CN108156141A - A kind of real time data recognition methods, device and electronic equipment - Google Patents
A kind of real time data recognition methods, device and electronic equipment Download PDFInfo
- Publication number
- CN108156141A CN108156141A CN201711338766.0A CN201711338766A CN108156141A CN 108156141 A CN108156141 A CN 108156141A CN 201711338766 A CN201711338766 A CN 201711338766A CN 108156141 A CN108156141 A CN 108156141A
- Authority
- CN
- China
- Prior art keywords
- data
- tested
- server
- interaction
- real
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
Abstract
An embodiment of the present invention provides a kind of real time data recognition methods, device and electronic equipment, methods to include：The a plurality of data to be tested generated in terminal and server-side interactive process are obtained in real time, are the first data flow by the processing of a plurality of data to be tested；From a plurality of data to be tested in the first data flow, the target data to match with default feature is filtered out one by one, and is the second data flow by target data processing；The interaction data generated in real-time monitoring terminal and server-side interactive process; and the interaction data to match with the target data in the second data flow is identified in real time; the interaction data using default measure is handled, can timely be noted abnormalities or the interaction data there are risk.
Description
Technical field
The present invention relates to technical field of data processing, more particularly to a kind of real time data recognition methods, device and electronics
Equipment.
Background technology
With the high speed development of Internet technology, can all have between a large amount of terminal and server-side interact at any time, from
And generate a large amount of interaction data.In the interactive process of various businesses type, it is possible to which there are various malice or abnormal
Operational Visit or data interaction.For example, for a network voting selecting activity, a need can be used as server-side
The business that can be performed is interacted with terminal, a large number of users can be by various terminal equipment, for example, mobile phone, computer
Deng.By being interacted between server-side, completion ballot This move or operation, however in the business, in fact it could happen that malice is brushed
The behavior of ticket, so as to cause the harmful effect chosen to the network voting.So it is similar to above-mentioned malice brush ticket etc. to cope with
Abnormal conditions are needed in the interactive process of various businesses type, carry out the prison of risk to generated interaction data in real time
Control and detection, and then determine abnormal data in time and take corresponding treatment measures.
In the prior art, when the interaction data generated in real time is identified, some intrinsic can only generally be passed through
Feature, for example, by individual IP addresses, individual user's account etc. is used as blacklist, utilizes the blacklist and interaction data progress
Match, so as to identify data abnormal or there are risk.However, due to the progress of technology, some intrinsic ten partial volumes of feature
Easily it is modified, so as to evade in the prior art, the mode that interaction data to be detected is identified using blacklist so that no
It can timely note abnormalities or the interaction data there are risk.
Invention content
The embodiment of the present invention is designed to provide a kind of real time data recognition methods, device and electronic equipment, to realize
It notes abnormalities or the interaction data there are risk in time.Specific technical solution is as follows：
An embodiment of the present invention provides a kind of real time data recognition methods, applied to Distributed Computing Platform, including：
The a plurality of data to be tested generated in terminal and server-side interactive process are obtained in real time, by a plurality of number to be detected
It is the first data flow according to processing；
From a plurality of data to be tested in first data flow, the target to match with default feature is filtered out one by one
Data, and be the second data flow by target data processing, described preset is characterized as advising possessed by the data to be tested
The behavior pattern feature of rule property；
The interaction data generated in real-time monitoring terminal and the server-side interactive process, and identify in real time and described the
The interaction data that target data in two data flows matches handles the interaction data using default measure.
Optionally, the default feature includes：Behavioural characteristic and temporal aspect, the behavioural characteristic expression action or event
The sequence and interval time that state parameter during generation, the temporal aspect expression action or event occur.
Optionally, it is described it is real-time obtain a plurality of data to be tested generated in terminal and server-side interactive process, including：
The a plurality of interaction data generated in terminal and server-side interactive process is obtained in real time；
For each interaction data, extract one or more of interaction data preset field, by one or
Multiple preset fields form a data to be tested.
Optionally, it is described it is real-time obtain a plurality of data to be tested generated in terminal and server-side interactive process, including：
Obtain a plurality of data to be tested generated in terminal and server-side interactive process in real time by message queue.
Optionally, it is described it is real-time obtain a plurality of data to be tested generated in terminal and server-side interactive process, will described in
A plurality of data to be tested processing is the first data flow, including：
When a plurality of data to be tested generated from multiple message queues, real-time acquisition terminal and server-side interactive process
When, a plurality of data to be tested that will respectively be obtained from the multiple message queue are uniformly processed as first data flow.
Optionally, described handle a plurality of data to be tested is the first data flow, including：
According to the sequencing of the generated time of a plurality of data to be tested, a plurality of data to be tested are arranged as
First data flow.
Optionally, the interaction data generated in the real-time monitoring terminal and the server-side interactive process, when going out again
During the interaction data now to match with the target data in second data flow, to the interaction data using default measure
It is handled, including：
For each target data in second data flow, each target data is cut to containing default core
The data segment of field, the default core field are to be directly used in the field for the default feature for characterizing the target data；
The data segment is preserved in the buffer, and the friendship generated in real-time monitoring terminal and the server-side interactive process
Mutual data；
When occurring interaction data that is identical with the data segment or matching in the interaction data again, to the interaction
Data are handled using default measure.
The embodiment of the present invention additionally provides a kind of real time data identification device, applied to Distributed Computing Platform, including：
Acquisition module, for obtaining a plurality of data to be tested generated in terminal and server-side interactive process in real time, by institute
It is the first data flow to state a plurality of data to be tested processing；
Matching module, for from a plurality of data to be tested in first data flow, filtering out one by one and default spy
Levy the target data that matches, and be the second data flow by target data processing, it is described it is default be characterized as it is described to be detected
Regular behavior pattern feature possessed by data；
Monitoring modular, for the interaction data generated in real-time monitoring terminal and the server-side interactive process, and in real time
It identifies the interaction data to match with the target data in second data flow, which is arranged using default
It applies and is handled.
Optionally, the default feature in the matching module includes：Behavioural characteristic and temporal aspect, the behavior are special
State parameter when expression action or event occur is levied, when sequence that the temporal aspect expression action or event occur and interval
Between.
Optionally, the acquisition module, is specifically used for：
The a plurality of interaction data generated in terminal and server-side interactive process is obtained in real time；For each interaction data,
One or more of interaction data preset field is extracted, one or more of preset fields are formed into a number to be detected
According to.
Optionally, the acquisition module, is specifically used for：
Obtain a plurality of data to be tested generated in terminal and server-side interactive process in real time by message queue.
Optionally, the acquisition module, is specifically used for：
When a plurality of data to be tested generated from multiple message queues, real-time acquisition terminal and server-side interactive process
When, a plurality of data to be tested that will respectively be obtained from the multiple message queue are uniformly processed as first data flow.
Optionally, the acquisition module, is specifically used for：
According to the sequencing of the generated time of a plurality of data to be tested, it is by a plurality of data to be tested processing
First data flow.
Optionally, the monitoring modular, is specifically used for：
For each target data in second data flow, each target data is cut to containing default core
The data segment of field, the default core field are to be directly used in the field for the default feature for characterizing the target data；
The data segment is preserved in the buffer, and the interaction data generated in real-time monitoring terminal and the server-side interactive process；
When occurring interaction data that is identical with the data segment or matching in the interaction data again, which is used
Default measure is handled.
The embodiment of the present invention additionally provides a kind of electronic equipment, total including processor, communication interface, memory and communication
Line, wherein, processor, communication interface, memory completes mutual communication by communication bus；
Memory, for storing computer program；
Processor during for performing the program stored on memory, realizes any of the above-described real time data identification
Method.
At the another aspect that the present invention is implemented, a kind of computer readable storage medium is additionally provided, it is described computer-readable
Instruction is stored in storage medium, when run on a computer so that computer performs any of the above-described real-time number
According to recognition methods.
At the another aspect that the present invention is implemented, the embodiment of the present invention additionally provides a kind of computer program production comprising instruction
Product, when run on a computer so that computer performs any of the above-described real time data recognition methods.
A kind of real time data recognition methods provided in an embodiment of the present invention, device and electronic equipment, by obtaining end in real time
The a plurality of data to be tested generated in end and server-side interactive process, and be the first data flow by the processing of a plurality of data to be tested；
From a plurality of data to be tested in the first data flow, the target data to match with default feature is filtered out one by one, and by institute
It is the second data flow to state target data processing；The interaction data generated in real-time monitoring terminal and server-side interactive process again, and
Identify the interaction data to match with the target data in the second data flow in real time, to the interaction data using default measure into
Row processing.It, can be to the feature of the behavior model reflected in data to be tested by presetting feature in the present invention is real-time
It is matched, so that it is determined that going out, there are the data to be tested of data risk or exception as target data, then pass through target data
The interaction data generated in real time is identified, exception or the interaction data there are risk can be timely identified, not need to
The monitoring of data is carried out using fixed blacklist, and since target data can also generate and update in real time, Ke Yijin
The accuracy and real-time that interaction data is identified in the raising of one step.Certainly, it implements any of the products of the present invention or method must
It is not necessarily required to reach all the above advantage simultaneously.
Description of the drawings
In order to illustrate more clearly about the embodiment of the present invention or technical scheme of the prior art, to embodiment or will show below
There is attached drawing needed in technology description to be briefly described.
Fig. 1 is a kind of flow chart of real time data recognition methods provided in an embodiment of the present invention；
Fig. 2 is another flow chart of real time data recognition methods provided in an embodiment of the present invention；
Fig. 3 is the structure chart of real time data identification device provided in an embodiment of the present invention；
Fig. 4 is the structure chart of electronic equipment provided in an embodiment of the present invention.
Specific embodiment
Below in conjunction with the attached drawing in the embodiment of the present invention, the technical solution in the embodiment of the present invention is described.
Referring to Fig. 1, Fig. 1 be real time data recognition methods provided in an embodiment of the present invention a kind of flow chart, applied to point
Cloth computing platform, including：
Step 101, a plurality of data to be tested generated in terminal and server-side interactive process are obtained in real time, it will be a plurality of to be checked
Measured data processing is the first data flow.
Distributed Computing Platform can have multiple stage computers or server, erect the data processing system of the clustering come
A large amount of pending data can be split, then distribute the data after fractionation to each computer or clothes by system
It is handled on business device, so as to realize the quick processing to mass data.It in embodiments of the present invention, can be with application distribution
Formula computing platform is realized to obtaining the real time monitoring and risk of the interaction data that are generated in terminal and server-side interactive process in real time
Identification.
Data to be tested can be that interaction data, example caused by a service interaction are carried out between terminal and server-side
Such as, user carries out sweepstake on primary line by terminal, and sweepstake can be as a data interactive service on the line, use
Family logs in the prize drawing page firstly the need of using terminal, then carries out lottery operation, and corresponding reward is got after completing prize drawing.Upper
It states in interactive process, various interaction datas can be generated between terminal and the server-side for performing sweepstake, for example, terminal is to clothes
Be engaged in end send logging request, the IP address described in terminal, terminal type, terminal log in prize drawing the page with carry out lottery operation it
Between the information such as time interval, can serve as data to be tested.
It can be by preset Information Granularity, to acquire and obtain data to be tested, for example, terminal-pair server-side each time
Request and server-side can be used as a data to be tested to interaction data caused by the response of the request, be stepped on as terminal is sent out
Record request, server-side respond for the logging request, and terminal completes register, and the interaction data of this process can be made
For a data to be tested.
Alternatively, terminal and server-side generated interaction data, Ke Yizuo in the interactive process of primary complete business
For a data to be tested, e.g., in the example drawn a lottery on above-mentioned line, the login that terminal sends the page from starting to server-side please
It asks, to getting corresponding reward.In the interactive process of entire operation flow, generated total data is to be detected as one
Data.
Again alternatively, terminal and server-side are in the interactive process of primary complete business, generated total data can be with
It is stored in presetting database in real time, such as MySQL databases.Specific data by certain rule by tables of data into
Row preserves, such as terminal type, the time that terminal transmission logs in, and terminal carries out the time of lottery operation and log in grasp with prize drawing
Time interval of work etc..One group of data preserved by certain rule can be preserved in data form per a line, in the data form
Data line, can also be used as a data to be tested.
Server-side has many terminals and is interacted with server-side in the business of execution, a plurality of to be checked so as to generate
Measured data.A plurality of data to be tested may be while generate, it is also possible to successively generate.Distributed Computing Platform can be real-time
Acquisition produced by a plurality of data to be tested, the mode specifically obtained can be server-side in real time to Distributed Computing Platform
Data to be tested or the data interaction between Distributed Computing Platform real-time monitoring terminal and server-side are sent, so as to
Obtain a plurality of data to be tested.
After a plurality of data to be tested produced by Distributed Computing Platform obtains, in order to make Distributed Calculation in subsequent step
Platform more steady can efficiently carry out the detection and identification of abnormal data risk, and preferably meet Distributed Calculation and put down
The operation characteristic of platform can be handled a plurality of data to be tested, such as a plurality of data to be tested to being obtained carry out
Arrangement and arrangement, so as to form real-time first data flow.Contain a plurality of data to be tested arranged in first data flow.
Step 102, from a plurality of data to be tested in the first data flow, filter out what is matched with default feature one by one
Target data, and be the second data flow by target data processing, it is default to be characterized as row regular possessed by data to be tested
For pattern feature.
After Distributed Computing Platform obtains the first data flow, can to every data to be tested in first data flow,
Being matched with default feature one by one.
Default feature refers to regular possessed by data to be tested, can reflect that terminal was being interacted with server-side
The feature of behavior pattern in journey.Behavior pattern refers to that terminal during being interacted with server-side, is sent out in chronological order
The concrete mode of raw various operations, action or event.
It can be accumulated by the concrete analysis to business model and by data of the business in early period implementation procedure
It is tired, behavior pattern and abnormal conditions of the normal users when carrying out service interaction by terminal and server-side can be analyzed
Under, for example, by Malware or program, malice brush ticket is carried out, is drawn a lottery when behaviors, terminal carries out service interaction with server-side
When behavior pattern.
Specifically, default feature can include：Behavioural characteristic and temporal aspect, behavioural characteristic expression action or event occur
When state parameter, the sequence and interval time that temporal aspect expression action or event occur.Action or event are terminal and clothes
Business end generated various operation responses when interacting, for example, sending logging request, the link in the click page, exiting and step on
Record etc..Action or event state parameter can be in the event of generation, the parameter information related with terminal or server-side, example
Whether the IP address of terminal, click and be unfolded to show in the page location or the page of the page when connecting in the page such as when logging in
Be shown with other information, draw a lottery in the page as clicked button when, whether which, which is unfolded to show prize drawing, illustrates information etc..
For example, on above-mentioned line in this business of sweepstake, normal users ask to log in prize drawing by sending first
The page, normal users generally stay for some time in the page, illustrate to be looked into and it is possible to click prize drawing in the page of drawing a lottery
It sees, then certain interval of time again, then carries out lottery operation, drawing outcomes can be checked after the completion of operation, and through after a period of time
The introduction of obtained reward is read, then gets corresponding reward again.Wherein, request is sent, the prize drawing page is logged in, clicks
Prize drawing explanation, lottery operation and check drawing outcomes can serve as specifically act or event.
However, in some cases, malice and high frequency time may be carried out by Malware or program in terminal
Prize drawing occupies Internet resources and damages interests of another.When Malware or program is used to carry out service interaction with server-side,
There may be differences for the behavior pattern of its behavior pattern and normal users, e.g., will not after sending the request login prize drawing page
Prize drawing explanation is clicked, draws a lottery immediately in very short time, gets then and immediately reward.
In this example embodiment, the prize drawing page-interval first time section-lottery operation-the second time interval of interval-neck is logged in
Reward is taken, can be as the temporal aspect in default feature, wherein first time threshold value and the second time threshold is time range,
It can be configured according to actual conditions, such as first time threshold value and the second time threshold can be 0 to 1 second, that is, belong to
When log in prize drawing the page and lottery operation the two operation between interval time in the range of 0 to 1 second, then all meet first
Time interval or the second time interval.
The terminal type of the prize drawing page is logged in, the state of the prize drawing page or position, page when getting reward during lottery operation
State or the information such as position, can be as the behavioural characteristic in default feature.
In practical applications, server-side may be performed simultaneously multiple business, and same type of business can have more phase
As step or feature.So for same type of multiple business, it can be by multiple services analysis, obtaining trans-sectoral business
Temporal aspect and behavioural characteristic.For example, the business such as online ballot, on-line purchase admission ticket, are respectively provided with and above-mentioned online prize drawing business
Similar flow or action can be used as same type of business with online prize drawing.
So the same type of business can be directed to, the default feature of unified trans-sectoral business is configured, for example, when therein
Sequence characteristics can be：Login page-interval first time section-the second time interval of operation A/ event A- intervals-operation B/ things
Part B, wherein operation A/ events A and operation B/ events B are that can be arbitrary specific operation or event in each business.It is therein
Behavioural characteristic can be：When logging in, terminal is preset kind, the page location of login page, behaviour when operation A/ events A occurs
When making B/ events B generations, page location of the place page etc..By the default feature of trans-sectoral business, can realize while to a variety of
The interaction data that interactive service generates is monitored in real time.
Distributed Computing Platform can utilize above-mentioned default feature, to every data to be tested in the first data, one by one
Matched with default feature.All kinds of interaction datas when record has terminal and the server-side to interact in data to be tested,
Which includes the interaction data corresponding to default feature, so, it can be by default feature to the progress of the first detection data
Match.For example, in a data to be tested, the generated generation operated or act is interacted between the terminal and server-side that are recorded
Sequence meets the temporal aspect in default feature with time interval, and the state parameter for operating or acting when occurring also complies with
When presetting the behavioural characteristic in feature, it may be considered that the data to be tested meet default feature.
When the data to be tested meet default feature, using the data to be tested as target data, and by target complete
Data such as are arranged and are arranged at the processing, so as to form real-time second data flow.Target data in second data flow can be with
As the data with data risk or exception.
Step 103, the interaction data generated in real-time monitoring terminal and server-side interactive process, and identify in real time and the
The interaction data that target data in two data flows matches handles the interaction data using default measure.
In a kind of embodiment of example in real time of the invention, Distributed Computing Platform can directly according to the second data flow,
In real time under current time, each terminal is monitored with the interaction data generated in server-side interactive process.
By above-mentioned steps, Distributed Computing Platform can generate the second data flow in real time, the mesh in the second data flow
Mark data can be saved, as the other bases for estimation of interaction data generated in real time of identification.Also, due to
Above-mentioned matching process is also performed in real time, so, the generation of the second data flow is also dynamic process, you can with real-time
Newly-increased target data is preserved, and then can ensure timely to obtain the new data with data risk or exception.
In the target data preserved, a plurality of types of data can be contained, for example, client type, IP address and
Other and the corresponding data of default feature etc..
By the monitoring to current time interaction data, recognise that there may be the friendships to match with target data
Mutual data are generating, for example, the interaction data is identical with target data, e.g., which is logging request, and the login
IP address in request is identical with the IP address in target data.It may be considered that the interaction data similarly belongs to number
According to risk or the data of exception, which can be handled using default measure.Default measure can include to sending out
Raw interaction data blocked the interaction data can either be recorded or can also be directed to the interaction data to
Related operating personnel send out prompt message or to backstage operation maintenance personnel alerts.For example, when the data please to log in
When asking, the logging request can be refused or logging request is transferred to the verification page, it is desirable that user's input validation code.
Alternatively, for example, the interaction data is a series of operations or action with time sequencing, have and target data
The temporal aspect to match, and its terminal type is identical with the terminal type in target data, but IP address is different, then also may be used
To think it may be considered that the interaction data similarly belongs to the data with data risk or exception.
Such as in a specific application scenarios, personal user can be by the Malware on PC, one
Malice brush ticket is carried out in a online poll business, which can generate a random IP address and carry out ballot behaviour every time
Make, in this case, PC with server-side during interacting, although constantly switching IP address, its terminal
The temporal aspect of type and interactive process, does not change, when the Malware is voted for the first time, passes through step
101 and step 102, can be carried out to the interaction data of polling station generation as data to be tested first time, and pass through and preset
The matching of feature, is determined as target data, when the Malware carries out brush ticket again, it is possible to by real-time to interaction data
Monitoring, it is the data with data risk or exception to identify the data that are generated when the PC is interacted with server-side, can
To be blocked or be intervened using default measure.
In the another embodiment of present example, Distributed Computing Platform can be by generated second data flow
Output to dedicated for carrying out the air control system of Data Detection, air control system further according to the second data flow, in real time to terminal with
The interaction data generated in server-side interactive process is monitored.Likewise, when and identify in real time in the second data flow
The interaction data that target data matches can be handled the interaction data using default measure by air control system.Specifically
, all kinds of air control systems that disclosure satisfy that demand of the embodiment of the present invention can be applied to the embodiment of the present invention, also belong to this
The protection domain of inventive embodiments.
A kind of real time data recognition methods provided in an embodiment of the present invention, device and electronic equipment, by obtaining end in real time
The a plurality of data to be tested generated in end and server-side interactive process, and be the first data flow by the processing of a plurality of data to be tested；
From a plurality of data to be tested in the first data flow, the target data to match with default feature is filtered out one by one, and by institute
It is the second data flow to state target data processing；The interaction data generated in real-time monitoring terminal and server-side interactive process again, and
Identify the interaction data to match with the target data in the second data flow in real time, to the interaction data using default measure into
Row processing.It, can be to the feature of the behavior model reflected in data to be tested by presetting feature in the present invention is real-time
It is matched, so that it is determined that going out, there are the data to be tested of data risk or exception as target data, then pass through target data
The interaction data generated in real time is identified, exception or the interaction data there are risk can be timely identified, not need to
The monitoring of data is carried out using fixed blacklist, and since target data can also generate and update in real time, Ke Yijin
The accuracy and real-time that interaction data is identified in the raising of one step.
With reference to above-described embodiment, in a step 101, terminal is obtained in real time and a plurality of is treated with what is generated in server-side interactive process
Detection data, including：
The first step obtains a plurality of interaction data generated in terminal and server-side interactive process in real time.
Second step for each interaction data, extracts one or more of interaction data preset field, by one
Or multiple preset fields form a data to be tested.
Terminal during interacting, can form data that are various types of, and being on a grand scale with server-side, if
Using whole various informations all as data to be tested, it can so that system burden is overweight, be unfavorable for monitoring data in real time.Institute
Each interactive service can be directed to, determine it is more crucial in the interactive service, and with the corresponding pass of default feature
Bond parameter or information, using the key parameter or information as preset field.
Distributed Computing Platform can obtain in real time or monitoring terminal and server-side between generate when interacting it is more
Data, then from one or more of each extracting data data preset field, and the one or more is pre-
If field is arranged or combined in order, a data to be tested are formed.
By preset field, the data more than largely sinking in data can be removed, only retain and can be used for matching default feature
Data, and then whole operational efficiency can be improved, mitigate decorum burden, further improve real-time.
With reference to above-described embodiment, in a step 101, terminal is obtained in real time and a plurality of is treated with what is generated in server-side interactive process
Detection data can include：
Obtain a plurality of data to be tested generated in terminal and server-side interactive process in real time by message queue.
Message queue is the container that message or data are transmitted between equipment or application, and usually it is real in an asynchronous manner
Existing message sends and receives, and in practical applications, message queue can be realized by message queue softwares such as ActiveMQ.
Terminal interacted with server-side caused by data to be tested, can in several ways, by preset Information Granularity,
A plurality of data to be tested are firstly added in message queue, then pushed from message queue to Distributed Computing Platform or
It is obtained from message queue by Distributed Computing Platform.It specifically, can be by server-side when data to be tested generate, by servicing
It holds to message queue and sends the data to be tested；Or data to be tested can first be recorded in generation by presupposed information granularity
In the file of Log Types, such as the journal files such as Mysql binlog and Raw log, then message queue can pass through visit
The journal file is asked, so as to obtain a plurality of data to be tested.
In embodiments of the present invention, data to be tested are added in into message queue first, can causes Distributed Computing Platform
Can a plurality of data to be tested more smoothly be obtained from message queue, Distributed Computing Platform is avoided to obtain in a short time greatly
The data to be tested of amount and caused by data pressure, so as to improve the stability of Distributed Computing Platform and anti-pressure ability.
With reference to above-described embodiment, in practical application, step 101, obtains terminal with being produced in server-side interactive process in real time
The processing of a plurality of data to be tested is the first data flow, can included by raw a plurality of data to be tested：
When a plurality of data to be tested generated from multiple message queues, real-time acquisition terminal and server-side interactive process
When, a plurality of data to be tested that will respectively be obtained from the multiple message queue are uniformly processed as first data flow.
Server-side may be performed simultaneously multiple same type of business, for example, multiple online poll activities or can be same
Sweepstake in Shi Zhihang online polls activity, line, booking etc. on line.Also, Distributed Computing Platform can be directed to simultaneously
Multiple server-sides provide the identification of data risk or abnormal data.
The data to be tested respectively generated can be added in different message teams by different business or different server-sides
In row, so, Distributed Computing Platform can obtain a plurality of data to be tested from multiple message queues.
When from multiple message queues, when obtaining a plurality of data to be tested, can uniting to a plurality of data to be tested obtained
One the processing such as is arranged or is arranged, and form first data flow, not to the number to be detected acquired in different messages queue
According to distinguishing.
By a plurality of data to be tested for obtaining multiple message queues, it is uniformly processed as first data flow, it can be with
By Distributed Computing Platform, to each business in multiple server-sides or server-side, generated data to be tested carry out
Unified matching and processing can reduce the complexity that Distributed Computing Platform performs subsequent step, can further improve point
The stability of cloth computing platform.
With reference to above-mentioned each embodiment, in a step 101, it is the first data flow by the processing of a plurality of data to be tested, wraps
It includes：
According to the sequencing of the generated time of a plurality of data to be tested, a plurality of data to be tested are arranged as the first data
Stream.
Each data to be tested, can contain a time identifier, which can be in data to be tested
One field or other kinds of label.At the time of the time identifier can be used for recording when the data to be tested generate.
Distributed Computing Platform, can be according to every when acquired a plurality of data to be tested are arranged as the first data flow
Time identifier in one data to be tested, by the sequencing of the generated time of data to be tested, by a plurality of data to be tested
It is arranged as the first data flow.So as to which preferentially to generated time, preceding data to be tested are matched or handled.It and then can
The real-time for being matched or being handled to improve Distributed Computing Platform to data to be tested.
Referring to Fig. 2, with reference to above-mentioned each embodiment, step 103, real-time monitoring terminal in server-side interactive process with producing
Raw interaction data, when occurring the interaction data to match with the target data in the second data flow again, to the interaction number
It is handled, can be included according to using default measure：
For each target data in the second data flow, each target data is cut to containing pre- by step 103a
If the data segment of core field, default core field is the field for the default feature for being directly used in characterization target data.
After Distributed Computing Platform generates the second data flow, the target data in second data flow can be applied, it is right
Terminal is monitored with the interaction data generated in server-side interactive process.Or second data flow can also be exported to wind
Control system.
In order to can more rapidly, easily using the target data, which can be cut, only retain mesh
The default core field of one or more of data is marked, so as to obtain the data segment formed by presetting core field.Default core
Field is the field for the default feature for being directly used in characterization target data, for example, default core field can be IP address, terminal
Type, the record data of order of occurrence and time interval of operation corresponding with temporal aspect or action etc..
Step 103b preserves data segment in the buffer, and generated in real-time monitoring terminal and server-side interactive process
Interaction data.
The data segment that can will be cut out preserves in the caches, so that Distributed Computing Platform or air control system are real
Now the quick of the data segment is read or accessed.
In cutting out with after data segment preservation for progress target data, Distributed Computing Platform or air control system can supervise in real time
Survey the interaction data generated in each terminal and server-side interactive process.
Step 103c, when occurring interaction data that is identical with data segment or matching in interaction data again, to the friendship
Mutual data are handled using default measure.
By the real-time monitoring of interaction data to being generated in each terminal and server-side interactive process, can find in time
In the current interaction data generated, if interaction data that is identical with the data segment preserved or matching occur.If
The interaction data is identical with the data segment preserved or matches, then it can be assumed that the interaction data has data risk or exception
Data, which can be handled using default measure.
In embodiments of the present invention, by cutting out the target data in the second data flow for data segment, and by the data
Duan Baocun is in the buffer, it is possible to reduce the data volume of target data, and convenient for preserving and extracting, distribution can be further improved
The efficiency that formula computing platform or air control system application target data are monitored or identify to the interaction data currently generated, can be with
Improve real-time.
Referring to Fig. 3, Fig. 3 is the structure chart of real time data identification device provided in an embodiment of the present invention, applied to distribution
Computing platform, including：
Acquisition module 301, will for obtaining a plurality of data to be tested generated in terminal and server-side interactive process in real time
The a plurality of data to be tested processing is the first data flow；
Matching module 302, for from a plurality of data to be tested in first data flow, filtering out and presetting one by one
The target data that feature matches, and by target data processing for the second data flow, it is described it is default be characterized as it is described to be checked
Regular behavior pattern feature possessed by measured data；
Monitoring modular 303, for the interaction data generated in real-time monitoring terminal and the server-side interactive process, and in fact
When identify the interaction data to match with the target data in second data flow, to the interaction data using default
Measure is handled.
A kind of real time data recognition methods provided in an embodiment of the present invention, device and electronic equipment, by obtaining end in real time
The a plurality of data to be tested generated in end and server-side interactive process, and be the first data flow by the processing of a plurality of data to be tested；
From a plurality of data to be tested in the first data flow, the target data to match with default feature is filtered out one by one, and by institute
It is the second data flow to state target data processing；The interaction data generated in real-time monitoring terminal and server-side interactive process again, and
Identify the interaction data to match with the target data in the second data flow in real time, to the interaction data using default measure into
Row processing.It, can be to the feature of the behavior model reflected in data to be tested by presetting feature in the present invention is real-time
It is matched, so that it is determined that going out, there are the data to be tested of data risk or exception as target data, then pass through target data
The interaction data generated in real time is identified, exception or the interaction data there are risk can be timely identified, not need to
The monitoring of data is carried out using fixed blacklist, and since target data can also generate and update in real time, Ke Yijin
The accuracy and real-time that interaction data is identified in the raising of one step.
Optionally, it is described in the matching module 302 in real time data identification device provided in an embodiment of the present invention
Default feature includes：State parameter when behavioural characteristic and temporal aspect, the behavioural characteristic expression action or event occur, institute
State sequence and the interval time of temporal aspect expression action or event generation.
Optionally, in real time data identification device provided in an embodiment of the present invention, the acquisition module 301 is specific to use
In：
The a plurality of interaction data generated in terminal and server-side interactive process is obtained in real time；For each interaction data,
One or more of interaction data preset field is extracted, one or more of preset fields are formed into a number to be detected
According to.
Optionally, in real time data identification device provided in an embodiment of the present invention, the acquisition module 301 is specific to use
In：
Obtain a plurality of data to be tested generated in terminal and server-side interactive process in real time by message queue.
Optionally, in real time data identification device provided in an embodiment of the present invention, the acquisition module 301 is specific to use
In：
When a plurality of data to be tested generated from multiple message queues, real-time acquisition terminal and server-side interactive process
When, a plurality of data to be tested that will respectively be obtained from the multiple message queue are uniformly processed as first data flow.
Optionally, in real time data identification device provided in an embodiment of the present invention, the acquisition module 301 is specific to use
In：
According to the sequencing of the generated time of a plurality of data to be tested, a plurality of data to be tested are arranged as
First data flow.
Optionally, in real time data identification device provided in an embodiment of the present invention, the monitoring modular 303 is specific to use
In：
For each target data in second data flow, each target data is cut to containing default core
The data segment of field, the default core field are to be directly used in the field for the default feature for characterizing the target data；
The data segment is preserved in the buffer, and the interaction data generated in real-time monitoring terminal and the server-side interactive process；
When occurring interaction data that is identical with the data segment or matching in the interaction data again, which is used
Default measure is handled.
The embodiment of the present invention additionally provides a kind of electronic equipment, as shown in figure 4, including processor 401, communication interface 402,
Memory 403 and communication bus 404, wherein, processor 401, communication interface 402, memory 403 is complete by communication bus 404
Into mutual communication,
Memory 403, for storing computer program；
Processor 401 during for performing the program stored on memory 403, realizes following steps：
The a plurality of data to be tested generated in terminal and server-side interactive process are obtained in real time, by a plurality of number to be detected
It is the first data flow according to processing；
From a plurality of data to be tested in first data flow, the target to match with default feature is filtered out one by one
Data, and be the second data flow by target data processing, described preset is characterized as advising possessed by the data to be tested
The behavior pattern feature of rule property；
The interaction data generated in real-time monitoring terminal and the server-side interactive process, and identify in real time and described the
The interaction data that target data in two data flows matches handles the interaction data using default measure.
The communication bus that above-mentioned electronic equipment is mentioned can be Peripheral Component Interconnect standard (Peripheral Pomponent
Interconnect, abbreviation PCI) bus or expanding the industrial standard structure (Extended Industry Standard
Architecture, abbreviation EISA) bus etc..The communication bus can be divided into address bus, data/address bus, controlling bus etc..
For ease of representing, only represented in figure with a thick line, it is not intended that an only bus or a type of bus.
Communication interface is for the communication between above-mentioned electronic equipment and other equipment.
Memory can include random access memory (Random Access Memory, abbreviation RAM), can also include
Nonvolatile memory (non-volatile memory), for example, at least a magnetic disk storage.Optionally, memory may be used also
To be at least one storage device for being located remotely from aforementioned processor.
Above-mentioned processor can be general processor, including central processing unit (Central Processing Unit,
Abbreviation CPU), network processing unit (Ne twork Processor, abbreviation NP) etc.；It can also be digital signal processor
(Digital Signal Processing, abbreviation DSP), application-specific integrated circuit (Applica tion Specific
Integrated Circuit, abbreviation ASIC), field programmable gate array (Field-Programmable Gate Array,
Abbreviation FPGA) either other programmable logic device, discrete gate or transistor logic, discrete hardware components.
It, can be to the spy of the behavior model reflected in data to be tested by presetting feature in the present invention is real-time
Sign is matched, so that it is determined that going out, there are the data to be tested of data risk or exception as target data, then pass through number of targets
It is identified according to the interaction data generated in real time, can timely identify exception or the interaction data there are risk, be not required to
Fixed blacklist to be used to carry out the monitoring of data, it, can be with and since target data can also generate and update in real time
Further improve the accuracy and real-time that interaction data is identified.
In another embodiment provided by the invention, a kind of computer readable storage medium is additionally provided, which can
It reads to be stored with instruction in storage medium, when run on a computer so that computer performs any institute in above-described embodiment
The real time data recognition methods stated.
In another embodiment provided by the invention, a kind of computer program product for including instruction is additionally provided, when it
When running on computers so that computer performs any real time data recognition methods in above-described embodiment.
In the above-described embodiments, can come wholly or partly by software, hardware, firmware or its arbitrary combination real
It is existing.When implemented in software, it can entirely or partly realize in the form of a computer program product.The computer program
Product includes one or more computer instructions.When loading on computers and performing the computer program instructions, all or
It partly generates according to the flow or function described in the embodiment of the present invention.The computer can be all-purpose computer, special meter
Calculation machine, computer network or other programmable devices.The computer instruction can be stored in computer readable storage medium
In or from a computer readable storage medium to another computer readable storage medium transmit, for example, the computer
Instruction can pass through wired (such as coaxial cable, optical fiber, number from a web-site, computer, server or data center
User's line (DSL)) or wireless (such as infrared, wireless, microwave etc.) mode to another web-site, computer, server or
Data center is transmitted.The computer readable storage medium can be any usable medium that computer can access or
It is the data storage devices such as server, the data center integrated comprising one or more usable mediums.The usable medium can be with
It is magnetic medium, (for example, floppy disk, hard disk, tape), optical medium (for example, DVD) or semiconductor medium (such as solid state disk
Solid State Disk (SSD)) etc..
It should be noted that herein, relational terms such as first and second and the like are used merely to a reality
Body or operation are distinguished with another entity or operation, are deposited without necessarily requiring or implying between these entities or operation
In any this practical relationship or sequence.Moreover, term " comprising ", "comprising" or its any other variant are intended to
Non-exclusive inclusion, so that process, method, article or equipment including a series of elements not only will including those
Element, but also including other elements that are not explicitly listed or further include as this process, method, article or equipment
Intrinsic element.In the absence of more restrictions, the element limited by sentence "including a ...", it is not excluded that
Also there are other identical elements in process, method, article or equipment including the element.
Each embodiment in this specification is described using relevant mode, identical similar portion between each embodiment
Point just to refer each other, and the highlights of each of the examples are difference from other examples.Especially for system reality
For applying example, since it is substantially similar to embodiment of the method, so description is fairly simple, related part is referring to embodiment of the method
Part explanation.
The foregoing is merely illustrative of the preferred embodiments of the present invention, is not intended to limit the scope of the present invention.It is all
Any modification, equivalent replacement, improvement and so within the spirit and principles in the present invention, are all contained in protection scope of the present invention
It is interior.
Claims (15)
1. a kind of real time data recognition methods, which is characterized in that applied to Distributed Computing Platform, including：
The a plurality of data to be tested generated in terminal and server-side interactive process are obtained in real time, at a plurality of data to be tested
It manages as the first data flow；
From a plurality of data to be tested in first data flow, the number of targets to match with default feature is filtered out one by one
According to, and be the second data flow by target data processing, described preset is characterized as rule possessed by the data to be tested
The behavior pattern feature of property；
The interaction data generated in real-time monitoring terminal and the server-side interactive process, and identify in real time and the described second number
The interaction data to match according to the target data in stream handles the interaction data using default measure.
2. according to the method described in claim 1, it is characterized in that, the default feature includes：Behavioural characteristic and temporal aspect,
State parameter when the behavioural characteristic expression action or event occur, the temporal aspect expression action or event occur suitable
Sequence and interval time.
3. according to the method described in claim 1, it is characterized in that, the real-time acquisition terminal in server-side interactive process with producing
Raw a plurality of data to be tested, including：
The a plurality of interaction data generated in terminal and server-side interactive process is obtained in real time；
For each interaction data, one or more of interaction data preset field is extracted, it will be one or more of
Preset field forms a data to be tested.
4. according to the method described in claim 1, it is characterized in that, the real-time acquisition terminal in server-side interactive process with producing
Raw a plurality of data to be tested, including：
Obtain a plurality of data to be tested generated in terminal and server-side interactive process in real time by message queue.
5. according to the method described in claim 4, it is characterized in that, the real-time acquisition terminal in server-side interactive process with producing
The a plurality of data to be tested processing is the first data flow by raw a plurality of data to be tested, including：
It, will when a plurality of data to be tested generated from multiple message queues, real-time acquisition terminal and server-side interactive process
The a plurality of data to be tested obtained respectively from the multiple message queue are uniformly processed as first data flow.
6. according to the method described in claim 1, it is characterized in that, described count a plurality of data to be tested processing for first
According to stream, including：
According to the sequencing of the generated time of a plurality of data to be tested, a plurality of data to be tested are arranged as described
First data flow.
7. according to the method described in claim 1, it is characterized in that, the real-time monitoring terminal and the server-side interactive process
The interaction data of middle generation, when the interaction data that appearance matches with the target data in second data flow again
When, the interaction data is handled using default measure, including：
For each target data in second data flow, each target data is cut to containing default core field
Data segment, the default core field is to be directly used in the field for the default feature for characterizing the target data；
The data segment is preserved in the buffer, and the interaction number generated in real-time monitoring terminal and the server-side interactive process
According to；
When occurring interaction data that is identical with the data segment or matching in the interaction data again, to the interaction data
It is handled using default measure.
8. a kind of real time data identification device, which is characterized in that applied to Distributed Computing Platform, including：
Acquisition module, will be described more for obtaining a plurality of data to be tested generated in terminal and server-side interactive process in real time
The processing of data to be tested is the first data flow；
Matching module, for from a plurality of data to be tested in first data flow, filtering out one by one and default feature phase
Matched target data, and be the second data flow by target data processing, described preset is characterized as the data to be tested
The behavior pattern feature of possessed regularity；
Monitoring modular for the interaction data generated in real-time monitoring terminal and the server-side interactive process, and identifies in real time
Go out the interaction data to match with the target data in second data flow, to the interaction data using default measure into
Row processing.
9. device according to claim 8, which is characterized in that the default feature in the matching module includes：Row
It is characterized and temporal aspect, the state parameter when behavioural characteristic expression action or event occur, the temporal aspect represents
The sequence and interval time that action or event occur.
10. device according to claim 8, which is characterized in that the acquisition module is specifically used for：
The a plurality of interaction data generated in terminal and server-side interactive process is obtained in real time；For each interaction data, extraction
One or more of preset fields are formed a data to be tested by one or more of interaction data preset field.
11. device according to claim 8, which is characterized in that the acquisition module is specifically used for：
Obtain a plurality of data to be tested generated in terminal and server-side interactive process in real time by message queue.
12. according to the devices described in claim 11, which is characterized in that the acquisition module is specifically used for：
It, will when a plurality of data to be tested generated from multiple message queues, real-time acquisition terminal and server-side interactive process
The a plurality of data to be tested obtained respectively from the multiple message queue are uniformly processed as first data flow.
13. device according to claim 8, which is characterized in that the acquisition module is specifically used for：
According to the sequencing of the generated time of a plurality of data to be tested, a plurality of data to be tested are arranged as described
First data flow.
14. device according to claim 8, which is characterized in that the monitoring modular is specifically used for：
For each target data in second data flow, each target data is cut to containing default core field
Data segment, the default core field is to be directly used in the field for the default feature for characterizing the target data；By institute
It states data segment to preserve in the buffer, and the interaction data generated in real-time monitoring terminal and the server-side interactive process；Work as institute
It states in interaction data again when there is interaction data that is identical with the data segment or matching, to the interaction data using presetting
Measure is handled.
15. a kind of electronic equipment, which is characterized in that including processor, communication interface, memory and communication bus, wherein, processing
Device, communication interface, memory complete mutual communication by communication bus；
Memory, for storing computer program；
Processor during for performing the program stored on memory, realizes any method and steps of claim 1-7.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201711338766.0A CN108156141B (en) | 2017-12-14 | 2017-12-14 | Real-time data identification method and device and electronic equipment |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201711338766.0A CN108156141B (en) | 2017-12-14 | 2017-12-14 | Real-time data identification method and device and electronic equipment |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN108156141A true CN108156141A (en) | 2018-06-12 |
| CN108156141B CN108156141B (en) | 2021-08-27 |
Family
ID=62466228
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201711338766.0A Active CN108156141B (en) | 2017-12-14 | 2017-12-14 | Real-time data identification method and device and electronic equipment |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN108156141B (en) |
Cited By (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN110309473A (en) * | 2019-06-05 | 2019-10-08 | 上海车轮互联网服务有限公司 | Merge the anti-brush ticket method and device of identity and voting behavior monitoring |
| CN110933069A (en) * | 2019-11-27 | 2020-03-27 | 上海明耿网络科技有限公司 | Network protection method, device and storage medium |
| CN111563088A (en) * | 2020-04-20 | 2020-08-21 | 成都库珀区块链科技有限公司 | Data consistency detection method and device |
| CN111931066A (en) * | 2020-09-11 | 2020-11-13 | 四川新网银行股份有限公司 | Real-time recommendation system design method |
| CN113949560A (en) * | 2021-10-15 | 2022-01-18 | 海尔数字科技(青岛)有限公司 | Network security identification method, device, server and storage medium |
Citations (10)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN103761478A (en) * | 2014-01-07 | 2014-04-30 | 北京奇虎科技有限公司 | Judging method and device of malicious files |
| CN104410533A (en) * | 2014-12-17 | 2015-03-11 | 乐山师范学院 | Network user behavior identification system |
| CN105183873A (en) * | 2015-09-18 | 2015-12-23 | 北京博雅立方科技有限公司 | Malicious clicking behavior detection method and device |
| CN105262726A (en) * | 2015-09-10 | 2016-01-20 | 中国人民解放军信息工程大学 | APT (Advanced Persistent Threat) attack detection method based on big data behavior sequence analysis |
| US20160173516A1 (en) * | 2013-11-07 | 2016-06-16 | Cyberpoint International Llc | Methods And Systems For Malware Detection |
| CN106027577A (en) * | 2016-08-04 | 2016-10-12 | 四川无声信息技术有限公司 | Exception access behavior detection method and device |
| CN106453357A (en) * | 2016-11-01 | 2017-02-22 | 北京红马传媒文化发展有限公司 | Network ticket buying abnormal behavior recognition method and system and equipment |
| CN106998334A (en) * | 2017-05-25 | 2017-08-01 | 北京计算机技术及应用研究所 | A kind of computer user's abnormal behavior detection method |
| CN107196953A (en) * | 2017-06-14 | 2017-09-22 | 上海丁牛信息科技有限公司 | A kind of anomaly detection method based on user behavior analysis |
| CN107229557A (en) * | 2017-06-26 | 2017-10-03 | 微鲸科技有限公司 | It is abnormal to click on detection method and device, click volume statistical method and device |
-
2017
- 2017-12-14 CN CN201711338766.0A patent/CN108156141B/en active Active
Patent Citations (10)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20160173516A1 (en) * | 2013-11-07 | 2016-06-16 | Cyberpoint International Llc | Methods And Systems For Malware Detection |
| CN103761478A (en) * | 2014-01-07 | 2014-04-30 | 北京奇虎科技有限公司 | Judging method and device of malicious files |
| CN104410533A (en) * | 2014-12-17 | 2015-03-11 | 乐山师范学院 | Network user behavior identification system |
| CN105262726A (en) * | 2015-09-10 | 2016-01-20 | 中国人民解放军信息工程大学 | APT (Advanced Persistent Threat) attack detection method based on big data behavior sequence analysis |
| CN105183873A (en) * | 2015-09-18 | 2015-12-23 | 北京博雅立方科技有限公司 | Malicious clicking behavior detection method and device |
| CN106027577A (en) * | 2016-08-04 | 2016-10-12 | 四川无声信息技术有限公司 | Exception access behavior detection method and device |
| CN106453357A (en) * | 2016-11-01 | 2017-02-22 | 北京红马传媒文化发展有限公司 | Network ticket buying abnormal behavior recognition method and system and equipment |
| CN106998334A (en) * | 2017-05-25 | 2017-08-01 | 北京计算机技术及应用研究所 | A kind of computer user's abnormal behavior detection method |
| CN107196953A (en) * | 2017-06-14 | 2017-09-22 | 上海丁牛信息科技有限公司 | A kind of anomaly detection method based on user behavior analysis |
| CN107229557A (en) * | 2017-06-26 | 2017-10-03 | 微鲸科技有限公司 | It is abnormal to click on detection method and device, click volume statistical method and device |
Cited By (7)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN110309473A (en) * | 2019-06-05 | 2019-10-08 | 上海车轮互联网服务有限公司 | Merge the anti-brush ticket method and device of identity and voting behavior monitoring |
| CN110933069A (en) * | 2019-11-27 | 2020-03-27 | 上海明耿网络科技有限公司 | Network protection method, device and storage medium |
| CN111563088A (en) * | 2020-04-20 | 2020-08-21 | 成都库珀区块链科技有限公司 | Data consistency detection method and device |
| CN111931066A (en) * | 2020-09-11 | 2020-11-13 | 四川新网银行股份有限公司 | Real-time recommendation system design method |
| CN111931066B (en) * | 2020-09-11 | 2021-09-07 | 四川新网银行股份有限公司 | Real-time recommendation system design method |
| CN113949560A (en) * | 2021-10-15 | 2022-01-18 | 海尔数字科技(青岛)有限公司 | Network security identification method, device, server and storage medium |
| CN113949560B (en) * | 2021-10-15 | 2023-10-27 | 卡奥斯数字科技(青岛)有限公司 | Network security identification method, device, server and storage medium |
Also Published As
| Publication number | Publication date |
|---|---|
| CN108156141B (en) | 2021-08-27 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN108156141A (en) | A kind of real time data recognition methods, device and electronic equipment | |
| CN108780479B (en) | System and method for detecting and scoring anomalies | |
| CN108062629A (en) | Processing method, terminal device and the medium of transaction event | |
| US20210092160A1 (en) | Data set creation with crowd-based reinforcement | |
| JP2017126283A (en) | Detection program, detection method and detection device | |
| CN110009365B (en) | User group detection method, device and equipment for abnormally transferring electronic assets | |
| CN112035303B (en) | Data testing method and device, computer and readable storage medium | |
| CN111754241A (en) | User behavior perception method, device, equipment and medium | |
| US20170109638A1 (en) | Ensemble-Based Identification of Executions of a Business Process | |
| CN111176202A (en) | Safety management method, device, terminal equipment and medium for industrial control network | |
| US10560473B2 (en) | Method of network monitoring and device | |
| CN108710670A (en) | A kind of log analysis method, device, electronic equipment and readable storage medium storing program for executing | |
| CN108304322B (en) | Pressure testing method and terminal equipment | |
| CN111612085A (en) | Method and device for detecting abnormal point in peer-to-peer group | |
| CN110852809A (en) | Data processing method, device, equipment and medium | |
| CN112437034A (en) | False terminal detection method and device, storage medium and electronic device | |
| CN112330355B (en) | Method, device, equipment and storage medium for processing consumption coupon transaction data | |
| CN113554056A (en) | Network asset aggregation method, device, electronic device and storage medium | |
| US20170109637A1 (en) | Crowd-Based Model for Identifying Nonconsecutive Executions of a Business Process | |
| CN110881030A (en) | Logstack-based method and device for recording operation logs of web service administrator | |
| CN111105255A (en) | Method for realizing store multi-channel member centralized management based on Internet platform | |
| CN109726550A (en) | Abnormal operation behavioral value method, apparatus and computer readable storage medium | |
| JP2019526129A (en) | Apparatus and method for digital media measurement including a user panel | |
| US9229898B2 (en) | Causation isolation using a configuration item metric identified based on event classification | |
| CN112580089A (en) | Information leakage early warning method, device and system, storage medium and electronic device |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |