CN106817235B - The detection method and device of website abnormal amount of access - Google Patents
The detection method and device of website abnormal amount of access Download PDFInfo
- Publication number
- CN106817235B CN106817235B CN201510857706.4A CN201510857706A CN106817235B CN 106817235 B CN106817235 B CN 106817235B CN 201510857706 A CN201510857706 A CN 201510857706A CN 106817235 B CN106817235 B CN 106817235B
- Authority
- CN
- China
- Prior art keywords
- visitor
- website
- access
- click
- preset
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
- H04L41/06—Management of faults, events, alarms or notifications
- H04L41/0631—Management of faults, events, alarms or notifications using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L43/00—Arrangements for monitoring or testing data switching networks
- H04L43/50—Testing arrangements
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L67/00—Network arrangements or protocols for supporting network services or applications
- H04L67/50—Network services
- H04L67/535—Tracking the activity of the user
Landscapes
- Engineering & Computer Science (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Computer Hardware Design (AREA)
- General Engineering & Computer Science (AREA)
- Information Transfer Between Computers (AREA)
Abstract
The invention discloses a kind of detection method and device of website abnormal amount of access, main purpose is to improve the precision of detection website abnormal amount of access.Main technical schemes of the invention include: to obtain the access information of preset website, access information includes: the click coordinate of the amount of access of preset website, visitor ID and the corresponding visitor of visitor ID in preset website, and visitor ID is unique identification of the visitor in preset website；According to access information, the actual range between click coordinate and hot spot click on area is determined, wherein hot spot click on area determines according to amount of access, and is the hot spot click on area in preset website；According to actual range, judge with the presence or absence of abnormal visitor in preset website, abnormal visitor is the corresponding visitor of same visitor ID that actual range is more than abnormal distance threshold in preset time threshold value；Abnormal visitor if it exists, then output abnormality visitor alarming information.During detecting the abnormal access amount of website.
Description
Technical field
The present invention relates to Internet technical fields, more particularly to the detection method and dress of a kind of website abnormal amount of access
It sets.
Background technique
Website visiting amount refers to for describing number of users and the webpage quantity etc. that is browsed of user of one website of access
Mark.Currently, website operator often faces the problem of website visiting amount fraud or exception, so-called website visiting amount fraud or different
It is often mainly automatically performed by machine by some procedure operation, leads to website visiting amount virtual height, this website abnormal amount of access
Any website conversion ratio and website attention rate will not be brought, the actual site amount of access of the website cannot be not only objectively responded, and
And website operator is caused to spend a large amount of unnecessary advertising and publicity costs.
In order to solve the problems, such as above-mentioned website abnormal amount of access, detecting in the website frequently with website abnormal detection device is
No to there is abnormal visitor, the specific detection process of website abnormal detection device includes: acquisition and judges visitor in the website
The residence time is accessed, determines whether the visitor is abnormal visitor by index of the access residence time.If the access residence time
Beyond preset time threshold, then website abnormal detection device determines that the visitor is abnormal visitor, and alarms, to notify net
Stand operator.
It is as follows to have found that it exists when detecting by above-mentioned website abnormal detection device to abnormal access amount by inventor
Problem: website abnormal detection device determines whether visitor is abnormal visitor by index of the single access residence time, for one
For the abnormal access amount manufacture machine of a little higher-ends, the habit that people normally accesses website may be imitated, i.e., is stopped access
Time maintains in preset time threshold, to avoid the detection of website abnormal detection device.Therefore, by net in the prior art
The abnormal access amount result precision that abnormal detector of standing detects website is lower.
Summary of the invention
In view of this, a kind of detection method and device of website abnormal amount of access provided by the invention, main purpose are
Improve the precision of detection website abnormal amount of access.
To solve the above-mentioned problems, present invention generally provides following technical solutions:
On the one hand, the present invention provides a kind of detection methods of website abnormal amount of access, this method comprises:
Obtain the access information of preset website, the access information include: the amount of access of the preset website, visitor ID and
For the corresponding visitor of the visitor ID in the click coordinate of the preset website, the visitor ID is visitor in the preset website
Unique identification；
According to the access information, the actual range between the click coordinate and hot spot click on area is determined, wherein institute
It states hot spot click on area to be determined according to the amount of access, and is the hot spot click on area in the preset website；
According to the actual range, judge with the presence or absence of abnormal visitor in the preset website, the exception visitor be
The actual range is more than the corresponding visitor of same visitor ID of abnormal distance threshold in preset time threshold value；
The abnormal visitor if it exists, then output abnormality visitor alarming information.
On the other hand, the present invention also provides a kind of detection device of website abnormal amount of access, which includes:
First acquisition unit, for obtaining the access information of preset website, the access information includes: the preset website
Amount of access, visitor ID and the corresponding visitor of the visitor ID the preset website click coordinate, the visitor ID be visit
Unique identification of the visitor in the preset website；
First determination unit, the access information for being obtained according to the first acquisition unit, determines the click
Actual range between coordinate and hot spot click on area, wherein the hot spot click on area is determined according to the amount of access, and is
Hot spot click on area in the preset website；
Judging unit, the actual range for being determined according to first determination unit, judges the preset website
In with the presence or absence of abnormal visitor, the exception visitor is that the actual range is more than abnormal distance threshold in preset time threshold value
The corresponding visitor of same visitor ID；
Output unit, for when judging unit judgement is there are when the abnormal visitor, output abnormality visitor alarming to be believed
Breath.
By above-mentioned technical proposal, technical solution provided by the invention is at least had the advantage that
The detection method and device of website abnormal amount of access provided by the invention, firstly, obtaining the access letter of preset website
Breath, which includes: the amount of access of the preset website, and access ID and access ID corresponds to visitor in the click of preset website
Coordinate；Secondly, determining the actual range between click coordinate and hot spot click on area according to the access information of acquisition, wherein should
Hot spot click on area is the hot spot click on area determined in preset website according to amount of access；And judged according to determining actual range
With the presence or absence of abnormal visitor in the preset website, the abnormal access is that the actual range is more than different in preset time threshold value
The corresponding visitor of same visitor ID of normal distance threshold；Finally, when determining in preset website in the presence of abnormal visitor, output abnormality
Visitor alarming information；Only determined whether with website abnormal detection device in the prior art using accessing the residence time as index for exception
Visitor compares, and the present invention simulates the randomness of visitor according to abnormal access amount manufacture machine, determines visitor in preset website
Actual range between click coordinate and hot spot click on area, i.e., the click coordinate of visitor is for the discrete of hot spot click on area
Degree, if same visitor is more than abnormal distance threshold in preset time always, it is determined that the visitor is abnormal visitor, can be significantly
Improve the precision for detecting abnormal access amount in preset website.
The above description is only an overview of the technical scheme of the present invention, in order to better understand the technical means of the present invention,
And it can be implemented in accordance with the contents of the specification, and in order to allow above and other objects of the present invention, feature and advantage can
It is clearer and more comprehensible, the followings are specific embodiments of the present invention.
Detailed description of the invention
By reading the following detailed description of the preferred embodiment, various other advantages and benefits are common for this field
Technical staff will become clear.The drawings are only for the purpose of illustrating a preferred embodiment, and is not considered as to the present invention
Limitation.And throughout the drawings, the same reference numbers will be used to refer to the same parts.In the accompanying drawings:
Fig. 1 shows a kind of flow chart of the detection method of website abnormal amount of access provided in an embodiment of the present invention；
Fig. 2 shows the schematic diagrames of hot spot click on area in preset website provided in an embodiment of the present invention；
Fig. 3 shows the flow chart of the detection method of another website abnormal amount of access provided in an embodiment of the present invention；
Fig. 4 shows a kind of composition block diagram of the detection device of website abnormal amount of access provided in an embodiment of the present invention；
Fig. 5 shows the composition block diagram of the detection device of another website abnormal amount of access provided in an embodiment of the present invention.
Specific embodiment
Exemplary embodiments of the present disclosure are described in more detail below with reference to accompanying drawings.Although showing the disclosure in attached drawing
Exemplary embodiment, it being understood, however, that may be realized in various forms the disclosure without should be by embodiments set forth here
It is limited.On the contrary, these embodiments are provided to facilitate a more thoroughly understanding of the present invention, and can be by the scope of the present disclosure
It is fully disclosed to those skilled in the art.
The embodiment of the present invention provides a kind of detection method of website abnormal amount of access, as shown in Figure 1, this method comprises:
101, the access information of preset website is obtained.
In the embodiment of the present invention, the access information includes: amount of access, visitor ID and the visitor of the preset website
For the corresponding visitor of ID in the click coordinate of the preset website, the visitor ID is unique mark of the visitor in the preset website
Know.It should be noted that access information described in the embodiment of the present invention is the access information obtained to website thermodynamic chart server,
The access information is compiled by website thermodynamic chart server.
102, the actual range between the click coordinate and hot spot click on area is determined according to the access information.
According to the access information that website thermodynamic chart server returns, the amount of access of the preset website is determined, the preset website
Amount of access be total amount of access, the hot spot click on area in the preset website is determined according to the amount of access of preset website, and count
Calculate actual range of the visitor between the click coordinate in preset website and hot spot click on area.In the embodiment of the present invention, hot spot
Click on area is made of multiple click coordinates.
It, below will be with exemplary shape for the clearer actual range understood between click coordinate and hot spot click on area
Formula is described in detail.Fig. 2 shows the schematic diagrames of hot spot click on area in preset website provided in an embodiment of the present invention, such as scheme
Shown in 2, the black dot in figure represents click coordinate of the visitor in preset website；The hot spot click on area is relatively general
It reads, visitor number of the hot spot click on area in figure for other regions in preset website, in the hot spot click on area
More, i.e. click coordinate quantity is more, and the visitor in other regions is fewer in number, i.e. click coordinate negligible amounts.It needs to illustrate
, when determining hot spot click on area, the specific location of hot spot click on area is had differences for different preset websites；Alternatively,
In identical preset website, determine that the period of hot spot click on area is different, the specific location of hot spot click on area may also
It has differences.The exemplary only citing of Fig. 2, specific location of the embodiment of the present invention to hot spot click on area in preset website
Without limiting.
In the specific implementation, after determining hot spot click on area, need successively to obtain the point in non-hot click on area
Coordinate is hit, and successively determines the actual range between those click coordinates and hot spot click on area, substantially determines those points
Hit the dispersion between coordinate and hot spot click on area.
103, judged in the preset website according to the actual range with the presence or absence of abnormal visitor.
The embodiment of the present invention simulates the randomness of visitor, abnormal access amount manufacture machine according to abnormal access amount manufacture machine
Click coordinate in preset website has the characteristics that click at random, and therefore, abnormal access amount manufacture machine clicks the point to be formed
It hits coordinate and with normal person accesses the preset website and click the click coordinate to be formed and can have a certain difference.
The exception visitor is the same visitor that the actual range is more than abnormal distance threshold in preset time threshold value
The corresponding visitor of ID；When being judged in preset website according to actual range with the presence or absence of abnormal visitor, it can use but not limit to
In mode below, mode one: if judge the corresponding visitor of same visitor ID rested on always in preset time threshold value it is non-
In hot spot click on area, the access residence time is more than normally to access the preset website time, it is determined that the corresponding visitor of visitor ID
For abnormal visitor；Mode two: if judging that the corresponding visitor of same visitor ID clicks in preset website forms click coordinate, still
The actual range between hot spot click on area is more than abnormal distance threshold to those click coordinates for a long time, it is determined that ID couples of the visitor
The visitor answered is abnormal visitor.The specific embodiment of the present invention is to the implementation of the abnormal visitor of judgement without limiting.
104, the abnormal visitor if it exists, then output abnormality visitor alarming information.
When determining in preset website in the presence of abnormal visitor, output abnormality visitor alarming information, so that website operator exists
When counting the amount of access of preset website, the amount of access that exception visitor generates is filtered.
The detection method of website abnormal amount of access provided by the invention, firstly, the access information of preset website is obtained, the visit
Ask that information includes: the amount of access of the preset website, access ID and access ID corresponds to visitor in the click coordinate of preset website；Its
It is secondary, the actual range between click coordinate and hot spot click on area is determined according to the access information of acquisition, wherein the hot spot is clicked
Region is the hot spot click on area determined in preset website according to amount of access；And the preset net is judged according to determining actual range
With the presence or absence of abnormal visitor in standing, the abnormal access is that the actual range is more than abnormal apart from threshold in preset time threshold value
The corresponding visitor of same visitor ID of value；Finally, when determining in preset website in the presence of abnormal visitor, output abnormality visitor alarming
Information；Only determined whether with website abnormal detection device in the prior art using accessing the residence time as index for abnormal visitor's phase
Than the present invention simulates the randomness of visitor according to abnormal access amount manufacture machine, determines that click of the visitor in preset website is sat
Mark hot spot click on area between actual range, i.e., the click coordinate of visitor for hot spot click on area dispersion, if together
One visitor is more than abnormal distance threshold in preset time always, it is determined that the visitor is abnormal visitor, can greatly improve inspection
Survey the precision of abnormal access amount in preset website.
Further, as the extension to above-described embodiment, the embodiment of the present invention provides another website abnormal amount of access
Detection method, as shown in figure 3, this method comprises:
301, the access information of preset website is obtained.
The access information includes: the amount of access of the preset website, redirected link path.
Wherein, the description of the access information in relation to the preset website of acquisition, please refers in step 101 shown in Fig. 1 specifically
Bright, the embodiment of the present invention is no longer repeated herein.
302, it obtains first and jumps visitor's quantity.
Wherein, described first visitor's quantity is jumped to jump in preset time threshold value by same redirected link path
Visitor's quantity of the different visitor ID of the preset website.
At the preset website of guest access, preset Website server can establish the special meeting between visitor and preset website
Words, are identified by visitor ID.Illustratively, it is assumed that after Zhang San enters the preset website for the first time, preset Website server
The visitor ID of foundation is that ID1 exits the access of the preset website after Zhang San's access finishes the preset website；When Zhang San again into
After entering the preset website, preset Website server is that the visitor ID that Zhang San establishes is ID2, i.e., accesses the preset website every time,
Corresponding visitor ID can have differences.
At the guest access preset website, preset website is jumped to by following redirected link path, such as: it is vertical to jump
Turn link path, portal redirected link path, mailbox, navigation, the chained address of other websites etc., the embodiment of the present invention is to jump
Turn link path without limiting.
All redirected link paths when the preset website of guest access are obtained from access information, and are counted respectively different
The corresponding visitor's number in redirected link path determines that first jumps visitor's quantity.Illustratively, it is assumed that all of acquisition jump
Link path has 5, be respectively as follows: redirected link path 1, redirected link path 2, redirected link path 3, redirected link path 4,
Redirected link path 5, and in the time interval of 10:00-10:20, the visitor's quantity jumped by redirected link path 1 is
30, it is 10 by visitor's quantity that redirected link path 2 jumps, is 900 by visitor's quantity that redirected link path 3 jumps,
It is 20 by visitor's quantity that redirected link path 4 jumps, is 40 by visitor's quantity that redirected link path 5 jumps.More than
Exemplary only citing, the embodiment of the present invention is to redirected link path, the visitor's quantity jumped by redirected link path etc.
Content is without limiting.
303, it obtains second and jumps visitor's quantity.
Wherein, described second visitor's quantity is jumped to jump in preset time threshold value by all redirected link paths
Visitor's quantity of the different visitor ID of the preset website；It holds by the example in step 303, between the time of 10:00-10:20
Every interior, have 5 by all redirected link paths: redirected link path 1, redirected link path 3, is jumped redirected link path 2
Link path 4, redirected link path 5 obtain second jump visitor's quantity be 1000.
304, visitor's quantity is jumped according to described first jump visitor's quantity calculating path repetitive rate with described second.
The path repetitive rate jumps visitor's quantity for described first and accounts for the described second percentage for jumping visitor's quantity.
First that step 302 is obtained, which jumps visitor's quantity and jump visitor's quantity with step 303 obtains second, to be removed
Method operation determines path repetitive rate.It holds by the example in step 302 and step 303, in the time interval of 10:00-10:20
It is interior, it is 30 by visitor's quantity that redirected link path 1 jumps, is 10 by visitor's quantity that redirected link path 2 jumps, leads to
Crossing visitor's quantity that redirected link path 3 jumps is 900, is 20 by visitor's quantity that redirected link path 4 jumps, passes through jump
Turning visitor's quantity that link path 5 jumps is 40, and determining second, to jump visitor's quantity be 1000, the path in redirected link path 1
Repetitive rate is 30/1000=0.03；The path repetitive rate in redirected link path 2 is 20/1000=0.02；Redirected link path 3
Path repetitive rate be 900/1000=0.9；The path repetitive rate in redirected link path 4 is 20/1000=0.02；Redirected link
The path repetitive rate in path 1 is 40/1000=0.04.
If 305, the path repetitive rate is greater than preset path repetition threshold value, output abnormality visitor alarming information.
Because abnormal access amount manufacture machine has the characteristics that repeat to click at the preset website of simulation guest access, institute
To determine that the higher redirected link path of passage path repetitive rate is visited when path repetitive rate, which is greater than preset path, repeats preset
Ask that the access of the preset website is determined as abnormal visitor, and output abnormality visitor alarming information, so that website operator is counting
When the amount of access of preset website, the amount of access that exception visitor generates is filtered.
It holds by above-mentioned example, it is assumed that set path and repeat threshold value as 0.8, the path repetitive rate in redirected link path 1 is
0.03, threshold value 0.8 is repeated less than path is set, determines that accessing the visitor of preset website by redirected link path 1 is not abnormal visit
Visitor；And the path repetitive rate in redirected link path 3 is 0.9, repeats threshold value 0.8 greater than path is set, accordingly, it is determined that passing through skip chain
It connects path 3 and accesses the visitor of preset website as abnormal visitor.
It should be noted that the present invention is when passage path repetitive rate determines in preset website with the presence or absence of abnormal visitor,
The path repetitive rate, which refers in preset time threshold value, to be determined.
Further, according to the access information determine between the click coordinate and hot spot click on area it is practical away from
From before, clustering is carried out according to the amount of access in access information, hot spot click on area is determined, is determining hot spot click on area
When, it will click on that coordinate is adjacent or similar click coordinate is divided into one kind.Amount of access is being analyzed by clustering
When, amount of access may analyze to multiple types, in the embodiment of the present invention, determine that the more seed type of amount of access is hot spot
Click on area.Wherein, concrete operations of the specific implementation in relation to clustering during refer to the prior art, the present invention are implemented
Example is no longer described in detail herein.
Further, the actual range between the click coordinate and hot spot click on area is determined according to the access information
It include: acquisition hot spot coordinates, the hot spot coordinates are the arbitrary coordinate in the hot spot click on area；Calculate the click coordinate
The actual range between the hot spot coordinates.
When calculating the actual range between click coordinate and hot spot coordinates, formula below may be employed without limitation of
It realizes, such as:Wherein, xiAnd xyIndicate click coordinate；x0And x0Indicate hot spot coordinates, tool
The embodiment of the present invention of body is to the formula of the actual range use calculated between click coordinate and hot spot coordinates without limiting.
As a kind of implementation of the embodiment of the present invention, the reality between click coordinate and hot spot click on area is being calculated
Apart from when, only calculate the actual range between the first hot spot coordinates and click coordinate, first hot spot coordinates be hot spot click area
In domain with click coordinate coordinate corresponding to the nearest point；As another implementation of the embodiment of the present invention, counting
When calculating the actual range between click coordinate and hot spot click on area, second hot area coordinate is obtained, second hot area coordinate is hot spot
Arbitrary coordinate in click on area successively calculates the actual range between second hot area coordinate and click coordinate.This specific hair
Bright embodiment is to the implementation of the actual range between determining click coordinate and hot spot click on area without limiting.
Further, the access information for obtaining preset website includes: to send to obtain access information to thermodynamic chart server
Solicited message；It receives and obtains the access information.
Further, as the realization to method shown in above-mentioned Fig. 1 and Fig. 3, another embodiment of the present invention additionally provides one
The detection device of kind website abnormal amount of access.The Installation practice is corresponding with preceding method embodiment, is easy to read, the present apparatus
Embodiment no longer repeats the detail content in preceding method embodiment one by one, it should be understood that the dress in the present embodiment
The full content realized in preceding method embodiment can be corresponded to by setting.
The embodiment of the present invention also provides a kind of detection device of website abnormal amount of access, as shown in figure 4, the device includes:
First acquisition unit 41, for obtaining the access information of preset website, the access information includes: the preset net
In the click coordinate of the preset website, the visitor ID is amount of access, visitor ID and the corresponding visitor of the visitor ID to stand
Unique identification of the visitor in the preset website；
First determination unit 42, the access information for being obtained according to the first acquisition unit 41, determine described in
Actual range between click coordinate and hot spot click on area, wherein the hot spot click on area is determining according to the amount of access,
It and is hot spot click on area in the preset website；
Judging unit 43, the actual range for being determined according to first determination unit 42, judges described preset
With the presence or absence of abnormal visitor in website, the exception visitor is that the actual range is more than abnormal distance in preset time threshold value
The corresponding visitor of same visitor ID of threshold value；
Output unit 44, for when the judging unit 43 judgement is there are when the abnormal visitor, output abnormality visitor to be reported
Alert information.
Further, as shown in figure 5, described device further include:
Second acquisition unit 45 jumps visitor's quantity for obtaining first；Wherein, described first visitor's quantity is jumped, is
In preset time threshold value, visitor's number of the different visitor ID of the preset website is jumped to by same redirected link path
It measures, further includes redirected link path in the access information；
Third acquiring unit 46 jumps visitor's quantity for obtaining second；Wherein, described second visitor's quantity is jumped, is
In preset time threshold value, visitor's number of the different visitor ID of the preset website is jumped to by all redirected link paths
Amount；
Computing unit 47, described first for being obtained according to the second acquisition unit 45 jump visitor's quantity with it is described
Described the second of the acquisition of third acquiring unit 46 jumps visitor's quantity, calculates path repetitive rate, wherein the path repetitive rate,
Visitor's quantity, which is jumped, for described first accounts for the described second percentage for jumping visitor's quantity.
Further, the output unit 44, the path repetitive rate for being also used to calculate when the computing unit 47 are big
When preset path repeats threshold value, output abnormality visitor alarming information.
Further, as shown in figure 5, described device further include:
Second determination unit 48, for determining that the click is sat according to the access information in first determination unit 42
Before actual range between mark and hot spot click on area, the amount of access is subjected to clustering, determines that the hot spot is clicked
Region.
Further, as shown in figure 5, the first determination unit 42 includes:
Module 421 is obtained, for obtaining hot spot coordinates, the hot spot coordinates are any seat in the hot spot click on area
Mark；
Computing module 422, for calculate the click coordinate and it is described acquisition module 421 obtain the hot spot coordinates it
Between the actual range.
Further, as shown in figure 5, the first acquisition unit 41 includes:
Sending module 411, for sending the solicited message for obtaining access information to thermodynamic chart server；
Receiving module 412 obtains access information for sending in the sending module 411 to the thermodynamic chart server
After solicited message, the access information is received；
Module 413 is obtained, for after the receiving module 412 receives the access information, obtaining the access letter
Breath.
The detection device of website abnormal amount of access provided by the invention, firstly, the access information of preset website is obtained, the visit
Ask that information includes: the amount of access of the preset website, access ID and access ID corresponds to visitor in the click coordinate of preset website；Its
It is secondary, the actual range between click coordinate and hot spot click on area is determined according to the access information of acquisition, wherein the hot spot is clicked
Region is the hot spot click on area determined in preset website according to amount of access；And the preset net is judged according to determining actual range
With the presence or absence of abnormal visitor in standing, the abnormal access is that the actual range is more than abnormal apart from threshold in preset time threshold value
The corresponding visitor of same visitor ID of value；Finally, when determining in preset website in the presence of abnormal visitor, output abnormality visitor alarming
Information；Only determined whether with website abnormal detection device in the prior art using accessing the residence time as index for abnormal visitor's phase
Than the present invention simulates the randomness of visitor according to abnormal access amount manufacture machine, determines that click of the visitor in preset website is sat
Mark hot spot click on area between actual range, i.e., the click coordinate of visitor for hot spot click on area dispersion, if together
One visitor is more than abnormal distance threshold in preset time always, it is determined that the visitor is abnormal visitor, can greatly improve inspection
Survey the precision of abnormal access amount in preset website.
The detection device of the website abnormal amount of access includes processor and memory, above-mentioned first acquisition unit, first
Determination unit, judging unit and output unit etc. store in memory as program unit, are stored in by processor execution
Above procedure unit in memory realizes corresponding function.
Include kernel in processor, is gone in memory to transfer corresponding program unit by kernel.Kernel can be set one
Or more, the precision of detection website abnormal amount of access is improved by adjusting kernel parameter.
Memory may include the non-volatile memory in computer-readable medium, random access memory (RAM) and/
Or the forms such as Nonvolatile memory, if read-only memory (ROM) or flash memory (flash RAM), memory include that at least one is deposited
Store up chip.
Present invention also provides a kind of computer program products, when executing on data processing equipment, are adapted for carrying out just
The program code of beginningization there are as below methods step: the access information of preset website is obtained, the access information includes: described preset
Click coordinate of the amount of access, visitor ID and the corresponding visitor of the visitor ID of website in the preset website, the visitor ID
For unique identification of the visitor in the preset website；According to the access information, determine that the click coordinate and hot spot are clicked
Actual range between region, wherein the hot spot click on area determines according to the amount of access, and is in the preset website
Hot spot click on area；According to the actual range, judge in the preset website with the presence or absence of abnormal visitor, the abnormal visit
Visitor is the corresponding visitor of same visitor ID that the actual range is more than abnormal distance threshold in preset time threshold value；If it exists
The exception visitor, then output abnormality visitor alarming information.
In the above embodiment of the invention, it all emphasizes particularly on different fields to the description of each embodiment, does not have in some embodiment
The part of detailed description, reference can be made to the related descriptions of other embodiments.
It should be understood by those skilled in the art that, embodiments herein can provide as method, system or computer program
Product.Therefore, complete hardware embodiment, complete software embodiment or reality combining software and hardware aspects can be used in the application
Apply the form of example.Moreover, it wherein includes the computer of computer usable program code that the application, which can be used in one or more,
The computer program implemented in usable storage medium (including but not limited to magnetic disk storage, CD-ROM, optical memory etc.) produces
The form of product.
The application is referring to method, the process of equipment (system) and computer program product according to the embodiment of the present application
Figure and/or block diagram describe.It should be understood that every one stream in flowchart and/or the block diagram can be realized by computer program instructions
The combination of process and/or box in journey and/or box and flowchart and/or the block diagram.It can provide these computer programs
Instruct the processor of general purpose computer, special purpose computer, Embedded Processor or other programmable data processing devices to produce
A raw machine, so that being generated by the instruction that computer or the processor of other programmable data processing devices execute for real
The device for the function of being specified in present one or more flows of the flowchart and/or one or more blocks of the block diagram.
These computer program instructions, which may also be stored in, is able to guide computer or other programmable data processing devices with spy
Determine in the computer-readable memory that mode works, so that it includes referring to that instruction stored in the computer readable memory, which generates,
Enable the manufacture of device, the command device realize in one box of one or more flows of the flowchart and/or block diagram or
The function of being specified in multiple boxes.
These computer program instructions also can be loaded onto a computer or other programmable data processing device, so that counting
Series of operation steps are executed on calculation machine or other programmable devices to generate computer implemented processing, thus in computer or
The instruction executed on other programmable devices is provided for realizing in one or more flows of the flowchart and/or block diagram one
The step of function of being specified in a box or multiple boxes.
In a typical configuration, calculating equipment includes one or more processors (CPU), input/output interface, net
Network interface and memory.
Memory may include the non-volatile memory in computer-readable medium, random access memory (RAM) and/
Or the forms such as Nonvolatile memory, such as read-only memory (ROM) or flash memory (flash RAM).Memory is computer-readable Jie
The example of matter.
Computer-readable medium includes permanent and non-permanent, removable and non-removable media can be by any method
Or technology come realize information store.Information can be computer readable instructions, data structure, the module of program or other data.
The example of the storage medium of computer includes, but are not limited to phase change memory (PRAM), static random access memory (SRAM), moves
State random access memory (DRAM), other kinds of random access memory (RAM), read-only memory (ROM), electric erasable
Programmable read only memory (EEPROM), flash memory or other memory techniques, read-only disc read only memory (CD-ROM) (CD-ROM),
Digital versatile disc (DVD) or other optical storage, magnetic cassettes, tape magnetic disk storage or other magnetic storage devices
Or any other non-transmission medium, can be used for storage can be accessed by a computing device information.As defined in this article, it calculates
Machine readable medium does not include temporary computer readable media (transitory media), such as the data-signal and carrier wave of modulation.
It should also be noted that, the terms "include", "comprise" or its any other variant are intended to nonexcludability
It include so that the process, method, commodity or the equipment that include a series of elements not only include those elements, but also to wrap
Include other elements that are not explicitly listed, or further include for this process, method, commodity or equipment intrinsic want
Element.In the absence of more restrictions, the element limited by sentence "including a ...", it is not excluded that including element
There is also other identical elements in process, method, commodity or equipment.
It will be understood by those skilled in the art that embodiments herein can provide as method, system or computer program product.
Therefore, complete hardware embodiment, complete software embodiment or embodiment combining software and hardware aspects can be used in the application
Form.It is deposited moreover, the application can be used to can be used in the computer that one or more wherein includes computer usable program code
The shape for the computer program product implemented on storage media (including but not limited to magnetic disk storage, CD-ROM, optical memory etc.)
Formula.
The above is only embodiments herein, are not intended to limit this application.To those skilled in the art,
Various changes and changes are possible in this application.It is all within the spirit and principles of the present application made by any modification, equivalent replacement,
Improve etc., it should be included within the scope of the claims of this application.
Claims (12)
1. a kind of detection method of website abnormal amount of access characterized by comprising
Obtain the access information of preset website, the access information includes: the amount of access of the preset website, visitor ID and described
The corresponding visitor of visitor ID the preset website click coordinate, the visitor ID be visitor in the preset website only
One mark；
According to the access information, the actual range between the click coordinate and hot spot click on area is determined, wherein the heat
Point click on area determines according to the amount of access, and is the hot spot click on area in the preset website；
According to the actual range, judge that the exception visitor is preset with the presence or absence of abnormal visitor in the preset website
The actual range is more than the corresponding visitor of same visitor ID of abnormal distance threshold in time threshold；
The abnormal visitor if it exists, then output abnormality visitor alarming information.
2. the method according to claim 1, wherein the method also includes:
It obtains first and jumps visitor's quantity；Wherein, described first visitor's quantity is jumped, is in preset time threshold value, by same
One redirected link path jumps to visitor's quantity of the different visitor ID of the preset website, further includes jumping in the access information
Turn link path；
It obtains second and jumps visitor's quantity；Wherein, described second visitor's quantity is jumped, to pass through institute in preset time threshold value
There is redirected link path to jump to visitor's quantity of the different visitor ID of the preset website；
Visitor's quantity is jumped according to described first and jumps visitor's quantity with described second, calculates path repetitive rate, wherein the road
Diameter repetitive rate jumps visitor's quantity for described first and accounts for the described second percentage for jumping visitor's quantity.
3. according to the method described in claim 2, it is characterized in that, the output abnormality visitor alarming information further include:
If the path repetitive rate, which is greater than preset path, repeats threshold value, output abnormality visitor alarming information.
4. method according to any one of claim 1-3, which is characterized in that according to access information determination
Before actual range between click coordinate and hot spot click on area, the method also includes:
The amount of access is subjected to clustering, determines the hot spot click on area.
5. according to the method described in claim 4, it is characterized in that, determining the click coordinate and heat according to the access information
Point click on area between actual range include:
Hot spot coordinates are obtained, the hot spot coordinates are the arbitrary coordinate in the hot spot click on area；
Calculate the actual range between the click coordinate and the hot spot coordinates.
6. according to the method described in claim 5, it is characterized in that, the access information for obtaining preset website includes:
The solicited message for obtaining access information is sent to thermodynamic chart server；
It receives and obtains the access information.
7. a kind of detection device of website abnormal amount of access characterized by comprising
First acquisition unit, for obtaining the access information of preset website, the access information includes: the visit of the preset website
In the click coordinate of the preset website, the visitor ID is that visitor exists by the amount of asking, visitor ID and the corresponding visitor of the visitor ID
Unique identification in the preset website；
First determination unit, the access information for being obtained according to the first acquisition unit, determines the click coordinate
With the actual range between hot spot click on area, wherein the hot spot click on area determines according to the amount of access, and is described
Hot spot click on area in preset website；
Judging unit, for according to first determination unit determine the actual range, judge be in the preset website
No to there is abnormal visitor, the exception visitor is that the actual range is more than the same of abnormal distance threshold in preset time threshold value
The corresponding visitor of one visitor ID；
Output unit, for when judging unit judgement is there are when the abnormal visitor, output abnormality visitor alarming information.
8. device according to claim 7, which is characterized in that described device further include:
Second acquisition unit jumps visitor's quantity for obtaining first；Wherein, described first visitor's quantity is jumped, for preset
In time threshold, visitor's quantity of the different visitor ID of the preset website is jumped to by same redirected link path, it is described
It further include redirected link path in access information；
Third acquiring unit jumps visitor's quantity for obtaining second；Wherein, described second visitor's quantity is jumped, for preset
In time threshold, visitor's quantity of the different visitor ID of the preset website is jumped to by all redirected link paths；
Computing unit, described first for being obtained according to the second acquisition unit jumps visitor's quantity and third acquisition
Described the second of unit acquisition jumps visitor's quantity, calculates path repetitive rate, wherein the path repetitive rate is described first
It jumps visitor's quantity and accounts for the described second percentage for jumping visitor's quantity.
9. device according to claim 8, which is characterized in that the output unit is also used to when the computing unit meter
When the path repetitive rate calculated is greater than preset path repetition threshold value, output abnormality visitor alarming information.
10. the device according to any one of claim 7-9, which is characterized in that described device further include:
Second determination unit, for determining the click coordinate and hot spot according to the access information in first determination unit
Before actual range between click on area, the amount of access is subjected to clustering, determines the hot spot click on area.
11. a kind of storage medium, which is characterized in that the storage medium includes the program of storage, wherein run in described program
When control the storage medium where equipment perform claim require 1 to visit to the website abnormal described in any one of claim 6
The detection method for the amount of asking.
12. a kind of detection device of website abnormal amount of access, which is characterized in that including pocessor and storage media, the storage
Media storage has a program, and the processor is for running program, and perform claim requires 1 to claim 6 when described program is run
Any one of described in website abnormal amount of access detection method.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201510857706.4A CN106817235B (en) | 2015-11-30 | 2015-11-30 | The detection method and device of website abnormal amount of access |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201510857706.4A CN106817235B (en) | 2015-11-30 | 2015-11-30 | The detection method and device of website abnormal amount of access |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN106817235A CN106817235A (en) | 2017-06-09 |
| CN106817235B true CN106817235B (en) | 2019-11-08 |
Family
ID=59156915
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201510857706.4A Active CN106817235B (en) | 2015-11-30 | 2015-11-30 | The detection method and device of website abnormal amount of access |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN106817235B (en) |
Families Citing this family (7)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN109428776B (en) * | 2017-08-23 | 2020-11-27 | 北京国双科技有限公司 | Website traffic monitoring method and device |
| CN110020354B (en) | 2017-09-30 | 2021-02-26 | 北京国双科技有限公司 | Click thermodynamic diagram anomaly detection method and device |
| CN110149297A (en) * | 2018-02-12 | 2019-08-20 | 北京数安鑫云信息技术有限公司 | A kind of path analysis method and apparatus |
| CN110210507B (en) * | 2018-10-29 | 2023-06-02 | 腾讯科技（深圳）有限公司 | Method and device for detecting machine click and readable storage medium |
| CN111125590B (en) * | 2018-10-31 | 2023-05-05 | 北京国双科技有限公司 | Method and device for drawing thermodynamic diagram |
| CN110008100B (en) * | 2019-03-08 | 2023-03-14 | 创新先进技术有限公司 | Method and device for detecting abnormal access volume of web page |
| CN111027945A (en) * | 2019-12-27 | 2020-04-17 | 四川亨通网智科技有限公司 | Scenic spot official website system |
Family Cites Families (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| JP4246694B2 (en) * | 2004-12-27 | 2009-04-02 | 株式会社環 | Access record notification device |
| CN103138986B (en) * | 2013-01-09 | 2016-08-03 | 天津大学 | A kind of website abnormal based on visual analysis accesses the detection method of behavior |
| CN103684885B (en) * | 2013-12-31 | 2017-03-29 | 新浪网技术(中国)有限公司 | A kind of Website server access exception determines method and device |
| CN104915455B (en) * | 2015-07-02 | 2017-03-15 | 焦点科技股份有限公司 | A kind of website abnormal based on user behavior accesses recognition methodss and system |
-
2015
- 2015-11-30 CN CN201510857706.4A patent/CN106817235B/en active Active
Also Published As
| Publication number | Publication date |
|---|---|
| CN106817235A (en) | 2017-06-09 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN106817235B (en) | The detection method and device of website abnormal amount of access | |
| TWI727202B (en) | Method and system for identifying fraudulent publisher networks | |
| CN106506556A (en) | A kind of network flow abnormal detecting method and device | |
| US10474799B2 (en) | Method and system for identifying a unique mobile device based on mobile device attribute changes over time | |
| Hao et al. | Research on mandatory lane‐changing behavior in highway weaving sections | |
| Koestel et al. | Evaluation of nonparametric shape measures for solute breakthrough curves | |
| CN104765874A (en) | Method and device for detecting click-cheating | |
| CN109240874A (en) | Website page method for detecting abnormality, apparatus and system | |
| CN109600345A (en) | Abnormal data flow rate testing methods and device | |
| CN109561052A (en) | The detection method and device of website abnormal flow | |
| CN104484604B (en) | A kind of page tampering identification method, scanner, apparatus and system | |
| CN109428776B (en) | Website traffic monitoring method and device | |
| CN102831218A (en) | Method and device for determining data in thermodynamic chart | |
| CN104901962B (en) | A kind of detection method and device of web page attacks data | |
| CN109948074A (en) | Website data interconnection method, device, storage medium, processor and electronic equipment | |
| CN103544325B (en) | For data processing method and device that Webpage clicks on distribution | |
| CN108734325A (en) | The evaluation method and device of planning path | |
| CN110020339A (en) | Based on without the webpage data acquiring method and device buried a little | |
| CN109274639A (en) | The recognition methods of open platform abnormal data access and device | |
| Li et al. | New automatic incident detection algorithm based on traffic data collected for journey time estimation | |
| Jia et al. | Influence of measurement variability of international roughness index on uncertainty of network-level pavement evaluation | |
| CN104182663B (en) | A kind of method and device for differentiating simulator operation | |
| CN106572057A (en) | Method and device for detecting exception information of user login | |
| CN110955846A (en) | Propagation path diagram generation method and device | |
| CN107292596A (en) | The apparatus and method and service end of anti-automatic brush red packet |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| CB02 | Change of applicant information |
Address after: 100083 No. 401, 4th Floor, Haitai Building, 229 North Fourth Ring Road, Haidian District, Beijing Applicant after: Beijing Guoshuang Technology Co.,Ltd. Address before: 100086 Cuigong Hotel, 76 Zhichun Road, Shuangyushu District, Haidian District, Beijing Applicant before: Beijing Guoshuang Technology Co.,Ltd. |
|
| CB02 | Change of applicant information | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |