CN109426700A - Data processing method, device, storage medium and electronic device - Google Patents
Data processing method, device, storage medium and electronic device Download PDFInfo
- Publication number
- CN109426700A CN109426700A CN201710754737.6A CN201710754737A CN109426700A CN 109426700 A CN109426700 A CN 109426700A CN 201710754737 A CN201710754737 A CN 201710754737A CN 109426700 A CN109426700 A CN 109426700A
- Authority
- CN
- China
- Prior art keywords
- data
- data processing
- request
- model
- classification
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
- 238000003860 storage Methods 0.000 title claims abstract description 33
- 238000003672 processing method Methods 0.000 title claims abstract description 30
- 238000012545 processing Methods 0.000 claims abstract description 422
- 230000003542 behavioural effect Effects 0.000 claims abstract description 104
- 238000000034 method Methods 0.000 claims abstract description 54
- 238000012360 testing method Methods 0.000 claims description 56
- 238000012795 verification Methods 0.000 claims description 38
- 230000015654 memory Effects 0.000 claims description 22
- 241000238876 Acari Species 0.000 claims description 18
- 230000002159 abnormal effect Effects 0.000 claims description 16
- 238000004590 computer program Methods 0.000 claims description 4
- 230000032258 transport Effects 0.000 claims 1
- 230000001960 triggered effect Effects 0.000 claims 1
- 238000005516 engineering process Methods 0.000 abstract description 9
- 230000006399 behavior Effects 0.000 description 63
- 230000000694 effects Effects 0.000 description 15
- 238000010586 diagram Methods 0.000 description 12
- 238000003066 decision tree Methods 0.000 description 11
- 238000012549 training Methods 0.000 description 11
- 238000010200 validation analysis Methods 0.000 description 9
- 241001269238 Data Species 0.000 description 8
- 230000008569 process Effects 0.000 description 8
- 238000004458 analytical method Methods 0.000 description 7
- 238000001914 filtration Methods 0.000 description 7
- 238000004422 calculation algorithm Methods 0.000 description 6
- 238000013524 data verification Methods 0.000 description 5
- 235000013399 edible fruits Nutrition 0.000 description 5
- 238000010801 machine learning Methods 0.000 description 5
- 206010000117 Abnormal behaviour Diseases 0.000 description 4
- 238000013499 data model Methods 0.000 description 4
- 230000006870 function Effects 0.000 description 4
- 230000001360 synchronised effect Effects 0.000 description 4
- 230000005540 biological transmission Effects 0.000 description 3
- 230000008859 change Effects 0.000 description 3
- 238000004891 communication Methods 0.000 description 3
- 238000010168 coupling process Methods 0.000 description 3
- 238000005859 coupling reaction Methods 0.000 description 3
- 230000007613 environmental effect Effects 0.000 description 3
- 230000008878 coupling Effects 0.000 description 2
- 238000012986 modification Methods 0.000 description 2
- 230000004048 modification Effects 0.000 description 2
- 238000012163 sequencing technique Methods 0.000 description 2
- 230000003042 antagnostic effect Effects 0.000 description 1
- 238000004364 calculation method Methods 0.000 description 1
- 238000004140 cleaning Methods 0.000 description 1
- 238000005336 cracking Methods 0.000 description 1
- 230000006378 damage Effects 0.000 description 1
- 230000003247 decreasing effect Effects 0.000 description 1
- 238000001514 detection method Methods 0.000 description 1
- 230000005611 electricity Effects 0.000 description 1
- 238000011156 evaluation Methods 0.000 description 1
- 238000000605 extraction Methods 0.000 description 1
- 238000005111 flow chemistry technique Methods 0.000 description 1
- 230000001771 impaired effect Effects 0.000 description 1
- 238000005259 measurement Methods 0.000 description 1
- 238000005192 partition Methods 0.000 description 1
- 230000002265 prevention Effects 0.000 description 1
- 238000005070 sampling Methods 0.000 description 1
- 238000012216 screening Methods 0.000 description 1
- 238000000926 separation method Methods 0.000 description 1
- 239000007787 solid Substances 0.000 description 1
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/10—Protecting distributed programs or content, e.g. vending or licensing of copyrighted material ; Digital rights management [DRM]
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
- G06F21/31—User authentication
- G06F21/316—User authentication by observing the pattern of computer usage, e.g. typical user behaviour
Abstract
The invention discloses a kind of data processing method, device, storage medium and electronic devices.Wherein, this method comprises: obtaining the behavioral data of client；Behavioral data is handled into the model data for data processing model, wherein the data processing model with model data, for carrying out classification processing to the security level of the first request, the first request triggers object event for client request；By the data processing model with model data, classification processing is carried out to the security level of the first request, obtains the classification results of the first request, wherein classification results are used to indicate the security level of the first request；Operation corresponding with classification results is carried out to the first request.The present invention solves the technical issues of low efficiency of data processing in the related technology.
Description
Technical field
The present invention relates to computer fields, in particular to a kind of data processing method, device, storage medium and electricity
Sub-device.
Background technique
Currently, the content of provider is illegally obtained by non-provider, and is supplied to user's use, to affect provider
Interests, this behavior be known as steal chain.Multimedia robber's chain situation is more and more severeer, and the destruction technological means for stealing chain side passes through synchronization
Authentication block, gets multimedia address, so that the copyright rights whatsoever of resource owning side is impaired, has increased and decreased bandwidth cost.
Existing multimedia anti-theft chain is mostly synchronous door chain, can be authenticated when multimedia is requested.Specifically
Ground, client are encrypted by using key and play relevant parameter, are sent to broadcasting backstage, are carried out after authentication judgement from the background to obstructed
The exception request crossed is hit.The advantages of synchronous door chain be take up less resources, authenticate it is fast, but because of the calculation of encryption parameter
Method is present in client, and easily stolen chain side cracks, and normal users and robber's chain can not be just efficiently differentiated after cracking
User, can only promote authentication effect by the upgrade algorithm of client, at high cost, come into force slow, lead to the efficiency of data processing
Lowly.
The prior art is increased on the basis of synchronous door chain and is counted to the number of user behavior, from the background certain
Judge that the behavior number of the user allows this user behavior if user has the behavior in addition to broadcasting in time interval
Pass through, if behavior of the user not in addition to broadcasting, does not allow this user behavior to pass through, and to the user behavior into
Row strike.In addition, stealing chain side while carrying out stealing chain broadcasting, it is only necessary to retransmit behavior request (such as: advertisement behavior
Request), it will be passed through by anti-stealing link system.
If the quantity according to user behavior determines user behavior, rather than the presence or absence of user behavior is carried out
Determine, will there are problems that the threshold value for determining the quantity of user behavior can not be selected accurately, if threshold value is excessively stringent
Normal users behavior will be judged by accident, if threshold value is excessively loose, have robber's chain of major part to be leaked through.Thus synchronous door chain
Scheme that there are upgrade costs is high, is easy to be modeled, the disadvantages of threshold values can not be accurately arranged, lead to the low efficiency of data processing
Under.
The model that existing asynchronous door chain can only come out according to preparatory study, solely knows according to given data model
Not once whether request is not to steal chain request, but can not provide the security level specifically requested.Know simultaneously at present in big data
Not Dao chain request scheme in, can only by the existing behavior prediction that can be identified be whether steal chain；For stealing the new model of chain,
Currently existing scheme can not go discovery to identify well, will be considered that current request is normal request, to let off some novel
The doubtful request for stealing chain limits it and hits range；For that intelligent can not send out in robber's chain Antagonistic Environment for becoming increasingly complex
Existing novel robber's chain situation, so as to cause the inefficiency of data processing.
In addition, after the authentication is passed, door chain backstage is right since authentication in the prior art occurs before multimedia
Subsequent broadcasting can not be controlled, and stolen chain side and only needed normally play out by synchronizing authentication, without
It needs to spend too many energy in the link other than broadcasting, be reduced so as to cause the safety of data processing.
Aiming at the problem that low efficiency of above-mentioned data processing, currently no effective solution has been proposed.
Summary of the invention
The embodiment of the invention provides a kind of data processing method, device, storage medium and electronic devices, at least to solve
In the related technology the technical issues of the low efficiency of data processing.
According to an aspect of an embodiment of the present invention, a kind of data processing method is provided.The data processing method includes:
Obtain the behavioral data of client；Behavioral data is handled into the model data for data processing model, wherein there is model data
Data processing model, for carrying out classification processing to the security level of the first request, the first request is touched for client request
Send out object event；By the data processing model with model data, classification processing is carried out to the security level of the first request, is obtained
To the classification results of the first request, wherein classification results are used to indicate the security level of the first request；To first request carry out with
The corresponding operation of classification results.
According to another aspect of an embodiment of the present invention, a kind of data processing equipment is additionally provided.The data processing equipment packet
It includes: acquiring unit, for obtaining the behavioral data of client；First processing units, for handling behavioral data at data
Manage the model data of model, wherein the data processing model with model data, for being carried out to the security level of the first request
Classification processing, the first request trigger object event for client request；The second processing unit, for by with model data
Data processing model, to first request security level carry out classification processing, obtain the classification results of the first request, wherein
Classification results are used to indicate the security level of the first request；Operating unit, it is corresponding with classification results for being carried out to the first request
Operation.
According to another aspect of an embodiment of the present invention, the program that a kind of storage medium includes storage is additionally provided, wherein journey
The data processing method of the embodiment of the present invention is executed when sort run.
According to another aspect of an embodiment of the present invention, a kind of electronic device is additionally provided.The electronic device include memory,
Processor and storage are on a memory and the computer program that can run on a processor, processor pass through computer program execution
The data processing method of the embodiment of the present invention.
In embodiments of the present invention, the behavioral data of client is obtained；Behavioral data is handled as data processing model
Model data, wherein the data processing model with model data, for being carried out at classification to the security level of the first request
Reason, the first request trigger object event for client request；By the data processing model with model data, asked to first
The security level asked carries out classification processing, obtains the classification results of the first request, wherein classification results are used to indicate the first request
Security level；Operation corresponding with classification results is carried out to the first request.Due to that can identify the peace of the request of client
Congruent grade, and then operation corresponding with security level is taken, reach the technical effect for improving the treatment effeciency of data, and then solve
Determined data processing in the related technology low efficiency the technical issues of.
Detailed description of the invention
The drawings described herein are used to provide a further understanding of the present invention, constitutes part of this application, this hair
Bright illustrative embodiments and their description are used to explain the present invention, and are not constituted improper limitations of the present invention.In the accompanying drawings:
Fig. 1 is a kind of schematic diagram of the hardware environment of data processing method according to an embodiment of the present invention；
Fig. 2 is a kind of flow chart of data processing method according to an embodiment of the present invention；
Fig. 3 is a kind of method for carrying out operation corresponding with classification results to the first request according to an embodiment of the present invention
Flow chart；
Fig. 4 is the flow chart of another data processing method according to an embodiment of the present invention；
Fig. 5 is a kind of process of method that data processing model is adjusted by test result according to an embodiment of the present invention
Figure；
Fig. 6 is the flow chart of another data processing method according to an embodiment of the present invention；
Fig. 7 is the flow chart of another data processing method according to an embodiment of the present invention；
Fig. 8 is the flow chart of another data processing method according to an embodiment of the present invention；
Fig. 9 is a kind of schematic diagram of data processing system according to an embodiment of the present invention；
Figure 10 is a kind of schematic diagram of policy scores system architecture according to an embodiment of the present invention；
Figure 11 is another policy scores system architecture according to an embodiment of the present invention；
Figure 12 is a kind of schematic diagram for being classified logic according to an embodiment of the present invention；
Figure 13 is a kind of logical schematic of decision tree according to an embodiment of the present invention；
Figure 14 is a kind of schematic diagram of data processing equipment according to an embodiment of the present invention；And
Figure 15 is a kind of structural block diagram of electronic device according to an embodiment of the present invention.
Specific embodiment
In order to enable those skilled in the art to better understand the solution of the present invention, below in conjunction in the embodiment of the present invention
Attached drawing, technical scheme in the embodiment of the invention is clearly and completely described, it is clear that described embodiment is only
The embodiment of a part of the invention, instead of all the embodiments.Based on the embodiments of the present invention, ordinary skill people
The model that the present invention protects all should belong in member's every other embodiment obtained without making creative work
It encloses.
It should be noted that description and claims of this specification and term " first " in above-mentioned attached drawing, "
Two " etc. be to be used to distinguish similar objects, without being used to describe a particular order or precedence order.It should be understood that using in this way
Data be interchangeable under appropriate circumstances, so as to the embodiment of the present invention described herein can in addition to illustrating herein or
Sequence other than those of description is implemented.In addition, term " includes " and " having " and their any deformation, it is intended that cover
Cover it is non-exclusive include, for example, the process, method, system, product or equipment for containing a series of steps or units are not necessarily limited to
Step or unit those of is clearly listed, but may include be not clearly listed or for these process, methods, product
Or other step or units that equipment is intrinsic.
Embodiment 1
According to embodiments of the present invention, a kind of embodiment of data processing method is provided.
Optionally, in the present embodiment, above-mentioned data processing method can be applied to as shown in Figure 1 by server 102
In the hardware environment constituted with terminal 104.Fig. 1 is a kind of hardware environment of data processing method according to an embodiment of the present invention
Schematic diagram.As shown in Figure 1, server 102 is attached by network with terminal 104, above-mentioned network includes but is not limited to: wide
Domain net, Metropolitan Area Network (MAN) or local area network, terminal 104 are not limited to PC, mobile phone, tablet computer etc..At the data of the embodiment of the present invention
Reason method can be executed by server 102, can also be executed, be can also be by server 102 and terminal by terminal 104
104 common execution.Wherein, the data processing method that terminal 104 executes the embodiment of the present invention is also possible to by mounted thereto
Client executes.
Fig. 2 is a kind of flow chart of data processing method according to an embodiment of the present invention.As shown in Fig. 2, this method can be with
The following steps are included:
Step S202 obtains the behavioral data of client.
In the technical solution that the application above-mentioned steps S202 is provided, the behavioral data of client is obtained.
In this embodiment, client can be videoconference client, music client end, document client, animation client
Deng herein with no restrictions.The behavioral data of client is obtained, the behavior number of client can be obtained by data processing system
According to, behavior data are the sample data for adjusting data processing model, that is, data processing model is trained,
In, data processing model can be used for handling the request of client transmission.
Optionally, the behavioral data of the embodiment can be the data that client generates in the process of running, can be visitor
The data generated when the request of each processing module are being called at family end, are also possible to produce during client sends request data
Raw data.For example, behavior data are data when video playing is authenticated, played, report play instruction, report advertisement, report
The behaviors such as heartbeat data are also possible to the video ID requested when video playing, User IP, channel information, platform information, log in letter
Breath etc. is also possible to the environmental information etc. of the player of client collection.
Optionally, which can continue to optimize behavioral data, for example, player is obtained when playing advertisement, screenshot
Behavior and user is reported to open the behavioral datas such as homepage, details page.
Behavioral data is handled the model data for data processing model by step S204.
In the technical solution that the application above-mentioned steps S204 is provided, behavioral data is handled into the mould for data processing model
Type data, wherein the data processing model with model data, for carrying out classification processing to the security level of the first request,
First request triggers object event for client request.
After the behavioral data for obtaining client, behavioral data is handled into the model data for data processing model.It can
Selection of land arranges behavioral data, will have the data screening for being used to adjust data processing model to get off in behavioral data, by it
It is abstracted as the vector data of multidimensional, these vector datas can be classified and be classified.Optionally, logical to above-mentioned vector data
Machine learning model is crossed, is trained, tested, fed back, final model data is obtained.
The data processing model of the embodiment can be by using decision-tree model, but is not limited to decision-tree model as base
This model carries out classification prediction to various states and obtains, for example, assume that the depth of tree-model is 8, then the maximum number of leaf node
Amount is 28-1=128.Optionally, a large amount of newest data can be all sampled every preset time to instruct data processing model
Practice, data processing model is trained for example, can all sample a large amount of newest data every preset time, data processing model
Itself constantly learns tuning, adjustment decision plan, to reach optimal strike effect to request data.Simultaneously in logarithm
During being trained according to processing model, model parameter can be adjusted by the dynamic authentication to data, to further mention
The recognition effect of high data processing model.
Step S206 is classified the security level of the first request by the data processing model with model data
Processing, obtains the classification results of the first request.
In the technical solution that the application above-mentioned steps S206 is provided, by the data processing model with model data,
Classification processing is carried out to the security level of the first request, obtains the classification results of the first request, wherein classification results are used to indicate
The security level of first request.
After handling behavioral data for the model data of data processing model, at the data with model data
Model is managed, classification processing is carried out to the security level of the first request, which can be client for requesting to play
The request of video, for requesting the request for playing music not limit for requesting the service requests such as the request paid herein
System.The classification results of first request are used to indicate the security level of the first request, which can be used to indicate that first
Request the safety of corresponding behavior.Optionally, which can be bound with score, and different score thresholds represents
Different security level, for example, when score is higher, then it represents that security level is higher, when score is lower, then it represents that safety etc.
Grade is lower.
In this embodiment, it steals chain and refers to that the content of provider is illegal by non-provider, be retrieved and provided to user's use,
Influence the behavior of the interests of provider.For the request that client is sent each time, a possibility that stealing chain request is all existed for, it should
In the presence of corresponding with the security level of request a possibility that stealing chain request.
Step S208 carries out operation corresponding with classification results to the first request.
In the technical solution that the application above-mentioned steps S208 is provided, behaviour corresponding with classification results is carried out to the first request
Make.
By the data processing model with model data, classification processing is carried out to the security level of the first request, is obtained
To after the classification results of the first request, operation corresponding with classification results is carried out to the first request, which is also right
The strategy that first request is taken when being handled can take different operations according to the different classification results of the first request.
For example, then directly being asked to first when the security level for determining the first request by data processing model corresponds to and steals chain behavior
It asks and is hit, the first request is not allowed to pass through.It is corresponding in the security level for determining the first request by data processing model
When doubtful robber's chain behavior, then dependency rule can be runed out, is obtained by the data of the first request by manually being analyzed and being abstracted
To the new operation that the first request is handled, and the operational order for being handled request is updated, realizes benign cycle,
Improve data-handling efficiency.
The embodiment can judge whether request is to steal chain request under given data model, also can be according to tables of data
Existing difference identifies the corresponding security level specifically requested, and then is gone to find novel robber's chain pattern according to security level,
And rapid strike is given according to dependency rule, the safety of data processing is improved, data-handling efficiency is improved.
S202 to step S208 through the above steps, obtains the behavioral data of client；Behavioral data is handled as data
Handle model model data, wherein with model data data processing model, for first request security level into
Row classification processing, the first request trigger object event for client request；By the data processing model with model data,
Classification processing is carried out to the security level of the first request, obtains the classification results of the first request, wherein classification results are used to indicate
The security level of first request；Operation corresponding with classification results is carried out to the first request.Due to that can identify client
The security level of request, and then operation corresponding with security level is taken, reach the technology effect for improving the treatment effeciency of data
Fruit, and then solve the technical issues of low efficiency of data processing in the related technology.
As an alternative embodiment, step S208, carries out operation corresponding with classification results to the first request and wraps
It includes: in the case where classification results are not existing classification results in data processing model, determining that the first request is destination request；
Obtain the first operational order for being handled the abnormal data in destination request；The first operation is carried out to the first request to refer to
The first indicated operation is enabled, and the first operational order is added in data processing model.
Fig. 3 is a kind of method for carrying out operation corresponding with classification results to the first request according to an embodiment of the present invention
Flow chart.As shown in figure 3, method includes the following steps:
Step S301 determines first in the case where classification results are not existing classification results in data processing model
Request is destination request.
It is not to have in data processing model in classification results in the technical solution that the application above-mentioned steps S301 is provided
Classification results in the case where, determine the first request be destination request.
By the data processing model with model data, classification processing is carried out to the security level of the first request, is obtained
To after the classification results of the first request, judge whether classification results are existing classification results in data processing model, if
Judging classification results not is existing data result in data processing model, then the first request is determined as destination request, mesh
Mark request is that doubtful robber's chain is requested, that is, first request is that robber's chain to be determined is requested.
Step S302 obtains the first operational order for being handled the abnormal data in destination request.
In the technical solution that the application above-mentioned steps S302 is provided, the first operational order, first operational order are obtained
For handling the abnormal data in destination request, wherein operation corresponding with classification results includes the first operational order
The first indicated operation, the first operational order are also used to indicate to the first request to there is the request of the same category to carry out first
Operation.
After determining that the first request is destination request, it can be scored by data processing model destination request,
Determine whether destination request is security request by appraisal result, if determining destination request not by appraisal result is to ask safely
It asks, then can determine destination request to steal chain request, then obtain the abnormal data in destination request, it can be by manually to abnormal number
It according to being analyzed, and is abstracted, obtains the first operational order, policy system can be passed through and obtain the first operational order, first behaviour
Making instruction can serve to indicate that the first operation of request progress with the first request with the same category, for example, to appraisal result
Same or similar a kind of chain of stealing is requested, and can be operated on it using identical operational order.
Optionally, which selects by classifier according to the performance of different data more widely to request data
The sorting algorithm classified.Applicable usage scenario can be used for any required field for taking request data corresponding strategy
Scape.
Step S303 carries out the first operation indicated by the first operational order to the first request, and by the first operational order
It is added in data processing model.
In the technical solution that the application above-mentioned steps S303 is provided, the first request is carried out indicated by the first operational order
The first operation, and the first operational order is added in data processing model.
After obtaining the first operational order for being handled the abnormal data in destination request, request first
The first operation indicated by the first operational order is carried out, that is, carrying out first to the first request by the instruction of the first operational order
Operation.Since the first operational order can serve to indicate that the first operation of request progress to having the same category with the first request,
The first operational order can be then added in data processing model, thus to operational order existing in data processing model into
Row updates, and realizes benign cycle, can directly to pass through when being subsequently encountered has the request of the same category with the first request
First operational order carries out the first operation to the request, for example, carrying out strike operation, prevents the corresponding behavior of the request from leading to
It crosses, improves the safety of data processing.
The embodiment is by the case where classification results are not existing classification results in data processing model, determining
One request is destination request；Obtain the first operational order for being handled the abnormal data in destination request, wherein with
The corresponding operation of classification results includes the first operation indicated by the first operational order, and the first operational order is used to indicate to the
There is the request of the same category to carry out the first operation for one request；First behaviour indicated by first operational order is carried out to the first request
Make, and the first operational order is added in data processing model, realizes corresponding with classification results to the first request progress
The purpose of operation.
As an alternative embodiment, step S204, handles the pattern number for data processing model for behavioral data
According to including: to be filtered to behavioral data, the vector data of data processing model is obtained, wherein vector data includes multiple dimensions
Degree；Vector data is handled into the model data for data processing model.
In this embodiment, after the behavioral data for obtaining client, for example, when video playing is authenticated, is played
Data, request data when reporting play quality, report advertisement, reporting the behavioral datas such as heartbeat or video playing, video
ID, User IP, channel, platform number, client collect player environmental information, the behavioral datas such as User ID, log-on message it
Afterwards, behavioral data is filtered, obtains the vector data of data processing model, for example, being carried out to the behavioral data got
Cleaning is arranged, the vector data of multidimensional is abstracted as.
It is filtered to behavioral data, after obtaining the vector data of data processing model, is by vector data processing
Vector data can be handled the model for data processing model by the model data of data processing model by data processing system
These vector datas are optionally classified and are classified by strategy by data.Then these vector datas are passed through into engineering
Practise model with training, test, feedback flow processing, obtain final model data.
The embodiment obtains the vector data of data processing model by being filtered to behavioral data, wherein vector number
According to including multiple dimensions；Vector data is handled into the model data for data processing model, realize by behavioral data processing be
The purpose of the model data of data processing model, and then by the data processing model with model data, to the first request
Security level carries out classification processing, obtains the classification results of the first request；Behaviour corresponding with classification results is carried out to the first request
Make, improves the purpose of data processing.
As an alternative embodiment, behavioral data is handled the model for data processing model in step S204
After data, this method further include: the test result tested model data is fed back into data processing model, and
Data processing model is adjusted by test result, the data processing model after being adjusted.
Fig. 4 is the flow chart of another data processing method according to an embodiment of the present invention.As shown in figure 4, this method is also
The following steps are included:
Step S401, tests model data, obtains test result.
In the technical solution that the application above-mentioned steps S401 is provided, handle by behavioral data as data processing model
Model data tests model data, obtains test result.
After handling behavioral data for the model data of data processing model, model data is tested, it can be with
Model data is tested by big data modeling, obtains test result.Optionally, according to machine learning model to mould
Type data are automatically analyzed, and test result is obtained, which can be used for adjusting data processing model.
Test result is fed back to data processing model, and adjusts data processing model by test result by step S402,
Data processing model after being adjusted.
In the technical solution that the application above-mentioned steps S402 is provided, test result is fed back into data processing model, and
Data processing model is adjusted by test result, the data processing model after being adjusted.
It is tested to model data, after obtaining test result, test result is fed back into data processing model, it can
Test result is fed back to data verification system by big data modeling, and then data processing mould is adjusted by test result
Type can adjust data processing model by test result according to machine learning model, and then the data processing after being adjusted
Model realizes the training to data processing model.
It optionally, in this embodiment, can be by order to guarantee accuracy that data processing model determines request data
It samples a large amount of newest behavioral datas according to preset time period to be trained data processing model, for example, acquisition is a large amount of most daily
New behavioral data is trained data processing model, such data processing model itself constantly study tuning, and then intelligence
Adjustable strategies, to improve the efficiency hit illegal request data.
The embodiment by after handling behavioral data for the model data of data processing model, to model data into
Row test, obtains test result；Test result is fed back into data processing model, and data processing mould is adjusted by test result
Type, the data processing model after being adjusted realize the training to data processing model, and then improve data processing model
The efficiency of processing.
As an alternative embodiment, step S402, adjusts data processing model by test result, is adjusted
Data processing model afterwards includes: validation test as a result, obtaining the first verification result；Meet first condition in the first verification result
In the case where, adjust the parameter of data processing model.
Fig. 5 is a kind of process of method that data processing model is adjusted by test result according to an embodiment of the present invention
Figure.As shown in figure 5, this method comprises:
Step S501, validation test is as a result, obtain the first verification result.
In the technical solution that the application above-mentioned steps S501 is provided, validation test is as a result, obtain the first verification result.
It is tested to model data, after obtaining test result, can be tested by data verification system and test is tied
Fruit is verified, and test result is obtained.
Step S502 adjusts the parameter of data processing model in the case where the first verification result meets first condition.
In the technical solution that the application above-mentioned steps S502 is provided, the case where the first verification result meets first condition
Under, adjust the parameter of data processing model.
In validation test as a result, after obtaining the first verification result, judge whether the first verification result meets first condition,
The first condition can be the condition for adjusting the parameter of data processing model, to improve data processing model to request data
The accuracy of identification.
The embodiment is by validation test as a result, obtaining the first verification result；Meet first condition in the first verification result
In the case where, the parameter of data processing model is adjusted, realizes and data processing model is adjusted by test result, after being adjusted
Data processing model purpose, realize the training to data processing model, so improve data processing model processing
Efficiency.
As an alternative embodiment, in step S206, by the data processing model with model data, to
The security level of one request carries out classification processing, when obtaining the classification results of the first request, this method further include: in the first request
In the case where meeting second condition, to the first request addition first identifier, wherein first identifier is used to identify the peace of the first request
Total state.
In this embodiment, the safe condition of the first request, can be whether the first request is safe state, if be
The state etc. of suspected security.When normal client is when sending request data, meeting go to call according to set sequence and frequency
The request of modules, generated module request number and frequency can be used as the behavioural characteristic of client.Optionally, judge
Whether request of data meets the request of normal client sending, if request of data is the request that normal client issues, to
The state that first request addition is used to indicate the first request is the first identifier of safe condition；If request of data is to steal chain client
The request issued is held, then is used to indicate the first identifier that the first request is non-secure states to the first request addition；It is asked first
In the case where asking as destination request, that is, being used in the case where the first request is the request of doubtful robber's chain to the first request addition
Indicate that the first request is the first identifier for stealing chain request to be determined.
Optionally, every kind of safety can also be subdivided out under every kind of solicited status to the first identifier of the first request addition
The mark of the sub- states of difference under state clearly to mark the state of request, and then improves data processing model to asking
The accuracy for asking data to identify.
As an alternative embodiment, behavioral data is handled the model for data processing model in step S204
When data, this method further include: obtain the target sample of data processing model and the sample observations of target sample；By target sample
The quantity processing of this sample size and sample observations is the first index of data processing model；In the mesh of data processing model
In standard specimen sheet, the sample size of the corresponding sample size of each classification of target sample and target sample is handled as data processing
Second index of model；First index and the second index are handled into the classification scoring for data processing model.
Fig. 6 is the flow chart of another data processing method according to an embodiment of the present invention.As shown in fig. 6, this method packet
Include following steps:
Step S601, by the number of the sample size of the target sample of data processing model and the sample observations of target sample
Amount, handles the first index for data processing model.
In the technical solution that the application above-mentioned steps S601 is provided, by the sample number of the target sample of data processing model
The quantity processing of the sample observations of amount and target sample is the first index of data processing model, wherein target sample includes
Behavioral data, the first index are used to indicate the request of client by the data handling path in data processing model, are handled
Generalization ability.
In this embodiment, the peace for the request that the data processing model with model data can be used for sending client
Congruent grade carries out classification processing.Data processing model can be trained constantly to be optimized to data processing model, be mentioned
The treatment effeciency of high data processing model.Optionally, decision-tree model is used as basic model to carry out dividing for various states
Class prediction.
The embodiment can calculate each of the sample obtained by behavioral data when being trained to data processing model
The importance of the sample factor, for example, can be used the methods of Geordie (gini) coefficient, information gain-ratio calculating be used to indicate it is each
The data of the importance of the sample factor, wherein the sample factor is used to indicate causality, the correlation etc. between data.?
To after the data for the importance for being used to indicate each sample factor, the most important sample in selecting current sample, most by this
The important sample factor is determined as the root node of data processing model；Maximum point can be calculated according to the sample factor chosen
The sample data of sample is divided into two parts according to the target sample factor by the target sample factor for splitting sample class, will be drawn
The two parts divided are as leaf node.Optionally, above-mentioned steps, Jin Ersheng are repeated to the corresponding subsample of leaf node
At data processing model.
Optionally, by the quantity of the sample size of the target sample of data processing model and the sample observations of target sample
Processing is the first index of data processing model, can be by the sample size and target sample of the target sample of data processing model
The quotient of quantity of sample observations be determined as the first index of data processing model, wherein target sample includes behavioral data,
First index is also the extensive index in path, can be one kind for indicating the index of novel robber's chain behavior, be used to indicate
The generalization ability that the request of client is handled by the data handling path in data processing model.Wherein, generalization ability is
Refer to machine learning algorithm to the adaptability of fresh sample, the destination of study is to acquire the rule for lying in data behind, to tool
There are the data other than the study collection of same rule, trained network can also provide suitable output, and the ability is also as general
Change ability.
In this embodiment, the value of the first index is bigger, indicates that the logic in the leaf path in the data processing model is general
Change ability is better.
Step S602, in target sample, by the corresponding sample size of each classification of target sample and target sample
Sample size handles the second index for data processing model.
In the technical solution that the application above-mentioned steps S602 is provided, in the target sample of data processing model, by mesh
The sample size processing of the corresponding sample size of each classification and target sample of standard specimen sheet is the second finger of data processing model
Number, wherein the second index is used to indicate the accuracy rate of the classification of the request of determining client.
In the target sample of data processing model, by the corresponding sample size of each classification and target sample of target sample
This sample size processing is the second index of data processing model, can be by the corresponding sample number of each classification of target sample
The quotient of amount and the sample size of target sample is determined as the second index of data processing model, can be for for indicating novel robber's chain
One kind of the index of behavior.Second index namely path classification index, the value of the second index is bigger, indicates that this class of paths is other
Predictablity rate is higher, and the value of the second index is lower, indicates that the other predictablity rate of this class of paths is lower, this path classification
Confusion degree it is bigger.Wherein, in the case where the other confusion degree of class of paths is big, it is meant that there are novel robber's chain behavior,
That is, not processed by data processing model before robber's chain behavior.
First index and the second index are handled the classification scoring for data processing model by step S603.
In the technical solution that the application above-mentioned steps S603 is provided, the first index and the second index are handled as at data
Manage the classification scoring of model, wherein each classification that classification scoring is used to indicate target sample is the degree of target category.
It is handled by the quantity of the sample size of the target sample of data processing model and the sample observations of target sample
For the first index of data processing model, by the sample number of each classification corresponding sample size and target sample of target sample
After amount processing is the second index of data processing model, the first index and the second index are handled to the class for data processing model
It does not score, it can be novel robber's chain mould that each classification that category scoring is used to indicate target sample, which is the degree of target category,
Formula scoring, classification scoring is higher, indicates in the sample for reaching the leaf node in data processing model, existing potential robber's chain
The degree of new behavior is higher.
Behavioral data when being handled the model data for data processing model by the embodiment, by the mesh of data processing model
The quantity processing of the sample observations of the sample size and target sample of standard specimen sheet is the first index of data processing model,
In, target sample includes behavioral data, and the first index is used to indicate the request of client by the data in data processing model
The generalization ability that line of reasoning diameter is handled；It is in the target sample of data processing model, each classification of target sample is corresponding
Sample size and target sample sample size processing be data processing model the second index, wherein the second index is used for
Indicate the accuracy rate of the classification of the request of determining client；First index and the second index are handled to the class for data processing model
It does not score, wherein each classification that classification scoring is used to indicate target sample is the degree of target category, to realize logarithm
According to the training of processing model.
As an alternative embodiment, step S601, by the number of the sample size of target sample and sample observations
Amount, handling as the first index of data processing model includes: to obtain the first Index A by following first formula:
Wherein, samples is used to indicate that the sample size of target sample, n to be used to indicate the quantity of the sample observations of target sample.
As an alternative embodiment, step S602, by the corresponding sample size of each classification of target sample and
The sample size of target sample, handling as the second index of data processing model includes: to obtain second by following second formula
Index B:Wherein, maxvalueiThe sample size under i-th of classification for indicating target sample is greater than
The sample size under classification in multiple classifications of target sample in addition to i-th of classification.
As an alternative embodiment, step S603 handles the first index and the second index for data processing mould
The classification scoring of type includes: to obtain classification scoring C by following third formula:Wherein,
Samples is used to indicate that the sample size of target sample, n to be used to indicate the quantity of the sample observations of target sample,
maxvalueiThe sample size under i-th of classification for indicating target sample is greater than in multiple classifications of target sample, except the
The corresponding sample size of classification except i classification.
In this embodiment, above-mentioned samples can be used to indicate that the sample size into subtree, and value is for indicating
Quantity (value under each classificationiIndicate the quantity of i-th of classification of this node).In general, have in leaf node
The classification of absolute predominance could be as the route result of this leaf node, that is, prediction result.
The data processing model of the embodiment can be obtained by gini coefficient.For stochastic variable X, if using p (x) table
Show the probability density function of X, E [X] indicates the expectation of X, then for the n sample observations x of Xi, the representation formula of gini coefficient
Are as follows:
As an alternative embodiment, the first index and the second index are handled as data processing mould in step S603
After the classification scoring of type, this method further include: filter out in data processing model greater than corresponding to the second index of target value
Node；In data processing model in filtered node, score according to classification corresponding with filtered node to filtering
Node afterwards is ranked up, and obtains ranking results；It is target section by the vertex ticks that ranking is predetermined sequence in ranking results
Point.
Fig. 7 is the flow chart of another data processing method according to an embodiment of the present invention.As shown in fig. 7, this method packet
Include following steps:
Step S701 filters out node corresponding to the second index greater than target value in data processing model.
In the technical solution that the application above-mentioned steps S701 is provided, filter out in data processing model greater than target value
Node corresponding to second index.
After handling the first index and the second index as the classification scoring of data processing model, data processing is filtered out
Greater than node corresponding to the second index of target value in model.For example, filtering out in Data Data model
The second index, wherein k is used to indicate the preset value that screens the second index, can be accuracy rate, for example, accuracy rate
It is 90%.
Step S702, in data processing model in filtered node, according to classification corresponding with filtered node
Scoring, is ranked up filtered node, obtains ranking results.
In the technical solution that the application above-mentioned steps S702 is provided, in data processing model in filtered node,
Filtered node is ranked up according to classification corresponding with filtered node scoring, obtains ranking results.
The vertex ticks that ranking is predetermined sequence is destination node in ranking results by step S703.
It is predetermined sequence by ranking in ranking results in the technical solution that the application above-mentioned steps S703 is provided
Vertex ticks is destination node, wherein the corresponding behavioral data of destination node robber's chain behavioral data to be determined for client.
It is greater than after node corresponding to the second index of target value in filtering out data processing model, in ranking results
In, it is destination node by the vertex ticks that ranking is predetermined sequence, can be ranked up according to new behavior modal index, selection is doubted
It is that doubtful new behavior steals chain node by the vertex ticks for being arranged in several former like leaf node, it can also be according to novel robber's chain mould
Formula scoring be ranked up, by novel robber's chain pattern scoring it is descending be ranked up, be by the vertex ticks for being arranged in several former
Doubtful new behavior steals chain node, and then takes out doubtful new behavior and steal the corresponding sample number progress OA operation analysis of chain node.
The embodiment by the first index and the second index are handled for data processing model classification scoring after, mistake
It filters in data processing model greater than node corresponding to the second index of target value；The filtered section in data processing model
In point, filtered node is ranked up according to classification corresponding with filtered node scoring, obtains ranking results；It is arranging
It is destination node by the vertex ticks that ranking is predetermined sequence in sequence result, wherein the corresponding behavioral data of destination node waits for really
It is set to robber's chain behavioral data of client.
As an alternative embodiment, being target section by the vertex ticks that ranking is predetermined sequence in step S703
After point, this method further include: obtain data on the corresponding line of destination node；Data on the corresponding line of destination node are verified, are obtained
To the second verification result；In the case where the second verification result meets third condition, the class of the corresponding data of destination node is determined
It Wei not target category.
Fig. 8 is the flow chart of another data processing method according to an embodiment of the present invention.As shown in figure 8, this method packet
Include following steps:
Step S801 obtains data on the corresponding line of destination node.
In the technical solution that the application above-mentioned steps S801 is provided, data on the corresponding line of destination node are obtained, wherein
Data are the behavioral data of client corresponding with destination node when predict on line to data processing model on line.
Be by ranking predetermined sequence vertex ticks be destination node after, obtain number on the corresponding line of destination node
According to data processing model that is trained and analyzing can be used, carried out in system to the grading classification of preset quantity
It is predicted on line, obtains data on line.
Step S802 verifies data on the corresponding line of destination node, obtains the second verification result.
In the technical solution that the application above-mentioned steps S802 is provided, data on the corresponding line of verifying destination node are obtained
Second verification result.
On obtaining the corresponding line of destination node after data, data on the corresponding line of verifying destination node obtain second
Verification result, and the data that doubtful new behavior steals chain node are subjected to on-line analysis, verifying, to find novel robber's chain mould
Formula, wherein the second verification result includes novel robber's chain pattern.
Step S803 determines the corresponding data of destination node in the case where the second verification result meets third condition
Classification is target category.
In the technical solution that the application above-mentioned steps S803 is provided, the case where the second verification result meets third condition
Under, determine that the classification of the corresponding data of destination node is target category.
The data on the corresponding line of verifying destination node, after obtaining the second verification result, meet in the second verification result
In the case where third condition, determine the corresponding data of destination node classification be target category, the third condition can for for
The classification for determining the corresponding data of destination node is the condition of target category, for example, determining the class of the corresponding data of destination node
Wei the condition of chain classification not be stolen, to find novel robber's chain pattern, wherein the second verification result includes novel robber's chain pattern.
The embodiment by be by ranking predetermined sequence vertex ticks be destination node after, the party obtains target section
Data on the corresponding line of point, wherein corresponding with destination node when data is predict on to data processing model progress line on line
Client behavioral data；Data on the corresponding line of destination node are verified, the second verification result is obtained；In the second verification result
In the case where meeting third condition, determines that the classification of the corresponding data of destination node is target category, realize to data processing
Model carries out the purpose predicted on line, and then improves data-handling efficiency.
The embodiment can be applied in multimedia, for example, video playing.Using big data intelligent anti-theft chain
It afterwards,, can be according to difference by the Scoring System scheme of the embodiment in the case where encountering many novel robber's chain patterns
Classification realizes the strike strategy of multiple combinations, doubtful novel robber's chain can be also identified, so that it is preparatory to do how novel robber's chain pattern
Identification, prevention, improve data-handling efficiency.
It should be noted that the embodiment is applied to the preferred embodiment that video playing scene is only the embodiment of the present invention,
The scheme for not representing the embodiment of the present invention is only limitted to video playing scene, and any need identifies request data, improves
The scene of the safety of data processing and data-handling efficiency is not another herein all within the scope of the embodiment of the present invention
One illustrates.
Embodiment 2
Technical solution of the present invention is illustrated below with reference to preferred embodiment, specifically whether is judging request data
To steal chain request, quickly robber's chain request is hit according to corresponding strategy, is illustrated.
It in this embodiment, also can root while judging whether request data is robber's chain request by data processing model
According to the difference of Data Representation, specifically one security level of request is identified；It is gone to find novel robber's chain pattern according to security level,
Dependency rule is being found and runed out at the first time, and quickly robber's chain request is being beaten according to the strategy obtained by dependency rule
It hits.
The embodiment mainly includes anti-stealing link system grading framework and data processing model.Wherein, anti-stealing link system is graded
Framework is mainly used for describing the general frame and principle of anti-stealing link system；Data processing model can be used in multimedia
Foundation, training and judgement of behavioural characteristic model etc..
Fig. 9 is a kind of schematic diagram of data processing system according to an embodiment of the present invention.As shown in figure 9, at door chain
The overall architecture of reason, the client (video, music, document, animation) of the embodiment can by advertisement behavior, quality behaviors, its
The corresponding data of characteristic behaviors such as its behavior (open, use) are sent to background server to carry out model training, refine
Algorithm model.Model judgement is carried out by the data processing model after training, and then carries out asynchronous authentication.The client of the embodiment
End can preferentially synchronize authentication, and multimedia resource is handled, and asynchronous authentication is then carried out again, in this way in asynchronous door chain
On the basis of, more detailed-oriented result scoring is exported, security property is given according to different scorings, and then send to client
Corresponding data and strategy.
The basic principle and Technical Architecture of tactful points-scoring system are illustrated below.
Figure 10 is a kind of schematic diagram of policy scores system architecture according to an embodiment of the present invention.As shown in Figure 10, sample
Data can be the behavioral data of client, sample data be accessed data processing system, by data processing system to sample number
According to being handled, processing result is obtained.Processing result is input to policy system again by data processing system, by policy system according to
Processing result acquisition strategy, and then strategy is input to big data modeling, by big data modeling to data processing mould
Type is tested, and test result is obtained, and data verification system verifies test result, and the data of verifying are input to and are sentenced
Certainly system, which can inquire court verdict by inquiry data acquisition, and then make decisions service.
Figure 11 is another policy scores system architecture according to an embodiment of the present invention.As shown in Figure 10 and Figure 11, sample
Data when data include video playing authentication, play, on give the correct time data, heartbeat, qualitative data, further include play quality report,
The data requested when the behaviors such as advertisement reports, heartbeat reports, video playing, video ID, User IP, channel, platform number, client
The parameters such as the player environmental information of collection, User ID, log-on message.Sample data is input to data processing system, data
Behavioral data is abstracted into the vector data of multidimensional by processing system, carries out feature extraction, then in tactful rating system, pass through plan
Slightly these vector datas are classified and are classified, which is also used to add strategy, more new strategy.Policy system will be to
Amount data be input to big data modeling, by machine learning model with training, model measurement, pass through data verification system again
It automatically analyzed, verified, and feedback validation is as a result, to be adjusted data processing model.Big data modeling simultaneously
Data processing model also by adjusting after provides mode decision scheme to decision system, and decision system is according to strategy and enters judgement behaviour
The data of work make decisions service, and export as a result, by analyzing result, and then the more new strategy in policy system.
The embodiment can use the model data in final data processing model and ask to the video playing of each user
It asks data to be classified, different strategies is taken according to classification situation, improves the efficiency of data processing.
Figure 12 is a kind of schematic diagram for being classified logic according to an embodiment of the present invention.As shown in figure 12, it reflects to request
Power obtains normally performed activity data and abnormal behavioral data, and normally performed activity data are further divided into normal behaviour letter
Abnormal behavioral data is further divided into normal behaviour information and abnormal behaviour information by breath and abnormal behaviour information, then
Normal behaviour information in normally performed activity data is further divided into normal information 1 and exception information 7, by normally performed activity
Abnormal behaviour information in data is further divided into normal information 2 and exception information 8, will be normal in abnormal behavioral data
Behavioural information is divided into normal information 3 and exception information 9, and the abnormal behaviour information in abnormal behavioral data is divided into normally
Information 4 and exception information 10, to realize the continuous subdivision to information.
The embodiment, can be with every in order to guarantee whether data processing model decision request data are the accuracy for stealing chain request
It samples a large amount of newest data every preset time to be trained data processing model, for example, sampling a large amount of newest numbers daily
It is trained according to data processing model, so that data processing model itself constantly study tuning, adjustment determine plan
Slightly, and then reach optimal strike effect.Data verification dynamic adjustment model can be passed through in model training test process simultaneously
Parameter improves the recognition effect of data processing model.
The data processing model of the embodiment simultaneously can also be to doubtful novel robber's chain pattern scoring except classification, after judgement
Abnormal data can have manual analysis and be abstracted, then hierarchical policy is updated, to realize benign cycle.
Data processing model is introduced again below.
In this embodiment it is possible to the case where predicting various robber's chains using more disaggregated models, detailed process is as follows:
The corresponding behavioral data of characteristic behavior that client is generated in request data is obtained, according to client in number of request
According to when the corresponding behavioral data of characteristic behavior that generates predict chain is stolen.Normal client can be according to set in request
Sequence and frequency go to call the request of modules, the quantity and frequency of generated module request can be used as client
Behavioural characteristic.Optionally, the condition for requesting whether to meet the request for normal client each time is determined using rule.Make
It is determined after requesting the condition of request that satisfaction is normal client each time, can be stamped for request of data each time with rule
The label of one state for being used to indicate request data is used to indicate for example, being used to indicate the label for normal request to steal chain
The label of request is used to indicate the label etc. for doubtful robber's chain request.Optionally, every kind of label can also subdivide label, from
And improve the accuracy that data processing model identifies request.
The embodiment can be used decision-tree model but be not limited to decision tree mould when being trained to data processing model
Type carries out the classification prediction of various states as basic model.Optionally, calculate include behavioral data sample it is each because
The importance (the methods of gini coefficient, information gain-ratio can be used) of son, selects the most important factor of current sample, will be most heavy
Root node of the factor wanted as data processing model；Selection can be used for calculating the factor point of maximum division sample class, press
Sample data is divided into two parts according to this factor point, the leaf node as data processing model.Obtained each section
Sample repeats carry out above-mentioned steps, and until result reaches predetermined condition, which can be for for asking client
The security level asked carries out the condition of classification processing, or accuracy rate and recall rate data processing model all up to standard.
The embodiment can also analyze data processing model.In an accuracy rate and recall rate number all up to standard
After generating according to processing model, tester is needed to carry out the logic analysis of decision tree to data processing model, passes through logic point
Analysis obtains the model logic of each classification in data processing model, and to there may be the paths of novel robber's chain behavior to mark
Note, for being used on line.
The logic of the decision tree subtree based on gini coefficient is introduced below.
Figure 13 is a kind of logical schematic of decision tree according to an embodiment of the present invention.As shown in figure 13, wherein samples
For indicating entry into the sample size of subtree, value is used to indicate the quantity (value under each classificationiFor indicating this node
I-th of classification quantity).Optionally, when leaf node has the classification of absolute predominance, corresponding path could be used as this
The route result of a leaf node, that is, prediction result.Gini is for indicating gini coefficient, for stochastic variable X, if using p
(x) probability density function of X is indicated, E [X] indicates the expectation of X, then for the n sample observations x of Xi, the table of gini coefficient
Show formula are as follows:
It should be noted that X [1], the corresponding numerical value of samples, value, gini in embodiment illustrated in fig. 13, only originally
Citing of the inventive embodiments to the structure of decision-tree model, does not constitute the limit to the data processing model of the embodiment of the present invention
It is fixed.
In order to find novel robber's chain pattern, which also defines several statistics come for indicating the new of leaf path
Type steals chain Activity Index.Including the extensive index in path and path classification index.
The extensive index in path:When the value of the extensive index in path is bigger, indicate that the logic in this leaf path is general
Change ability is better.
Path classification index:When path classification index value is bigger, this path classification predictablity rate is higher；
When path classification index value is lower, indicate that the classification confusion degree in this path is bigger.Confusion degree then means to exist greatly new
Type steals chain behavior.
Novel robber's chain pattern scoring:Novel robber's chain mould
When the numerical value of formula scoring is higher, indicate in the corresponding sample of this leaf node, existing potential robber's chain new behavior degree is higher.
After complete to data processing model training, it is assumed that the depth of tree is 8, then the maximum quantity of leaf node is 28-1
=128；Filter out path classification index(k indicates accuracy rate, such as node 90%), can be according to
Doubtful leaf node in new behavior modal index sequencing selection data processing model, it is doubtful for marking several nodes being arranged in front
Like robber's chain node of new behavior, and corresponding sample data is taken out for OA operation analysis.
Optionally, the data processing model of the embodiment can be used a variety of evaluation methods and generate, including information gain, letter
Ratio of profit increase etc. is ceased, herein with no restrictions.
The embodiment can also carry out data processing model to predict on line.It can be used trained, and analyzed
Decision-tree model predicted on the lines of set several grading classifications, carry out strike feedback in real time to chain request is stolen, and
The data on-line analysis verifying of chain node will be stolen by doubtful new behavior, so as to find novel robber's chain pattern.
In this embodiment, after using big data intelligent anti-theft chain, many novel robber's chain patterns can be encountered, in the past
Model be difficult to identify, and Scoring System scheme through the embodiment of the present invention, can on the basis of intelligence asynchronous door chain,
Algorithm model is refined, more detailed-oriented result scoring can be exported, security property is given according to different scorings, is done
It can also be identified doubtful to more comprehensive careful door chain logic to hit strategy according to different classes of realization multiple combinations
Novel robber's chain identifies in advance, takes precautions against to do how novel robber's chain pattern, improves data-handling efficiency.
In this embodiment it is possible to continue to optimize behavioural characteristic, for example, screenshot when playing advertisement inside player reports
And user opens the behaviors such as homepage, details page.Classifier can select more widely to have according to different Data Representations more
The sorting algorithm of classification capacity.Usage scenario can be used for any need and carry out safety detection to request data, to robber's chain request
The scene hit, herein with no restrictions.
It should be noted that for the various method embodiments described above, for simple description, therefore, it is stated as a series of
Combination of actions, but those skilled in the art should understand that, the present invention is not limited by the sequence of acts described because
According to the present invention, some steps may be performed in other sequences or simultaneously.Secondly, those skilled in the art should also know
It knows, the embodiments described in the specification are all preferred embodiments, and related actions and modules is not necessarily of the invention
It is necessary.
Through the above description of the embodiments, those skilled in the art can be understood that according to above-mentioned implementation
The method of example can be realized by means of software and necessary general hardware platform, naturally it is also possible to by hardware, but it is very much
In the case of the former be more preferably embodiment.Based on this understanding, technical solution of the present invention is substantially in other words to existing
The part that technology contributes can be embodied in the form of software products, which is stored in a storage
In medium (such as ROM/RAM, magnetic disk, CD), including some instructions are used so that a terminal device (can be mobile phone, calculate
Machine, server or network equipment etc.) execute method described in each embodiment of the present invention.
Embodiment 3
According to embodiments of the present invention, it additionally provides a kind of for implementing the data processing equipment of above-mentioned data processing method.
Figure 14 is a kind of schematic diagram of data processing equipment according to an embodiment of the present invention.As shown in figure 14, the apparatus may include: obtain
Take unit 10, first processing units 20, the second processing unit 30 and execution unit 40.
Acquiring unit 10, for obtaining the behavioral data of client.
First processing units 20, for behavioral data to be handled to the model data for data processing model, wherein there is mould
The data processing model of type data, for carrying out classification processing to the security level of the first request, the first request is used for client
Request triggering object event.
The second processing unit 30, for by the data processing model with model data, to the safety etc. of the first request
Grade carries out classification processing, obtains the classification results of the first request, wherein classification results are used to indicate safety of the first request etc.
Grade.
Operating unit 40, for carrying out operation corresponding with classification results to the first request.
It should be noted that the acquiring unit 10 in the embodiment can be used for executing the step in the embodiment of the present application 1
S202, the first processing units 20 in the embodiment can be used for executing the step S204 in the embodiment of the present application 1, the embodiment
In the second processing unit 30 can be used for executing the step S206 in the embodiment of the present application 1, the operating unit in the embodiment
40 can be used for executing the step S208 in the embodiment of the present application 1.
Operating unit 40 comprises determining that module, obtains module and operation module.Wherein it is determined that module, for being tied in classification
Fruit is not to determine that the first request is destination request in data processing model in the case where existing classification results；Module is obtained, is used
In obtaining the first operational order, wherein the first operational order is for handling the abnormal data in destination request, with classification
As a result corresponding operation includes the first operation indicated by the first operational order, and the first operational order is also used to indicate to first
The request with the same category is requested to carry out the first operation；Operation module, for carrying out the first operation to the first request, and by the
One operational order is added in data processing model.
First processing units 20 include: filtering module and processing module.Wherein, filtering module, for behavioral data into
Row filtering, obtains the vector data of data processing model, wherein vector data includes multiple dimensions；Processing module, for will be to
Measure the model data that data processing is data processing model.
Optionally, device further include: test cell and adjustment unit.Wherein, test cell, for by behavioral data
After processing is the model data of data processing model, model data is tested, test result is obtained；Adjustment unit is used
In test result is fed back to data processing model, and data processing model is adjusted by test result, the number after being adjusted
According to processing model.
Optionally, adjustment unit includes: authentication module and adjustment module.Wherein, authentication module is used for validation test knot
Fruit obtains the first verification result；Module is adjusted, for adjusting data in the case where the first verification result meets first condition
Handle the parameter of model.
Optionally, which further includes adding unit, for by the data processing model with model data, to
The security level of one request carries out classification processing, when obtaining the classification results of the first request, meets second condition in the first request
In the case where, first identifier is added for the first request, wherein first identifier is used to identify the safe condition of the first request.
Optionally, device further include: first acquisition unit, third processing unit, fourth processing unit and fourth process
Unit.Wherein, first acquisition unit, for obtaining number when behavioral data to be handled to the model data for data processing model
According to the target sample of processing model and the sample observations of target sample；Third processing unit, for by the sample of target sample
The quantity of quantity and sample observations handles the first index for data processing model, wherein target sample includes behavior number
According to the first index is used to indicate the request of client by the data handling path in data processing model, and what is handled is extensive
Ability；Fourth processing unit is used in target sample, by the corresponding sample size of each classification and target sample of target sample
This sample size, handles the second index for data processing model, wherein the second index is used to indicate asking for determining client
The accuracy rate for the classification asked；Fourth processing unit, for handling the class for data processing model for the first index and the second index
It does not score, wherein each classification that classification scoring is used to indicate target sample is the degree of target category.
Optionally, third processing unit is used to obtain the first Index A by following first formula:Wherein,
Samples is used to indicate that the sample size of target sample, n to be used to indicate the quantity of the sample observations of target sample.
Optionally, fourth processing unit is used to obtain the second index B by following second formula:Its
In, maxvalueiThe sample size under i-th of classification for indicating target sample, which is greater than in multiple classifications of target sample, to be removed
The sample size under classification except i-th of classification.
Optionally, fourth processing unit is used to obtain classification scoring C by following third formula:
Wherein, samples is used to indicate that the sample size of target sample, n to be used to indicate the quantity of the sample observations of target sample,
maxvalueiThe sample size under i-th of classification for indicating target sample is greater than in multiple classifications of target sample, except the
The corresponding sample size of classification except i classification.
Optionally, the device further include: filter element, for handling as at data by the first index and the second index
After the classification scoring for managing model, in data processing model, node corresponding to the second index greater than target value is filtered out；
Sequencing unit, in filtered node, scoring according to classification corresponding with filtered node in data processing model,
Filtered node is ranked up, ranking results are obtained；Marking unit, for being default sequence by ranking in ranking results
The vertex ticks of column is destination node, wherein the corresponding behavioral data of destination node robber's chain behavior number to be determined for client
According to.
Optionally, device further include: second acquisition unit, authentication unit and determination unit.Wherein, second list is obtained
Member, for be by ranking predetermined sequence vertex ticks be destination node after, obtain data on the corresponding line of destination node,
Wherein, data are the behavior number of client corresponding with destination node when predict on line to data processing model on line
According to；Authentication unit obtains the second verification result for verifying data on the corresponding line of destination node；Determination unit, for the
In the case that two verification results meet third condition, determine that the classification of the corresponding data of destination node is target category.
The embodiment obtains the behavioral data of client by acquiring unit 10, by first processing units 20 by behavior number
It is the model data of data processing model according to processing, wherein the data processing model with model data, for requesting first
Security level carry out classification processing, the first request triggers object event for client request, and the second processing unit 30 passes through
Data processing model with model data carries out classification processing to the security level of the first request, obtains point of the first request
Grade result, wherein classification results are used to indicate the security level of the first request, by operating unit 40 to first request carry out with
The corresponding operation of classification results.Due to that can identify the security level of the request of client, and then take and security level pair
The operation answered has reached the technical effect for improving the treatment effeciency of data, and then has solved the effect of data processing in the related technology
The low technical problem of rate.
Herein it should be noted that example and application scenarios phase that said units and module are realized with corresponding step
Together, but it is not limited to the above embodiments 1 disclosure of that.It should be noted that above-mentioned module can be with as a part of device
It operates in hardware environment as shown in Figure 1, hardware realization can also be passed through, wherein hardware environment by software realization
Including network environment.
Embodiment 4
According to embodiments of the present invention, it additionally provides a kind of for implementing the electronic device of above-mentioned data processing method.
Figure 15 is a kind of structural block diagram of electronic device according to an embodiment of the present invention.As shown in figure 15, the electronics dress being somebody's turn to do
Setting may include: one or more (one is only shown in figure) processors 151, memory 153.Optionally, as shown in figure 15, should
Electronic device can also include transmitting device 155, input-output equipment 157.
Wherein, memory 153 can be used for storing software program and module, such as the data processing side in the embodiment of the present invention
Method and the corresponding program instruction/module of device, processor 151 by the software program that is stored in memory 153 of operation and
Module realizes above-mentioned data processing method thereby executing various function application and data processing.Memory 153 can wrap
Include high speed random access memory, can also include nonvolatile memory, as one or more magnetic storage device, flash memory or
Other non-volatile solid state memories of person.In some instances, memory 153 can further comprise remote relative to processor 151
The memory of journey setting, these remote memories can pass through network connection to electronic device.The example of above-mentioned network include but
It is not limited to internet, intranet, local area network, mobile radio communication and combinations thereof.
Above-mentioned transmitting device 155 is used to that data to be received or sent via network, can be also used for processor with
Data transmission between memory.Above-mentioned network specific example may include cable network and wireless network.In an example,
Transmitting device 155 includes a network adapter (Network Interface Controller, NIC), can pass through cable
It is connected with other network equipments with router so as to be communicated with internet or local area network.In an example, transmission dress
155 are set as radio frequency (Radio Frequency, RF) module, is used to wirelessly be communicated with internet.
Wherein, specifically, memory 153 is for storing application program.
The application program that processor 151 can call memory 153 to store by transmitting device 155, to execute following steps
It is rapid:
Obtain the behavioral data of client；
Behavioral data is handled into the model data for data processing model, wherein the data processing mould with model data
Type, for carrying out classification processing to the security level of the first request, the first request triggers object event for client request；
By the data processing model with model data, classification processing is carried out to the security level of the first request, is obtained
The classification results of first request, wherein classification results are used to indicate the security level of the first request；
Operation corresponding with classification results is carried out to the first request.
Processor 151 is also used to execute following step: not being existing classification knot in data processing model in classification results
In the case where fruit, determine that the first request is destination request；The first operational order is obtained, the first operational order is used for destination request
In abnormal data handled, wherein it is corresponding with classification results operation include the first operational order indicated by first behaviour
Make, the first operational order is also used to indicate the first operation of request progress to having the same category with the first request；It is asked to first
It asks and carries out the first operation indicated by the first operational order, and the first operational order is added in data processing model.
Processor 151 is also used to execute following step: being filtered to behavioral data, obtains the vector of data processing model
Data, wherein vector data includes multiple dimensions；Vector data is handled into the model data for data processing model.
Processor 151 is also used to execute following step: behavioral data is being handled to the model data for data processing model
Later, model data is tested, obtains test result；Test result is fed back into data processing model, and passes through test
As a result data processing model is adjusted, the data processing model after being adjusted.
Processor 151 is also used to execute following step: validation test is as a result, obtain the first verification result；In the first verifying
As a result in the case where meeting first condition, the parameter of data processing model is adjusted.
Processor 151 is also used to execute following step: by the data processing model with model data, asking to first
The security level asked carries out classification processing, when obtaining the classification results of the first request, meets the feelings of second condition in the first request
Under condition, to the first request addition first identifier, wherein first identifier is used to identify the safe condition of the first request.
Processor 151 is also used to execute following step: behavioral data is being handled to the model data for data processing model
When, obtain the target sample of data processing model and the sample observations of target sample；By the sample size and sample of target sample
The quantity processing of this observation is the first index of data processing model, wherein target sample includes behavioral data, the first index
It is used to indicate the generalization ability that the request of client is handled by the data handling path in data processing model；In target sample
In this, the sample size of each classification corresponding sample size and target sample of target sample is handled as data processing mould
Second index of type, wherein the second index is used to indicate the accuracy rate of the classification of the request of determining client；By the first index and
Second index handles the classification scoring for data processing model, wherein classification, which scores, is used to indicate each classification of target sample
For the degree of target category.
Processor 151 is also used to execute following step: the first Index A is obtained by following first formula:
Wherein, samples is used to indicate that the sample size of target sample, n to be used to indicate the quantity of the sample observations of target sample.
Processor 151 is also used to execute following step: the second index B is obtained by following second formula:
Wherein, maxvalueiThe sample size under i-th of classification for indicating target sample is greater than in multiple classifications of target sample
The sample size under classification in addition to i-th of classification.
Processor 151 is also used to execute following step: classification scoring C is obtained by following third formula:Wherein, samples is used to indicate the sample size of target sample, and n is for indicating target
The quantity of the sample observations of sample, maxvalueiThe sample size under i-th of classification for indicating target sample is greater than mesh
The corresponding sample size of classification in multiple classifications of standard specimen sheet, in addition to i-th of classification.
Processor 151 is also used to execute following step: by the first index and the second index, handling as data processing model
Classification scoring after, in data processing model, filter out node corresponding to the second index greater than target value；In data
It handles in model in filtered node, scores according to classification corresponding with filtered node, filtered node is carried out
Sequence, obtains ranking results；It is destination node by the vertex ticks that ranking is predetermined sequence, wherein target in ranking results
The corresponding behavioral data of node robber's chain behavioral data to be determined for client.
Processor 151 is also used to execute following step: by the vertex ticks that ranking is predetermined sequence be destination node it
Afterwards, data on the corresponding line of destination node are obtained, wherein when data is predict on to data processing model progress line on line,
The behavioral data of client corresponding with destination node；Data on the corresponding line of destination node are verified, the second verification result is obtained；
In the case where the second verification result meets third condition, determine that the classification of the corresponding data of destination node is target category.
Using the embodiment of the present invention, a kind of scheme of data processing is provided.By the behavioral data for obtaining client；It will
Behavioral data processing is the model data of data processing model, wherein the data processing model with model data, for the
The security level of one request carries out classification processing, and the first request triggers object event for client request；By with model
The data processing model of data carries out classification processing to the security level of the first request, obtains the classification results of the first request,
In, classification results are used to indicate the security level of the first request；Operation corresponding with classification results is carried out to the first request.Due to
It can identify the security level of the request of client, and then take operation corresponding with security level, reach raising data
Treatment effeciency technical effect, and then solve the technical issues of low efficiency of data processing in the related technology.
Optionally, the specific example in the present embodiment can be with reference to example described in above-described embodiment, the present embodiment
Details are not described herein.
It will appreciated by the skilled person that structure shown in figure 15 is only to illustrate, electronic device can be intelligence
Mobile phone (such as Android phone, iOS mobile phone), tablet computer, palm PC and mobile internet device (Mobile
Internet Devices, MID), the electronic devices such as PAD.Figure 15 it does not cause to limit to the structure of above-mentioned electronic device.Example
Such as, electronic device may also include than shown in Figure 15 more perhaps less component (such as network interface, display device) or
With the configuration different from shown in Figure 15.
Those of ordinary skill in the art will appreciate that all or part of the steps in the various methods of above-described embodiment is can
It is completed with instructing the relevant hardware of electronic device by program, which can store in a computer readable storage medium
In, storage medium may include: flash disk, read-only memory (Read-Only Memory, ROM), random access device (Random
Access Memory, RAM), disk or CD etc..
Embodiment 5
The embodiments of the present invention also provide a kind of storage mediums.Optionally, in the present embodiment, above-mentioned storage medium can
With the program code for configuration for executing data processing.
Optionally, in the present embodiment, above-mentioned storage medium can be located at multiple in network shown in above-described embodiment
On at least one network equipment in the network equipment.
Optionally, in the present embodiment, storage medium is arranged to store the program code for executing following steps:
Obtain the behavioral data of client；
Behavioral data is handled into the model data for data processing model, wherein the data processing mould with model data
Type, for carrying out classification processing to the security level of the first request, the first request triggers object event for client request；
By the data processing model with model data, classification processing is carried out to the security level of the first request, is obtained
The classification results of first request, wherein classification results are used to indicate the security level of the first request；
Operation corresponding with classification results is carried out to the first request.
Optionally, storage medium is also configured to store the program code for executing following steps: classification results not
In the case where for classification results existing in data processing model, determine that the first request is destination request；The first operation is obtained to refer to
It enables, the first operational order is for handling the abnormal data in destination request, wherein operation packet corresponding with classification results
The first operation indicated by the first operational order is included, the first operational order is also used to indicate to have the same category to the first request
Request carry out first operation；First operation indicated by first operational order is carried out to the first request, and the first operation is referred to
Order is added in data processing model.
Optionally, storage medium is also configured to store the program code for executing following steps: to behavioral data into
Row filtering, obtains the vector data of data processing model, wherein vector data includes multiple dimensions；It is by vector data processing
The model data of data processing model.
Optionally, storage medium is also configured to store the program code for executing following steps: by behavioral data
After processing is the model data of data processing model, model data is tested, test result is obtained；Test result is anti-
It is fed to data processing model, and data processing model is adjusted by test result, the data processing model after being adjusted.
Optionally, storage medium is also configured to store the program code for executing following steps: validation test as a result,
Obtain the first verification result；In the case where the first verification result meets first condition, the parameter of data processing model is adjusted.
Optionally, storage medium is also configured to store the program code for executing following steps: by with mould
The data processing model of type data carries out classification processing to the security level of the first request, obtains the classification results of the first request
When, in the case where the first request meets second condition, to the first request addition first identifier, wherein first identifier is for marking
Know the safe condition of the first request.
Optionally, storage medium is also configured to store the program code for executing following steps: by behavioral data
When processing is the model data of data processing model, the sample observation of the target sample and target sample of data processing model is obtained
Value；The quantity of the sample size of target sample and sample observations is handled into the first index for data processing model, wherein mesh
Standard specimen originally includes behavioral data, and the first index is used to indicate the request of client by the data processing road in data processing model
Diameter, the generalization ability handled；In target sample, by the corresponding sample size of each classification and target sample of target sample
This sample size, handles the second index for data processing model, wherein the second index is used to indicate asking for determining client
The accuracy rate for the classification asked；By the first index and the second index, the classification scoring for data processing model is handled, wherein classification
Each classification that scoring is used to indicate target sample is the degree of target category.
Optionally, storage medium is also configured to store the program code for executing following steps: by following first
Formula obtains the first Index A:Wherein, samples is used to indicate the sample size of target sample, and n is for indicating
The quantity of the sample observations of target sample.
Optionally, storage medium is also configured to store the program code for executing following steps: by following second
Formula obtains the second index B:Wherein, maxvalueiUnder i-th of classification for indicating target sample
Sample size is greater than the sample size under the classification in multiple classifications of target sample in addition to i-th of classification.
Optionally, storage medium is also configured to store the program code for executing following steps: by following third
Formula obtains classification scoring C:Wherein, samples is used to indicate the sample of target sample
Quantity, n are used to indicate the quantity of the sample observations of target sample, maxvalueiFor indicating i-th of classification of target sample
Under sample size be greater than target sample multiple classifications in, the corresponding sample size of classification in addition to i-th of classification.
Optionally, storage medium is also configured to store the program code for executing following steps: by the first index
It in data processing model, is filtered out greater than target value after handling the classification scoring for data processing model with the second index
The second index corresponding to node；In data processing model in filtered node, according to corresponding with filtered node
Classification scoring, filtered node is ranked up, ranking results are obtained；It is predetermined sequence by ranking in ranking results
Vertex ticks be destination node, wherein the corresponding behavioral data of destination node robber's chain behavioral data to be determined for client.
Optionally, storage medium is also configured to store the program code for executing following steps: being pre- by ranking
If the vertex ticks of sequence is data on the corresponding line of acquisition destination node, wherein data are right on line after destination node
When data processing model predict on line, the behavioral data of client corresponding with destination node；It is corresponding to verify destination node
Line on data, obtain the second verification result；In the case where the second verification result meets third condition, destination node pair is determined
The classification for the data answered is target category.
Optionally, the specific example in the present embodiment can be with reference to example described in above-described embodiment, the present embodiment
Details are not described herein.
Optionally, in the present embodiment, above-mentioned storage medium can include but is not limited to: USB flash disk, read-only memory (ROM,
Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, magnetic disk or
The various media that can store program code such as CD.
The serial number of the above embodiments of the invention is only for description, does not represent the advantages or disadvantages of the embodiments.
If the integrated unit in above-described embodiment is realized in the form of SFU software functional unit and as independent product
When selling or using, it can store in above-mentioned computer-readable storage medium.Based on this understanding, skill of the invention
Substantially all or part of the part that contributes to existing technology or the technical solution can be with soft in other words for art scheme
The form of part product embodies, which is stored in a storage medium, including some instructions are used so that one
Platform or multiple stage computers equipment (can be personal computer, server or network equipment etc.) execute each embodiment institute of the present invention
State all or part of the steps of method.
In the above embodiment of the invention, it all emphasizes particularly on different fields to the description of each embodiment, does not have in some embodiment
The part of detailed description, reference can be made to the related descriptions of other embodiments.
In several embodiments provided herein, it should be understood that disclosed client, it can be by others side
Formula is realized.Wherein, the apparatus embodiments described above are merely exemplary, such as the division of the unit, and only one
Kind of logical function partition, there may be another division manner in actual implementation, for example, multiple units or components can combine or
It is desirably integrated into another system, or some features can be ignored or not executed.Another point, it is shown or discussed it is mutual it
Between coupling, direct-coupling or communication connection can be through some interfaces, the INDIRECT COUPLING or communication link of unit or module
It connects, can be electrical or other forms.
The unit as illustrated by the separation member may or may not be physically separated, aobvious as unit
The component shown may or may not be physical unit, it can and it is in one place, or may be distributed over multiple
In network unit.It can select some or all of unit therein according to the actual needs to realize the mesh of this embodiment scheme
's.
It, can also be in addition, the functional units in various embodiments of the present invention may be integrated into one processing unit
It is that each unit physically exists alone, can also be integrated in one unit with two or more units.Above-mentioned integrated list
Member both can take the form of hardware realization, can also realize in the form of software functional units.
The above is only a preferred embodiment of the present invention, it is noted that for the ordinary skill people of the art
For member, various improvements and modifications may be made without departing from the principle of the present invention, these improvements and modifications are also answered
It is considered as protection scope of the present invention.
Claims (15)
1. a kind of data processing method characterized by comprising
Obtain the behavioral data of client；
The behavioral data is handled into the model data for data processing model, wherein the number with the model data
According to processing model, for carrying out classification processing to the security level of the first request, first request is asked for the client
Seek triggering object event；
By the data processing model with the model data, the security level of first request is carried out at classification
Reason obtains the classification results of first request, wherein the classification results are used to indicate the safety etc. of first request
Grade；
Operation corresponding with the classification results is carried out to first request.
2. the method according to claim 1, wherein described carry out and the classification results first request
Corresponding operation includes:
In the case where the classification results are not existing classification results in the data processing model, determine that described first asks
It asks as destination request；
Obtain the first operational order, wherein first operational order is used to carry out the abnormal data in the destination request
Processing, the operation corresponding with the classification results include first operating indicated by first operational order, and described the
One operational order is also used to indicate request progress first operation to having the same category with first request；
First operation is carried out to first request, and first operational order is added to the data processing model
In.
3. the method according to claim 1, wherein described handle the behavioral data for data processing model
Model data include:
The behavioral data is filtered, the vector data of the data processing model is obtained, wherein the vector data packet
Include multiple dimensions；
The vector data is handled into the model data for the data processing model.
4. the method according to claim 1, wherein the behavioral data is handled as data processing mould described
After the model data of type, the method also includes:
The model data is tested, test result is obtained；
The test result is fed back into the data processing model, and the data processing mould is adjusted by the test result
Type, the data processing model after being adjusted.
5. according to the method described in claim 4, it is characterized in that, described adjust the data processing by the test result
Model, the data processing model after being adjusted include:
The test result is verified, the first verification result is obtained；
In the case where first verification result meets first condition, the parameter of the data processing model is adjusted.
6. the method according to claim 1, wherein passing through the data with the model data described
Model is handled, classification processing is carried out to the security level of first request, when obtaining the classification results of first request, institute
State method further include:
In the case where first request meets second condition, for the first request addition first identifier, wherein described the
One mark is for identifying the safe condition of first request.
7. method as claimed in any of claims 1 to 6, which is characterized in that it is described will be at the behavioral data
When reason is the model data of data processing model, the method also includes:
Obtain the target sample of the data processing model and the sample observations of the target sample；
By the quantity of the sample size of the target sample and the sample observations, handling is the of the data processing model
One index, wherein the target sample includes the behavioral data, and first index is used to indicate the request of the client
By the data handling path in the data processing model, the generalization ability that is handled；
In the target sample, by the sample of each classification corresponding sample size and the target sample of the target sample
This quantity handles the second index for the data processing model, wherein second index, which is used to indicate, determines the client
The accuracy rate of the classification of the request at end；
By first index and second index, the classification scoring for the data processing model is handled, wherein the class
Each classification that the target sample Ping Fen be used to indicate is the degree of target category.
8. the method according to the description of claim 7 is characterized in that
The quantity by the sample size of the target sample and the sample observations is handled as the data processing model
The first index include: that first Index A is obtained by following first formula:
Wherein, samples is used to indicate the sample size of the target sample, and n is for indicating the target sample
The quantity of this sample observations.
9. the method according to the description of claim 7 is characterized in that the corresponding sample of each classification by the target sample
The sample size of this quantity and the target sample, handling as the second index of the data processing model includes: by as follows
Second formula obtains the second index B:
Wherein, maxvalueiThe sample size under i-th of classification for indicating the target sample is big
The sample size under classification in multiple classifications of the target sample in addition to i-th of classification.
10. the method according to the description of claim 7 is characterized in that described by first index and second index, place
Reason is that the classification scoring of the data processing model includes: to obtain the classification scoring C by following third formula:
Wherein, samples is used to indicate that the sample size of the target sample, n to be used for
Indicate the quantity of the sample observations of the target sample, maxvalueiUnder i-th of classification for indicating the target sample
Sample size be greater than the target sample multiple classifications in, the corresponding sample number of classification in addition to i-th of classification
Amount.
11. the method according to the description of claim 7 is characterized in that described by first index and second index,
After processing is the classification scoring of the data processing model, the method also includes:
In the data processing model, node corresponding to the second index greater than target value is filtered out；
In the data processing model in filtered node, score according to classification corresponding with the filtered node,
The filtered node is ranked up, ranking results are obtained；
It is destination node by the vertex ticks that ranking is predetermined sequence, wherein the destination node pair in the ranking results
The behavioral data answered robber's chain behavioral data to be determined for the client.
12. according to the method for claim 11, which is characterized in that be by the vertex ticks that ranking is predetermined sequence described
After destination node, the method also includes:
Obtain data on the corresponding line of the destination node, wherein on the line data be to the data processing model into
When being predicted on line, the behavioral data of the client corresponding with the destination node；
Data on the corresponding line of the destination node are verified, the second verification result is obtained；
In the case where second verification result meets third condition, determine that the classification of the corresponding data of the destination node is
The target category.
13. a kind of data processing equipment characterized by comprising
Acquiring unit, for obtaining the behavioral data of client；
First processing units, for the behavioral data to be handled to the model data for data processing model, wherein have described
The data processing model of model data, for carrying out classification processing, first request to the security level of the first request
Object event is triggered for the client request；
The second processing unit, for requesting described first by the data processing model with the model data
Security level carries out classification processing, obtains the classification results of first request, wherein the classification results are used to indicate described
The security level of first request；
Operating unit, for carrying out operation corresponding with the classification results to first request.
14. a kind of storage medium, which is characterized in that the storage medium includes the program of storage, wherein when described program is run
Execute data processing method described in any one of claim 1 to 12.
15. a kind of electronic device, including memory, processor and it is stored on the memory and can transports on the processor
Capable computer program, which is characterized in that the processor executes the claim 1 to 12 times by the computer program
Data processing method described in one.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201710754737.6A CN109426700B (en) | 2017-08-28 | 2017-08-28 | Data processing method, data processing device, storage medium and electronic device |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201710754737.6A CN109426700B (en) | 2017-08-28 | 2017-08-28 | Data processing method, data processing device, storage medium and electronic device |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN109426700A true CN109426700A (en) | 2019-03-05 |
| CN109426700B CN109426700B (en) | 2023-04-25 |
Family
ID=65503335
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201710754737.6A Active CN109426700B (en) | 2017-08-28 | 2017-08-28 | Data processing method, data processing device, storage medium and electronic device |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN109426700B (en) |
Cited By (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN111063230A (en) * | 2019-12-13 | 2020-04-24 | 中国人民解放军空军工程大学 | Motion filter of simulation training simulation system |
| CN111818305A (en) * | 2020-07-09 | 2020-10-23 | 杭州海康威视数字技术股份有限公司 | Distributed system, service control method and device |
| WO2020232899A1 (en) * | 2019-05-23 | 2020-11-26 | 平安科技（深圳）有限公司 | Troubleshooting method for data analysis system, and related device |
| CN112115468A (en) * | 2020-09-07 | 2020-12-22 | 沈建锋 | Service information detection method based on big data and cloud computing center |
| CN112637148A (en) * | 2020-12-11 | 2021-04-09 | 平安普惠企业管理有限公司 | Method, device, electronic equipment and medium for verifying user |
Citations (9)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN102385705A (en) * | 2010-09-02 | 2012-03-21 | 大猩猩科技股份有限公司 | Abnormal behavior detection system and method by utilizing automatic multi-feature clustering method |
| CN102724317A (en) * | 2012-06-21 | 2012-10-10 | 华为技术有限公司 | Network data flow classification method and device |
| CN105516211A (en) * | 2016-02-06 | 2016-04-20 | 北京祥云天地科技有限公司 | Method, device and system for recognizing database accessing behaviors based on behavior model |
| CN105897676A (en) * | 2015-12-01 | 2016-08-24 | 乐视网信息技术（北京）股份有限公司 | User resource access behavior processing method and device |
| US20160255139A1 (en) * | 2016-03-12 | 2016-09-01 | Yogesh Chunilal Rathod | Structured updated status, requests, user data & programming based presenting & accessing of connections or connectable users or entities and/or link(s) |
| CN106354799A (en) * | 2016-08-26 | 2017-01-25 | 河海大学 | Subject data set multi-layer facet filtration method and system based on data quality |
| CN106384282A (en) * | 2016-06-14 | 2017-02-08 | 平安科技（深圳）有限公司 | Method and device for building decision-making model |
| CN106611189A (en) * | 2016-06-28 | 2017-05-03 | 四川用联信息技术有限公司 | Method for constructing integrated classifier of standardized multi-dimensional cost sensitive decision-making tree |
| CN107015993A (en) * | 2016-01-28 | 2017-08-04 | 中国移动通信集团上海有限公司 | A kind of user type recognition methods and device |
-
2017
- 2017-08-28 CN CN201710754737.6A patent/CN109426700B/en active Active
Patent Citations (9)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN102385705A (en) * | 2010-09-02 | 2012-03-21 | 大猩猩科技股份有限公司 | Abnormal behavior detection system and method by utilizing automatic multi-feature clustering method |
| CN102724317A (en) * | 2012-06-21 | 2012-10-10 | 华为技术有限公司 | Network data flow classification method and device |
| CN105897676A (en) * | 2015-12-01 | 2016-08-24 | 乐视网信息技术（北京）股份有限公司 | User resource access behavior processing method and device |
| CN107015993A (en) * | 2016-01-28 | 2017-08-04 | 中国移动通信集团上海有限公司 | A kind of user type recognition methods and device |
| CN105516211A (en) * | 2016-02-06 | 2016-04-20 | 北京祥云天地科技有限公司 | Method, device and system for recognizing database accessing behaviors based on behavior model |
| US20160255139A1 (en) * | 2016-03-12 | 2016-09-01 | Yogesh Chunilal Rathod | Structured updated status, requests, user data & programming based presenting & accessing of connections or connectable users or entities and/or link(s) |
| CN106384282A (en) * | 2016-06-14 | 2017-02-08 | 平安科技（深圳）有限公司 | Method and device for building decision-making model |
| CN106611189A (en) * | 2016-06-28 | 2017-05-03 | 四川用联信息技术有限公司 | Method for constructing integrated classifier of standardized multi-dimensional cost sensitive decision-making tree |
| CN106354799A (en) * | 2016-08-26 | 2017-01-25 | 河海大学 | Subject data set multi-layer facet filtration method and system based on data quality |
Non-Patent Citations (2)
| Title |
|---|
| CLARA ROCHA 等: "An algorithm for ordinal sorting based on ELECTRE with categories defined by examples" * |
| 梁晓月: "中文问答系统中问题分类相关技术的研究" * |
Cited By (8)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| WO2020232899A1 (en) * | 2019-05-23 | 2020-11-26 | 平安科技（深圳）有限公司 | Troubleshooting method for data analysis system, and related device |
| CN111063230A (en) * | 2019-12-13 | 2020-04-24 | 中国人民解放军空军工程大学 | Motion filter of simulation training simulation system |
| CN111818305A (en) * | 2020-07-09 | 2020-10-23 | 杭州海康威视数字技术股份有限公司 | Distributed system, service control method and device |
| CN111818305B (en) * | 2020-07-09 | 2021-12-10 | 杭州海康威视数字技术股份有限公司 | Distributed system, service control method and device |
| CN112115468A (en) * | 2020-09-07 | 2020-12-22 | 沈建锋 | Service information detection method based on big data and cloud computing center |
| CN112115468B (en) * | 2020-09-07 | 2021-04-02 | 深圳市瑞冠信息科技有限公司 | Service information detection method based on big data and cloud computing center |
| CN112637148A (en) * | 2020-12-11 | 2021-04-09 | 平安普惠企业管理有限公司 | Method, device, electronic equipment and medium for verifying user |
| CN112637148B (en) * | 2020-12-11 | 2022-10-21 | 平安普惠企业管理有限公司 | Method, device, electronic equipment and medium for verifying user |
Also Published As
| Publication number | Publication date |
|---|---|
| CN109426700B (en) | 2023-04-25 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN109426700A (en) | Data processing method, device, storage medium and electronic device | |
| CN109922032B (en) | Method, device, equipment and storage medium for determining risk of logging in account | |
| CN108156131B (en) | Webshell detection method, electronic device and computer storage medium | |
| CN110009171B (en) | User behavior simulation method, device, equipment and computer readable storage medium | |
| CN103530365B (en) | Obtain the method and system of the download link of resource | |
| CN109241711A (en) | User behavior recognition method and device based on prediction model | |
| CN107332811A (en) | The methods, devices and systems of intrusion detection | |
| CN106777024A (en) | Recognize the method and device of malicious user | |
| CN108334758A (en) | A kind of detection method, device and the equipment of user's ultra vires act | |
| CN107733863A (en) | Daily record adjustment method and device under a kind of distributed hadoop environment | |
| CN110493262A (en) | It is a kind of to improve the network attack detecting method classified and system | |
| Kistijantoro | Vitality based feature selection for intrusion detection | |
| CN110008976A (en) | A kind of network behavior classification method and device | |
| Neri | Comparing local search with respect to genetic evolution to detect intrusions in computer networks | |
| Garcia et al. | A deep learning-based intrusion detection and preventation system for detecting and preventing denial-of-service attacks | |
| CN110572302B (en) | Diskless local area network scene identification method and device and terminal | |
| CN104731937A (en) | User behavior data processing method and device | |
| CN110598794A (en) | Classified countermeasure network attack detection method and system | |
| CN112822223A (en) | DNS hidden tunnel event automatic detection method and device and electronic equipment | |
| CN110519228B (en) | Method and system for identifying malicious cloud robot in black-production scene | |
| CN112184241A (en) | Identity authentication method and device | |
| CN106039711A (en) | User identity authentication method and device | |
| Farid et al. | Learning intrusion detection based on adaptive bayesian algorithm | |
| CN106789411B (en) | Method and device for acquiring active IP data in machine room | |
| Merkle | Automated network forensics |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |