CN106936778A - The abnormal detection method of website traffic and device - Google Patents
The abnormal detection method of website traffic and device Download PDFInfo
- Publication number
- CN106936778A CN106936778A CN201511019106.7A CN201511019106A CN106936778A CN 106936778 A CN106936778 A CN 106936778A CN 201511019106 A CN201511019106 A CN 201511019106A CN 106936778 A CN106936778 A CN 106936778A
- Authority
- CN
- China
- Prior art keywords
- behavioral data
- website
- ratio
- access
- browser
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
- H04L63/1425—Traffic logging, e.g. anomaly detection
Landscapes
- Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Computer Hardware Design (AREA)
- Computing Systems (AREA)
- General Engineering & Computer Science (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Information Transfer Between Computers (AREA)
Abstract
This application discloses a kind of abnormal detection method of website traffic and device.Wherein, the method includes：The access behavioral data using various browser access multiple website in preset time period is obtained, obtains accessing behavioral data set；Calculate using the first ratio for accessing behavioral data in access behavioral data set using every kind of browser, obtain the distribution of the first access behavioral data；The second ratio of the access behavioral data of every kind of browser is used in the access behavioral data for calculating each website in multiple websites, multiple second access behavioral data distributions one-to-one with multiple websites are obtained；Calculate multiple second and access in behavioral datas distribution each and second access the similarity that behavioral data distribution accesses behavioral data distribution with first, obtain and the one-to-one multiple similarities in multiple websites；Targeted website is determined from multiple websites according to the similarity for calculating.Present application addresses the relatively low technical problem of detection website traffic exception accuracy rate in the prior art.
Description
Technical field
The application is related to computer realm, in particular to a kind of abnormal detection method of website traffic and device.
Background technology
In existing Traffic anomaly detection method, number of requests, flow, the service of station address (URL) are generally chosen
The indexs such as the process time of device are used as the abnormal index of analyzing web site traffic.In the method, simple given threshold, if on
State index and then think website traffic exception more than the threshold value of setting.
In the above-mentioned methods, the threshold value of setting does not have the basis of probability statistics, is programmer and artificially sets, and randomness is very
Greatly, it is as a result unreliable.And index is changed over time in itself, for example on weekdays and festivals or holidays, flow inherently differs
Sample；4 points of the flow of flow and morning at nine o'clock of evening, it is also different.And set certain threshold value and judge that the flow of website is
No exception necessarily brings erroneous judgement.
For above-mentioned problem, effective solution is not yet proposed at present.
The content of the invention
The embodiment of the present application provides a kind of abnormal detection method of website traffic and device, at least to solve prior art
The relatively low technical problem of middle detection website traffic exception accuracy rate.
According to the one side of the embodiment of the present application, there is provided a kind of abnormal detection method of website traffic, including：Obtain
Using the access behavioral data of various browser access multiple website in preset time period, obtain accessing behavioral data set；Meter
Calculate using the first ratio for accessing behavioral data in the access behavioral data set using every kind of browser, obtain the first visit
Ask that behavioral data is distributed；The access of every kind of browser is used in the access behavioral data for calculating each website in the multiple website
Second ratio of behavioral data, obtains one-to-one with the multiple website multiple second and accesses behavioral data distribution；Calculate
The multiple second accesses each second access behavioral data distribution and the described first access behavioral data in behavioral data distribution
The similarity of distribution, obtains and the one-to-one multiple similarity in the multiple website；According to the similarity for calculating from described
Targeted website is determined in multiple websites, wherein, the targeted website is the website of Traffic Anomaly.
Further, determine that targeted website includes from the multiple website according to the similarity for calculating：From described
Similarity is selected in multiple websites less than the website of preset ratio threshold value, as the targeted website；To the multiple similarity
Be ranked up from small to large, before selection the corresponding website of n similarity as the targeted website, wherein, n be more than or wait
In 1 positive integer；Or the multiple similarity is ranked up from small to large, the corresponding website of the preceding m% similarity of selection
As the targeted website, wherein, m is the positive integer more than or equal to 1, and less than or equal to 100.
Further, calculate it is the multiple second access behavioral data distribution in each second access behavioral data distribution with
Described first similarity for accessing behavioral data distribution, obtains including with the one-to-one multiple similarity in the multiple website：
By formulaThe similarity is calculated, wherein, xiThe in behavior distribution is accessed for described first
One ratio, yiIt is the described second the second ratio accessed in behavior distribution, i takes 1 to n successively, n is first ratio and described
The quantity of the second ratio；Or by formulaThe similarity is calculated,
Wherein, xiIt is the first ratio, y in the described first access behavior distributioniThe second ratio during behavior is distributed is accessed for described second
Value, i takes 1 to n successively, and n is the quantity of first ratio and second ratio.
Further, the access behavioral data of every kind of browser is used in calculating using the access behavioral data set
The first ratio, obtain the first access behavioral data distribution before, methods described also includes：According to first ratio to described
Various browsers are merged, and obtain multiple objective browsers；Wherein, calculate and used using in the access behavioral data set
First ratio of the access behavioral data of every kind of browser, obtaining the distribution of the first access behavioral data includes：Calculate using described
Each mesh in the multiple objective browser is used in the access behavioral data of multiple the multiple websites of objective browsers access
First ratio of the access behavioral data of mark browser, obtains described first and accesses behavioral data distribution.
Further, the multiple objective browser includes first object browser and the second objective browser, according to institute
State the first ratio to merge various browsers, obtaining multiple objective browsers includes：By first ratio according to
Descending is ranked up；It is determined that the corresponding browser of preceding k-1 the first ratios is the first object browser, wherein, k be more than
Or the positive integer equal to 1；Browser corresponding to remaining n-k+1 the first ratio is merged into second target to browse
Device, and the n-k+1 the first ratio is merged into the accounting of second objective browser, wherein, second target is clear
Look at device accounting be less than the ratio of kth -1 first.
According to the another aspect of the embodiment of the present application, a kind of abnormal detection means of website traffic is additionally provided, including：Obtain
Unit is taken, the access behavioral data of various browser access multiple website is used in preset time period for obtaining, is accessed
Behavioral data set；First computing unit, every kind of browser is used for calculating using in the access behavioral data set
The first ratio of behavioral data is accessed, the distribution of the first access behavioral data is obtained；Second computing unit, it is the multiple for calculating
The second ratio for accessing behavioral data in website in the access behavioral data of each website using every kind of browser, obtains and institute
State multiple websites one-to-one multiple second and access behavioral data distribution；3rd computing unit, for calculating the multiple
Each second access behavioral data distribution accesses the similar of behavioral data distribution to described first in two access behavioral data distributions
Degree, obtains and the one-to-one multiple similarity in the multiple website；Determining unit, for according to the similarity for calculating from institute
State and determine targeted website in multiple websites, wherein, the targeted website is the website of Traffic Anomaly.
Further, the determining unit includes：First choice module, for selecting similarity from the multiple website
Less than the website of preset ratio threshold value, as the targeted website；Second selecting module, for the multiple similarity from small
To being ranked up greatly, the corresponding website of preceding n similarity is selected as the targeted website, wherein, n is more than or equal to 1
Positive integer；Or the 3rd selecting module, for being ranked up from small to large to the multiple similarity, m% phase before selection
Corresponding website is seemingly spent as the targeted website, wherein, m is more than or equal to 1 and just whole less than or equal to 100
Number.
Further, the 3rd computing unit includes：First computing module, for by formulaThe similarity is calculated, wherein, xiFor described first access behavior distribution in the first ratio,
yiFor described second accesses the second ratio in behavior distribution, i takes 1 to n successively, and n is first ratio and second ratio
The quantity of value；Or second computing module, for by formulaCalculate
The similarity, wherein, xiIt is the first ratio, y in the described first access behavior distributioniIt is the described second access behavior distribution
In the second ratio, i takes 1 to n successively, and n is the quantity of first ratio and second ratio.
Further, described device also includes：Combining unit, the visit is used for being calculated in first computing unit
The first ratio of the access behavioral data that every kind of browser is used in behavioral data set is asked, the first access behavioral data point is obtained
Before cloth, various browsers are merged according to first ratio, obtain multiple objective browsers；Wherein, it is described
First computing unit includes：Computing module, the multiple target is used for calculating using in the access behavioral data set
First ratio of the access behavioral data of each objective browser in browser, obtains described first and accesses behavioral data distribution.
Further, the multiple objective browser includes first object browser and the second objective browser, the conjunction
And unit includes：Order module, for first ratio to be ranked up according to descending；Determining module, for determining preceding k-1
The corresponding browser of individual first ratio is the first object browser, wherein, k is the positive integer more than or equal to 1；Merge
Module, for the browser corresponding to remaining n-k+1 the first ratio to be merged into second objective browser, and will be described
N-k+1 the first ratio merges into the accounting of second objective browser, wherein, the accounting of second objective browser is small
In the ratio of kth -1 first.
In the embodiment of the present application, using the access obtained in preset time period using various browser access multiple website
Behavioral data, obtains accessing behavioral data set；Calculate and use every kind of browser using in the access behavioral data set
The first ratio of behavioral data is accessed, the distribution of the first access behavioral data is obtained；Calculate each website in the multiple website
The second ratio of the access behavioral data in behavioral data using every kind of browser is accessed, is obtained and a pair of the multiple website 1
Multiple second for answering accesses behavioral data and is distributed；Calculate the multiple second and access each second access row in behavioral data distribution
For data distribution accesses the similarity that behavioral data is distributed with described first, obtain multiple correspondingly with the multiple website
Similarity；Targeted website is determined from the multiple website according to the similarity for calculating, wherein, the targeted website is stream
The mode of abnormal website is measured, by the way that behavioral data calculating the first access behavioral data is distributed and second accesses behavior according to accessing
Data distribution, and behavioral data distribution calculating Similarity value is accessed according to the first access behavioral data distribution and second, by phase
The website of Traffic Anomaly is determined like degree, the method relative to the abnormal website of artificial investigation is relied in the prior art has reached fast
Speed and the purpose of accurate detection flows exception website, and then it is relatively low to solve detection website traffic exception accuracy rate in the prior art
Technical problem, it is achieved thereby that improving the technique effect of Traffic Anomaly website detection efficiency.
Brief description of the drawings
Accompanying drawing described herein is used for providing further understanding of the present application, constitutes the part of the application, this Shen
Schematic description and description please does not constitute the improper restriction to the application for explaining the application.In the accompanying drawings：
Fig. 1 is the flow chart according to a kind of abnormal detection method of website traffic of the embodiment of the present application；And
Fig. 2 is the schematic diagram according to a kind of abnormal detection means of website traffic of the embodiment of the present application.
Specific embodiment
In order that those skilled in the art more fully understand application scheme, below in conjunction with the embodiment of the present application
Accompanying drawing, is clearly and completely described to the technical scheme in the embodiment of the present application, it is clear that described embodiment is only
The embodiment of the application part, rather than whole embodiments.Based on the embodiment in the application, ordinary skill people
The every other embodiment that member is obtained under the premise of creative work is not made, should all belong to the model of the application protection
Enclose.
It should be noted that term " first ", " in the description and claims of this application and above-mentioned accompanying drawing
Two " it is etc. for distinguishing similar object, without for describing specific order or precedence.It should be appreciated that so using
Data can exchange in the appropriate case, so as to embodiments herein described herein can with except illustrating herein or
Order beyond those of description is implemented.Additionally, term " comprising " and " having " and their any deformation, it is intended that cover
Lid is non-exclusive to be included, for example, the process, method, system, product or the equipment that contain series of steps or unit are not necessarily limited to
Those steps or unit clearly listed, but may include not list clearly or for these processes, method, product
Or other intrinsic steps of equipment or unit.
According to the embodiment of the present application, there is provided a kind of abnormal detection method of website traffic, it is necessary to explanation, in accompanying drawing
Flow can be performed in the such as one group computer system of computer executable instructions the step of illustrate, and, although
Show logical order in flow charts, but in some cases, can with different from order herein perform it is shown or
The step of description.
Fig. 1 is the flow chart according to a kind of abnormal detection method of website traffic of the embodiment of the present application, as shown in figure 1,
The method comprises the following steps S102 to step S110：
Step S102, obtains the access behavioral data using various browser access multiple website in preset time period, obtains
To access behavioral data set.
Preset time period can be chosen for one day, one week or one month, and browser can be IE browser, and 360 browse
Device, or other browsers, for example, Chrome, Safari, Sougo, Firefox etc..The access behavioral data of website can be with
Have various, can be visit capacity of the website in preset time period and the website in preset time period in the present embodiment
Flowing of access etc..
Step S104, calculates first using the access behavioral data that every kind of browser is used in access behavioral data set
Ratio, obtains the distribution of the first access behavioral data.
For example, IE browser, 360 browsers, Chrome browsers, Safari browsers, Sougo browsers and
The access behavioral data of multiple websites is respectively a bars, b bars, c bars, d bars, e bars and f bars in Firefox browser, then above-mentioned clear
The first ratio of the access behavioral data of every kind of browser in device of looking at is respectivelyWithWherein,
X=a+b+c+d+e+f.Above-mentioned multiple first ratios are the distribution of the first access behavioral data, also referred to as benchmark distributions.
Step S106, uses the access row of every kind of browser in the access behavioral data for calculating each website in multiple websites
It is the second ratio of data, obtains one-to-one with multiple websites multiple second and access behavioral data distribution.
For example, any one website " A websites ", in IE browser, 360 browsers, Chrome browsers, Safari is browsed
Device, the access behavioral data of " A websites " is respectively a in the browser such as Sougo browsers and Firefox2Bar, b2Bar, c2Bar, d2
Bar, e2Bar and f2Bar, the second ratio of access behavioral data of the A websites in above-mentioned browser using every kind of browser is respectively：WithWherein, X2=a2+b2+c2+d2+e2+f2, above-mentioned multiple second ratios
As second accesses behavioral data distribution.
Step S108, calculates multiple second and accesses each second access behavioral data distribution and first in behavioral data distribution
The similarity of behavioral data distribution is accessed, is obtained and the one-to-one multiple similarity in multiple websites.
Specifically, it is distributed and the first access behavioral data distribution by calculating the second access behavioral data of each website
Similarity, it may be determined that the website of Traffic Anomaly, can also determine the access channel of the Traffic Anomaly website, i.e., user is at which
The website is have accessed in browser.
Step S110, targeted website is determined according to the similarity for calculating from multiple websites, wherein, targeted website is
The website of Traffic Anomaly.
Specifically, in the embodiment of the present application, the similarity for calculating is smaller, shows that the abnormal probability of website traffic is got over
It is high.
In the embodiment of the present application, by the way that according to accessing, behavioral data calculating the first access behavioral data is distributed and second visits
Ask that behavioral data is distributed, and behavioral data distribution and the second access behavioral data distribution accessed according to first and calculate Similarity value,
The website of Traffic Anomaly is determined by similarity, the method relative to the abnormal website of artificial investigation is relied in the prior art reaches
The purpose of quick and accurate detection flows exception website has been arrived, and then it is abnormal accurate to solve detection website traffic in the prior art
The relatively low technical problem of rate, it is achieved thereby that improving the technique effect of Traffic Anomaly website detection efficiency.
Determine that having for targeted website is various from multiple websites according to similarity, in another alternative embodiment, can be with
Including following any one mode：
Mode one：
Similarity is selected from multiple websites less than the website of preset ratio threshold value, as targeted website.
Specifically, it may be considered that set preset ratio threshold value to determine targeted website, the value of the similarity that will be calculated
It is compared with preset ratio threshold value respectively, and determines that less than the corresponding website of similarity of preset ratio threshold value be Traffic Anomaly
Website, the access channel of the Traffic Anomaly website can also be determined.
Mode two：
Multiple similarities are ranked up from small to large, the corresponding website of preceding n similarity is selected as targeted website, its
In, n is the positive integer more than or equal to 1.
Specifically, ascending sort can be carried out to the multiple similarities being calculated, obtains a similarity sequence, chosen
The corresponding website of preceding n in the sequence smaller similarity as Traffic Anomaly website (that is, targeted website), wherein, n's takes
Value user can determine according to the quantity of the species of actual browser and website.For example, in 1000 websites, choosing similarity sequence
In preceding 10 similarities or the website corresponding to preceding 15 similarities be targeted website.
Mode three：
Multiple similarities are ranked up from small to large, the corresponding website of preceding m% similarity is selected as targeted website,
Wherein, m is the positive integer more than or equal to 1, and less than or equal to 100.
Specifically, ascending sort can be carried out to the multiple similarities being calculated, obtains a similarity sequence, chosen
The corresponding website of the less similarities of preceding m% is the website of Traffic Anomaly in the sequence.Wherein, m% is a percent value,
The value user of m% can choose according to actual needs, for example, choose in the similarity sequence preceding 1% corresponding website of similarity
It is the website of Traffic Anomaly.If the quantity of website is 1000, the website of Traffic Anomaly is 10.
Alternatively, in the embodiment of the present application, preset algorithm can have various, for example, Pearson correlation coefficient algorithm or
Person calculates similarity by KL divergence formula scheduling algorithms.Preferably, calculate multiple second and access each in behavioral data distribution
Second accesses the similarity that behavioral data distribution accesses behavioral data distribution with first, obtains many correspondingly with multiple websites
Individual similarity includes：
Similarity is calculated by KL divergences formula, the formula that KL divergences are calculated is：Wherein,
xiIt is the first ratio, y in the first access behavior distributioniFor second accesses the second ratio in behavior distribution, i takes 1 to n successively,
N is the quantity of the first ratio and the second ratio.
Similarity, the computing formula of Pearson correlation coefficient algorithm can also be calculated by Pearson correlation coefficient algorithm
For：Wherein, xiIt is the first ratio, y in the first access behavior distributioni
It is the second the second ratio accessed in behavior distribution, i takes 1 to n successively, n is the quantity of the first ratio and the second ratio, x is the
One average value for accessing the first ratio in behavior distribution, y is the average value of the second ratio in the second access behavior distribution.
In addition to above two calculation, in this application, other calculations can also be chosen to calculate multiple the
Each second access behavioral data is distributed in the similarity of the first access behavioral data distribution in two access behavioral data distributions.Example
Such as, mahalanobis distance algorithm, Chebyshev's distance algorithm etc..
Alternatively, using the access behavioral data that every kind of browser is used in accessing behavioral data set first is being calculated
Ratio, before obtaining the distribution of the first access behavioral data, method also comprises the following steps S1：Browsed to various according to the first ratio
Device is merged, and obtains multiple objective browsers.
Specifically, if the quantity of browser is more, account for smaller due to what some browsers were calculated, meter can be caused
The error of the similarity for obtaining is larger.Therefore, before the distribution of the first access behavioral data is obtained, can be according to the first ratio
Various browsers are merged, the various browsers (that is, objective browser) after being merged.For example, browser is by closing
And 100 before are changed into 10 after merging.
Calculate using the first ratio for accessing behavioral data in access behavioral data set using every kind of browser, obtain
First access behavioral data distribution includes step S3：Calculate the access behavior number that multiple websites are accessed using multiple objective browsers
According to middle the first ratio using the access behavioral data of each objective browser in multiple objective browsers, the first access row is obtained
It is data distribution.Specifically, after the merging of various browsers obtains multiple objective browsers, multiple objective browsers are obtained
Each objective browser is used in the first access behavioral data for accessing each website in behavioral data, and then the multiple websites of calculating
Access behavioral data the second ratio, obtain the second access behavioral data distribution.
Alternatively, multiple objective browsers include first object browser and the second objective browser, according to accounting to many
Plant browser to merge, obtain multiple objective browsers and comprise the following steps S11 to step S15：
Step S11, multiple first ratios are ranked up according to descending.
Step S13, it is determined that the corresponding browser of preceding k-1 the first ratios is first object browser, wherein, k be more than
Or the positive integer equal to 1.
Step S15, the second objective browser is merged into by the browser corresponding to remaining n-k+1 the first ratio, and will
N-k+1 the first ratio merges into the accounting of the second objective browser, wherein, the accounting of the second objective browser is less than kth -1
Individual first ratio.
It is assumed that quantity n=100 of browser, can obtain 100 the first ratios, respectively x by calculating1~
x100, 100 first ratio can be ranked up according to descending, obtain the collating sequence of the first ratio.User can be according to meter
The first ratio for calculating determines the value of k, for example, choosing, first larger ratio of first 9 (that is, k=10) is corresponding to be browsed
Device is first object browser, i.e. obtain 9 first object browsers.Then by the rear n-k+1=91 browser in sequence
91 sums of the first ratio of browser after the second objective browser, and calculating are merged into, is somebody's turn to do and as the second objective browser
Accounting.After by merging, the first ratio respectively x of 10 objective browsers for obtaining1、x2、x3、x4、x5、x6、x7、x8、
x9And y10, wherein, y10=x10+x11+x12+……+x100。
After the first ratio for obtaining above-mentioned 10 objective browsers, the first access behavioral data of objective browser is obtained
Distribution, then, calculate respectively should " A websites " and above-mentioned 10 objective browsers accounting.It is assumed that in 10 objective browsers
In the access behavioral data of " A websites " be respectively k1、k2、k3、k4、k5、k6、k7、k8、k9And k10, calculate the second ratio and be respectively：WithWherein, M=k1+k2+...+k10, according to the second ratio
The the second access behavioral data for obtaining is distributed as：
And then access behavioral data distribution { x according to first1、x2、x3、x4、x5、x6、x7、x8、x9、y10AndSimilarity is calculated, it is finally, true according to similarity
Set the goal website.
The detection method of the website traffic exception provided by the application, is no longer dependent on traditional artificial investigation, passes through
Whole network data calculates benchmark distributions, and calculates the distribution of each website and the similarity of benchmark distributions, Jin Ergen
The website of Traffic Anomaly can be quickly and accurately determined according to similarity.
The embodiment of the present application additionally provides a kind of abnormal detection means of website traffic, and the detection means is mainly used in performing
The detection method of the website traffic exception that the embodiment of the present application the above is provided, is provided the embodiment of the present application below
The abnormal detection means of website traffic does specific introduction.
Fig. 2 is the schematic diagram according to a kind of abnormal detection means of website traffic of the embodiment of the present application, as shown in Fig. 2
The abnormal detection means of the website traffic mainly includes acquiring unit 10, the first computing unit 20, the second computing unit the 30, the 3rd
Computing unit 40 and determining unit 50, wherein：
Acquiring unit 10, the access behavior number of various browser access multiple website is used for obtaining in preset time period
According to, obtain access behavioral data set.
Preset time period can be chosen for one day, one week or one month, and browser can be IE browser, and 360 browse
Device, or other browsers, for example, Chrome, Safari, Sougo, Firefox etc..The access behavioral data of website can be with
Have various, can be visit capacity of the website in preset time period and the website in preset time period in the present embodiment
Flowing of access etc..
First computing unit 20, the access behavior in access behavioral data set using every kind of browser is used for calculating
First ratio of data, obtains the distribution of the first access behavioral data.
For example, IE browser, 360 browsers, Chrome browsers, Safari browsers, Sougo browsers and
The access behavioral data of multiple websites is respectively a bars, b bars, c bars, d bars, e bars and f bars in Firefox browser, then above-mentioned clear
The first ratio of the access behavioral data of every kind of browser in device of looking at is respectivelyWithWherein, X
=a+b+c+d+e+f.Above-mentioned multiple first ratios are the distribution of the first access behavioral data.
Second computing unit 30, for being browsed using every kind of in the access behavioral data for calculating each website in multiple websites
Second ratio of the access behavioral data of device, obtains one-to-one with multiple websites multiple second and accesses behavioral data distribution.
For example, any one website " A websites ", in IE browser, 360 browsers, Chrome browsers, Safari is browsed
Device, the access behavioral data of " A websites " is respectively a in the browser such as Sougo browsers and Firefox2Bar, b2Bar, c2Bar, d2
Bar, e2Bar and f2Bar, the second ratio of access behavioral data of the A websites in above-mentioned browser using every kind of browser is respectively：WithWherein, X2=a2+b2+c2+d2+e2+f2.Above-mentioned multiple second ratios
Value is second and accesses behavioral data distribution.
3rd computing unit 40, each second access behavioral data during behavioral data is distributed is accessed for calculating multiple second
The similarity that distribution accesses behavioral data distribution with first, obtains and the one-to-one multiple similarity in multiple websites.
Specifically, it is distributed and the first access behavioral data distribution by calculating the second access behavioral data of each website
Similarity, it may be determined that the website of Traffic Anomaly, can also determine the access channel of the Traffic Anomaly website, i.e., user is at which
The website is have accessed in browser.
Determining unit 50, for determining targeted website from multiple websites according to the similarity for calculating, wherein, target
Website is the website of Traffic Anomaly.
Specifically, in the embodiment of the present application, the similarity for calculating is smaller, shows that the abnormal probability of website traffic is got over
It is high.
In the embodiment of the present application, by the way that according to accessing, behavioral data calculating the first access behavioral data is distributed and second visits
Ask that behavioral data is distributed, and behavioral data distribution and the second access behavioral data distribution accessed according to first and calculate Similarity value,
The website of Traffic Anomaly is determined by similarity, the method relative to the abnormal website of artificial investigation is relied in the prior art reaches
The purpose of quick and accurate detection flows exception website has been arrived, and then it is abnormal accurate to solve detection website traffic in the prior art
The relatively low technical problem of rate, it is achieved thereby that improving the technique effect of Traffic Anomaly website detection efficiency.
Optionally it is determined that unit includes：First choice module, for selecting similarity from multiple websites less than default ratio
The website of example threshold value, as targeted website；Second selecting module, for being ranked up from small to large to multiple similarities, selection
The corresponding website of preceding n similarity as targeted website, wherein, n is the positive integer more than or equal to 1；Or the 3rd selection
Module, for being ranked up from small to large to multiple similarities, the corresponding website of the preceding m% similarity of selection is used as target network
Stand, wherein, m is the positive integer more than or equal to 1, and less than or equal to 100.
Specifically, it may be considered that set preset ratio threshold value to determine targeted website, the value of the similarity that will be calculated
It is compared with preset ratio threshold value respectively, and determines that less than the corresponding website of similarity of preset ratio threshold value be Traffic Anomaly
Website, the access channel of the Traffic Anomaly website can also be determined.
Ascending sort can also be carried out to the multiple similarities being calculated, a similarity sequence be obtained, by calling
Second selecting module chooses website (that is, mesh of the corresponding website of the smaller similarities of the preceding n in the sequence as Traffic Anomaly
Mark website), wherein, the value user of n can determine according to the quantity of the species of actual browser and website.For example, 1000 nets
In standing, preceding 10 similarities or the corresponding website of preceding 15 similarities are targeted website in selection similarity sequence.
Ascending sort can be carried out to the multiple similarities being calculated, obtain a similarity sequence, by calling
Three selection modules are come to choose in the sequence the corresponding website of preceding m% less similarity be the website of Traffic Anomaly.Wherein,
M% is a percent value, and the value user of m% can choose according to actual needs, for example, choose preceding 1% in similarity sequence
The corresponding website of similarity for Traffic Anomaly website.If the quantity of website is 1000, the website of Traffic Anomaly is 10.
Alternatively, the 3rd computing unit includes：First computing module, for by formula
Similarity is calculated, wherein, xiIt is the first ratio, y in the first access behavior distributioniIt is second in the second access behavior distribution
Ratio, i takes 1 to n successively, and n is the quantity of the first ratio and the second ratio；Or second computing module, for by publicitySimilarity is calculated, wherein, xiThe in behavior distribution is accessed for first
One ratio, yiFor second accesses the second ratio in behavior distribution, i takes 1 to n successively, and n is the number of the first ratio and the second ratio
Amount.
Similarity is calculated by KL divergences formula, the formula that KL divergences are calculated is：Wherein,
xiIt is the first ratio, y in the first access behavior distributioniFor second accesses the second ratio in behavior distribution, i takes 1 to n successively,
N is the quantity of the first ratio and the second ratio.
Similarity, the computing formula of Pearson correlation coefficient algorithm can also be calculated by Pearson correlation coefficient algorithm
For：Wherein, xiFor first access behavior distribution in the first ratio,
yiFor second accesses the second ratio in behavior distribution, i takes 1 to n successively, and n is the quantity of the first ratio and the second ratio.
In addition to above two calculation, in this application, other calculations can also be chosen to calculate multiple the
Each second access behavioral data is distributed in the similarity of the first access behavioral data distribution in two access behavioral data distributions.Example
Such as, mahalanobis distance algorithm, Chebyshev's distance algorithm etc..
Alternatively, detection means also includes：Combining unit, access behavioral data is used for being calculated in the first computing unit
Using first ratio for accessing behavioral data of every kind of browser in set, before obtaining the distribution of the first access behavioral data, press
Various browsers are merged according to the first ratio, obtains multiple objective browsers；Specifically, if the quantity of browser is more
When, account for smaller due to what some browsers were calculated, the error of the similarity being calculated can be caused larger.Therefore, exist
Before obtaining the distribution of the first access behavioral data, various browsers can be merged according to the first ratio, obtain merging
Various browsers (that is, objective browser) afterwards.For example, browser from 100 before merging be changed into merge after 10.
Wherein, the first computing unit includes：Computing module, multiple websites are accessed for calculating using multiple objective browsers
The first ratio accessed in behavioral data using the access behavioral data of each objective browser in multiple objective browsers, obtain
Behavioral data distribution is accessed to first.Specifically, after the merging of various browsers obtains multiple objective browsers, multiple is obtained
First access behavioral data of objective browser, and then used often in the access behavioral data of each website in the multiple websites of calculating
Second ratio of the access behavioral data of individual objective browser, obtains the distribution of the second access behavioral data.
Alternatively, multiple objective browsers include first object browser and the second objective browser, and combining unit includes：
Order module, for multiple first ratios to be ranked up according to descending；Determining module, for determining preceding k-1 the first ratio
Corresponding browser is first object browser, wherein, k is the positive integer more than or equal to 1；Merging module, for that will remain
Browser corresponding to remaining n-k+1 the first ratio merges into the second objective browser, and n-k+1 the first ratio is merged into
The accounting of the second objective browser, wherein, the accounting of the second objective browser is less than the ratio of kth -1 first.
It is assumed that quantity n=100 of browser, can obtain 100 the first ratios, respectively x by calculating1~
x100, 100 first ratio is ranked up according to descending by calling order module, obtain the collating sequence of the first ratio.And
The value of k is determined by calling determining module according to the value for calculating the first ratio, for example, choosing first 9 (that is, k=10)
The larger corresponding browser of the first ratio is first object browser, i.e. obtain 9 first object browsers.Then pass through
Call merging module that the rear n-k+1=91 browser in sequence merged into the second objective browser, and after calculating 91 it is clear
Look at device the first ratio sum, should and the as accounting of the second objective browser.After by merging, 10 targets for obtaining are clear
Look at device the first ratio value respectively x1、x2、x3、x4、x5、x6、x7、x8、x9And y10, wherein, y10=x10+x11+x12+……+
x100。
The abnormal detection means of the website traffic includes processor and memory, and above-mentioned acquiring unit, first calculate single
Unit, the second computing unit, the 3rd computing unit and determining unit etc. as program unit storage in memory, by processor
Storage said procedure unit in memory is performed to realize corresponding function.
Kernel is included in processor, is gone in memory to transfer corresponding program unit by kernel.Kernel can set one
Or more, detected in the prior art by adjusting kernel parameter come quick and accurate detection flows exception website, and then solving
The relatively low technical problem of website traffic exception accuracy rate, it is achieved thereby that improving the technology effect of Traffic Anomaly website detection efficiency
Really.
Memory potentially includes the volatile memory in computer-readable medium, random access memory (RAM) and/
Or the form, such as read-only storage (ROM) or flash memory (flash RAM) such as Nonvolatile memory, memory is deposited including at least one
Storage chip.
Present invention also provides a kind of computer program product, when being performed on data processing equipment, it is adapted for carrying out just
The program code of beginningization there are as below methods step：Obtain the access using various browser access multiple website in preset time period
Behavioral data, obtains accessing behavioral data set；Calculate and use every kind of browser using in the access behavioral data set
The first ratio of behavioral data is accessed, the distribution of the first access behavioral data is obtained；Calculate each website in the multiple website
The second ratio of the access behavioral data in behavioral data using every kind of browser is accessed, is obtained and a pair of the multiple website 1
Multiple second for answering accesses behavioral data and is distributed；Calculate the multiple second and access each second access row in behavioral data distribution
For data distribution accesses the similarity that behavioral data is distributed with described first, obtain multiple correspondingly with the multiple website
Similarity；And targeted website is determined from the multiple website according to the similarity for calculating, wherein, the targeted website
It is the website of Traffic Anomaly.
Above-mentioned the embodiment of the present application sequence number is for illustration only, and the quality of embodiment is not represented.
In above-described embodiment of the application, the description to each embodiment all emphasizes particularly on different fields, and does not have in certain embodiment
The part of detailed description, may refer to the associated description of other embodiment.
In several embodiments provided herein, it should be understood that disclosed technology contents, can be by other
Mode is realized.Wherein, device embodiment described above is only schematical, such as division of described unit, Ke Yiwei
A kind of division of logic function, can there is other dividing mode when actually realizing, such as multiple units or component can combine or
Person is desirably integrated into another system, or some features can be ignored, or does not perform.Another, shown or discussed is mutual
Between coupling or direct-coupling or communication connection can be the INDIRECT COUPLING or communication link of unit or module by some interfaces
Connect, can be electrical or other forms.
The unit that is illustrated as separating component can be or may not be it is physically separate, it is aobvious as unit
The part for showing can be or may not be physical location, you can with positioned at a place, or can also be distributed to multiple
On unit.Some or all of unit therein can be according to the actual needs selected to realize the purpose of this embodiment scheme.
In addition, during each functional unit in the application each embodiment can be integrated in a processing unit, it is also possible to
It is that unit is individually physically present, it is also possible to which two or more units are integrated in a unit.Above-mentioned integrated list
Unit can both be realized in the form of hardware, it would however also be possible to employ the form of SFU software functional unit is realized.
If the integrated unit is to realize in the form of SFU software functional unit and as independent production marketing or use
When, can store in a computer read/write memory medium.Based on such understanding, the technical scheme of the application is substantially
The part for being contributed to prior art in other words or all or part of the technical scheme can be in the form of software products
Embody, the computer software product is stored in a storage medium, including some instructions are used to so that a computer
Equipment (can be personal computer, server or network equipment etc.) perform the application each embodiment methods described whole or
Part steps.And foregoing storage medium includes：USB flash disk, read-only storage (ROM, Read-Only Memory), arbitrary access are deposited
Reservoir (RAM, Random Access Memory), mobile hard disk, magnetic disc or CD etc. are various can be with store program codes
Medium.
The above is only the preferred embodiment of the application, it is noted that for the ordinary skill people of the art
For member, on the premise of the application principle is not departed from, some improvements and modifications can also be made, these improvements and modifications also should
It is considered as the protection domain of the application.
Claims (10)
1. the abnormal detection method of a kind of website traffic, it is characterised in that including：
The access behavioral data using various browser access multiple website in preset time period is obtained, obtains accessing behavioral data
Set；
Calculate using the first ratio for accessing behavioral data in the access behavioral data set using every kind of browser, obtain
First accesses behavioral data distribution；
The access behavioral data of every kind of browser is used in the access behavioral data for calculating each website in the multiple website
Second ratio, obtains one-to-one with the multiple website multiple second and accesses behavioral data distribution；
Calculate the multiple second and access each second access behavioral data distribution and the described first access in behavioral data distribution
The similarity of behavioral data distribution, obtains and the one-to-one multiple similarity in the multiple website；
Targeted website is determined from the multiple website according to the similarity for calculating, wherein, the targeted website is flow
Abnormal website.
2. method according to claim 1, it is characterised in that according to the similarity for calculating from the multiple website really
Making targeted website includes：
Similarity is selected from the multiple website less than the website of preset ratio threshold value, as the targeted website；
The multiple similarity is ranked up from small to large, the corresponding website of the preceding n similarity of selection is used as the target network
Stand, wherein, n is the positive integer more than or equal to 1；Or
The multiple similarity is ranked up from small to large, the corresponding website of the preceding m% similarity of selection is used as the target
Website, wherein, m is the positive integer more than or equal to 1, and less than or equal to 100.
3. method according to claim 1, it is characterised in that calculate the multiple second and access every in behavioral data distribution
Individual second accesses behavioral data distribution accesses the similarity that behavioral data is distributed with described first, obtains and the multiple website one
One corresponding multiple similarities include：
By formulaThe similarity is calculated, wherein, xiFor in the described first access behavior distribution
The first ratio, yiBe the described second the second ratio accessed in behavior distribution, i takes 1 to n successively, n be first ratio and
The quantity of second ratio；Or
By formula The similarity is calculated, wherein, xiIt is described
One accesses the first ratio, the y in behavior distributioniFor described second accesses the second ratio in behavior distribution, i takes 1 to n, n successively
It is first ratio and the quantity of second ratio.
4. method according to claim 1, it is characterised in that used in calculating using the access behavioral data set
First ratio of the access behavioral data of every kind of browser, before obtaining the distribution of the first access behavioral data, methods described is also wrapped
Include：
Various browsers are merged according to first ratio, obtains multiple objective browsers；
Wherein, calculate and use the first ratio for accessing behavioral data in the access behavioral data set using every kind of browser
Value, obtaining the distribution of the first access behavioral data includes：Calculate and access the multiple website using the multiple objective browser
Using the first ratio of the access behavioral data of each objective browser in the multiple objective browser in access behavioral data,
Obtain described first and access behavioral data distribution.
5. method according to claim 4, it is characterised in that the multiple objective browser includes first object browser
With the second objective browser, various browsers are merged according to first ratio, obtain multiple objective browsers
Including：
First ratio is ranked up according to descending；
It is determined that the preceding k-1 corresponding browser of the first ratio is the first object browser, wherein, k is more than or equal to 1
Positive integer；
Browser corresponding to remaining n-k+1 the first ratios is merged into second objective browser, and by the n-k+1
Individual first ratio merges into the accounting of second objective browser, wherein, the accounting of second objective browser is less than the
K-1 the first ratio.
6. the abnormal detection means of a kind of website traffic, it is characterised in that including：
Acquiring unit, the access behavioral data of various browser access multiple website is used for obtaining in preset time period, obtained
To access behavioral data set；
First computing unit, the access behavior number in the access behavioral data set using every kind of browser is used for calculating
According to the first ratio, obtain the first access behavioral data distribution；
Second computing unit, for using every kind of browser in the access behavioral data for calculating each website in the multiple website
Access behavioral data the second ratio, obtain and the multiple website one-to-one multiple second access behavioral datas point
Cloth；
3rd computing unit, each second access behavioral data point during behavioral data is distributed is accessed for calculating the multiple second
Cloth accesses the similarity that behavioral data is distributed with described first, obtains and the one-to-one multiple similarity in the multiple website；
Determining unit, for determining targeted website from the multiple website according to the similarity for calculating, wherein, the mesh
Mark website is the website of Traffic Anomaly.
7. device according to claim 6, it is characterised in that the determining unit includes：
First choice module, for selecting similarity from the multiple website less than the website of preset ratio threshold value, as institute
State targeted website；
Second selecting module, for being ranked up from small to large to the multiple similarity, the corresponding net of the preceding n similarity of selection
Stand as the targeted website, wherein, n is the positive integer more than or equal to 1；Or
3rd selecting module, for being ranked up from small to large to the multiple similarity, m% similarity is corresponding before selection
Website as the targeted website, wherein, m is the positive integer more than or equal to 1, and less than or equal to 100.
8. device according to claim 6, it is characterised in that the 3rd computing unit includes：
First computing module, for by formulaThe similarity is calculated, wherein, xiFor described
First accesses the first ratio, the y in behavior distributioniBe described second access behavior distribution in the second ratio, i take successively 1 to
N, n are the quantity of first ratio and second ratio；Or
Second computing module, for by formula Calculate described similar
Degree, wherein, xiIt is the first ratio, y in the described first access behavior distributioniIt is second in the described second access behavior distribution
Ratio, i takes 1 to n successively, and n is the quantity of first ratio and second ratio.
9. device according to claim 6, it is characterised in that described device also includes：
Combining unit, for first computing unit calculate using it is described access behavioral data set in browsed using every kind of
First ratio of the access behavioral data of device, before obtaining the distribution of the first access behavioral data, according to first ratio to institute
State various browsers to merge, obtain multiple objective browsers；
Wherein, first computing unit includes：Computing module, uses for calculating using in the access behavioral data set
The first ratio of the access behavioral data of each objective browser, obtains described first and accesses row in the multiple objective browser
It is data distribution.
10. device according to claim 9, it is characterised in that the multiple objective browser is browsed including first object
Device and the second objective browser, the combining unit include：
Order module, for first ratio to be ranked up according to descending；
Determining module, for determining that the preceding k-1 corresponding browser of the first ratio is the first object browser, wherein, k is
Positive integer more than or equal to 1；
Merging module, for the browser corresponding to remaining n-k+1 the first ratio to be merged into second objective browser,
And the n-k+1 the first ratios are merged into the accounting of second objective browser, wherein, second objective browser
Accounting be less than the ratio of kth -1 first.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201511019106.7A CN106936778B (en) | 2015-12-29 | 2015-12-29 | Method and device for detecting abnormal website traffic |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201511019106.7A CN106936778B (en) | 2015-12-29 | 2015-12-29 | Method and device for detecting abnormal website traffic |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN106936778A true CN106936778A (en) | 2017-07-07 |
| CN106936778B CN106936778B (en) | 2020-05-05 |
Family
ID=59441385
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201511019106.7A Active CN106936778B (en) | 2015-12-29 | 2015-12-29 | Method and device for detecting abnormal website traffic |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN106936778B (en) |
Cited By (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN107438079A (en) * | 2017-08-18 | 2017-12-05 | 杭州安恒信息技术有限公司 | A kind of detection method of the unknown abnormal behaviour in website |
| CN109246026A (en) * | 2018-08-13 | 2019-01-18 | 中国平安人寿保险股份有限公司 | Traffic management and control method, apparatus, equipment and storage medium |
| CN109783773A (en) * | 2018-12-14 | 2019-05-21 | 微梦创科网络科技（中国）有限公司 | A kind of method and device of the improper flow of determining website interface |
| CN111817909A (en) * | 2020-06-12 | 2020-10-23 | 中国船舶重工集团公司第七二四研究所 | Equipment health management method based on behavior set template monitoring |
| CN112165466A (en) * | 2020-09-16 | 2021-01-01 | 杭州安恒信息技术股份有限公司 | Method and device for false alarm identification, electronic device and storage medium |
| CN114024699A (en) * | 2020-07-17 | 2022-02-08 | 杨耀忠 | Abnormal flow detection method in complex network environment |
Citations (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20080249786A1 (en) * | 2007-04-03 | 2008-10-09 | Google Inc. | Identifying inadequate search content |
| CN102790700A (en) * | 2011-05-19 | 2012-11-21 | 北京启明星辰信息技术股份有限公司 | Method and device for recognizing webpage crawler |
| CN102932206A (en) * | 2012-11-19 | 2013-02-13 | 北京奇虎科技有限公司 | Method and system for monitoring website access information |
| CN103117903A (en) * | 2013-02-07 | 2013-05-22 | 中国联合网络通信集团有限公司 | Internet surfing unusual flow detection method and device |
| CN104077396A (en) * | 2014-07-01 | 2014-10-01 | 清华大学深圳研究生院 | Method and device for detecting phishing website |
| WO2015039553A1 (en) * | 2013-09-23 | 2015-03-26 | Tencent Technology (Shenzhen) Company Limited | Method and system for identifying fraudulent websites priority claim and related application |
-
2015
- 2015-12-29 CN CN201511019106.7A patent/CN106936778B/en active Active
Patent Citations (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20080249786A1 (en) * | 2007-04-03 | 2008-10-09 | Google Inc. | Identifying inadequate search content |
| CN102790700A (en) * | 2011-05-19 | 2012-11-21 | 北京启明星辰信息技术股份有限公司 | Method and device for recognizing webpage crawler |
| CN102932206A (en) * | 2012-11-19 | 2013-02-13 | 北京奇虎科技有限公司 | Method and system for monitoring website access information |
| CN103117903A (en) * | 2013-02-07 | 2013-05-22 | 中国联合网络通信集团有限公司 | Internet surfing unusual flow detection method and device |
| WO2015039553A1 (en) * | 2013-09-23 | 2015-03-26 | Tencent Technology (Shenzhen) Company Limited | Method and system for identifying fraudulent websites priority claim and related application |
| CN104077396A (en) * | 2014-07-01 | 2014-10-01 | 清华大学深圳研究生院 | Method and device for detecting phishing website |
Cited By (10)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN107438079A (en) * | 2017-08-18 | 2017-12-05 | 杭州安恒信息技术有限公司 | A kind of detection method of the unknown abnormal behaviour in website |
| CN107438079B (en) * | 2017-08-18 | 2020-05-01 | 杭州安恒信息技术股份有限公司 | Method for detecting unknown abnormal behaviors of website |
| CN109246026A (en) * | 2018-08-13 | 2019-01-18 | 中国平安人寿保险股份有限公司 | Traffic management and control method, apparatus, equipment and storage medium |
| CN109783773A (en) * | 2018-12-14 | 2019-05-21 | 微梦创科网络科技（中国）有限公司 | A kind of method and device of the improper flow of determining website interface |
| CN109783773B (en) * | 2018-12-14 | 2022-11-11 | 微梦创科网络科技（中国）有限公司 | Method and device for determining abnormal flow of website interface |
| CN111817909A (en) * | 2020-06-12 | 2020-10-23 | 中国船舶重工集团公司第七二四研究所 | Equipment health management method based on behavior set template monitoring |
| CN111817909B (en) * | 2020-06-12 | 2022-01-21 | 中国船舶重工集团公司第七二四研究所 | Equipment health management method based on behavior set template monitoring |
| CN114024699A (en) * | 2020-07-17 | 2022-02-08 | 杨耀忠 | Abnormal flow detection method in complex network environment |
| CN112165466A (en) * | 2020-09-16 | 2021-01-01 | 杭州安恒信息技术股份有限公司 | Method and device for false alarm identification, electronic device and storage medium |
| CN112165466B (en) * | 2020-09-16 | 2022-06-17 | 杭州安恒信息技术股份有限公司 | Method and device for false alarm identification, electronic device and storage medium |
Also Published As
| Publication number | Publication date |
|---|---|
| CN106936778B (en) | 2020-05-05 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN106936778A (en) | The abnormal detection method of website traffic and device | |
| CN103886068B (en) | Data processing method and device for Internet user's behavioural analysis | |
| CN104391979B (en) | Network malice reptile recognition methods and device | |
| TWI587229B (en) | Push method and device for product information | |
| CN104426713B (en) | The monitoring method and device of web site access effect data | |
| CN109559208A (en) | A kind of information recommendation method, server and computer-readable medium | |
| CN105260414B (en) | User behavior similarity calculation method and device | |
| CN107066476A (en) | A kind of real-time recommendation method based on article similarity | |
| CN106547793A (en) | The method and apparatus for obtaining proxy server address | |
| CN102831218A (en) | Method and device for determining data in thermodynamic chart | |
| CN106920119A (en) | The evaluation method and device of a kind of user's value | |
| CN103593444B (en) | Internet Keyword identifying processing method and apparatus | |
| CN106874165A (en) | Page detection method and device | |
| CN110825977A (en) | Data recommendation method and related equipment | |
| CN106899426A (en) | User's access number statistical method and its system | |
| CN104391953B (en) | Detect the method and device of webpage renewal | |
| CN105335363B (en) | A kind of Object Push method and system | |
| CN104090908A (en) | Method and device for counting mean detention time in page group and generalizing content in website | |
| CN109409940A (en) | Browse processing method, device, equipment and storage medium based on path | |
| CN110310476B (en) | Road congestion degree evaluation method and device, computer equipment and storage medium | |
| CN106257507A (en) | The methods of risk assessment of user behavior and device | |
| CN107231383A (en) | The detection method and device of CC attacks | |
| CN110287373A (en) | Collaborative filtering film recommended method and system based on score in predicting and user characteristics | |
| CN107135199A (en) | The detection method and device at webpage back door | |
| CN110008393A (en) | It is a kind of for obtaining the method and apparatus of site information |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| CB02 | Change of applicant information | ||
| CB02 | Change of applicant information |
Address after: 100083 No. 401, 4th Floor, Haitai Building, 229 North Fourth Ring Road, Haidian District, Beijing Applicant after: Beijing Guoshuang Technology Co.,Ltd. Address before: 100086 Cuigong Hotel, 76 Zhichun Road, Shuangyushu District, Haidian District, Beijing Applicant before: Beijing Guoshuang Technology Co.,Ltd. |
|
| GR01 | Patent grant | ||
| GR01 | Patent grant |