CN103413054A - Internet addiction detection device and method based on user-computer interactive events - Google Patents

Abstract

The invention provides an Internet addiction detection device and method based on user-computer interactive events and belongs to the field of data mining. According to the Internet addiction detection device and method based on the user-computer interactive events, quantifiable human-computer interactive operational data are collected through Internet surfing tools which are used by a user frequently, the data are used for computing and analyzing Internet surfing behaviors of the user, accordingly whether the user has an Internet addiction can be detected, and the Internet surfing tools can be controlled effectively. According to the Internet addiction detection device and method based on the user-computer interactive events, the accuracy of Internet addiction detection can reach more than 85%, errors of existing detection methods can be effectively avoided, and the accuracy of the detection can be improved; the detection costs can be reduced, a user can carry out detection at any time, high application value to primary and secondary school students can be obtained, Internet addiction behaviors can be effectively prevented and controlled, and damage caused by Internet addiction can be reduced.

Description

Network addiction pick-up unit and method based on the subscriber computer alternative events

Technical field

The invention belongs to Data Mining, be specifically related to a kind of pick-up unit of network addiction based on the subscriber computer alternative events and method.

Background technology

Network has become the rise of important component part, the especially social network such as Facebook, Twitter, Sina's microblogging of modern people's life, and increasing people has joined in the troop of online.Certainly, network, when to human society, bringing efficient convenient service, also brings negative and negative influence to human society.The subnetwork user is owing to excessively indulging in without limit network, cause its physiology, at heart, emotion, morals etc. are many-sided impaired, have disturbed normal work, studying and living, even bring out crime.

By consulting the related data of relevant network addiction, current research work and achievement are mostly launched based on fields such as psychology, sociology, medical science, above-mentioned existing network addiction detection method is loaded down with trivial details, cost is high, error is large, and detect from computer data acquisition, belong to blank, in fact, user and network carry out mutual computer operation can be recorded in detail, and for analyzing, this is to the judgement network addiction or even find that potential network addiction trend has important value, but is left in the basket at present.

Summary of the invention

For the shortcoming of prior art, the present invention proposes a kind of pick-up unit of network addiction based on the subscriber computer alternative events and method, the purpose that reduce testing cost to reach, improves accuracy in detection, simplification detection method.

A kind of pick-up unit of network addiction based on the subscriber computer alternative events, comprise simple event acquisition module, complicated event generation module, the time is extensive and normalized module, the frequent sub-acquisition module of behavior generation, Sample Storehouse build module, data processing and detection module and preventive intervention procedure module, wherein

Simple event acquisition module: be used to gathering user and computer interactive variable as simple event, comprise computer CPU utilization rate, memory usage, unit interval left button number of times, unit interval number of pixels, network traffics and the operation process that right button number of times, unit interval keyboard number of taps, unit interval mouse move of clicking the mouse of clicking the mouse, and above-mentioned input variable is sent to the complicated event generation module;

Complicated event generation module: for each simple event is compared with threshold value separately respectively, if be more than or equal to threshold range, retain this simple event, then generate complicated events according to the whole simple event combined situation that retain; Otherwise continue to gather simple event; Described complicated event comprises that off-line sees video, sees video, real time strategy, the game of table trip class, browsing page, online chatting and down operation online;

Extensive and normalized module of time: arrange for the complicated event that each user day is done, and the complicated event time of origin is carried out to extensive processing, be about to be divided in one day several time periods; To the duration carry out normalized, the duration that is about to complicated event is carried out the rounding operation; And the complicated event after processing is sent to the sub-acquisition module of frequent behavior generation;

The frequent sub-acquisition module of behavior generation: when setting up Sample Storehouse, for obtaining between a plurality of network addiction users the identical complicated event carried out, gather the generation number of times of above-mentioned identical complicated event, and according to the set frequency threshold value of user, select be greater than threshold value complicated event as frequent network addiction complicated event, generation that the set that consists of above-mentioned frequent network addiction complicated event of reentrying distributes be used to describing the user behavior feature, and be sent to Sample Storehouse and build module; For obtaining the identical complicated event carried out between a plurality of non-network addiction users, gather the generation number of times of above-mentioned identical complicated event, and according to the set frequency threshold value of user, select be greater than threshold value complicated event as frequent non-network addiction complicated event, reentry by generation distributed be used to describing the user behavior feature of above-mentioned frequent non-network addiction set that complicated event forms, and be sent to Sample Storehouse structure module;

When detecting user's network addiction situation, for obtaining the identical complicated event that user to be measured carried out within a period of time, gather the generation number of times of above-mentioned identical complicated event, and according to the set frequency threshold value of user, select be greater than threshold value complicated event as frequent complicated event, reentry by generation distributed be used to describing behavioural characteristic of set that above-mentioned frequent complicated event forms, and be sent to data processing and detection module;

Sample Storehouse builds module: for adopting based on producing sub sample structure algorithm, frequent network addiction complicated event generation is counted the score, if score surpasses threshold value, save as the network addiction class, otherwise delete, and frequent non-network addiction complicated event is produced to the sub non-network addiction class that saves as; Or adopt the sample structure algorithm based on Emerging Pattern to calculate frequent complicated event generation, obtain generation the preservation of Emerging Pattern;

Data are processed and detection module: for frequent behavior generation to be detected is compared with the network addiction Sample Storehouse, are contained in Sample Storehouse if frequent complicated event to be detected produces attached bag, determine that it is network addiction, otherwise be non-network addiction, and the output judged result; Or frequent behavior generation to be detected is compared with Sample Storehouse, adopt the network addiction detection algorithm based on Emerging Pattern to calculate respectively its network addiction score and non-network addiction score, according to score, just judge classification under it;

Preventive intervention procedure module: for when the subscriber computer interbehavior being detected and be the network addiction behavior, send early warning, and limit this user by timer and can continue computed time range, 1～2 hour; If the overstepping the time limit scope, shut down computer.

Employing, based on the method that the network addiction pick-up unit of subscriber computer alternative events detects, comprises the following steps:

Step 1, gather mutual variable between a plurality of network addiction users and a plurality of non-network addiction user and computing machine as simple event, comprise computer CPU utilization rate, memory usage, unit interval left button number of times, unit interval number of pixels, network traffics and the operation process that right button number of times, unit interval keyboard number of taps, unit interval mouse move of clicking the mouse of clicking the mouse;

Step 2, each simple event is compared with threshold value separately respectively, if be more than or equal to threshold range, retain this simple event, then generate complicated events according to the whole simple event combined situation that retain; Otherwise continue to gather simple event; Described complicated event comprises that off-line sees video, sees video, real time strategy, the game of table trip class, browsing page, online chatting and down operation online;

The process that generates complicated event is as follows:

If CPU usage surpasses or equals threshold range 45%～55%, memory usage surpasses or equals threshold range 55%～65%, and surfing flow surpasses or equal threshold range 35～45MB, generates a complicated event of seeing online video;

If CPU usage surpasses or equals threshold range 45%～55%, memory usage surpasses or equals threshold range 55%～65%, and the operation process is multimedia player, generates the complicated event that an off-line is seen video;

If CPU usage surpasses or equals threshold range 45%～55%, memory usage surpasses or equals threshold range 55%～65%, the unit interval left button number of times of clicking the mouse surpasses or equals threshold range 25～35 times, the unit interval right button number of times of clicking the mouse surpasses or equals threshold range 10～20 times, the number of pixels that the unit interval mouse moves surpasses or equals 1550～1650 of threshold ranges, unit interval keyboard number of taps surpasses or equals threshold range 80～120 times, and the operation process is timely strategy game, generate a complicated event of playing real time strategy,

If CPU usage surpasses or equals threshold range 45%～55%, memory usage surpasses or equals threshold range 55%～65%, the unit interval left button number of times of clicking the mouse surpasses or equals threshold range 25～35 times, the number of pixels that the unit interval mouse moves surpasses or equals 1550～1650 of threshold ranges, and the operation process is the game of a table trip class, generate a complicated event of playing the game of table trip class;

If CPU usage surpasses or equals threshold range 45%～55%, the unit interval left button number of times of clicking the mouse surpasses or equals threshold range 25～35 times, the number of pixels that the unit interval mouse moves surpasses or equals 1550～1650 of threshold ranges, and the operation process is the game of a table trip class, generate the complicated event that another plays the game of table trip class;

The left button number of times surpasses or equals threshold range 25～35 times if the unit interval clicks the mouse, the number of pixels that the unit interval mouse moves surpasses or equals 1550～1650 of threshold ranges, and the operation process is browser, generate the complicated event of a browsing page;

The left button number of times surpasses or equals threshold range 25～35 times if the unit interval clicks the mouse, the number of pixels that the unit interval mouse moves surpasses or equals 1550～1650 of threshold ranges, surfing flow surpasses or equals threshold range 35～45MB, and the operation process is browser, generate the complicated event of another browsing page;

If the number of pixels that the unit interval mouse moves surpasses or equals 1550～1650 of threshold ranges, surfing flow surpasses or equals threshold range 35～45MB, and the operation process is browser, generates the complicated event of another browsing page;

If unit interval keyboard number of taps surpasses or equals threshold range 80～120 times, and the operation process is instant chat software, generates the complicated event of an online chat;

If the number of pixels that the unit interval mouse moves surpasses or equals 1550～1650 of threshold ranges, unit interval keyboard number of taps surpasses or equals threshold range 80～120 times, and the operation process is instant chat software, generate the complicated event of another online chat;

If surfing flow surpasses or equals threshold range 35～45MB, generate the complicated event of a downloaded data;

Step 3, the complicated event time of origin is carried out to extensive processing, soon be divided into 6:00～11:00,11:00～14:00,14:00～18:00,18:00～23:00, five time periods of 23:00～6:00 in one day, and will the duration carry out normalized, the duration that is about to complicated event take and carried out the rounding operation as unit in 10 minutes;

Step 4, obtain the identical complicated event carried out between the identical complicated event that carries out between a plurality of network addiction users and a plurality of non-network addiction user, gather the generation number of times of above-mentioned identical complicated event, and according to the set frequency threshold value of user, select be greater than threshold value complicated event as frequent network addiction complicated event and frequent non-network addiction complicated event, reentry by a plurality of generation that distribute be used to describing the user behavior feature of above-mentioned frequent network addiction set that complicated event forms, acquisition is by a plurality of generation that distribute be used to describing the user behavior feature of above-mentioned frequent non-network addiction set that complicated event forms, and be sent to Sample Storehouse and build module,

Step 5, employing count the score based on producing generation of sub sample structure algorithm to frequent network addiction complicated event, if score surpasses threshold value, save as the network addiction class, otherwise delete, and generation of frequent non-network addiction complicated event is saved as to non-network addiction class; Or adopt the sample collection algorithm based on Emerging Pattern to calculate frequent complicated event generation, obtain generation of Emerging Pattern and preserve;

Step 6, gather user to be measured within a period of time and the mutual variable between computing machine, and repeating step 2 is to step 3;

Step 7, obtain the identical complicated event that user to be measured carried out within a period of time, and gather the generation number of times of above-mentioned identical complicated event, and according to the set frequency threshold value of user, select be greater than threshold value complicated event as frequent complicated event, reentry by generation distributed be used to describing behavioural characteristic of set that above-mentioned frequent complicated event forms, and be sent to data processing and detection module;

Step 8, frequent behavior generation to be detected is compared with the network addiction Sample Storehouse, be contained in Sample Storehouse if frequent complicated event to be detected produces attached bag, determine that it is network addiction, otherwise be non-network addiction, and the output judged result; Or frequent behavior generation to be detected is compared with Sample Storehouse, adopt the network addiction detection algorithm based on Emerging Pattern to calculate respectively its network addiction score and non-network addiction score, judge both score height, frequent complicated event to be detected belongs to the high classification of score;

If it is the network addiction behavior that step 9 detects the subscriber computer interbehavior, adopts the preventive intervention procedure module to send early warning, and by timer, limit this user and can continue computed time range, 1～2 hour; If the overstepping the time limit scope, shut down computer.

The threshold value separately of the described simple event of step 2: computer CPU utilization rate span 45%～55%, memory usage span 55%～65%, unit interval the click the mouse right button number of times span 10～20 times of left button number of times span 25～35 times, unit interval of clicking the mouse, the number of pixels span 1550～1650 that unit interval keyboard number of taps span 80～120, unit interval mouse move, network traffics span 35～45MB.

The described employing of step 5 counts the score to frequent network addiction complicated event generation based on producing sub sample structure algorithm, is specially:

Step 5-1, according to user's request, determine the weight coefficient of complicated event type, guarantee the weight coefficient of real time strategy>see online video weight coefficient>weight coefficient>off-line of weight coefficient>browsing page that table trip class is played is seen the weight coefficient of the weight coefficient of the weight coefficient>online chatting of video>download, and weight coefficient adds up to 1;

Step 5-2, determine the complicated event time weight coefficient of extensive section according to user's request, guarantee the weight coefficient in weight coefficient>morning in weight coefficient>afternoon at weight coefficient>noon in the weight coefficient>evening at dawn, and weight coefficient adds up to 1;

Step 5-3, will produce each complicated event type weight coefficient, complicated event time extensive section weight coefficient and duration in son and multiply each other and try to achieve scoring, and each complicated event scoring summation will be obtained to the sub scoring of this generation;

If step 5-4 score surpasses threshold value, the threshold value span is 1～6, preserves, otherwise deletes.

The described employing of step 5 is calculated frequent complicated event generation based on the sample structure algorithm of Emerging Pattern, obtains generation of Emerging Pattern the preservation of classifying, and is specially:

Step 5-a, obtain and belong in frequent network addiction complicated event and do not belong to generation in frequent non-network addiction complicated event;

Step 5-b, obtain and do not belong in frequent network addiction complicated event and belong to generation in frequent non-network addiction complicated event;

Step 5-c, obtain and namely belong in frequent network addiction complicated event common generation belonged to again in frequent non-network addiction complicated event, and determine its support in frequent network addiction complicated event, namely occurrence rate, determine the support in frequent non-network addiction complicated event;

Step 5-d, calculating should produce sub rate of growth jointly in frequent network addiction complicated event, soon its support in frequent network addiction complicated event is divided by the support in frequent non-network addiction complicated event; Calculate again in frequent non-network addiction complicated event and should jointly produce sub rate of growth, be about to its support in frequent non-network addiction complicated event divided by the support in frequent network addiction complicated event;

The size of step 5-e, more above-mentioned two rate of growth, retain generation that rate of growth is greater than 1, deletes generation that rate of growth is less than 1;

Step 5-f, generation in frequent network addiction complicated event is got to union, generation in frequent non-network addiction complicated event is got to union, namely obtain generation of Emerging Pattern and preserve.

The described employing of step 8 is calculated respectively its network addiction score and non-network addiction score, score score (C, D based on the network addiction detection algorithm of Emerging Pattern _i) formula is as follows:

$\mathrm{Score}(C,D_{i|j})=\underset{X\∈\mathrm{RS}}{\mathrm{\Σ}}\frac{\mathrm{Gr}(X,D_{j|i},D_{i|j})}{\mathrm{Gr}(X,D_{j|i},D_{i|j})+\mathrm{Max}{\mathrm{Gr}}_{\mathrm{RS}}}\×{\mathrm{Sup}}_c\left(X\right)$

$+\underset{Y\&Element;\mathrm{<figure-callout\; id="1"\; label="WS"\; filenames="HDA0000368918860000041.png"\; state="\{\{state\}\}">WS</figure-callout>}}{\mathrm{\&Sigma;}}\frac{1}{\mathrm{Gr}(Y,D_{i|j},D_{j|i})+\mathrm{Min}{\mathrm{Gr}}_{\mathrm{WS}}}\&times;{\mathrm{Sup}}_c\left(Y\right),(i\&NotEqual;j)---\left(2\right)$

Wherein: D _i|jMean D _iSample Storehouse or D _jSample Storehouse, D _j|iMean D _jSample Storehouse or D _iSample Storehouse, i and j are Sample Storehouse class tag numbers, and X means D _iGeneration of Emerging Pattern, Y means D _jGeneration of Emerging Pattern; RS is the forward sample set of target class, the set namely had a positive effect, and WS is the reverse sample set of target class, namely plays the set of negative consequence; Gr (X, D _j|i, D _i|j) rate of growth of expression X from a class to another class; MaxGr _RSMean the maximum rate of growth threshold value in the target class set, RS means the forward sample set of target class, MinGr _WSMean the minimum rate of growth threshold value in the non-target class set, WS means the reverse sample set of target class, and C is complicated event to be sorted, Sup _c(X) mean the support of X in C, Sup _c(Y) mean the support of Y in C.

Advantage of the present invention:

A kind of pick-up unit of network addiction based on the subscriber computer alternative events of the present invention and method, the Internet access (as desk-top computer and notebook computer etc.) of commonly using by people, gather quantifiable man-machine interactive operation data, and utilize these data computational analysiss user internet behavior, thereby detect the user and whether suffer from network addiction, and this Internet access is control effectively; This patent detects the accuracy of network addiction can effectively avoid the error of existing detection method up to more than 85%, improves the accuracy detected; The present invention also can reduce testing cost, and the user can detect at any time, high for students in middle and primary schools' using value, effectively prevents and control the network addiction behavior, reduces the network addiction injury.

The accompanying drawing explanation

Fig. 1 is the structure drawing of device of an embodiment of the present invention;

Fig. 2 is the method flow diagram that the network addiction pick-up unit of an embodiment of the present invention detects;

Fig. 3 is the equivalence class of an embodiment of the present invention and produces sub-schematic diagram;

Fig. 4 is the efficiency test figure as a result of an embodiment of the present invention, and wherein, figure (a) be coordinate diagram working time, and scheming (b) is the memory headroom coordinate diagram;

Fig. 5 is the validity test figure as a result of an embodiment of the present invention, and wherein, figure (a) be the accuracy coordinate diagram, and figure (b) is the rate of missed diagnosis coordinate diagram, and scheming (c) is the misdiagnosis rate coordinate diagram.

Embodiment

A kind of pick-up unit of network addiction based on the subscriber computer alternative events, as shown in Figure 1, comprise simple event acquisition module, complicated event generation module, the time is extensive and normalized module, the frequent sub-acquisition module of behavior generation, Sample Storehouse build module, data processing and detection module and preventive intervention procedure module, wherein

Simple event acquisition module: be used to gathering user and computer interactive variable as simple event, comprise computer CPU utilization rate, memory usage, unit interval left button number of times, unit interval number of pixels, network traffics and the operation process that right button number of times, unit interval keyboard number of taps, unit interval mouse move of clicking the mouse of clicking the mouse, and above-mentioned input variable is sent to the complicated event generation module;

Wherein,

CPU is the computer core hardware component, CPU usage real-time change when the user moves different application, correspondingly, user's different computer operation behaviors, make its CPU usage correspondence different numerical ranges, simultaneously, this index also can be used for further inferring the type of user's complicated event.In embodiments of the present invention, by the monitoring of the task manager in computing machine current C PU utilization rate.

The monitoring of memory usage is similar to the monitoring effect of CPU usage, all can be used for judging that the user operates the behavior of computing machine, and similarly, this index also will be used to the complicated event type of reasoning user behavior.In embodiments of the present invention, by the current memory usage of the monitoring of the task manager in computing machine.

The left button number of times of clicking the mouse in unit interval, the data difference of different computer operation behaviors on this index is very obvious, for example, when the user carries out fairly large game operation, in unit interval, the mouse number of clicks is quite a lot of, according to statistics, can reach per minute hundred times.By contrast, when watching the operations such as film, video, only have per minute several times, so this index can obviously be distinguished the senior semantic behavior of user.In embodiments of the present invention, by the real-time listening mouse click event, obtain the number of times that in the unit interval, mouse is clicked.

Recording of the record of unit interval internal keyboard number of taps and mouse number of clicks is basically identical, can significantly show for the behavior that needs in a large number keyboard operation, and this index is also one of important indicator with differentiation complicated event of reasoning.In embodiments of the present invention, by the real-time listening keyboard event of knocking, obtain the number of times that the unit interval internal keyboard knocks.

Network traffics (comprising uplink traffic and downlink traffic) after the computing machine interconnection network, can effectively distinguish internet behavior and the machine behavior.When the user frequently used network, up or downlink traffic data were far away higher than the machine behavior, and this is significant to judging whether the user carries out internet behavior.In embodiments of the present invention, by the statistical information of Ethernet in the call instruction prompt, obtain the network traffics of computing machine.

All programs of moving in computing machine all can show in the computer task manager, but a lot of process has nothing to do with network addiction, such as the computer operating system process etc., can monitor.And some typical processes relevant with network addiction, such as, under browser process (IE browser process, Google browser process, search dog browser process etc.), game process (Age of Empires game, three states kill game etc.), line, see video software (Windows multimedia player), Instant Messenger (IM) software (QQ, Skype, MSN etc.) all needs the emphasis monitoring.Simultaneously, the program of different its operations of network addiction user also may be different, and for example, for game network addiction user, it may move more game process, can more accurately judge the senior complex behavior event of user so monitor this.

Complicated event generation module: for each simple event is compared with threshold value separately respectively, if be more than or equal to threshold range, retain this simple event, then generate complicated events according to the whole simple event combined situation that retain; Otherwise continue to gather simple event; Described complicated event comprises that off-line sees video, sees video, real time strategy, the game of table trip class, browsing page, online chatting and down operation online;

Extensive and normalized module of time: arrange for the complicated event that each user day is done, and the complicated event time of origin is carried out to extensive processing, be about to be divided in one day several time periods; To the duration carry out normalized, the duration that is about to complicated event is carried out the rounding operation; And the complicated event after processing is sent to the sub-acquisition module of frequent behavior generation;

The frequent sub-acquisition module of behavior generation: when setting up Sample Storehouse, for obtaining between a plurality of network addiction users the identical complicated event carried out, gather the generation number of times of above-mentioned identical complicated event, and according to the set frequency threshold value of user, select be greater than threshold value complicated event as frequent network addiction complicated event, generation that the set that consists of above-mentioned frequent network addiction complicated event of reentrying distributes be used to describing the user behavior feature, and be sent to Sample Storehouse and build module; For obtaining the identical complicated event carried out between a plurality of non-network addiction users, gather the generation number of times of above-mentioned identical complicated event, and according to the set frequency threshold value of user, select be greater than threshold value complicated event as frequent non-network addiction complicated event, reentry by generation distributed be used to describing the user behavior feature of above-mentioned frequent non-network addiction set that complicated event forms, and be sent to Sample Storehouse structure module;

When detecting user's network addiction situation, for obtaining the identical complicated event that user to be measured carried out within a period of time, gather the generation number of times of above-mentioned identical complicated event, and according to the set frequency threshold value of user, select be greater than threshold value complicated event as frequent complicated event, reentry by generation distributed be used to describing behavioural characteristic of set that above-mentioned frequent complicated event forms, and be sent to data processing and detection module;

Sample Storehouse builds module: for adopting based on producing sub sample structure algorithm, frequent network addiction complicated event generation is counted the score, if score surpasses threshold value, save as the network addiction class, otherwise delete, or adopt EPBSBA algorithm (sample based on Emerging Pattern builds algorithm) to produce son to frequent complicated event and calculate, generation the classification that obtain Emerging Pattern are preserved;

Data are processed and detection module: for frequent behavior generation to be detected is compared with the network addiction Sample Storehouse, are contained in Sample Storehouse if frequent complicated event to be detected produces attached bag, determine that it is network addiction, otherwise be non-network addiction, and the output judged result; Or frequent behavior generation to be detected is compared with Sample Storehouse, adopt EPBPDA algorithm (based on the network addiction detection algorithm of Emerging Pattern) to calculate respectively its network addiction score and non-network addiction score, according to score, just judge classification under it;

Preventive intervention procedure module: for when the subscriber computer interbehavior being detected and be the network addiction behavior, this device can send early warning, warning the user to have the network addiction symptom, and by timer, limit this user and can continue computed time range, is generally 1-2 hour; In case surpass this time limit scope, will further start software service and shut down computer, to stop this user, use computing machine, thereby realize the effective intervention to network addiction.

The method that employing detects based on the network addiction pick-up unit of subscriber computer alternative events, process flow diagram as shown in Figure 2, comprises the following steps:

Mutual variable between step 1, a plurality of network addiction users of collection and a plurality of non-network addiction user and computing machine is as simple event, as shown in table 1, comprise computer CPU utilization rate, memory usage, unit interval left side number of times, unit interval right side number of pixels, network traffics and the operation process that number of times, unit interval keyboard number of taps, unit interval mouse move of clicking the mouse of clicking the mouse;

Table 1

Step 2, each simple event is compared with threshold value separately respectively, if be more than or equal to threshold range, retain this simple event, then generate complicated events according to the whole simple event combined situation that retain; Otherwise continue to gather simple event; Described complicated event comprises that off-line sees video, sees video, real time strategy, the game of table trip class, browsing page, online chatting and down operation online;

The type of complicated event is as shown in table 2,

Table 2

The process that generates complicated event is as follows:

If CPU usage surpasses or equals threshold range 45%～55%, memory usage surpasses or equals threshold range 55%～65%, and surfing flow surpasses or equal threshold range 35～45MB, generates a complicated event of seeing online video;

If CPU usage surpasses or equals threshold range 45%～55%, memory usage surpasses or equals threshold range 55%～65%, and the operation process is multimedia player, generates the complicated event that an off-line is seen video;

If CPU usage surpasses or equals threshold range 45%～55%, memory usage surpasses or equals threshold range 55%～65%, the unit interval left button number of times of clicking the mouse surpasses or equals threshold range 25～35 times, the unit interval right button number of times of clicking the mouse surpasses or equals threshold range 10～20 times, the number of pixels that the unit interval mouse moves surpasses or equals 1550～1650 of threshold ranges, unit interval keyboard number of taps surpasses or equals threshold range 80～120 times, and the operation process is timely strategy game, generate a complicated event of playing real time strategy,

If CPU usage surpasses or equals threshold range 45%～55%, memory usage surpasses or equals threshold range 55%～65%, the unit interval left button number of times of clicking the mouse surpasses or equals threshold range 25～35 times, the number of pixels that the unit interval mouse moves surpasses or equals 1550～1650 of threshold ranges, and the operation process is the game of a table trip class, generate a complicated event of playing the game of table trip class;

If CPU usage surpasses or equals threshold range 45%～55%, the unit interval left button number of times of clicking the mouse surpasses or equals threshold range 25～35 times, the number of pixels that the unit interval mouse moves surpasses or equals 1550～1650 of threshold ranges, and the operation process is the game of a table trip class, generate the complicated event that another plays the game of table trip class;

The left button number of times surpasses or equals threshold range 25～35 times if the unit interval clicks the mouse, the number of pixels that the unit interval mouse moves surpasses or equals 1550～1650 of threshold ranges, and the operation process is browser, generate the complicated event of a browsing page;

The left button number of times surpasses or equals threshold range 25～35 times if the unit interval clicks the mouse, the number of pixels that the unit interval mouse moves surpasses or equals 1550～1650 of threshold ranges, surfing flow surpasses or equals threshold range 35～45MB, and the operation process is browser, generate the complicated event of another browsing page;

If the number of pixels that the unit interval mouse moves surpasses or equals 1550～1650 of threshold ranges, surfing flow surpasses or equals threshold range 35～45MB, and the operation process is browser, generates the complicated event of another browsing page;

If unit interval keyboard number of taps surpasses or equals threshold range 80～120 times, and the operation process is instant chat software, generates the complicated event of an online chat;

If the number of pixels that the unit interval mouse moves surpasses or equals 1550～1650 of threshold ranges, unit interval keyboard number of taps surpasses or equals threshold range 80～120 times, and the operation process is instant chat software, generate the complicated event of another online chat;

If surfing flow surpasses or equals threshold range 35～45MB, generate the complicated event of a downloaded data;

For example, when following simple event being detected: CPU usage is greater than 50%, memory usage is greater than 60%, 100 beats/mins of mouse numbers of clicks in per minute (drawing after the pixel count COMPREHENSIVE CALCULATING moved according to mouse left click, right click number of times and mouse), unit interval internal keyboard number of taps is greater than 90 beats/mins, monitoring the application program of moving is that three states kill game sanguosha.exe, and network traffics are greater than 40MB/ minute, generate a complicated event of playing real time strategy.

Step 3, the complicated event time of origin is carried out to extensive processing, soon be divided into 6:00～11:00,11:00～14:00,14:00～18:00,18:00～23:00, five time periods of 23:00～6:00 in one day, and will the duration carry out normalized, the duration that is about to complicated event take and carried out the rounding operation as unit in 10 minutes;

In the complicated event generative process, because diversity constantly occurs event, can produce a large amount of different time points, cause the generation of too much complicated event, i.e. complicated event fragmentation problem.In fact, a lot of different events of time of origin there is no essential distinction semantically, such as, " 8 a.m. online 47 minutes " and " morning, 9 online were 52 minutes ", be all online in the morning, and the start time is similar, duration is also close, therefore from semantic rationality angle, can regard these two complicated events as an event, the extensive processing operation of time of Here it is complicated event.Table 3 has listed the time of origin scope after extensive processing.

As can be seen from Table 3, by 5 level sections of one day extensive one-tenth, be respectively:: 6:00 AM is to point in the mornings 11 period in the morning; Period at noon: at 11 in the morning is to 2 pm; Period in the afternoon: 2 pm to evenings 6 point; : at 6 in evening is to 11 points at night the period in the evening; Period at dawn: 11 are arrived second day point in mornings 6 at night.Adopt this extensive strategy can effectively reduce the time fragmentation, based on above method, as long as event occurs constantly to be positioned at wherein certain extensive level, just it was attributed to for certain time period.

In addition, consider that the duration has diverse problems equally, in fact differed also not obvious in namely 47 minutes and 52 minutes, therefore when generation is constantly identical, they can be regarded as to same event, this just need to carry out the normalization operation to the duration, namely by rounding (Round) technology and according to the principle that rounds up, the duration standard is turned to integer form, now, 47 minutes and 52 minutes just all rounding be 50 minutes, facilitated the further processing of complicated event.

In the embodiment of the present invention, monitor the subscriber computer CPU usage in one minute and be greater than 60%, memory usage is greater than 50%, and the program of moving is Windows multimedia player program, and this user just sees video at off-line.If 12:00～12:46 infers continuously in this time of 46 minutes that user's off-line sees video at noon, utilize so the extensive and normalization processing method of complicated event, just produced a complicated event, namely noon, off-line was seen video 50 minutes, note is Bc50.

Step 4, obtain the identical complicated event carried out between the identical complicated event that carries out between a plurality of network addiction users and a plurality of non-network addiction user, gather the generation number of times of above-mentioned identical complicated event, and according to the set frequency threshold value of user, select be greater than threshold value complicated event as frequent network addiction complicated event and frequent non-network addiction complicated event, reentry by a plurality of generation that distribute be used to describing the user behavior feature of above-mentioned frequent network addiction set that complicated event forms, acquisition is by a plurality of generation that distribute be used to describing the user behavior feature of above-mentioned frequent non-network addiction set that complicated event forms, and be sent to Sample Storehouse and build module,

In the embodiment of the present invention, take and gather the network addiction user and be example, after gathering 10 users' that network addiction arranged certain day computer interactive behavior simple event data, show that by the complicated event reasoning behavior sequence is as follows:

Network addiction user 1:{Bc60, Ce80, Ae70, Ed80, Be100, Ab100, Eb30};

Network addiction user 2:{Bc60, Ce80, Be100, Bb40, Ga20, Eb30, Ac20};

Network addiction user 3:{Bc60, Ce80, Ae70, Ed80, Da30, Bb40};

Network addiction user 4:{Ae70, Bc60, Ed80, Be100, Ab100};

Network addiction user 5:{Ae70, Bc60, Ed80, Be100, Ab100, Ga20, Eb30};

Network addiction user 6:{Ae70, Ed80, Da30, Bb40, Fa20};

Network addiction user 7:{Be100, Ab100, Bc60, Ce80, Da30};

Network addiction user 8:{Be100, Ab100, Ga20, Ad60};

Network addiction user 9:{Ab100, Bc60, Bb40, Fa20, Ad60};

Network addiction user 10:{Be100, Ed80, Da30, Eb30, Ac20}.

Utilize the sub-acquisition algorithm of frequent behavior generation to obtain above-mentioned 10 users that network addiction arranged generation (Generator) that day the computer interactive behavior sequence is corresponding as follows:

Produce sub-G1:<Ab100, Be100 >

Produce sub-G2:<Ab100, Bc60 >

Produce sub-G3:<Ed80, Ae70 >

Produce sub-G4:<Ce80, Bc60 >

Produce sub-G5:<Ed80, Ab100 >

Produce sub-G6:<Ae70, Be100 >

Produce sub-G7:<Ae70, Bc60 >

Produce sub-G8:<Ae70, Ab100 >

Produce sub-G9:<Ce80, Be100 >

Produce sub-G10:<Be100 >

Produce sub-G11:<Bc60 >

Produce sub-G12:<Ab100 >

Produce sub-G13:<Ed80 >

Produce sub-G14:<Ae70 >

Produce sub-G15:<Ce80 >

Obtain the generation submethod as follows:

Setting is input as D and MinSup, and wherein, D represents normalized complicated event database, and MinSup is the support threshold value (user sets up on their own as required) of frequent behavior generation that will obtain, and Output rusults is that FG(is frequent behavior generation subclass).

The obtaining step of frequent behavior generation is as follows:

1) each in scanning complicated event database D, generating item collection set F, record each number of times occurred in database (being support) simultaneously, and by support descending sort item collection set F.

2) item collection set F is built to the FP-Tree tree.

3) from the item with minimum support, start access (namely the backward according to the item collection item collection set F visits), scanning complicated event database is also set up its condition database.

4) choose each and the power set thereof in condition database, judge according to producing sub-definite whether it is to produce son.If so, then judge whether that further support produces with this proper subclass that sub support is identical, if exist, delete this and produce son, produce son and deposit frequent behavior generation subclass FG in otherwise retain this, finally export FG.

Be directed to and produce being described as follows of son:

All combinations of the complicated event that appearance and occurrence number are identical in identical complicated event sequence, be called frequent complicated event equivalence class.Producing son is the most simply meaning of this equivalence class.If produce sub-behavior, occur, just mean that under it all in equivalence class follow behavior all can occur, therefore only with producing, subly mean that its corresponding equivalence class gets final product.

Table 4

Table 5

Suppose that a and c mean that respectively 9 online played games 60 minutes, 11 online shopping 40 minutes.Equivalence class a, and in ac}, a is the sub-behavior of ac, can say that therefore as long as a occurs, ac is certain generation just, ac means with regard to available a so, so equivalence class just only means to get final product with a.

All equivalence classes in table 5 as shown in Figure 3.In Fig. 3, it is 2 equivalence class that the black box line has partly shown frequent degree, and the behavior set that this equivalence class comprises is { ab, ae, abc, abe, ace, abce}, its corresponding generation is that { it means as long as this two joint action of ab and ae occurs just can significantly represent that in set, all behaviors occur for ab, ae}, subsequent treatment needs only for this and produces sub corresponding behavior, and needn't process all behaviors in equivalence class.

Step 5, employing count the score to frequent network addiction complicated event generation based on producing sub sample structure algorithm, if score surpasses threshold value, classify and preserve, otherwise deletion, and frequent non-network addiction complicated event generation is preserved; Or adopt the EPBSBA algorithm to produce son to frequent complicated event and calculate, generation the classification that obtain Emerging Pattern are preserved;

Employing counts the score to frequent network addiction complicated event generation based on producing sub sample structure algorithm, is specially:

Step 5-1, according to user's request, determine the weight coefficient of complicated event type, guarantee the weight coefficient of real time strategy>see online video weight coefficient>weight coefficient>off-line of weight coefficient>browsing page that table trip class is played is seen the weight coefficient of the weight coefficient of the weight coefficient>online chatting of video>download, and weight coefficient adds up to 1;

In the embodiment of the present invention, complicated event type weight coefficient is as shown in table 6:

Table 6

Step 5-2, determine the complicated event time weight coefficient of extensive section according to user's request, guarantee the weight coefficient in weight coefficient>morning in weight coefficient>afternoon at weight coefficient>noon in the weight coefficient>evening at dawn, and weight coefficient adds up to 1;

In the embodiment of the present invention, the complicated event time, extensive section weight coefficient was as shown in table 7:

Table 7

Step 5-3, will produce each complicated event type weight coefficient, complicated event time extensive section weight coefficient and duration in son and multiply each other and try to achieve scoring, and each complicated event scoring summation will be obtained to the sub scoring of this generation;

A user's frequent computer interactive behavior can also not all be had the network addiction feature but these generations are sub, so need to further be filtered out network addiction behavior generation by a plurality of frequent behavior generation subrepresentations, so that the behavior of classification network addiction.

This algorithm adopts the marking mode to select network addiction behavior generation, and it gives a mark formula as shown in Equation (1), wherein, and parameter

Represent respectively behavior type, time of origin and the duration of k complicated event in i behavior generation subclass, this complicated event implication with front is identical, and provides weight coefficient corresponding to these parameters by the user;

$\mathrm{Score}\left(G_i\right)=\underset{k=1}{\overset{n}{\mathrm{\&Sigma;}}}\mathrm{weight}\left({\mathrm{Type}}_k^i\right)\&times;\mathrm{weight}\left(t_k^i\right)\&times;{\mathrm{dur}}_k^i---\left(1\right)$

Wherein, G _iBe i and produce son, n is G _iThe complicated event number comprised,

For G _iIn the event type weight coefficient of k complicated event;

For G _iIn extensive section weight coefficient of event time of k complicated event;

For G _iIn duration of k complicated event.

If step 5-4 score surpasses threshold value 4, preserve, otherwise delete.

EP is the abbreviation of Emerging Pattern (Emerging Pattern), comprise JEP(jump Emerging Pattern) and the eEP(Essential Emerging Patterns), Emerging Pattern EP is a kind of new contrast mining mode, it is the item collection from a data set to another one data set support generation marked change, its can the target acquisition class and non-target class between the differentiation feature, therefore based on EP, can set up the sorter that classifying quality is good.

Adopt the EPBSBA algorithm to produce son to frequent complicated event and calculate, generation the classification that obtain Emerging Pattern are preserved; This algorithm filters out respectively the JEP(jump Emerging Pattern of network addiction class and non-network addiction class) and the eEP(Essential Emerging Patterns), wherein the former tries to achieve by difference set, and the latter tries to achieve by union.Then, according to EP threshold value given in advance (the supposition threshold value is 1), filter out EP and calculate corresponding rate of growth.Next, then see in the screening set whether the subset comprised is mutually arranged, if having, need further to carry out deletion action; If not then finish.

According to minimum support threshold value MinSup(user, make by oneself), call frequent behavior generation subalgorithm, to network addiction and non-network addiction two class databases, (be D ₁And D ₂) obtain respectively and produce subclass FG ₁And FG ₂.

In the embodiment of the present invention, suppose MinSup=3/10, filter out 9 sub-G of network addiction behavior generation ₃, G ₄, G ₇, G ₁₀, G ₁₁, G ₁₂, G ₁₃, G ₁₄And G ₁₅, and form initial network addiction class Generator storehouse, as shown in the Generator under network addiction class label in table 8.Because the generation of non-network addiction class Generator is identical with the production method of network addiction class Generator, difference only is by gathering the computer interactive data acquisition of normal users, to repeat no more herein.As shown in supposing under Generator network addiction class as non-as table 8 label of non-network addiction class, this class libraries is that the EPBPDA algorithm is used, and the GBPDA algorithm is not used this class libraries.Digitized representation support in the bracket of Generator back, this is only useful to the EPBPDA algorithm, and the GBPDA algorithm is not used this index.

Table 8

JEP asks for:

JEP is that rate of growth is the EP of ∞.Obtaining the sub-FG of frequent behavior generation that produces network addiction class and non-network addiction class ₁And FG ₂After, by the difference set computing of gathering, can draw the JEP between two class databases, namely for network addiction data D ₁, FG ₁-FG ₂Results set mean database D ₁To D ₂JEP because FG ₁-FG ₂Difference set is illustrated in FG ₁Middle existence but at FG ₂Non-existent generation, therefore, FG ₁-FG ₂Element in difference set is at D ₁In no matter have much supports, it is at D ₂In support one be decided to be zero because D ₂Do not comprise this element.Further, according to rate of growth definition, difference set FG ₁-FG ₂In element from D ₂To D ₁Rate of growth be ∞, therefore difference set FG ₁-FG ₂In element one be decided to be D ₁To D ₂JEP, be denoted as JEP _D1/D2.In like manner, FG ₁-FG ₂Difference set mean D ₂To D ₁JEP, be denoted as JEP _D2/D1.

EEP asks for:

EEP is the EP that is greater than rate of growth threshold value 1.At first, to frequent behavior generation subclass FG ₁And FG ₂Cap.Then, each of occuring simultaneously is judged to whether its rate of growth is greater than or equal to given rate of growth threshold value MinGr, if satisfy condition, deposits in Candidate Set.Next, judge in Candidate Set whether the subset comprised is mutually arranged, if having, get its smallest subset and delete its superset, if not then Candidate Set not operated.So the element comprised in final Candidate Set is exactly eEP.

EP asks for.Obtain respectively network addiction D ₁With non-network addiction database D ₂EEP and the union of JEP, i.e. D ₁EP be eEP and JEP _D1/D2Also, D ₂EP be eEP and JEP _D2/D1Also.

Concrete steps are as follows:

Step 5-a, obtain generation that belongs to frequent network addiction complicated event and do not belong to frequent non-network addiction complicated event;

The JEP of network addiction class _PIUFor:

D1-D2={<Be100>,<Ab100>,<Bc60,Ce80>}

Step 5-b, obtain generation that does not belong to frequent network addiction complicated event and belong to frequent non-network addiction complicated event;

The JEP of non-network addiction class _NPIUFor:

D ₂-D ₁={<Ga40>,<Fe40>,<Ae70,Fe40>}

Step 5-c, obtain and namely belong to common generation that frequent network addiction complicated event belongs to again frequent non-network addiction complicated event, and determine its support in frequent network addiction complicated event, namely occurrence rate, determine the support in frequent non-network addiction complicated event;

EEP _PIU(network addiction class eEP)=eEP _NPIU(non-network addiction class eEP) is:

D1∩D2={<Ae70>,<Bc60>,<Ce80>,<Ed80>,<Ae70,Ed80>,<Ae70,Bc60>}

Support and the support in frequent non-network addiction complicated event of each frequent complicated event in frequent network addiction complicated event, (percentage in bracket) as shown in table 8.

Step 5-d, calculating should produce sub rate of growth jointly in frequent network addiction complicated event, soon its support in frequent network addiction complicated event is divided by the support in frequent non-network addiction complicated event; Calculate again in frequent non-network addiction complicated event and should jointly produce sub rate of growth, be about to its support in frequent non-network addiction complicated event divided by the support in frequent network addiction complicated event;

Take<Bc60 [7/6.5] be example, due to<Bc60 > support in the network addiction class is 70%, and the support in non-network addiction class is 65%, so its rate of growth is 7/6.5, and the rate of growth of other EP also can be tried to achieve respectively by this, repeats no more herein.

The size of step 5-e, more above-mentioned two rate of growth, retain generation that rate of growth is greater than 1, deletes generation that rate of growth is less than 1;

According to EP given in advance _PIUThreshold value (the supposition threshold value is 1) filters out network addiction class (eEP _PIU) and calculate corresponding rate of growth, the selection result be<Bc60>[7/6.5],<Ae70, Ed80>[1.5], the numeral rate of growth in square bracket wherein.

See again in the screening set whether the subset comprised is mutually arranged, if having, delete; If not then finish.Because this gathers the subset mutually do not comprised, so finish.

Therefore, the final eEP of network addiction class _PIU=<Bc60>[7/6.5],<Ae70, Ed80>[1.5]>, the minimum threshold of its corresponding rate of growth and max-thresholds are respectively 7/6.5 and 1.5.

Non-network addiction class is in like manner as follows:

According to EP given in advance _NPIUThe eEP of threshold value (the supposition threshold value is 1) the non-network addiction class of screening _NPIU, draw<Ae70,<Ce80>,<Ed80>,<Ae70, Bc60>.

Due in screening set<Ae70 be<Ae70 Bc60 subset, need deletion<Ae70, Bc60 >, so

eEP _NPIU={<Ae70>[90%/50%=1.6],<Ce80>[70%/40%=1.75],<Ed80>[70%/55%=7/5.5]}

Therefore, in non-network addiction class, minimum threshold and the max-thresholds of rate of growth is respectively 7/5.5 and 1.75.

Step 5-f, generation in frequent network addiction complicated event is got to union, generation in frequent non-network addiction complicated event is got to union, generation the classification that namely obtain Emerging Pattern are preserved.

Step 6, gather user to be measured within a period of time and the mutual variable between computing machine, and repeating step 2 is to step 3;

The internet behavior sequence in one week of user to be detected collected is as follows:

Monday: { Be100, Ab100, Bc60, Ae70, Db90, Fe40, Da50};

Tuesday: { Ed80, Ab100, Ee30, Fd30};

Wednesday: { Be100, Ed80, Bc60, Ae70, Db90, Fe40}

Thursday: { Cc30, Da40};

Friday: { Be100, Ce20};

Saturday: { Fa90, Ad20};

Sunday: { Be100, Ab100, Ed80, Bc60, Ae70, Db90, Fe40, Ge60, Aa70};

Step 7, obtain the identical complicated event that user to be measured carried out within a period of time, and gather the generation number of times of above-mentioned identical complicated event, and according to the set frequency threshold value of user, select be greater than threshold value complicated event as frequent complicated event, reentry by generation distributed be used to describing behavioural characteristic of set that above-mentioned frequent complicated event forms, and be sent to data processing and detection module;

Step 8, frequent behavior generation to be detected is compared with the network addiction Sample Storehouse, be contained in Sample Storehouse if frequent complicated event to be detected produces attached bag, determine that it is network addiction, otherwise be non-network addiction, and the output judged result; Or frequent behavior generation to be detected is compared with Sample Storehouse, adopt the EPBPDA algorithm to calculate respectively its network addiction score and non-network addiction score, judge both score height, frequent complicated event to be detected belongs to the high classification of score;

Two kinds of network addiction mode detection algorithms have been proposed, namely based on producing sub PIU detection algorithm (Generator-Based PIU Detecting Algorithm-GBPDA) and based on the PIU detection algorithm (EP-Based PIU Detecting Algorithm-EPBPDA) of EP in this patent embodiment.

The GBPDA algorithm:

Behavior event to be detected is scanned, if the behavior event comprise in database any one produce sub-Generator, just judge that behavior to be detected is that the network addiction behavior is arranged.The value of considering the duration is larger, and behavior to be detected is that the possibility of network addiction behavior is just larger, therefore, and for the complicated event CE in behavior sequence to be detected _m(type _m, t _m, dur _m) and Generator in complicated event CE _n(type _n, t _n, dur _n), if type _m=type _n, t _m=t _n, and dur _m>=dur _n, so still think CE _mWith CE _nIt is same complicated event.

In the embodiment of the present invention, scan the frequent item set of all internet behavior sequences of user one to be detected, getting the support threshold value here is 3/7, and frequent item set is { Be100, Ab100, Bc60, Ae70, Db90, Fe40} so.Find that its of comprising at least in the network addiction class produces son, namely<Be100 >, according to GBPDA algorithm network addiction decision principle, as long as of namely comprising in network addiction behavior pattern storehouse produces son, just judge that it has the network addiction behavior, thus this behavior final decision to be detected its belong to the network addiction behavior.

The EPBPDA algorithm:

After obtaining JEP and eEP, calculate respectively the score value of network addiction class and non-network addiction class, then compare, select the last judged result of score value great thing.

Score Score (C, D _i|j) formula is as follows:

$\mathrm{Score}(C,D_{i|j})=\underset{X\&Element;\mathrm{RS}}{\mathrm{\&Sigma;}}\frac{\mathrm{Gr}(X,D_{j|i},D_{i|j})}{\mathrm{Gr}(X,D_{j|i},D_{i|j})+\mathrm{Max}{\mathrm{Gr}}_{\mathrm{RS}}}\&times;{\mathrm{Sup}}_c\left(X\right)$

$+\underset{Y\&Element;\mathrm{<figure-callout\; id="1"\; label="WS"\; filenames="HDA0000368918860000041.png"\; state="\{\{state\}\}">WS</figure-callout>}}{\mathrm{\&Sigma;}}\frac{1}{\mathrm{Gr}(Y,D_{i|j},D_{j|i})+\mathrm{Min}{\mathrm{Gr}}_{\mathrm{WS}}}\&times;{\mathrm{Sup}}_c\left(Y\right),(i\&NotEqual;j)---\left(2\right)$

Wherein: i and j are Sample Storehouse class tag numbers, D _i, D _jAre all Sample Storehouses, are generalized expression, distinguished with subscript i|j or j|i.Note in this patent, only having 2 class Sample Storehouses, i.e. network addiction class Sample Storehouse and non-network addiction class Sample Storehouse, be therefore better distinguish the two, use D ₁Mean the network addiction class libraries, use D ₂Mean non-network addiction storehouse.X means D ₁Generation of Emerging Pattern, Y means D ₂Generation of Emerging Pattern; RS is the forward sample set of target class, the set namely had a positive effect, and WS is the reverse sample set of target class, namely plays the set of negative consequence; Gr (X, D _j|i, D _i|j) meaning the rate of growth of X from a class to another class, this factor place, front and back by decollator " | " sequentially determines.Such as, Gr (X, D ₂, D ₁) mean that X is from D ₂To D ₁Rate of growth, Gr (X, D ₁, D ₂) mean that X is from D ₁To D ₂Rate of growth; MaxGr _RSMean the maximum rate of growth threshold value in the target class set, MinGr _WSMean the minimum rate of growth threshold value in the non-target class set, C is complicated event to be sorted, Sup _c(X) mean the support of X in C, Sup _c(Y) mean the support of Y in C.

If regard sample C to be detected as RS, namely target class, utilize first in formula (2) to count the score; If regard C as WS, namely non-target class, utilize second in formula (2) to count the score.Wherein, first in formula (2) $\underset{X\&Element;\mathrm{RS}}{\mathrm{\&Sigma;}}\frac{\mathrm{Gr}(X,D_{j|i},D_{i|j})}{\mathrm{Gr}(X,D_{j|i},D_{i|j})+\mathrm{Max}{\mathrm{Gr}}_{\mathrm{RS}}}\&times;{\mathrm{Sup}}_c\left(X\right),$ Not only provided eEP and JEP to marking contribution, parameter MaxGr also lay special stress on the contribution of JEP.Meanwhile, the EP of non-target class belongs to target class for sample C and also has contribution.For C, whether belong to D when judging C ₁During class, D ₂EP in class is Y, also can give certain contribution.When in C, comprising Y, can judge C and belong to D ₁The probability of class is 1/ (Gr (X, D ₂, D ₁)+1), as Gr (Y, D ₂, D ₁) when larger, the contribution margin of Y very I to ignore, but as Gr (Y, D ₂, D ₁) meeting on the basis of minimum threshold and hour, for judgement C, belonging to D ₁Can embody larger contribution, therefore need to consider the impact that this factor is brought, consider simultaneously the difference of common EP and JEP, in formula (2) second

The contribution margin that has meaned Y.Therefore, formula (2) is the result considered.

In the embodiment of the present invention, from the internet behavior sequence in this one week of user to be detected, obtaining Generator and corresponding support thereof, namely

G _C={<Be100>(50%),<Ab100>(60%),<Bc60>(45%),<Ae70>(30%),<Ae70,Fe40>(50%)}。

The JEP of class C to be detected obtains as follows:

JEP _PIU-C={<Be100>(50%),<Ab100>(60%)}

JEP _NPIU-C={<Ae70,Fe40>(50%)}

Due to EP threshold value=1, therefore in generation of class C to be detected, the eEP set of network addiction class and non-network addiction class is respectively:

eEP _PIU-C={<Bc60>(45%)}

eEP _NPIU-C={<Ae70>(30%)}

Therefore, the network addiction class of class to be detected and non-network addiction class EP collection and be respectively:

EP _PIU-C={<Be100>(50%),<Ab100>(60%),<Bc60>(45%)}

EP _NPIU-C={<Ae70,Fe40>(50%),<Ae70>(30%)}

Front has been tried to achieve the MaxGr of network addiction class EP _RS=MaxGr _D1=1.5, MinGr _WS=MinGr _D2=7/6.5; The MaxGr of non-network addiction class EP _RS=MarGr _D2=1.75, MinGr _WS=MinGr _D1=7/5.5.

Below, calculate respectively each generation of user behavior to be detected at network addiction class D ₁With non-network addiction class D ₂Score.

1) because<Be100 (50%) and<Ab100 (60%) be network addiction class D ₁The jump Emerging Pattern, for network addiction class D ₁Be X, namely belong to forward collection and RS, for non-network addiction class D ₂Be Y, namely belong to reverse set WS, therefore have:

Gr(<Be100>,D ₂,D ₁)=∞，Sup _c(<Be100>)=50%

$\mathrm{Score}(<\mathrm{Be}100>,D1)=\lim \frac{\&infin;}{\&infin;+\mathrm{<figure-callout\; id="1"\; label="Max\; Gr\; D"\; filenames="HDA0000368918860000041.png"\; state="\{\{state\}\}">Max</figure-callout>}{\mathrm{Gr}}_D{1}_{}}\&times;0.5=\lim \frac{\&infin;}{\&infin;+1.5}\&times;0.5=1\&times;0.5$

$\mathrm{Score}(<\mathrm{Be}100>,D_2)=\mathrm{<figure-callout\; id="1"\; label="lim"\; filenames="HDA0000368918860000041.png"\; state="\{\{state\}\}">lim</figure-callout>}\frac{1}{\&infin;+\mathrm{Min}{\mathrm{Gr}}_{D2}}\&times;0.5=\mathrm{<figure-callout\; id="1"\; label="lim"\; filenames="HDA0000368918860000041.png"\; state="\{\{state\}\}">lim</figure-callout>}\frac{1}{\&infin;+7/6.5}\&times;0.5=0\&times;0.5$

Gr(<Ab100>,D ₂,D ₁)=∞，Sup _c(<Ad100>)=60%

$\mathrm{Score}(<\mathrm{<figure-callout\; id="100"\; label="Ab"\; filenames="HDA0000368918860000032.png"\; state="\{\{state\}\}">Ab</figure-callout>}100>,D_1)=\lim \frac{\&infin;}{\&infin;+\mathrm{<figure-callout\; id="1"\; label="Max\; Gr\; D"\; filenames="HDA0000368918860000041.png"\; state="\{\{state\}\}">Max</figure-callout>}{\mathrm{Gr}}_D{1}_{}}\&times;0.6=\lim \frac{\&infin;}{\&infin;+1.5}=1\&times;0.6$

$\mathrm{Score}(<\mathrm{<figure-callout\; id="100"\; label="Ab"\; filenames="HDA0000368918860000032.png"\; state="\{\{state\}\}">Ab</figure-callout>}100>,D_2)=\mathrm{<figure-callout\; id="1"\; label="lim"\; filenames="HDA0000368918860000041.png"\; state="\{\{state\}\}">lim</figure-callout>}\frac{1}{\&infin;+\mathrm{Min}{\mathrm{Gr}}_{D2}}\&times;0.6=\mathrm{<figure-callout\; id="1"\; label="lim"\; filenames="HDA0000368918860000041.png"\; state="\{\{state\}\}">lim</figure-callout>}\frac{1}{\&infin;+7/6.5}\&times;0.6=0\&times;0.6$

2) because<Bc60 (45%) be generation of network addiction class D1, D1 is X for the network addiction class, namely belongs to forward collection and RS, is Y for non-network addiction class D2, namely belongs to reverse set WS, so has:

Gr(<Bc60>,D ₂,D ₁)=70%/65%=7/6.5,Sup _c(<Bc60>)=45%

$\mathrm{Score}(<\mathrm{<figure-callout\; id="60"\; label="Bc"\; filenames="HDA0000368918860000032.png"\; state="\{\{state\}\}">Bc</figure-callout>}60>,D_1)=\frac{\mathrm{Gr}(<\mathrm{<figure-callout\; id="60"\; label="Bc"\; filenames="HDA0000368918860000032.png"\; state="\{\{state\}\}">Bc</figure-callout>}60,D_2,D_1)}{\mathrm{Gr}(<\mathrm{<figure-callout\; id="60"\; label="Bc"\; filenames="HDA0000368918860000032.png"\; state="\{\{state\}\}">Bc</figure-callout>}60,D_2,{\mathrm{<figure-callout\; id="1"\; label="D"\; filenames="HDA0000368918860000041.png"\; state="\{\{state\}\}">D</figure-callout>}}_1>)+\mathrm{<figure-callout\; id="1"\; label="Max\; Gr\; D"\; filenames="HDA0000368918860000041.png"\; state="\{\{state\}\}">Max</figure-callout>}{\mathrm{Gr}}_D{1}_{}}\&times;{\mathrm{Sup}}_c(<\mathrm{<figure-callout\; id="60"\; label="Bc"\; filenames="HDA0000368918860000032.png"\; state="\{\{state\}\}">Bc</figure-callout>}60>)$

$=\frac{7/6.5}{7/6.5+1.5}\&times;0.45$

$\mathrm{Score}(<\mathrm{<figure-callout\; id="60"\; label="Bc"\; filenames="HDA0000368918860000032.png"\; state="\{\{state\}\}">Bc</figure-callout>}60>,D_2)=\frac{1}{\mathrm{Gr}(<\mathrm{<figure-callout\; id="60"\; label="Bc"\; filenames="HDA0000368918860000032.png"\; state="\{\{state\}\}">Bc</figure-callout>}60,D_2,{\mathrm{<figure-callout\; id="1"\; label="D"\; filenames="HDA0000368918860000041.png"\; state="\{\{state\}\}">D</figure-callout>}}_1>)+\mathrm{Min}{\mathrm{Gr}}_{D2}}\&times;{\mathrm{Sup}}_c(<\mathrm{<figure-callout\; id="60"\; label="Bc"\; filenames="HDA0000368918860000032.png"\; state="\{\{state\}\}">Bc</figure-callout>}60>)$

$=\frac{1}{7/6.5+7/6.5}\&times;0.45$

3) because<Ae70 (30%) be non-network addiction class D ₂Generation, for non-network addiction class D ₂Be X, namely belong to forward collection and RS, for network addiction class D ₁Be Y, namely belong to reverse set WS, therefore have:

Gr(<Ae70>,D ₁,D ₂)=90%/50%=1.6，Sup _c(<Ae70>)=30%；

$\mathrm{Score}(<\mathrm{Ae}70>,D_1)=\frac{1}{\mathrm{Gr}(<\mathrm{Ae}70,{\mathrm{<figure-callout\; id="1"\; label="D"\; filenames="HDA0000368918860000041.png"\; state="\{\{state\}\}">D</figure-callout>}}_1,D_2>)+\mathrm{<figure-callout\; id="1"\; label="Min\; Gr\; D"\; filenames="HDA0000368918860000041.png"\; state="\{\{state\}\}">Min</figure-callout>}{\mathrm{Gr}}_D{1}_{}}\&times;0.3=\frac{1}{1.6+7/5.5}\&times;0.3$

$\mathrm{Score}(<\mathrm{Ae}70>,D_2)=\frac{\mathrm{Gr}(<\mathrm{<figure-callout\; id="60"\; label="Bc"\; filenames="HDA0000368918860000032.png"\; state="\{\{state\}\}">Bc</figure-callout>}60,{\mathrm{<figure-callout\; id="1"\; label="D"\; filenames="HDA0000368918860000041.png"\; state="\{\{state\}\}">D</figure-callout>}}_1,D_2>)}{\mathrm{Gr}(<\mathrm{Ae}70,{\mathrm{<figure-callout\; id="1"\; label="D"\; filenames="HDA0000368918860000041.png"\; state="\{\{state\}\}">D</figure-callout>}}_1,D_2>)+\mathrm{Max}{\mathrm{Gr}}_{D2}}\&times;0.3=\frac{1.6}{1.6+1.75}\&times;0.3$

4) because<Ae70, Fe40>(50%) be non-network addiction class D ₂The jump Emerging Pattern, for non-network addiction class D ₂Be X, namely belong to forward collection and RS, for network addiction class D ₁Be Y, namely belong to reverse set WS, therefore have:

Gr(<Ae70,Fe40>,D ₁,D ₂)=∞，Sup _c(<Ae70,Fe40>)=50%；

$\mathrm{Score}(<\mathrm{Ae}70,\mathrm{Fe}40>,D_1)=\mathrm{<figure-callout\; id="1"\; label="lim"\; filenames="HDA0000368918860000041.png"\; state="\{\{state\}\}">lim</figure-callout>}\frac{1}{\&infin;+\mathrm{<figure-callout\; id="1"\; label="Min\; Gr\; D"\; filenames="HDA0000368918860000041.png"\; state="\{\{state\}\}">Min</figure-callout>}{\mathrm{Gr}}_D{1}_{}}\&times;0.5=\mathrm{<figure-callout\; id="1"\; label="lim"\; filenames="HDA0000368918860000041.png"\; state="\{\{state\}\}">lim</figure-callout>}\frac{1}{\&infin;+7/5.5}\&times;0.5=0\&times;0.5$

$\mathrm{Score}(<\mathrm{Ae}70,\mathrm{Fe}40>,D_2)=\lim \frac{\&infin;}{\&infin;+\mathrm{Mar}{\mathrm{Gr}}_{D2}}\&times;0.5=\lim \frac{\&infin;}{\&infin;+1.75}\&times;0.5=1\&times;0.5$

Bring above-mentioned result of calculation into formula (2), network addiction class and the non-network addiction class score of trying to achieve behavior to be detected are as follows:

${\mathrm{Score}}_{\mathrm{PIU}}=1\&times;50\%+1\&times;60\%+\frac{7/6.5}{7/6.5+1.5}\&times;0.45+\frac{1}{1.6+7/5.5}\&times;0.3+0\&times;0.5=1.39$

${\mathrm{Score}}_{\mathrm{NPIU}}=0\&times;0.5+0\&times;0.6+\frac{1}{7/6.5+7/6.5}\&times;0.45+\frac{1.6}{1.6+1.75}\&times;0.3+1\&times;0.5=0.85$

Due to SCORE _PIU=1.39 are greater than SCORE _NPIU=0.85, therefore, this behavior to be detected of final decision belongs to the network addiction class.

If it is the network addiction behavior that step 9 detects the subscriber computer interbehavior, adopts the preventive intervention procedure module to send early warning, and by timer, limit this user and can continue to use computing machine 1 hour; If the overstepping the time limit scope, shut down computer.

In case surpass this time limit scope, will further start software service and shut down computer, in the embodiment of the present invention, call the api interface of Windows system, i.e. Shutdown function, realize the closing of computing machine, thereby realize the effective intervention to network addiction.

In the embodiment of the present invention, test by experiment the effect of the network addiction detection method proposed.

(1) to the evaluation of network addiction detection algorithm efficiency.

Two kinds of network addiction detection algorithm GBPDA algorithms that utilize to propose and EPBPDA algorithm, mainly estimate from time complexity and space complexity.From Fig. 4, finding out in figure (a), growth along with data scale (the computer interactive behavioral data produced in a day of namely take is the detection unit), from gathering four day data to ten day data, the working time of two kinds of algorithms, equal journey increased progressively trend, at this moment also more because of the processing time of the more algorithms of data.In addition, the EPBPDA algorithm working time outline higher than the GBPDA algorithm, reason is that the EPBPDA algorithm needs more multiprocessing process than GBPDA algorithm, therefore causes more working times.From the memory headroom in figure (b) Fig. 4, two kinds of algorithm required memory upper limits all are not more than 16MB byte of memory space.Simultaneously, along with the data set scale increases, memory headroom also takies and increases gradually thereupon.In addition, the EPBPDA algorithm expends more memory headrooms than the GBPDA algorithm, and reason is that EP excavates and will excavate on basis and carry out at Generator, therefore need to take relatively many memory sources.

(2) to the evaluation of network addiction detection algorithm effect.

From Fig. 5, finding out in figure (a), at first, two kinds of algorithms have all been obtained higher accuracy, the validity of these two kinds of network addiction detection algorithms has been described, and along with data scale increases, the accuracy rate of two kinds of algorithms all is improved to some extent, and illustrates that more detections of data effect is better.Secondly, the accuracy of EPBPDA algorithm will be higher than the GBPDA algorithm, reason is, the EPBPDA algorithm is to contrast and draw on two class data sets, i.e. network addiction class and non-network addiction class, more objective, it is also more fair for network addiction, to pass judgment on, and the GBPDA algorithm, only by with network addiction class Generator to recently embodying, namely only pass judgment on user behavior and whether with the network addiction class, approach, and determining of judge threshold value also has very strong subjective factor.

From loss and two angles of false drop rate, two kinds of algorithms are estimated respectively.Loss is that network addiction has been judged into non-network addiction, and false drop rate is that non-network addiction has been judged into network addiction, and obviously these two indexs all can affect network addiction detection effect, therefore they unifications can be to error rate.At first, from figure (b) Fig. 5 and figure (c), finding out, error rate all is in a reduced levels, illustrates that classifying quality is good.Secondly, when data scale hour, error rate is higher, this has also just in time verified from other one side the rule that accuracy rate is reacted; And when data scale increased, error rate was to a certain degree descending to some extent, this proving again carries out network addiction behavior detection need to gather user behavior data as much as possible.Next, the error rate of EPBPDA algorithm, a little less than the GBPDA algorithm, illustrates EPBPDA algorithm classification better effects if, and this comes from its constructed sorter, and not only form is succinct and retained the stronger characteristic attribute of the property distinguished, thereby has guaranteed classifying quality.

Claims (6)

1. pick-up unit of the network addiction based on the subscriber computer alternative events, it is characterized in that: comprise simple event acquisition module, complicated event generation module, the time is extensive and normalized module, the frequent sub-acquisition module of behavior generation, Sample Storehouse build module, data processing and detection module and preventive intervention procedure module, wherein

Simple event acquisition module: be used to gathering user and computer interactive variable as simple event, comprise computer CPU utilization rate, memory usage, unit interval left button number of times, unit interval number of pixels, network traffics and the operation process that right button number of times, unit interval keyboard number of taps, unit interval mouse move of clicking the mouse of clicking the mouse, and above-mentioned input variable is sent to the complicated event generation module;

Complicated event generation module: for each simple event is compared with threshold value separately respectively, if be more than or equal to threshold range, retain this simple event, then generate complicated events according to the whole simple event combined situation that retain; Otherwise continue to gather simple event; Described complicated event comprises that off-line sees video, sees video, real time strategy, the game of table trip class, browsing page, online chatting and down operation online;

Extensive and normalized module of time: arrange for the complicated event that each user day is done, and the complicated event time of origin is carried out to extensive processing, be about to be divided in one day several time periods; To the duration carry out normalized, the duration that is about to complicated event is carried out the rounding operation; And the complicated event after processing is sent to the sub-acquisition module of frequent behavior generation;

The frequent sub-acquisition module of behavior generation: when setting up Sample Storehouse, for obtaining between a plurality of network addiction users the identical complicated event carried out, gather the generation number of times of above-mentioned identical complicated event, and according to the set frequency threshold value of user, select be greater than threshold value complicated event as frequent network addiction complicated event, generation that the set that consists of above-mentioned frequent network addiction complicated event of reentrying distributes be used to describing the user behavior feature, and be sent to Sample Storehouse and build module; For obtaining the identical complicated event carried out between a plurality of non-network addiction users, gather the generation number of times of above-mentioned identical complicated event, and according to the set frequency threshold value of user, select be greater than threshold value complicated event as frequent non-network addiction complicated event, reentry by generation distributed be used to describing the user behavior feature of above-mentioned frequent non-network addiction set that complicated event forms, and be sent to Sample Storehouse structure module;

When detecting user's network addiction situation, for obtaining the identical complicated event that user to be measured carried out within a period of time, gather the generation number of times of above-mentioned identical complicated event, and according to the set frequency threshold value of user, select be greater than threshold value complicated event as frequent complicated event, reentry by generation distributed be used to describing behavioural characteristic of set that above-mentioned frequent complicated event forms, and be sent to data processing and detection module;

Sample Storehouse builds module: for adopting based on producing sub sample structure algorithm, frequent network addiction complicated event generation is counted the score, if score surpasses threshold value, save as the network addiction class, otherwise delete, and frequent non-network addiction complicated event is produced to the sub non-network addiction class that saves as; Or adopt the sample structure algorithm based on Emerging Pattern to calculate frequent complicated event generation, obtain generation the preservation of Emerging Pattern;

Data are processed and detection module: for frequent behavior generation to be detected is compared with the network addiction Sample Storehouse, are contained in Sample Storehouse if frequent complicated event to be detected produces attached bag, determine that it is network addiction, otherwise be non-network addiction, and the output judged result; Or frequent behavior generation to be detected is compared with Sample Storehouse, adopt the network addiction detection algorithm based on Emerging Pattern to calculate respectively its network addiction score and non-network addiction score, according to score, just judge classification under it;

Preventive intervention procedure module: for when the subscriber computer interbehavior being detected and be the network addiction behavior, send early warning, and limit this user by timer and can continue computed time range, 1～2 hour; If the overstepping the time limit scope, shut down computer.

2. the method that adopts the pick-up unit of the network addiction based on the subscriber computer alternative events claimed in claim 1 to detect is characterized in that: comprise the following steps:

Step 1, gather mutual variable between a plurality of network addiction users and a plurality of non-network addiction user and computing machine as simple event, comprise computer CPU utilization rate, memory usage, unit interval left button number of times, unit interval number of pixels, network traffics and the operation process that right button number of times, unit interval keyboard number of taps, unit interval mouse move of clicking the mouse of clicking the mouse;

Step 2, each simple event is compared with threshold value separately respectively, if be more than or equal to threshold range, retain this simple event, then generate complicated events according to the whole simple event combined situation that retain; Otherwise continue to gather simple event; Described complicated event comprises that off-line sees video, sees video, real time strategy, the game of table trip class, browsing page, online chatting and down operation online;

The process that generates complicated event is as follows:

If CPU usage surpasses or equals threshold range 45%～55%, memory usage surpasses or equals threshold range 55%～65%, and surfing flow surpasses or equal threshold range 35～45MB, generates a complicated event of seeing online video;

If CPU usage surpasses or equals threshold range 45%～55%, memory usage surpasses or equals threshold range 55%～65%, and the operation process is multimedia player, generates the complicated event that an off-line is seen video;

If CPU usage surpasses or equals threshold range 45%～55%, memory usage surpasses or equals threshold range 55%～65%, the unit interval left button number of times of clicking the mouse surpasses or equals threshold range 25～35 times, the unit interval right button number of times of clicking the mouse surpasses or equals threshold range 10～20 times, the number of pixels that the unit interval mouse moves surpasses or equals 1550～1650 of threshold ranges, unit interval keyboard number of taps surpasses or equals threshold range 80～120 times, and the operation process is timely strategy game, generate a complicated event of playing real time strategy,

If CPU usage surpasses or equals threshold range 45%～55%, memory usage surpasses or equals threshold range 55%～65%, the unit interval left button number of times of clicking the mouse surpasses or equals threshold range 25～35 times, the number of pixels that the unit interval mouse moves surpasses or equals 1550～1650 of threshold ranges, and the operation process is the game of a table trip class, generate a complicated event of playing the game of table trip class;

If CPU usage surpasses or equals threshold range 45%～55%, the unit interval left button number of times of clicking the mouse surpasses or equals threshold range 25～35 times, the number of pixels that the unit interval mouse moves surpasses or equals 1550～1650 of threshold ranges, and the operation process is the game of a table trip class, generate the complicated event that another plays the game of table trip class;

The left button number of times surpasses or equals threshold range 25～35 times if the unit interval clicks the mouse, the number of pixels that the unit interval mouse moves surpasses or equals 1550～1650 of threshold ranges, and the operation process is browser, generate the complicated event of a browsing page;

The left button number of times surpasses or equals threshold range 25～35 times if the unit interval clicks the mouse, the number of pixels that the unit interval mouse moves surpasses or equals 1550～1650 of threshold ranges, surfing flow surpasses or equals threshold range 35～45MB, and the operation process is browser, generate the complicated event of another browsing page;

If the number of pixels that the unit interval mouse moves surpasses or equals 1550～1650 of threshold ranges, surfing flow surpasses or equals threshold range 35～45MB, and the operation process is browser, generates the complicated event of another browsing page;

If unit interval keyboard number of taps surpasses or equals threshold range 80～120 times, and the operation process is instant chat software, generates the complicated event of an online chat;

If the number of pixels that the unit interval mouse moves surpasses or equals 1550～1650 of threshold ranges, unit interval keyboard number of taps surpasses or equals threshold range 80～120 times, and the operation process is instant chat software, generate the complicated event of another online chat;

If surfing flow surpasses or equals threshold range 35～45MB, generate the complicated event of a downloaded data;

Step 3, the complicated event time of origin is carried out to extensive processing, soon be divided into 6:00～11:00,11:00～14:00,14:00～18:00,18:00～23:00, five time periods of 23:00～6:00 in one day, and will the duration carry out normalized, the duration that is about to complicated event take and carried out the rounding operation as unit in 10 minutes;

Step 4, obtain the identical complicated event carried out between the identical complicated event that carries out between a plurality of network addiction users and a plurality of non-network addiction user, gather the generation number of times of above-mentioned identical complicated event, and according to the set frequency threshold value of user, select be greater than threshold value complicated event as frequent network addiction complicated event and frequent non-network addiction complicated event, reentry by a plurality of generation that distribute be used to describing the user behavior feature of above-mentioned frequent network addiction set that complicated event forms, acquisition is by a plurality of generation that distribute be used to describing the user behavior feature of above-mentioned frequent non-network addiction set that complicated event forms, and be sent to Sample Storehouse and build module,

Step 5, employing count the score based on producing generation of sub sample structure algorithm to frequent network addiction complicated event, if score surpasses threshold value, save as the network addiction class, otherwise delete, and generation of frequent non-network addiction complicated event is saved as to non-network addiction class; Or adopt the sample collection algorithm based on Emerging Pattern to calculate frequent complicated event generation, obtain generation of Emerging Pattern and preserve;

Step 6, gather user to be measured within a period of time and the mutual variable between computing machine, and repeating step 2 is to step 3;

Step 7, obtain the identical complicated event that user to be measured carried out within a period of time, and gather the generation number of times of above-mentioned identical complicated event, and according to the set frequency threshold value of user, select be greater than threshold value complicated event as frequent complicated event, reentry by generation distributed be used to describing behavioural characteristic of set that above-mentioned frequent complicated event forms, and be sent to data processing and detection module;

Step 8, frequent behavior generation to be detected is compared with the network addiction Sample Storehouse, be contained in Sample Storehouse if frequent complicated event to be detected produces attached bag, determine that it is network addiction, otherwise be non-network addiction, and the output judged result; Or frequent behavior generation to be detected is compared with Sample Storehouse, adopt the network addiction detection algorithm based on Emerging Pattern to calculate respectively its network addiction score and non-network addiction score, judge both score height, frequent complicated event to be detected belongs to the high classification of score;

If it is the network addiction behavior that step 9 detects the subscriber computer interbehavior, adopts the preventive intervention procedure module to send early warning, and by timer, limit this user and can continue computed time range, 1～2 hour; If the overstepping the time limit scope, shut down computer.

3. the method that detects of the pick-up unit of the network addiction based on the subscriber computer alternative events according to claim 2, it is characterized in that: the threshold value separately of the described simple event of step 2: computer CPU utilization rate span 45%～55%, memory usage span 55%～65%, click the mouse left button number of times span 25～35 times of unit interval, click the mouse right button number of times span 10～20 times of unit interval, unit interval keyboard number of taps span 80～120, the number of pixels span 1550～1650 that the unit interval mouse moves, network traffics span 35～45MB.

4. the method that detects of the pick-up unit of the network addiction based on the subscriber computer alternative events according to claim 2, it is characterized in that: the described employing of step 5 counts the score to frequent network addiction complicated event generation based on producing sub sample structure algorithm, is specially:

Step 5-1, according to user's request, determine the weight coefficient of complicated event type, guarantee the weight coefficient of real time strategy>see online video weight coefficient>weight coefficient>off-line of weight coefficient>browsing page that table trip class is played is seen the weight coefficient of the weight coefficient of the weight coefficient>online chatting of video>download, and weight coefficient adds up to 1;

Step 5-2, determine the complicated event time weight coefficient of extensive section according to user's request, guarantee the weight coefficient in weight coefficient>morning in weight coefficient>afternoon at weight coefficient>noon in the weight coefficient>evening at dawn, and weight coefficient adds up to 1;

Step 5-3, will produce each complicated event type weight coefficient, complicated event time extensive section weight coefficient and duration in son and multiply each other and try to achieve scoring, and each complicated event scoring summation will be obtained to the sub scoring of this generation;

If step 5-4 score surpasses threshold value, the threshold value span is 1～6, preserves, otherwise deletes.

5. the method that detects of the pick-up unit of the network addiction based on the subscriber computer alternative events according to claim 2, it is characterized in that: the described employing of step 5 is calculated frequent complicated event generation based on the sample structure algorithm of Emerging Pattern, generation the classification that obtain Emerging Pattern are preserved, and are specially:

Step 5-a, obtain and belong in frequent network addiction complicated event and do not belong to generation in frequent non-network addiction complicated event;

Step 5-b, obtain and do not belong in frequent network addiction complicated event and belong to generation in frequent non-network addiction complicated event;

Step 5-c, obtain and namely belong in frequent network addiction complicated event common generation belonged to again in frequent non-network addiction complicated event, and determine its support in frequent network addiction complicated event, namely occurrence rate, determine the support in frequent non-network addiction complicated event;

Step 5-d, calculating should produce sub rate of growth jointly in frequent network addiction complicated event, soon its support in frequent network addiction complicated event is divided by the support in frequent non-network addiction complicated event; Calculate again in frequent non-network addiction complicated event and should jointly produce sub rate of growth, be about to its support in frequent non-network addiction complicated event divided by the support in frequent network addiction complicated event;

The size of step 5-e, more above-mentioned two rate of growth, retain generation that rate of growth is greater than 1, deletes generation that rate of growth is less than 1;

Step 5-f, generation in frequent network addiction complicated event is got to union, generation in frequent non-network addiction complicated event is got to union, namely obtain generation of Emerging Pattern and preserve.

6. the method that detects of the pick-up unit of the network addiction based on the subscriber computer alternative events according to claim 2, it is characterized in that: the described employing of step 8 is calculated respectively its network addiction score and non-network addiction score based on the network addiction detection algorithm of Emerging Pattern, score score (C, D _i) formula is as follows:

$\mathrm{Score}(C,D_{i|j})=\underset{X\&Element;\mathrm{RS}}{\mathrm{\&Sigma;}}\frac{\mathrm{Gr}(X,D_{j|i},D_{i|j})}{\mathrm{Gr}(X,D_{j|i},D_{i|j})+\mathrm{Max}{\mathrm{Gr}}_{\mathrm{RS}}}\&times;{\mathrm{Sup}}_c\left(X\right)$

$+\underset{Y\&Element;\mathrm{WS}}{\mathrm{\&Sigma;}}\frac{1}{\mathrm{Gr}(Y,D_{i|j},D_{j|i})+\mathrm{Min}{\mathrm{Gr}}_{\mathrm{WS}}}\&times;{\mathrm{Sup}}_c\left(Y\right),(i\&NotEqual;j)---\left(2\right)$

Wherein: D _i|jMean D _iSample Storehouse or D _jSample Storehouse, D _j|iMean D _jSample Storehouse or D _iSample Storehouse, i and j are Sample Storehouse class tag numbers, and X means D _iGeneration of Emerging Pattern, Y means D _jGeneration of Emerging Pattern; RS is the forward sample set of target class, the set namely had a positive effect, and WS is the reverse sample set of target class, namely plays the set of negative consequence; Gr (X, D _j|i, D _i|j) rate of growth of expression X from a class to another class; MaxGr _RSMean the maximum rate of growth threshold value in the target class set, RS means the forward sample set of target class, MinGr _WSMean the minimum rate of growth threshold value in the non-target class set, WS means the reverse sample set of target class, and C is complicated event to be sorted, Sup _c(X) mean the support of X in C, Sup _c(Y) mean the support of Y in C.

Images