CN106650433A - Detecting method and system for abnormal behavior - Google Patents
Detecting method and system for abnormal behavior Download PDFInfo
- Publication number
- CN106650433A CN106650433A CN201611159571.5A CN201611159571A CN106650433A CN 106650433 A CN106650433 A CN 106650433A CN 201611159571 A CN201611159571 A CN 201611159571A CN 106650433 A CN106650433 A CN 106650433A
- Authority
- CN
- China
- Prior art keywords
- page
- page access
- user
- detected
- rule
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
- G06F21/55—Detecting local intrusion or implementing counter-measures
- G06F21/554—Detecting local intrusion or implementing counter-measures involving event detection and direct action
Abstract
The invention discloses a detecting method for an abnormal behavior. The detecting method comprises the steps of determining a page access behavior sequence and a frequent rule which corresponds to the page access behavior sequence according to page access behavior data of a user and judging the frequent rule; generating an abnormal behavior rule base according to an abnormal frequent rule in a judging result. The detecting method further comprises the steps of obtaining information of a behavior to be detected; conducting matching between the information of the behavior to be detected and the behavior in the abnormal behavior rule base, and judging the information of the behavior to be detected as abnormal behavior information when the matching is successful. The invention discloses a detecting system for the abnormal behavior at the same time.
Description
Technical field
The present invention relates to the data analysis technique in field of computer technology, more particularly to a kind of anomaly detection method
And system.
Background technology
With mobile terminal, the such as fast-developing and continuous popularization of mobile phone, computer, E-book reader, have increasingly
Many users can be read whenever and wherever possible using mobile terminal read electronic books, so as to enjoy the facility of reading
Property.However, in reading process, in order to improve the ranking or income of books, often there is the ranking (brush list) for refreshing list
Or the situation that brush is ordered, for example：For a book, certain chapters and sections of book or certain page, with the 2-3 seconds, even with longer
The frequency brush of time once, for attracting more users to pay close attention to the e-book.But because the user access activity can not
Truly reflect the amount of reading or purchase volume of user, and the adverse effect brought to system load can not in time find and respond,
Therefore, the behavior such as brush list, brush order belongs to the abnormal access behavior of user.
It is main using artificial in order to be monitored to the abnormal access behavior of user in current mobile terminal is read
The mode checked afterwards, i.e.,：After there is abnormal access behavior, more in units of day or the moon, the abnormal access behavior is entered
Pedestrian's work is checked.As can be seen here, the mode manually checked afterwards not only lost labor's cost, and efficiency is low, it is impossible to send out in time
Abnormal access behavior in existing reading process.Therefore, urgently need in prior art it is a kind of can to read user accession page
Sequence carries out monitor in real time, and the method that the abnormal access behavior to occurring is detected.
The content of the invention
In view of this, the embodiment of the present invention is expected to provide a kind of anomaly detection method and system, can effectively solve the problem that
Manually check that the high cost of presence, efficiency are low afterwards in prior art, and can not in time find and respond user's abnormal access
The problem of behavior.
To reach above-mentioned purpose, what the technical scheme of the embodiment of the present invention was realized in：
The embodiment of the present invention provides a kind of anomaly detection method, according to the page access behavioral data of user, it is determined that
Page access behavior sequence and frequent rule corresponding with the page access behavior sequence, and the frequent rule is entered
Row judges；Abnormal frequently rule in judged result, generates abnormal behaviour rule base；Methods described also includes：
Obtain behavioural information to be detected；
The behavioural information to be detected is matched with the behavior in the abnormal behaviour rule base, when the match is successful,
The behavioural information to be detected is judged to into abnormal behaviour information.
In such scheme, it is described the behavioural information to be detected is judged to abnormal behaviour information after, methods described
Also include：The result of determination of the behavioural information to be detected is preserved into the abnormal behaviour rule base.
In such scheme, the page access behavioral data of the user includes：Subscriber Number, session number, Page Name,
Page type and page access time.
In such scheme, the page access behavioral data according to user determines page access behavior sequence, including：
All page access behavioral datas of active user are obtained, to the page for needing to detect in the page access behavioral data
Noodles type carries out special identifier, and according to the session number and the page access time, the accession page of user is carried out
Sequence, the numbering of the accession page type of user is serialized, and obtains the page access behavior sequence.
In such scheme, before the determination frequent rule corresponding with the page access behavior sequence, the side
Method also includes：Duplicate removal is carried out to the numbering of the accession page type of the user.
The embodiment of the present invention also provides a kind of unusual checking system, and the system includes：Determining module, judge mould
Block, generation module, acquisition module, matching module；Wherein,
The determining module, for according to the page access behavioral data of user, determine page access behavior sequence and
Frequent rule corresponding with the page access behavior sequence；
The judge module, for judging the frequent rule；
The generation module, for the abnormal frequently rule in judged result, generates abnormal behaviour rule base；
The acquisition module, for obtaining behavioural information to be detected；
The matching module, for the behavioural information to be detected to be carried out with the behavior in the abnormal behaviour rule base
Matching, when the match is successful, is then judged to abnormal behaviour information by the behavioural information to be detected.
In such scheme, the generation module is additionally operable to judge the behavioural information to be detected in the matching module
After for abnormal behaviour information, the result of determination of the behavioural information to be detected is preserved into the abnormal behaviour rule base.
In such scheme, the determining module, specifically for：All page access behavioral datas of active user are obtained,
Page type to needing to detect in the page access behavioral data carries out special identifier, and according to the session number and described
Page access time, the accession page of user is ranked up, the numbering of the accession page type of user is serialized, obtained
To the page access behavior sequence.
In such scheme, the system also includes：Deduplication module, visits for determining in the determining module with the page
Before asking the corresponding frequent rule of behavior sequence, duplicate removal is carried out to the numbering of the accession page type of the user.
Anomaly detection method and system that the embodiment of the present invention is provided, according to the page access behavior number of user
According to, determine page access behavior sequence and frequent rule corresponding with the page access behavior sequence, and to described frequent
Rule is judged；Abnormal frequently rule in judged result, generates abnormal behaviour rule base；Obtain behavior letter to be detected
Breath；The behavioural information to be detected is matched with the behavior in the abnormal behaviour rule base, when the match is successful, will be described
Behavioural information to be detected is judged to abnormal behaviour information.Thus, by setting up abnormal behaviour rule base, in actual applications, profit
With the abnormal access behavior of abnormal behaviour rule base automatic identification user, cost of labor not only can be reduced, additionally it is possible to improve prison
The real-time and validity of control abnormal access behavior；Also, manually check afterwards due to not adopting, to a certain extent can be with
What is be likely to occur during avoiding manually checking can not in time find and respond the problem of user's abnormal access behavior, reach in time
It was found that purpose, so as to lift the use feeling of user.
Description of the drawings
Fig. 1 realizes schematic flow sheet for embodiment of the present invention anomaly detection method；
Fig. 2 is the composition structural representation of embodiment of the present invention unusual checking system.
Specific embodiment
The characteristics of in order to more fully hereinafter understand the embodiment of the present invention and technology contents, below in conjunction with the accompanying drawings to this
The realization of bright embodiment is described in detail, appended accompanying drawing purposes of discussion only for reference, not for limiting the present invention.
In embodiments of the present invention, the mobile terminal can include but is not limited to mobile phone, flat board, palm PC, electronics
The electronic equipments such as book reader.
As shown in figure 1, anomaly detection method realizes flow process in the embodiment of the present invention, comprise the following steps：
Step 101：According to the page access behavioral data of user, determine page access behavior sequence and with the page
Interview asks behavior sequence corresponding frequent rule, and the frequent rule is judged；
Here, the page access behavioral data of the user includes：Subscriber Number, session number, Page Name, classes of pages
The information such as type and page access time.
Wherein, the page type is included but is not limited to：Login page, the paying page, ordering page, reading page.For
The different visitor of differentiation, Website server can for each visitor distribute session number secure identifier (SID,
Security Identifiers), all data that visitor preserves in session (Session) are all associated with SID.This
Sample, during Accessor Access's page, arranges and obtains Session data by SID, therefore, can be with by Session
Realize the data sharing between multiple pages.When user logs in any one page, mark and login user can will be logged in
Name is stored in Session variables, can just know that the user has logged on so in other pages, so as to avoid repeating to step on
The problem of record.
According to the page access behavioral data of user in this step, page access behavior sequence is determined, specifically include：Obtain
All page access behavioral datas of active user, the page type to needing to detect in the page access behavioral data carries out spy
Different mark, and according to the session number and the page access time, the accession page of user is ranked up, by user's
The numbering of accession page type is serialized, and obtains the page access behavior sequence.
Specifically, can be from all page access behavior numbers of extracting directly active user in the page access list of user
According to, and the page type to needing detection carries out special identifier, such as, will individually be compiled with order and the costs related page
Number, to be different from page type table in other ordinary pages, for example, addition special identifier after page type be：Login page-
1st, the paying page -2, ordering page -3, reading page -4 ...；After process is identified to above-mentioned page type, according to
Session number and page access time, the accession page of user is carried out temporally with the sequence of session number, such as, 6:00/1
→7:00/2→8:00/3→9:00/4 →... ..., the numbering for so making the accession page type of user realizes serializing, so as to
The accession page behavior sequence of user is obtained, that is, has obtained the use track of user.Here, the effect of time is to be arranged
Sequence.
Here it is possible to Sequential Pattern Mining Algorithm is based on, it is determined that frequent rule corresponding with the page access behavior sequence
Then.Preferably, the GSP algorithms in Sequential Pattern Mining Algorithm can be adopted, by arranging page access behavior sequence pattern most
Little support angle value, using the alternative manner successively searched for Frequent episodes are searched out.Wherein, the minimum support value is sequence number
According to the sequence number comprising certain sequence in storehouse；Here, for how using GSP algorithms and the alternative manner successively searched for searching
Go out Frequent episodes, belong to prior art, this is no longer going to repeat them.
Here, before the determination frequent rule corresponding with the page access behavior sequence, methods described is also wrapped
Include：Duplicate removal is carried out to the numbering of the accession page type of the user.
Here, due to being possible in a duration section, in same page type, cause page access behavior sequence
Length it is very long, so as to affect the Detection results of abnormal behaviour, now need to repeat page number process, by page
Face redirects to obtain accurately entering data.For example：The numbering of current user to access pages type is 1 → 1 → 1 → 1 → 1 →
6, then for redirecting, the numbering for carrying out the user to access pages type after duplicate removal is 1 → 6.
Step 102：Abnormal frequently rule in judged result, generates abnormal behaviour rule base；
Here, can according to the experience accumulation of service needed and user, it is pair corresponding with page access behavior sequence frequently
Rule detected, whether rationally to judge it, that is, determine which frequent rule is rational, and which frequent rule is abnormal
's.For abnormal frequent rule, in being added to abnormal behaviour rule base.Wherein, the storage side of abnormal behaviour rule base
Formula includes database or big data thesaurus.
Step 103：Obtain behavioural information to be detected；
Step 104：The behavioural information to be detected is matched with the behavior in the abnormal behaviour rule base, is matched
When successful, the behavioural information to be detected is judged to into abnormal behaviour information.
Here, for the abnormal behaviour information for detecting, comprehensively its page access behavior testing result can be further confirmed that,
Further, business details can be deep into.Furthermore it is also possible to respective handling is carried out to abnormal behaviour, for example：For order
Abnormal user, can carry out alerting redirecting for the page；For rate sensitive kinds user, follow-up paying conversion etc. can be carried out.Its
In, rate sensitivity can be considered and merely desire to see free.
Here, it is described the behavioural information to be detected is judged to abnormal behaviour information after, methods described also includes：
The result of determination of the behavioural information to be detected is preserved into the abnormal behaviour rule base.
Here, the page access behavior sequence in the behavioural information to be detected is possible within a period of time in same
Page type, causes the length of page access behavior sequence very long, in reading page in a such as hour, therefore, to avoid
The testing result of follow-up abnormal behaviour, needs is affected the result of determination of the behavioural information to be detected to be preserved to the exception
Before in action rule warehouse, duplicate removal is carried out to the page access behavior sequence in the behavioural information to be detected.
