CN109492394A - The recognition methods of abnormal traffic request and terminal device - Google Patents
The recognition methods of abnormal traffic request and terminal device Download PDFInfo
- Publication number
- CN109492394A CN109492394A CN201811249394.9A CN201811249394A CN109492394A CN 109492394 A CN109492394 A CN 109492394A CN 201811249394 A CN201811249394 A CN 201811249394A CN 109492394 A CN109492394 A CN 109492394A
- Authority
- CN
- China
- Prior art keywords
- service request
- matrix
- preset
- cluster centre
- traffic
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
- 230000002159 abnormal effect Effects 0.000 title claims abstract description 49
- 238000000034 method Methods 0.000 title claims abstract description 39
- 239000011159 matrix material Substances 0.000 claims abstract description 177
- 238000012417 linear regression Methods 0.000 claims description 31
- 238000004590 computer program Methods 0.000 claims description 14
- 238000006243 chemical reaction Methods 0.000 claims description 4
- 239000004744 fabric Substances 0.000 claims description 2
- 230000032258 transport Effects 0.000 claims 1
- 230000006870 function Effects 0.000 description 7
- 238000010586 diagram Methods 0.000 description 4
- 238000004458 analytical method Methods 0.000 description 3
- 238000004364 calculation method Methods 0.000 description 2
- 230000005856 abnormality Effects 0.000 description 1
- 229910002056 binary alloy Inorganic materials 0.000 description 1
- 230000005611 electricity Effects 0.000 description 1
- 238000005516 engineering process Methods 0.000 description 1
- 238000009434 installation Methods 0.000 description 1
- 238000000926 separation method Methods 0.000 description 1
- 239000002699 waste material Substances 0.000 description 1
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
- G06F21/57—Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
- G06F21/55—Detecting local intrusion or implementing counter-measures
- G06F21/56—Computer malware detection or handling, e.g. anti-virus arrangements
- G06F21/566—Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
-
- Y—GENERAL TAGGING OF NEW TECHNOLOGICAL DEVELOPMENTS; GENERAL TAGGING OF CROSS-SECTIONAL TECHNOLOGIES SPANNING OVER SEVERAL SECTIONS OF THE IPC; TECHNICAL SUBJECTS COVERED BY FORMER USPC CROSS-REFERENCE ART COLLECTIONS [XRACs] AND DIGESTS
- Y02—TECHNOLOGIES OR APPLICATIONS FOR MITIGATION OR ADAPTATION AGAINST CLIMATE CHANGE
- Y02D—CLIMATE CHANGE MITIGATION TECHNOLOGIES IN INFORMATION AND COMMUNICATION TECHNOLOGIES [ICT], I.E. INFORMATION AND COMMUNICATION TECHNOLOGIES AIMING AT THE REDUCTION OF THEIR OWN ENERGY USE
- Y02D10/00—Energy efficient computing, e.g. low power processors, power management or thermal management
Landscapes
- Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Computer Hardware Design (AREA)
- General Engineering & Computer Science (AREA)
- Software Systems (AREA)
- Theoretical Computer Science (AREA)
- General Physics & Mathematics (AREA)
- Physics & Mathematics (AREA)
- Health & Medical Sciences (AREA)
- General Health & Medical Sciences (AREA)
- Virology (AREA)
- Debugging And Monitoring (AREA)
- Management, Administration, Business Operations System, And Electronic Commerce (AREA)
- Data Exchanges In Wide-Area Networks (AREA)
Abstract
The present invention is suitable for technical field of data processing, provide recognition methods and the terminal device of a kind of request of abnormal traffic, by the way that service request received in preset time period is stored in presetting database, and delete the service request received before preset time period, real-time update presetting database；If the receiving time of each service request meets preset Annual distribution standard in presetting database, data type that service request is included and the corresponding relationship of data value are converted into the corresponding traffic matrix of each service request；Calculate the cluster centre matrix of the preset quantity of whole traffic matrixs, the similarity of a cluster centre matrix and whole preset R-matrixes is respectively less than similarity threshold if it exists, it is abnormal then to determine that the service request in preset time period exists, allow user by reducing preset time period, the more real-time abnormal conditions for grasping service request, to take countermeasure in time, the normal operation of server is ensured.
Description
Technical field
The recognition methods and terminal requested the invention belongs to technical field of data processing more particularly to a kind of abnormal traffic are set
It is standby.
Background technique
Currently, the server of a large corporation needs a large amount of service request of processing in the short time, but may be due to
There are a large amount of abnormal traffic requests in a short time in the reasons such as malicious attack or service request method, system are abnormal, these abnormal industry
Business request may cause damages to the normal operation of server, while can also waste the process resource of server.
Existing security defensive system is difficult to judge in real time in a certain very short period with the presence or absence of more different
Normal service request, generally requiring engineering staff just can recognize that abnormal industry by subsequent analysis after being spaced longer time
Business request, and lock the period for a large amount of abnormal traffic requests occur.Obviously, current abnormal traffic is requested in identification process
Real-time is poor, and the normal operation of server may be on the hazard.
Summary of the invention
In view of this, the embodiment of the invention provides a kind of recognition methods of abnormal traffic request and terminal devices, with solution
Certainly the prior art has that real-time is poor in the abnormal service request of identification.
The first aspect of the embodiment of the present invention provides a kind of recognition methods of abnormal traffic request, comprising:
The service request received in preset time period is stored in presetting database, and will have been deposited in the presetting database
The service request that receives before preset time period of storage is deleted, to update the presetting database, in the service request
Corresponding relationship comprising multiple data types and data value, the data type include the receiving time of service request；Judge institute
Whether the receiving time for stating each service request in presetting database meets preset Annual distribution standard；If described default
The receiving time of each service request meets preset Annual distribution standard in database, then will be in the presetting database
It is corresponding that the data type that each service request is included with the corresponding relationship of data value is converted to each service request
Traffic matrix；Calculate the cluster centre matrix of the preset quantity of whole traffic matrixs, if it exists a cluster centre matrix with
All the similarity of preset R-matrix is respectively less than similarity threshold, then determines that the service request in the preset time period is deposited
In exception.
The second aspect of the embodiment of the present invention provides a kind of terminal device, including memory and processor, described to deposit
The computer program that can be run on the processor is stored in reservoir, when the processor executes the computer program,
Realize following steps:
The service request received in preset time period is stored in presetting database, and will have been deposited in the presetting database
The service request that receives before preset time period of storage is deleted, to update the presetting database, in the service request
Corresponding relationship comprising multiple data types and data value, the data type include the receiving time of service request；Judge institute
Whether the receiving time for stating each service request in presetting database meets preset Annual distribution standard；If described default
The receiving time of each service request meets preset Annual distribution standard in database, then will be in the presetting database
It is corresponding that the data type that each service request is included with the corresponding relationship of data value is converted to each service request
Traffic matrix；Calculate the cluster centre matrix of the preset quantity of whole traffic matrixs, if it exists a cluster centre matrix with
All the similarity of preset R-matrix is respectively less than similarity threshold, then determines that the service request in the preset time period is deposited
In exception.
The third aspect of the embodiment of the present invention provides a kind of identification device of abnormal traffic request, comprising:
Update module, the service request for will receive in preset time period are stored in presetting database, and will be described pre-
If the stored service request received before preset time period is deleted in database, to update the presetting database,
It include the corresponding relationship of multiple data types and data value in the service request, the data type includes connecing for service request
Between time receiving；Judgment module, for judging it is pre- whether the receiving time of each service request in the presetting database meets
If Annual distribution standard；Conversion module, if the receiving time for the service request each in the presetting database accords with
Preset Annual distribution standard is closed, then the data type and number for being included by the service request each in the presetting database
The corresponding traffic matrix of each service request is converted to according to the corresponding relationship of value；Computing module, for calculating whole business
The cluster centre matrix of the preset quantity of matrix, a cluster centre matrix is similar to all preset R-matrixes if it exists
Degree is respectively less than similarity threshold, then it is abnormal to determine that the service request in the preset time period exists.
The fourth aspect of the embodiment of the present invention provides a kind of computer readable storage medium, the computer-readable storage
Media storage has computer program, and the computer program realizes following steps when being executed by processor:
The service request received in preset time period is stored in presetting database, and will have been deposited in the presetting database
The service request that receives before preset time period of storage is deleted, to update the presetting database, in the service request
Corresponding relationship comprising multiple data types and data value, the data type include the receiving time of service request；Judge institute
Whether the receiving time for stating each service request in presetting database meets preset Annual distribution standard；If described default
The receiving time of each service request meets preset Annual distribution standard in database, then will be in the presetting database
It is corresponding that the data type that each service request is included with the corresponding relationship of data value is converted to each service request
Traffic matrix；Calculate the cluster centre matrix of the preset quantity of whole traffic matrixs, if it exists a cluster centre matrix with
All the similarity of preset R-matrix is respectively less than similarity threshold, then determines that the service request in the preset time period is deposited
In exception.
In embodiments of the present invention, it by the way that service request received in preset time period is stored in presetting database, and deletes
Except the service request received before preset time period, real-time update presetting database；If each business is asked in presetting database
The receiving time asked meets preset Annual distribution standard, then the data type for being included by service request is corresponding with data value
Relationship is converted to the corresponding traffic matrix of each service request；Calculate the cluster centre square of the preset quantity of whole traffic matrixs
Battle array, the similarity of a cluster centre matrix and whole preset R-matrixes is respectively less than similarity threshold if it exists, then determines
There is exception in the service request in preset time period, user is passed through and reduces preset time period, more real-time to grasp
The abnormal conditions of service request ensure the normal operation of server to take countermeasure in time.
Detailed description of the invention
It to describe the technical solutions in the embodiments of the present invention more clearly, below will be to embodiment or description of the prior art
Needed in attached drawing be briefly described, it should be apparent that, the accompanying drawings in the following description is only of the invention some
Embodiment for those of ordinary skill in the art without any creative labor, can also be according to these
Attached drawing obtains other attached drawings.
Fig. 1 is the implementation flow chart of the recognition methods of abnormal traffic request provided in an embodiment of the present invention；
Fig. 2 is the specific implementation flow chart of the recognition methods S102 of abnormal traffic request provided in an embodiment of the present invention；
Fig. 3 is the specific implementation flow chart of the recognition methods S105 of abnormal traffic request provided in an embodiment of the present invention；
Fig. 4 is the structural block diagram of the identification device of abnormal traffic request provided in an embodiment of the present invention；
Fig. 5 is the schematic diagram of server provided in an embodiment of the present invention.
Specific embodiment
In being described below, for illustration and not for limitation, the tool of such as particular system structure, technology etc is proposed
Body details, to understand thoroughly the embodiment of the present invention.However, it will be clear to one skilled in the art that there is no these specific
The present invention also may be implemented in the other embodiments of details.In other situations, it omits to well-known system, device, electricity
The detailed description of road and method, in case unnecessary details interferes description of the invention.
In order to illustrate technical solutions according to the invention, the following is a description of specific embodiments.
Fig. 1 shows the implementation process of the recognition methods of abnormal traffic request provided in an embodiment of the present invention, this method stream
Journey includes step S101 to S107.The specific implementation principle of each step is as follows.
The service request received in preset time period is stored in presetting database by S101, and by the presetting database
The interior stored service request received before preset time period is deleted, to update the presetting database.
It in embodiments of the present invention, include the corresponding relationship of multiple data types and data value, institute in the service request
State the receiving time that data type includes service request.
In embodiments of the present invention, it is analyzed primarily directed to the service request stored in presetting database, in order to protect
The real-time for demonstrate,proving analysis needs just to be updated the service request in presetting database at interval of a period of time.It is understood that
Ground, by adjusting the size of the duration of preset time period, thus it is possible to vary the real-time journey identified is requested for abnormal traffic
Degree, wherein the duration of preset time period is smaller, and the real-time identified for abnormal traffic request is better, because can incite somebody to action
The period for a large amount of abnormal traffic requests occur foreshortens to a smaller range, and user is facilitated to make counter-measure in time.
It is to be appreciated that updating the method for the presetting database are as follows: the service request that will be received in preset time period
It is stored in presetting database, and the service request received before preset time period stored in the presetting database is deleted
It removes.For example, preset time period can be 10 seconds before current time to the period between current time.
In embodiments of the present invention, the data value of multiple data types, optionally, data type are contained in service request
It include: the excellent of the receiving time of service request, the request object of service request, the request type of service request and service request
First grade etc..
It is to be appreciated that the case where service request can be understood from various dimensions by the data for including in service request, and
Further service request is analyzed in the follow-up process.
S102, judges whether the receiving time of each service request in the presetting database meets the preset time
Distribution standard.
In embodiments of the present invention, the data value for the total data type for including in service request is not needed first
It is analyzed, but only the receiving time of one of data type, that is, service request is analyzed comprehensively first.It does so
The reason of be, be often in the short time by the way of if there is personnel's malicious attack traffic system under normal circumstances
It is interior to send a large amount of service request, so being to meet preset Annual distribution standard in the receiving time for first determining whether service request
Under the premise of, then the subsequent comprehensive analysis to total data type is carried out, be conducive to save computing resource, and maliciously attacking
Note abnormalities request as early as possible in the case where hitting.
Optionally, judge whether the receiving time of each service request in presetting database meets the preset time point
Cloth standard can pass through: preset time period are divided into multiple unit intervals, and when according to the reception of each service request
Between, the quantity of the corresponding service request of each unit interval is calculated, if it exists the corresponding service request of a unit interval
Quantity be greater than preset conventional amounts threshold value, then determine that the receiving time of each service request in presetting database is not inconsistent
Preset Annual distribution standard is closed, the quantity of the corresponding service request of a unit interval is greater than preset routine if it does not exist
Amount threshold then determines that the receiving time of each service request in presetting database meets preset Annual distribution standard.
Optionally, since in some systems, under normal circumstances, quantity of service request itself will be according to the time
Change and occur increasing or reduce along a linear change track, so in such a case, it is possible to first fitting normal line
Property variation track, and calculate in preset time period whether there is the corresponding true service request of a unit interval quantity
The linear change track is deviated from, the quantity of the corresponding service request of a unit interval deviates from the linear change if it exists
Track has been more than preset coefficient of deviation, then it is pre- to determine that the receiving time of each service request in presetting database is not met
If Annual distribution standard, the quantity of the corresponding service request of a unit interval deviates the linear change track if it does not exist
More than preset coefficient of deviation, then determine that the receiving time of each service request in presetting database meets the preset time
Distribution standard.Specific calculating process will be discussed in detail in embodiments below.
S103, if the receiving time of each service request does not meet preset Annual distribution in the presetting database
It is abnormal then to determine that the service request in the preset time period exists for standard.
S104, if the receiving time of each service request meets preset Annual distribution mark in the presetting database
Standard, then the corresponding relationship conversion of the data type and data value that are included by the service request each in the presetting database
For the corresponding traffic matrix of each service request.
In embodiments of the present invention, as explained above, when being received to one of data type in service request
Between verify it is errorless after, can just carry out a comprehensive verifyings to whole data types of each service request.
In embodiments of the present invention, the corresponding relationship of the data type for being included by each service request and data value is needed
It is converted into a traffic matrix.Specifically, each data type has the section in its corresponding matrix, by each data type
After corresponding data value is converted into binary system, it is stored in the section in the corresponding matrix of each data type, to generate traffic matrix.
S105 calculates the cluster centre matrix of the preset quantity of whole traffic matrixs.
In embodiments of the present invention, a cluster centre, root can be determined in the close multiple traffic matrixs of similarity
According to the cluster centre for being redefined for whole traffic matrixs and determining preset quantity of engineering staff.
S106, the similarity of a cluster centre matrix and whole preset R-matrixes is respectively less than similarity threshold if it exists
It is abnormal then to determine that the service request in the preset time period exists for value.
In embodiments of the present invention, preset R-matrix is according to the service request meter in the presetting database before update
The essence of the cluster centre matrix of calculating, i.e. this step judgement are as follows: according to service request pair each in current presetting database
The cluster centre matrix that the traffic matrix answered generates whether at least updated with one before presetting database in each service request
The similarity for the cluster centre matrix that corresponding traffic matrix generates is sufficiently large.
It is to be appreciated that since the service request in the embodiment of the present invention in presetting database is all real-time change, more
The service request in the service request and current presetting database in presetting database before new can exist it is more than one not
Together, so the cluster centre matrix of calculated preset quantity, the only cluster centre matrix of a certain preset time period, when default
After database update, cluster centre can be moved with the addition of new traffic matrix and the removal of old traffic matrix,
But according to our data statistics, the distance of this movement should be in reasonable range under normal circumstances.So if pre-
If after database update, there are the similarities of a cluster centre matrix and whole preset R-matrixes to be respectively less than similarity threshold
Value, that is, the distance that there is the movement of at least one cluster centre matrix is excessive, then when determining described default in embodiments of the present invention
Between service request in section exist it is abnormal.
Notably, in the service request determined in the preset time period, there are after exception, further includes: will
The cluster centre matrix is set as the updated R-matrix.
It is to be appreciated that doing standard by updating R-matrix to compare cluster centre matrix next time with the presence or absence of abnormal
It is standby.
S107, the similarity of a cluster centre matrix and whole preset R-matrixes is respectively less than similarity if it does not exist
It is abnormal then to determine that the service request in the preset time period is not present for threshold value.
Notably, in the service request determined in the preset time period, there is no after exception, further includes:
The cluster centre matrix is set as the updated R-matrix.
It is to be appreciated that doing standard by updating R-matrix to compare cluster centre matrix next time with the presence or absence of abnormal
It is standby.
It is to be appreciated that in embodiments of the present invention, it is default by the way that service request received in preset time period to be stored in
Database, and delete the service request received before preset time period, real-time update presetting database；If in presetting database
The receiving time of each service request meets preset Annual distribution standard, the then data type for being included by service request and number
The corresponding traffic matrix of each service request is converted to according to the corresponding relationship of value；Calculate the poly- of the preset quantity of whole traffic matrixs
Class center matrix, the similarity of a cluster centre matrix and whole preset R-matrixes is respectively less than similarity threshold if it exists
It is abnormal then to determine that the service request in preset time period exists, allows user by reducing preset time period, more in fact for value
When the abnormal conditions of grasp service request ensure the normal operation of server to take countermeasure in time.
As an embodiment of the present invention, as shown in Fig. 2, above-mentioned S102 includes:
S1021 calculates the corresponding business of multiple unit time periods and asks according to the receiving time of each service request
The quantity asked generates the corresponding relationship of the quantity of unit interval and service request.
Illustratively, it is assumed that in embodiments of the present invention, the 10:00:01-10:00:10 of preset time period, the unit time
Section when it is 1 second a length of, then preset time period is divided into 10 unit intervals, count in each unit interval how many
Service request, the i.e. corresponding relationship of the quantity of generation unit interval and service request.
S1022 is fitted the quantity of the unit interval and service request in preset time period by linear regression model (LRM)
Corresponding relationship, and the linear regression coeffficient of the equation of linear regression is calculated according to least square method, to generate linear regression side
Journey.
The linear regression model (LRM) are as follows: Y (n)=aX (n)+b, the Y (n) are n-th of unit in the preset time period
The quantity of period corresponding service request, the X (n) are n-th of unit interval in the preset time period, and a is
The linear regression coeffficient, the b are error coefficient.
Illustratively, it is assumed that preset time period is 10 seconds, and each unit interval is successively sorted sequentially in time, will
The X (n) of first unit interval is set as 1, and the X (n) of second unit interval is set as 2, when by third unit
Between the X (n) of section be set as 3, and so on, X (n) indicates n-th of unit interval in 10 seconds as independent variable.
After the corresponding relationship for counting the unit interval in preset time period and the quantity of call request, Ke Yitong
Cross linear regression coeffficient and error coefficient that least square method calculates the equation of linear regression.
S1023 calculates the theoretical quantity of the corresponding service request of each unit interval by the equation of linear regression,
And calculate the difference of the quantity of the corresponding service request of each unit interval and the theoretical quantity of the service request.
It is to be appreciated that bringing the value of X (n) into after calculating equation of linear regression, each unit time can be calculated
The theoretical quantity of the corresponding service request of section.And the quantity and the service request of the corresponding service request of each unit interval
Theoretical quantity difference be exactly true value and theoretical value gap.
S1024 determines described default if the corresponding difference of whole unit intervals is less than preset difference threshold
The receiving time of each service request meets preset Annual distribution standard in database.
It is to be appreciated that can prove the number there is no the corresponding service request of a unit interval in this case
It is more than preset coefficient of deviation that amount, which deviates the linear change track, then determines connecing for each service request in presetting database
Meet preset Annual distribution standard between time receiving.
As an embodiment of the present invention, as shown in figure 3, above-mentioned S105 includes:
S1051 arbitrarily chooses the traffic matrix of the preset quantity as initially in whole traffic matrixs
Cluster centre matrix.
In embodiments of the present invention, n traffic matrix is arbitrarily chosen as cluster centre square in whole traffic matrixs
Battle array, it is possible to understand that ground, n are the integer greater than 1 and less than traffic matrix sum.
S1052, calculate each traffic matrix to each cluster centre matrix Euclidean distance, by each traffic matrix
It is included into set of matrices corresponding with the smallest cluster centre matrix of its Euclidean distance.
Illustratively, it is assumed that whole traffic matrixs includes: K1, K2, K3, K4, K5, K6, K7, K8, K9, K10, it is assumed that when
Preceding cluster centre matrix is n1, n2 and n3, and by calculate each traffic matrix to cluster centre matrix it is European away from
From showing that the distance of traffic matrix K1, K2 and K9 and n1 are smaller than with the distance of n2 or n3, then K1, K2 and K9 be included into n1
Corresponding set of matrices.
S1053 calculates in the corresponding set of matrices of each cluster centre matrix each same position in whole traffic matrixs
Element average value, to generate the corresponding mean matrix of each cluster centre matrix, and the cluster centre matrix is corresponding
Mean matrix as updated cluster centre matrix.
Illustratively, as described in example above, it is assumed that the corresponding set of matrices of cluster centre matrix n1 include K1, K2 and
K9 then calculates the average value of traffic matrix K1, traffic matrix K2 and traffic matrix K9 corresponding position element, to generate three industry
The mean matrix n4 of business matrix, and replace n1 as new cluster centre n4.
S1054, judges whether updated cluster centre matrix meets termination condition.
It is optionally, described to judge whether updated cluster centre matrix meets termination condition, comprising:
Calculate the Euclidean distance of each traffic matrix in the corresponding set of matrices of each cluster centre matrix
The sum of average value, as cluster error；
If the cluster error is greater than preset error threshold, updated cluster centre matrix is unsatisfactory for terminating item
Part；
If the cluster error is less than or equal to preset error threshold, updated cluster centre matrix, which meets, to be terminated
Condition.
S1055 returns to execution and calculates each traffic matrix to respectively if the cluster centre matrix is unsatisfactory for termination condition
Each traffic matrix is included into and the smallest cluster centre matrix of its Euclidean distance by the Euclidean distance of a cluster centre matrix
The operation of corresponding set of matrices.
S1056 exports whole cluster centre matrixes if the cluster centre matrix meets termination condition.
In embodiments of the present invention, by multiple cycle calculations, the cluster centre matrix of preset quantity can be calculated.
Corresponding to the recognition methods of the request of abnormal traffic described in foregoing embodiments, Fig. 4 shows the embodiment of the present invention and mentions
The structural block diagram of the identification device of the abnormal traffic request of confession illustrates only related to the embodiment of the present invention for ease of description
Part.
Referring to Fig. 4, which includes:
Update module 401, the service request for will receive in preset time period are stored in presetting database, and will be described
The stored service request received before preset time period is deleted in presetting database, to update the preset data
Library includes the corresponding relationship of multiple data types and data value in the service request, and the data type includes service request
Receiving time；
Judgment module 402, for judging whether the receiving time of each service request in the presetting database accords with
Close preset Annual distribution standard；
Conversion module 403, if the receiving time for the service request each in the presetting database meet it is default
Annual distribution standard, then the data type for being included by the service request each in the presetting database and data value
Corresponding relationship is converted to the corresponding traffic matrix of each service request；
Computing module 404, the cluster centre matrix of the preset quantity for calculating whole traffic matrixs, one is gathered if it exists
The similarity of class center matrix and whole preset R-matrixes is respectively less than similarity threshold, then determines in the preset time period
Service request exist it is abnormal.
Optionally, whether the receiving time for judging each service request in the presetting database meets default
Annual distribution standard, comprising:
According to the receiving time of each service request, the number of the corresponding service request of multiple unit time periods is calculated
Amount generates the corresponding relationship of the quantity of unit interval and service request；Pass through linear regression model (LRM): Y (n)=aX (n)+b is quasi-
The corresponding relationship of the quantity of the unit interval and service request in preset time period is closed, and described in calculating according to least square method
The linear regression coeffficient of equation of linear regression, to generate equation of linear regression；The Y (n) is n-th in the preset time period
The quantity of the corresponding service request of unit interval, the X (n) is n-th of unit interval in the preset time period, described
A is the linear regression coeffficient, and the b is error coefficient；Each unit interval pair is calculated by the equation of linear regression
The theoretical quantity for the service request answered, and calculate the quantity and the business of the corresponding service request of each unit interval
The difference of the theoretical quantity of request；If the corresponding difference of whole unit interval is less than preset difference threshold, determine
The receiving time of each service request meets preset Annual distribution standard in the presetting database.
Optionally, the cluster centre matrix of the preset quantity for calculating whole traffic matrixs, comprising:
The traffic matrix of the preset quantity is arbitrarily chosen as in initial cluster in whole traffic matrixs
Heart matrix；Calculate each traffic matrix to each cluster centre matrix Euclidean distance, by each traffic matrix be included into
The corresponding set of matrices of the smallest cluster centre matrix of its Euclidean distance；Calculate the corresponding set of matrices of each cluster centre matrix
The average value of the element of each same position in middle whole traffic matrix, to generate the corresponding average square of each cluster centre matrix
Battle array, and using the corresponding mean matrix of the cluster centre matrix as updated cluster centre；Judge in updated cluster
Whether heart matrix meets termination condition；If the cluster centre matrix is unsatisfactory for termination condition, returns to execution and calculate each industry
Matrix be engaged in the Euclidean distance of each cluster centre matrix, each traffic matrix is included into the smallest poly- with its Euclidean distance
The operation of the corresponding set of matrices of class center matrix；If the cluster centre matrix meets termination condition, whole gather is exported
Class center matrix.
It is optionally, described to judge whether updated cluster centre matrix meets termination condition, comprising:
Calculate the Euclidean distance of each traffic matrix in the corresponding set of matrices of each cluster centre matrix
The sum of average value, as cluster error；If the cluster error is greater than preset error threshold, updated cluster centre square
Battle array is unsatisfactory for termination condition；If the cluster error is less than or equal to preset error threshold, updated cluster centre square
Battle array meets termination condition.
Optionally, in the service request determined in the preset time period, there are after exception, further includes: will be described
Cluster centre matrix is set as the updated R-matrix.
In embodiments of the present invention, it by the way that service request received in preset time period is stored in presetting database, and deletes
Except the service request received before preset time period, real-time update presetting database；If each business is asked in presetting database
The receiving time asked meets preset Annual distribution standard, then the data type for being included by service request is corresponding with data value
Relationship is converted to the corresponding traffic matrix of each service request；Calculate the cluster centre square of the preset quantity of whole traffic matrixs
Battle array, the similarity of a cluster centre matrix and whole preset R-matrixes is respectively less than similarity threshold if it exists, then determines
There is exception in the service request in preset time period, user is passed through and reduces preset time period, more real-time to grasp
The abnormal conditions of service request ensure the normal operation of server to take countermeasure in time.
Fig. 5 is the schematic diagram for the terminal device that one embodiment of the invention provides.As shown in figure 5, the terminal of the embodiment is set
Standby 5 include: processor 50, memory 51 and are stored in the meter that can be run in the memory 51 and on the processor 50
Calculation machine program 52, such as the recognizer of abnormal traffic request.The realization when processor 50 executes the computer program 52
Step in the recognition methods embodiment of above-mentioned each abnormal traffic request, such as step 101 shown in FIG. 1 is to 107.Alternatively,
The processor 50 realizes the function of each module/unit in above-mentioned each Installation practice, example when executing the computer program 52
The function of unit 401 to 404 as shown in Figure 4.
Illustratively, the computer program 52 can be divided into one or more module/units, it is one or
Multiple module/units are stored in the memory 51, and are executed by the processor 50, to complete the present invention.Described one
A or multiple module/units can be the series of computation machine program instruction section that can complete specific function, which is used for
Implementation procedure of the computer program 52 in the terminal device 5 is described.
The terminal device 5 can be the calculating such as desktop PC, notebook, palm PC and cloud terminal device and set
It is standby.The terminal device may include, but be not limited only to, processor 50, memory 51.It will be understood by those skilled in the art that Fig. 5
The only example of terminal device 5 does not constitute the restriction to terminal device 5, may include than illustrating more or fewer portions
Part perhaps combines certain components or different components, such as the terminal device can also include input-output equipment, net
Network access device, bus etc..
Alleged processor 50 can be central processing unit (Central Processing Unit, CPU), can also be
Other general processors, digital signal processor (Digital Signal Processor, DSP), specific integrated circuit
(Application Specific Integrated Circuit, ASIC), ready-made programmable gate array (Field-
Programmable Gate Array, FPGA) either other programmable logic device, discrete gate or transistor logic,
Discrete hardware components etc..General processor can be microprocessor or the processor is also possible to any conventional processor
Deng.
The memory 51 can be the internal storage unit of the terminal device 5, such as the hard disk or interior of terminal device 5
It deposits.The memory 51 is also possible to the External memory equipment of the terminal device 5, such as be equipped on the terminal device 5
Plug-in type hard disk, intelligent memory card (Smart Media Card, SMC), secure digital (Secure Digital, SD) card dodge
Deposit card (Flash Card) etc..Further, the memory 51 can also both include the storage inside list of the terminal device 5
Member also includes External memory equipment.The memory 51 is for storing needed for the computer program and the terminal device
Other programs and data.The memory 51 can be also used for temporarily storing the data that has exported or will export.
It is apparent to those skilled in the art that for convenience of description and succinctly, only with above-mentioned each function
Can unit, module division progress for example, in practical application, can according to need and by above-mentioned function distribution by different
Functional unit, module are completed, i.e., the internal structure of described device is divided into different functional unit or module, more than completing
The all or part of function of description.Each functional unit in embodiment, module can integrate in one processing unit, can also
To be that each unit physically exists alone, can also be integrated in one unit with two or more units, it is above-mentioned integrated
Unit both can take the form of hardware realization, can also realize in the form of software functional units.In addition, each function list
Member, the specific name of module are also only for convenience of distinguishing each other, the protection scope being not intended to limit this application.Above system
The specific work process of middle unit, module, can refer to corresponding processes in the foregoing method embodiment, and details are not described herein.
In the above-described embodiments, it all emphasizes particularly on different fields to the description of each embodiment, is not described in detail or remembers in some embodiment
The part of load may refer to the associated description of other embodiments.
The unit as illustrated by the separation member may or may not be physically separated, aobvious as unit
The component shown may or may not be physical unit, it can and it is in one place, or may be distributed over multiple
In network unit.It can select some or all of unit therein according to the actual needs to realize the mesh of this embodiment scheme
's.
If the integrated module/unit be realized in the form of SFU software functional unit and as independent product sale or
In use, can store in a computer readable storage medium.Based on this understanding, the present invention realizes above-mentioned implementation
All or part of the process in example method, can also instruct relevant hardware to complete, the meter by computer program
Calculation machine program can be stored in a computer readable storage medium.
Embodiment described above is merely illustrative of the technical solution of the present invention, rather than its limitations；Although referring to aforementioned reality
Applying example, invention is explained in detail, those skilled in the art should understand that: it still can be to aforementioned each
Technical solution documented by embodiment is modified or equivalent replacement of some of the technical features；And these are modified
Or replacement, the spirit and scope for technical solution of various embodiments of the present invention that it does not separate the essence of the corresponding technical solution should all
It is included within protection scope of the present invention.
Claims (10)
1. a kind of recognition methods of abnormal traffic request characterized by comprising
The service request received in preset time period is stored in presetting database, and will be stored in the presetting database
The service request received before preset time period is deleted, and to update the presetting database, includes in the service request
The corresponding relationship of multiple data types and data value, the data type include the receiving time of service request；
Judge whether the receiving time of each service request in the presetting database meets preset Annual distribution standard；
If the receiving time of each service request meets preset Annual distribution standard in the presetting database, by institute
The corresponding relationship for stating each service request is included in presetting database data type and data value is converted to each institute
State the corresponding traffic matrix of service request；
The cluster centre matrix of the preset quantity of whole traffic matrixs is calculated, a cluster centre matrix is preset with whole if it exists
The similarity of R-matrix be respectively less than similarity threshold, then it is abnormal to determine that the service request in the preset time period exists.
2. the recognition methods of abnormal traffic request as described in claim 1, which is characterized in that the judgement preset data
Whether the receiving time of each service request meets preset Annual distribution standard in library, comprising:
According to the receiving time of each service request, the quantity of the corresponding service request of multiple unit time periods is calculated,
Generate the corresponding relationship of the quantity of unit interval and service request；
Pass through linear regression model (LRM): the number of unit interval and service request in Y (n)=aX (n)+b fitting preset time period
The corresponding relationship of amount, and the linear regression coeffficient of the equation of linear regression is calculated according to least square method, to generate linear return
Return equation；The Y (n) is the quantity of the corresponding service request of n-th of unit interval in the preset time period, the X (n)
For n-th of unit interval in the preset time period, a is the linear regression coeffficient, and the b is error coefficient；
The theoretical quantity of the corresponding service request of each unit interval is calculated by the equation of linear regression, and is calculated each
The difference of the theoretical quantity of the quantity and service request of the corresponding service request of unit interval；
If the corresponding difference of whole unit interval is less than preset difference threshold, determine each in the presetting database
The receiving time of a service request meets preset Annual distribution standard.
3. the recognition methods of abnormal traffic request as described in claim 1, which is characterized in that the whole traffic matrixs of the calculating
Preset quantity cluster centre matrix, comprising:
The traffic matrix of the preset quantity is arbitrarily chosen as initial cluster centre square in whole traffic matrixs
Battle array；
Each traffic matrix is calculated to the Euclidean distance of each cluster centre matrix, each traffic matrix is included into and its Europe
Family name is apart from the corresponding set of matrices of the smallest cluster centre matrix；
Calculate in the corresponding set of matrices of each cluster centre matrix the flat of the element of each same position in whole traffic matrixs
Mean value, to generate the corresponding mean matrix of each cluster centre matrix, and by the corresponding mean matrix of the cluster centre matrix
As updated cluster centre matrix；
Judge whether updated cluster centre matrix meets termination condition；
If the cluster centre matrix is unsatisfactory for termination condition, returns to execution and calculate each traffic matrix to each cluster centre
Each traffic matrix is included into matrix corresponding with the smallest cluster centre matrix of its Euclidean distance by the Euclidean distance of matrix
The operation of set；
If the cluster centre matrix meets termination condition, whole cluster centre matrixes is exported.
4. the recognition methods of abnormal traffic request as claimed in claim 2, which is characterized in that the updated cluster of judgement
Whether center matrix meets termination condition, comprising:
Calculate being averaged for the Euclidean distance of each traffic matrix in the corresponding set of matrices of each cluster centre matrix
The sum of value, as cluster error；
If the cluster error is greater than preset error threshold, updated cluster centre matrix is unsatisfactory for termination condition；
If the cluster error is less than or equal to preset error threshold, updated cluster centre matrix, which meets, terminates item
Part.
5. the recognition methods of abnormal traffic request as described in claim 1, which is characterized in that when the judgement is described default
Between service request in section there are after exception, further includes:
The cluster centre matrix is set as the updated R-matrix.
6. a kind of terminal device, including memory and processor, it is stored with and can transports on the processor in the memory
Capable computer program, which is characterized in that when the processor executes the computer program, realize following steps:
The service request received in preset time period is stored in presetting database, and will be stored in the presetting database
The service request received before preset time period is deleted, and to update the presetting database, includes in the service request
The corresponding relationship of multiple data types and data value, the data type include the receiving time of service request；
Judge whether the receiving time of each service request in the presetting database meets preset Annual distribution standard；
If the receiving time of each service request meets preset Annual distribution standard in the presetting database, by institute
The corresponding relationship for stating each service request is included in presetting database data type and data value is converted to each institute
State the corresponding traffic matrix of service request；
The cluster centre matrix of the preset quantity of whole traffic matrixs is calculated, a cluster centre matrix is preset with whole if it exists
The similarity of R-matrix be respectively less than similarity threshold, then it is abnormal to determine that the service request in the preset time period exists.
7. terminal device as claimed in claim 6, which is characterized in that each industry in the judgement presetting database
Whether the receiving time of business request meets preset Annual distribution standard, comprising:
According to the receiving time of each service request, the quantity of the corresponding service request of multiple unit time periods is calculated,
Generate the corresponding relationship of the quantity of unit interval and service request；
Pass through linear regression model (LRM): the number of unit interval and service request in Y (n)=aX (n)+b fitting preset time period
The corresponding relationship of amount, and the linear regression coeffficient of the equation of linear regression is calculated according to least square method, to generate linear return
Return equation；The Y (n) is the quantity of the corresponding service request of n-th of unit interval in the preset time period, the X (n)
For n-th of unit interval in the preset time period, a is the linear regression coeffficient, and the b is error coefficient；
The theoretical quantity of the corresponding service request of each unit interval is calculated by the equation of linear regression, and is calculated each
The difference of the theoretical quantity of the quantity and service request of the corresponding service request of unit interval；
If the corresponding difference of whole unit interval is less than preset difference threshold, determine each in the presetting database
The receiving time of a service request meets preset Annual distribution standard.
8. terminal device as claimed in claim 6, which is characterized in that the preset quantity for calculating whole traffic matrixs is gathered
Class center matrix, comprising:
The traffic matrix of the preset quantity is arbitrarily chosen as initial cluster centre square in whole traffic matrixs
Battle array；
Each traffic matrix is calculated to the Euclidean distance of each cluster centre matrix, each traffic matrix is included into and its Europe
Family name is apart from the corresponding set of matrices of the smallest cluster centre matrix；
Calculate in the corresponding set of matrices of each cluster centre matrix the flat of the element of each same position in whole traffic matrixs
Mean value, to generate the corresponding mean matrix of each cluster centre matrix, and by the corresponding mean matrix of the cluster centre matrix
As updated cluster centre matrix；
Judge whether updated cluster centre matrix meets termination condition；
If the cluster centre matrix is unsatisfactory for termination condition, returns to execution and calculate each traffic matrix to each cluster centre
Each traffic matrix is included into matrix corresponding with the smallest cluster centre matrix of its Euclidean distance by the Euclidean distance of matrix
The operation of set；
If the cluster centre matrix meets termination condition, whole cluster centre matrixes is exported.
9. a kind of identification device of abnormal traffic request, which is characterized in that described device includes:
Update module, service request for will receive in preset time period are stored in presetting database, and by the present count
It is deleted according to the service request received before preset time period stored in library, it is described to update the presetting database
It include the corresponding relationship of multiple data types and data value in service request, when the data type includes the reception of service request
Between；
Judgment module, for judging it is preset whether the receiving time of each service request in the presetting database meets
Annual distribution standard；
Conversion module, if the receiving time for the service request each in the presetting database meets the preset time point
Cloth standard, the then corresponding relationship of the data type and data value that are included by the service request each in the presetting database
Be converted to the corresponding traffic matrix of each service request；
Computing module, the cluster centre matrix of the preset quantity for calculating whole traffic matrixs, if it exists a cluster centre
The similarity of matrix and whole preset R-matrixes is respectively less than similarity threshold, then determines the business in the preset time period
Request exists abnormal.
10. a kind of computer readable storage medium, the computer-readable recording medium storage has computer program, and feature exists
In when the computer program is executed by processor the step of any one of such as claim 1 to 6 of realization the method.
Priority Applications (2)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201811249394.9A CN109492394B (en) | 2018-10-25 | 2018-10-25 | Abnormal service request identification method and terminal equipment |
| PCT/CN2018/124341 WO2020082588A1 (en) | 2018-10-25 | 2018-12-27 | Method and apparatus for identifying abnormal service request, electronic device, and medium |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201811249394.9A CN109492394B (en) | 2018-10-25 | 2018-10-25 | Abnormal service request identification method and terminal equipment |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN109492394A true CN109492394A (en) | 2019-03-19 |
| CN109492394B CN109492394B (en) | 2024-05-03 |
Family
ID=65691882
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201811249394.9A Active CN109492394B (en) | 2018-10-25 | 2018-10-25 | Abnormal service request identification method and terminal equipment |
Country Status (2)
| Country | Link |
|---|---|
| CN (1) | CN109492394B (en) |
| WO (1) | WO2020082588A1 (en) |
Cited By (9)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN110059013A (en) * | 2019-04-24 | 2019-07-26 | 北京百度网讯科技有限公司 | The determination method and device operated normally after software upgrading |
| CN110222504A (en) * | 2019-05-21 | 2019-09-10 | 平安银行股份有限公司 | Monitoring method, device, terminal device and the medium of user's operation |
| CN110619019A (en) * | 2019-08-07 | 2019-12-27 | 平安科技（深圳）有限公司 | Distributed storage method and system of data |
| CN111079653A (en) * | 2019-12-18 | 2020-04-28 | 中国工商银行股份有限公司 | Automatic database sorting method and device |
| CN111506829A (en) * | 2020-03-20 | 2020-08-07 | 微梦创科网络科技（中国）有限公司 | Batch real-time identification method and device for abnormal attention behaviors |
| CN112232771A (en) * | 2020-10-17 | 2021-01-15 | 严怀华 | Big data analysis method and big data cloud platform applied to smart government-enterprise cloud service |
| CN112560085A (en) * | 2020-12-10 | 2021-03-26 | 支付宝(杭州)信息技术有限公司 | Privacy protection method and device of business prediction model |
| CN113630425A (en) * | 2021-10-08 | 2021-11-09 | 国网浙江省电力有限公司金华供电公司 | Financial data safe transmission method for multiple power bodies |
| CN116484230A (en) * | 2023-06-20 | 2023-07-25 | 世优（北京）科技有限公司 | Method for identifying abnormal business data and training method of AI digital person |
Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN106469276A (en) * | 2015-08-19 | 2017-03-01 | 阿里巴巴集团控股有限公司 | The kind identification method of data sample and device |
| CN107256257A (en) * | 2017-06-12 | 2017-10-17 | 上海携程商务有限公司 | Abnormal user generation content identification method and system based on business datum |
| CN107302547A (en) * | 2017-08-21 | 2017-10-27 | 深信服科技股份有限公司 | A kind of web service exceptions detection method and device |
| CN108491301A (en) * | 2018-02-01 | 2018-09-04 | 平安科技（深圳）有限公司 | Electronic device, the abnormity early warning method based on redis and storage medium |
Family Cites Families (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN104065526B (en) * | 2013-03-22 | 2019-04-23 | 腾讯科技（深圳）有限公司 | A kind of method and apparatus of server failure alarm |
| JP6028857B2 (en) * | 2013-05-20 | 2016-11-24 | 富士通株式会社 | Data stream processing parallelization program and data stream processing parallelization system |
| CN104917643B (en) * | 2014-03-11 | 2019-02-01 | 腾讯科技（深圳）有限公司 | Abnormal account detection method and device |
| CN108289077B (en) * | 2017-01-09 | 2021-09-21 | 中兴通讯股份有限公司 | Method and device for carrying out fuzzy detection analysis on WEB server security |
| CN108595300A (en) * | 2018-03-21 | 2018-09-28 | 北京奇艺世纪科技有限公司 | A kind of method and device of configurable monitoring and alarm |
-
2018
- 2018-10-25 CN CN201811249394.9A patent/CN109492394B/en active Active
- 2018-12-27 WO PCT/CN2018/124341 patent/WO2020082588A1/en active Application Filing
Patent Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN106469276A (en) * | 2015-08-19 | 2017-03-01 | 阿里巴巴集团控股有限公司 | The kind identification method of data sample and device |
| CN107256257A (en) * | 2017-06-12 | 2017-10-17 | 上海携程商务有限公司 | Abnormal user generation content identification method and system based on business datum |
| CN107302547A (en) * | 2017-08-21 | 2017-10-27 | 深信服科技股份有限公司 | A kind of web service exceptions detection method and device |
| CN108491301A (en) * | 2018-02-01 | 2018-09-04 | 平安科技（深圳）有限公司 | Electronic device, the abnormity early warning method based on redis and storage medium |
Cited By (17)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN110059013A (en) * | 2019-04-24 | 2019-07-26 | 北京百度网讯科技有限公司 | The determination method and device operated normally after software upgrading |
| CN110059013B (en) * | 2019-04-24 | 2023-06-23 | 北京百度网讯科技有限公司 | Method and device for determining normal operation after software upgrading |
| CN110222504A (en) * | 2019-05-21 | 2019-09-10 | 平安银行股份有限公司 | Monitoring method, device, terminal device and the medium of user's operation |
| CN110222504B (en) * | 2019-05-21 | 2024-02-13 | 平安银行股份有限公司 | User operation monitoring method, device, terminal equipment and medium |
| CN110619019A (en) * | 2019-08-07 | 2019-12-27 | 平安科技（深圳）有限公司 | Distributed storage method and system of data |
| CN110619019B (en) * | 2019-08-07 | 2024-03-15 | 平安科技（深圳）有限公司 | Distributed storage method and system for data |
| CN111079653A (en) * | 2019-12-18 | 2020-04-28 | 中国工商银行股份有限公司 | Automatic database sorting method and device |
| CN111079653B (en) * | 2019-12-18 | 2024-03-22 | 中国工商银行股份有限公司 | Automatic database separation method and device |
| CN111506829A (en) * | 2020-03-20 | 2020-08-07 | 微梦创科网络科技（中国）有限公司 | Batch real-time identification method and device for abnormal attention behaviors |
| CN111506829B (en) * | 2020-03-20 | 2023-08-25 | 微梦创科网络科技（中国）有限公司 | Abnormal attention behavior batch real-time identification method and device |
| CN112232771A (en) * | 2020-10-17 | 2021-01-15 | 严怀华 | Big data analysis method and big data cloud platform applied to smart government-enterprise cloud service |
| CN112560085A (en) * | 2020-12-10 | 2021-03-26 | 支付宝(杭州)信息技术有限公司 | Privacy protection method and device of business prediction model |
| CN112560085B (en) * | 2020-12-10 | 2023-09-19 | 支付宝(杭州)信息技术有限公司 | Privacy protection method and device for business prediction model |
| CN113630425B (en) * | 2021-10-08 | 2022-01-07 | 国网浙江省电力有限公司金华供电公司 | Financial data safe transmission method for multiple power bodies |
| CN113630425A (en) * | 2021-10-08 | 2021-11-09 | 国网浙江省电力有限公司金华供电公司 | Financial data safe transmission method for multiple power bodies |
| CN116484230B (en) * | 2023-06-20 | 2023-09-01 | 世优（北京）科技有限公司 | Method for identifying abnormal business data and training method of AI digital person |
| CN116484230A (en) * | 2023-06-20 | 2023-07-25 | 世优（北京）科技有限公司 | Method for identifying abnormal business data and training method of AI digital person |
Also Published As
| Publication number | Publication date |
|---|---|
| CN109492394B (en) | 2024-05-03 |
| WO2020082588A1 (en) | 2020-04-30 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN109492394A (en) | The recognition methods of abnormal traffic request and terminal device | |
| CN108600009B (en) | Network alarm root positioning method based on alarm data analysis | |
| CN108985553A (en) | A kind of recognition methods and equipment of abnormal user | |
| CN109815657A (en) | A kind of identity identifying method and terminal device based on alliance's chain | |
| CN102724103B (en) | Proxy server, hierarchical network system and distributed workload management method | |
| CN107526645B (en) | A kind of communication optimization method and system | |
| CN103970851B (en) | The method that magnanimity Credential data directly provides general headquarters of large-size enterprise group financial statement | |
| WO2021051529A1 (en) | Method, apparatus and device for estimating cloud host resources, and storage medium | |
| CN107748696A (en) | The method and terminal device of a kind of task scheduling | |
| Yin et al. | Cloudscout: A non-intrusive approach to service dependency discovery | |
| CN109446017A (en) | A kind of alarm algorithm generation method, monitoring system and terminal device | |
| CN109165137A (en) | data analysis and alarm method and system | |
| CN110222504A (en) | Monitoring method, device, terminal device and the medium of user's operation | |
| CN109241357A (en) | Chain structure model and its construction method, system and terminal device | |
| CN109739433A (en) | The method and terminal device of data processing | |
| CN104135530A (en) | Increment reporting method and device | |
| CN110502395A (en) | Equipment running status appraisal procedure, terminal device and storage medium based on cluster | |
| CN115269108A (en) | Data processing method, device and equipment | |
| CN109409764A (en) | Production monitoring method and terminal device | |
| CN105184452B (en) | A kind of MapReduce job dependence control methods calculated suitable for power information big data | |
| CN109324959A (en) | A kind of method, server and the computer readable storage medium of automatic transfer data | |
| CN109039826B (en) | Collecting method, device and electronic equipment | |
| CN110058869A (en) | Mobile application method for pushing, computer readable storage medium and terminal device | |
| CN109375146A (en) | A kind of filling mining method, system and the terminal device of electricity consumption data | |
| CN109240893A (en) | Using operating status querying method and terminal device |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |