CN110347568A - The treating method and apparatus of user behavior data - Google Patents
The treating method and apparatus of user behavior data Download PDFInfo
- Publication number
- CN110347568A CN110347568A CN201910566383.1A CN201910566383A CN110347568A CN 110347568 A CN110347568 A CN 110347568A CN 201910566383 A CN201910566383 A CN 201910566383A CN 110347568 A CN110347568 A CN 110347568A
- Authority
- CN
- China
- Prior art keywords
- data
- user behavior
- behavior data
- rule
- matching
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Withdrawn
Links
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/30—Monitoring
- G06F11/34—Recording or statistical evaluation of computer activity, e.g. of down time, of input/output operation ; Recording or statistical evaluation of user activity, e.g. usability assessment
- G06F11/3438—Recording or statistical evaluation of computer activity, e.g. of down time, of input/output operation ; Recording or statistical evaluation of user activity, e.g. usability assessment monitoring of user actions
Landscapes
- Engineering & Computer Science (AREA)
- General Engineering & Computer Science (AREA)
- Theoretical Computer Science (AREA)
- Computer Hardware Design (AREA)
- Quality & Reliability (AREA)
- Physics & Mathematics (AREA)
- General Physics & Mathematics (AREA)
- Management, Administration, Business Operations System, And Electronic Commerce (AREA)
Abstract
This application discloses a kind for the treatment of method and apparatus of user behavior data.The described method includes: user behavior data is obtained, wherein the user behavior data includes the corresponding event type information of the user behavior data；The corresponding relationship of event type according to the pre-stored data and Data Matching strategy determines the corresponding Data Matching strategy of event type information in the user behavior data；According to the Data Matching strategy, matching operation is carried out to the user behavior data, obtains matching result.
Description
Technical field
This application involves field of information processing, espespecially a kind for the treatment of method and apparatus of user behavior data.
Background technique
Risk control system acquires operation behavior of the user on network, obtains corresponding user behavior data, and utilize
Preset matching rule analyzes collected user behavior data, finds abnormal behaviour therein, and then notify downstream
System either user, makes the further precautionary measures.
In the related art, under the limitation of software architecture and machine performance, risk control system is based on batch processing side
Formula is collected and analyzes to data, since data volume is huge and the inefficiencies of analysis mode, is difficult to accomplish the reality of risk judgment
Shi Xing.It is that subsequent remind could even find behind second day after problem occurs mostly.Therefore, the batch processing of periodic point
Analysis task is unable to fully the computing capability using server, seriously constrains the application of risk control system in actual production.
Summary of the invention
In order to solve the above-mentioned technical problem, this application provides a kind for the treatment of method and apparatus of user behavior data, energy
Enough improve the matching efficiency of user behavior data.
In order to reach the application purpose, this application provides a kind of processing methods of user behavior data, comprising:
User behavior data is obtained, wherein the user behavior data includes the corresponding event class of the user behavior data
Type information；
The corresponding relationship of event type according to the pre-stored data and Data Matching strategy determines in the user behavior data
The corresponding Data Matching strategy of event type information, wherein the Data Matching strategy is arranged according to pre-set syntactic structure
's；
According to the Data Matching strategy, matching operation is carried out to the user behavior data, obtains matching result.
In one exemplary embodiment, the corresponding event type information of the user behavior data is in the following way
Determining, comprising:
The data source of the user behavior data；And/or the value of the corresponding service fields of the user behavior data.
In one exemplary embodiment, the syntactic structure includes needed for the description content and/or rule execution of rule
Precondition；
The description content of the judgment rule includes event type, length of window, a statistical unit and for judging whether
At least one of parameter with rule；
It is described rule execute needed for precondition include event type, length of window, statistical unit and for judge be
No at least one of the execution condition for carrying out rule match；
It is described that matching operation is carried out to the user behavior data, obtains matching result according to the Data Matching strategy,
Include:
Step 1 judges whether there is the precondition in the Data Matching strategy；
If there is the precondition, then judge whether the user behavior data meets the precondition, then executes
Step 2:；
If thening follow the steps 2 without the precondition；
Step 2, according to the judgment rule description content record in matching object, from the user behavior data
Extract the value information of the matching object；
Step 3, by the judgement for matching object in the description content record of obtained value information and the judgment rule
Condition is matched, and matching result is obtained.
In one exemplary embodiment, described according to the Data Matching strategy, the user behavior data is carried out
Matching operation, before obtaining matching result, further includes:
When user behavior data includes data generation time information, the data procedures in predetermined time period are being obtained
In, according to the data time information in the length of pre-set time delay and received user behavior data, execute number
It is operated according to obtaining；And/or
After having executed data acquisition operations, according to pre-set data classification rule, to the user behavior got
Data are classified, and manifold classification data are obtained.
In one exemplary embodiment, the method also includes:
It is modified when detecting in data matching strategy, obtains the corresponding Notification of Changes letter of changed rule
Breath, wherein the Notification of Changes information includes the mark of change type and rule；
According to the change communication information, pre-stored Data Matching strategy is synchronized.
A kind of processing unit of user behavior data, including processor and memory, wherein the memory is stored with meter
Calculation machine program, the processor call the computer program in the memory to realize following operation, comprising:
User behavior data is obtained, wherein the user behavior data includes the corresponding event class of the user behavior data
Type information；
The corresponding relationship of event type according to the pre-stored data and Data Matching strategy determines in the user behavior data
The corresponding Data Matching strategy of event type information, wherein the Data Matching strategy is arranged according to pre-set syntactic structure
's；
According to the Data Matching strategy, matching operation is carried out to the user behavior data, obtains matching result.
In one exemplary embodiment, the processor calls the computer program in the memory to pass through to realize
Such as the corresponding event type information of determination user behavior of under type, comprising:
The data source of the user behavior data；And/or the value of the corresponding service fields of the user behavior data.
In one exemplary embodiment, the institute that the processor calls the computer program in the memory to be realized
Precondition needed for stating the description content and/or rule execution that syntactic structure includes rule；
The description content of the judgment rule includes event type, length of window, a statistical unit and for judging whether
At least one of parameter with rule；
It is described rule execute needed for precondition include event type, length of window, statistical unit and for judge be
No at least one of the execution condition for carrying out rule match；
It is described according to the Data Matching strategy to realize that the processor calls the computer program in the memory,
Matching operation is carried out to the user behavior data, obtains matching result, comprising:
Step 1 judges whether there is the precondition in the Data Matching strategy；
If there is the precondition, then judge whether the user behavior data meets the precondition, then executes
Step 2:；
If thening follow the steps 2 without the precondition；
Step 2, according to the judgment rule description content record in matching object, from the user behavior data
Extract the value information of the matching object；
Step 3, by the judgement for matching object in the description content record of obtained value information and the judgment rule
Condition is matched, and matching result is obtained.
In one exemplary embodiment, the processor call the computer program in the memory with realize according to
The Data Matching strategy carries out matching operation, before obtaining the operation of matching result, the place to the user behavior data
Reason device calls the computer program in the memory also to realize following operation, comprising:
When user behavior data includes data generation time information, the data procedures in predetermined time period are being obtained
In, according to the data time information in the length of pre-set time delay and received user behavior data, execute number
It is operated according to obtaining；And/or
After having executed data acquisition operations, according to pre-set data classification rule, to the user behavior got
Data are classified, and manifold classification data are obtained.
In one exemplary embodiment, the processor calls the computer program in the memory also to realize as follows
Operation, comprising:
It is modified when detecting in data matching strategy, obtains the corresponding Notification of Changes letter of changed rule
Breath, wherein the Notification of Changes information includes the mark of change type and rule；
According to the change communication information, pre-stored Data Matching strategy is synchronized.
Embodiment provided by the present application obtains user behavior data, wherein the user behavior data includes the user
The corresponding event type information of behavioral data, and the corresponding relationship of event type according to the pre-stored data and Data Matching strategy,
Determine the corresponding Data Matching strategy of event type information in the user behavior data, wherein the Data Matching strategy according to
Pre-set syntactic structure setting, according still further to the Data Matching strategy, matching behaviour is carried out to the user behavior data
Make, obtain matching result, using event type information and data matching strategy, facilitates determining matching rule, and using preset
Syntactic structure writes Data Matching strategy, eliminates the ambiguity in Data Matching strategy, improves the matching effect of user behavior data
Rate.
Other features and advantage will illustrate in the following description, also, partly become from specification
It obtains it is clear that being understood and implementing the application.The purpose of the application and other advantages can be by specifications, right
Specifically noted structure is achieved and obtained in claim and attached drawing.
Detailed description of the invention
Attached drawing is used to provide to further understand technical scheme, and constitutes part of specification, with this
The embodiment of application is used to explain the technical solution of the application together, does not constitute the limitation to technical scheme.
Fig. 1 is the flow chart of the processing method of user behavior data provided by the present application；
Fig. 2 is the flow chart of regular dynamic updating method provided by the embodiments of the present application；
Fig. 3 is the flow chart of the processing method of user behavior data provided by the embodiments of the present application.
Specific embodiment
For the purposes, technical schemes and advantages of the application are more clearly understood, below in conjunction with attached drawing to the application
Embodiment be described in detail.It should be noted that in the absence of conflict, in the embodiment and embodiment in the application
Feature can mutual any combination.
Step shown in the flowchart of the accompanying drawings can be in a computer system such as a set of computer executable instructions
It executes.Also, although logical order is shown in flow charts, and it in some cases, can be to be different from herein suitable
Sequence executes shown or described step.
Fig. 1 is the flow chart of the processing method of user behavior data provided by the present application.Method shown in Fig. 1 includes:
Step 101 obtains user behavior data, wherein the user behavior data includes that the user behavior data is corresponding
Event type information；
In one exemplary embodiment, the embodiment of the present application has abandoned batch processing mode, uses new stream process completely
Mode.Stream process has many advantages, such as that time delay is low, and handling capacity is big and resource occupation is small, guarantees the reliability that message is sent, easily extends
Property and handling capacity.The embodiment of the present application uses message-oriented middleware (Kafka) real-time reception user behavior data.
In one exemplary embodiment, event type field is contained in user behavior data and event field occurs.
Wherein:
Event type field determines which rule is suitable for this user behavior data；Wherein rule is stored in advance in number
According in library.It is right using the rule for being suitable for the type data according to the event type field in data when user data arrives
It carries out matching primitives.If in rule including the dependence of front and back arrival data, such as time window either sequencing,
It needs to cache and the user behavior data in pre-calculation time window.
It is that will occur in event field when executing matching primitives that the description information that event field is event content, which occurs,
Content matched with rule in database.
Different user behavior datas may be implemented based on aforesaid way and be matched to applicable rule.
The corresponding relationship of step 102, event type according to the pre-stored data and Data Matching strategy determines user's row
For the corresponding Data Matching strategy of event type information in data, wherein the Data Matching strategy is according to pre-set grammer
Structure setting；
In one exemplary embodiment, the rule recorded in Data Matching strategy carries out standardization processing.Due to text
The rule of describing mode can not be parsed by a program, and can have ambiguity.Therefore the embodiment of the present application provides set of rule and describes language
Method solves the above problems.
Step 103 matches user behavior data progress matching operation according to the Data Matching strategy
As a result.
Embodiment of the method provided by the present application obtains user behavior data, wherein the user behavior data includes described
The corresponding event type information of user behavior data, and event type according to the pre-stored data pass corresponding with Data Matching strategy
System, determines the corresponding Data Matching strategy of event type information in the user behavior data, wherein the Data Matching strategy
According to the setting of pre-set syntactic structure, according still further to the Data Matching strategy, to user behavior data progress
With operation, matching result is obtained, using event type information and data matching strategy, facilitates determining matching rule, and using pre-
If syntactic structure write Data Matching strategy, eliminate the ambiguity in Data Matching strategy, improve of user behavior data
With efficiency.
Method provided by the present application is described further below:
In view of the requirement of real-time, the embodiment of the present application uses real-time streams computing engines Flink.At traditional batch
Computing engines are managed, Flink stream process real-time is good, and resource occupation is few, and data throughout is larger, is very suitable to this application scenarios.
Data format is done into unitized processing.Used here as map operator, JSON format is uniformly converted data to.Simultaneously
Reject illegal, can not to convert data.The unrelated field of business is filtered out later, reduces volume of transmitted data and subsequent meter
Calculation amount.
In addition, data to be stamped to the label of event type again, so that subsequent determining the type data need matched rule.
Meanwhile being stored in the time that data generate in data as a field (timestamp), the timestamp is in data random ordering and rule
Then when counting statistics, using the time as reference.
In one exemplary embodiment, the corresponding event type information of the user behavior data is in the following way
Determining, comprising:
The data source of the user behavior data；And/or the value of the corresponding service fields of the user behavior data.
In one exemplary embodiment, event type can be concrete operations behavior of the user on website, such as log in,
Publish, pay the bill, going out money etc..
The embodiment of the present application can be determined corresponding by judging user behavior data is generated by which concrete operations
Time type；For example, the user behavior data is to log in some websites by user to generate, then the corresponding thing of the user behavior data
Part type is to log in.
The embodiment of the present application can be by the identification information of the type of service carried in determining user behavior data, and determining should
The corresponding event type of user behavior data.In partial service system corresponding type of service can be configured for specific transactions in advance
Mark, the type of service can to log in or publishing etc. operation behaviors, can by the acquisition of the identification information to type of service,
Determine corresponding event type.
In one exemplary embodiment, the syntactic structure includes needed for the description content and/or rule execution of rule
Precondition；
The description content of the judgment rule includes event type, length of window, a statistical unit and for judging whether
At least one of parameter with rule；
It is described rule execute needed for precondition include event type, length of window, statistical unit and for judge be
No at least one of the execution condition for carrying out rule match；
It is described that matching operation is carried out to the user behavior data, obtains matching result according to the Data Matching strategy,
Include:
Step 1 judges whether there is the precondition in the Data Matching strategy；
If there is the precondition, then judge whether the user behavior data meets the precondition, then executes
Step 2:；
If thening follow the steps 2 without the precondition；
Step 2, according to the judgment rule description content record in matching object, from the user behavior data
Extract the value information of the matching object；
Step 3, by the judgement for matching object in the description content record of obtained value information and the judgment rule
Condition is matched, and matching result is obtained.
The embodiment of the present application is studied by the rule to various verbal descriptions, to its key message carried out refine and
Standardization processing.Give following rule description grammer.
Rule syntax is described as follows:
The text of above-mentioned rule describes are as follows: within statistics nearest 3 hours, the same Customer ID transfer amounts are greater than 10000
The number that occurs of user behavior export to down-stream system and as " block trade number " field.
If necessary to match the ordered data stream of series of different, for example, user continuously logs in, 10000 yuan are produced
More than, it is then log out, whole flow process occurred within 10 minutes.It needs to increase rule following configuration:
After corresponding rule is written in for Data Matching strategy, if receiving user behavior data, from database
Full dose reads rule, according to event type field, finds matched rule.If it find that user data and a plurality of rule are
Matching, system need to be sent to downstream after being successively combined data and these rules.Every data after this step is all
Carry corresponding Rule Information.
In one exemplary embodiment, described according to the Data Matching strategy, the user behavior data is carried out
Matching operation, before obtaining matching result, further includes:
When user behavior data includes data generation time information, the data procedures in predetermined time period are being obtained
In, according to the data time information in the length of pre-set time delay and received user behavior data, execute number
It is operated according to obtaining；And/or
After having executed data acquisition operations, according to pre-set data classification rule, to the user behavior got
Data are classified, and manifold classification data are obtained.
In one exemplary embodiment, it is necessary first to handle the out-of-order problem of data.It is advised in the delayed scope of permission
The fixed delay time (such as 100ms) what a can receive.Data are received every time, only think before it the number of (100ms)
According to be it is complete received, triggering calculates also just for this partial data.In the case, carry out slow data if received
Within (100ms), which can jump the queue, subsequent to influence calculated result because of the mistake of the data arrival order.
Since this step of rule match is using data and the compatible rule merging being matched to as new element, needed herein by them
Separation, and by rule parsing.The resolution rules stage carries out division operation to data stream first.Such as it is needed herein according to client
ID statistics, system can be sent to identical subregion according to the identical data of Customer ID.If rule specifies program window
Between, each subregion needs to do window data polymerization processing.Window each in this way only exists time of origin in (current time-window
Size, current time], the user behavior data in interval closed at the right is opened on a left side, and these data belong to the same Customer ID.
If there is the requirement of preposition event in rule, need to use finite state machine (FSM) when resolution rules.Successively
The data that subregion arrives are carried out with the matching of event type.If state machine can successively match all conditions, then it is assumed that preposition
Time conditions meet, and trigger rule and calculate.Otherwise, need to confirm rule configuration in whether continuation field.If it is required that continuous,
State machine can be reset, and otherwise state machine is not reset.
For each index, the data for meeting statistical condition are filtered out, aggregate function is substituted into and calculates index result.This step
The rapid process function for using Flink.Complete customized data processing and converging operation may be implemented in the function.
After obtained calculated result, calculated result is output in regulation engine.Drools can be used in regulation engine, right
Index calculated result returned after being judged whether trigger notice event.Such as rule calculates certain user in nearest 5 minutes
It logs in 5 times repeatedly.Whether regulation engine can reach warning threshold with configuration registry number 5 times.
If you need to trigger notice event, stream process engine Flink is returned using judging result as data flow.Flink passes through again
Message-oriented middleware is sent to downstream.
In one exemplary embodiment, the method also includes:
It is modified when detecting in data matching strategy, obtains the corresponding Notification of Changes letter of changed rule
Breath, wherein the Notification of Changes information includes the mark of change type and rule；
According to the change communication information, pre-stored Data Matching strategy is synchronized.
After user changes rule using graphical interfaces, a Notification of Changes information can be generated, which contains change
More type (increase, delete, modification) and rule ID.Policy Change Notices information is needed exist for (to use as a data flow
The message systems such as Kafka).If the stream has received information, illustrate that rule changes, needs to parse modification information, increment synchronization
Rule database content achievees the purpose that the dynamic change of rule and rule change come into force immediately into caching.
In one exemplary embodiment, connect method is first used, user behavior data and Policy Change Notices are connected
Two inlet flows are flowed, then make different responses using the input data that stateful FlatMap operator flows two.Work as rule
When then Notification of Changes arrives, needs the rule in increment reading database and update rule cache.When user behavior data arrives,
From according to this field of event type, suitable rule is filtered out from rule cache, rule match is carried out, thereby realizes
The support of regular dynamic change.
It for the data with rule match, is uniformly collected into together, and downstream data stream is sent to by message-oriented middleware
In the middle.It can satisfy the diversity of down-stream system herein, various processing, such as message push can be carried out to output stream,
Mail notification, deposit database etc..
Method provided by the embodiments of the present application realizes the real-time analysis processing of user behavior data stream, is retouched by rule
Predicate method has standardized writing for rule and has eliminated ambiguity, and realizes the support that rule change dynamic realtime comes into force.
Fig. 2 is the flow chart of regular dynamic updating method provided by the embodiments of the present application.Method shown in Fig. 2 includes following step
It is rapid:
Step 201, the more new information for obtaining rule；
Wherein the more new packets include newly-increased rule, stored rule are modified or are deleted stored rule
Then；
If the more new information is directly stored in the database for storage rule, 202 are thened follow the steps；
If the more new information is the rule by client request, step 203 is being executed to step 203；
Step 202 stores the rule, then executes step 205；
Step 203, the more new information according to, create-rule Notification of Changes；
More new information is converted into a notification streams, the input information as system；
Step 204, using pre-set configuration port, send the Policy Change Notices, then execute step 205；
Step 205, the caching rule are into pre-set database.
Method provided by the embodiments of the present application can be realized the purpose that dynamic updates rule.
Fig. 3 is the flow chart of the processing method of user behavior data provided by the embodiments of the present application.Method shown in Fig. 3 includes
Following steps:
The present embodiment is continuously logged in user, is produced 10000 yuan or more, is then log out, and whole flow process occurred at 10 minutes
Within rule handled for be illustrated.
Step 301 obtains user behavior data；
Step 302 starts the cleaning processing user behavior data；
Data format is done into unitized processing.Using map operator, JSON format is uniformly converted data to, is rejected simultaneously
Data that are illegal and can not converting filter out the unrelated field of business later, reduce volume of transmitted data and subsequent meter
Calculation amount.
In addition, data to be stamped to the label of event type again, so that subsequent determining the type data need matched rule.
Meanwhile being stored in the time that data generate in data as a field (timestamp), the timestamp is in data random ordering and rule
Then when counting statistics, using the time as reference.
Step 303, by treated, user behavior data is sent to message-oriented middleware；
Step 304 passes through user data stream process entrance transmission treated the user behavior data；
User behavior data after step 305, dissection process, obtains parsing result；
Step 306 handles the data that random ordering occurs in parsing result, obtains partial data；
Wherein, step 306 is optional, and the out-of-order when just execution of data occurs in parsing result；
Step 307, using the event type in parsing result, search the corresponding rule of the parsing result；
Optionally, in matching rule, also execution step 308, dynamic update rule operation, with guarantee rule obtain and
Shi Gengxin；
If do not found, then follow the steps 309, record can not matched data, process terminates；
If found, 310 are thened follow the steps to step 318；
Step 310 carries out data subregion to user behavior data；
Whether have whether front and back data have preset dependence condition in step 311, judgment rule；
If so, thening follow the steps 312, according to time window size is arranged in rule, converging operation is carried out to data, then
Execute step 313；Otherwise, step 313 is directly executed；
In this example, need to accumulate the data within obtaining 10 minutes；
Step 313 parses rule, is filtered to data qualification；
In this example, the filter operation of data qualification be to event type, frequency, statistical condition, whether it is continuous these
Condition is judged；
Step 314, extraction need the numerical value of static fields；
In this example, the numerical value of transfer amounts is extracted；
The numerical value of step 315, counting statistics field；
In this example, the parameter for needing to compare is statistic, which is the amount totals produced；
Step 316 judges whether the numerical value for needing the parameter compared is greater than pre-set threshold value；
If it is greater, then step 317 is executed, transmission judging result to down-stream system, then execute step 318；
Step 318, storage judging result, process terminate.
Method provided by the embodiments of the present application facilitates determining matching rule, and writes data using preset syntactic structure
Matching strategy eliminates the ambiguity in Data Matching strategy, improves the matching efficiency of user behavior data.
The embodiment of the present application provides a kind of processing unit of user behavior data, including processor and memory, wherein institute
It states memory and is stored with computer program, the processor calls the computer program in the memory to realize following behaviour
Make, comprising:
User behavior data is obtained, wherein the user behavior data includes the corresponding event class of the user behavior data
Type information；
The corresponding relationship of event type according to the pre-stored data and Data Matching strategy determines in the user behavior data
The corresponding Data Matching strategy of event type information, wherein the Data Matching strategy is arranged according to pre-set syntactic structure
's；
According to the Data Matching strategy, matching operation is carried out to the user behavior data, obtains matching result.
In one exemplary embodiment, the processor calls the computer program in the memory to pass through to realize
Such as the corresponding event type information of determination user behavior of under type, comprising:
The data source of the user behavior data；And/or the value of the corresponding service fields of the user behavior data.
In one exemplary embodiment, the institute that the processor calls the computer program in the memory to be realized
Precondition needed for stating the description content and/or rule execution that syntactic structure includes rule；
The description content of the judgment rule includes event type, length of window, a statistical unit and for judging whether
At least one of parameter with rule；
It is described rule execute needed for precondition include event type, length of window, statistical unit and for judge be
No at least one of the execution condition for carrying out rule match；
It is described according to the Data Matching strategy to realize that the processor calls the computer program in the memory,
Matching operation is carried out to the user behavior data, obtains matching result, comprising:
Step 1 judges whether there is the precondition in the Data Matching strategy；
If there is the precondition, then judge whether the user behavior data meets the precondition, then executes
Step 2:；
If thening follow the steps 2 without the precondition；
Step 2, according to the judgment rule description content record in matching object, from the user behavior data
Extract the value information of the matching object；
Step 3, by the judgement for matching object in the description content record of obtained value information and the judgment rule
Condition is matched, and matching result is obtained.
In one exemplary embodiment, the processor call the computer program in the memory with realize according to
The Data Matching strategy carries out matching operation, before obtaining the operation of matching result, the place to the user behavior data
Reason device calls the computer program in the memory also to realize following operation, comprising:
When user behavior data includes data generation time information, the data procedures in predetermined time period are being obtained
In, according to the data time information in the length of pre-set time delay and received user behavior data, execute number
It is operated according to obtaining；And/or
After having executed data acquisition operations, according to pre-set data classification rule, to the user behavior got
Data are classified, and manifold classification data are obtained.
In one exemplary embodiment, the processor calls the computer program in the memory also to realize as follows
Operation, comprising:
It is modified when detecting in data matching strategy, obtains the corresponding Notification of Changes letter of changed rule
Breath, wherein the Notification of Changes information includes the mark of change type and rule；
According to the change communication information, pre-stored Data Matching strategy is synchronized.
Installation practice provided by the present application obtains user behavior data, wherein the user behavior data includes described
The corresponding event type information of user behavior data, and event type according to the pre-stored data pass corresponding with Data Matching strategy
System, determines the corresponding Data Matching strategy of event type information in the user behavior data, wherein the Data Matching strategy
According to the setting of pre-set syntactic structure, according still further to the Data Matching strategy, to user behavior data progress
With operation, matching result is obtained, using event type information and data matching strategy, facilitates determining matching rule, and using pre-
If syntactic structure write Data Matching strategy, eliminate the ambiguity in Data Matching strategy, improve of user behavior data
With efficiency.
It will appreciated by the skilled person that whole or certain steps, system, dress in method disclosed hereinabove
Functional module/unit in setting may be implemented as software, firmware, hardware and its combination appropriate.In hardware embodiment,
Division between the functional module/unit referred in the above description not necessarily corresponds to the division of physical assemblies；For example, one
Physical assemblies can have multiple functions or a function or step and can be executed by several physical assemblies cooperations.Certain groups
Part or all components may be implemented as by processor, such as the software that digital signal processor or microprocessor execute, or by
It is embodied as hardware, or is implemented as integrated circuit, such as specific integrated circuit.Such software can be distributed in computer-readable
On medium, computer-readable medium may include computer storage medium (or non-transitory medium) and communication media (or temporarily
Property medium).As known to a person of ordinary skill in the art, term computer storage medium is included in for storing information (such as
Computer readable instructions, data structure, program module or other data) any method or technique in the volatibility implemented and non-
Volatibility, removable and nonremovable medium.Computer storage medium include but is not limited to RAM, ROM, EEPROM, flash memory or its
His memory technology, CD-ROM, digital versatile disc (DVD) or other optical disc storages, magnetic holder, tape, disk storage or other
Magnetic memory apparatus or any other medium that can be used for storing desired information and can be accessed by a computer.This
Outside, known to a person of ordinary skill in the art to be, communication media generally comprises computer readable instructions, data structure, program mould
Other data in the modulated data signal of block or such as carrier wave or other transmission mechanisms etc, and may include any information
Delivery media.
Claims (10)
1. a kind of processing method of user behavior data characterized by comprising
User behavior data is obtained, wherein the user behavior data includes the corresponding event type letter of the user behavior data
Breath；
The corresponding relationship of event type according to the pre-stored data and Data Matching strategy determines event in the user behavior data
The corresponding Data Matching strategy of type information, wherein what the Data Matching strategy was arranged according to pre-set syntactic structure；
According to the Data Matching strategy, matching operation is carried out to the user behavior data, obtains matching result.
2. the method according to claim 1, wherein the corresponding event type information of the user behavior data is
It is determined as follows, comprising:
The data source of the user behavior data；And/or the value of the corresponding service fields of the user behavior data.
3. according to the method described in claim 1, it is characterized by:
The syntactic structure includes that the description content of rule and/or rule execute required precondition；
The description content of the judgment rule includes event type, length of window, statistical unit and advises for judging whether to match
At least one of parameter then；
It is described rule execute needed for precondition include event type, length of window, statistical unit and for judge whether into
At least one of matched execution condition of line discipline；
It is described that matching operation is carried out to the user behavior data, obtains matching result according to the Data Matching strategy, packet
It includes:
Step 1 judges whether there is the precondition in the Data Matching strategy；
If there is the precondition, then judge whether the user behavior data meets the precondition, then executes step
2:；
If thening follow the steps 2 without the precondition；
Step 2, according to the judgment rule description content record in matching object, extracted from the user behavior data
The value information of the matching object；
Step 3, by the Rule of judgment for matching object in the description content record of obtained value information and the judgment rule
It is matched, obtains matching result.
4. method according to claim 1 or 3, which is characterized in that it is described according to the Data Matching strategy, to the use
Family behavioral data carries out matching operation, before obtaining matching result, further includes:
When user behavior data includes data generation time information, in obtaining the data procedures in predetermined time period, press
The data time information in length and received user behavior data according to pre-set time delay executes data acquisition
Operation；And/or
After having executed data acquisition operations, according to pre-set data classification rule, to the user behavior data got
Classify, obtains manifold classification data.
5. the method according to claim 1, wherein the method also includes:
It is modified when detecting in data matching strategy, obtains the corresponding Notification of Changes information of changed rule,
Described in Notification of Changes information include change type and rule mark；
According to the change communication information, pre-stored Data Matching strategy is synchronized.
6. a kind of processing unit of user behavior data, which is characterized in that including processor and memory, wherein the memory
It is stored with computer program, the processor calls the computer program in the memory to realize following operation, comprising:
User behavior data is obtained, wherein the user behavior data includes the corresponding event type letter of the user behavior data
Breath；
The corresponding relationship of event type according to the pre-stored data and Data Matching strategy determines event in the user behavior data
The corresponding Data Matching strategy of type information, wherein what the Data Matching strategy was arranged according to pre-set syntactic structure；
According to the Data Matching strategy, matching operation is carried out to the user behavior data, obtains matching result.
7. device according to claim 6, which is characterized in that the processor calls the computer journey in the memory
Sequence is to realize the corresponding event type information of determination user behavior in the following way, comprising:
The data source of the user behavior data；And/or the value of the corresponding service fields of the user behavior data.
8. device according to claim 6, it is characterised in that:
The syntactic structure that the processor calls the computer program in the memory to be realized includes the description of rule
Content and/or rule execute required precondition；
The description content of the judgment rule includes event type, length of window, statistical unit and advises for judging whether to match
At least one of parameter then；
It is described rule execute needed for precondition include event type, length of window, statistical unit and for judge whether into
At least one of matched execution condition of line discipline；
It is described according to the Data Matching strategy to realize that the processor calls the computer program in the memory, to institute
It states user behavior data and carries out matching operation, obtain matching result, comprising:
Step 1 judges whether there is the precondition in the Data Matching strategy；
If there is the precondition, then judge whether the user behavior data meets the precondition, then executes step
2:；
If thening follow the steps 2 without the precondition；
Step 2, according to the judgment rule description content record in matching object, extracted from the user behavior data
The value information of the matching object；
Step 3, by the Rule of judgment for matching object in the description content record of obtained value information and the judgment rule
It is matched, obtains matching result.
9. the device according to claim 6 or 8, which is characterized in that the processor calls the calculating in the memory
Machine program carries out matching operation to realize according to the Data Matching strategy, to the user behavior data, obtains matching result
Operation before, the processor calls the computer program in the memory also to realize following operation, comprising:
When user behavior data includes data generation time information, in obtaining the data procedures in predetermined time period, press
The data time information in length and received user behavior data according to pre-set time delay executes data acquisition
Operation；And/or
After having executed data acquisition operations, according to pre-set data classification rule, to the user behavior data got
Classify, obtains manifold classification data.
10. device according to claim 6, which is characterized in that the processor calls the computer in the memory
Program also realizes following operation, comprising:
It is modified when detecting in data matching strategy, obtains the corresponding Notification of Changes information of changed rule,
Described in Notification of Changes information include change type and rule mark；
According to the change communication information, pre-stored Data Matching strategy is synchronized.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201910566383.1A CN110347568A (en) | 2019-06-27 | 2019-06-27 | The treating method and apparatus of user behavior data |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201910566383.1A CN110347568A (en) | 2019-06-27 | 2019-06-27 | The treating method and apparatus of user behavior data |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN110347568A true CN110347568A (en) | 2019-10-18 |
Family
ID=68183304
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201910566383.1A Withdrawn CN110347568A (en) | 2019-06-27 | 2019-06-27 | The treating method and apparatus of user behavior data |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN110347568A (en) |
Cited By (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN111444291A (en) * | 2020-03-27 | 2020-07-24 | 上海爱数信息技术股份有限公司 | Real-time data alarm method based on stream processing engine and rule engine |
| CN112017007A (en) * | 2020-08-31 | 2020-12-01 | 中国平安财产保险股份有限公司 | User behavior data processing method and device, computer equipment and storage medium |
| CN112346988A (en) * | 2020-11-26 | 2021-02-09 | 恩亿科(北京)数据科技有限公司 | Data testing method and system and data filter |
| CN113570166A (en) * | 2021-09-08 | 2021-10-29 | 湖南惠农科技有限公司 | Wind control real-time prediction identification method and device |
| CN116775170A (en) * | 2023-08-03 | 2023-09-19 | 中体彩彩票运营管理有限公司 | Event driven software system and method based on finite state machine and rule engine |
-
2019
- 2019-06-27 CN CN201910566383.1A patent/CN110347568A/en not_active Withdrawn
Cited By (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN111444291A (en) * | 2020-03-27 | 2020-07-24 | 上海爱数信息技术股份有限公司 | Real-time data alarm method based on stream processing engine and rule engine |
| CN112017007A (en) * | 2020-08-31 | 2020-12-01 | 中国平安财产保险股份有限公司 | User behavior data processing method and device, computer equipment and storage medium |
| CN112346988A (en) * | 2020-11-26 | 2021-02-09 | 恩亿科(北京)数据科技有限公司 | Data testing method and system and data filter |
| CN113570166A (en) * | 2021-09-08 | 2021-10-29 | 湖南惠农科技有限公司 | Wind control real-time prediction identification method and device |
| CN116775170A (en) * | 2023-08-03 | 2023-09-19 | 中体彩彩票运营管理有限公司 | Event driven software system and method based on finite state machine and rule engine |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN110347568A (en) | The treating method and apparatus of user behavior data | |
| RU2419986C2 (en) | Combining multiline protocol accesses | |
| US10164839B2 (en) | Log analysis system | |
| CN104392381A (en) | Risk monitoring method of transaction data and system thereof | |
| CN110750562A (en) | Storm-based real-time data comparison early warning method and system | |
| CN109034993A (en) | Account checking method, equipment, system and computer readable storage medium | |
| CN106886558B (en) | Data processing method and server | |
| US20210385251A1 (en) | System and methods for integrating datasets and automating transformation workflows using a distributed computational graph | |
| US8620839B2 (en) | Markov modeling of service usage patterns | |
| CN108923972B (en) | Weight-reducing flow prompting method, device, server and storage medium | |
| US20160063090A1 (en) | Analyzing Frequently Occurring Data Items | |
| CN113706176B (en) | Information anti-fraud processing method and service platform system combined with cloud computing | |
| CN110806954A (en) | Method, device and equipment for evaluating cloud host resources and storage medium | |
| CN109635564A (en) | A kind of method, apparatus, medium and equipment detecting Brute Force behavior | |
| CN112506743A (en) | Log monitoring method and device and server | |
| CN109086195A (en) | Log statistic and analysis system and method based on log versatility regulation engine | |
| CN112667750A (en) | Method and device for determining and identifying message category | |
| CN112003940B (en) | Payment network state processing method and server based on block chain and online service | |
| CN111126071B (en) | Method and device for determining questioning text data and method for processing customer service group data | |
| CN104636211A (en) | Information interaction method among software systems, and middleware system | |
| CN110972086A (en) | Short message processing method and device, electronic equipment and computer readable storage medium | |
| CN108494635A (en) | A kind of network flow detection system based on cloud computing | |
| CN111193631B (en) | Information processing method, system, and computer-readable storage medium | |
| CN109842511A (en) | A kind of TCP method for determination of performance parameter and system | |
| CN113095891A (en) | Data processing method and device, storage medium and electronic device |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| WW01 | Invention patent application withdrawn after publication |
Application publication date: 20191018 |
|
| WW01 | Invention patent application withdrawn after publication |