The embodiment of the present invention determines frequent rule according to page access behavior sequence, and is generated according to frequent rule abnormal
Action rule warehouse, so that using the abnormal behaviour rule base monitor in real time abnormal behaviour for generating, being compared to existing artificial
Auditing method afterwards, the mesh of the abnormal behaviour such as the method can reach brush list for finding occur in reading process in time or brush is ordered
, the real-time of monitoring is improved, can preferably monitor the abnormal behaviour of continuous brush ordering page and be read using alternately brush order
Read the abnormal behaviour of the page, and good effect can be played to the paying of rate sensitive users conversion.
To realize said method, the embodiment of the present invention additionally provides a kind of unusual checking system, as shown in Fig. 2 should
System includes determining module 201, judge module 202, generation module 203, acquisition module 204, matching module 205；Wherein,
The determining module 201, for according to the page access behavioral data of user, determine page access behavior sequence,
And frequent rule corresponding with the page access behavior sequence；
The judge module 202, for judging the frequent rule；
The generation module 203, it is raw for the abnormal frequently rule in the judged result of the judge module 202
Into abnormal behaviour rule base；
The acquisition module 204, for obtaining behavioural information to be detected；
The matching module 205, for by the behavior in the behavioural information to be detected and the abnormal behaviour rule base
Matched, when the match is successful, the behavioural information to be detected is judged to into abnormal behaviour information.
Wherein, the page access behavioral data of the user includes：Subscriber Number, session number, Page Name, classes of pages
Type and page access time；The page type includes：Login page, the paying page, ordering page and reading page.
Here, the determining module 201, specifically for：All page access behavioral datas of active user are obtained, to institute
Stating needs the page type for detecting to carry out special identifier in page access behavioral data, and according to the session number and the page
Access time, is ranked up to the accession page of user, and the numbering of the accession page type of user is serialized, and obtains institute
State page access behavior sequence.
Here, Sequential Pattern Mining Algorithm can be based on, it is determined that frequent rule corresponding with the page access behavior sequence.
Here, the generation module 203, is additionally operable to judge the behavioural information to be detected in the matching module 205
After for abnormal behaviour information, the result of determination of the behavioural information to be detected is preserved into the abnormal behaviour rule base.
Here, the system also includes：Deduplication module 206, visits for determining in the determining module 201 with the page
Before asking the corresponding frequent rule of behavior sequence, duplicate removal is carried out to the numbering of the accession page type of the user.
In actual applications, the determining module 201, judge module 202, generation module 203, acquisition module 204, matching
Module 205, deduplication module 206 can be by central processing unit (CPU, the Central Processing on mobile terminal
Unit), microprocessor (MPU, Micro Processor Unit), digital signal processor (DSP, Digital Signal
) or field programmable gate array (FPGA, Field Programmable Gate Array) etc. is realized Processor.
The embodiment of the present invention according to the page access behavioral data of user, determine page access behavior sequence and with institute
The corresponding frequent rule of page access behavior sequence is stated, and the frequent rule is judged；It is different in judged result
It is often frequently regular, generate abnormal behaviour rule base；Obtain behavioural information to be detected；The behavioural information to be detected is different with described
The often behavior in action rule warehouse is matched, and when the match is successful, the behavioural information to be detected is judged to into abnormal behaviour is believed
Breath.Thus, by setting up abnormal behaviour rule base, in actual applications, using abnormal behaviour rule base automatic identification user's
Abnormal access behavior, not only can reduce cost of labor, additionally it is possible to improve the real-time and validity of monitoring abnormal access behavior；
Also, manually check afterwards due to not adopting, can also avoid being likely to occur not during manually checking to a certain extent
The problem of user's abnormal access behavior can be in time found and be responded, the purpose of timely discovery is reached, so as to lift the use of user
Impression.
Those skilled in the art are it should be appreciated that embodiments of the invention can be provided as method, system or computer program
Product.Therefore, the present invention can adopt hardware embodiment, software implementation or the shape with reference to the embodiment in terms of software and hardware
Formula.And, the present invention can be adopted can be with storage in one or more computers for wherein including computer usable program code
The form of the computer program implemented on medium (including but not limited to magnetic disc store and optical memory etc.).
The present invention is the flow process with reference to method according to embodiments of the present invention, equipment (system) and computer program
Figure and/or block diagram are describing.It should be understood that can be by computer program instructions flowchart and/or each stream in block diagram
The combination of journey and/or square frame and flow chart and/or the flow process in block diagram and/or square frame.These computer programs can be provided
The processor of all-purpose computer, special-purpose computer, Embedded Processor or other programmable data processing devices is instructed to produce
A raw machine so that produced for reality by the instruction of computer or the computing device of other programmable data processing devices
The device of the function of specifying in present one flow process of flow chart or one square frame of multiple flow processs and/or block diagram or multiple square frames.
These computer program instructions may be alternatively stored in can guide computer or other programmable data processing devices with spy
In determining the computer-readable memory that mode works so that the instruction being stored in the computer-readable memory is produced to be included referring to
Make the manufacture of device, the command device realize in one flow process of flow chart or one square frame of multiple flow processs and/or block diagram or
The function of specifying in multiple square frames.
These computer program instructions also can be loaded in computer or other programmable data processing devices so that in meter
Series of operation steps is performed on calculation machine or other programmable devices to produce computer implemented process, so as in computer or
The instruction performed on other programmable devices is provided for realizing in one flow process of flow chart or multiple flow processs and/or block diagram one
The step of function of specifying in individual square frame or multiple square frames.
The above, only presently preferred embodiments of the present invention is not intended to limit protection scope of the present invention, it is all
Any modification, equivalent and improvement for being made within the spirit and principles in the present invention etc., should be included in the protection of the present invention
Within the scope of.
Claims (10)
1. a kind of anomaly detection method, it is characterised in that according to the page access behavioral data of user, determine page access
Behavior sequence and frequent rule corresponding with the page access behavior sequence, and the frequent rule is judged；Root
It is judged that the abnormal frequently rule in result, generates abnormal behaviour rule base；Methods described also includes：
Obtain behavioural information to be detected；
The behavioural information to be detected is matched with the behavior in the abnormal behaviour rule base, when the match is successful, by institute
State behavioural information to be detected and be judged to abnormal behaviour information.
2. method according to claim 1, it is characterised in that the behavioural information to be detected is judged to into exception described
After behavioural information, methods described also includes：The result of determination of the behavioural information to be detected is preserved to the abnormal behaviour
In rule base.
3. method according to claim 1 and 2, it is characterised in that the page access behavioral data of the user includes：With
Family number, session number, Page Name, page type and page access time.
4. method according to claim 3, it is characterised in that the page access behavioral data according to user, it is determined that
Page access behavior sequence, including：
All page access behavioral datas of active user are obtained, to the classes of pages for needing to detect in the page access behavioral data
Type carries out special identifier, and according to the session number and the page access time, the accession page of user is ranked up,
The numbering of the accession page type of user is serialized, the page access behavior sequence is obtained.
5. method according to claim 4, it is characterised in that it is described determine it is corresponding with the page access behavior sequence
It is frequent rule before, methods described also includes：Duplicate removal is carried out to the numbering of the accession page type of the user.
6. a kind of unusual checking system, it is characterised in that the system includes：Determining module, judge module, generation mould
Block, acquisition module, matching module；Wherein,
The determining module, for according to the page access behavioral data of user, determine page access behavior sequence and with institute
State the corresponding frequent rule of page access behavior sequence；
The judge module, for judging the frequent rule；
The generation module, for the abnormal frequently rule in judged result, generates abnormal behaviour rule base；
The acquisition module, for obtaining behavioural information to be detected；
A matching module, for the behavior in the behavioural information to be detected and the abnormal behaviour rule base to be carried out
Match somebody with somebody, when the match is successful, then the behavioural information to be detected is judged to into abnormal behaviour information.
7. system according to claim 6, it is characterised in that the generation module, being additionally operable to will in the matching module
The behavioural information to be detected is judged to after abnormal behaviour information, by the result of determination of the behavioural information to be detected preserve to
In the abnormal behaviour rule base.
8. the system according to claim 6 or 7, it is characterised in that the page access behavioral data of the user includes：With
Family number, session number, Page Name, page type and page access time.
9. system according to claim 8, it is characterised in that the determining module, specifically for：
All page access behavioral datas of active user are obtained, to the classes of pages for needing to detect in the page access behavioral data
Type carries out special identifier, and according to the session number and the page access time, the accession page of user is ranked up,
The numbering of the accession page type of user is serialized, the page access behavior sequence is obtained.
10. system according to claim 9, it is characterised in that the system also includes：Deduplication module, for described
Before determining module determination frequent rule corresponding with the page access behavior sequence, the accession page type to the user
Numbering carry out duplicate removal.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201611159571.5A CN106650433B (en) | 2016-12-15 | 2016-12-15 | A kind of anomaly detection method and system |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201611159571.5A CN106650433B (en) | 2016-12-15 | 2016-12-15 | A kind of anomaly detection method and system |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN106650433A true CN106650433A (en) | 2017-05-10 |
| CN106650433B CN106650433B (en) | 2018-09-04 |
Family
ID=58823749
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201611159571.5A Active CN106650433B (en) | 2016-12-15 | 2016-12-15 | A kind of anomaly detection method and system |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN106650433B (en) |
Cited By (8)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN107481117A (en) * | 2017-08-21 | 2017-12-15 | 掌阅科技股份有限公司 | Detection method, electronic equipment and the computer-readable storage medium of abnormal behaviour |
| CN109492023A (en) * | 2018-10-12 | 2019-03-19 | 咪咕文化科技有限公司 | A kind of automobile information processing method and its equipment, computer storage medium |
| CN110704773A (en) * | 2018-06-25 | 2020-01-17 | 顺丰科技有限公司 | Abnormal behavior detection method and system based on frequent behavior sequence mode |
| CN111221722A (en) * | 2019-09-23 | 2020-06-02 | 平安科技（深圳）有限公司 | Behavior detection method and device, electronic equipment and storage medium |
| CN111368169A (en) * | 2018-12-25 | 2020-07-03 | 卓望数码技术（深圳）有限公司 | Method, device, equipment and storage medium for detecting brushing amount behavior |
| CN114257427A (en) * | 2021-12-09 | 2022-03-29 | 北京知道创宇信息技术股份有限公司 | Target user identification method and device, electronic equipment and storage medium |
| CN114666391A (en) * | 2020-12-03 | 2022-06-24 | 中国移动通信集团广东有限公司 | Access track determining method, device, equipment and storage medium |
| CN117201090A (en) * | 2023-08-28 | 2023-12-08 | 山东亚泽信息技术有限公司 | Abnormal behavior detection processing method and system |
Citations (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN104537553A (en) * | 2015-01-19 | 2015-04-22 | 齐鲁工业大学 | Application of repeated negative sequence pattern in customer purchase behavior analysis |
-
2016
- 2016-12-15 CN CN201611159571.5A patent/CN106650433B/en active Active
Patent Citations (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN104537553A (en) * | 2015-01-19 | 2015-04-22 | 齐鲁工业大学 | Application of repeated negative sequence pattern in customer purchase behavior analysis |
Non-Patent Citations (2)
| Title |
|---|
| 杜洪波: "《时间序列相似性查询及异常检测算法的研究》", 《中国优秀硕士学位论文全全文数据库》 * |
| 钱昱: "基于序列模式的异常检测", 《微机发展》 * |
Cited By (13)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN107481117A (en) * | 2017-08-21 | 2017-12-15 | 掌阅科技股份有限公司 | Detection method, electronic equipment and the computer-readable storage medium of abnormal behaviour |
| CN110704773A (en) * | 2018-06-25 | 2020-01-17 | 顺丰科技有限公司 | Abnormal behavior detection method and system based on frequent behavior sequence mode |
| CN109492023A (en) * | 2018-10-12 | 2019-03-19 | 咪咕文化科技有限公司 | A kind of automobile information processing method and its equipment, computer storage medium |
| CN109492023B (en) * | 2018-10-12 | 2021-02-19 | 咪咕文化科技有限公司 | Automobile information processing method and equipment and computer storage medium |
| CN111368169B (en) * | 2018-12-25 | 2023-08-01 | 卓望数码技术（深圳）有限公司 | Method, device, equipment and storage medium for detecting brushing amount behavior |
| CN111368169A (en) * | 2018-12-25 | 2020-07-03 | 卓望数码技术（深圳）有限公司 | Method, device, equipment and storage medium for detecting brushing amount behavior |
| CN111221722A (en) * | 2019-09-23 | 2020-06-02 | 平安科技（深圳）有限公司 | Behavior detection method and device, electronic equipment and storage medium |
| CN111221722B (en) * | 2019-09-23 | 2024-01-30 | 平安科技（深圳）有限公司 | Behavior detection method, behavior detection device, electronic equipment and storage medium |
| CN114666391B (en) * | 2020-12-03 | 2023-09-19 | 中国移动通信集团广东有限公司 | Method, device, equipment and storage medium for determining access track |
| CN114666391A (en) * | 2020-12-03 | 2022-06-24 | 中国移动通信集团广东有限公司 | Access track determining method, device, equipment and storage medium |
| CN114257427B (en) * | 2021-12-09 | 2023-12-01 | 北京知道创宇信息技术股份有限公司 | Target user identification method and device, electronic equipment and storage medium |
| CN114257427A (en) * | 2021-12-09 | 2022-03-29 | 北京知道创宇信息技术股份有限公司 | Target user identification method and device, electronic equipment and storage medium |
| CN117201090A (en) * | 2023-08-28 | 2023-12-08 | 山东亚泽信息技术有限公司 | Abnormal behavior detection processing method and system |
Also Published As
| Publication number | Publication date |
|---|---|
| CN106650433B (en) | 2018-09-04 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN106650433A (en) | Detecting method and system for abnormal behavior | |
| CN110442712B (en) | Risk determination method, risk determination device, server and text examination system | |
| CN111177714B (en) | Abnormal behavior detection method and device, computer equipment and storage medium | |
| US20110166926A1 (en) | Evaluating Online Marketing Efficiency | |
| CN114840853B (en) | Digital business analysis method based on big data and cloud server | |
| CN107578263A (en) | A kind of detection method, device and the electronic equipment of advertisement abnormal access | |
| CN106327230B (en) | Abnormal user detection method and equipment | |
| CN107330326A (en) | A kind of malice trojan horse detection processing method and processing device | |
| CN114996103A (en) | Page abnormity detection method and device, electronic equipment and storage medium | |
| CN109542764B (en) | Webpage automatic testing method and device, computer equipment and storage medium | |
| US10990985B2 (en) | Remote supervision of client device activity | |
| CN110659435A (en) | Page data acquisition processing method and device, computer equipment and storage medium | |
| CN111340540B (en) | Advertisement recommendation model monitoring method, advertisement recommendation method and advertisement recommendation model monitoring device | |
| CN112347457A (en) | Abnormal account detection method and device, computer equipment and storage medium | |
| CN110457603A (en) | Customer relationship abstracting method, device, electronic equipment and readable storage medium storing program for executing | |
| Genga et al. | Towards a systematic process-aware behavioral analysis for security | |
| CN116340934A (en) | Terminal abnormal behavior detection method, device, equipment and storage medium | |
| CN107562599A (en) | A kind of parameter detection method and device | |
| CN112506765A (en) | Software testing method, device, equipment and storage medium | |
| CN115314404B (en) | Service optimization method, device, computer equipment and storage medium | |
| CN112003833A (en) | Abnormal behavior detection method and device | |
| CN116302888A (en) | System health degree detection method and device, computer equipment and storage medium thereof | |
| CN117454912A (en) | Product flow direction monitoring method, device, computer equipment and storage medium | |
| CN117520743A (en) | Method, device, equipment, storage medium and product for monitoring user electricity consumption risk | |
| CN116975870A (en) | System security assessment method, device, computer equipment and storage medium |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |