CN108076032B - Abnormal behavior user identification method and device - Google Patents

Abstract

Embodiments of the present invention provide a method and device for identifying abnormal behavior users. The method includes: acquiring status information of a current network, where the status information includes: a network-wide rate, a network element rate, and a service flow value; state information, preset time interval t and observation time i, determine whether there are users with abnormal behavior in the current network; if there are users with abnormal behavior in the current network, obtain the session record information of the user to be identified and the user terminal to be identified. information; identify the abnormal behavior user according to the session record information and the user terminal information. The apparatus performs the above-described method. The abnormal behavior user identification method and device provided by the embodiments of the present invention ensure the stability of the current network rate by judging whether there are abnormal behavior users in the current network and identifying the abnormal behavior users.

Description

A kind of abnormal behavior user identification method and device

technical field

Embodiments of the present invention relate to the field of mobile communication technologies, and in particular, to a method and device for identifying abnormal behavior users.

Background technique

With the development of mobile communication technology, more and more people obtain information through the Internet to meet the needs of daily study and work.

However, at the same time, some behaviors related to online information security, such as stealing accounts, posting malicious links, defrauding Internet users' money, etc., also occur. Such behaviors are collectively referred to as "abnormal user behaviors". These abnormal user behaviors occupy a large amount of limited space for a long time. Network resources greatly affect the normal user's Internet experience, resulting in slow Internet access or inability for users to access the Internet. The existing method to solve this problem is mainly through the user's complaint. The network environment is optimized, but users with abnormal behavior cannot be identified, and the problem of slow Internet access for normal users cannot be solved from the source.

Therefore, how to effectively identify users with abnormal behavior has become an urgent problem to be solved.

SUMMARY OF THE INVENTION

In view of the problems existing in the prior art, embodiments of the present invention provide a method and device for identifying abnormal behavior users.

On the one hand, an embodiment of the present invention provides a method for identifying a user with abnormal behavior, including:

Acquire status information of the current network, where the status information includes: the rate of the entire network, the rate of the network element, and the service flow value;

According to the state information of the current network, the preset time interval t and the observation time i, determine whether there are abnormal users in the current network;

If there is a user with abnormal behavior in the current network, acquiring the session record information of the user to be identified and the terminal information of the user to be identified;

Identify the user with abnormal behavior according to the session record information and the user terminal information.

On the other hand, an embodiment of the present invention provides an abnormal behavior user identification device, including:

a network information acquisition unit, configured to acquire state information of the current network, where the state information includes: a network-wide rate, a network element rate and a service flow value;

a judging unit, configured to judge whether there are abnormal users in the current network according to the state information of the current network, the preset time interval t and the observation time i;

a user information acquisition unit, configured to acquire the session record information of the user to be identified and the terminal information of the user to be identified if there is a user with abnormal behavior in the current network;

An identification unit, configured to identify the abnormal behavior user according to the session record information and the user terminal information.

The abnormal behavior user identification method and device provided by the embodiments of the present invention ensure the stability of the current network rate by judging whether there are abnormal behavior users in the current network and identifying the abnormal behavior users.

Description of drawings

In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the accompanying drawings that need to be used in the description of the embodiments or the prior art. Obviously, the accompanying drawings in the following description These are some embodiments of the present invention. For those of ordinary skill in the art, other drawings can also be obtained according to these drawings without creative efforts.

1 is a schematic flowchart of a method for identifying a user with abnormal behavior according to an embodiment of the present invention;

2 is a schematic flowchart of a method for identifying a user with abnormal behavior according to another embodiment of the present invention;

3 is a schematic structural diagram of an abnormal behavior user identification device according to an embodiment of the present invention;

FIG. 4 is a schematic diagram of a physical structure of an apparatus according to an embodiment of the present invention.

Detailed ways

In order to make the purposes, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments These are some embodiments of the present invention, but not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative efforts shall fall within the protection scope of the present invention.

FIG. 1 is a schematic flowchart of a method for identifying a user with abnormal behavior according to an embodiment of the present invention. As shown in FIG. 1 , a method for identifying a user with abnormal behavior provided by the present embodiment includes the following steps:

S1: Acquire status information of the current network, where the status information includes: a network-wide rate, a network element rate, and a service flow value.

Specifically, the apparatus acquires state information of the current network, where the state information includes: a network-wide rate, a network element rate, and a service flow value. It should be noted that: the current network status information may include the entire network rate, network element rate and service flow value, but is not limited to the above-mentioned overall network rate, network element rate and service flow value.

S2: According to the state information of the current network, the preset time interval t and the observation time i, determine whether there are users with abnormal behaviors in the current network.

Specifically, the device determines whether there are users with abnormal behaviors in the current network according to the state information of the current network, the preset time interval t and the observation time i. It should be noted that the preset time interval t and the observation time i can be set independently according to the actual situation. For example, the preset time interval t can be set to 1 hour, which can be understood as: the device performs the abnormal behavior user identification every 1 hour. method once, and identify the user behavior to be selected; the smaller the value set by the preset time interval t, the higher the frequency of identifying user behavior The lower the frequency of identification, the observation time i can be arbitrarily set to one or more times between the start time and the end time corresponding to the preset time interval t, for example: when the preset time interval t is set to 1 hour, if the The current time of this method is 17:00, the start time corresponds to 17:00, the end time corresponds to 18:00, and the observation time i can be any one or several times from 17:00 to 18:00. The acquisition time of the whole network rate or network element rate or service flow value.

S3: If there is a user with abnormal behavior in the current network, acquire the session record information of the user to be identified and the terminal information of the user to be identified.

Specifically, the apparatus acquires the session record information of the to-be-identified user and the to-be-identified user terminal information if it learns that there is a user with abnormal behavior in the current network. It should be noted that the user session record information may include but is not limited to: access record information to the network domain name, session duration, source TCP/UDP port, destination TCP/UDP port, etc. The user terminal information may include but not limited to: The brand and model of the mobile phone terminal used, etc.

S4: Identify the abnormal behavior user according to the session record information and the user terminal information.

Specifically, the apparatus identifies the abnormal behavior user according to the session record information and the user terminal information. It should be noted that the identification of the user with abnormal behavior can be realized according to the number of visits to a specific domain name in the session record information, the brand and model of the mobile terminal in the user terminal information, the mobile phone number used, and the location of the mobile terminal. .

The abnormal behavior user identification method provided by the embodiment of the present invention ensures the stability of the current network rate by judging whether there is an abnormal behavior user in the current network, and identifying the abnormal behavior user.

On the basis of the above-mentioned embodiment, according to the state information of the current network, the preset time interval t and the observation time i, judging whether there are users with abnormal behavior in the current network, including:

According to the entire network rate of the current network, the preset time interval t and the observation time i, it is determined whether the entire network rate of the current network has decreased.

计算出预设时间间隔1小时内全网速率的平均值

其中V_Ai是当前网络的状态信息中的全网速率，再根据公式：

计算出当前网络的全网速率下降百分比P_A，再根据公式：

判断出当前网络的全网速率是否处于下降状态(即当P_A≥5％，表示全网速率有下降；当P_A＜5％，表示全网速率未下降)，其中的5％为预设全网速率百分比，可以根据实际情况自主设置，这里的5％是一种可选的方案，本发明实施例对此不做具体的限定。Specifically, the apparatus determines whether the entire network rate of the current network decreases according to the current network-wide rate, the preset time interval t and the observation time i. It should be noted that: the basis for judging whether the speed of the entire network has dropped may be the percentage of drop in the speed of the entire network of the current network. Continuing to refer to the above-mentioned implementation, the following examples are described: when the preset time interval t is set to 1 hour, if the current time for executing the method is is 17:00, then the start time corresponds to 17:00, and the end time corresponds to 18:00. Assuming that the observation time i is 17:10, 17:25, and 17:50, then the number of observations n is 3, which can be According to the formula:

Calculate the average rate of the entire network within 1 hour of the preset time interval

Among them, V _Ai is the entire network rate in the current network status information, and then according to the formula:

Calculate the percentage P _A of the current network rate drop of the entire network, and then according to the formula:

Determine whether the current network speed of the entire network is in a state of decline (that is, when P _A ≥ 5%, it means that the speed of the whole network has dropped; when P _A <5%, it means that the speed of the whole network has not dropped), of which 5% is preset The rate percentage of the entire network can be set independently according to the actual situation, and the 5% here is an optional solution, which is not specifically limited in this embodiment of the present invention.

If it is determined that the entire network rate of the current network is in a declining state, it is determined whether the network element rate of the current network has decreased.

计算出预设时间间隔1小时内网元速率的平均值

其中V_Bi是当前网络的状态信息中的网元速率，再根据公式：

计算出当前网络的网元速率下降百分比P_B，再根据公式：

判断出当前网络的网元速率是否处于下降状态，其中的10％为预设网元速率百分比，可以根据实际情况自主设置，这里的10％是一种可选的方案，本发明实施例对此不做具体的限定。Specifically, if the device determines that the network-wide rate of the current network is in a declining state, the device determines whether the network element rate of the current network has decreased. If it is determined that the network-wide rate of the current network is in a state of not decreasing, it can be considered that there are no abnormal behavior users in the current network. It should be noted that the basis for judging whether the network element rate has dropped can be the percentage of the network element rate drop of the current network. Continuing to refer to the above implementation example, the following is an example: the number of observations n is 3 times, which can be based on the formula:

Calculate the average rate of network elements within a preset time interval of 1 hour

Where V _Bi is the network element rate in the current network state information, and then according to the formula:

Calculate the NE rate drop percentage P _B of the current network, and then follow the formula:

It is judged whether the network element rate of the current network is in a declining state, and 10% of which is the preset network element rate percentage, which can be set independently according to the actual situation. The 10% here is an optional solution, and this embodiment of the present invention No specific restrictions are made.

If it is determined that the network element rate of the current network is in a declining state, the first m service flow values in the service flow value are selected as the candidate service flow value according to the size of the service flow value.

Specifically, if the device determines that the network element rate of the current network is in a declining state, it selects the first m service flow values in the service flow value as the candidate service flow value according to the size of the service flow value. If the device determines that the network element rate of the current network is in a state of not decreasing, it can be considered that there is no abnormal behavior user in the current network. The value of m can be set independently according to the actual situation, which is not specifically limited here. In this embodiment, the value of the candidate service traffic obtained by m=10 is listed as shown in Table 1:

Table 1 is the top 10 business flow values that can be used as candidate business flow values. Table 1

business Traffic (MB) proportion Rate (kbps) 360 Security Guard 3687 14% 283 Fetion 1090 4% 198 NetEase 570 2% 108 ICBC 553 2% 93 QQ space 370 1% 479 Tencent.com 284 1% 591 UC Browse 151 1% 480 Sina 148 1% 503 Baidu 110 0% 397 Apple official website 77 0% 470 RNC overall 25598 100% 278

According to the preset time interval t and the traffic value of the service to be selected, the rate of the service to be selected corresponding to the service to be selected is calculated.

计算出待选业务速率V_ij，其中i为所述观察时间、j为第j个业务、M_ij为待选业务流量值。Specifically, the apparatus calculates the service rate to be selected corresponding to the service to be selected according to the preset time interval t and the flow value of the service to be selected. An example is as follows: According to the formula:

The rate V _ij of the service to be selected is calculated, where i is the observation time, j is the jth service, and Mi _ij is the flow value of the service to be selected.

It is judged whether the rate of the candidate service of the current network decreases.

计算出待选业务速率的平均值

可以再根据公式：

判断所述当前网络的待选业务速率是否为下降状态判断所述当前网络的待选业务速率是否为下降状态。Specifically, the apparatus judges whether the rate of the candidate service of the current network decreases. According to the formula:

Calculate the average value of the service rate to be selected

According to the formula:

It is judged whether the service rate to be selected of the current network is in a declining state.

If it is determined that the service rate to be selected in the current network is in a declining state, it is determined that there are users with abnormal behaviors in the current network.

Specifically, if the device determines that the service rate to be selected in the current network is in a declining state, the device determines that there are users with abnormal behaviors in the current network. If it is determined that the service rate to be selected in the current network is in a state of not decreasing, it can be considered that there is no abnormal behavior user in the current network.

The abnormal behavior user identification method provided by the embodiment of the present invention can accurately identify whether there are abnormal behavior users in the current network by judging whether the current network speed of the entire network, the network element rate and the rate of the service to be selected have decreased.

On the basis of the foregoing embodiment, determining whether the entire network rate of the current network has decreased according to the current network-wide rate, the preset time interval t and the observation time i, including:

According to the preset time interval t and the observation time i, the number of observations n in the preset time interval t is obtained, wherein the observation time i is located at the start time and the end time corresponding to the preset time interval t between.

Specifically, the device obtains the number of observations n in the preset time interval t according to the preset time interval t and the observation time i, where the observation time i is located at the start corresponding to the preset time interval t time and the end time. It has been described in the above-mentioned embodiments, and will not be repeated here.

Calculate the average rate of the entire network within the preset time interval t according to the number of observations n and the current network-wide rate of the network.

Specifically, the apparatus calculates the average rate of the entire network within the preset time interval t according to the number of observations n and the current network-wide rate of the network. It has been described in the above-mentioned embodiments, and will not be repeated here.

According to the average rate of the entire network and the overall network rate of the current network, the drop percentage of the overall network rate of the current network is calculated.

Specifically, the apparatus calculates the percentage reduction of the entire network rate of the current network according to the average rate of the entire network rate and the entire network rate of the current network. It has been described in the above-mentioned embodiments, and will not be repeated here.

If the drop percentage of the whole network rate of the current network is greater than or equal to the preset whole network speed percentage, it is determined that the whole network speed of the current network is in a drop state.

Specifically, the apparatus determines that the current network-wide rate of the current network is in a reduced state if the percentage of decrease in the overall network rate of the current network is greater than or equal to a preset rate of the entire network. It has been described in the above-mentioned embodiments, and will not be repeated here.

The method for identifying users with abnormal behavior provided by the embodiment of the present invention ensures the accuracy of judging the state of the entire network rate drop by calculating the current network-wide rate drop percentage.

On the basis of the foregoing embodiment, determining whether the network element rate of the current network decreases, including:

According to the number of observations n and the network element rate of the current network, an average value of the network element rate within the preset time interval t is calculated.

Specifically, the apparatus calculates the average value of the network element rate within the preset time interval t according to the observation times n and the network element rate of the current network. It has been described in the above-mentioned embodiments, and will not be repeated here.

According to the average value of the network element rates and the network element rate of the current network, the percentage reduction of the network element rate of the current network is calculated.

Specifically, the apparatus calculates the percentage drop of the network element rate of the current network according to the average value of the network element rate and the network element rate of the current network. It has been described in the above-mentioned embodiments, and will not be repeated here.

If the drop percentage of the network element rate of the current network is greater than or equal to the preset network element rate percentage, it is determined that the network element rate of the current network is in a drop state.

Specifically, the apparatus determines that the network element rate of the current network is in a declining state if the device learns that the network element rate drop percentage of the current network is greater than or equal to a preset network element rate percentage. It has been described in the above-mentioned embodiments, and will not be repeated here.

The abnormal behavior user identification method provided by the embodiment of the present invention ensures the accuracy of judging the state of network element rate reduction by calculating the rate drop percentage of the network element in the current network.

On the basis of the foregoing embodiment, the judging whether the rate of the service to be selected in the current network decreases, including:

According to the service rate to be selected and the number m of traffic of the service to be selected, the average value of the service rate to be selected is calculated.

Specifically, the apparatus calculates the average value of the service rates to be selected according to the service rate to be selected and the number m of traffic of the service to be selected. It has been described in the above-mentioned embodiments, and will not be repeated here.

所述待选业务速率V_ij和所述网元速率的平均值

若通过公式

计算的结果为1，则判断所述当前网络的待选业务速率为下降状态。According to the average value of the candidate service rates

The average value of the candidate service rate V _ij and the network element rate

If by formula

If the calculation result is 1, it is judged that the service rate of the current network to be selected is in a declining state.

所述待选业务速率V_ij和所述网元速率的平均值

若通过公式

计算的结果为1，则判断所述当前网络的待选业务速率为下降状态。已在上述实施例中说明，此处不再赘述。Specifically, the device according to the average value of the service rate to be selected

The average value of the candidate service rate V _ij and the network element rate

If by formula

If the calculation result is 1, it is judged that the service rate of the current network to be selected is in a declining state. It has been described in the above-mentioned embodiments, and will not be repeated here.

The abnormal behavior user identification method provided by the embodiment of the present invention ensures the accuracy of judging that the service rate to be selected is in a declining state according to the calculated average value of the service rate to be selected and the rate of the network element.

On the basis of the foregoing embodiment, identifying the user with abnormal behavior according to the session record information and the user terminal information includes:

According to the number of visits to the specific domain name in the session record information, the to-be-identified user whose number of visits to the specific domain name is greater than the first threshold of the number of visits is identified as an abnormal user.

Specifically, FIG. 2 is a schematic flowchart of a method for identifying a user with abnormal behavior according to another embodiment of the present invention. As shown in FIG. 2 , according to the number of visits to the specific domain name in the session record information, the device determines that the number of visits to the specific domain name is greater than the number of visits to the specific domain name in the session record information. The to-be-identified user with a threshold of access times is identified as an abnormal user. The threshold of the first number of visits can be set independently according to the actual situation, which is not limited here. An example is as follows: the number of users to be identified is 1000, the first access threshold is 50 times, and 40 of the users to be identified have a specific domain name whose access times are greater than the first access threshold of 50 times, the 40 users to be identified are identified as abnormal user.

The to-be-identified user whose number of visits to the specific domain name is less than the first threshold of the number of visits is taken as the first to-be-identified user.

Specifically, the device takes the user to be identified whose number of visits to the specific domain name is less than the threshold of the first number of visits as the first user to be identified. Continuing to refer to the above-mentioned embodiment, an example is described as follows: the above-mentioned 960 (1000-40=960) to-be-identified users are taken as the first to-be-identified users.

Extracting the mobile phone number of the first user to be identified, if the number of visits to the specific domain name by the same mobile phone number is greater than the second threshold of the number of visits, the first user to be identified is identified as an abnormal user, wherein the second The access times threshold is smaller than the first access times threshold.

Specifically, the device extracts the mobile phone number of the first user to be identified, and if the number of visits to the specific domain name by the same mobile phone number is greater than the second threshold of the number of visits, the device identifies the first user to be identified as an abnormal user, wherein, The second access times threshold is smaller than the first access times threshold. The threshold for the second number of visits can be set independently according to the actual situation, which is not limited here. Continuing to refer to the above-mentioned embodiment, an example is described as follows: the number of first users to be identified is 960, the second threshold for the number of visits is 40, and the number of visits to a specific domain name by the same mobile phone number in the first user to be identified is greater than the second threshold of 40 visits The next 60 first users to be identified are identified as abnormal users.

The first to-be-identified user whose number of visits to the specific domain name by the same mobile phone number is less than the second threshold of the number of visits is taken as the second to-be-identified user.

Specifically, the device uses the first user to be identified whose number of visits to the specific domain name by the same mobile phone number is less than the second threshold of the number of visits as the second user to be identified. An example is as follows: the first to-be-identified user is 960, and 900 (960-60) first to-be-identified users are used as the second to-be-identified users.

The mobile phone terminal information of the second user to be identified is extracted, where the mobile phone terminal information includes: the manufacturer and model of the mobile phone terminal.

Specifically, the apparatus extracts the mobile phone terminal information of the second user to be identified, and the mobile phone terminal information may include but is not limited to: the manufacturer and model of the mobile phone terminal.

If the number of visits to the specific domain name by the mobile terminal of the same manufacturer and model of the mobile phone terminal is greater than the third threshold of the number of visits, the second to-be-identified user is identified as an abnormal user, wherein the third number of visits The threshold is smaller than the second access times threshold.

Specifically, if the device learns that the number of visits to the specific domain name by the mobile terminal of the same manufacturer and model of the mobile terminal is greater than the third threshold of the number of visits, the device identifies the second to-be-identified user as an abnormal user, wherein the The third access times threshold is smaller than the second access times threshold. The third access times threshold can be set independently according to the actual situation, which is not limited here. Continuing to refer to the above embodiment, an example is described as follows: the number of the second to-be-identified users is 900, and the third threshold of access times is 30 times. The 20 second to-be-identified users whose number of visits to the specific domain name is greater than the third threshold of 30 visits are identified as abnormal users.

The second to-be-identified user whose number of visits to the specific domain name by the mobile phone terminal of the same manufacturer and model of the mobile phone terminal is less than the third threshold of the number of visits is taken as the third to-be-identified user.

Specifically, the device uses the second user to be identified whose number of visits to the specific domain name by the mobile terminal of the same manufacturer and model of the mobile terminal is less than a third threshold of the number of visits as the third user to be identified. An example is as follows: the number of the second to-be-identified users is 900, and 880 (900-20) second to-be-identified users are used as the third to-be-identified users.

Extract the location information of the mobile phone terminal of the third user to be identified, and if the displacement change generated by the position of the mobile phone terminal within the preset time interval t is less than a preset distance threshold, the third user to be identified Identifies as an abnormal user.

Specifically, the device extracts the position information of the mobile phone terminal of the third user to be identified, and if the displacement change of the position of the mobile phone terminal within the preset time interval t is less than a preset distance threshold, the third 3. The user to be identified is identified as an abnormal user. The preset distance threshold can be set independently according to the actual situation, which is not limited here. Continuing to refer to the above-mentioned embodiment, an example is described as follows: the number of the third to-be-identified users is 880, the preset distance threshold is 200 meters, and the displacement of the position of the mobile phone terminal in the third to-be-identified user within the preset time interval t is calculated. The 10 third to-be-identified users whose variation is less than the preset distance threshold of 200 meters are identified as abnormal users. 870 (880-10) third to-be-identified users whose position of the mobile phone terminal in the third to-be-identified user is generated within the preset time interval t are identified as normal users with an amount of change greater than or equal to the preset distance threshold of 200 meters. .

The abnormal behavior user identification method provided by the embodiment of the present invention ensures the accuracy of the identification effect by successively identifying the abnormal behavior users.

The acquisition method of the flowchart of the abnormal behavior user identification method shown in Figure 2 can be obtained according to the following steps:

R1: User session record information to be identified, and key features are extracted as sample library factors. Independent features that have no effect on other features are regarded as a sample library factor, and multiple features that affect each other and work together are combined into a sample library factor. Thereby, a sample library containing normal users and abnormal user online behavior sessions is established.

R2: Based on the sample library factor in step R1, randomly select a certain number of objects, construct a training data set, and generate the flowchart of the abnormal behavior user identification method shown in Figure 2 through training and pruning. The detailed structure and algorithm of the flowchart of the user identification method for identifying abnormal behaviors are as follows:

The decision tree algorithm adopts the CART (Classification and Regression Trees) algorithm, that is, the classification and regression tree algorithm.

The CART algorithm mainly includes two steps: (1) recursively divide the samples to build a tree, and (2) use the verification data for pruning.

The recursion of step (1) establishes a binary tree, where x ₁ , x ₂ , . . . , x _n represent n attributes of a single sample, and y represents the category to which they belong. The CART algorithm recursively divides the n-dimensional space into non-overlapping rectangles. The division steps are roughly as follows:

(1) Select an independent variable x _i , and then select a value v _i of x _i , and v _i divides the n-dimensional space into two parts, all samples in one part satisfy x _i ≤υ _i , and all samples in the other part satisfy x _i >υ _i , there are only two values of the attribute value for discrete variables, that is, it is equal to the value or not equal to the value. The continuous variables also need to be discretized first. The abnormal user online behavior characteristics of this proposal belong to continuous variables.

(2) Recursive processing, re-select an attribute according to step (1) and continue to divide the two parts obtained above until the entire n-dimensional space is divided.

In the dividing process, for a variable attribute, its dividing point is the midpoint of a pair of continuous variable attribute values. Assuming that a set of m samples has m consecutive values for an attribute, then there will be m-1 split points, each split point is the mean of two adjacent consecutive values. The division of each attribute is sorted by the amount of impurity that can be reduced, and the reduction of impurity is defined as the sum of the impurity before division minus the ratio of the impurity division of each node after division. The Gini indicator is commonly used in the impurity measurement method. The Gini value is mainly to measure the impurity of the data division or training data set K. The Gini value is tested on the branch node. If a certain purity is satisfied, it is divided into the left subtree, otherwise it is divided into the right subtree. tree, and finally generate a binary decision tree. The smaller the Gini value, the higher the "purity" of the sample. Assuming that a sample shares class Z, and the probability of belonging to class i is p _i , then the Gini impurity of a node K can be defined as the following formula:

When Gini(K)=0, all samples belong to the same class, and when all classes appear in nodes with equal probability, Gini(K) is maximized,

In the actual recursive division process, if all samples of the current node do not belong to the same class or there is only one sample left, then this node is a non-leaf node, so it is necessary to try each attribute of the sample and the corresponding splitting point for each attribute, Try to find a partition with the largest impurity variable, and the subtree divided by this attribute is the optimal branch.

Step (2) The CART algorithm adopts post-pruning. This proposal adopts the cost-complexity pruning method for post-pruning: r(t) is the error rate of node t, and p(t) is the proportion of the data on node t to all the data. ratio, if the node is pruned, R(t) is the error cost of node t, then

R(t)=r(t)×p(t) (9)

是子树中包含的叶子节点个数，由公式(9)，对于分类回归树中的每一个非叶子节点的表面误差率增益值α，有If the node is not pruned, R(T _t ) is the error cost of the subtree T _t , which is equal to the sum of the error costs of all leaf nodes on the subtree T _t ;

is the number of leaf nodes contained in the subtree. According to formula (9), for the surface error rate gain value α of each non-leaf node in the classification and regression tree, we have

FIG. 3 is a schematic structural diagram of a user identification device for abnormal behavior according to an embodiment of the present invention. As shown in FIG. 3 , this embodiment provides a user identification device for abnormal behavior, including a network information acquisition unit 1, a judgment unit 2, and a user information acquisition unit 3 and identification unit 4, where:

The network information acquisition unit 1 is used to acquire the state information of the current network, the state information includes: the whole network rate, the network element rate and the service flow value; the judgment unit 2 is used to obtain the state information of the current network according to the preset time interval. t and observation time i, to judge whether there are users with abnormal behavior in the current network; the user information acquisition unit 3 is used to obtain the user session record information to be identified and the user terminal information to be identified if there are users with abnormal behavior in the current network ; The identification unit 4 is configured to identify the abnormal behavior user according to the session record information and the user terminal information.

Specifically, the network information acquisition unit 1 is used to acquire the state information of the current network, the state information includes: the whole network rate, the network element rate and the service flow value. The network information acquisition unit 1 sends the state information to the judgment unit 2, and judges the The unit 2 is used to judge whether there are abnormal users in the current network according to the state information of the current network, the preset time interval t and the observation time i, and the judgment unit 2 sends the judgment result of the abnormal users to the user information acquisition unit 3. The user information acquisition unit 3 is configured to acquire the session record information of the user to be identified and the user terminal information to be identified if there is a user with abnormal behavior in the current network, and the user information acquisition unit 3 sends the session record information and user terminal information. The identification unit 4 is configured to identify the abnormal behavior user according to the session record information and the user terminal information.

The abnormal behavior user identification device provided by the embodiment of the present invention ensures the stability of the current network rate by judging whether there are abnormal behavior users in the current network and identifying the abnormal behavior users.

On the basis of the above embodiment, the judging unit 2 is used for:

According to the whole network rate of the current network, the preset time interval t and the observation time i, it is judged whether the whole network rate of the current network has decreased; Whether the network element rate of the current network has declined; if it is judged that the network element rate of the current network is in a declining state, then according to the size of the service flow value, the first m service flow values in the service flow value are selected as the waiting state. selecting a service flow value; according to the preset time interval t and the candidate service flow value, calculate the candidate service rate corresponding to the candidate service; determine whether the candidate service rate of the current network decreases; if It is determined that the service rate to be selected in the current network is in a declining state, and it is determined that there are users with abnormal behaviors in the current network.

Specifically, the judging unit 2 is used for judging whether the entire network rate of the current network has decreased according to the current network-wide rate, the preset time interval t and the observation time i; the judging unit 2 is used for if Judging that the entire network rate of the current network is in a declining state, then judging whether the network element rate of the current network is declining; the judging unit 2 is configured to determine that the network element rate of the current network is in a declining state, then According to the size of the service flow value, the first m service flow values in the service flow value are selected as the service flow value to be selected; the judging unit 2 is used for selecting the service flow value according to the preset time interval t and the service to be selected flow value, calculate the service rate to be selected corresponding to the service to be selected; the judgment unit 2 is used to judge whether the rate of the service to be selected of the current network has decreased; the judgment unit 2 is used to know the current If the service rate of the network to be selected is in a declining state, it is determined that there are users with abnormal behavior in the current network.

The abnormal behavior user identification device provided by the embodiment of the present invention can accurately identify whether there are abnormal behavior users in the current network by judging whether the current network speed of the entire network, the network element rate and the rate of the service to be selected have decreased.

On the basis of the above embodiment, the judging unit 2 is also used for:

所述待选业务速率V_ij和所述网元速率的平均值

若通过公式

计算的结果为1，则判断所述当前网络的待选业务速率为下降状态。Calculate the average value of the service rates to be selected according to the service rates to be selected and the number m of service flows to be selected; and calculate the average value of the service rates to be selected according to the average service rates

The average value of the service rate V _ij to be selected and the rate of the network element

If by formula

If the calculated result is 1, it is judged that the service rate of the current network to be selected is in a declining state.

所述待选业务速率V_ij和所述网元速率的平均值

若通过公式

计算的结果为1，则判断所述当前网络的待选业务速率为下降状态。Specifically, the judgment unit 2 is further configured to calculate the average value of the service rates to be selected according to the service rate to be selected and the number m of service flows to be selected; the judgment unit 2 is further configured to calculate the average value of the service rates to be selected according to the service rate to be selected. average value

The average value of the candidate service rate V _ij and the network element rate

If by formula

If the calculation result is 1, it is judged that the service rate of the current network to be selected is in a declining state.

The abnormal behavior user identification device provided by the embodiment of the present invention ensures the accuracy of judging that the service rate to be selected is in a declining state according to the calculated average value of the service rate to be selected and the network element rate.

On the basis of the above embodiment, the identification unit 4 is used for:

According to the number of visits to the specific domain name in the session record information, the to-be-identified user whose number of visits to the specific domain name is greater than the first threshold of the number of visits is identified as an abnormal user; the number of visits to the specific domain name is less than the threshold of the first number of visits. The user to be identified is regarded as the first user to be identified; the mobile phone number of the first user to be identified is extracted, and if the number of visits to the specific domain name by the same mobile phone number is greater than the second threshold of the number of visits, the first user to be identified will be Identifying users as abnormal users, wherein the second access times threshold is less than the first access times threshold; the first user to be identified whose access times of the same mobile phone number to the specific domain name is less than the second access times threshold As the second to-be-identified user; extract the mobile terminal information of the second to-be-identified user, the mobile terminal information includes: mobile terminal manufacturer and model; if the mobile terminal of the same mobile terminal manufacturer and model If the number of visits to a specific domain name is greater than the third threshold of the number of visits, the second user to be identified is identified as an abnormal user, wherein the threshold of the third number of visits is less than the threshold of the second number of visits; the same as the mobile phone terminal manufacturer The second to-be-identified user whose number of visits to the specific domain name by the mobile phone terminal of the same model is less than the third threshold of the number of visits is taken as the third to-be-identified user; the location information of the mobile terminal of the third to-be-identified user is extracted, if If the displacement change of the position of the mobile phone terminal within the preset time interval t is smaller than the preset distance threshold, the third user to be identified is identified as an abnormal user.

Specifically, the identifying unit 4 is configured to identify the user to be identified whose number of visits to the specific domain name is greater than the first threshold of the number of visits as an abnormal user according to the number of visits to the specific domain name in the session record information; the identifying unit 4 is configured to The user to be identified whose number of visits to the specific domain name is less than the first number of visits threshold is used as the first user to be identified; the identification unit 4 is used to extract the mobile phone number of the first user to be identified, if the same mobile phone number If the number of visits to a specific domain name is greater than the second threshold of the number of visits, the first user to be identified is identified as an abnormal user, wherein the threshold of the second number of visits is less than the threshold of the first number of visits; the identifying unit 4 is used to identify the same The first to-be-identified user whose number of visits to the specific domain name by the mobile phone number is less than the second threshold of the number of visits is regarded as the second to-be-identified user; the identification unit 4 is used to extract the mobile phone terminal information of the second to-be-identified user, and the The mobile phone terminal information includes: the manufacturer and model of the mobile phone terminal; the identification unit 4 is configured to identify the second domain name if the number of visits to the specific domain name by the mobile terminal of the same mobile terminal manufacturer and model is greater than the third threshold of the number of visits. The user to be identified is identified as an abnormal user, wherein the third access times threshold is less than the second access times threshold; the identifying unit 4 is configured to compare the mobile phone terminals of the same manufacturer and model of the mobile phone terminal to the specific domain name. The second user to be identified whose number of visits is less than the threshold of the third number of visits is regarded as the third user to be identified; the identification unit 4 is used to extract the location information of the mobile phone terminal of the third user to be identified, if the location of the mobile phone terminal is in If the displacement variation generated within the preset time interval t is smaller than the preset distance threshold, the third user to be identified is identified as an abnormal user.

The abnormal behavior user identification device provided by the embodiment of the present invention ensures the accuracy of the identification effect by successively identifying the abnormal behavior users.

The abnormal behavior user identification device provided in this embodiment can be specifically used to execute the processing flow of the above method embodiments, and its functions are not repeated here, and reference may be made to the detailed description of the above method embodiments.

FIG. 4 is a schematic diagram of the physical structure of an apparatus provided by an embodiment of the present invention. As shown in FIG. 4 , the adjacent area optimization processing apparatus includes: a processor (processor) 401, a memory (memory) 402, and a bus 403;

The processor 401 and the memory 402 communicate with each other through the bus 403;

The processor 401 is configured to call the program instructions in the memory 402 to execute the methods provided by the above method embodiments, for example, including: the whole network rate, the network element rate and the service flow value; Status information, preset time interval t and observation time i, to determine whether there are users with abnormal behavior in the current network; if there are users with abnormal behavior in the current network, obtain the session record information of the user to be identified and the terminal information of the user to be identified ; Identify the abnormal behavior user according to the session record information and the user terminal information.

This embodiment discloses a computer program product, the computer program product includes a computer program stored on a non-transitory computer-readable storage medium, the computer program includes program instructions, and when the program instructions are executed by a computer, the computer program The methods provided by the above method embodiments can be implemented, for example, including: the whole network rate, the network element rate and the service flow value; according to the state information of the current network, the preset time interval t and the observation time i, determine the Whether there are users with abnormal behaviors on the network; if there are users with abnormal behaviors in the current network, obtain the session record information of the user to be identified and the user terminal information to be identified; Identify abnormal users.

This embodiment provides a non-transitory computer-readable storage medium, where the non-transitory computer-readable storage medium stores computer instructions, and the computer instructions cause the computer to execute the methods provided by the foregoing method embodiments, for example, including : whole network rate, network element rate and service flow value; according to the state information of the current network, preset time interval t and observation time i, determine whether there are abnormal users in the current network; if the current network has abnormal behavior If the user is a behavior user, the session record information of the user to be identified and the user terminal information to be identified are obtained; the abnormal behavior user is identified according to the session record information and the user terminal information.

Those of ordinary skill in the art can understand that all or part of the steps of implementing the above method embodiments can be completed by program instructions related to hardware, the aforementioned program can be stored in a computer-readable storage medium, and when the program is executed, execute It includes the steps of the above method embodiments; and the aforementioned storage medium includes: ROM, RAM, magnetic disk or optical disk and other media that can store program codes.

The above-described embodiments such as the abnormal behavior user identification device are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physically separated unit, that is, it can be located in one place, or it can be distributed over multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution in this embodiment. Those of ordinary skill in the art can understand and implement it without creative effort.

From the description of the above embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus a necessary general hardware platform, and certainly can also be implemented by hardware. Based on this understanding, the above-mentioned technical solutions can be embodied in the form of software products in essence or the parts that make contributions to the prior art, and the computer software products can be stored in computer-readable storage media, such as ROM/RAM, magnetic A disc, an optical disc, etc., includes several instructions for causing a computer device (which may be a personal computer, a server, or a network device, etc.) to perform the methods described in various embodiments or some parts of the embodiments.

Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the embodiments of the present invention, but not to limit them; although the embodiments of the present invention have been described in detail with reference to the foregoing embodiments, ordinary The skilled person should understand that it is still possible to modify the technical solutions described in the foregoing embodiments, or to perform equivalent replacements on some or all of the technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the present invention. The scope of the technical solutions of the embodiments of each embodiment.

Claims (2)

1. A method for identifying abnormal behavior users is characterized by comprising the following steps:

acquiring state information of a current network, wherein the state information comprises: the whole network rate, the network element rate and the service flow value;

judging whether the current network has abnormal behavior users or not according to the state information of the current network, a preset time interval t and an observation time i;

if the user with the abnormal behavior exists in the current network, acquiring session record information of the user to be identified and terminal information of the user to be identified;

according to the session record information and the user terminal information, identifying the abnormal behavior user;

the judging whether the current network has the user with the abnormal behavior according to the state information of the current network, the preset time interval t and the observation time i comprises the following steps:

judging whether the full-network rate of the current network is reduced or not according to the full-network rate of the current network, a preset time interval t and an observation time i;

if the whole network rate of the current network is judged to be in a descending state, judging whether the network element rate of the current network is descending;

if the network element speed of the current network is judged to be in a descending state, selecting the first m service flow values in the service flow values as service flow values to be selected according to the size of the service flow values;

calculating the rate of the service to be selected corresponding to the service to be selected according to the preset time interval t and the value of the traffic of the service to be selected;

judging whether the rate of the service to be selected of the current network is reduced or not;

if the rate of the service to be selected of the current network is judged to be in a descending state, judging that users with abnormal behaviors exist in the current network;

the judging whether the full-network rate of the current network is reduced or not according to the full-network rate of the current network, a preset time interval t and an observation time i comprises the following steps:

acquiring the observation times n in a preset time interval t according to the preset time interval t and observation time i, wherein the observation time i is positioned between the starting time and the ending time corresponding to the preset time interval t;

calculating the average value of the full network speed within the preset time interval t according to the observation times n and the full network speed of the current network;

calculating the whole network rate reduction percentage of the current network according to the average value of the whole network rate and the whole network rate of the current network;

if the whole network rate reduction percentage of the current network is greater than or equal to the preset whole network rate percentage, judging that the whole network rate of the current network is in a reduction state;

the determining whether the network element rate of the current network decreases includes:

calculating the average value of the network element speed in the preset time interval t according to the observation times n and the network element speed of the current network;

calculating the network element rate reduction percentage of the current network according to the average value of the network element rates and the network element rate of the current network;

if the network element rate reduction percentage of the current network is greater than or equal to the preset network element rate percentage, judging that the network element rate of the current network is in a reduction state;

the judging whether the rate of the service to be selected of the current network is reduced includes:

calculating the average value of the service rate to be selected according to the service rate to be selected and the number m of the service flow to be selected;

according to the average value of the service rate to be selected

The service rate V to be selected_ijAnd an average value of the network element rate

If passing through the formula

If the calculated result is 1, judging that the rate of the service to be selected of the current network is in a descending state, wherein j is the jth service;

the identifying the abnormal behavior user according to the session record information and the user terminal information comprises:

according to the number of times of specific domain name access in the session record information, identifying the user to be identified, of which the number of times of specific domain name access is greater than a first access number threshold value, as an abnormal user;

taking the user to be identified with the specific domain name access times smaller than a first access time threshold value as a first user to be identified;

extracting the mobile phone number of the first user to be identified, and identifying the first user to be identified as an abnormal user if the number of times of access to the specific domain name by the same mobile phone number is greater than a second access time threshold value, wherein the second access time threshold value is smaller than the first access time threshold value;

taking the first to-be-identified user with the same mobile phone number and the access frequency of the specific domain name smaller than a second access frequency threshold value as a second to-be-identified user;

extracting mobile phone terminal information of the second user to be identified, wherein the mobile phone terminal information comprises: the manufacturer and model of the mobile phone terminal;

if the access times of the mobile phone terminal with the same manufacturer and model of the mobile phone terminal to the specific domain name are larger than a third access time threshold, identifying the second user to be identified as an abnormal user, wherein the third access time threshold is smaller than the second access time threshold;

taking the second user to be identified, of which the access times of the mobile phone terminal with the same manufacturer and model of the mobile phone terminal to the specific domain name are smaller than a third access time threshold value, as a third user to be identified;

and extracting the position information of the mobile phone terminal of the third user to be identified, and identifying the third user to be identified as an abnormal user if the displacement variation generated by the position of the mobile phone terminal in the preset time interval t is smaller than a preset distance threshold.

2. An abnormal behavior user recognition apparatus, comprising:

a network information obtaining unit, configured to obtain status information of a current network, where the status information includes: the whole network rate, the network element rate and the service flow value;

the judging unit is used for judging whether the current network has abnormal behavior users or not according to the state information of the current network, a preset time interval t and an observation time i;

the user information acquisition unit is used for acquiring session record information of a user to be identified and information of the user terminal to be identified if the user with the abnormal behavior exists in the current network;

the identification unit is used for identifying the abnormal behavior user according to the session record information and the user terminal information;

the judgment unit is used for:

judging whether the full-network rate of the current network is reduced or not according to the full-network rate of the current network, a preset time interval t and an observation time i;

if the whole network rate of the current network is judged to be in a descending state, judging whether the network element rate of the current network is descending;

if the network element speed of the current network is judged to be in a descending state, selecting the first m service flow values in the service flow values as service flow values to be selected according to the size of the service flow values;

calculating the rate of the service to be selected corresponding to the service to be selected according to the preset time interval t and the value of the traffic of the service to be selected;

judging whether the rate of the service to be selected of the current network is reduced or not;

if the rate of the service to be selected of the current network is judged to be in a descending state, judging that users with abnormal behaviors exist in the current network;

the judging unit is further configured to:

acquiring the observation times n in a preset time interval t according to the preset time interval t and observation time i, wherein the observation time i is positioned between the starting time and the ending time corresponding to the preset time interval t;

calculating the average value of the full network speed within the preset time interval t according to the observation times n and the full network speed of the current network;

calculating the whole network rate reduction percentage of the current network according to the average value of the whole network rate and the whole network rate of the current network;

if the whole network rate reduction percentage of the current network is greater than or equal to the preset whole network rate percentage, judging that the whole network rate of the current network is in a reduction state;

the judging unit is further configured to:

calculating the average value of the network element speed in the preset time interval t according to the observation times n and the network element speed of the current network;

calculating the network element rate reduction percentage of the current network according to the average value of the network element rates and the network element rate of the current network;

if the network element rate reduction percentage of the current network is greater than or equal to the preset network element rate percentage, judging that the network element rate of the current network is in a reduction state;

the judging unit is further configured to:

calculating the average value of the service rate to be selected according to the service rate to be selected and the number m of the service flow to be selected;

according to the average value of the service rate to be selected

The service rate V to be selected_ijAnd an average value of the network element rate

If passing through the formula

If the calculated result is 1, judging that the rate of the service to be selected of the current network is in a descending state, wherein j is the jth service;

the identification unit is used for:

according to the number of times of specific domain name access in the session record information, identifying the user to be identified, of which the number of times of specific domain name access is greater than a first access number threshold value, as an abnormal user;

taking the user to be identified with the specific domain name access times smaller than a first access time threshold value as a first user to be identified;

extracting the mobile phone number of the first user to be identified, and identifying the first user to be identified as an abnormal user if the number of times of access to the specific domain name by the same mobile phone number is greater than a second access time threshold value, wherein the second access time threshold value is smaller than the first access time threshold value;

taking the first to-be-identified user with the same mobile phone number and the access frequency of the specific domain name smaller than a second access frequency threshold value as a second to-be-identified user;

extracting mobile phone terminal information of the second user to be identified, wherein the mobile phone terminal information comprises: the manufacturer and model of the mobile phone terminal;

if the access times of the mobile phone terminal with the same manufacturer and model of the mobile phone terminal to the specific domain name are larger than a third access time threshold, identifying the second user to be identified as an abnormal user, wherein the third access time threshold is smaller than the second access time threshold;

taking the second user to be identified, of which the access times of the mobile phone terminal with the same manufacturer and model of the mobile phone terminal to the specific domain name are smaller than a third access time threshold value, as a third user to be identified;

and extracting the position information of the mobile phone terminal of the third user to be identified, and identifying the third user to be identified as an abnormal user if the displacement variation generated by the position of the mobile phone terminal in the preset time interval t is smaller than a preset distance threshold.

Images