly degree of the target flow carrier is calculated.
S430: and judging whether the abnormal behavior of the target flow carrier occurs or not based on the conversion abnormality degree.
Based on the foregoing embodiments, a specific example is taken below to describe a procedure of detecting abnormal behavior in the embodiment of the present application, and referring to fig. 5, an exemplary diagram of detecting abnormal behavior in the embodiment of the present application specifically includes:
Firstly, determining various types of use objects based on historical operation data of various historical flow carriers, respectively aiming at reference conversion parameters of various multimedia resources, obtaining reference conversion parameters p1, p2, p3, p4, p5 and p6, and then determining various types of use objects based on current operation data of a target flow carrier, wherein the flow conversion parameters respectively aiming at various multimedia resources are q1 and q2.
And calculating the total deviation degree between each reference conversion parameter and each flow conversion parameter to obtain the conversion anomaly degree of the target flow carrier of 0.9.
If the conversion anomaly degree is determined to be greater than the anomaly degree threshold value of 0.8, determining that the target flow carrier is abnormal, wherein the specific abnormal behavior is to induce the object to be used to click the advertisement at the article comment, so that the conversion anomaly degree of the target flow carrier is far higher than that of a large disc.
Based on the same inventive concept, the embodiment of the application also provides an abnormal behavior detection device. As shown in fig. 6, a schematic structural diagram of an abnormal behavior detection apparatus according to an embodiment of the present application may include:
a first determining module 600, configured to determine, based on historical operation data of each historical traffic carrier, each type of usage object, and reference conversion parameters for each type of multimedia resource respectively; wherein each reference transformation parameter characterizes: parameters of a type of history conversion quantity generated by a type of usage object aiming at a type of multimedia resources associated with a history flow carrier;
A second determining module 610, configured to determine, based on current operation data of the target traffic bearer, traffic conversion parameters of each type of usage object for each type of multimedia resource; wherein each flow conversion parameter characterizes: parameters of current conversion quantity generated by a class of usage objects aiming at a class of multimedia resources associated with a target flow carrier;
a processing module 620 for determining a conversion anomaly of the target flow carrier based on the respective reference conversion parameters and the overall degree of deviation between the respective flow conversion parameters;
the detection module 630 is configured to determine an abnormal behavior detection result of the target flow carrier based on the conversion anomaly degree.
Optionally, the processing module 620 is further configured to:
for various types of use objects, the following operations are respectively executed: determining a class of use objects according to respective flow conversion parameters of the class of use objects for various types of multimedia resources and related reference conversion parameters, and determining the sub-anomaly degree of the class of use objects for the corresponding class of multimedia resources;
based on the obtained degree of abnormality of each sub, the degree of abnormality of the conversion of the target flow carrier is determined.
Optionally, when determining a class of usage objects according to the class of usage objects, the respective traffic conversion parameters for each class of multimedia resources, and the associated reference conversion parameters, and aiming at the sub-abnormality degree of the corresponding class of multimedia resources, the processing module 620 is further configured to:
For various multimedia resources, the following operations are respectively executed:
obtaining a parameter average value among all reference conversion parameters associated with a type of multimedia resources, and obtaining a parameter standard deviation among all the reference conversion parameters associated with the type of multimedia resources;
and determining the sub-anomaly of the class of the using objects for the class of the multimedia resources based on the flow conversion parameters, the parameter mean values and the parameter standard deviation of the class of the multimedia resources.
Optionally, when determining the sub-abnormality degree of the class of usage objects for the class of multimedia resources based on the traffic conversion parameter, the parameter mean value and the parameter standard deviation of the class of multimedia resources, the processing module 620 is further configured to:
obtaining a parameter difference value of the type of multimedia resources based on the flow conversion parameters and the parameter average value of the type of multimedia resources;
and taking the ratio of the parameter difference value to the parameter standard deviation as a class of using objects, and aiming at the sub-anomaly degree of a class of multimedia resources.
Optionally, when determining the conversion anomaly degree of the target flow carrier based on the obtained respective sub anomaly degree, the processing module 620 is further configured to:
respectively taking the ratio of the click quantity of various using objects aiming at various multimedia resources and the sum of the click quantity of the target flow carrier as the abnormality degree weight of the corresponding using objects aiming at the corresponding multimedia resources;
And determining the conversion anomaly degree of the target flow carrier based on the obtained anomaly degree of each sub-and the anomaly degree weight corresponding to each sub-anomaly degree.
Optionally, the historical operating data includes: each historical conversion and each historical click, the first determination module 600 is further configured to:
for each historical traffic carrier, the following operations are performed respectively:
based on various using objects using a historical flow carrier, each reference conversion parameter is obtained according to the respective historical conversion quantity and the historical click quantity of various multimedia resources.
Optionally, the current operation data includes: each current conversion and each current click through, the second determination module 610 is further configured to:
for various types of use objects, the following operations are respectively executed:
and obtaining a class of use objects according to the current conversion quantity and the current click quantity of the class of use objects for various multimedia resources, and obtaining flow conversion parameters of the class of use objects for the corresponding class of multimedia resources.
Optionally, the detection module 630 is further configured to:
when the conversion abnormality degree is determined to reach a preset abnormality degree threshold value, determining that an abnormality exists in the abnormal behavior detection result of the target flow carrier.
Optionally, the detection module 630 is further configured to:
Determining the number of objects corresponding to the use objects with the registration time later than a preset registration time threshold based on the registration time corresponding to each use object associated with the target flow carrier;
determining a registration proportion corresponding to each use object based on the number of objects and the total number of objects of each use object;
and when the registration proportion is determined to be larger than a preset proportion threshold value and the conversion anomaly degree is determined to be larger than an anomaly degree threshold value, determining that the anomaly behavior detection result of the target flow carrier is abnormal.
Those skilled in the art will appreciate that the various aspects of the application may be implemented as a system, method, or program product. Accordingly, aspects of the application may be embodied in the following forms, namely: an entirely hardware embodiment, an entirely software embodiment (including firmware, micro-code, etc.) or an embodiment combining hardware and software aspects may be referred to herein as a "circuit," module "or" system.
In some possible embodiments, the abnormal behavior detection apparatus according to the present application may include at least a processor and a memory. Wherein the memory stores program code that, when executed by the processor, causes the processor to perform the steps in the abnormal behavior detection method according to various exemplary embodiments of the present application described in this specification. For example, the processor may perform the steps as shown in fig. 3A.
The embodiment of the application also provides electronic equipment based on the same conception as the embodiment of the method. In one embodiment, the electronic device may be a server, such as the anomaly detection server 220 shown in fig. 2A, and in this embodiment, the electronic device may be configured as shown in fig. 7, including a memory 701, a communication module 703, and one or more processors 702.
Memory 701 for storing a computer program for execution by processor 702. The memory 701 may mainly include a storage program area and a storage data area, wherein the storage program area may store an operating system, a program required for running an instant communication function, and the like; the storage data area can store various instant messaging information, operation instruction sets and the like.
The memory 701 may be a volatile memory (RAM), such as a random-access memory (RAM); the memory 701 may also be a nonvolatile memory (non-volatile memory), such as a read-only memory (rom), a flash memory (flash memory), a hard disk (HDD) or a Solid State Drive (SSD); or memory 701 is any other medium that can be used to carry or store desired program code in the form of instructions or data structures and that can be accessed by a computer, but is not limited to such. Memory 701 may be a combination of the above.
The processor 702 may include one or more central processing units (central processing unit, CPU) or digital processing units, or the like. A processor 702 for implementing the above-described abnormal behavior detection method when calling the computer program stored in the memory 701.
The communication module 703 is used for communicating with a terminal device and other servers.
The specific connection medium between the memory 701, the communication module 703 and the processor 702 is not limited in the embodiment of the present application. The embodiment of the present application is shown in fig. 7, where the memory 701 and the processor 702 are connected by a bus 704, where the bus 704 is shown in bold in fig. 7, and the connection between other components is merely illustrative, and not limiting. The bus 704 may be divided into an address bus, a data bus, a control bus, and the like. For ease of description, only one thick line is depicted in fig. 7, but only one bus or one type of bus is not depicted.
The memory 701 stores a computer storage medium in which computer executable instructions for implementing the abnormal behavior detection method of the embodiment of the present application are stored. The processor 702 is configured to perform the abnormal behavior detection method described above, as shown in fig. 3A.
In some possible embodiments, aspects of the abnormal behavior detection method provided by the present application may also be implemented in the form of a program product comprising program code for causing a computer device to perform the steps of the abnormal behavior detection method according to various exemplary embodiments of the present application as described herein above when the program product is run on the computer device, e.g., the computer device may perform the steps as shown in fig. 3A.
The program product may employ any combination of one or more readable media. The readable medium may be a readable signal medium or a readable storage medium. The readable storage medium can be, for example, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or a combination of any of the foregoing. More specific examples (a non-exhaustive list) of the readable storage medium would include the following: an electrical connection having one or more wires, a portable disk, a hard disk, random Access Memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.
The program product of embodiments of the present application may employ a portable compact disc read only memory (CD-ROM) and include program code and may run on a computing device. However, the program product of the present application is not limited thereto, and in this document, a readable storage medium may be any tangible medium that can contain, or store a program for use by or in connection with a command execution system, apparatus, or device.
The readable signal medium may include a data signal propagated in baseband or as part of a carrier wave with readable program code embodied therein. Such a propagated data signal may take any of a variety of forms, including, but not limited to, electro-magnetic, optical, or any suitable combination of the foregoing. A readable signal medium may also be any readable medium that is not a readable storage medium and that can communicate, propagate, or transport a program for use by or in connection with a command execution system, apparatus, or device.
Program code embodied on a readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wireline, optical fiber cable, RF, etc., or any suitable combination of the foregoing.
Program code for carrying out operations of the present application may be written in any combination of one or more programming languages, including an object oriented programming language such as Java, C++ or the like and conventional procedural programming languages, such as the "C" programming language or similar programming languages. The program code may execute entirely on the user's computing device, partly on the user's equipment, as a stand-alone software package, partly on the user's computing device, partly on a remote computing device, or entirely on the remote computing device or server. In the case of remote computing devices, the remote computing device may be connected to the user computing device through any kind of network, including a Local Area Network (LAN) or a Wide Area Network (WAN), or may be connected to an external computing device (e.g., connected via the Internet using an Internet service provider).
It should be noted that although several units or sub-units of the apparatus are mentioned in the above detailed description, such a division is merely exemplary and not mandatory. Indeed, the features and functions of two or more of the elements described above may be embodied in one element in accordance with embodiments of the present application. Conversely, the features and functions of one unit described above may be further divided into a plurality of units to be embodied.
Furthermore, although the operations of the methods of the present application are depicted in the drawings in a particular order, this is not required to either imply that the operations must be performed in that particular order or that all of the illustrated operations be performed to achieve desirable results. Additionally or alternatively, certain steps may be omitted, multiple steps combined into one step to perform, and/or one step decomposed into multiple steps to perform.
It will be appreciated by those skilled in the art that embodiments of the present application may be provided as a method, system, or computer program product. Accordingly, the present application may take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment combining software and hardware aspects. Furthermore, the present application may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, and the like) having computer-usable program code embodied therein.
While preferred embodiments of the present application have been described, additional variations and modifications in those embodiments may occur to those skilled in the art once they learn of the basic inventive concepts. It is therefore intended that the following claims be interpreted as including the preferred embodiments and all such alterations and modifications as fall within the scope of the application.
It will be apparent to those skilled in the art that various modifications and variations can be made to the present application without departing from the spirit or scope of the application. Thus, it is intended that the present application also include such modifications and alterations insofar as they come within the scope of the appended claims or the equivalents thereof.

Claims (15)

1. An abnormal behavior detection method, comprising:
determining various use objects based on the historical operation data of each historical flow carrier, and respectively aiming at the reference conversion parameters of various multimedia resources; wherein each reference transformation parameter characterizes: parameters of a type of history conversion quantity generated by a type of usage object aiming at a type of multimedia resources associated with a history flow carrier;
determining various types of use objects based on the current operation data of the target flow carrier, and respectively aiming at flow conversion parameters of various types of multimedia resources; wherein each flow conversion parameter characterizes: parameters of current conversion quantity generated by a class of usage objects aiming at a class of multimedia resources associated with the target flow carrier;
determining a conversion anomaly of the target flow carrier based on the overall degree of deviation between each reference conversion parameter and each flow conversion parameter;
And determining an abnormal behavior detection result of the target flow carrier based on the conversion abnormality.
2. The method of claim 1, wherein said determining the degree of conversion anomaly of the target flow carrier based on the degree of overall deviation between each reference conversion parameter and each flow conversion parameter comprises:
for the various types of use objects, the following operations are respectively executed: determining the sub-degree of abnormality of a class of using objects aiming at the corresponding class of multimedia resources based on the respective flow conversion parameters of the class of using objects aiming at the various types of multimedia resources and the associated reference conversion parameters;
based on the obtained individual child anomalies, a transformation anomaly of the target flow carrier is determined.
3. The method of claim 2, wherein the determining the class of usage objects for the sub-anomalies of the corresponding class of multimedia resources based on the class of usage objects, the respective traffic transformation parameters for the class of multimedia resources, and the associated respective reference transformation parameters, respectively, comprises:
for the various multimedia resources, the following operations are respectively executed:
obtaining a parameter average value among all reference conversion parameters associated with a type of multimedia resources, and obtaining a parameter standard deviation among all the reference conversion parameters associated with the type of multimedia resources;
And determining the sub-anomaly of the class of using objects for the class of multimedia resources based on the flow conversion parameters, the parameter mean value and the parameter standard deviation of the class of multimedia resources.
4. The method of claim 3, wherein the determining a sub-anomaly of a class of usage objects for the class of multimedia resources based on the traffic conversion parameters, the parameter means, and the parameter standard deviation of the class of multimedia resources comprises:
obtaining a parameter difference value of the type of multimedia resources based on the flow conversion parameters of the type of multimedia resources and the parameter average value;
and taking the ratio between the parameter difference value and the parameter standard deviation as a class of using objects, and aiming at the sub-anomaly degree of the class of multimedia resources.
5. The method of claim 3, wherein said determining the conversion anomaly of the target flow carrier based on the obtained individual sub-anomalies comprises:
respectively taking the ratio of the click quantity of the various using objects aiming at the various multimedia resources and the sum of the click quantity of the target flow carrier as the abnormality degree weight of the corresponding using objects aiming at the corresponding multimedia resources;
And determining the conversion anomaly degree of the target flow carrier based on the obtained anomaly degree of each sub-and the anomaly degree weight corresponding to each sub-anomaly degree.
6. The method of claim 1, wherein the historical operating data comprises: each historical conversion amount and each historical click amount, determining various usage objects based on the historical operation data of each historical flow carrier, and respectively aiming at the reference conversion parameters of various multimedia resources, wherein the method comprises the following steps:
for each historical traffic carrier, the following operations are performed respectively:
based on various using objects using a historical flow carrier, each reference conversion parameter is obtained according to the respective historical conversion quantity and the historical click quantity of various multimedia resources.
7. The method of claim 1, wherein the current operational data comprises: determining the various usage objects based on the current operation data of the target traffic carrier according to the current conversion amounts and the current click amounts, and respectively aiming at traffic conversion parameters of the various multimedia resources, wherein the traffic conversion parameters comprise:
for various types of use objects, the following operations are respectively executed:
and obtaining flow conversion parameters of the class of the use objects aiming at the corresponding class of the multimedia resources based on the current conversion quantity and the current click quantity of the class of the use objects aiming at the various classes of the multimedia resources.
8. The method of any one of claims 1-7, wherein determining abnormal behavior detection results for the target flow carrier based on the conversion anomalies comprises:
and when the conversion anomaly degree reaches a preset anomaly degree threshold value, determining that the anomaly behavior detection result of the target flow carrier is abnormal.
9. The method of any one of claims 1-7, wherein determining abnormal behavior detection results for the target flow carrier based on the conversion anomalies comprises:
determining the number of objects corresponding to the use objects with the registration time later than a preset registration time threshold based on the registration time corresponding to each use object associated with the target flow carrier;
determining a registration proportion corresponding to each use object based on the number of the objects and the total number of the objects of each use object;
and when the registration proportion is determined to be larger than a preset proportion threshold value and the conversion anomaly degree is determined to be larger than an anomaly degree threshold value, determining that the anomaly behavior detection result of the target flow carrier is abnormal.
10. An abnormal behavior detection apparatus, comprising:
The first determining module is used for determining various types of using objects based on the historical operation data of each historical flow carrier and respectively aiming at the reference conversion parameters of various types of multimedia resources; wherein each reference transformation parameter characterizes: parameters of a type of history conversion quantity generated by a type of usage object aiming at a type of multimedia resources associated with a history flow carrier;
the second determining module is used for determining various types of using objects based on the current operation data of the target flow carrier, and the flow conversion parameters of various types of multimedia resources are respectively aimed at; wherein each flow conversion parameter characterizes: parameters of current conversion quantity generated by a class of usage objects aiming at a class of multimedia resources associated with the target flow carrier;
a processing module for determining a conversion anomaly of the target flow carrier based on the overall degree of deviation between each reference conversion parameter and each flow conversion parameter;
and the detection module is used for determining an abnormal behavior detection result of the target flow carrier based on the conversion abnormality degree.
11. The apparatus of claim 10, wherein the processing module is further to:
for the various types of use objects, the following operations are respectively executed: determining the sub-degree of abnormality of a class of using objects aiming at the corresponding class of multimedia resources based on the respective flow conversion parameters of the class of using objects aiming at the various types of multimedia resources and the associated reference conversion parameters;
Based on the obtained individual child anomalies, a transformation anomaly of the target flow carrier is determined.
12. The apparatus of claim 11, wherein the processing module is further configured to, when determining the class of usage objects for the sub-anomalies of the corresponding class of multimedia resources based on the class of usage objects, the respective traffic transformation parameters for the class of multimedia resources, and the associated respective reference transformation parameters, respectively:
for the various multimedia resources, the following operations are respectively executed:
obtaining a parameter average value among all reference conversion parameters associated with a type of multimedia resources, and obtaining a parameter standard deviation among all the reference conversion parameters associated with the type of multimedia resources;
and determining the sub-anomaly of the class of using objects for the class of multimedia resources based on the flow conversion parameters, the parameter mean value and the parameter standard deviation of the class of multimedia resources.
13. An electronic device comprising a processor and a memory, wherein the memory stores program code that, when executed by the processor, causes the processor to perform the steps of the method of any of claims 1-9.
14. A computer readable storage medium, characterized in that it comprises a program code for causing an electronic device to perform the steps of the method according to any of claims 1-9, when said program code is run on the electronic device.
15. A computer program product comprising computer instructions stored in a computer readable storage medium; when the computer instructions are read from the computer-readable storage medium by a processor of an electronic device, the processor executes the computer instructions, causing the electronic device to perform the steps of the method of any one of claims 1-9.
CN202210190446.XA 2022-02-28 2022-02-28 Abnormal behavior detection method and device, electronic equipment and storage medium Pending CN116720147A (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN202210190446.XA CN116720147A (en) 2022-02-28 2022-02-28 Abnormal behavior detection method and device, electronic equipment and storage medium

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN202210190446.XA CN116720147A (en) 2022-02-28 2022-02-28 Abnormal behavior detection method and device, electronic equipment and storage medium

Publications (1)

Publication Number Publication Date
CN116720147A true CN116720147A (en) 2023-09-08

Family

ID=87868501

Family Applications (1)

Application Number Title Priority Date Filing Date
CN202210190446.XA Pending CN116720147A (en) 2022-02-28 2022-02-28 Abnormal behavior detection method and device, electronic equipment and storage medium

Country Status (1)

Country Link
CN (1) CN116720147A (en)

Similar Documents

Publication Publication Date Title
US7937336B1 (en) Predicting geographic location associated with network address
US8732015B1 (en) Social media pricing engine
CN102737334B (en) Micro-segment definition system
CN112231570B (en) Recommendation system support attack detection method, device, equipment and storage medium
JP2017054514A (en) Network-oriented product rollout in online social networks
CN111641629B (en) Abnormal behavior detection method, device, equipment and storage medium
CN110991789B (en) Method and device for determining confidence interval, storage medium and electronic device
CN111008335B (en) Information processing method, device, equipment and storage medium
US20120137005A1 (en) Semantic- and Preference-Based Planning of Cloud Service Templates
CN115511501A (en) Data processing method, computer equipment and readable storage medium
TW201310986A (en) Virtual advertising platform
CN111738770A (en) Advertisement abnormal flow detection method and device
CN110798467A (en) Target object identification method and device, computer equipment and storage medium
US10742627B2 (en) System and method for dynamic network data validation
CN110720099A (en) System and method for providing recommendation based on seed supervised learning
US20140351931A1 (en) Methods, systems and media for detecting non-intended traffic using co-visitation information
CN113011911B (en) Data prediction method and device based on artificial intelligence, medium and electronic equipment
CN108509626B (en) Method and apparatus for verify data
CN109829593B (en) Credit determining method and device for target object, storage medium and electronic device
CN116720147A (en) Abnormal behavior detection method and device, electronic equipment and storage medium
CN114662001A (en) Resource interaction prediction model training method and device and resource recommendation method and device
CN114596108A (en) Object recommendation method and device, electronic equipment and storage medium
CN111882415A (en) Training method and related device of quality detection model
CN113450127A (en) Information display method and device, computer equipment and storage medium
US20140143019A1 (en) Managing modeled audience extension information

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination
REG Reference to a national code

Ref country code: HK

Ref legal event code: DE

Ref document number: 40093143

Country of ref document: HK