CN100384161C - Method and system for processing service behaviour abnormal - Google Patents
Method and system for processing service behaviour abnormal Download PDFInfo
- Publication number
- CN100384161C CN100384161C CNB2005100488872A CN200510048887A CN100384161C CN 100384161 C CN100384161 C CN 100384161C CN B2005100488872 A CNB2005100488872 A CN B2005100488872A CN 200510048887 A CN200510048887 A CN 200510048887A CN 100384161 C CN100384161 C CN 100384161C
- Authority
- CN
- China
- Prior art keywords
- information
- business conduct
- target service
- abnormal
- record
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Expired - Fee Related
Links
Images
Landscapes
- Management, Administration, Business Operations System, And Electronic Commerce (AREA)
Abstract
The present invention discloses an abnormal service behavior treating method which comprises the steps that target service behavior recording information of users and preserved feature service behavior information of the users are compared firstly, and the target service behavior is judged whether abnormal according to the comparison result. If the target service behavior is abnormal, the target service behavior is transmitted to users to notify the users, etc. according to the scheduled process, so that the purposes of identifying and treating the abnormality of the service behavior of the users are achieved at last. In addition, the present invention also discloses an abnormal service behavior treating system which mainly comprises an abnormality judging unit for realizing the comparison and the judgment functions, and an abnormality treating unit for realizing the abnormality treating function. In addition, the system of the present invention can further comprises a target record collecting unit for collecting records of target service behavior, a feature information generating unit for generating and preserving feature service behavior information in advance, and an abnormality storing unit for storing records of service behavior abnormality of users.
Description
Technical field
The present invention relates to communication technical field, be meant a kind of business conduct abnormality eliminating method and system especially.
Background technology
As everyone knows, the behavior of people in real life often shows certain rules, i.e. said custom on the ordinary meaning, for example: have a meal in the scope at a fixed time, sleep and on and off duty etc.Nowadays along with the popularizing of Networks and Communications technology, people also often show certain rules when using network of relation or communication service, and for example, certain user every days such as surfing the Net in the time range of 19:00 to 21:00 greatly.By the related service data of user in some cycles are carried out statistical analysis, can take out a curve, this curve just is called user's professional fingerprint characteristic or professional fingerprint item visually, and the set of the professional fingerprint item of all of this user then is this user's " a professional fingerprint ".
The professional fingerprint of grasping the user often has great important to network or common carrier, it not only can help the real-time tracking user's of operator business demand, identify the market's trend, thereby provide more high-quality ground service to the user, but also help operator more reasonably to use resource, control cost, thereby in keen competition, stand on the invincible position.
In addition, an important application of grasp customer service fingerprint then is monitoring and the processing to the behavior of user's abnormal traffic.Here the behavior of said user's abnormal traffic is meant that the user uses the unusual performance of corresponding service, and for example: the telephone expenses of user certain month are higher than its average telephone expenses far away, and it is unusual by free call on sb. else's expense through illegal means etc. Subscriber Number then might to occur.At present, all be provided with the abnormality processing module that is used to provide unusual judgement and processing capacity in a lot of equipment of network and communications system, for example: be used for the Traffic Anomaly monitoring module of the calling overload situations at monitor group body and function family in the switch, and be used for predicting and the Customer Relation Management (CRM) system that manages etc. to the user from business conducts such as net situation or malicious owing fee.
Yet on the one hand, above-mentioned unusual judgement can not be discerned the unusual of single business conduct in conjunction with the characteristics of particular user all based on the analysis to user group's business conduct.On the other hand, whether unusually above-mentioned abnormality judgment method can only discern certain business conduct, and can not the abnormal traffic behavior that be identified be analysed in depth, and more can not judge the change of business conduct demand from these abnormal conditions.For example, the situation of change that the business conduct that causes along with the change of user behavior custom takes place, existing system then can't be accomplished the change of this regular traffic demand is adapted to processing at all.
Summary of the invention
In view of this, one object of the present invention is to provide a kind of business conduct abnormality eliminating method, solves judgement and handling problem at the behavior of unique user abnormal traffic.
Business conduct abnormality eliminating method provided by the invention mainly comprises step: will embody the user user characteristics business conduct information of the embodiment customer service behavioural characteristic of the target service behavior record information of target service operating position and preservation is compared, judge according to comparative result whether this target service behavior is unusual, if then this target service behavior is handled according to preset program.
In said method, comprising: the FEATURE service behavioural information that generates and preserve the user in advance;
The step of described comparison comprises:
A, generate the business conduct eigen vector, and the business conduct eigen vector that generates comprises property attribute information based on user's target service behavior record information;
B, the respective attributes information that the property attribute information and the FEATURE service behavioural information of business conduct eigen vector comprised is compared, and judge according to comparative result whether the target service behavior is unusual according to predefined comparison strategy.
In the step a of said method, the step of described generation business conduct eigen vector comprises: target service behavior record information is comprised the preliminary treatment of the combination in any of identification, integration, computing, format conversion, extraction, filtration and quantification.
In the step b of said method, described according to comparison strategy comparison business conduct eigen vector property attribute information and the step of the respective attributes information of user characteristics business conduct information comprise: the respective attributes value of information of the property attribute value of information of business conduct eigen vector and user characteristics business conduct information is subtracted each other, is divided by or the ratio of getting is handled.
In the step b of said method, describedly judge according to comparative result whether unusual step comprises in the target service behavior: judge whether the property attribute deviation that relatively obtains belongs to the abnormal variation scope of setting, if then judge the target service abnormal behavior; Otherwise, be judged to be non-unusual.
In said method, also comprise: generate and preserve customer service abnormal behavior record in advance;
The described step of this target service behavior being handled according to preset program comprises:
The customer service abnormal behavior record that c, inquiry are preserved judges whether to exist the business conduct exception record identical with described target service abnormal behavior, if, execution in step d then; Otherwise, execution in step e;
D, handle this target service behavior, and upgrade the abnormal information of this business conduct exception record, process ends according to the abnormality processing parameter that is comprised in the business conduct exception record;
E, handle this target service behavior, and set up and preserve exception record about this target service behavior according to the default exception handler that is provided with.
In said method, described business conduct eigen vector comprises base attribute information;
Among the step c, described judging whether exists the step of the business conduct exception record identical with the target service abnormal behavior to comprise: the corresponding service abnormal behavior record of preserving according to the base attribute information searching of target service behavioral trait vector, judge whether the abnormal characteristic attribute information that this business conduct exception record comprises is identical with the corresponding abnormal characteristic attribute information of target service behavioral trait vector, if then judge to have identical exception record; Otherwise, judge not have identical exception record.
In the steps d of said method, described abnormality processing parameter comprises: the combination in any that increases the unusual number of times of record, sends notice and suspend operation to user or service node;
Among the step e, described default exception handler comprises: the combination in any that increases the unusual number of times of record, sends notice and suspend operation to user or service node.
Another object of the present invention is to provide a kind of business conduct abnormality processing system, and this system mainly comprises: abnormal deciding means and exception processing unit; Wherein,
Described abnormal deciding means is used for comparison user's target service behavior record information and user's FEATURE service behavioural information, judge according to comparative result whether the target service behavior is unusual, and send the unusual target service behavior record information that is judged to be to exception processing unit;
Described exception processing unit is used for according to preset program the pairing ownership goal business conduct of target service behavior record information that receives being handled.
In said system, further comprise: target record collector unit and characteristic information generation unit; Wherein, described target record collector unit is used for obtaining from service node user's target service behavior record information, and generate the business conduct eigen vector, and send this business conduct eigen vector information that generates to abnormal deciding means and characteristic information generation unit based on this target service behavior record information;
Described characteristic information generation unit is used for generating and preserve user's FEATURE service behavioural information in advance based on receiving business conduct eigen vector information, and provides the FEATURE service behavioural information according to the keyword that receives to abnormal deciding means;
Described abnormal deciding means is further used for sending to the characteristic information generation unit keyword of the base attribute information that comprises target service behavior record information, and receives the FEATURE service behavioural information that the characteristic information generation unit returns;
Described abnormal deciding means is used for according to predetermined comparison strategy the property attribute information of the business conduct eigen vector that receives and the respective attributes information of FEATURE service behavioural information being compared, judge according to comparative result whether the target service behavior is unusual, and will be judged to be unusual business conduct eigen vector information and be sent to exception processing unit;
Described exception processing unit is used for according to preset program the pairing ownership goal business conduct of business conduct eigen vector information that receives being handled.
In said system, further comprise: abnormal memory cell;
Described abnormal memory cell is used to store user's business conduct exception record;
Described exception processing unit is used to receive the business conduct eigen vector information from abnormal deciding means, and according to whether storing the business conduct exception record identical in this business conduct eigen vector information inquiry abnormal memory cell with the target service abnormal behavior, if, the then abnormality processing parameter processing target business conduct that is comprised according to this business conduct exception record, and in abnormal memory cell, upgrade and preserve this business conduct exception record; Otherwise, handle this target service behavior according to the default exception handler that is provided with, and in abnormal memory cell, set up and preserve business conduct exception record about this target service behavior.
In said system, described exception processing unit is further used for sending about the dystropic announcement information of target service to user or service node.
In said system, described characteristic information generation unit is for generating the also professional system of fingerprints of the professional finger print information of leading subscriber.
In sum, the present invention takes: at first user's the target service behavior record information and the user characteristics business conduct information of preservation are compared, judge according to comparative result whether this target service behavior is unusual then, if, then this target service behavior is comprised processing such as sending notice to the user according to preset program, thus the final purpose that the customer service abnormal behavior is discerned and handled of realizing.In addition, the present invention also discloses a kind of business conduct abnormality processing system, and this system mainly comprises the abnormal deciding means that is used to realize comparison described in the said method and arbitration functions, and the exception processing unit of realizing above-mentioned abnormality processing function.In addition, system of the present invention also can further comprise: be used to collect target service behavior record information the target record collector unit, be used for the abnormal memory cell that generates and preserve the characteristic information generation unit of FEATURE service behavioural information in advance and be used to store user's business conduct exception record.
Description of drawings
Fig. 1 is business conduct abnormality eliminating method flow chart according to an embodiment of the invention.
Fig. 2 is business conduct abnormality processing system structure chart according to an embodiment of the invention.
Embodiment
For making the purpose, technical solutions and advantages of the present invention clearer, the present invention is described in further detail below in conjunction with accompanying drawing.
Core concept of the present invention is: at first user's the target service behavior record information and the user characteristics business conduct information of preservation are compared, judge according to comparative result whether this target service behavior is unusual then, if, then this target service behavior is comprised processing such as sending notice to the user according to preset program, thus the final purpose that the customer service abnormal behavior is discerned and handled of realizing.
According to an embodiment of the invention business conduct abnormality eliminating method flow process as shown in Figure 1, this method specifically comprises the steps:
Step 101: obtain user's target service behavior record information, and generate corresponding business behavioral trait vector based on this recorded information.
Wherein, user's business conduct recorded information is meant embodiment user that service node the writes down initial data to the operating position of corresponding service.Service node can comprise such as Service Gateways such as charge system, BOSS and switches.The business conduct recorded information can be: message registration; The expense record; Comprise professional service recorder such as information such as service time, duration or expenses; Business tine record--user uses professional particular content, as short message content and webpage query contents etc.Can decide according to concrete class of service at the specifying information item that the business conduct recorded information of every type of business is comprised, generally comprise user ID (ID), service identification and the professional data etc. of using.Wherein, the professional data of using specifically can comprise such as information such as service time or costs of use.Target service behavior record information then is meant the business conduct recorded information as subject matter, and this business conduct recorded information is as the initial data of follow-up unusual judgement, analysis and processing.Target service behavior record information is usually expressed as the setting-up time scope, as the customer service behavior record in certain month, perhaps with the recorded information of other form performance.
Because target service behavior record information is by the different service node collections or the initial data of record, therefore the content that it comprised is more numerous and diverse, and also disunity of form, can't directly it be judged unusually or analyze, but need through certain preprocessing process, thereby obtain to embody the business attribute information of customer service behavioural characteristic, and the set of all business attribute information that obtain is the business conduct eigen vector, business attribute information is the characteristic element that constitutes this eigen vector, and an eigen vector can be made of one or more characteristic elements.For example, customer service behavioral trait vector can comprise: characteristic elements such as user ID, service identification and service time.As mentioned above, the business conduct eigen vector generally is to generate by the target service behavior record information content of obtaining is carried out various preliminary treatment, and the business conduct eigen vector that obtains can be directly as the basis of judging and analyzing unusually.And top said preliminary treatment specifically can comprise: identification, integration, computing, format conversion, extraction, filtration are or/and quantification etc.
For instance, can obtain user as shown in table 1 13345678922 October message registration as target service behavior record information, as can be seen from Table 1, this target service behavior record information comprises: items of information such as user ID, service identification, charge type, date, time and expense account.And the business conduct eigen vector that generates based on table 1, promptly professional summary table is as shown in table 2, and as can be seen from Table 2, this business conduct eigen vector comprises: user ID, service identification, time, charge type, expense account and 6 characteristic elements of proportion.Expense account wherein is to gather at the expense accounts of various pairing each time period of charge type in the table 1 respectively to obtain, and proportion then is the ratio that each type of service expense account occupies all expense account total values.
| User ID | Service identification | Charge type | Date | Time | The expense account |
| 13345678922 | Monthly_Bill | Local | 2005/10/01 | 19:15:00-19:20:00 | ￥5.00 |
| 13345678922 | Monthly_Bill | Long-distance | 2005/10/03 | 19:00:00-19:06:00 | ￥6.00 |
| 13345678922 | Monthly_Bill | Local | 2005/10/07 | 19:30:00-19:36:00 | ￥6.00 |
| 13345678922 | Monthly_Bill | Note | 2005/10/07 | 09:00:00-09:02:00 | ￥2.00 |
| ... | ... | ... | ... | ... | ... |
| ... | ... | ... | ... | ... | ... |
| 13345678922 | Monthly_Bill | Online | 2005/10/28 | 00:00:00-02:02:00 | ￥3.00 |
Table 1
| User ID | Service identification | Time | Charge type | The expense account | Proportion |
| 13345678922 | Monthly_Bill | 2005.10 | Long-distance | ￥75.00 | 55.4％ |
| 13345678922 | Monthly_Bill | 2005.10 | Local | ￥42.00 | 31.0％ |
| 13345678922 | Monthly_Bill | 2005.10 | Note | ￥4.50 | 3.3％ |
| 13345678922 | Monthly_Bill | 2005.10 | Online | ￥14.00 | 10.3％ |
| 13345678922 | Monthly_Bill | 2005.10 | Amount to | ￥135.5 | 100％ |
Table 2
Step 102: the FEATURE service behavioural information of obtaining the user.
Wherein, the FEATURE service behavioural information is meant the user's that the historical business conduct recorded information based on the user generates business conduct characteristic information.Because user's target service behavior record information both may be the customer service behavior that has taken place, it also may be the customer service behavior that will take place in current occurent customer service behavior or future, and because the customer service behavior has regular hour property usually, therefore be time of origin, require time of origin as the historical business conduct on the basis of generating feature business conduct information before the time of origin of target service behavior.In addition, in order to realize follow-up unusual judgement, the FEATURE service behavioural information that require to generate must comprise certain or some or all property attribute item of information of business conduct eigen vector described in the above-mentioned steps 102, even its full detail item--comprise base attribute information and property attribute information, be the FEATURE service behavioural information must with the property attribute information overlap of business conduct eigen vector, preferably overlapping with the full detail item of business conduct eigen vector, so that carry out follow-up comparison and unusual judgement.This point can be by setting in advance characteristic information generation unit and business conduct eigen vector generation unit, and make the FEATURE service behavioural information that generates itself have part or all of identical item of information with the business conduct eigen vector to realize.
The above-mentioned concrete steps of obtaining the FEATURE service behavioural information can comprise: set in advance the characteristic information generation unit, generated user characteristics business conduct information and preserved this information by this characteristic information generation unit; When obtaining the FEATURE service behavioural information, provide the keyword of the base attribute information that comprises target service behavior record information to the characteristic information generation unit; The FEATURE service behavioural information that the characteristic information generation unit is preserved according to the key search self that receives, and export the individual features business conduct information that retrieves.The base attribute information of above-mentioned target service behavior record information comprises user ID, service identification and time range etc. usually, but also can comprise out of Memory according to concrete business tine.Wherein service identification specifically can comprise, as: the sign of whole business, speech business, short message and/or MMS etc.In addition, above-mentioned keyword can be input in the characteristic information generation unit by the interactive interface that is provided with.
As a preferred embodiment, above-mentioned characteristic information generation unit can realize that the FEATURE service behavioural information of obtaining this moment then is the corresponding business finger print information by professional system of fingerprints.Wherein, professional system of fingerprints mainly is meant and generates the also functional unit of the professional finger print information of leading subscriber, professional finger print information then is meant the business conduct record that professional system of fingerprints regularly generates and upgrades according to the business conduct historical record of user in setting-up time, and professional finger print information specifically can comprise: user ID, service identification, time range and other attribute information field.About the detailed description of professional fingerprint and professional system of fingerprints specifically can referring to the application number that is delivered to Patent Office of the People's Republic of China be 200510113124.1 in first to file, and should incorporate into herein as a reference at the full text of first to file.
Below be that example describes equally with above-mentioned user's 13345678922 message registration in October.Input comprises user ID--and 13345678922, service identification--monthly ticket (Monthly_Bill), the keyword in time range--October obtains this user's FEATURE service behavioural information, and the FEATURE service behavioural information of obtaining is as shown in table 3 below, this FEATURE service behavioural information comprises user ID, service identification, time, charge type, expense account and 6 items of information of proportion as can be seen from Table 3, and is identical with the item of information that above-mentioned business conduct eigen vector is comprised.
| User ID | Service identification | Time | Charge type | The expense account | Proportion |
| 13345678922 | Monthly_Bill | 2005.10 | Long-distance | ￥35.00 | 35％ |
| 13345678922 | Monthly_Bill | 2005.10 | Local | ￥42.00 | 42％ |
| 13345678922 | Monthly_Bill | 2005.10 | Note | ￥5.00 | 5％ |
| 13345678922 | Monthly_Bill | 2005.10 | Online | ￥18.00 | 18％ |
| 13345678922 | Monthly_Bill | 2005.10 | Amount to | ￥100.00 | 100％ |
Table 3
Step 103: the property attribute information of business conduct eigen vector and the respective attributes information of FEATURE service behavioural information are compared according to predefined comparison strategy, and judge according to comparative result whether the target service behavior is unusual, if then execution in step 104; Otherwise, process ends.
In this step, comparison strategy is normally predefined according to concrete business characteristic, and the comparison strategy of setting can comprise usually: the respective attributes value of a certain of business conduct eigen vector or a few property attribute values and FEATURE service behavioural information is compared, as subtract each other, be divided by or get ratio etc., obtain corresponding property attribute deviation, compare by the property attribute deviation that will obtain and the thresholding of predefined abnormal variation scope then, judge whether this property attribute deviation belongs to the abnormal variation scope of setting, if then judge the target service abnormal behavior; Otherwise, be judged to be non-unusual.
For example: at above-mentioned user's 13345678922 message registration in October, the property attribute information in table 2 and the table 3 is compared, obtain comparison tabulation as shown in table 4.As can be seen, table 4 comprises: user ID, service identification, time, charge type, expense deviation, individual proportional jitter and 7 items of information of population proportion deviation.Wherein, the comparison strategy of setting specifically comprises: at first, the pairing expense account of corresponding charge type in pairing expense account of each charge type in the table 2 and the table 3 subtracted each other obtain the expense deviation; Secondly, the ratio that calculates the pairing expense account of corresponding charge type in above-mentioned expense deviation and the table 3 obtains individual proportional jitter; Once more, the pairing proportion information of corresponding charge type in pairing proportion information of each charge type in the table 2 and the table 3 subtracted each other obtain the population proportion deviation, this population proportion deviation embodies each charge type situation of change of proportion on the whole, thereby obtains comprising 3 property attribute deviations of expense deviation, individual proportional jitter and population proportion deviation; At last, the threshold value with the abnormal variation scope of the above-mentioned property attribute deviation that obtains and setting compares.The abnormal variation scope that this moment, hypothesis was set is: overall expenses deviation Da Yu $+50.00, or individual proportional jitter is greater than 50%.Then this user's overall expenses deviation that shows from table 4 is+35.00, and long-distance proportional jitter is 114.3%, and long-distance as can be seen proportional jitter is 114.3%, because 114.3%＞50%, therefore judge the target service abnormal behavior.
| User ID | Service identification | Time | Charge type | The expense deviation | Individual proportional jitter | The population proportion deviation |
| 13345678922 | Monthly_Bill | 2005.10 | Long-distance | +40.00 | 40/35＝114.3％ | +20.4％ |
| 13345678922 | Monthly_Bill | 2005.10 | Local | 0.00 | 0 | -11％ |
| 13345678922 | Monthly_Bill | 2005.10 | Note | -0.50 | -0.5/5＝-10％ | -1.7％ |
| 13345678922 | Monthly_Bill | 2005.10 | Online | -4.00 | -4/18＝22.2％ | -7.7％ |
| 13345678922 | Monthly_Bill | 2005.10 | Amount to | +35.00 | 35.5％ | 0 |
Table 4
Step 104: the customer service abnormal behavior record that inquiry is preserved judges whether to have the business conduct exception record identical with the target service abnormal behavior described in the above-mentioned steps 103, if then execution in step 105; Otherwise, execution in step 106.
Wherein, customer service abnormal behavior record is meant the dystropic historical record of customer service of system log (SYSLOG).Customer service abnormal behavior record comprises usually: such as base attribute information such as user ID, service identification and time and abnormal information etc.Abnormal information wherein comprises usually: information such as unusual sign, abnormal characteristic attribute information and abnormality processing parameter.Can also comprise information such as unusual number of times and unusual rank according to service needed in addition.Wherein unusual sign is meant the unique identification of the abnormal traffic behavior of preservation.And the abnormal characteristic attribute information is meant and causes the target service behavior to be judged as unusual property attribute information in the business conduct eigen vector, for example: the individual proportional jitter of the long-distance cost in the above-mentioned example is greater than 50%, so the individual proportional jitter of long-distance cost is the abnormal characteristic attribute information.The abnormality processing parameter specifically can comprise: increase record unusual number of times, send notice or/and suspend operation etc. to user or service node.And unusual number of times both can be meant the adding up of all unusual number of times of the same business conduct of this user, also can specifically refer to the adding up of the unusual number of times that takes place of certain class of the same business conduct of this user.It is serious, medium and slight etc. that unusual rank then can comprise, unusual rank is determined according to the abnormal attribute value and the deviation of unusual thresholding usually.
Judge whether to exist the business conduct exception record identical specifically can comprise the steps: the corresponding service abnormal behavior record of preserving according to the base attribute information searching of target service behavioral trait vector with this target service abnormal behavior, judge whether the abnormal characteristic attribute information that this business conduct exception record comprises is identical with the corresponding abnormal characteristic attribute information of target service behavioral trait vector, if then judge to have identical exception record; Otherwise, judge not have identical exception record.
Step 105: handle this target service behavior according to the abnormality processing parameter that is comprised in the business conduct exception record, and upgrade the abnormal information of this business conduct exception record, process ends.
Wherein, described in abnormality processing parameter such as the above-mentioned step 104, specifically can comprise: increase record unusual number of times, send notice or/and suspend operation etc. to user or service node.The abnormal information of upgrading known exception business conduct record then is meant unusual number of times information, unusual class information and the temporal information etc. that renewal is wherein comprised.
Step 106: handle this target service behavior according to the default exception handler that is provided with, and set up and preserve the exception record about this target service behavior, process ends.
Wherein, the default exception handler of setting specifically can comprise: increase record unusual number of times, send notice or/and suspend operation etc. to user or service node.
Business conduct abnormality eliminating method of the present invention more than has been described, has the following describes business conduct abnormality processing system of the present invention, this system configuration mainly comprises as shown in Figure 2: abnormal deciding means and exception processing unit; Wherein, abnormal deciding means is used for comparison user's target service behavior record information and user's FEATURE service behavioural information, judge according to comparative result whether the target service behavior is unusual, and send the unusual target service behavior record information that is judged to be to exception processing unit; Exception processing unit is used for according to preset program the pairing ownership goal business conduct of target service behavior record information that receives being handled.
As a preferred embodiment, system of the present invention also can further comprise: target record collector unit and characteristic information generation unit; Wherein, the target record collector unit is used for obtaining from the service node of outside user's target service behavior record information, and generate corresponding business behavioral trait vector information, and send the business conduct eigen vector information that generates to abnormal deciding means and characteristic information generation unit based on this target service behavior record information.The characteristic information generation unit is used for generating and preserve user's FEATURE service behavioural information in advance based on receiving business conduct eigen vector information, and provides the FEATURE service behavioural information according to the keyword that receives to abnormal deciding means.The characteristic information generation unit can be a professional system of fingerprints etc.Abnormal deciding means is further used for sending to the characteristic information generation unit keyword of the base attribute information that comprises target service behavior record information, and receives the FEATURE service behavioural information that the characteristic information generation unit returns; And this abnormal deciding means is used for according to predetermined comparison strategy the property attribute information of above-mentioned business conduct eigen vector and the respective attributes information of FEATURE service behavioural information being compared, judge according to comparative result whether the target service behavior is unusual, and will be judged to be unusual business conduct eigen vector information and be sent to exception processing unit.Described exception processing unit is used for according to preset program the pairing ownership goal business conduct of business conduct eigen vector information that receives being handled.
As another preferred embodiment of system of the present invention, can also on the basis of the foregoing description system, further comprise abnormal memory cell; This abnormal memory cell is used to store user's business conduct exception record.At this moment, exception processing unit then is used to receive the business conduct eigen vector information from abnormal deciding means, and according to whether storing the business conduct exception record identical in this business conduct eigen vector information inquiry abnormal memory cell with the target service abnormal behavior, if, the then processing parameter processing target business conduct that is comprised according to this business conduct exception record, and in abnormal memory cell, upgrade this business conduct exception record of preserving; Otherwise, handle this target service behavior according to the default exception handler that is provided with, and in abnormal memory cell, set up and preserve business conduct exception record about this target service behavior.
Described in the abnormality processing parameter wherein such as the step 104 and step 105 of above-mentioned method, repeat no more herein.Therefore, handling the abnormal traffic behavior according to the abnormality processing parameter is exactly to carry out corresponding abnormality processing operation according to these parameter informations.For example:, can send about target service abnormal behavior notification message etc. to relative users by exception processing unit, and can this abnormal traffic behavior be further processed according to user's feedback according to customer contact mode parameter information wherein.In addition, also can send corresponding notification message, so that it takes necessary professional control measure etc. to service node.
In a word, the above is preferred embodiment of the present invention only, is not to be used to limit the present invention.
Claims (13)
1. business conduct abnormality eliminating method, it is characterized in that, this method comprises: will embody the user user characteristics business conduct information of the embodiment customer service behavioural characteristic of the target service behavior record information of target service operating position and preservation is compared, judge according to comparative result whether this target service behavior is unusual, if then this target service behavior is handled according to preset program.
2. method according to claim 1 is characterized in that, this method comprises: the FEATURE service behavioural information that generates and preserve the user in advance;
The step of described comparison comprises:
A, generate the business conduct eigen vector, and the business conduct eigen vector that generates comprises property attribute information based on user's target service behavior record information;
B, the respective attributes information that the property attribute information and the FEATURE service behavioural information of business conduct eigen vector comprised is compared, and judge according to comparative result whether the target service behavior is unusual according to predefined comparison strategy.
3. method according to claim 2, it is characterized in that, among the step a, the step of described generation business conduct eigen vector comprises: target service behavior record information is comprised the preliminary treatment of the combination in any of identification, integration, computing, format conversion, extraction, filtration and quantification.
4. method according to claim 2, it is characterized in that, among the step b, described according to comparison strategy comparison business conduct eigen vector property attribute information and the step of the respective attributes information of user characteristics business conduct information comprise: the respective attributes value of information of the property attribute value of information of business conduct eigen vector and user characteristics business conduct information is subtracted each other, is divided by or the ratio of getting is handled.
5. method according to claim 2, it is characterized in that, among the step b, describedly judge according to comparative result whether unusual step comprises in the target service behavior: judge whether the property attribute deviation that relatively obtains belongs to the abnormal variation scope of setting, if then judge the target service abnormal behavior; Otherwise, be judged to be non-unusual.
6. according to any described method in the claim 1 to 5, it is characterized in that this method also comprises: generate and preserve customer service abnormal behavior record in advance;
The described step of this target service behavior being handled according to preset program comprises:
The customer service abnormal behavior record that c, inquiry are preserved judges whether to exist the business conduct exception record identical with described target service abnormal behavior, if, execution in step d then; Otherwise, execution in step e;
D, handle this target service behavior, and upgrade the abnormal information of this business conduct exception record, process ends according to the abnormality processing parameter that is comprised in the business conduct exception record;
E, handle this target service behavior, and set up and preserve exception record about this target service behavior according to the default exception handler that is provided with.
7. method according to claim 6 is characterized in that, described business conduct eigen vector comprises base attribute information;
Among the step c, described judging whether exists the step of the business conduct exception record identical with the target service abnormal behavior to comprise: the corresponding service abnormal behavior record of preserving according to the base attribute information searching of target service behavioral trait vector, judge whether the abnormal characteristic attribute information that this business conduct exception record comprises is identical with the corresponding abnormal characteristic attribute information of target service behavioral trait vector, if then judge to have identical exception record; Otherwise, judge not have identical exception record.
8. method according to claim 6 is characterized in that, in the steps d, described abnormality processing parameter comprises: the combination in any that increases the unusual number of times of record, sends notice and suspend operation to user or service node;
Among the step e, described default exception handler comprises: the combination in any that increases the unusual number of times of record, sends notice and suspend operation to user or service node.
9. a business conduct abnormality processing system is characterized in that, this system comprises: abnormal deciding means and exception processing unit; Wherein,
Described abnormal deciding means is used for comparison user's target service behavior record information and user's FEATURE service behavioural information, judge according to comparative result whether the target service behavior is unusual, and send the unusual target service behavior record information that is judged to be to exception processing unit;
Described exception processing unit is used for according to preset program the pairing ownership goal business conduct of target service behavior record information that receives being handled.
10. system according to claim 9 is characterized in that, this system further comprises: target record collector unit and characteristic information generation unit; Wherein,
Described target record collector unit is used for obtaining from service node user's target service behavior record information, and generate the business conduct eigen vector, and send this business conduct eigen vector information that generates to abnormal deciding means and characteristic information generation unit based on this target service behavior record information;
Described characteristic information generation unit is used for generating and preserve user's FEATURE service behavioural information in advance based on receiving business conduct eigen vector information, and provides the FEATURE service behavioural information according to the keyword that receives to abnormal deciding means;
Described abnormal deciding means is further used for sending to the characteristic information generation unit keyword of the base attribute information that comprises target service behavior record information, and receives the FEATURE service behavioural information that the characteristic information generation unit returns;
Described abnormal deciding means is used for according to predetermined comparison strategy the property attribute information of the business conduct eigen vector that receives and the respective attributes information of FEATURE service behavioural information being compared, judge according to comparative result whether the target service behavior is unusual, and will be judged to be unusual business conduct eigen vector information and be sent to exception processing unit;
Described exception processing unit is used for according to preset program the pairing ownership goal business conduct of business conduct eigen vector information that receives being handled.
11. system according to claim 10 is characterized in that, this system further comprises: abnormal memory cell;
Described abnormal memory cell is used to store user's business conduct exception record;
Described exception processing unit is used to receive the business conduct eigen vector information from abnormal deciding means, and according to whether storing the business conduct exception record identical in this business conduct eigen vector information inquiry abnormal memory cell with the target service abnormal behavior, if, the then abnormality processing parameter processing target business conduct that is comprised according to this business conduct exception record, and in abnormal memory cell, upgrade and preserve this business conduct exception record; Otherwise, handle this target service behavior according to the default exception handler that is provided with, and in abnormal memory cell, set up and preserve business conduct exception record about this target service behavior.
12. system according to claim 9 is characterized in that, described exception processing unit is further used for sending about the dystropic announcement information of target service to user or service node.
13., it is characterized in that described characteristic information generation unit is for generating the also professional system of fingerprints of the professional finger print information of leading subscriber according to any described system in the claim 9 to 12.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CNB2005100488872A CN100384161C (en) | 2005-12-31 | 2005-12-31 | Method and system for processing service behaviour abnormal |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CNB2005100488872A CN100384161C (en) | 2005-12-31 | 2005-12-31 | Method and system for processing service behaviour abnormal |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN1859224A CN1859224A (en) | 2006-11-08 |
| CN100384161C true CN100384161C (en) | 2008-04-23 |
Family
ID=37298089
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CNB2005100488872A Expired - Fee Related CN100384161C (en) | 2005-12-31 | 2005-12-31 | Method and system for processing service behaviour abnormal |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN100384161C (en) |
Families Citing this family (12)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN102056201B (en) * | 2009-10-30 | 2014-09-03 | 中国移动通信集团广西有限公司 | Method and device for processing abnormal condition in service process |
| CN104426885B (en) * | 2013-09-03 | 2019-04-16 | 深圳市腾讯计算机系统有限公司 | Abnormal account providing method and device |
| CN103473312A (en) * | 2013-09-11 | 2013-12-25 | 北京思特奇信息技术股份有限公司 | Independent basis information obtaining method |
| CN104866296B (en) * | 2014-02-25 | 2019-05-28 | 腾讯科技（北京）有限公司 | Data processing method and device |
| CN105100032B (en) * | 2014-05-23 | 2019-07-05 | 腾讯科技（北京）有限公司 | A kind of method and device for preventing resource from stealing |
| CN106296254B (en) * | 2015-06-09 | 2021-06-25 | 腾讯科技（深圳）有限公司 | Exposure behavior data management method and device |
| CN106844367A (en) * | 2015-12-03 | 2017-06-13 | 阿里巴巴集团控股有限公司 | A kind of processing method and processing device of Internet service |
| CN108628694B (en) * | 2017-03-20 | 2023-03-28 | 腾讯科技（深圳）有限公司 | Data processing method and device based on programmable hardware |
| CN109299135B (en) * | 2018-11-26 | 2024-05-14 | 平安科技（深圳）有限公司 | Abnormal query recognition method, recognition equipment and medium based on recognition model |
| CN110689084B (en) * | 2019-09-30 | 2022-03-01 | 北京明略软件系统有限公司 | Abnormal user identification method and device |
| CN112232643A (en) * | 2020-09-25 | 2021-01-15 | 上海淇毓信息科技有限公司 | Method and device for managing business strategy and electronic equipment |
| CN112887923B (en) * | 2021-01-22 | 2022-02-15 | 中国科学院自动化研究所 | Unsupervised abnormal short text monitoring method and system based on dynamic communication network |
Citations (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN1417683A (en) * | 2001-11-07 | 2003-05-14 | 华为技术有限公司 | Abnormal logic business simulating test device |
| EP1367799A2 (en) * | 2002-05-31 | 2003-12-03 | Alcatel Canada Inc. | Hashing for TCP SYN/FIN correspondence |
| CN1620135A (en) * | 2003-11-21 | 2005-05-25 | 华为技术有限公司 | Conference television system and method of realizing maintaining business in said system |
-
2005
- 2005-12-31 CN CNB2005100488872A patent/CN100384161C/en not_active Expired - Fee Related
Patent Citations (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN1417683A (en) * | 2001-11-07 | 2003-05-14 | 华为技术有限公司 | Abnormal logic business simulating test device |
| EP1367799A2 (en) * | 2002-05-31 | 2003-12-03 | Alcatel Canada Inc. | Hashing for TCP SYN/FIN correspondence |
| CN1620135A (en) * | 2003-11-21 | 2005-05-25 | 华为技术有限公司 | Conference television system and method of realizing maintaining business in said system |
Also Published As
| Publication number | Publication date |
|---|---|
| CN1859224A (en) | 2006-11-08 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN100384161C (en) | Method and system for processing service behaviour abnormal | |
| CN100518191C (en) | Method and system for securing service quality in communication network | |
| CN107040863A (en) | Real time business recommends method and system | |
| CN106371984A (en) | Data monitoring method, equipment and system | |
| CN104579912B (en) | Data pushing method and device | |
| CN109120428B (en) | Method and system for wind control analysis | |
| CN106371973A (en) | Data processing method, equipment and system | |
| CN108112038B (en) | Method and device for controlling access flow | |
| CN113412607B (en) | Content pushing method and device, mobile terminal and storage medium | |
| CN107592236A (en) | The monitoring method and device of a kind of related business datum of promotion message | |
| CN106095789A (en) | A kind of message subscribing managing device and method | |
| CN101389085B (en) | Rubbish short message recognition system and method based on sending behavior | |
| CN107977855B (en) | Method and device for managing user information | |
| CN104866296A (en) | Data processing method and device | |
| CN107566148A (en) | Analysis method, system, device and the terminal of terminal applies operation data | |
| CN109978575B (en) | Method and device for mining user flow operation scene | |
| JP5935511B2 (en) | Program and campaign management device | |
| CN110321364B (en) | Transaction data query method, device and terminal of credit card management system | |
| Malone et al. | Do three-part tariffs improve efficiency in residential broadband networks? | |
| CN101770626A (en) | Method, device and system for identifying agents with card-laundering behavior | |
| CN110070392B (en) | User loss early warning method and device | |
| CN108830658B (en) | Data processing method and device for information push, electronic equipment and storage medium | |
| CN106790339A (en) | Metadata server, network device, and automatic resource management method | |
| CN110769454A (en) | Flow prediction method and device | |
| AU2007247995A1 (en) | Method and apparatus to perform real-time audience estimation and commercial selection suitable for targeted advertising |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| C06 | Publication | ||
| PB01 | Publication | ||
| C10 | Entry into substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| C14 | Grant of patent or utility model | ||
| GR01 | Patent grant | ||
| CF01 | Termination of patent right due to non-payment of annual fee |
Granted publication date: 20080423 Termination date: 20151231 |
|
| EXPY | Termination of patent right or utility model |