CN106815255A - The method and device of detection data access exception - Google Patents
The method and device of detection data access exception Download PDFInfo
- Publication number
- CN106815255A CN106815255A CN201510867547.6A CN201510867547A CN106815255A CN 106815255 A CN106815255 A CN 106815255A CN 201510867547 A CN201510867547 A CN 201510867547A CN 106815255 A CN106815255 A CN 106815255A
- Authority
- CN
- China
- Prior art keywords
- data
- time point
- amount
- detected
- cycle
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
- G06F16/90—Details of database functions independent of the retrieved data types
- G06F16/95—Retrieval from the web
- G06F16/951—Indexing; Web crawling techniques
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
- G06F16/90—Details of database functions independent of the retrieved data types
- G06F16/95—Retrieval from the web
- G06F16/957—Browsing optimisation, e.g. caching or content distillation
- G06F16/9574—Browsing optimisation, e.g. caching or content distillation of access to content, e.g. by caching
Abstract
The invention discloses a kind of method and device of detection data access exception.Wherein, the method includes：The history for obtaining time point to be detected accesses data, wherein, history accesses packet containing the data volume and data volume corresponding time point for accessing parameter；According to the advance time cycle for dividing, the cycle very first time belonging to time point to be detected is determined, and the first access data that extracting data was in the cycle very first time are accessed from history；According to the data volume in the cycle very first time and the corresponding time point of the data volume in the cycle very first time, time point to be detected corresponding first predicted data amount is determined；If time point to be detected, corresponding actual amount of data was more than the first predicted data amount, actual amount of data exception is determined.The present invention is solved because existing data access method for detecting abnormality is also easy to produce deviation or judges the relatively low technical problem of the accuracy for causing by accident.
Description
Technical field
The present invention relates to internet arena, in particular to a kind of method and device of detection data access exception.
Background technology
With the fast development of internet in recent years, increasing user understands current events, purchase commodity by internet
Or webpage is browsed, therefore, the detection to data access exception is then arisen at the historic moment.For example, third party software calls certain
The data of application, operator needs to know that the amount that daily third party software calls the application is at one from business
In rational scope, judge that the third party software is the data for pulling the application in malice with this, and carry out
Early warning.
It is mostly by the data and history number to the new generation of current point in time for the abnormality detection of data overall trend
According to average contrasted, or carried out by the data and the data at previous time point to the new generation of current point in time
Contrast to detect that the data that current point in time is newly produced whether there is exception.
However, the average based on current point in time and historical data is compared and draws testing result, continue for one group with
For the data set of growth, the average of historical data has not had representational to the data of the new generation of current point in time
In the case of, for the new data for producing, whether abnormal judgement just has deviation；Based on the number that current point in time is newly produced
Compared according to the data with previous time point the testing result that draws again easily because the data at previous time point
Abnormal situation (continuous data occur abnormal) and there is erroneous judgement.
For above-mentioned problem, effective solution is not yet proposed at present.
The content of the invention
A kind of method and device of detection data access exception is the embodiment of the invention provides, at least to solve due to existing
Data access method for detecting abnormality be also easy to produce deviation or the relatively low technical problem of the accuracy that causes of erroneous judgement.
A kind of one side according to embodiments of the present invention, there is provided method of detection data access exception, including：Obtain
The history for taking time point to be detected accesses data, wherein, the history access packet containing the data volume for accessing parameter and
The data volume corresponding time point；According to the advance time cycle for dividing, determine belonging to the time point to be detected
The cycle very first time, and access the first access number that extracting data was in the cycle very first time from the history
According to, wherein, described first accesses packet containing the data volume in the cycle very first time and the cycle very first time
Interior data volume corresponding time point；According to the data volume in the cycle very first time and in the cycle very first time
Data volume corresponding time point, determine the time point to be detected corresponding first predicted data amount；If described to be checked
Survey time point corresponding actual amount of data and be more than first predicted data amount, determine the actual amount of data exception.
Another aspect according to embodiments of the present invention, additionally provides a kind of device of detection data access exception, including：
First acquisition unit, the history for obtaining time point to be detected accesses data, wherein, the history accesses packet
Containing the data volume and the data volume corresponding time point that access parameter；Extraction unit, for according to it is advance divide when
Between the cycle, determine the cycle very first time belonging to the time point to be detected, and extracting data is accessed from the history
The first access data within the cycle very first time, wherein, when the first access packet contains described first
Between the data volume in the cycle and the data volume corresponding time point in the cycle very first time；First determining unit, uses
Data volume within according to the cycle very first time and the data volume corresponding time point in the cycle very first time,
Determine the time point to be detected corresponding first predicted data amount；Detection unit, if for the time point to be detected
Corresponding actual amount of data is more than first predicted data amount, determines the actual amount of data exception.
In embodiments of the present invention, data are accessed using the history for obtaining time point to be detected, wherein, history accesses number
According to comprising the data volume and data volume corresponding time point for accessing parameter；According to the advance time cycle for dividing, it is determined that treating
The cycle very first time belonging to detection time point, and access extracting data was in the cycle very first time the from history
One access data, wherein, first access the packet cycle containing the very first time in data volume and in the cycle very first time
Data volume corresponding time point；According to the data volume in the cycle very first time and the correspondence of the data volume in the cycle very first time
Time point, determine time point to be detected corresponding first predicted data amount；If time point to be detected corresponding actual number
It is more than the first predicted data amount according to amount, determines the abnormal mode of actual amount of data, extracting data is accessed by from history
Belong to the first of the same time cycle with time point to be detected and access data, when determining to be detected according to the first access data
Between put corresponding first predicted data amount, and then determine whether time point to be detected corresponding actual amount of data abnormal, reaches
To the accurate purpose for carrying out business early warning, it is achieved thereby that improving the technology effect of the accuracy of detection data access exception
Really, so solve due to existing data access method for detecting abnormality be also easy to produce deviation or the accuracy that causes of erroneous judgement compared with
Low technical problem.
Brief description of the drawings
Accompanying drawing described herein is used for providing a further understanding of the present invention, constitutes the part of the application, this hair
Bright schematic description and description does not constitute inappropriate limitation of the present invention for explaining the present invention.In accompanying drawing
In：
Fig. 1 is a kind of hardware of the terminal of the service data access right control method according to the embodiment of the present application
Structured flowchart；
Fig. 2 is the schematic flow sheet of the method for a kind of optional detection data access exception according to the embodiment of the present application；
Fig. 3 is the schematic flow sheet of the method for the optional detection data access exception of another kind according to the embodiment of the present application；
Fig. 4 is the schematic flow sheet of the method for another the optional detection data access exception according to the embodiment of the present application；
Fig. 5 is the schematic flow sheet of the method for another the optional detection data access exception according to the embodiment of the present application；
Fig. 6 is the structural representation of the device of a kind of optional detection data access exception according to the embodiment of the present application；
Fig. 7 is the structural representation of the device of the optional detection data access exception of another kind according to the embodiment of the present application；
Fig. 8 is the structural representation of the device of another the optional detection data access exception according to the embodiment of the present application；
Fig. 9 is the structural representation of the device of another the optional detection data access exception according to the embodiment of the present application.
Specific embodiment
In order that those skilled in the art more fully understand the present invention program, below in conjunction with the embodiment of the present invention
Accompanying drawing, is clearly and completely described to the technical scheme in the embodiment of the present invention, it is clear that described embodiment
The only embodiment of a present invention part, rather than whole embodiments.Based on the embodiment in the present invention, ability
The every other embodiment that domain those of ordinary skill is obtained under the premise of creative work is not made, should all belong to
The scope of protection of the invention.
It should be noted that term " first ", " in description and claims of this specification and above-mentioned accompanying drawing
Two " it is etc. for distinguishing similar object, without for describing specific order or precedence.It should be appreciated that this
The data that sample is used can be exchanged in the appropriate case, so as to embodiments of the invention described herein can with except
Here the order beyond those for illustrating or describing is implemented.Additionally, term " comprising " and " having " and they
Any deformation, it is intended that covering is non-exclusive to be included, for example, containing process, the side of series of steps or unit
Method, system, product or equipment are not necessarily limited to those steps clearly listed or unit, but may include unclear
List or for these processes, method, product or other intrinsic steps of equipment or unit.
Embodiment 1
According to embodiments of the present invention, additionally provide a kind of embodiment of the method for the method of detection data access exception, it is necessary to
Illustrate, can be in the such as one group department of computer science of computer executable instructions the step of the flow of accompanying drawing is illustrated
Performed in system, and, although logical order is shown in flow charts, but in some cases, can be with difference
Shown or described step is performed in order herein.
The embodiment of the method that the embodiment of the present application one is provided can be in mobile terminal, terminal or similar fortune
Calculate execution in device.As a example by running on computer terminals, Fig. 1 is that a kind of detection data of the embodiment of the present invention is visited
Ask the hardware block diagram of the terminal of abnormal method.As shown in figure 1, terminal 10 can include one
(processor 102 can include but is not limited to Micro-processor MCV to individual or multiple (one is only shown in figure) processor 102
Or the processing unit of PLD FPGA etc.), the memory 104 for data storage and for communicating
The transmitting device 106 of function.It will appreciated by the skilled person that the structure shown in Fig. 1 is only to illustrate, its
The structure to above-mentioned electronic installation does not cause to limit.For example, terminal 10 may also include than shown in Fig. 1 more
Many or less components, or with the configuration different from shown in Fig. 1.
Memory 104 can be used to store the software program and module of application software, such as detection in the embodiment of the present invention
The abnormal corresponding programmed instruction/module of method of data access, processor 102 is by running storage in memory 104
Interior software program and module, so as to perform various function application and data processing, that is, realize above-mentioned application journey
The leak detection method of sequence.Memory 104 may include high speed random access memory, may also include nonvolatile memory,
Such as one or more magnetic storage device, flash memory or other non-volatile solid state memories.In some instances,
Memory 104 can further include the memory remotely located relative to processor 102, and these remote memories can be with
By network connection to terminal 10.The example of above-mentioned network include but is not limited to internet, intranet,
LAN, mobile radio communication and combinations thereof.
Transmitting device 106 is used to that data to be received or sent via a network.Above-mentioned network instantiation may include
The wireless network that the communication providerses of terminal 10 are provided.In an example, transmitting device 106 includes one
Network adapter (Network Interface Controller, NIC), it can be by base station and other network equipments
It is connected so as to be communicated with internet.In an example, transmitting device 106 can be radio frequency (Radio
Frequency, RF) module, it is used to wirelessly be communicated with internet.
Under above-mentioned running environment, this application provides the method for detection data access exception as shown in Figure 2.Fig. 2
It is the flow chart of the method for according to embodiments of the present invention one detection data access exception.
Step S202, the history for obtaining time point to be detected accesses data, wherein, history accesses packet and joins containing access
Several data volume and data volume corresponding time points.
In the application above-mentioned steps S202, the history at time point to be detected accesses data can be for before time point to be detected
Some or several preset time periods in access data, or all visits generated before time point to be detected
Ask data.Wherein, access parameter include it is following one or more：Visit capacity, order volume, the amount of calling, registration amount,
Trading volume and click volume.
So, to access parameter as visit capacity, time point to be detected is for as a example by 2015-8-1, visit capacity refers to certain website
Or application is accessed for number of times, the data volume for accessing parameter refers to the concrete numerical value in corresponding time point visit capacity, with
Illustrated as a example by table 1.
Table 1
| Time point | Visit capacity/time |
| 2015-7-1 | 84321 |
| 2015-7-2 | 97513 |
| …… | …… |
| 2015-7-4 | 125483 |
| 2015-7-5 | 153846 |
| …… | …… |
| 2015-7-31 | 81628 |
After the history for obtaining time point to be detected accesses data, data can be accessed to history and be cleaned (i.e.
The access data that exception is removed in data are accessed from history), treat the dry of analyze data collection to exclude abnormal access data
Disturb, specifically how from history access data in remove exception access data subsequent embodiment in will be described in detail,
Do not repeat herein.
Step S204, according to the advance time cycle for dividing, determines the cycle very first time belonging to time point to be detected,
And access the first access data that extracting data was in the cycle very first time from history.
In the application above-mentioned steps S204, first accesses data volume and the very first time in the packet cycle containing the very first time
Data volume corresponding time point in cycle；The time cycle for dividing in advance can be that the history to getting accesses data
Obtained after entering line period observation, it is often relevant with business experience, the fluctuation of some data volumes is for all with calendar month
Phase, have with week as cycle, some data volumes then have more complicated period of waves.
Still as a example by accessing parameter for visit capacity, typically there is the fluctuation significantly with weekend and non-weekend as cycle,
For example shown in table 1, the visit capacity of 2015-7-4 and 2015-7-5 in weekend apparently higher than non-weekend visit capacity,
And then the cycle very first time belonging to time point 2015-8-1 to be detected can be determined for weekend, therefore from historical data
Extract the first access data in weekend.
Step S206, according to the data volume in the cycle very first time and the corresponding time of the data volume in the cycle very first time
Point, determines time point to be detected corresponding first predicted data amount.
In the application above-mentioned steps S204, time point to be detected, corresponding first predicted data amount was a match value, was
By data statistics, according to the data volume in the cycle very first time and the corresponding time of the data volume in the cycle very first time
The value that point prediction goes out.
Specifically, according to the data volume in the cycle very first time and the corresponding time point of the data volume in the cycle very first time,
Determine that time point to be detected corresponding first predicted data amount includes：According to the data volume in the cycle very first time and first
At data volume corresponding time point in time cycle, determine the first linear function；Determined by the first linear function to be checked
Survey time point corresponding first predicted data amount.
Wherein, first linear function can be V (t)=a+bt, and V (t) represents data volume, and t represents time point,
According to the data volume in the cycle very first time and the corresponding time point of the data volume in the cycle very first time, a and b is determined
Value, then bring time point to be detected into the first linear function V (t)=a+bt, obtain time point to be detected corresponding
First predicted data amount.
Above-mentioned steps S204 to step S206, using periodicity analysis method, first accesses data and enters line period to history
Observation.It is analyzed to determine which time cycle time point to be detected is in by the periodicity for accessing history data
In (period of waves), the access data in the same time cycle are all extracted during history is then accessed data
Form a new data set.Briefly, such as the visit capacity of some websites has significantly with weekend and non-weekend
It is the fluctuation in cycle, if time point to be detected is in weekend, then just at all weekends in history access data
Access data pick-up and out form a new data set.A linear letter on the time is drawn according still further to data statistics
Number (the first i.e. above-mentioned linear function), and then the fitting gone out on time point to be detected using this first linear function call
Value (the first i.e. above-mentioned predicted data amount) is V1.
Step S208, if time point to be detected corresponding actual amount of data is more than the first predicted data amount, determines actual number
It is abnormal according to amount.
In the application above-mentioned steps S208, if actual amount of data is more than the first above-mentioned predicted data amount, can recognize
It is interior in rational interval in the amplitude of the actual amount of data at the time point to be detected, otherwise determines actual amount of data exception.
From the foregoing, it will be observed that the scheme that the above embodiments of the present application one are provided, accesses extracting data and treats by from history
Detection time point belongs to the first access data in same time cycle, and accessing data according to first determines time point to be detected
Corresponding first predicted data amount, and then determine whether time point to be detected corresponding actual amount of data is abnormal, reaches
The accurate purpose for carrying out business early warning, it is achieved thereby that the technique effect of the accuracy of detection data access exception is improved,
And then solve because existing data access method for detecting abnormality is also easy to produce deviation or the accuracy that causes of erroneous judgement is relatively low
Technical problem.
Alternatively, as shown in figure 3, accessing the first access that extracting data was in the cycle very first time from history
Before data, the method for the detection data access exception of the present embodiment also includes：
Step S302, obtains the data exception percentage that history accesses data, wherein, data exception percentage is used for table
Show that history accesses the rate of change between data volume and the data volume of adjacent time point in data.
In the application step S302, abnormal going through is excluded by calculating the data exception percentage of history access data
History accesses the interference that data are brought.Judge on a historical time point data volume whether be belonging to it is abnormal, can be with
Compared with two time points for closing on using by it, for example, judge t day datas V (t), it and V (t-1) can be taken
Compared with the average of V (t+n+1), but this depends on that the abnormal access cycle is how many, it is assumed here that abnormal access
Cycle is n days, and from t to t+n, day is all abnormal data to such as one data, and problem was resolved since t+n+1 days
In the normal scope of data regression, it is clear that to come with V (t-1) by V (t+1) to V (t+n) when V (t) is judged
It is all inappropriate for comparing.
Therefore in the present embodiment, the data exception percentage for obtaining history access data includes：By formula
M=(V (t)-(V (t+n+1)-V (t-1))/2)/V (t), is calculated data exception percentage, wherein, M is that data are different
Normal percentage, V (t) is data volume, and t is data volume corresponding time point, and n is the default abnormal access cycle.
Step S304, if data exception percentage is more than the first predetermined threshold value, determines the corresponding visit of data exception percentage
Ask that data are abnormal access data.
In the application above-mentioned steps S304, the first predetermined threshold value is in general empirical value, and it is according to different business
Scape and it is different.If for example, M is less than or equal to the first predetermined threshold value, normal access data are can be determined that, if M
More than the first predetermined threshold value, then illustrate that the corresponding data that access of M are abnormal access data, and then its property history is accessed
Removed in data.
Step S306, accesses from history and abnormal access data is removed in data.
Above-mentioned steps S302 to step S306 provides a kind of history and accesses the cleaning method of data (i.e. from history access
The access data of exception are removed in data), access interference of the data to analyze data collection to exclude abnormal history.Specifically
Ground, judges on one historical time point data whether be abnormal access data, can be using by it and two for closing on
Individual time point compares, for example, judge t day datas V (t), can take its average with V (t-1) and V (t+5)
To compare, but this depends on that the abnormal access cycle is how many, it is assumed here that the abnormal access cycle is 4 days, such as one
From t to t+4, day is all abnormal data to data, and problem was resolved in the normal scope of data regression since t+5 days,
Obvious be all inappropriate to be compared with V (t-1) by V (t+1) to V (t+4) when V (t) is judged.Such as
Really (V (t)-(V (t+5)-V (t-1))/2)/V (t)<=5%, then can be determined that V (t) is normal data, otherwise by it from
History is removed in accessing number, and here, 5% is empirical value different according to different business scenarios.
Alternatively, as shown in figure 4, it is determined that before actual amount of data exception, the detection data of the present embodiment accesses different
Normal method also includes：
Step S402, according to history access data, draw for represent the relation between time point and data volume second
Linear function.
In the application above-mentioned steps S402, data can also be accessed according to history and show that second is linear by data statistics
Function, from unlike above-mentioned steps S204 to step S206, the second linear function is to access number according to whole history
Drawn by data statistics according to (or having removed the history access data of abnormal access data), that is, obtain First Line
Property the sample that is used of function and the second linear function it is different.
Step S404, time point to be detected corresponding second predicted data amount is obtained by the second linear function.
Wherein, if time point to be detected corresponding actual amount of data is more than the first predicted data amount, actual amount of data is determined
Exception includes：If time point to be detected, corresponding actual amount of data was more than the first predicted data amount and the second predicted data amount,
Determine actual amount of data exception.
Above-mentioned steps S402 to step S404, data (can also be that the history cleaned accesses data) are accessed with history
It is fitted, second linear function of the data on the time is drawn by full dose data statistics, such as V (t)=c+dt,
And then show that the match value (i.e. the second predicted data amount) on time point to be detected is V2 using the second linear function.
It should be noted that above-mentioned steps S402 to step S404 and step S204 to do not have between step S206 when
Between order restriction.
Alternatively, as shown in figure 5, it is determined that before actual amount of data exception, the detection data of the present embodiment accesses different
Normal method also includes：
Step S502, the corresponding data volume of previous time point according to time point to be detected obtains time point pair to be detected
The 3rd predicted data amount answered.
In the application above-mentioned steps S502, the corresponding data volume of previous time point at time point to be detected can be with it is to be checked
Survey the related data volume of time point corresponding data volume.For example, third party software call using A the amount of calling directly with
Directly related using the order volume of A and the click volume of the third party software, the tune amount ratio on time point to be detected is previous
It increases A percentage points, then match value (equivalent to the 3rd predicted data amount) V3 on time point to be detected is
Match value on the corresponding amount of calling of previous time point at time point to be detected × (1+A%), and/or time point to be detected
V3 (equivalent to the 3rd predicted data amount) is the corresponding click volume of previous time point × (1+A%) at time point to be detected.
Wherein, if time point to be detected corresponding actual amount of data is more than the first predicted data amount, actual amount of data is determined
Exception includes：If time point to be detected, corresponding actual amount of data was more than the first predicted data amount and the 3rd predicted data amount,
Determine actual amount of data exception.
Alternatively, the corresponding data volume of previous time point according to time point to be detected, obtains time point correspondence to be detected
The 3rd predicted data amount include：By formula Q=W (t-1) × (1+A%), the 3rd predicted data amount is calculated,
Wherein, Q is the 3rd predicted data amount, and W (t-1) is the corresponding data volume of previous time point at time point to be detected, A%
It is the percentage point of the data volume compared to the data volume growth of previous time point at time point to be detected.
You need to add is that, getting the first predicted data amount, the second predicted data amount and the 3rd predicted data amount
In the case of, the method for the detection data access exception of the present embodiment can take the first predicted data amount, the second prediction number
Compared according to the maximum V=max (V1, V2, V3) and actual amount of data in amount and the 3rd predicted data amount, such as fruit
Border data volume≤V, then it is considered that the amplitude of the data volume on the time point to be detected is in rational interval, otherwise
Determine actual amount of data exception.
It should be noted that above-mentioned steps S502 and step S202 is not to having the restriction of time sequencing between step S206.
It follows that the data access detection accuracy that prior art is present is poor, continue with the number for increasing for one group
For collection, the average of historical data do not had to the data of the new generation of current point in time it is representational in the case of,
For the new data for producing, whether abnormal judgement just has deviation；The data that are newly produced based on current point in time and previous
The data at individual time point compare the testing result for drawing again easily because the abnormal feelings of the data at previous time point
Condition (continuous data occur abnormal) and there is the problem of erroneous judgement, the application proposes a kind of based on history to access data
The first method for accessing data to carry out anomaly data detection for belonging to the same time cycle with time point to be detected is extracted,
By fitting time point to be detected corresponding first predicted data amount, and then determine time point to be detected corresponding reality
Whether data volume is abnormal, has reached the accurate purpose for carrying out business early warning, it is achieved thereby that improving detection data accesses different
The technique effect of normal accuracy.
It should be noted that for foregoing each method embodiment, in order to be briefly described, therefore it is all expressed as one it is
The combination of actions of row, but those skilled in the art should know, and the present invention is not limited by described sequence of movement
System, because according to the present invention, some steps can sequentially or simultaneously be carried out using other.Secondly, art technology
Personnel should also know that embodiment described in this description belongs to preferred embodiment, involved action and module
Not necessarily necessary to the present invention.
Through the above description of the embodiments, those skilled in the art can be understood that according to above-mentioned implementation
The method of example can add the mode of required general hardware platform to realize by software, naturally it is also possible to by hardware, but
The former is more preferably implementation method in many cases.Based on such understanding, technical scheme substantially or
Say that the part contributed to prior art can be embodied in the form of software product, the computer software product is deposited
Storage is in a storage medium (such as ROM/RAM, magnetic disc, CD), including some instructions are used to so that a station terminal
Equipment (can be mobile phone, computer, server, or network equipment etc.) is performed described in each embodiment of the invention
Method.
Embodiment 2
According to the embodiment of the present application, a kind of device embodiment for implementing above method embodiment, this Shen are additionally provided
Please the device that is provided of above-described embodiment can run on computer terminals.
Fig. 6 is the structural representation of the device of the detection data access exception according to the embodiment of the present application.
As shown in fig. 6, the device of the detection data access exception can include first acquisition unit 602, extraction unit
604th, the first determining unit 606 and detection unit 608.
Wherein, first acquisition unit 602, the history for obtaining time point to be detected accesses data, wherein, it is described
History accesses packet containing the data volume and the data volume corresponding time point for accessing parameter；Extraction unit 604, uses
According to the advance time cycle for dividing, determining the cycle very first time belonging to the time point to be detected, and from described
History accesses the first access data that extracting data was in the cycle very first time, wherein, described first accesses
Packet is containing the data volume in the cycle very first time and the data volume corresponding time point in the cycle very first time；
First determining unit 606, for according to the data volume in the cycle very first time and in the cycle very first time
At data volume corresponding time point, determine the time point to be detected corresponding first predicted data amount；Detection unit 608,
If being more than first predicted data amount for time point to be detected corresponding actual amount of data, the reality is determined
Data volume exception.
From the foregoing, it will be observed that the scheme that the above embodiments of the present application two are provided, accesses extracting data and treats by from history
Detection time point belongs to the first access data in same time cycle, and accessing data according to first determines time point to be detected
Corresponding first predicted data amount, and then determine whether time point to be detected corresponding actual amount of data is abnormal, reaches
The accurate purpose for carrying out business early warning, it is achieved thereby that the technique effect of the accuracy of detection data access exception is improved,
And then solve because existing data access method for detecting abnormality is also easy to produce deviation or the accuracy that causes of erroneous judgement is relatively low
Technical problem.
Herein it should be noted that above-mentioned first acquisition unit 602, extraction unit 604, the first determining unit 606
And detection unit 608 corresponds to the step S202 to step S208 in embodiment one, four modules and corresponding step
Suddenly the example realized is identical with application scenarios, but is not limited to the disclosure of that of above-described embodiment one.Need explanation
It is that above-mentioned module may operate in the terminal 10 of the offer of embodiment one as a part for device, Ke Yitong
Cross software realization, it is also possible to realize by hardware.
Alternatively, as shown in fig. 7, the device of detection data access exception also includes：Second acquisition unit 702, sentence
Disconnected unit 704 and processing unit 706.
Wherein, second acquisition unit 702, the data exception percentage of data is accessed for obtaining the history, wherein,
The data exception percentage be used to representing the history access the data volume in data and adjacent time point data volume it
Between rate of change；Judging unit 704, if being more than the first predetermined threshold value for the data exception percentage, determines institute
It is abnormal access data to state the corresponding data that access of data exception percentage；Processing unit 706, for from the history
The abnormal access data are removed in access data.
Herein it should be noted that above-mentioned second acquisition unit 702, judging unit 704 and processing unit 706 pairs
Step S302 to step S306 that should be in embodiment one, example that three modules are realized with corresponding step and should
It is identical with scene, but it is not limited to the disclosure of that of above-described embodiment one.It should be noted that above-mentioned module is used as dress
The part put may operate in the terminal 10 of the offer of embodiment one, can be realized by software, it is also possible to
Realized by hardware.
Alternatively, the second acquisition unit 702 is used to perform the data that following steps obtain the history access data
Abnormal percentage：By formula M=(V (t)-(V (t+n+1)-V (t-1))/2)/V (t), the data are calculated different
Normal percentage, wherein, M is the data exception percentage, and V (t) is data volume, and t is data volume corresponding time point,
N is the default abnormal access cycle.
Alternatively, first determining unit 606 is used to perform following steps according to the number in the cycle very first time
According to the data volume corresponding time point in amount and the cycle very first time, the time point to be detected corresponding the is determined
One predicted data amount：According to the data volume in the cycle very first time and the data volume pair in the cycle very first time
At the time point answered, determine the first linear function；The time point correspondence to be detected is determined by first linear function
The first predicted data amount.
Alternatively, as shown in figure 8, the device of detection data access exception also includes：Second determining unit 802.
Wherein, the second determining unit 802, for according to the history access data, draw for represent time point with
Second linear function of the relation between data volume；The time point pair to be detected is obtained by second linear function
The second predicted data amount answered；Wherein, the detection unit 608, if for time point to be detected corresponding reality
Border data volume is more than first predicted data amount and second predicted data amount, determines the actual amount of data exception.
Herein it should be noted that above-mentioned second determining unit 802 is corresponding to the step S402 in embodiment one to step
S404, the module is identical with example and application scenarios that the step of correspondence is realized, but is not limited to the institute of above-described embodiment one
Disclosure.It should be noted that above-mentioned module may operate in the offer of embodiment one as a part for device
In terminal 10, can be realized by software, it is also possible to realized by hardware.
Alternatively, as shown in figure 9, the device of detection data access exception also includes：3rd acquiring unit 902.
Wherein, the 3rd acquiring unit 902, for the corresponding data of previous time point according to the time point to be detected
Amount, obtains the time point to be detected corresponding 3rd predicted data amount；Wherein, the detection unit 608, is used for
If time point to be detected, corresponding actual amount of data was more than first predicted data amount and the 3rd prediction data
Amount, determines the actual amount of data exception.
Herein it should be noted that above-mentioned 3rd acquiring unit 902 corresponds to the step S502 in embodiment one, the mould
Block is identical with example and application scenarios that the step of correspondence is realized, but is not limited to the disclosure of that of above-described embodiment one.
It should be noted that above-mentioned module may operate in the terminal 10 of the offer of embodiment one as a part for device
In, can be realized by software, it is also possible to realized by hardware.
Alternatively, the 3rd acquiring unit 902 is used to performing following steps previous according to the time point to be detected
Time point corresponding data volume, obtains the time point to be detected corresponding 3rd predicted data amount：By formula
Q=W (t-1) × (1+A%), is calculated the 3rd predicted data amount, wherein, Q is the 3rd predicted data amount,
W (t-1) is the corresponding data volume of previous time point at the time point to be detected, and A% is the number at the time point to be detected
According to amount compared to the percentage point that the data volume of the previous time point increases.
It follows that the data access detection accuracy that prior art is present is poor, continue with the number for increasing for one group
For collection, the average of historical data do not had to the data of the new generation of current point in time it is representational in the case of,
For the new data for producing, whether abnormal judgement just has deviation；The data that are newly produced based on current point in time and previous
The data at individual time point compare the testing result for drawing again easily because the abnormal feelings of the data at previous time point
Condition (continuous data occur abnormal) and there is the problem of erroneous judgement, the application proposes a kind of based on history to access data
The first method for accessing data to carry out anomaly data detection for belonging to the same time cycle with time point to be detected is extracted,
By fitting time point to be detected corresponding first predicted data amount, and then determine time point to be detected corresponding reality
Whether data volume is abnormal, has reached the accurate purpose for carrying out business early warning, it is achieved thereby that improving detection data accesses different
The technique effect of normal accuracy.
Embodiment 3
Embodiments herein additionally provides a kind of storage medium.Alternatively, in the present embodiment, above-mentioned storage medium
Can be used for preserving the program code performed by the method for the detection data access exception that above-described embodiment one is provided.
Alternatively, in the present embodiment, during above-mentioned storage medium may be located at computer network Computer terminal group
In any one terminal, or in any one mobile terminal in mobile terminal group.
Alternatively, in the present embodiment, storage medium is arranged to storage for performing the program code of following steps：
The history for obtaining time point to be detected accesses data, wherein, the history accesses packet containing the data volume for accessing parameter
And the data volume corresponding time point；According to the advance time cycle for dividing, determine belonging to the time point to be detected
The cycle very first time, and from the history access extracting data be in the cycle very first time in first access
Data, wherein, described first accesses packet containing the data volume in the cycle very first time and the week very first time
Data volume corresponding time point in phase；According to the data volume in the cycle very first time and the cycle very first time
At interior data volume corresponding time point, determine the time point to be detected corresponding first predicted data amount；If described treat
The corresponding actual amount of data of detection time point is more than first predicted data amount, determines the actual amount of data exception.
Alternatively, storage medium is also configured to storage for performing the program code of following steps：Obtain the history
The data exception percentage of data is accessed, wherein, the data exception percentage is used to represent that the history accesses data
In data volume and the data volume of adjacent time point between rate of change；If the data exception percentage is pre- more than first
If threshold value, determine that the corresponding data that access of the data exception percentage are abnormal access data；Accessed from the history
The abnormal access data are removed in data.
Alternatively, storage medium is also configured to storage for performing the program code of following steps：By formula
M=(V (t)-(V (t+n+1)-V (t-1))/2)/V (t), is calculated the data exception percentage, wherein, M is institute
Data exception percentage is stated, V (t) is data volume, and t is data volume corresponding time point, and n is default abnormal access week
Phase.
Alternatively, storage medium is also configured to storage for performing the program code of following steps：According to described first
Data volume in time cycle and the data volume corresponding time point in the cycle very first time, determine the first linear letter
Number；The time point to be detected corresponding first predicted data amount is determined by first linear function.
Alternatively, storage medium is also configured to storage for performing the program code of following steps：According to the history
Data are accessed, the second linear function for representing the relation between time point and data volume is drawn；By described second
Linear function obtains the time point to be detected corresponding second predicted data amount；Wherein, if when described to be detected
Between put corresponding actual amount of data more than first predicted data amount, determine that the actual amount of data includes extremely：If
Time point to be detected, corresponding actual amount of data was more than first predicted data amount and second predicted data amount,
Determine the actual amount of data exception.
Alternatively, storage medium is also configured to storage for performing the program code of following steps：According to described to be checked
The corresponding data volume of previous time point at time point is surveyed, the time point to be detected corresponding 3rd predicted data amount is obtained；
Wherein, if the time point to be detected corresponding actual amount of data is more than first predicted data amount, institute is determined
State actual amount of data includes extremely：If time point to be detected corresponding actual amount of data is more than the described first prediction number
According to amount and the 3rd predicted data amount, the actual amount of data exception is determined.
Alternatively, storage medium is also configured to storage for performing the program code of following steps：By formula
Q=W (t-1) × (1+A%), is calculated the 3rd predicted data amount, wherein, Q is the 3rd predicted data amount,
W (t-1) is the corresponding data volume of previous time point at the time point to be detected, and A% is the number at the time point to be detected
According to amount compared to the percentage point that the data volume of the previous time point increases.
Alternatively, in the present embodiment, above-mentioned storage medium can be included but is not limited to：USB flash disk, read-only storage (ROM,
Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, magnetic
Dish or CD etc. are various can be with the medium of store program codes.
Alternatively, the specific example in the present embodiment may be referred to the example described in above-described embodiment 1, this implementation
Example will not be repeated here.
Above-mentioned the embodiment of the present application sequence number is for illustration only, and the quality of embodiment is not represented.
In above-described embodiment of the application, the description to each embodiment all emphasizes particularly on different fields, and does not have in certain embodiment
The part of detailed description, may refer to the associated description of other embodiment.
In several embodiments provided herein, it should be understood that the processing unit of disclosed sequence information,
Can realize by another way.Wherein, device embodiment described above be only it is schematical, such as it is described
The division of unit, only a kind of division of logic function can have other dividing mode when actually realizing, such as many
Individual unit or component can be combined or be desirably integrated into another system, or some features can be ignored, or not performed.
It is another, shown or discussed coupling or direct-coupling or communication connection each other can be by some interfaces,
The INDIRECT COUPLING or communication connection of unit or module, can be electrical or other forms.
The unit that is illustrated as separating component can be or may not be it is physically separate, it is aobvious as unit
The part for showing can be or may not be physical location, you can with positioned at a place, or can also be distributed to
On multiple NEs.Some or all of unit therein can be according to the actual needs selected to realize the present embodiment
The purpose of scheme.
In addition, during each functional unit in the application each embodiment can be integrated in a processing unit, it is also possible to
It is that unit is individually physically present, it is also possible to which two or more units are integrated in a unit.It is above-mentioned integrated
Unit can both be realized in the form of hardware, it would however also be possible to employ the form of SFU software functional unit is realized.
If the integrated unit is to realize in the form of SFU software functional unit and as independent production marketing or when using,
Can store in a computer read/write memory medium.Based on such understanding, the technical scheme essence of the application
On all or part of the part that is contributed to prior art in other words or the technical scheme can be with software product
Form is embodied, and the computer software product is stored in a storage medium, including some instructions are used to so that one
Platform computer equipment (can be personal computer, server or network equipment etc.) performs each embodiment institute of the application
State all or part of step of method.And foregoing storage medium includes：USB flash disk, read-only storage (ROM, Read-Only
Memory), random access memory (RAM, Random Access Memory), mobile hard disk, magnetic disc or CD
Etc. it is various can be with the medium of store program codes.
The above is only the preferred embodiment of the application, it is noted that for the ordinary skill people of the art
For member, on the premise of the application principle is not departed from, some improvements and modifications can also be made, these improve and moisten
Decorations also should be regarded as the protection domain of the application.
Claims (15)
1. a kind of method of detection data access exception, it is characterised in that including：
The history for obtaining time point to be detected accesses data, wherein, the history accesses packet parameter containing access
Data volume and the data volume corresponding time point；
According to the advance time cycle for dividing, the cycle very first time belonging to the time point to be detected is determined, and
The first access data that extracting data was in the cycle very first time are accessed from the history, wherein, institute
The first access packet is stated containing the data volume in the cycle very first time and the data in the cycle very first time
Measure corresponding time point；
During according to the data volume in the cycle very first time and the corresponding data volume in the cycle very first time
Between point, determine the time point to be detected corresponding first predicted data amount；
If time point to be detected, corresponding actual amount of data was more than first predicted data amount, it is determined that described
Actual amount of data exception.
2. method according to claim 1, it is characterised in that accessed at extracting data from the history described
Before the first access data in the cycle very first time, methods described also includes：
The data exception percentage that the history accesses data is obtained, wherein, the data exception percentage is used for
Represent that the history accesses the rate of change between data volume and the data volume of adjacent time point in data；
If the data exception percentage is more than the first predetermined threshold value, determine that the data exception percentage is corresponding
Access data are abnormal access data；
Accessed in data from the history and remove the abnormal access data.
3. method according to claim 2, it is characterised in that the data that the acquisition history accesses data are different
Normal percentage includes：
By formula M=(V (t)-(V (t+n+1)-V (t-1))/2)/V (t), the data exception hundred is calculated
Divide ratio, wherein, M is the data exception percentage, and V (t) is data volume, and t is data volume corresponding time point,
N is the default abnormal access cycle.
4. method according to claim 1, it is characterised in that the data according in the cycle very first time
At data volume corresponding time point in amount and the cycle very first time, determine that the time point to be detected is corresponding
First predicted data amount includes：
During according to the data volume in the cycle very first time and the corresponding data volume in the cycle very first time
Between point, determine the first linear function；
The time point to be detected corresponding first predicted data amount is determined by first linear function.
5. method according to claim 1, it is characterised in that it is described determine the actual amount of data exception before,
Methods described also includes：
Data are accessed according to the history, the second line for representing the relation between time point and data volume is drawn
Property function；
The time point to be detected corresponding second predicted data amount is obtained by second linear function；
Wherein, if the time point to be detected corresponding actual amount of data is more than first predicted data amount,
Determine that the actual amount of data includes extremely：
If time point to be detected, corresponding actual amount of data was more than first predicted data amount and described second
Predicted data amount, determines the actual amount of data exception.
6. method according to claim 1, it is characterised in that it is described determine the actual amount of data exception before,
Methods described also includes：
The corresponding data volume of previous time point according to the time point to be detected, obtains the time point to be detected
Corresponding 3rd predicted data amount；
Wherein, if the time point to be detected corresponding actual amount of data is more than first predicted data amount,
Determine that the actual amount of data includes extremely：
If time point to be detected, corresponding actual amount of data was more than first predicted data amount and the described 3rd
Predicted data amount, determines the actual amount of data exception.
7. method according to claim 6, it is characterised in that it is described according to the time point to be detected it is previous when
Between put corresponding data volume, obtaining the time point to be detected corresponding 3rd predicted data amount includes：
By formula Q=W (t-1) × (1+A%), the 3rd predicted data amount is calculated, wherein, Q is institute
The 3rd predicted data amount is stated, W (t-1) is the corresponding data volume of previous time point at the time point to be detected, A%
It is the percentage point of the data volume compared to the data volume growth of the previous time point at the time point to be detected.
8. method according to any one of claim 1 to 7, it is characterised in that the access parameter includes following
One or more：
Visit capacity, order volume, the amount of calling, registration amount, trading volume and click volume.
9. a kind of device of detection data access exception, it is characterised in that including：
First acquisition unit, the history for obtaining time point to be detected accesses data, wherein, the history is visited
Ask data volume and the data volume corresponding time point of the packet containing parameter is accessed；
Extraction unit, for according to the advance time cycle for dividing, determining the belonging to the time point to be detected
A period of time, and access the first access that extracting data was in the cycle very first time from the history
Data, wherein, described first accesses packet containing the data volume in the cycle very first time and when described first
Between data volume corresponding time point in the cycle；
First determining unit, for according to the data volume in the cycle very first time and the cycle very first time
At interior data volume corresponding time point, determine the time point to be detected corresponding first predicted data amount；
Detection unit, if for time point to be detected corresponding actual amount of data more than the described first prediction number
According to amount, the actual amount of data exception is determined.
10. device according to claim 9, it is characterised in that also include：
Second acquisition unit, the data exception percentage of data is accessed for obtaining the history, wherein, it is described
Data exception percentage be used to representing the history access the data volume in data and adjacent time point data volume it
Between rate of change；
Judging unit, if being more than the first predetermined threshold value for the data exception percentage, determines that the data are different
The corresponding data that access of normal percentage are abnormal access data；
Processing unit, the abnormal access data are removed for being accessed in data from the history.
11. devices according to claim 10, it is characterised in that the second acquisition unit is used to perform following steps
Obtain the data exception percentage that the history accesses data：
By formula M=(V (t)-(V (t+n+1)-V (t-1))/2)/V (t), the data exception hundred is calculated
Divide ratio, wherein, M is the data exception percentage, and V (t) is data volume, and t is data volume corresponding time point,
N is the default abnormal access cycle.
12. devices according to claim 9, it is characterised in that first determining unit is used to perform following steps
According to the data volume in the cycle very first time and the data volume corresponding time point in the cycle very first time,
Determine the time point to be detected corresponding first predicted data amount：
During according to the data volume in the cycle very first time and the corresponding data volume in the cycle very first time
Between point, determine the first linear function；
The time point to be detected corresponding first predicted data amount is determined by first linear function.
13. devices according to claim 9, it is characterised in that also include：
Second determining unit, for accessing data according to the history, draws for representing time point and data volume
Between relation the second linear function；The time point correspondence to be detected is obtained by second linear function
The second predicted data amount；
Wherein, the detection unit, if for time point to be detected corresponding actual amount of data more than described
First predicted data amount and second predicted data amount, determine the actual amount of data exception.
14. devices according to claim 9, it is characterised in that also include：
3rd acquiring unit, for the corresponding data volume of previous time point according to the time point to be detected, obtains
Take the time point to be detected corresponding 3rd predicted data amount；
Wherein, the detection unit, if for time point to be detected corresponding actual amount of data more than described
First predicted data amount and the 3rd predicted data amount, determine the actual amount of data exception.
15. devices according to claim 14, it is characterised in that the 3rd acquiring unit is used to perform following steps
The corresponding data volume of previous time point according to the time point to be detected, obtains the time point correspondence to be detected
The 3rd predicted data amount：
By formula Q=W (t-1) × (1+A%), the 3rd predicted data amount is calculated, wherein, Q is institute
The 3rd predicted data amount is stated, W (t-1) is the corresponding data volume of previous time point at the time point to be detected, A%
It is the percentage point of the data volume compared to the data volume growth of the previous time point at the time point to be detected.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201510867547.6A CN106815255A (en) | 2015-11-27 | 2015-11-27 | The method and device of detection data access exception |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201510867547.6A CN106815255A (en) | 2015-11-27 | 2015-11-27 | The method and device of detection data access exception |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN106815255A true CN106815255A (en) | 2017-06-09 |
Family
ID=59107815
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201510867547.6A Pending CN106815255A (en) | 2015-11-27 | 2015-11-27 | The method and device of detection data access exception |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN106815255A (en) |
Cited By (18)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN107481117A (en) * | 2017-08-21 | 2017-12-15 | 掌阅科技股份有限公司 | Detection method, electronic equipment and the computer-readable storage medium of abnormal behaviour |
| CN107547266A (en) * | 2017-07-31 | 2018-01-05 | 腾讯科技（深圳）有限公司 | The detection method and device of online amount abnormity point, computer equipment and storage medium |
| CN108366274A (en) * | 2018-01-11 | 2018-08-03 | 北京奇艺世纪科技有限公司 | A kind of detection method and device of brush playback volume |
| CN109581122A (en) * | 2018-12-24 | 2019-04-05 | 北京新能源汽车股份有限公司 | A kind of detection method that vehicle abnormality wakes up, apparatus and system |
| CN109873790A (en) * | 2017-12-04 | 2019-06-11 | 中国电信股份有限公司 | Network security detection method, device and computer readable storage medium |
| CN109960626A (en) * | 2017-12-26 | 2019-07-02 | 中国移动通信集团辽宁有限公司 | Recognition methods, device, equipment and the medium of port exception |
| CN110290400A (en) * | 2019-07-29 | 2019-09-27 | 北京奇艺世纪科技有限公司 | The recognition methods of suspicious brush amount video, true playback volume predictor method and device |
| WO2020019965A1 (en) * | 2018-07-27 | 2020-01-30 | 阿里巴巴集团控股有限公司 | Data monitoring method and device, electronic device, and computer readable storage medium |
| CN110830445A (en) * | 2019-10-14 | 2020-02-21 | 中国平安财产保险股份有限公司 | Method and device for identifying abnormal access object |
| CN111210070A (en) * | 2020-01-03 | 2020-05-29 | 恩亿科(北京)数据科技有限公司 | Data analysis method and device, electronic equipment and readable storage medium |
| CN111563527A (en) * | 2020-03-30 | 2020-08-21 | 北京金堤科技有限公司 | Abnormal event detection method and device |
| CN111666186A (en) * | 2020-04-26 | 2020-09-15 | 杭州数梦工场科技有限公司 | Data access abnormity detection method and device, storage medium and computer equipment |
| CN111695083A (en) * | 2019-03-15 | 2020-09-22 | 北京京东尚科信息技术有限公司 | Detection method and detection equipment |
| CN112131075A (en) * | 2020-09-15 | 2020-12-25 | 上海上讯信息技术股份有限公司 | Method and equipment for detecting abnormity of stored monitoring data |
| CN112635031A (en) * | 2020-12-15 | 2021-04-09 | 北京懿医云科技有限公司 | Data volume anomaly detection method and device, storage medium and equipment |
| CN113409025A (en) * | 2021-07-06 | 2021-09-17 | 中国工商银行股份有限公司 | Service data extraction method, device and storage medium |
| CN115314229A (en) * | 2021-04-20 | 2022-11-08 | 中国移动通信集团河北有限公司 | Data access method, device, equipment and storage medium |
| CN115603955A (en) * | 2022-09-26 | 2023-01-13 | 北京百度网讯科技有限公司（Cn） | Abnormal access object identification method, device, equipment and medium |
Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20020077792A1 (en) * | 2000-10-27 | 2002-06-20 | Panacya, Inc. | Early warning in e-service management systems |
| CN102081623A (en) * | 2009-11-30 | 2011-06-01 | 中国移动通信集团浙江有限公司 | Method and system for detecting database abnormality |
| CN102130800A (en) * | 2011-04-01 | 2011-07-20 | 苏州赛特斯网络科技有限公司 | Device and method for detecting network access abnormality based on data stream behavior analysis |
| CN103490949A (en) * | 2013-09-06 | 2014-01-01 | 京信通信系统（中国）有限公司 | Method and device for collecting data information and detecting data information anomalies |
-
2015
- 2015-11-27 CN CN201510867547.6A patent/CN106815255A/en active Pending
Patent Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20020077792A1 (en) * | 2000-10-27 | 2002-06-20 | Panacya, Inc. | Early warning in e-service management systems |
| CN102081623A (en) * | 2009-11-30 | 2011-06-01 | 中国移动通信集团浙江有限公司 | Method and system for detecting database abnormality |
| CN102130800A (en) * | 2011-04-01 | 2011-07-20 | 苏州赛特斯网络科技有限公司 | Device and method for detecting network access abnormality based on data stream behavior analysis |
| CN103490949A (en) * | 2013-09-06 | 2014-01-01 | 京信通信系统（中国）有限公司 | Method and device for collecting data information and detecting data information anomalies |
Cited By (31)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN107547266A (en) * | 2017-07-31 | 2018-01-05 | 腾讯科技（深圳）有限公司 | The detection method and device of online amount abnormity point, computer equipment and storage medium |
| CN107547266B (en) * | 2017-07-31 | 2020-09-29 | 腾讯科技（深圳）有限公司 | Method and device for detecting online quantity abnormal point, computer equipment and storage medium |
| CN107481117A (en) * | 2017-08-21 | 2017-12-15 | 掌阅科技股份有限公司 | Detection method, electronic equipment and the computer-readable storage medium of abnormal behaviour |
| CN109873790A (en) * | 2017-12-04 | 2019-06-11 | 中国电信股份有限公司 | Network security detection method, device and computer readable storage medium |
| CN109960626B (en) * | 2017-12-26 | 2022-10-18 | 中国移动通信集团辽宁有限公司 | Port abnormity identification method, device, equipment and medium |
| CN109960626A (en) * | 2017-12-26 | 2019-07-02 | 中国移动通信集团辽宁有限公司 | Recognition methods, device, equipment and the medium of port exception |
| CN108366274B (en) * | 2018-01-11 | 2020-09-01 | 北京奇艺世纪科技有限公司 | Method and device for detecting brushing playing amount |
| CN108366274A (en) * | 2018-01-11 | 2018-08-03 | 北京奇艺世纪科技有限公司 | A kind of detection method and device of brush playback volume |
| WO2020019965A1 (en) * | 2018-07-27 | 2020-01-30 | 阿里巴巴集团控股有限公司 | Data monitoring method and device, electronic device, and computer readable storage medium |
| US11200136B2 (en) | 2018-07-27 | 2021-12-14 | Advanced New Technologies Co., Ltd. | Data monitoring methods, apparatuses, electronic devices, and computer readable storage media |
| CN109581122B (en) * | 2018-12-24 | 2021-06-25 | 北京新能源汽车股份有限公司 | Method, device and system for detecting abnormal awakening of vehicle |
| CN109581122A (en) * | 2018-12-24 | 2019-04-05 | 北京新能源汽车股份有限公司 | A kind of detection method that vehicle abnormality wakes up, apparatus and system |
| CN111695083A (en) * | 2019-03-15 | 2020-09-22 | 北京京东尚科信息技术有限公司 | Detection method and detection equipment |
| CN110290400A (en) * | 2019-07-29 | 2019-09-27 | 北京奇艺世纪科技有限公司 | The recognition methods of suspicious brush amount video, true playback volume predictor method and device |
| CN110290400B (en) * | 2019-07-29 | 2022-06-03 | 北京奇艺世纪科技有限公司 | Suspicious brushing amount video identification method, real playing amount estimation method and device |
| CN110830445A (en) * | 2019-10-14 | 2020-02-21 | 中国平安财产保险股份有限公司 | Method and device for identifying abnormal access object |
| CN111210070A (en) * | 2020-01-03 | 2020-05-29 | 恩亿科(北京)数据科技有限公司 | Data analysis method and device, electronic equipment and readable storage medium |
| CN111563527B (en) * | 2020-03-30 | 2024-02-09 | 北京金堤科技有限公司 | Abnormal event detection method and device |
| CN111563527A (en) * | 2020-03-30 | 2020-08-21 | 北京金堤科技有限公司 | Abnormal event detection method and device |
| CN111666186B (en) * | 2020-04-26 | 2023-09-15 | 杭州数梦工场科技有限公司 | Method and device for detecting data access abnormality, storage medium and computer equipment |
| CN111666186A (en) * | 2020-04-26 | 2020-09-15 | 杭州数梦工场科技有限公司 | Data access abnormity detection method and device, storage medium and computer equipment |
| CN112131075B (en) * | 2020-09-15 | 2023-04-28 | 上海上讯信息技术股份有限公司 | Method and equipment for detecting abnormality of storage monitoring data |
| CN112131075A (en) * | 2020-09-15 | 2020-12-25 | 上海上讯信息技术股份有限公司 | Method and equipment for detecting abnormity of stored monitoring data |
| CN112635031A (en) * | 2020-12-15 | 2021-04-09 | 北京懿医云科技有限公司 | Data volume anomaly detection method and device, storage medium and equipment |
| CN112635031B (en) * | 2020-12-15 | 2023-08-29 | 北京懿医云科技有限公司 | Data volume anomaly detection method, device, storage medium and equipment |
| CN115314229A (en) * | 2021-04-20 | 2022-11-08 | 中国移动通信集团河北有限公司 | Data access method, device, equipment and storage medium |
| CN115314229B (en) * | 2021-04-20 | 2024-03-19 | 中国移动通信集团河北有限公司 | Data access method, device, equipment and storage medium |
| CN113409025A (en) * | 2021-07-06 | 2021-09-17 | 中国工商银行股份有限公司 | Service data extraction method, device and storage medium |
| CN113409025B (en) * | 2021-07-06 | 2024-03-26 | 中国工商银行股份有限公司 | Service data extraction method, device and storage medium |
| CN115603955A (en) * | 2022-09-26 | 2023-01-13 | 北京百度网讯科技有限公司（Cn） | Abnormal access object identification method, device, equipment and medium |
| CN115603955B (en) * | 2022-09-26 | 2023-11-07 | 北京百度网讯科技有限公司 | Abnormal access object identification method, device, equipment and medium |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN106815255A (en) | The method and device of detection data access exception | |
| CN106685674B (en) | Method and device for predicting network event and establishing network event prediction model | |
| US20180266848A1 (en) | Analysis of smart meter data based on frequency content | |
| US20150371163A1 (en) | Churn prediction in a broadband network | |
| CN110209551B (en) | Abnormal equipment identification method and device, electronic equipment and storage medium | |
| US11410062B2 (en) | Method and system for reducing risk values discrepancies between categories | |
| CN111174370A (en) | Fault detection method and device, storage medium and electronic device | |
| CN107404481A (en) | User profile recognition methods and device | |
| CN108805174A (en) | clustering method and device | |
| CN107330326A (en) | A kind of malice trojan horse detection processing method and processing device | |
| CN105721406A (en) | Method and device for obtaining IP black list | |
| CN108156141A (en) | A kind of real time data recognition methods, device and electronic equipment | |
| CN107038108A (en) | The method of testing and device of software | |
| CN110290467A (en) | The acquisition methods and device of dwell point, shopping centre service range, influence factor | |
| CN109618281B (en) | High-speed rail cell identification method and device | |
| CN106257507A (en) | The methods of risk assessment of user behavior and device | |
| CN109168138A (en) | The recognition methods for the number of changing, device and equipment in net | |
| CN110826583A (en) | Fault determination method and device, storage medium and electronic device | |
| CN112819258A (en) | Bank branch to store customer quantity prediction method and device | |
| CN115705282A (en) | Cell network anomaly detection method and device and computer readable storage medium | |
| CN113110961A (en) | Equipment abnormality detection method and device, computer equipment and readable storage medium | |
| CN106304084B (en) | Information processing method and device | |
| CN113123955B (en) | Plunger pump abnormity detection method and device, storage medium and electronic equipment | |
| CN107888394A (en) | The method and device of network failure reason positioning | |
| CN115967906A (en) | User resident position identification method, terminal, electronic device and storage medium |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| RJ01 | Rejection of invention patent application after publication |
Application publication date: 20170609 |
|
| RJ01 | Rejection of invention patent application after publication |