CN109818921B - Method and device for analyzing abnormal flow of website interface - Google Patents
Method and device for analyzing abnormal flow of website interface Download PDFInfo
- Publication number
- CN109818921B CN109818921B CN201811529552.6A CN201811529552A CN109818921B CN 109818921 B CN109818921 B CN 109818921B CN 201811529552 A CN201811529552 A CN 201811529552A CN 109818921 B CN109818921 B CN 109818921B
- Authority
- CN
- China
- Prior art keywords
- fit
- goodness
- data points
- interface
- website interface
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
Images
Abstract
The embodiment of the invention provides a method and a device for analyzing abnormal flow of a website interface, wherein the method comprises the following steps: acquiring an access log of any website interface within a preset time length; counting the request quantity x of each ip and the number f (x) of the ip corresponding to each request quantity x according to the access log to obtain a plurality of data points (x, f (x)), and performing optimal fitting on the data points (x, f (x)) to obtain an optimal fitting function; and obtaining the goodness of fit of the website interface according to the optimal fitting function, and determining the abnormal flow percentage of the website interface according to the goodness of fit. Because the method for judging the abnormal traffic ratio of each interface in the website by using the goodness of fit of power law distribution is adopted, the task can be finished by a small amount of machines and time. Moreover, the condition of multiple ip brush interfaces can be found, and the factor is taken into account in the invalid traffic ratio of each interface. The invalid traffic ratio of each interface can also be obtained.
Description
Technical Field
The invention relates to the field of data analysis, in particular to a method and a device for analyzing abnormal flow of a website interface.
Background
Websites output data to users, some of whom for various reasons use machines to simulate human web page access requests. Such machine accesses are typically large and frequent, and can adversely affect the health of the server. The anti-seize station system is a system for blocking the abnormal access of the part.
Each web site has many different interfaces that users request to use different functions. The interface has abnormal flow, mainly some useful people write program to brush access amount, brush praise and the like. These abnormal traffic not only mask the true traffic, increasing the load on the website, but also are unfair to normal users. However, these flows are disguised and are not different from normal flows, and now the goal is to find the proportion of anomalies in the flows for each interface and then to make an interception strategy in a targeted manner. Among them, finding the abnormal traffic ratio (of each interface) is the most critical step.
For the prior art, all access logs in one day are generally collected, an ip with more accesses and a unique access interface is found out, then all accesses of the ip are counted, and the accesses are abnormal traffic. In short, all logs in a day are collected, all the ip occurring in the logs are counted, and then the access amount corresponding to each ip is counted. Searching the single ip with high access quantity and single access interface, calculating all accesses as abnormal flow, and then summarizing and dividing the abnormal flow by the total access quantity to obtain the abnormal flow percentage of each day.
In the process of implementing the invention, the inventor finds that at least the following problems exist in the prior art:
(1) all logs may be large a day, too many machines are needed for statistics, and too long a time.
(2) The scheme can only find out the condition of single ip brush and single interface, and multiple ip or multiple interfaces can not be used.
(3) Only the invalid traffic ratio of the total traffic can be obtained, and the invalid traffic ratio (i.e., abnormal traffic) of each interface cannot be obtained.
Disclosure of Invention
The embodiment of the invention provides a method and a device for analyzing abnormal flow of a website interface, which aim to solve the technical problems in the prior art.
In a first aspect, an embodiment of the present invention provides a method for analyzing abnormal traffic of a website interface, including:
acquiring an access log of any website interface within a preset time length;
counting the request quantity x of each ip and the number f (x) of the ip corresponding to each request quantity x according to the access log to obtain a plurality of data points (x, f (x)), and performing optimal fitting on the data points (x, f (x)) to obtain an optimal fitting function;
and obtaining the goodness of fit of the website interface according to the optimal fitting function, and determining the abnormal flow percentage of the website interface according to the goodness of fit.
In a second aspect, an embodiment of the present invention provides an apparatus for analyzing abnormal traffic of a web interface, including:
the access log acquisition module is used for acquiring the access log of any website interface within a preset time length;
the optimal fitting function determining module is used for counting the request quantity x of each ip and the number f (x) of the ip corresponding to each request quantity x according to the access log to obtain a plurality of data points (x, f (x)), and performing optimal fitting on the plurality of data points (x, f (x)) to obtain an optimal fitting function;
and the abnormal flow percentage determination module is used for obtaining the goodness of fit of the website interface according to the optimal fitting function and determining the abnormal flow percentage of the website interface according to the goodness of fit.
In a third aspect, an embodiment of the present invention provides a computer-readable storage medium, on which a computer program is stored, where the computer program is executed by a processor to implement the method for analyzing the abnormal traffic of the web interface according to the first aspect.
In a fourth aspect, an embodiment of the present invention provides a computer device, including:
one or more processors;
storage means for storing one or more programs;
the one or more programs, when executed by the one or more processors, cause the one or more processors to implement the method for analyzing web site interface abnormal traffic as described in the first aspect.
The technical scheme has the following beneficial effects:
due to the adoption of the method for judging the abnormal traffic ratio of each interface in the website by using the goodness of fit of power law distribution, the task can be finished by a small amount of machines and time. Moreover, the condition of multiple ip brush interfaces can be found, and the factor is taken into account in the invalid traffic ratio of each interface. Finally, the invalid traffic ratio of each interface can be obtained.
Drawings
In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings used in the description of the embodiments or the prior art will be briefly described below, it is obvious that the drawings in the following description are only some embodiments of the present invention, and for those skilled in the art, other drawings can be obtained according to the drawings without creative efforts.
Fig. 1 is a flowchart of a method for analyzing abnormal traffic of a web interface according to the present embodiment;
FIG. 2 is a schematic diagram illustrating the fitting effect of an unwashed interface according to an example of the present embodiment;
FIG. 3 is a diagram illustrating the fitting effect of a brushed interface of the present embodiment as an example;
FIG. 4 is a diagram illustrating the fitting effect of another brush interface of the present embodiment as an example;
fig. 5 is a functional block diagram of an analysis apparatus for abnormal traffic of a web interface according to the present embodiment.
Detailed Description
The technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the drawings in the embodiments of the present invention, and it is obvious that the described embodiments are only a part of the embodiments of the present invention, and not all of the embodiments. All other embodiments, which can be derived by a person skilled in the art from the embodiments given herein without making any creative effort, shall fall within the protection scope of the present invention.
First, technical term definition is performed:
the anti-grabbing station system: websites output data to users, some of whom for various reasons use machines to simulate human web page access requests. Such machine access is typically heavy and frequent, and may adversely affect the health of the server. The anti-seize station system is a system for blocking the abnormal access of the part.
Interface: each web site has many different interfaces that users request to use different functions. The interface has abnormal flow, mainly some useful people write program to brush access amount, brush praise and the like. These abnormal traffic not only mask the true traffic, increasing the load on the website, but also are unfair to normal users.
Goodness of fit: goodness of fit (R-squared, i.e. R)2) Closer to 1 represents a more complex target distribution of data points.
URL: the URL is as follows: com/useru is 1, then, in abc, com is the domain name,/user is the interface, and u is 1 is the parameter.
Fig. 1 is a flowchart of an analysis method for abnormal traffic of a web interface according to this embodiment. As shown in fig. 1, it includes the following steps:
step S110: and acquiring an access log of any website interface within a preset time length.
Step S120: and counting the request quantity x of each ip and the number f (x) of the ip corresponding to each request quantity x according to the access log to obtain a plurality of data points (x, f (x)), and performing optimal fitting on the data points (x, f (x)) to obtain an optimal fitting function. There are many methods for optimizing the fitting, and no particular limitation is imposed in this embodiment.
Step S130: and obtaining the goodness of fit of the website interface according to the optimal fitting function, and determining the abnormal flow percentage of the website interface according to the goodness of fit.
Alternatively, in step S120, the formula f (x) ax may be used-kPerforming optimization fitting on a plurality of data points (x, f (x)), and determining the values a of the coefficients a and k in the formulam、kmObtaining the optimal fitting function based on the values of a and k
Optionally, the goodness-of-fit is a goodness-of-fit based on a power law distribution.
In one embodiment, the goodness-of-fit of the website interface may be obtained from the best fit function in step 130 by:
alternatively, the curve fitting curve _ fit method of Python Scipy employs a non-linear least squares method. Non-linear least squares (Non-linear least squares) from data points and an objective function to be fitted f (x) ax-kTo obtain the unknown parameters a and k in the objective function.
After a and k of the objective function are obtained, the goodness of fit is determined using its equations and raw data points, where statistical conceptual decision coefficients or decision coefficients are used, see in detail Wikipedia, https:// en.
More specifically, the obtaining of the goodness of fit of the website interface according to the best fit function in step S130 may specifically include the following steps:
the ith data point of the plurality of data points (x, f (x)) is denoted as (x)i，yi) All of yiThe average value of (A) is recorded as
Obtaining the best fitting function
Thereafter, each x value of the plurality of data points is designated as xiSubstitution into
The value obtained is denoted fiThen, the goodness-of-fit R is determined according to the following formula2：
In some embodiments, the determining the percentage of abnormal traffic of the website interface according to the goodness of fit in step S130 may specifically include: and taking the percentage of the difference between the logarithm value 1 and the goodness of fit to obtain the abnormal flow percentage of the website interface.
Optionally, the preset length of time is greater than or equal to one minute and less than 24 hours. The predetermined length of time is optional, but is typically greater than or equal to 1 minute to be statistically significant. The preset time length is related to the type of the malicious interface and the application scene. For an application scene with a small data volume in unit time, the sampling time needs to be increased to increase the data volume, so that the data has statistical significance. In one example, the selection criteria for the preset time period include: enough logs (about 10000 logs) were collected.
The following is described in more detail by means of a number of specific examples:
in a period of time with statistical significance, under the condition of not being brushed, the ip request quantity and the number of the ip requests approximately meet the power law distribution (formula I):
f(x)＝ax-k
in one minute, the logs are classified according to interfaces, and the request quantity of each ip is counted, such as:
1.1.1.1：2
1.1.1.2：2
1.1.1.3：1
1.1.1.4：1
1.1.1.5：1
1.1.1.6：3
then, the number of ip is counted according to the request quantity, and 3 data points are obtained: (Format x: f (x))
1:3 (3 ip with request amount of 1)
2:2 (2 ip with request amount of 2)
3:1 (1 ip with request amount of 3)
Then f (x) ax when the data (x: f (x)) is known-kAn optimization fit is performed by finding a, k in a set of equations as close as possible the 3 data points are to f (x).
The optimal fitting can calculate the coefficient of the R side, namely the goodness of fit, the closer the R side is to 1, the more the data points conform to the power law distribution (formula one), and the invalid flow rate does not exist, if the interface is brushed, a large number of abnormal points can be generated no matter whether the interface is multi-ip or single-ip, and the R side is reduced. In summary, the more the interface is swiped, the lower the calculated R-party.
The technical solution of the embodiment of the present invention is detailed below by referring to specific examples:
for example, take an access log within 1 minute of an interface. The method comprises the steps of counting the request quantity of each ip, then counting the number of the ip according to the request quantity to obtain a plurality of data points, and then carrying out optimal fitting to obtain an optimal fitting function f (x). They are all drawn in the same figure as shown in figure 1. The five-pointed star is the raw data point and the dots are the fitting function. In fig. 2, the abscissa is the number of requests in one minute, and the ordinate is the logarithm of the number of ip. It can be seen that the fitting effect is better for the interface that is not brushed, the average R within 10 minutes2At 0.9796054203285649, there is substantially no abnormal flow.
As shown in fig. 3, this is a typical feature of the brushed interface: a large number of irregular data points are arranged above a normal curve, so that the data deviate from normal power law distribution, the fitting effect by using a power function is poor, and R is20.85588995153289082, i.e. the ratio of the interface brushed is at least 15%.
As shown in FIG. 4, this is another brushed interface, and a large number of irregularities due to abnormal traffic, R, can be seen20.87879857101806613, i.e., an abnormal flow rate of at least 12%.
The above process is performed for each interface, and finally a list of interfaces and R-square values can be obtained, i.e. an approximate proportion of abnormal traffic for each interface is obtained.
Some preferred technical details are described below:
1. there are many software implementations of the optimization fitting, and this embodiment uses the curve _ fit method of python and scipy packages.
popt,pcov＝curve_fit(f,t,y)
After executing this statement, the best a, k is loaded in popt.
2. Drawing uses matplotlib from python.
plt.plot(t,yvals)
plt.show()
A series of scatter points can be drawn on the graph.
3. Calculation of goodness of fit R-square:
sum0＝0
sum1＝0
average＝numpy.average(y)
for i in range(len(yvals)):
sum0+＝(y[i]-yvals[i])**2
sum1+＝(y[i]-average)**2
r2＝1-(sum0/sum1)
the technical scheme of the embodiment has the beneficial effects that:
due to the adoption of a novel abnormal flow proportion statistical method, the task can be completed by using a small amount of machines and time. Moreover, the condition of multiple ip brush interfaces can be found, and the factor is taken into account in the invalid traffic ratio of each interface. Finally, the invalid traffic ratio of each interface can be obtained.
Fig. 5 is a functional block diagram of an apparatus 200 for analyzing the percentage of abnormal traffic of the web interface according to the present embodiment. As shown in fig. 5, the apparatus 200 includes the following functional modules: an access log obtaining module 210, configured to obtain an access log of any website interface within a preset time length; the optimal fitting function determining module 220 is configured to count the request amount x of each ip and the number f (x) of the ip corresponding to each request amount x according to the access log to obtain a plurality of data points (x, f (x)), and perform optimal fitting on the plurality of data points (x, f (x)) to obtain an optimal fitting function; the abnormal traffic percentage determining module 230 is configured to obtain a goodness of fit of the website interface according to the optimal fitting function, and determine the abnormal traffic percentage of the website interface according to the goodness of fit.
Optionally, the best fit function determining module 220 may be specifically configured to: according to the formula f (x) ax-kPerforming optimization fitting on the multiple data points (x, f (x)), and determining the values a of the coefficients a and k in the formulam、kmObtaining the optimal fitting function based on the values of a and k
Optionally, the goodness-of-fit is a goodness-of-fit based on a power law distribution; the abnormal flow percentage determination module 230 may be specifically configured to:
the ith data point of the plurality of data points (x, f (x)) is denoted as (x)i，yi) All of yiThe average value of (A) is recorded as
Obtaining the best fitting function
Thereafter, each x value of these multiple data points is designated as xiSubstitution into
The value obtained is denoted fiThen, the goodness-of-fit R is determined according to the following formula2：
Specifically, the abnormal traffic percentage determination module 230 may be specifically configured to: and taking the percentage of the difference between the logarithm value 1 and the goodness of fit to obtain the abnormal flow percentage of the website interface.
Optionally, the preset length of time is greater than or equal to one minute and less than 24 hours.
The device of the embodiment of the invention has the following advantages: the analysis task of the abnormal flow of each website interface can be completed by using a small amount of machines and time. The device can discover the condition of multiple ip-brush interfaces and take this factor into account the invalid traffic ratio of each interface. The device can obtain the invalid traffic ratio of each interface.
The present embodiment also provides a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, the computer program implements the method for analyzing the abnormal traffic of the web interface according to any one of the foregoing embodiments.
The present embodiment also provides a computer device, which includes: one or more processors; storage means for storing one or more programs; when the one or more programs are executed by the one or more processors, the one or more processors are caused to implement the analysis method for abnormal traffic of the website interface according to any one of the preceding embodiments.
The computer device or the electronic device may have a communication bus, which may be a Peripheral Component Interconnect (PCI) bus, an Extended Industry Standard Architecture (EISA) bus, or the like. The communication bus may be divided into an address bus, a data bus, a control bus, etc. The communication bus is used for communication between the electronic device and other devices.
The storage device may include a Random Access Memory (RAM) or a Non-Volatile Memory (NVM), such as at least one disk Memory. Optionally, the memory may also be at least one memory device located remotely from the processor.
The Processor may be a general-purpose Processor, including a Central Processing Unit (CPU), a Network Processor (NP), and the like; but also Digital Signal Processors (DSPs), Application Specific Integrated Circuits (ASICs), Field Programmable Gate Arrays (FPGAs) or other Programmable logic devices, discrete Gate or transistor logic devices, discrete hardware components.
Those of skill in the art will further appreciate that the various illustrative logical blocks, units, and steps described in connection with the embodiments disclosed herein may be implemented as electronic hardware, computer software, or combinations of both. To clearly illustrate the interchangeability of hardware and software, various illustrative components, elements, and steps have been described above generally in terms of their functionality. Whether such functionality is implemented as hardware or software depends upon the particular application and design requirements of the overall system. Skilled artisans may implement the described functionality in varying ways for each particular application, but such implementation decisions should not be interpreted as causing a departure from the scope of the present embodiments.
The steps of a method or algorithm described in connection with the embodiments disclosed herein may be embodied directly in hardware, in a software module executed by a processor, or in a combination of the two. A software module may be stored in RAM memory, flash memory, ROM memory, EPROM memory, EEPROM memory, registers, hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art. For example, a storage medium may be coupled to the processor such the processor can read information from, and write information to, the storage medium. In the alternative, the storage medium may be integral to the processor. The processor and the storage medium may reside in an ASIC, which may be located in a user terminal. In the alternative, the processor and the storage medium may reside in different components in a user terminal.
The above-mentioned embodiments are intended to illustrate the objects, technical solutions and advantages of the present invention in further detail, and it should be understood that the above-mentioned embodiments are merely exemplary embodiments of the present invention, and are not intended to limit the scope of the present invention, and any modifications, equivalent substitutions, improvements and the like made within the spirit and principle of the present invention should be included in the scope of the present invention.
Claims (6)
1. A method for analyzing abnormal flow of a website interface is characterized by comprising the following steps:
acquiring an access log of any website interface within a preset time length;
counting the request quantity x of each ip and the number f (x) of the ip corresponding to each request quantity x according to the access log to obtain a plurality of data points (x, f (x)), and performing optimal fitting on the data points (x, f (x)) to obtain an optimal fitting function;
obtaining the goodness of fit of the website interface according to the optimal fitting function, and determining the abnormal flow percentage of the website interface according to the goodness of fit;
wherein said performing an optimization fit on said plurality of data points (x, f (x)) to obtain a best fit function comprises:
according to the formula fx ═ ax-kPerforming optimization fitting on the plurality of data points (x, f (x)), and determining the values a of the coefficients a and k in the formulam、kmObtaining the optimal fitting function based on the values of a and k
The goodness-of-fit is a goodness-of-fit based on a power law distribution;
obtaining goodness of fit of the website interface according to the optimal fitting function, specifically comprising:
the ith data point of the plurality of data points (x, f (x)) is denoted as (x)i，yi) All of yiThe average value of (A) is recorded as
Obtaining the best fitting function
Thereafter, each x value of the plurality of data points is designated as xiSubstitution into
ObtainedThe value is noted as fiThen, goodness-of-fit R2 is determined according to the following equation:
2. the method of claim 1, wherein determining the percentage of abnormal traffic for the web site interface based on the goodness-of-fit comprises:
and taking percentage of the difference between the logarithm value 1 and the goodness of fit to obtain the abnormal flow percentage of the website interface.
3. An apparatus for analyzing abnormal traffic of a web interface, comprising:
the access log acquisition module is used for acquiring the access log of any website interface within a preset time length;
the optimal fitting function determining module is used for counting the request quantity x of each ip and the number f (x) of the ip corresponding to each request quantity x according to the access log to obtain a plurality of data points (x, f (x)), and performing optimal fitting on the plurality of data points (x, f (x)) to obtain an optimal fitting function;
the abnormal flow percentage determining module is used for obtaining the goodness of fit of the website interface according to the optimal fitting function and determining the abnormal flow percentage of the website interface according to the goodness of fit;
the best fit function determination module is specifically configured to: according to the formula fx ═ ax-kFor the plurality of data points (x, f (x)) Performing optimization fitting, and determining the values a of the coefficients a and k in the formulam、kmObtaining the optimal fitting function based on the values of a and k
The goodness-of-fit is a goodness-of-fit based on a power law distribution;
the abnormal flow percentage determination module is specifically configured to:
the ith data point of the plurality of data points (x, f (x)) is denoted as (x)i，yi) All of yiThe average value of (A) is recorded as
Obtaining the best fitting function
Thereafter, each x value of the plurality of data points is designated as xiSubstitution into
The value obtained is denoted fiThen, the goodness-of-fit R is determined according to the following formula2：
4. The apparatus according to claim 3, wherein the abnormal flow percentage determination module is specifically configured to: and taking percentage of the difference between the logarithm value 1 and the goodness of fit to obtain the abnormal flow percentage of the website interface.
5. A computer-readable storage medium, on which a computer program is stored, which, when being executed by a processor, implements a method for analyzing abnormal traffic of a web site interface according to any one of claims 1-2.
6. A computer device, comprising:
one or more processors;
storage means for storing one or more programs;
the one or more programs, when executed by the one or more processors, cause the one or more processors to implement the method for analyzing web site interface abnormal traffic of any of claims 1-2.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201811529552.6A CN109818921B (en) | 2018-12-14 | 2018-12-14 | Method and device for analyzing abnormal flow of website interface |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201811529552.6A CN109818921B (en) | 2018-12-14 | 2018-12-14 | Method and device for analyzing abnormal flow of website interface |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN109818921A CN109818921A (en) | 2019-05-28 |
| CN109818921B true CN109818921B (en) | 2021-09-21 |
Family
ID=66601727
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201811529552.6A Active CN109818921B (en) | 2018-12-14 | 2018-12-14 | Method and device for analyzing abnormal flow of website interface |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN109818921B (en) |
Families Citing this family (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN112115324B (en) * | 2020-08-10 | 2023-10-24 | 微梦创科网络科技（中国）有限公司 | Method and device for confirming praise and praise users based on power law distribution |
| CN112149036B (en) * | 2020-09-28 | 2023-11-10 | 微梦创科网络科技（中国）有限公司 | Method and system for identifying batch abnormal interaction behaviors |
| CN112861128A (en) * | 2021-01-21 | 2021-05-28 | 微梦创科网络科技（中国）有限公司 | Method and system for identifying machine accounts in batches |
Citations (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101827081A (en) * | 2010-02-09 | 2010-09-08 | 蓝盾信息安全技术股份有限公司 | Method and system for detecting request safety |
| CN101826996B (en) * | 2010-03-19 | 2012-05-23 | 中国科学院计算机网络信息中心 | Domain name system flow detection method and domain name server |
| CN104065573A (en) * | 2014-06-30 | 2014-09-24 | 重庆邮电大学 | Routing method based on least-squares fitting in multi-domain optical network |
| CN107666490A (en) * | 2017-10-18 | 2018-02-06 | 中国联合网络通信集团有限公司 | A kind of suspicious domain name detection method and device |
| CN107896160A (en) * | 2017-10-27 | 2018-04-10 | 中国科学技术大学 | A kind of data center network flowmeter factor method based on distributed system |
Family Cites Families (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US9392463B2 (en) * | 2012-12-20 | 2016-07-12 | Tarun Anand | System and method for detecting anomaly in a handheld device |
| CN105162628B (en) * | 2015-08-24 | 2018-12-18 | 上海天旦网络科技发展有限公司 | Quickly determine the system and method for the reasonable alarm threshold of network |
-
2018
- 2018-12-14 CN CN201811529552.6A patent/CN109818921B/en active Active
Patent Citations (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101827081A (en) * | 2010-02-09 | 2010-09-08 | 蓝盾信息安全技术股份有限公司 | Method and system for detecting request safety |
| CN101826996B (en) * | 2010-03-19 | 2012-05-23 | 中国科学院计算机网络信息中心 | Domain name system flow detection method and domain name server |
| CN104065573A (en) * | 2014-06-30 | 2014-09-24 | 重庆邮电大学 | Routing method based on least-squares fitting in multi-domain optical network |
| CN107666490A (en) * | 2017-10-18 | 2018-02-06 | 中国联合网络通信集团有限公司 | A kind of suspicious domain name detection method and device |
| CN107896160A (en) * | 2017-10-27 | 2018-04-10 | 中国科学技术大学 | A kind of data center network flowmeter factor method based on distributed system |
Also Published As
| Publication number | Publication date |
|---|---|
| CN109818921A (en) | 2019-05-28 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN109818921B (en) | Method and device for analyzing abnormal flow of website interface | |
| CN109815332B (en) | Loss function optimization method, loss function optimization device, computer equipment and storage medium | |
| JP6918245B2 (en) | Identity verification method and equipment | |
| TWI684151B (en) | Method and device for detecting illegal transaction | |
| CN104391979B (en) | Network malice reptile recognition methods and device | |
| CN109558295B (en) | Performance index abnormality detection method and device | |
| US20210044614A1 (en) | Risk control method, risk control apparatus, electronic device, and storage medium | |
| JP2018538587A (en) | Risk assessment method and system | |
| CN106469376B (en) | Risk control method and equipment | |
| CN110474871B (en) | Abnormal account detection method and device, computer equipment and storage medium | |
| CN110830445B (en) | Method and device for identifying abnormal access object | |
| CN106874165B (en) | Webpage detection method and device | |
| CN111681102A (en) | Credit prediction method, apparatus, device and storage medium | |
| CN110599136A (en) | Method and device for managing and controlling flow of block chain transaction pool | |
| CN109525933B (en) | Location privacy protection method and device | |
| CN109410198B (en) | Time sequence action detection method, device and equipment | |
| CN110874638B (en) | Behavior analysis-oriented meta-knowledge federation method, device, electronic equipment and system | |
| CN110866831A (en) | Asset activity level determination method and device and server | |
| CN107612946A (en) | Detection method, detection means and the electronic equipment of IP address | |
| CN112115324B (en) | Method and device for confirming praise and praise users based on power law distribution | |
| CN109783773B (en) | Method and device for determining abnormal flow of website interface | |
| CN109598525B (en) | Data processing method and device | |
| CN113157542B (en) | User identification method and system for convergence behavior based on application log | |
| CN110309421B (en) | UGC content quality evaluation method and device and electronic equipment | |
| CN114422168A (en) | Malicious machine traffic identification method and system |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |