CN105095318B - A kind of method and apparatus for realizing analysis of central issue - Google Patents
A kind of method and apparatus for realizing analysis of central issue Download PDFInfo
- Publication number
- CN105095318B CN105095318B CN201410220033.7A CN201410220033A CN105095318B CN 105095318 B CN105095318 B CN 105095318B CN 201410220033 A CN201410220033 A CN 201410220033A CN 105095318 B CN105095318 B CN 105095318B
- Authority
- CN
- China
- Prior art keywords
- event
- block
- polymerization
- degree
- class
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
Abstract
The invention discloses a kind of method and apparatus of analysis of central issue, comprising: in measurement period, carries out statistical classification to event sets according to the attribute of at least one event, obtains the statistical result being made of different event class；According to the attribute of at least one event class, the event class in obtained statistical result is mapped to one by one in the corresponding event sub-block of different event block；According to obtained mapping result, the degree of polymerization deviation of each event sub-block in each event block is calculated；According to the degree of polymerization deviation of calculated event sub-block and pre-set hot spot determination strategy, the hot spot in each event block is determined.The technical solution provided through the invention effectively improves the computation complexity of analysis of central issue based on the degree of polymerization of defined event class, to very well satisfy the demand that data that are a large amount of, a plurality of types of, quickly occurring are carried out with analysis of central issue.
Description
Technical field
The present invention relates to data analysis technique, espespecially a kind of method and apparatus for realizing analysis of central issue.
Background technique
Increase with the rapid development of information technology, geometric progression is presented in the scale of the processing of information, exchange, analysis and storage
It is long, the analytical technology of data that are a large amount of, a plurality of types of, quickly occurring widely is ground in each field for producing and living
Study carefully and use, analysis of central issue is one of data analysis technique important technology.Analysis of central issue technology is the certain specific things of analysis
A kind of effective ways of potential connection between part effectively can make regression analysis to event and prospect is pre- by analysis of central issue
It surveys, researcher is helped to obtain the conclusion of science.In analysis of central issue, usual hot spot of concern is that event occurrence frequency is abnormal
Zonule, if it find that event occurrence frequency in some or multiple zonules is higher or lower than normal frequency, then significantly
The zonule is defined as hot spot.
The analysis of central issue method of existing event generallys use the analysis hot spot of the nearest neighbor algorithm in clustering algorithm, although the algorithm
Can analyze out hot spot, but computationally intensive and computational efficiency needed for it is low, thus cannot meet well to it is a large amount of at present,
A plurality of types of, data that are quickly occurring carry out the demand of analysis of central issue.
Summary of the invention
In order to solve the above-mentioned technical problems, the present invention provides a kind of method and apparatus for realizing analysis of central issue, can drop
The computation complexity of low-heat point analysis meets analysis of central issue demand.
In order to reach the object of the invention, the invention discloses a kind of methods for realizing analysis of central issue, include the following steps:
In measurement period, statistical classification is carried out to event sets according to the attribute of at least one event, is obtained by difference
The statistical result of event class composition；
According to the attribute of at least one event class, the event class in obtained statistical result is mapped to different event one by one
In the corresponding event sub-block of block；
According to obtained mapping result, the degree of polymerization deviation of each event sub-block in each event block is calculated；
According to the degree of polymerization deviation of calculated event sub-block and pre-set hot spot determination strategy, each thing is determined
Hot spot in part block.
The event sets are made of event；The attribute of the event includes at least: identifier, type and grade；
The attribute of the event class includes at least: identifier, type, grade and indicating the event in same class event class
How many quantity.
The degree of polymerization deviation for calculating each event sub-block in each event block, comprising:
According to the grade and quantity of the event class, the degree of polymerization of each event class in current event block is calculated separately；
According to the degree of polymerization of each event class of acquisition, the degree of polymerization of each event sub-block in the current event block is calculated；
According to the degree of polymerization of the quantity of the event sub-block of the current event block and each event sub-block of acquisition, described in calculating
The average degree of polymerization of current event block；
According to the degree of polymerization of the average degree of polymerization of acquisition and each event sub-block, each event in the current event block is calculated
The degree of polymerization deviation of sub-block.
The calculation formula of the degree of polymerization A of the event class are as follows: A=log (E*L), wherein E is the quantity of the event class,
L is the grade of the event class.
The calculation formula of the degree of polymerization As of the event sub-block are as follows:Wherein, AnFor the polymerization of event class n
Degree, N are the quantity of the event class of the current event sub-block；
The average degree of polymerizationCalculation formula are as follows:Wherein, AsmFor the degree of polymerization of event sub-block m, M
For the quantity of the event sub-block in shown current event block；
The degree of polymerization deviation delta s of the event sub-block mmCalculation formula are as follows:Wherein, Asm
For the degree of polymerization of event sub-block m,For the average degree of polymerization.
This method further include: according to the degree of polymerization deviation of the corresponding event sub-block of the hot spot of the determination and preset
Abnormal determination strategy, determine the exception level of the hot spot.
This method further include: the event area constituted comprising all event blocks is divided:
The event area constituted comprising all event blocks is expressed as border circular areas, the border circular areas is divided into circle
The identical multiple annulus of the heart；
By the annulus according to the quantity of the event sub-block in event block from the shared center of circle to the excircle of the annulus
Direction carries out uniform equal part to obtain multiple fan rings；
The event block is corresponded into the annulus, the event sub-block is corresponded into the fan ring, by the event class
Correspond to the dot in the fan ring.
This method further include: according to each event class in each fan ring, be laid out the dot in each fan ring.
Being laid out the dot in each fan ring in each annulus includes:
By event class in the current fan ring according to the quantity of the event class by being up to ranked up less to be sorted
As a result, and calculating the maximum radius of the corresponding dot of each event class in the current fan ring；
According to the maximum radius and pre-set fan ring dot placement strategy, the center of circle for calculating the current fan ring is sat
Mark set；
Sequence from ranking results according to the quantity of the event class from big to small, extracts the event class, phase one by one
Central coordinate of circle is randomly selected from the central coordinate of circle set with answering, as the corresponding dot of extracted event class
Central coordinate of circle, using the calculated dot radius of the quantity of extracted event class as described in radius determination at the central coordinate of circle
Dot.
The central coordinate of circle set are as follows: arrange the maximum according to the fan ring dot placement strategy in the current fan ring
When dot, the set of the coordinate in the center of circle of all maximum dots in the fan ring；
Wherein, the maximum dot is the dot with maximum radius.
The fan ring dot placement strategy are as follows: pressed on the first layer center of circle circular arc close to the outer camber line of the current fan ring
According to the preset center of circle circular arc placement strategy arrangement maximum dot, in the second layer close to first layer center of circle circular arc
The maximum dot is arranged according to the center of circle circular arc placement strategy on the circular arc of the center of circle, and so on, close to shown current fan
According to the center of circle circular arc placement strategy arrangement maximum dot on P layers of center of circle circular arc of the interior camber line of ring, wherein
The center of circle circular arc placement strategy are as follows: the center of circle of the maximum dot is on the circular arc of the center of circle, and two adjacent institutes
State that maximum dot is tangent, and two maximum dots at center of circle circular arc both ends, two with the contour of the current fan ring respectively
Straight line is tangent,
The value of P is the integer value that the ratio of R and 2r is rounded downwards, wherein
R is the radius of the current fan ring, and r is the maximum radius.
The invention also discloses a kind of devices for realizing analysis of central issue, including statistical classification module, statistical result to map mould
Block, degree of polymerization deviation computing module and hot spot judgment module, wherein
Statistical classification module, for being united according to the attribute of at least one event to event sets in measurement period
Score class, obtains the statistical result being made of different event class；
Statistical result mapping block, for the attribute according at least one event class, by the system from statistical classification module
Event class in meter result is mapped to one by one in the corresponding event sub-block of different event block；
Degree of polymerization deviation computing module, for calculating each event according to the mapping result from statistical result mapping block
The degree of polymerization deviation of each event sub-block in block；
Hot spot judgment module, for according to the degree of polymerization deviation of the event sub-block from degree of polymerization deviation computing module and
Pre-set hot spot determination strategy, determines the hot spot in each event block.
The event sets are made of event；The attribute of the event includes at least: identifier, type and grade；It is described
The attribute of event class includes at least: identifier, type, grade and indicate same class event class in event number quantity.
The degree of polymerization deviation computing module includes at least the degree of polymerization of the degree of polymerization computing module of event class, event sub-block
The degree of polymerization deviation computing module of computing module, average degree of polymerization computing module and event sub-block, wherein
Degree of polymerization computing module calculates separately every in current event block for the grade and quantity according to the event class
The degree of polymerization of a event class；
The degree of polymerization computing module of event sub-block, for according to the poly- of each event class from the degree of polymerization computing module
It is right, calculate the degree of polymerization of each event sub-block in the current event block；
Average degree of polymerization computing module, for according to the quantity of the event sub-block of the current event block and coming from the thing
The degree of polymerization of each event sub-block of the degree of polymerization computing module of part sub-block, calculates the average degree of polymerization of the current event block；
The degree of polymerization deviation computing module of event sub-block, for according to being averaged from the average degree of polymerization computing module
The degree of polymerization of the degree of polymerization and each event sub-block of the degree of polymerization computing module from the event sub-block, calculates the current event
The degree of polymerization deviation of each event sub-block in block.
The calculation formula of the degree of polymerization A of the event class are as follows: A=log (E*L), wherein E is the quantity of the event class,
L is the grade of the event class.
The calculation formula of the degree of polymerization As of the event sub-block are as follows:Wherein, AnFor the polymerization of event class n
Degree, N are the quantity of the event class of the current event sub-block；
The average degree of polymerizationCalculation formula are as follows:Wherein, AsmFor the degree of polymerization of event sub-block m,
M is the quantity of the event sub-block in shown current event block；
The degree of polymerization deviation delta s of the event sub-block mmCalculation formula are as follows:Wherein, Asm
For the degree of polymerization of event sub-block m,For the average degree of polymerization.
Compared with prior art, the method for a kind of analysis of central issue of the invention, comprising: in measurement period, according at least
The attribute of one event carries out statistical classification to event sets, obtains the statistical result being made of different event class；According at least
Event class in obtained statistical result is mapped to the corresponding event sub-block of different event block by the attribute of one event class one by one
In；According to obtained mapping result, the degree of polymerization deviation of each event sub-block in each event block is calculated；According to calculated event
The degree of polymerization deviation of sub-block and pre-set hot spot determination strategy, determine the hot spot in each event block.The present invention provides
The degree of polymerization of the technical solution based on defined event class so that analysis of central issue is relatively easy, calculation amount is small and computational efficiency
Height meets analysis of central issue demand to drop the computation complexity of low-heat point analysis.
Further, technical solution of the present invention optimizes the coordinate position calculation method of the corresponding figure of event class, so that
The corresponding figure of event class more reasonably, is intuitively shown in patterned event area, to meet well
The efficient demand realized analysis of central issue and event class intuitively shown.
Other features and advantages of the present invention will be illustrated in the following description, also, partly becomes from specification
It obtains it is clear that understand through the implementation of the invention.The objectives and other advantages of the invention can be by specification, right
Specifically noted structure is achieved and obtained in claim and attached drawing.
Detailed description of the invention
Attached drawing is used to provide to further understand technical solution of the present invention, and constitutes part of specification, with this
The embodiment of application technical solution for explaining the present invention together, does not constitute the limitation to technical solution of the present invention.
Fig. 1 (a) is the flow chart for the method that the present invention realizes analysis of central issue；
Fig. 1 (b) is the flow chart that the method for degree of polymerization deviation is calculated in Fig. 1 (a) of the present invention；
Fig. 2 is the schematic diagram that event area of the present invention is expressed as the event area in the embodiment of border circular areas；
Fig. 3 is the flow chart that the present invention is laid out dot on the basis of analysis of central issue in each fan ring；
Fig. 4 is to realize the circle of the corresponding dot of calculating event class in analysis of central issue and the embodiment for being laid out dot in the present invention
The schematic diagram of the coordinate position of the heart；
Fig. 5 is the composed structure schematic diagram that the present invention realizes analysis of central issue device；
Fig. 6 is to realize in analysis of central issue and the embodiment for being laid out dot to open up for computer network event sets in the present invention
Show the effect picture of the corresponding dot of event class.
Specific embodiment
To make the objectives, technical solutions, and advantages of the present invention clearer, below in conjunction with attached drawing to the present invention
Embodiment be described in detail.It should be noted that in the absence of conflict, in the embodiment and embodiment in the application
Feature can mutual any combination.
Step shown in the flowchart of the accompanying drawings can be in a computer system such as a set of computer executable instructions
It executes.Also, although logical order is shown in flow charts, and it in some cases, can be to be different from herein suitable
Sequence executes shown or described step.
Analysis of central issue is that event sets are carried out with a kind of technology of data analysis.To obtain event sets, firstly, to hot spot
The event analyzed in the field of application carries out feature description, in general, event is to carry out feature description by multiple attributes.
Generally, it by extracting at least one common trait of a certain major class event in above-mentioned field, and will extract
Attribute of the common trait as event, to realize the feature description to this major class event.Those skilled in the art understand
, the field to analysis of central issue application may include multiple major class events, can extract for every kind of major class event endless
Exactly the same attribute carries out feature description to event therein, and can use analysis of central issue respectively for each major class event
Method carry out analysis of central issue.Wherein,
The attribute of event, in general, a variety of numerical value or typonym corresponding with numerical value can be defined.For example, event
Type is a kind of attribute of event, may include application layer, network layer, terminating layer, etc..
Then, a certain major class event in the field of analysis of central issue application is acquired, the main object of acquisition is thing
The numerical value of the attribute predetermined of part, to realize that the feature to event describes.Collected event is constituted again and is gathered, is i.e. thing
Part set.
Fig. 1 is the flow chart for the method that the present invention realizes analysis of central issue, as shown in Figure 1, comprising:
Step 101: in measurement period, statistical classification being carried out to event sets according to the attribute of at least one event, is obtained
To the statistical result being made of different event class.Wherein,
Measurement period is the pre-set periodic period for corresponding to execute statistical classification, right in measurement period
Event is acquired being put into collected event in event sets corresponding with the measurement period.For example, measurement period can
To be set as 30 seconds etc..
Event sets are made of event, and event carries out feature description by the attribute of event, and the attribute of event includes at least: mark
Know symbol, type and grade.
Event class carries out feature description by the attribute of event class, and the attribute of event class includes at least: identifier, type, etc.
Grade and quantity.Wherein, the identifier of event class and type are the identifier and type of the event of its statistics, and the grade of event class is
The grade of its event with highest grade counted, the quantity of event class are the event in the same class event class of its statistics
Quantity.In this way, all events identifier having the same and type of event class statistics.That is, the root in this step
Statistical classification is carried out to event sets according to the attribute of at least one event, may is that in measurement period, according to the mark of event
Symbol and type carry out statistical classification to event sets.
Statistical result is made of several event classes, and size, that is, event class quantity of statistical result is mainly by measurement period
The speed of the appearance speed of length and event determines.
Statistical result can be stored at least one Hash table.Wherein, being safeguarded and saved data using Hash table is this
The conventional techniques of field personnel, are not intended to limit the scope of protection of the present invention, and which is not described herein again.
Step 102: according to the attribute of at least one event class, the event class in obtained statistical result being mapped to one by one
In the corresponding event sub-block of different event block.Wherein,
Event block is made of at least one event sub-block, and the quantity of event block is at least 1.
Specifically, the event class in statistical result can be mapped to by each event block according to the type of event class one by one
In.Therefore, the quantity of event block is that the quantity of numerical value included by the type by event class or typonym determines.For example, such as
The type of fruit event class includes application layer type, network layer type and terminal channel type, then the quantity of event block is 3, this 3 things
Part block is respectively application-layer events block, network layer event block and terminating layer event block.
The environment attribute for generating or receiving such event extracted from the identifier of event class can be known as event
The environment of class.In each event block, this is mapped to according to the event class that the environment of event class will be mapped to current event block one by one
Event block in the numerical value or typonym of the environment of event class correspondingly each event sub-block, that is to say, that how many
The numerical value of the environment of a event class, correspondingly, with regard to how many event sub-block.Therefore, the number of the event sub-block in each event block
Amount is that the quantity of numerical value included by environment by event class or environment title determines.For example, being mapped to some event block
The environment of event class includes purpose environment 1, purpose environment 2, purpose environment 3 and purpose environment 4, then the event sub-block of the event block
Quantity be 4, this 4 event sub-blocks are respectively event sub-block 1, event sub-block 2, event sub-block 3 and event sub-block 4.
Step 103: according to obtained mapping result, calculating the degree of polymerization deviation of each event sub-block in each event block.This
The detailed process of step realizes such as Fig. 1 (b), and as shown in Fig. 1 (b), this step specifically comprises the following steps:
Step 103-1: according to the grade and quantity of event class, the polymerization of each event class in current event block is calculated separately
Degree.Wherein,
Shown in the calculating such as formula (1) of the degree of polymerization A of event class,
A=log (E*L) (1)
In formula (1), E is the quantity of event class, and L is the grade of event class.
Step 103-2: according to the degree of polymerization of each event class of acquisition, the degree of polymerization of each event sub-block is calculated.Wherein,
Shown in the calculating such as formula (2) of the degree of polymerization As of event sub-block,
In formula (2), AnFor the degree of polymerization of event class n, N is the quantity of the event class of current event sub-block.
Step 103-3: according to the degree of polymerization of the quantity of the event sub-block in event block and the event sub-block of acquisition, calculating is worked as
The average degree of polymerization of preceding event block.Wherein,
The average degree of polymerization of event blockCalculating such as formula (3) shown in,
In formula (3), AsmFor the degree of polymerization of event sub-block m, M is the quantity of the event sub-block in current event block.
Step 103-4: according to the degree of polymerization of the average degree of polymerization of acquisition and event sub-block, the poly- of each event sub-block is calculated
Right deviation.Wherein,
The degree of polymerization deviation delta s of event sub-block mmCalculating such as formula (4) shown in,
In formula (4), AsmFor the degree of polymerization of event sub-block m,For average degree of polymerization, the value range of m be 1,
2,…,M}。
Step 104, according to the degree of polymerization deviation of calculated event sub-block and pre-set hot spot determination strategy, really
Hot spot in fixed each event block.
Wherein, hot spot determination strategy can be with are as follows: if the degree of polymerization deviation delta of event sub-blocksGreater than 0, then corresponding event
Sub-block is hot spot, and otherwise corresponding event sub-block is not hot spot.
After determining hot spot, further abnormal point can also be carried out the exception determination strategy according to shown in table 1 to hot spot
Analysis, to distinguish the exception level of hot spot.
| ΔsRange | The exception level of hot spot |
| 0≤Δs<50 | Normally |
| 50≤Δs<100 | It is low |
| 100≤Δs<150 | In |
| 150≤Δs<200 | Middle height |
| Δs≥200 | It is high |
Table 1
Further, the method for the present invention further includes dividing to the event area constituted comprising all event blocks, with excellent
The coordinate position calculation method of the corresponding figure of change event class, so that the corresponding figure of event class more reasonably, intuitively exists
It is shown in patterned event area, efficiently realizes analysis of central issue to meet well and event class intuitively shown
Demand.It specifically includes:
The event area constituted comprising all event blocks is expressed as border circular areas, it is identical that border circular areas is divided into the center of circle
Multiple annulus, the direction of the excircle by annulus according to the quantity of the event sub-block in event block from the shared center of circle to annulus, which is drawn, to be divided
Secant carries out uniform equal part to obtain multiple fan rings, and Fig. 2 is that event area of the present invention is expressed as in the embodiment of border circular areas
Event sub-block is corresponded to fan ring, by event class pair as shown in Fig. 2, event block is corresponded to annulus by the schematic diagram of event area
It should be the dot in fan ring.
As shown in Fig. 2, by taking event area is divided into the identical annulus in 3 centers of circle as an example.Wherein, the annulus of innermost layer is to answer
With layer annulus, it should be noted that the annulus of innermost layer is actually circular shape, for convenience of description and uniformly, will
The circle and its two outside layers annulus of innermost layer are referred to as annulus.Wherein,
The radius of each annulus determines the area of each annulus, can be selected according to preset annular radii selection strategy
Select the radius of each annulus.For example, annular radii selection strategy can be with are as follows: determined first according to the indication range of border circular areas round
The radius in region, then by the radius of border circular areas according to the annulus of border circular areas quantity carry out equal part, obtain through equal part
Numerical value be each annulus radius.
As shown in Fig. 2, the annulus of middle layer is network layer annulus.Outermost annulus is terminating layer annulus.Each annulus
It is made of the identical fan ring of the shape of 4 area equations, it is also noted that innermost layer fan ring is actually by 4
Sector composition, for convenience of description and uniformly, the fan ring of the sector of innermost layer annulus and its two outside layers annulus is referred to as
Fan ring.
As shown in Fig. 2, 4 fan rings that network layer annulus includes are referred to as subnet one, subnet according to one embodiment
Two, subnet three and subnet four.That is, the environment for the event class being mapped in network layer annulus includes 4 numerical value, they
Title is divided into subnet one, subnet two, subnet three and subnet four.
Correspondingly,
The method of the present invention can also include: to safeguard recently the corresponding statistical result of measurement period at least once, and will count
As a result it saves in the historical data.Specifically,
It is with the corresponding statistical result of nearest 10 measurement periods of the Hash table queue maintenance for using 10 Hash tables to be constituted
Example, wherein statistical result corresponding with the last longest measurement period in measurement period interval is known as oldest statistical result.
In this example embodiment,
Before executing step 101, oldest statistical result can be saved in the historical data, then by above-mentioned Kazakhstan first
For safeguarding that the Hash table of oldest statistical result is removed from the Hash table queue in uncommon table queue, and in the Hash table queue
Generate the statistical result that a new Hash table is used to safeguard the current statistic period.
Correspondingly,
After executing step 104, the method for the present invention can also include: according to each event class in each fan ring, in each fan ring
Interior layout dot, Fig. 3 is the flow chart that the present invention is laid out dot on the basis of analysis of central issue in each fan ring, such as Fig. 3 institute
Show, comprising:
Step 301: the event class fanned in ring is obtained into sequence knot by being up to ranked up less according to the quantity of event class
Fruit, and calculate the maximum radius of the corresponding dot of each event class in current fan ring.
Here it is possible to by way of chained list to the event class in current fan ring according to event class quantity by it is up to few into
Row sequence is the conventional techniques of those skilled in the art using linked list maintenance and the technology for saving ranking results, is not used to limit
Determine protection scope of the present invention, which is not described herein again.
Based on ranking results, it is easy to extract the maximum value of the event number of the event class in current fan ring.Based on pre-
The radius scale parameter of the radius of the event number for the event class being first arranged dot corresponding with event class calculates radius scale ginseng
Several products with above-mentioned maximum value, resulting product value are the maximum radius of the dot in the fan ring.
Step 302: according to maximum radius and preset fan ring dot placement strategy, calculating the central coordinate of circle collection of fan ring
It closes.Wherein,
Central coordinate of circle collection is combined into when currently fan ring arranges maximum dot according to fan ring dot placement strategy, institute in the fan ring
There is the set of the coordinate in the center of circle of maximum dot.Wherein,
Maximum dot is the dot with maximum radius.
Fan ring dot placement strategy is to arrange on the circular arc of the first layer center of circle according to preset center of circle circular arc placement strategy
Maximum dot is arranged, arranges maximum dot according to center of circle circular arc placement strategy on the circular arc of the second layer center of circle, and so on, in P
Maximum dot is arranged according to center of circle circular arc placement strategy on the circular arc of the layer center of circle.Wherein, the value of P isThat is the ratio of R and 2r
The integer value being rounded downwards, wherein R is the radius of current fan ring, i.e., currently fans any one in two straight lines of the contour of ring
Length, r is maximum radius.Wherein,
Center of circle circular arc placement strategy is that the center of circle of maximum dot is on the circular arc of the center of circle, and two adjacent maximum dot phases
It cuts, and two maximum dots at center of circle circular arc both ends are tangent with two straight lines of the contour of current fan ring respectively.
First layer center of circle circular arc is across the center of circle of all dots tangent with the external arc of current fan ring, two endpoints
For the circular arc in the center of circle of two dots in the tangent above-mentioned dot of the straight line of the contour with current fan ring.Wherein,
Maximum dot corresponding with first layer center of circle circular arc is known as first layer dot, it will be with first layer dot in shared circle
The tangent circular arc in heart direction is known as first layer tangent arc.
Second layer center of circle circular arc be across the center of circle of all dots tangent with first layer tangent arc, two endpoints be
With the straight line of the contour of current fan ring in tangent above-mentioned dot the center of circle of two dots circular arc.
With reference to the definition of second layer center of circle circular arc, class releases third layer dot circular arc, the 4th layer of dot circular arc ..., and P layers
The definition of dot circular arc.Wherein,
With reference to the definition of first layer dot and first layer tangent arc, class releases second layer dot, third layer dot ...,
The definition of P layers of dot and second layer tangent arc, third layer tangent arc ..., the definition of P layers of tangent arc.
According to first layer center of circle circular arc, second layer center of circle circular arc ..., the definition of P layers of center of circle circular arc easy can be obtained
To the radius R of k-th of center of circle circular arckCalculation formula: Rk=R- (2k-1) * r, wherein the value range of k is { 1,2 ..., P },
RkFor the arc radius in the shared center of circle to k-th of center of circle circular arc.
Fig. 4 is to realize the circle of the corresponding dot of calculating event class in analysis of central issue and the embodiment for being laid out dot in the present invention
The schematic diagram of the coordinate position of the heart, as shown in figure 4, in order to obtain the central coordinate of circle set of the fan ring,
Firstly, calculating radian set { E1,E2,…,EJ, wherein J is the quantity of current annulus middle fan ring, in radian set
Radian EjCalculating such as formula (5) shown in, wherein the value range of j is { 1,2 ..., J }, in conjunction with embodiment as shown in Figure 4
In, the value of J is 4.
According to radian set, the corresponding radian of current fan ring is expressed as [Ej-1,Ej], wherein E0Value be 0.In turn, may be used
To obtain the corresponding arc range of kth layer center of circle circular arc:For the convenience of description, being further represented as
[Dj-1,Dj], wherein θkFor deflection angle, definition refers to following formula (7) and its corresponding description.
As shown in figure 4, the exemplary multiple dots with maximum radius r drawn, wherein the shared center of circle is such as Fig. 4 institute
The center of circle of 3 annulus shown.
As shown in figure 4, the coordinate position in the center of circle of maximum dot is (xi,yi), xiAnd yiBetween relationship such as formula (6)
It is shown.Wherein, the x as shown in formula (6)iAnd yiValue range represent (xi,yi) in current fan ring.
xi+yi=Ri 2 (6)
Wherein, Rk*cosDj≤xi≤Rk*cosDj-1, Rk*sinDj-1≤yi≤Rk*sinDj
Then, deflection angle θ is calculatedk, it is that the center of circle of the maximum dot of tangent two on k-th of center of circle circular arc is opposite
In centered deflection angle altogether.As shown in figure 4, deflection angle is straight line and the shared center of circle to circle of the shared center of circle to center of circle A
Angle between the straight line of heart B, dot A and dot B are tangent, and tangent with the external arc of current fan ring, and all have maximum
Radius r, deflection angle θkCalculating as shown in following formula (7).
As shown in formula (7), θkWith RkIt corresponds, k-th of center of circle circular arc has corresponding θkWith Rk。
Then, calculate center of circle stepping, by it is between the circular arc of the adjacent two layers center of circle, in the shared center of circle to the outer circle for currently fanning ring
Distance on arc direction is known as center of circle stepping.As shown in figure 4, dot B and second layer center of circle circular arc on the circular arc of the first layer center of circle
On dot C between linear distance of the center of circle stepping between center of circle B and center of circle C, orbicular spot C and dot B are tangent.The center of circle
Shown in the calculating such as formula (8) of stepping Δ V.
Δ V=r*2 (8)
Finally, calculating the central coordinate of circle set of current fan ring according to formula (5), formula (6), formula (7), formula (8)
{ (xi, yi) } is calculated as shown in formula (9-1) and (9-2), wherein h is to deflect on k-th of center of circle circular arc in currently fan ring
θkDeflection number of times, the value range of h isEach variable of formula (9-1) and (9-2)
Definition and value range refer to formula (5), formula (6), formula (7) and formula (8) and its corresponding description above.
Work as Dj-Tk*h>Dj-1When (9-1)
Work as Dj-Tk*h≤Dj-1When (9-2)
Step 303: the sequence from ranking results according to the quantity of event class from big to small extracts event class, phase one by one
Central coordinate of circle is randomly selected from central coordinate of circle set with answering, as the center of circle of the corresponding dot of extracted event class
Coordinate determines at central coordinate of circle by radius of the calculated dot radius of the quantity of extracted event class in currently fan ring
Dot.
Central coordinate of circle is randomly selected from central coordinate of circle set by a kind of random algorithm such as pseudo-random algorithm, for ability
For the technical staff in domain, it can choose a variety of random algorithms, these random algorithms are the conventional techniques of those skilled in the art
Means, which is not described herein again.
The product of the event number of above-mentioned radius scale parameter and extracted event class is calculated, resulting product value is the thing
The dot radius of the corresponding dot of part class.
When all event classes in ranking results be all extracted or central coordinate of circle set in all central coordinate of circle
When all corresponding to the event class extracted, the current layout dot fanned in ring terminates.
Correspondingly,
The color that dot can be set from shallow to deep, respectively represents the grade of its corresponding event class from low to high.
According to one embodiment, can be designated as further by the background color in the region of the corresponding annulus of the hot spot judged
Different colors, for example, it is red, to intuitively show hot spot in event area with obvious way.
Further,
It step 303, can also include: that the event class in statistical result is stored in historical data with corresponding central coordinate of circle
In.
Fig. 5 is the composed structure schematic diagram that the present invention realizes analysis of central issue device, as shown in figure 5, including at least statistical
Generic module 501, statistical result mapping block 502, degree of polymerization deviation computing module 503 and hot spot judgment module 504, wherein
Statistical classification module 501, for being carried out according to the attribute of at least one event to event sets in measurement period
Statistical classification obtains the statistical result being made of different event class；
Statistical result mapping block 502 will come from statistical classification module for the attribute according at least one event class
Event class in 501 statistical result is mapped to one by one in the corresponding event sub-block of different event block；
Degree of polymerization deviation computing module 503, for calculating according to the mapping result from statistical result mapping block 502
The degree of polymerization deviation of each event sub-block in each event block；
Hot spot judgment module 504, for inclined according to the degree of polymerization of the event sub-block from degree of polymerization deviation computing module 503
Poor and pre-set hot spot determination strategy, determines the hot spot in each event block.
Further,
Event sets are made of event；The attribute of event includes at least: identifier, type and grade；The attribute of event class
Include at least: identifier, type, grade and indicate same class event class in event number quantity.
Wherein, degree of polymerization deviation computing module 503 includes at least: degree of polymerization computing module 503-1, event of event class
Degree of polymerization computing module 503-2, the average degree of polymerization computing module 503-3 of block and the degree of polymerization deviation computing module of event sub-block
503-4, wherein
Degree of polymerization computing module 503-1 is calculated separately every in current event block for the grade and quantity according to event class
The degree of polymerization of a event class；
The degree of polymerization computing module 503-2 of event sub-block, for according to each event from degree of polymerization computing module 503-1
The degree of polymerization of class calculates the degree of polymerization of each event sub-block in current event block；
Average degree of polymerization computing module 503-3, for according to the quantity of the event sub-block of current event block and coming from event
The degree of polymerization of each event sub-block of the degree of polymerization computing module 503-2 of sub-block calculates the average degree of polymerization of current event block；
The degree of polymerization deviation computing module 503-4 of event sub-block, for according to from average degree of polymerization computing module 503-3
Average degree of polymerization and the degree of polymerization computing module 503-2 from event sub-block each event sub-block the degree of polymerization, calculate current
The degree of polymerization deviation of each event sub-block in event block.
Further,
The calculation formula of the degree of polymerization A of event class are as follows: A=log (E*L), wherein E is the quantity of event class, and L is event
The grade of class.
Further,
The calculation formula of the degree of polymerization As of event sub-block are as follows:Wherein, AnFor the degree of polymerization of event class n, N is
The quantity of the event class of current event sub-block；
Average degree of polymerizationCalculation formula are as follows:Wherein, AsmFor the degree of polymerization of event sub-block m, M is
The quantity of event sub-block in shown current event block.
The degree of polymerization deviation delta s of event sub-block mmCalculation formula are as follows:Wherein, AsmFor thing
The degree of polymerization of part sub-block m,For average degree of polymerization.
Apparatus of the present invention may be provided in various analysis of central issue equipment.
An application of the invention is the device that analysis of central issue is realized in computer network facility.Fig. 6 is in the present invention
Analysis of central issue is realized for computer network event sets and is laid out the corresponding dot of displaying event class in the embodiment of dot
Effect picture.Wherein,
The identifier of event is that computer network message is corresponding when being initially generated in the generating device for generating the message
Source IP address and purpose IP address, the type of event are the type of generating device, and the above-mentioned message of the grade of event is marked
Grade.Correspondingly, when the identifier of event class is that computer network message is initially generated in the generating device for generating the message
Corresponding source IP address and purpose IP address, the type of event class are the type of generating device, and the grade of event class is above-mentioned report
The grade that is marked of message in text with greatest level, the quantity of event class be have in event sets identical source IP address,
The quantity of the computer network message of purpose IP address and event type, the environment of event class are to extract from its purpose IP address
Subnet address.Wherein,
As shown in fig. 6, the type of event class includes application layer, network layer and terminating layer, the subnet address of event class includes
Subnet one, subnet two, subnet three and subnet four.
As shown in fig. 6, the division of event area is identical as event area shown in Fig. 2, which is not described herein again.In Fig. 6 institute
In each fan ring of three annulus shown, the corresponding dot of event class for being mapped to the fan ring is depicted, and the color of dot is by shallow
From low to high to the deep grade for representing its corresponding event class, and the size of dot represents the number of the quantity of its corresponding event class
The size of value.
Although disclosed herein embodiment it is as above, the content only for ease of understanding the present invention and use
Embodiment is not intended to limit the invention.Technical staff in any fields of the present invention is taken off not departing from the present invention
Under the premise of the spirit and scope of dew, any modification and variation, but the present invention can be carried out in the form and details of implementation
Scope of patent protection, still should be subject to the scope of the claims as defined in the appended claims.
Claims (8)
1. a kind of method for realizing analysis of central issue characterized by comprising
In measurement period, statistical classification is carried out to event sets according to the attribute of at least one event, is obtained by different event
The statistical result of class composition；
According to the attribute of at least one event class, the event class in obtained statistical result is mapped to different event block one by one
In corresponding event sub-block；
According to obtained mapping result, the degree of polymerization deviation of each event sub-block in each event block is calculated；
According to the degree of polymerization deviation of calculated event sub-block and pre-set hot spot determination strategy, each event block is determined
In hot spot；
Wherein, the event sets are made of event；The attribute of the event includes at least: identifier, type and grade；
The attribute of the event class includes at least: identifier, type, grade and indicate same class event class in event number
Quantity；
Wherein, the degree of polymerization deviation for calculating each event sub-block in each event block, comprising:
According to the grade and quantity of the event class, the degree of polymerization of each event class in current event block is calculated separately；
According to the degree of polymerization of each event class of acquisition, the degree of polymerization of each event sub-block in the current event block is calculated；
According to the degree of polymerization of the quantity of the event sub-block of the current event block and each event sub-block of acquisition, calculate described current
The average degree of polymerization of event block；
According to the degree of polymerization of the average degree of polymerization of acquisition and each event sub-block, each event sub-block in the current event block is calculated
Degree of polymerization deviation；
The calculation formula of the degree of polymerization A of the event class are as follows: A=log (E*L), wherein E is the quantity of the event class, and L is
The grade of the event class；
The calculation formula of the degree of polymerization As of the event sub-block are as follows:Wherein, AnFor the degree of polymerization of event class n, N is
The quantity of the event class of the current event sub-block；
The average degree of polymerizationCalculation formula are as follows:Wherein, AsmFor the degree of polymerization of event sub-block m, M is institute
Show the quantity of the event sub-block in current event block；
The degree of polymerization deviation delta s of the event sub-block mmCalculation formula are as follows:Wherein, AsmFor thing
The degree of polymerization of part sub-block m,For the average degree of polymerization.
2. the method according to claim 1, wherein this method further include:
According to the degree of polymerization deviation of the corresponding event sub-block of the hot spot of the determination and pre-set abnormal determination strategy, really
The exception level of the fixed hot spot.
3. method according to claim 1 or 2, which is characterized in that this method further include: to including all event blocks
The event area of composition is divided:
The event area constituted comprising all event blocks is expressed as border circular areas, the border circular areas is divided into center of circle phase
Same multiple annulus；
By the annulus according to the quantity of the event sub-block in event block from the shared center of circle to the direction of the excircle of the annulus
Uniform equal part is carried out to obtain multiple fan rings；
The event block is corresponded into the annulus, the event sub-block is corresponded into the fan ring, the event class is corresponding
For the dot in the fan ring.
4. according to the method described in claim 3, it is characterized in that, this method further include: according to each event in each fan ring
Class is laid out the dot in each fan ring.
5. according to the method described in claim 3, it is characterized in that, being laid out the dot packet in each fan ring in each annulus
It includes:
By event class in current fan ring according to the quantity of the event class by being up to ranked up less to obtain ranking results, and count
Calculate the maximum radius of the corresponding dot of each event class in the current fan ring；
According to the maximum radius and pre-set fan ring dot placement strategy, the central coordinate of circle collection of the current fan ring is calculated
It closes；
Sequence from ranking results according to the quantity of the event class from big to small, extracts the event class, correspondingly one by one
Central coordinate of circle is randomly selected from the central coordinate of circle set, as the center of circle of the corresponding dot of extracted event class
Coordinate determines the circle using the calculated dot radius of the quantity of extracted event class as radius at the central coordinate of circle
Point.
6. according to the method described in claim 5, it is characterized in that, the central coordinate of circle set are as follows:
It is all described in the fan ring in the current fan ring maximum dot described according to fan ring dot placement strategy arrangement
The set of the coordinate in the center of circle of maximum dot；
Wherein, the maximum dot is the dot with maximum radius.
7. according to the method described in claim 6, it is characterized in that, the fan ring dot placement strategy are as follows:
Plan is laid out according to preset center of circle circular arc on the first layer center of circle circular arc close to the outer camber line of the current fan ring
The maximum dot is slightly arranged, according to the center of circle circular arc on the second layer center of circle circular arc close to first layer center of circle circular arc
The placement strategy arrangement maximum dot, and so on, on the P layers of center of circle circular arc close to the interior camber line of shown current fan ring
According to the center of circle circular arc placement strategy arrangement maximum dot, wherein
The center of circle circular arc placement strategy are as follows: the center of circle of the maximum dot is on the circular arc of the center of circle, and described in adjacent two most
Large circle point is tangent, and two of the center of circle circular arc both ends maximum dots two straight lines with the contour of the current fan ring respectively
It is tangent,
The value of P is the integer value that the ratio of R and 2r is rounded downwards, wherein
R is the radius of the current fan ring, and r is the maximum radius.
8. a kind of device of analysis of central issue, which is characterized in that including statistical classification module (501), statistical result mapping block
(502), degree of polymerization deviation computing module (503) and hot spot judgment module (504), wherein
Statistical classification module (501), for being united according to the attribute of at least one event to event sets in measurement period
Score class, obtains the statistical result being made of different event class；
Statistical result mapping block (502) will come from statistical classification module for the attribute according at least one event class
(501) the event class in statistical result is mapped to one by one in the corresponding event sub-block of different event block；
Degree of polymerization deviation computing module (503), for calculating according to the mapping result for coming from statistical result mapping block (502)
The degree of polymerization deviation of each event sub-block in each event block；
Hot spot judgment module (504), it is inclined for the degree of polymerization according to the event sub-block from degree of polymerization deviation computing module (503)
Poor and pre-set hot spot determination strategy, determines the hot spot in each event block；
Wherein, the event sets are made of event；The attribute of the event includes at least: identifier, type and grade；It is described
The attribute of event class includes at least: identifier, type, grade and indicate same class event class in event number quantity；
The degree of polymerization deviation computing module (503) includes at least the degree of polymerization computing module (503-1) of event class, event sub-block
Degree of polymerization computing module (503-2), average degree of polymerization computing module (503-3) and event sub-block degree of polymerization deviation calculate mould
Block (503-4), wherein
Degree of polymerization computing module (503-1) calculates separately in current event block for the grade and quantity according to the event class
The degree of polymerization of each event class；
The degree of polymerization computing module (503-2) of event sub-block, for according to each from the degree of polymerization computing module (503-1)
The degree of polymerization of event class calculates the degree of polymerization of each event sub-block in the current event block；
Average degree of polymerization computing module (503-3), for according to the quantity of the event sub-block of the current event block and coming from institute
The degree of polymerization for stating each event sub-block of the degree of polymerization computing module (503-2) of event sub-block calculates the flat of the current event block
Homopolymerization is right；
The degree of polymerization deviation computing module (503-4) of event sub-block, for according to from the average degree of polymerization computing module
Each event sub-block of the average degree of polymerization of (503-3) and the degree of polymerization computing module (503-2) from the event sub-block is gathered
It is right, calculate the degree of polymerization deviation of each event sub-block in the current event block；
The calculation formula of the degree of polymerization A of the event class are as follows: A=log (E*L), wherein E is the quantity of the event class, and L is
The grade of the event class；
The calculation formula of the degree of polymerization As of the event sub-block are as follows:Wherein, AnFor the degree of polymerization of event class n, N is
The quantity of the event class of the current event sub-block；
The average degree of polymerizationCalculation formula are as follows:Wherein, AsmFor the degree of polymerization of event sub-block m, M is institute
Show the quantity of the event sub-block in current event block；
The degree of polymerization deviation delta s of the event sub-block mmCalculation formula are as follows:Wherein, AsmFor thing
The degree of polymerization of part sub-block m,For the average degree of polymerization.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201410220033.7A CN105095318B (en) | 2014-05-22 | 2014-05-22 | A kind of method and apparatus for realizing analysis of central issue |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201410220033.7A CN105095318B (en) | 2014-05-22 | 2014-05-22 | A kind of method and apparatus for realizing analysis of central issue |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN105095318A CN105095318A (en) | 2015-11-25 |
| CN105095318B true CN105095318B (en) | 2019-02-26 |
Family
ID=54575766
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201410220033.7A Active CN105095318B (en) | 2014-05-22 | 2014-05-22 | A kind of method and apparatus for realizing analysis of central issue |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN105095318B (en) |
Families Citing this family (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN107506870A (en) * | 2017-09-06 | 2017-12-22 | 国家电网公司 | A kind of electric service hotspot prediction method based on hot word |
Citations (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101488150A (en) * | 2009-03-04 | 2009-07-22 | 哈尔滨工程大学 | Real-time multi-view network focus event analysis apparatus and analysis method |
| CN101887459A (en) * | 2010-06-28 | 2010-11-17 | 中国科学院计算技术研究所 | Network video topic detection method and system thereof |
| CN102402715A (en) * | 2010-09-13 | 2012-04-04 | 方正国际软件有限公司 | Method and device for presenting incident hotspot region |
| CN102831248A (en) * | 2012-09-18 | 2012-12-19 | 北京奇虎科技有限公司 | Network hotspot mining method and network hotspot mining device |
| CN102880915A (en) * | 2012-09-06 | 2013-01-16 | 中山大学 | Method of forecasting electric quantity based on association mining of hot events |
| CN103593358A (en) * | 2012-08-16 | 2014-02-19 | 江苏金鸽网络科技有限公司 | Internet information hotspot control method based on cluster analysis |
-
2014
- 2014-05-22 CN CN201410220033.7A patent/CN105095318B/en active Active
Patent Citations (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101488150A (en) * | 2009-03-04 | 2009-07-22 | 哈尔滨工程大学 | Real-time multi-view network focus event analysis apparatus and analysis method |
| CN101887459A (en) * | 2010-06-28 | 2010-11-17 | 中国科学院计算技术研究所 | Network video topic detection method and system thereof |
| CN102402715A (en) * | 2010-09-13 | 2012-04-04 | 方正国际软件有限公司 | Method and device for presenting incident hotspot region |
| CN103593358A (en) * | 2012-08-16 | 2014-02-19 | 江苏金鸽网络科技有限公司 | Internet information hotspot control method based on cluster analysis |
| CN102880915A (en) * | 2012-09-06 | 2013-01-16 | 中山大学 | Method of forecasting electric quantity based on association mining of hot events |
| CN102831248A (en) * | 2012-09-18 | 2012-12-19 | 北京奇虎科技有限公司 | Network hotspot mining method and network hotspot mining device |
Also Published As
| Publication number | Publication date |
|---|---|
| CN105095318A (en) | 2015-11-25 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN106250523B (en) | A kind of method of distributed column storage system index | |
| CN105471637B (en) | A kind of complex network node importance appraisal procedure and system | |
| CN104504200B (en) | A kind of trend curve figure display methods for the monitoring of rotating machinery on-line vibration | |
| CN104408179A (en) | Method and device for processing data from data table | |
| CN105827422B (en) | A kind of method and device of determining network element alarming incidence relation | |
| CN106055580B (en) | A kind of fuzzy clustering result visualization method based on Radviz | |
| CN104282026B (en) | Distributing homogeneity appraisal procedure based on watershed algorithm and minimum spanning tree | |
| CN103744962B (en) | Method and device for realizing K-means clustering | |
| CN103456013A (en) | Method for expressing ultrapixels and measuring similarity between ultrapixels | |
| Smart | Quantitative characterization of channel network structure | |
| CN109117350A (en) | Alarm method, device and the server of automatic monitoring computer software and hardware | |
| CN105095318B (en) | A kind of method and apparatus for realizing analysis of central issue | |
| CN109947760A (en) | It is a kind of excavate KPI root because method and device | |
| CN109461133A (en) | Bridge bolt dropping detection method and terminal device | |
| CN109033322A (en) | A kind of test method and device of multidimensional data | |
| CN110795463B (en) | Mass time series data visualization method for transient analysis of power system | |
| Mirge et al. | Dense traffic flow patterns mining in bi-directional road networks using density based trajectory clustering | |
| CN106910140A (en) | A kind of method based on SVG form power system wiring diagram Network topologies | |
| CN108510010A (en) | A kind of density peaks clustering method and system based on prescreening | |
| CN103927765B (en) | For positioning the method and apparatus in bar code region in image | |
| CN108509532A (en) | A kind of accumulation method and apparatus applied to map | |
| Lee et al. | A perimeter-based clustering index for measuring spatial segregation: a cognitive GIS approach | |
| CN105764069B (en) | A kind of LTE network PCI planning Multipurpose Optimal Method | |
| CN105354610A (en) | Random Hough transform-based people counting method | |
| CN103377473A (en) | Method for eliminating repeated image and apparatus |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| C06 | Publication | ||
| PB01 | Publication | ||
| C10 | Entry into substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |