CN109831415A

CN109831415A - A kind of object processing method, device, system and computer readable storage medium

Info

Publication number: CN109831415A
Application number: CN201811614031.0A
Authority: CN
Inventors: 姜丹薇
Original assignee: Beijing QIYI Century Science and Technology Co Ltd
Current assignee: Beijing QIYI Century Science and Technology Co Ltd
Priority date: 2018-12-27
Filing date: 2018-12-27
Publication date: 2019-05-31
Anticipated expiration: 2038-12-27
Also published as: CN109831415B

Abstract

The present invention provides a kind of object processing method, device, system and computer readable storage mediums, belong to field of computer technology.Wherein, terminal can send feature configuration information to server, at least two target signatures needed for classification and target object in this feature configuration information including target object, server at least two target signatures according to needed for the classification of target object and target object, extract target object, using target object as the object of abnormal behavior, and it is sent to terminal, finally, terminal can receive the target object of server transmission, and based at least two target signatures that target object has, the permission of target object is configured.In the embodiment of the present invention, server can extract target object according to multiple features, and correspondingly, terminal can be configured the permission of target object when target object meets multiple features, and then the confined problem of permission of part normal subjects is avoided, improve the accuracy rate of object handles.

Description

Object processing method, device and system and computer readable storage medium

Technical Field

The present invention relates to the field of computer technologies, and in particular, to a method, an apparatus, a system, and a computer-readable storage medium for processing an object.

Background

At present, in order to improve the security of a network system, data in the network system often needs to be analyzed, and whether the behavior of an object is abnormal or not is evaluated according to the characteristics of each object, for example, whether a User Identity (UID) has a risk of abnormal login or not is judged according to the login times of the UID within 1 minute, and then the authority of the object is limited, so as to ensure the security of the network system.

In the prior art, when an object is processed, whether the object has abnormal behavior is often determined based on a single characteristic of the object, and if the object has abnormal behavior, the authority of the object is limited. However, the confidence level of the single feature is low, and the method in the prior art may cause the authority of part of normal objects to be limited, and the accuracy of object processing to be low.

Disclosure of Invention

The invention provides an object processing method, device and system and a computer readable storage medium, which are used for solving the problem of low accuracy of object processing.

According to a first aspect of the present invention, there is provided an object processing method, which may be applied to a system including a terminal and a server, the method including:

the terminal sends feature configuration information to the server; the feature configuration information comprises the category of the target object and at least two target features required by the target object;

the server extracts a target object according to the category of the target object and at least two target characteristics required by the target object;

and the server takes the target object as an object with abnormal behavior and sends the object to the terminal.

And the terminal receives the target object sent by the server and sets the authority of the target object based on at least two target characteristics of the target object.

According to a second aspect of the present invention, there is provided an object processing method, which can be applied to a server, the method including:

receiving feature configuration information sent by a terminal; the feature configuration information comprises the category of the target object and at least two target features required by the target object;

extracting a target object according to the category of the target object and at least two target characteristics required by the target object;

and taking the target object as an object with abnormal behavior and sending the target object to the terminal.

Optionally, the extracting the target object according to the category of the target object and at least two target features required by the target object includes:

respectively establishing different processing tasks aiming at each target characteristic, and determining the priority of each processing task according to the target characteristic corresponding to each processing task;

and extracting the target object by using each processing task according to the priority of each processing task, the target feature corresponding to each processing task and the category of the target object.

Optionally, the extracting the target object by using each processing task according to the priority of each processing task, the target feature corresponding to each processing task, and the category of the target object includes:

extracting an object which has target characteristics corresponding to the highest priority processing task and has the same category as the target object by using the highest priority processing task to obtain an object corresponding to the highest priority processing task;

for any processing task except the processing task with the highest priority, extracting an object with target characteristics corresponding to the processing task from objects corresponding to a processing task at the previous stage of the processing task by using the processing task according to the sequence from the highest priority to the lowest priority, and obtaining an object corresponding to the processing task;

and determining the object extracted by the task with the lowest priority as the target object.

Optionally, the determining the priority of each processing task according to the target feature corresponding to each processing task includes:

judging whether the at least two target characteristics have associated characteristics or not; the associated feature comprises the content of a basic feature, wherein the basic feature is any one of the at least two target features except the associated feature;

if no associated feature exists in the at least two target features, randomly setting a priority for each processing task; or,

if the at least two target characteristics have the associated characteristics, setting the priority of the processing task corresponding to the basic characteristics of the associated characteristics to be higher than the priority of the processing task corresponding to the associated characteristics, and randomly setting the priorities of other processing tasks.

Optionally, the extracting, by using the highest priority processing task, the object that has the target feature corresponding to the highest priority processing task and has the same category as the target object to obtain the object corresponding to the highest priority processing task includes:

if the target time period in the target characteristic corresponding to the highest priority processing task falls into the time range of real-time data, extracting an object corresponding to the highest priority processing task from the real-time data; or,

if the target time period in the target feature corresponding to the highest-priority processing task falls into the time range of the offline data, extracting an object corresponding to the highest-priority processing task from the offline data; or,

and if one part of the target time period in the target characteristic corresponding to the highest-priority processing task falls into the time range of real-time data and the other part of the target time period falls into the time range of offline data, extracting the object corresponding to the highest-priority processing task from the real-time data and the offline data.

Optionally, the extracting, by using the processing task, an object having a target feature corresponding to the processing task from an object corresponding to a previous-level processing task of the processing task to obtain an object corresponding to the processing task includes:

taking the object corresponding to the previous-level processing task as an alternative object, and determining whether the alternative object has the target feature corresponding to the processing task based on real-time data if the target time period in the target feature corresponding to the processing task falls into the time range of the real-time data for each alternative object;

if the target time period in the target features corresponding to the processing task falls into the time range of offline data, determining whether the candidate object has the target features corresponding to the processing task based on the offline data;

if one part of the target time period in the target features corresponding to the processing task falls into the time range of real-time data and the other part of the target time period falls into the time range of off-line data, determining whether the candidate object has the target features corresponding to the processing task based on the real-time data and the off-line data;

and taking the candidate object with the target characteristics corresponding to the processing task as the object corresponding to the processing task.

Optionally, after extracting the target object according to the category of the target object and at least two target features required by the target object, the method further includes:

and storing the target object and at least two target characteristics required by the target object into a specified database.

According to a third aspect of the present invention, there is provided a target object processing method, which can be applied to a terminal, the method including:

sending feature configuration information to a server; the feature configuration information comprises the category of the target object and at least two target features required by the target object;

and receiving the target object sent by the server, and setting the authority of the target object based on at least two target characteristics of the target object.

According to a fourth aspect of the present invention, there is provided an object processing system, which may include a terminal and a server;

the terminal is used for sending feature configuration information to the server; the feature configuration information comprises the category of the target object and at least two target features required by the target object;

the server is used for extracting the target object according to the category of the target object and at least two target characteristics required by the target object;

and the server is also used for taking the target object as an abnormal behavior object and sending the abnormal behavior object to the terminal.

The terminal is further used for receiving the target object sent by the server and setting the authority of the target object based on at least two target characteristics of the target object.

According to a fifth aspect of the present invention, there is provided an object processing apparatus, which can be applied to a server, the apparatus including:

the receiving module is used for receiving the characteristic configuration information sent by the terminal; the feature configuration information comprises the category of the target object and at least two target features required by the target object;

the extraction module is used for extracting the target object according to the category of the target object and at least two target characteristics required by the target object;

and the sending module is used for taking the target object as an object with abnormal behavior and sending the target object to the terminal.

Optionally, the extracting module includes:

the establishing submodule is used for respectively establishing different processing tasks aiming at each target characteristic and determining the priority of each processing task according to the target characteristic corresponding to each processing task;

and the extraction submodule is used for extracting the target object by utilizing each processing task according to the priority of each processing task, the target feature corresponding to each processing task and the category of the target object.

Optionally, the extracting sub-module includes:

the first extraction unit is used for extracting an object with target characteristics corresponding to the highest priority processing task by utilizing the highest priority processing task to obtain an object corresponding to the highest priority processing task;

a second extracting unit, configured to, for any processing task except the processing task with the highest priority, extract, by using the processing task, an object having a target feature corresponding to the processing task from objects corresponding to a processing task of a previous stage of the processing task in an order from a highest priority to a lowest priority, and obtain an object corresponding to the processing task;

and the determining unit is used for determining the object extracted by the lowest priority processing task as the target object.

Optionally, the establishing sub-module is configured to:

Optionally, the first extracting unit is configured to:

Optionally, the second extracting unit is configured to:

Optionally, the apparatus further comprises:

and the storage module is used for storing the target object and at least two target characteristics required by the target object into a specified database.

According to a sixth aspect of the present invention, there is provided an object processing apparatus applicable to a terminal, the apparatus may include:

the sending module is used for sending the feature configuration information to the server; the feature configuration information comprises the category of the target object and at least two target features required by the target object;

and the receiving module is used for receiving the target object sent by the server and setting the authority of the target object based on at least two target characteristics of the target object.

According to a seventh aspect of the present invention, there is provided a computer-readable storage medium on which a computer program is stored, the computer program, when executed by a processor, implementing the object processing method according to the first, second and third aspects.

Aiming at the prior art, the invention has the following advantages:

the terminal can send feature configuration information to the server, the feature configuration information comprises the category of the target object and at least two target features required by the target object, then the server can extract the target object according to the category of the target object and the at least two target features required by the target object, then the target object is used as an object with abnormal behavior and sent to the terminal, and finally the terminal can receive the target object sent by the server and set the authority of the target object based on the at least two target features of the target object. In the embodiment of the invention, the server can extract the target object according to the plurality of characteristics, correspondingly, the terminal can set the authority of the target object when the target object meets the plurality of characteristics, so that the problem that the authority of part of normal objects is limited is avoided, the accuracy of object processing is improved, meanwhile, corresponding implementation codes do not need to be developed in a customized manner aiming at different characteristics, and a user can control the server to extract the target object by sending corresponding characteristic configuration information to the server through the terminal according to own requirements, so that the operation process is simplified, and the implementation cost is reduced.

The foregoing description is only an overview of the technical solutions of the present invention, and the embodiments of the present invention are described below in order to make the technical means of the present invention more clearly understood and to make the above and other objects, features, and advantages of the present invention more clearly understandable.

Drawings

Various other advantages and benefits will become apparent to those of ordinary skill in the art upon reading the following detailed description of the preferred embodiments. The drawings are only for purposes of illustrating the preferred embodiments and are not to be construed as limiting the invention. Also, like reference numerals are used to refer to like parts throughout the drawings. In the drawings:

FIG. 1 is a flowchart illustrating steps of a method for processing an object according to an embodiment of the present invention;

FIG. 2 is a flow chart illustrating steps of another object processing method according to an embodiment of the present invention;

FIG. 3 is a flowchart illustrating steps of a method for processing an object according to another embodiment of the present invention;

FIG. 4-1 is a flow chart illustrating steps of a further object processing method according to an embodiment of the present invention;

fig. 4-2 is a schematic diagram of an application of extracting a target object based on multiple target features according to an embodiment of the present invention;

FIG. 5 is a block diagram of an object processing system provided by an embodiment of the invention;

fig. 6 is a block diagram of an object processing apparatus according to an embodiment of the present invention;

fig. 7 is a block diagram of another object processing apparatus according to an embodiment of the present invention.

Detailed Description

Exemplary embodiments of the present invention will be described in more detail below with reference to the accompanying drawings. While exemplary embodiments of the invention are shown in the drawings, it should be understood that the invention can be embodied in various forms and should not be limited to the embodiments set forth herein. Rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the scope of the invention to those skilled in the art.

In an actual application scenario, in order to improve the security of a network system, it is often necessary to evaluate whether behaviors of an object in a network are abnormal, and accordingly, in the prior art, it is often determined whether the object has the abnormal behavior based on a single feature of the object, if so, the authority of the object is limited, and the confidence of the whole evaluation mode is low, so that a situation that a normal object is evaluated as an object having the abnormal behavior, the authority of the object is limited, and the accuracy of processing operation is low may occur.

Therefore, an embodiment of the present invention provides an object processing method, in which, for a problem of low accuracy existing in the prior art, a corresponding solution idea is provided: the method comprises the steps that a terminal sends feature configuration information to a server, the feature configuration information comprises the category of a target object and at least two target features required by the target object, then the server can extract the target object according to the category of the target object and the at least two target features required by the target object, then the target object is used as an object with abnormal behavior and sent to the terminal, and finally the terminal can receive the target object sent by the server and set the authority of the target object based on the at least two target features of the target object. In the embodiment of the invention, the server can extract the target object according to the plurality of characteristics, and correspondingly, the terminal can set the authority of the target object when the target object meets the plurality of characteristics, so that the problem that the authority of part of normal objects is limited is avoided, and the accuracy of object processing is improved.

The above-mentioned object processing method is specifically described below.

Fig. 1 is a flowchart of steps of an object processing method according to an embodiment of the present invention, which is applied to a system including a terminal and a server, and as shown in fig. 1, the method may include:

step 101, the terminal sends feature configuration information to the server; the feature configuration information includes a category of the target object and at least two target features required by the target object.

In the embodiment of the present invention, in order to improve the confidence that the extracted target object is an abnormal-behavior object, the terminal may send, to the server, feature configuration information including a category of the target object and a plurality of target features that the target object needs to have, where each target feature may be set by a user according to an actual requirement, and for example, when an abnormal-behavior object needs to be extracted, a plurality of features that may exist in abnormal login may be set as the target features.

Furthermore, the feature configuration information can be generated by the terminal based on the selection operation of the user in the preset interface, so that the user does not need to perform customized development on different features each time, and the user can select the preset interface according to the own requirements to control the terminal to extract the target object with the target features, thereby simplifying the implementation process and reducing the implementation cost. Specifically, the preset interface may be developed in advance by a developer, different candidate object categories and different candidate feature extraction options may be defined in the preset interface, the candidate object categories defined in the preset interface indicate different types of objects, and for example, the object categories may be User Identities (UIDs), fingerprints, and IP addresses of web pages. The terminal may determine the category of the target object and at least two target features required by the target object in the feature configuration information based on the candidate object category selected by the user in the preset interface and the selected candidate feature extraction option.

Further, different candidate feature extraction options may correspond to different feature extraction factors, which may include time ranges, attributes of operations, comparators, and comparison values, among others. The time range may be unlimited time, or may be a fixed time period, for example, from 10 days in 11 months to 20 days in 11 months, or may be a sliding time period, that is, the length of the time period is fixed, but the starting and ending time points are always rolling forward, for example, within 2 hours from the current time point, further, the attribute of the operation may be the actual number of operations, the maximum number of times in unit time, the minimum number of times in unit time, the latest number of times in unit time, the number of times of a deduplication COUNT (deduplication COUNT), the duration of the operation, or the like, further, the comparator may include one of greater than, equal to, less than, equal to, or the like, and the comparison value may be any value. In practical application, all selectable contents of all feature extraction factors can be displayed in a preset interface for a user to select, and certainly, definition input boxes corresponding to all feature extraction factors can also be displayed in the preset interface, and the user can manually input required contents, which is not limited in the embodiment of the present invention. Accordingly, the terminal may combine the feature extraction factors selected or input by the user to obtain a target feature.

Step 102, the server extracts a target object according to the category of the target object and at least two target characteristics required by the target object.

In the embodiment of the present invention, the server may receive the feature configuration information sent by the terminal, and then extract the target object based on the category of the target object in the feature configuration information and at least two target features required by the target object. Because the feature configuration information includes a plurality of target features, the server performs multi-directional behavior evaluation on the target object extracted based on the plurality of target features, and therefore has a higher confidence level, for example, the confidence level of an object satisfying a plurality of abnormal login features is much higher than the confidence level of an object satisfying a single abnormal login feature.

And 103, the server takes the target object as an abnormal behavior object and sends the abnormal behavior object to the terminal.

In the embodiment of the present invention, if the target object satisfies the plurality of target characteristics, the target object may be considered as an abnormal behavior object, and at this time, the server may send the target object to the terminal, so that the terminal can process the target object.

And step 104, the terminal receives the target object sent by the server, and sets the authority of the target object based on at least two target characteristics of the target object.

In the embodiment of the present invention, the terminal may set the authority of the target object according to the number of the target features of the target object and the specific content of the target features, for example, limit the login authority of the target object, for example, limit the authority of the target object to execute a certain operation, and the like. Specifically, the larger the number of target features possessed by the target object is, the larger the difference between the specific content of the possessed target features and the normal behavior features is, the larger the degree of behavior abnormality existing in the target object can be considered, and accordingly, the degree of limitation on the terminal on the authority thereof can be larger.

In summary, in the object processing method provided in the embodiment of the present invention, the terminal may send the feature configuration information to the server, where the feature configuration information includes the category of the target object and at least two target features required by the target object, then the server may extract the target object according to the category of the target object and the at least two target features required by the target object, and then take the target object as an object with abnormal behavior and send the target object to the terminal, and finally, the terminal may receive the target object sent by the server and set the authority of the target object based on the at least two target features possessed by the target object. In the embodiment of the invention, the server can extract the target object according to the plurality of characteristics, and correspondingly, the terminal can set the authority of the target object when the target object meets the plurality of characteristics, so that the problem that the authority of part of normal objects is limited is avoided, and the accuracy of object processing is improved.

Fig. 2 is a flowchart of steps of another object processing method provided in an embodiment of the present invention, which is applied to a server, and as shown in fig. 2, the method may include:

step 201, receiving feature configuration information sent by a terminal; the feature configuration information includes a category of the target object and at least two target features required by the target object.

Specifically, the implementation manner of this step may refer to step 102, which is not described herein again in this embodiment of the present invention.

Step 202, extracting the target object according to the category of the target object and at least two target characteristics required by the target object.

And 203, taking the target object as an object with abnormal behavior, and sending the target object to the terminal.

Specifically, the implementation manner of this step may refer to step 103, which is not described herein again in this embodiment of the present invention.

In summary, in the object processing method provided in the embodiment of the present invention, the server may receive the feature configuration information sent by the terminal, where the feature configuration information includes the category of the target object and at least two target features required by the target object, and then the server may extract the target object according to the category of the target object and the at least two target features required by the target object, and then take the target object as an object with abnormal behavior and send the object to the terminal, so that the terminal may set the authority of the target object. In the embodiment of the invention, the server can extract the target object according to the plurality of characteristics, so that the terminal can set the authority of the target object when the target object meets the plurality of characteristics, the problem that the authority of part of normal objects is limited is further avoided, and the accuracy of object processing is improved.

Fig. 3 is a flowchart of steps of another object processing method provided in an embodiment of the present invention, which is applied to a terminal, and as shown in fig. 3, the method may include:

step 301, sending feature configuration information to a server; the feature configuration information includes a category of the target object and at least two target features required by the target object.

Specifically, the implementation manner of this step may refer to step 101 described above, and details of the embodiment of the present invention are not described herein.

Step 302, receiving a target object sent by the server, and setting the authority of the target object based on at least two target characteristics of the target object.

Specifically, the implementation manner of this step may refer to step 104, which is not described herein again in this embodiment of the present invention.

In summary, in the object processing method provided in the embodiment of the present invention, the terminal may send the feature configuration information to the server, so that the server determines the target object based on the plurality of target features, where the feature configuration information includes the category of the target object and at least two target features required by the target object, and then the terminal may receive the target object sent by the server, and set the authority of the target object based on the at least two target features possessed by the target object. In the embodiment of the invention, the server can extract the target object according to the plurality of characteristics, so that the terminal can set the authority of the target object when the target object meets the plurality of characteristics, the problem that the authority of part of normal objects is limited is further avoided, and the accuracy of object processing is improved.

Fig. 4-1 is a flowchart illustrating steps of another object processing method according to an embodiment of the present invention, and as shown in fig. 4-1, the method may include:

step 401, the terminal sends feature configuration information to a server; the feature configuration information includes a category of the target object and at least two target features required by the target object.

Step 402, the server receives the feature configuration information sent by the terminal.

Step 403, the server extracts the target object according to the category of the target object and at least two target features required by the target object.

In one possible embodiment, step 403 may be implemented by steps 4031-4034 as follows:

step 4031, the server respectively establishes different processing tasks for each target feature, and determines the priority of each processing task according to the target feature corresponding to each processing task.

In this step, the server may establish a corresponding processing task for each target feature, where different processing tasks are used to filter the objects according to different target features, and specifically, the server may establish a processing task for each target feature by establishing a thread for each target feature.

Further, in determining the priority of each processing task, the server may be implemented by the following sub-steps (1) to (3):

substep (1): the server judges whether the at least two target characteristics have associated characteristics. If not, performing substep (2), and if so, performing substep (3).

In this step, the associated feature includes a content of a basic feature, and the basic feature is any one of the at least two target features except the associated feature. Specifically, the server may analyze the content of the target feature one by one, and determine whether the content of the target feature is the associated feature according to whether the content of the target feature includes the content of other target features. As an example, it is assumed that 3 target features are included, where the target feature a is "login number is greater than 3 within 1 minute", the target feature b is "login number is greater than 3 within 1 minute occurring within 1 hour" greater than 5 ", and the target feature c is" number of login devices used within 10 days is greater than 6 ", and since the target feature b includes the content of the target feature a, it may be determined that the target feature a is a base feature and the target feature b is a related feature.

Substep (2): and if the at least two target characteristics do not have associated characteristics, the server randomly sets the priority for each processing task.

In this step, if there is no correlation feature, each processing task may be processed in a random order, and thus, a priority may be randomly set for each processing task.

Substep (3): if the associated characteristics exist in the at least two target characteristics, the server sets the priority of the processing task corresponding to the basic characteristics of the associated characteristics to be higher than the priority of the processing task corresponding to the associated characteristics, and randomly sets the priorities of other processing tasks.

For example, the server may set a priority higher than the processing task corresponding to the target feature b for the processing task corresponding to the target feature a, and randomly set a priority for the processing task corresponding to the target feature c, for example, the priority higher than the processing task corresponding to the target feature a may be set for the processing task corresponding to the target feature c, or the priority lower than the processing task corresponding to the target feature a may be set for the processing task corresponding to the target feature c, and the like, which are not limited in this embodiment of the present invention.

In the embodiment of the invention, the object with the basic characteristic can be ensured to be determined in advance by setting the priority of the processing task corresponding to the basic characteristic to be higher than the priority of the processing task corresponding to the associated characteristic, so that the processing task corresponding to the associated characteristic only needs to continuously extract the object conforming to the associated characteristic from the processing result of the processing task corresponding to the basic characteristic, thereby reducing the processing range of the processing task corresponding to the associated characteristic and improving the processing efficiency.

Step 4032, extracting the target object by using each processing task according to the priority of each processing task, the target feature corresponding to each processing task and the category of the target object.

Specifically, step 4032 can be implemented by steps 4032a to 4032c as follows:

step 4032a, the server extracts, by using the highest priority processing task, an object which has the target feature corresponding to the highest priority processing task and has the same category as the target object, and obtains an object corresponding to the highest priority processing task.

In this step, the highest priority processing task is the corresponding highest priority processing task, and specifically, if the target time period in the target feature corresponding to the highest priority processing task falls within the time range of the real-time data, the server may extract the object corresponding to the highest priority processing task from the real-time data, where the object corresponding to the highest priority processing task is the object having the target feature corresponding to the highest priority processing task and having the same category as the target object.

The target time period is a time range used for representing statistics in the target feature, the real-time data is received by the server within a preset time from the current time, the preset time is set according to an actual situation, for example, the preset time may be 10 minutes, and accordingly, the time range of the real-time data is within the preset time from the current time.

In the embodiment of the invention, the target time period in the target characteristic corresponding to the highest priority processing task falls into the time range of the real-time data, and the object corresponding to the highest priority processing task is extracted from the real-time data, so that the extraction range can be reduced, and the extraction efficiency is further improved. Specifically, the server may extract, from the real-time data, an object having a target feature corresponding to the highest priority processing task and having a category identical to that of the target object, by using a preset real-time computing engine. The real-time computing engine may be an engine, which is deployed in advance on a server, for extracting an object from real-time data, the real-time data may be composed of a plurality of message queues, each message queue may include data sent to the server, and the data may be a log.

During extraction, the server may analyze each piece of data in the real-time data, determine an object indicated by each piece of data, an operation performed on the object, and an operation time, then count an analysis result, determine a specific value of an attribute of a target operation corresponding to an object of the same type as the target object within a target time period, and finally determine whether the value satisfies a numerical relationship represented by a comparator and a comparison value in a target feature corresponding to the highest priority processing task, for example, the number of times of login of UID1 within 1 minute from the current time point is 3, the number of times of login of UID2 within 1 minute from the current time point is 7, and the numerical relationship represented by the comparator and the comparison value in the target feature corresponding to the highest priority processing task is greater than 5, since UID1 does not satisfy the numerical relationship, and UID2 satisfies the numerical relationship, the UID2 may be determined to be the object corresponding to the highest priority processing task.

Further, if the target time period in the target feature corresponding to the highest priority processing task falls within the time range of the offline data, the server may extract the object corresponding to the highest priority processing task from the offline data, where the offline data is historical data received by the server within a time exceeding a preset time from the current time, and accordingly, the time range of the offline data is a time other than the preset time from the current time, and further, the offline data may be stored in a database, and the database may be deployed on the server or on another server, which is not limited in the embodiment of the present invention, in which, by extracting the target object from the offline data when the target time period in the target feature corresponding to the highest priority processing task falls within the time range of the offline data, the extraction range may be reduced, thereby improving the extraction efficiency.

Specifically, the server may select a target data source from a plurality of preset data sources according to a target feature corresponding to the highest priority processing task, where different data sources include offline data for different types of operations. In practical applications, in order to facilitate management of offline data, the offline data is often classified and stored to different locations according to different data dimensions, and therefore, multiple data sources exist. Taking data dimensions as the types of operations corresponding to data as an example, the preset multiple data sources may store offline data for different types of operations, where the address and the adopted data format of each data source may be different. Correspondingly, the server can select a data source with the stored offline data matched with the operation corresponding to the target feature from a plurality of preset data sources as the target data source, so that the data range of the extraction object is reduced, and the extraction operation efficiency is improved. For example, assuming that the target characteristic is that "the number of login operations in 11 months 10 to 11 months 20 is greater than 1000", the server may select the stored offline data as the data source for the login operations as the target data source.

Then, the server may screen the data in the target data source according to a target time period included in the target feature corresponding to the highest priority processing task, so as to obtain offline data to be analyzed. For example, assuming that the target time period is from 11 month 10 to 11 month 20, the server performs screening according to the time point of each piece of offline data in the target data source, and specifically, the offline data whose time point is from 11 month 10 to 11 month 20 may be determined as the offline data to be analyzed. Of course, as the requirements for object extraction are different, the target feature may further include other information, for example, a service source of the data, and accordingly, when the screening is performed, the screening may also be performed according to the service source, and when a plurality of screening conditions are provided, each condition may be satisfied as the screening criterion, or any one of the conditions may be satisfied as the screening criterion, which is not limited in the embodiment of the present invention. In the embodiment of the invention, the offline data in the target data source is screened, so that the data range of the extracted object can be further reduced, and the efficiency of the extraction operation is further improved.

Finally, the server can extract the object with the target characteristics corresponding to the processing task with the highest priority from the offline data to be analyzed by using a preset offline calculation engine. In this step, the offline computation engine may be an engine that is deployed in advance on a server and is used for extracting objects from offline data. Specifically, the server may analyze each piece of offline data to be analyzed in the offline data to be analyzed, determine an object indicated by each piece of offline data to be analyzed, an operation performed on the object, and an operation time, then count an analysis result, determine the number of times of an attribute of a target operation corresponding to an object having the same category as the target object in a target time period, and finally determine whether the number of times of the attribute satisfies a numerical relationship represented by a comparator and a comparison value in a target feature corresponding to the highest-priority processing task, and if the number of times of the attribute satisfies the numerical relationship, may determine the number of times of the attribute as the object corresponding to the highest-priority processing task.

Further, if a part of the target time period in the target feature corresponding to the highest priority processing task falls within the time range of the real-time data and another part of the target time period falls within the time range of the offline data, the server may extract the object corresponding to the highest priority processing task from the real-time data and the offline data.

Specifically, the server may extract, from the real-time data, the first object having the target feature corresponding to the highest-priority processing task by using a preset real-time computing engine. For example, assuming that the target time period in the target feature corresponding to the highest priority processing task is one minute, the server may count, from the real-time data, a specific value of an attribute of the target operation corresponding to an object having the same category as the target object within one minute, for example, count a specific value of the number of logins of the UID within 1 minute, and finally determine whether the value relationship represented by the comparator and the comparison value in the feature configuration information is satisfied, and if so, determine that the value relationship is the first object.

Then, a target data source can be selected from a plurality of preset data sources according to the target characteristics corresponding to the highest priority processing task, then, data in the target data source is screened according to a target time period included in the target characteristics corresponding to the highest priority processing task to obtain offline data to be analyzed, then, a preset offline calculation engine is utilized to extract a second object with the target characteristics corresponding to the highest priority processing task from the offline data to be analyzed, and finally, the first object and the second object are used as objects corresponding to the highest priority processing task.

Step 4032b, for any processing task except the processing task with the highest priority, according to the sequence from high priority to low priority, the processing task is used for extracting an object with target characteristics corresponding to the processing task from objects corresponding to a processing task at the previous level of the processing task, and an object corresponding to the processing task is obtained.

In this step, when an object corresponding to the processing task is extracted from objects corresponding to the previous processing task by any processing task except the processing task of the highest priority, the object corresponding to the highest priority processing task extracted by the processing task of the highest priority is essentially extracted on the basis, and the object corresponding to the highest priority processing task is the same as the type of the target object.

Specifically, this step can be realized by the following substeps (1) to (4):

substep (1): the server takes an object corresponding to a previous-level processing task as an alternative object, and for each alternative object, if a target time period in target characteristics corresponding to the processing task falls into a time range of real-time data, whether the alternative object has the target characteristics corresponding to the processing task is determined based on the real-time data.

For example, assume that there are 3 target features: the method comprises the following steps of obtaining a target feature a, a target feature b and a target feature c, wherein the processing tasks corresponding to the target feature are respectively as follows: processing task 1, processing task 2, and processing task 3, the priority of these 3 processing tasks from high to low is: processing task 3, processing task 1, and processing task 2, the server may extract an object having the target feature c by using processing task 3 in step 4032, and obtain an object corresponding to processing task 3.

Specifically, the server may perform processing using the processing task 1, and since the processing task of the previous stage of the processing task 1 is the processing task 3, the server may use an object corresponding to the processing task 3 as a candidate, and determine whether or not the candidate has an object having the target feature corresponding to the processing task 1 from among the candidates using the processing task 1.

Specifically, if the target time period in the target feature a corresponding to the processing task 1 falls within the time range of the real-time data, the server may determine whether the candidate object has the target feature corresponding to the processing task 1 based on the real-time data, specifically, the server may analyze each piece of data in the real-time data by using a preset real-time calculation engine, determine an object indicated by each piece of data, an operation performed on the object, and an operation time, then, count an analysis result, determine a specific value of an attribute of the target operation corresponding to the candidate object in the target time period, finally, determine whether the value satisfies a numerical relationship represented by a comparator and a comparison value in the target feature corresponding to the processing task, and if the value satisfies the numerical relationship, determine that the candidate object has the target feature corresponding to the processing task.

Substep (2): and if the target time period in the target characteristics corresponding to the processing task falls into the time range of the offline data, determining whether the candidate object has the target characteristics corresponding to the processing task based on the offline data.

Specifically, the server may analyze each piece of data in the offline data by using a preset offline calculation engine, determine an object indicated by each piece of data, an operation performed on the object, and an operation time, then count an analysis result, determine a specific value of an attribute of a target operation corresponding to the candidate object in a target time period, and finally determine whether the value satisfies a numerical relationship represented by a comparator and a comparison value in a target feature corresponding to the processing task, and if the value satisfies the numerical relationship, determine that the candidate object has the target feature corresponding to the processing task.

Substep (3): and if one part of the target time period in the target characteristics corresponding to the processing task falls into the time range of real-time data and the other part of the target time period falls into the time range of offline data, determining whether the candidate object has the target characteristics corresponding to the processing task or not based on the real-time data and the offline data.

Specifically, the determination manner in this step may refer to the foregoing steps, and the present invention is not described herein again.

Substep (4): and taking the candidate object with the target characteristics corresponding to the processing task as the object corresponding to the processing task.

For example, assuming that 4 candidate objects have the target feature corresponding to the processing task, the server may use the 4 candidate objects as the objects corresponding to the processing task.

Step 4032c, the object extracted by the lowest priority processing task is determined as the target object.

In the embodiment of the present invention, the object corresponding to the previous processing task of each processing task is an object having the target feature corresponding to each processing task before the processing task, so that the object determined by the lowest priority processing task from the objects corresponding to the previous processing task has all the target features, and the server can determine the object extracted by using the lowest priority processing task as the target object.

Further, fig. 4-2 is an application diagram of extracting a target object based on a plurality of target features according to an embodiment of the present invention, as shown in fig. 4-2, a server may utilize a real-time computing engine and an offline computing engine to process real-time data and offline data, and specifically, may extract the target object based on a plurality of target features required by the target object. Further, in order to facilitate the subsequent process of utilizing the target object according to the features of the target object, for example, performing model training as a sample, in the embodiment of the present invention, after extracting the target object according to the category of the target object and at least two target features required by the target object, the server may further store the target object and the at least two target features required by the target object into a specified database, so as to facilitate other operations to utilize. For example, the target object and at least two target features required by the target object may be used as model training samples for training the model, or, according to the target object and the at least two target features required by the target object, an access rule may be set for the client, for example, the feature required by the false target object is more than 10 login operations in one minute, and the access rule may be set to prohibit the target object with the feature required by the target object from accessing, so as to improve the security of the client.

And step 404, the server takes the target object as an object with abnormal behavior and sends the object to the terminal.

Step 405, the terminal receives the target object sent by the server, and sets the authority of the target object based on at least two target characteristics of the target object.

Fig. 5 is a block diagram of an object processing system according to an embodiment of the present invention, and as shown in fig. 5, the system 50 may include: a terminal 501 and a server 502;

the terminal 501 is configured to send feature configuration information to the server 502; the feature configuration information comprises the category of the target object and at least two target features required by the target object;

the server 502 is configured to extract a target object according to the category of the target object and at least two target features required by the target object;

the server 502 is further configured to use the target object as an abnormal behavior object, and send the abnormal behavior object to the terminal 501.

The terminal 501 is further configured to receive the target object sent by the server 502, and set the authority of the target object based on at least two target features of the target object.

In summary, in the object processing system provided in the embodiment of the present invention, the terminal may send feature configuration information to the server, where the feature configuration information includes a category of the target object and at least two target features required by the target object, then the server may extract the target object according to the category of the target object and the at least two target features required by the target object, then take the target object as an object with abnormal behavior and send the target object to the terminal, and finally, the terminal may receive the target object sent by the server and set the authority of the target object based on the at least two target features possessed by the target object. In the embodiment of the invention, the server can extract the target object according to the plurality of characteristics, and correspondingly, the terminal can set the authority of the target object when the target object meets the plurality of characteristics, so that the problem that the authority of part of normal objects is limited is avoided, and the accuracy of object processing is improved.

Fig. 6 is a block diagram of an object processing apparatus according to an embodiment of the present invention, and as shown in fig. 6, the apparatus 60 may include:

a receiving module 601, configured to receive feature configuration information sent by a terminal; the feature configuration information comprises the category of the target object and at least two target features required by the target object;

an extracting module 602, configured to extract a target object according to a category of the target object and at least two target features required by the target object;

a sending module 603, configured to take the target object as an abnormal behavior object, and send the abnormal behavior object to the terminal.

Optionally, the extracting module 602 includes:

Optionally, the extracting sub-module includes:

a first extraction unit, configured to extract, by using a highest priority processing task, an object that has a target feature corresponding to the highest priority processing task and has a same category as that of the target object, and obtain an object corresponding to the highest priority processing task;

Optionally, the establishing sub-module is configured to:

Optionally, the first extracting unit is configured to:

Optionally, the second extracting unit is configured to:

Optionally, the apparatus 60 further includes:

In summary, in the object processing apparatus provided in the embodiments of the present invention, the first receiving module may receive feature configuration information sent by the terminal, where the feature configuration information includes a category of the target object and at least two target features required by the target object, the extracting module may then extract the target object according to the category of the target object and the at least two target features required by the target object, and then the first sending module takes the target object as an object with abnormal behavior and sends the object to the terminal, so that the terminal may set the authority of the target object. In the embodiment of the invention, the server can extract the target object according to the plurality of characteristics, so that the terminal can set the authority of the target object when the target object meets the plurality of characteristics, the problem that the authority of part of normal objects is limited is further avoided, and the accuracy of object processing is improved.

Fig. 7 is a block diagram of another object processing apparatus according to an embodiment of the present invention, and as shown in fig. 7, the apparatus 70 may include:

a sending module 701, configured to send feature configuration information to a server; the feature configuration information comprises the category of the target object and at least two target features required by the target object;

a receiving module 702, configured to receive a target object sent by the server, and set an authority of the target object based on at least two target features of the target object.

In summary, in the object processing apparatus provided in the embodiment of the present invention, the second sending module may send the feature configuration information to the server, so that the server determines the target object based on the plurality of target features, where the feature configuration information includes the category of the target object and at least two target features required by the target object, and then the second receiving module may receive the target object sent by the server, and set the authority of the target object based on the at least two target features possessed by the target object. In the embodiment of the invention, the server can extract the target object according to the plurality of characteristics, so that the terminal can set the authority of the target object when the target object meets the plurality of characteristics, the problem that the authority of part of normal objects is limited is further avoided, and the accuracy of object processing is improved.

For the above device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and for the relevant points, refer to the partial description of the method embodiment.

Preferably, an embodiment of the present invention further provides a mobile terminal, which includes a processor, a memory, and a computer program stored in the memory and capable of running on the processor, where the computer program, when executed by the processor, implements each process of the above object processing method embodiment, and can achieve the same technical effect, and details are not repeated here to avoid repetition.

The embodiment of the present invention further provides a computer-readable storage medium, where a computer program is stored on the computer-readable storage medium, and when the computer program is executed by a processor, the computer program implements each process of the embodiment of the object processing method, and can achieve the same technical effect, and in order to avoid repetition, details are not repeated here. The computer-readable storage medium may be a Read-Only Memory (ROM), a Random Access Memory (RAM), a magnetic disk or an optical disk.

The embodiments in the present specification are described in a progressive manner, each embodiment focuses on differences from other embodiments, and the same and similar parts among the embodiments are referred to each other.

As is readily imaginable to the person skilled in the art: any combination of the above embodiments is possible, and thus any combination between the above embodiments is an embodiment of the present invention, but the present disclosure is not necessarily detailed herein for reasons of space.

The object handling methods provided herein are not inherently related to any particular computer, virtual system, or other apparatus. Various general purpose systems may also be used with the teachings herein. The structure required to construct a system incorporating aspects of the present invention will be apparent from the description above. Moreover, the present invention is not directed to any particular programming language. It is appreciated that a variety of programming languages may be used to implement the teachings of the present invention as described herein, and any descriptions of specific languages are provided above to disclose the best mode of the invention.

In the description provided herein, numerous specific details are set forth. It is understood, however, that embodiments of the invention may be practiced without these specific details. In some instances, well-known methods, structures and techniques have not been shown in detail in order not to obscure an understanding of this description.

Similarly, it should be appreciated that in the foregoing description of exemplary embodiments of the invention, various features of the invention are sometimes grouped together in a single embodiment, figure, or description thereof for the purpose of streamlining the invention and aiding in the understanding of one or more of the various inventive aspects. However, the disclosed method should not be interpreted as reflecting an intention that: that the invention as claimed requires more features than are expressly recited in each claim. Rather, as the following claims reflect, inventive aspects lie in less than all features of a single foregoing disclosed embodiment. Thus, the claims following the detailed description are hereby expressly incorporated into this detailed description, with each claim standing on its own as a separate embodiment of this invention.

Those skilled in the art will appreciate that the modules in the device in an embodiment may be adaptively changed and disposed in one or more devices different from the embodiment. The modules or units or components of the embodiments may be combined into one module or unit or component, and furthermore they may be divided into a plurality of sub-modules or sub-units or sub-components. All of the features disclosed in this specification (including any accompanying claims, abstract and drawings), and all of the processes or elements of any method or apparatus so disclosed, may be combined in any combination, except combinations where at least some of such features and/or processes or elements are mutually exclusive. Each feature disclosed in this specification (including any accompanying claims, abstract and drawings) may be replaced by alternative features serving the same, equivalent or similar purpose, unless expressly stated otherwise.

Furthermore, those skilled in the art will appreciate that while some embodiments described herein include some features included in other embodiments, rather than other features, combinations of features of different embodiments are meant to be within the scope of the invention and form different embodiments. For example, in the claims, any of the claimed embodiments may be used in any combination.

The various component embodiments of the invention may be implemented in hardware, or in software modules running on one or more processors, or in a combination thereof. Those skilled in the art will appreciate that a microprocessor or Digital Signal Processor (DSP) may be used in practice to implement some or all of the functions of some or all of the components of the object processing method according to embodiments of the present invention. The present invention may also be embodied as apparatus or device programs (e.g., computer programs and computer program products) for performing a portion or all of the methods described herein. Such programs implementing the present invention may be stored on computer-readable media or may be in the form of one or more signals. Such a signal may be downloaded from an internet website or provided on a carrier signal or in any other form.

It should be noted that the above-mentioned embodiments illustrate rather than limit the invention, and that those skilled in the art will be able to design alternative embodiments without departing from the scope of the appended claims. In the claims, any reference signs placed between parentheses shall not be construed as limiting the claim. The word "comprising" does not exclude the presence of elements or steps not listed in a claim. The word "a" or "an" preceding an element does not exclude the presence of a plurality of such elements. The invention may be implemented by means of hardware comprising several distinct elements, and by means of a suitably programmed computer. In the unit claims enumerating several means, several of these means may be embodied by one and the same item of hardware. The usage of the words first, second and third, etcetera do not indicate any ordering. These words may be interpreted as names.

Claims

1. An object processing method is applied to a system comprising a terminal and a server, and the method comprises the following steps:

the server takes the target object as an object with abnormal behavior and sends the object to the terminal;

2. An object processing method applied to a server, the method comprising:

3. The method of claim 2, wherein extracting the target object according to the category of the target object and the at least two target features required by the target object comprises:

4. The method according to claim 3, wherein the extracting the target object by using each processing task according to the priority of each processing task, the target feature corresponding to each processing task and the category of the target object comprises:

5. The method of claim 3, wherein determining the priority of each processing task according to the target feature corresponding to each processing task comprises:

6. The method according to claim 4, wherein the extracting, by using the highest priority processing task, the object having the target feature corresponding to the highest priority processing task and having the same category as the target object to obtain the object corresponding to the highest priority processing task comprises:

7. The method according to claim 4, wherein the extracting, by the processing task, an object having a target feature corresponding to the processing task from objects corresponding to a previous processing task of the processing task to obtain an object corresponding to the processing task, includes:

8. The method according to claim 2, wherein after extracting the target object according to the category of the target object and the at least two target features required by the target object, the method further comprises:

9. An object processing method, applied to a terminal, the method comprising:

10. An object processing system is characterized in that the system comprises a terminal and a server;

the server is also used for taking the target object as an object with abnormal behavior and sending the target object to the terminal;

11. An object processing apparatus applied to a server, the apparatus comprising:

12. The apparatus of claim 11, wherein the extraction module comprises:

13. The apparatus of claim 12, wherein the extraction sub-module comprises:

14. The apparatus of claim 12, wherein the setup submodule is configured to:

15. The apparatus of claim 13, wherein the first extraction unit is configured to:

16. The apparatus of claim 13, wherein the second extraction unit is configured to:

if the target time period in the target feature corresponding to the processing task falls within the time range of the offline data, determining whether the candidate object has the target feature corresponding to the processing task based on the offline data:

17. The apparatus of claim 11, further comprising:

18. An object processing apparatus, applied to a terminal, the apparatus comprising:

19. A computer-readable storage medium, on which a computer program is stored, which, when executed by a processor, implements an object processing method according to any one of claims 1 to 9.