CN111258874B - User operation track analysis method and device based on web data - Google Patents

Abstract

Embodiments of the present invention provide a method and device for analyzing user operation traces based on web data. The method includes acquiring user operation trajectories in real time, the user operation trajectories at least including business types; comparing the user operation trajectories with all default trajectories with the same business type according to a trajectory model obtained in advance through a clustering algorithm; Wherein, the trajectory model includes at least one default trajectory corresponding to each business type; if the user operation trajectory is different from the default trajectory, the user operation trajectory is marked as an abnormal trajectory, and the embodiment of the present invention collects The obtained user operation trajectory is compared with the default trajectory of the corresponding service type, and if they are different, it is determined that the user operation trajectory is an abnormal trajectory, so that the user operation trajectory can be analyzed more simply and efficiently.

Description

A user operation trajectory analysis method and device based on web data

technical field

Embodiments of the present invention relate to the field of computer technology, and in particular to a method and device for analyzing user operation traces based on web data.

Background technique

With the popularity of cloud computing and container cloud, a large number of IT application systems are gradually deployed in virtualized and containerized environments. With the continuous enrichment of various business scenarios and the blowout growth of business volume, it brings huge challenges to the maintainability of the system and applications. Especially in the telecommunications industry, operators themselves have built a lot of application systems to provide consumers with various special services, and some system functions involve sub-functions of multiple business systems, requiring multi-system collaboration to work properly. The evolution of the architecture has intensified the complexity of such business systems, and put forward higher requirements for the analysis of user operation behavior.

In view of the above problems, the main solutions adopted in the existing technology are: Solution 1: Operation trajectory sorting based on manual combing: traditional maintenance personnel want to understand the operation trajectory of the whole process of business handling, and need to sort out the business operation process at the project stage. It is passed on to the follow-up maintenance personnel in the form of a maintenance manual. If there are subsequent business changes or new additions, it needs to be updated by the conscious behavior of the developers and maintenance personnel. This method is suitable for small application systems with little change rate, and the effect is relatively stable. Solution 2: Output of operation trajectory based on code embedding: The output of code embedding operation trajectory is mainly in the code development stage, and the information output required by the operation trajectory is realized in the code in advance. After being put into the production environment, each step of the user's operation will be output to the trajectory analysis center, and the analysis center will sort out the operation path of each business through dimensions such as IP address, user ID, serial number, and time. When developing new business codes in the future, coding according to the predetermined development specifications can ensure that subsequent businesses can also be included in the operation track center. Solution 3: Acquisition of operation traces based on probes: This solution is to obtain method-level call records for deployed middleware by introducing probe packages into middleware. The injection of the operation trajectory code is automatically completed through the software development kit (Software Development Kit, SDK) that automatically embeds codes and collects data. In this way, developers only need to modify a small amount of code or even a single line of code. Follow-up map the relationship between the calling method and the business operation, and complete the analysis of the user's operation track.

However, there are serious deficiencies in existing technologies: as the scale of various system clusters continues to expand, simple manual sorting has become a difficult task, not to mention that due to the implementation of agile development, the application code changes are increasing day by day. The resulting surge in operation types and steps. The rapidly growing knowledge of business operations cannot be sorted out quickly and accurately, and the existing knowledge manuals are increasingly inaccurate. To be precise, this method is not suitable for medium and large scale. Solution 2 requires developers to design the operation trajectory output plan for the overall project in advance, but the existing production system often has multiple projects jointly developed, introducing different manufacturers and adopting different technical frameworks, and there may be old, middle-aged and young people in the same system. Three generations of systems, and other practical problems make it impossible to undergo a one-time transformation, and even some systems cannot complete the pre-embedded transformation at all. If only some systems output data, the effect is not obvious. Therefore, there are actual promotion defects in this way. Solution 3 adopts the middleware probe-based operation trajectory acquisition solution. Although the code basically does not need to be changed, the existing technology still has a certain distance from the actual needs in terms of system stability, system rapid deployment, and data acquisition scalability. Meet the actual needs of production. In summary, the existing technology is too complex and inefficient in terms of data analysis capabilities.

Contents of the invention

Embodiments of the present invention provide a method and device for analyzing user operation traces based on web data, which are used to solve the problem that the prior art is too complex and inefficient in terms of data analysis capabilities.

In the first aspect, the embodiment of the present invention provides a user operation track analysis method based on web data, including:

Obtaining user operation traces in real time, where the user operation traces at least include business types;

According to the trajectory model obtained in advance through the clustering algorithm, the user operation trajectory is compared with all default trajectories with the same business type; wherein the trajectory model includes at least one default trajectory corresponding to each business type;

If the user operation trajectory is different from the default trajectory, the user operation trajectory is marked as an abnormal trajectory.

In the second aspect, an embodiment of the present invention provides a device for analyzing user operation traces based on web data, which is characterized in that it includes:

A traffic collection unit, configured to acquire user operation traces in real time, where the user operation traces at least include service types;

A trajectory analysis unit, configured to compare the user operation trajectory with all default trajectories of the same business type according to a trajectory model obtained in advance through a clustering algorithm; wherein the trajectory model includes at least one default track;

A cross identification unit, configured to mark the user operation track as an abnormal track if the user operation track is different from a default track.

In a third aspect, an embodiment of the present invention also provides an electronic device, including:

processor, memory, communication interface, and communication bus; wherein,

The processor, the memory, and the communication interface complete mutual communication through the communication bus;

The communication interface is used for information transmission between communication devices of the electronic device;

The memory stores computer program instructions executable by the processor, and the processor calls the program instructions to perform the following methods:

Obtaining user operation traces in real time, where the user operation traces at least include business types;

According to the trajectory model obtained in advance through the clustering algorithm, the user operation trajectory is compared with all default trajectories with the same business type; wherein the trajectory model includes at least one default trajectory corresponding to each business type;

If the user operation trajectory is different from the default trajectory, the user operation trajectory is marked as an abnormal trajectory.

In a fourth aspect, the embodiment of the present invention also provides a non-transitory computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, the following method is implemented:

Obtaining user operation traces in real time, where the user operation traces at least include business types;

According to the trajectory model obtained in advance through the clustering algorithm, the user operation trajectory is compared with all default trajectories with the same business type; wherein the trajectory model includes at least one default trajectory corresponding to each business type;

If the user operation trajectory is different from the default trajectory, the user operation trajectory is marked as an abnormal trajectory.

The web data-based user operation trajectory analysis method and device provided by the embodiments of the present invention compare the collected user operation trajectory with the default trajectory of the corresponding business type, and if they are different, determine that the user operation trajectory is an abnormal trajectory , so that the user's operation trajectory can be accurately analyzed more simply and efficiently.

Description of drawings

Fig. 1 is the flow chart of the method for analyzing user's operation trajectory based on web data according to an embodiment of the present invention;

2 is a flowchart of another web data-based user operation trajectory analysis method according to an embodiment of the present invention;

3 is a flow chart of another web data-based user operation trajectory analysis method according to an embodiment of the present invention;

4 is a schematic structural diagram of a device for analyzing user operation traces based on web data according to an embodiment of the present invention;

5 is a schematic structural diagram of another device for analyzing user operation traces based on web data according to an embodiment of the present invention;

6 is a schematic structural diagram of another device for analyzing user operation traces based on web data according to an embodiment of the present invention;

Fig. 7 illustrates a schematic diagram of the physical structure of an electronic device.

Detailed ways

In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments It is a part of embodiments of the present invention, but not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by persons of ordinary skill in the art without creative efforts fall within the protection scope of the present invention.

Fig. 1 is a flowchart of a method for analyzing user operation tracks based on web data according to an embodiment of the present invention. As shown in Fig. 1 , the method includes:

Step S01. Acquire user operation traces in real time, where the user operation traces at least include service types.

By collecting Web data in the network, the user operation trajectory of the user when handling business can be obtained. The user operation trajectory includes multi-dimensional data of user operations, specifically at least including business type, job number, address, time and duration, etc.

In the specific collection process, traditional network mirroring uses switch mirroring ports or optical splitters for collection. For the current agile release, cloud deployment, and containerization, deployment flexibility is insufficient. The embodiment of the present invention adopts the integrated collection technology, which not only supports traditional physical switches, but also supports flexible deployment of virtual machines and containers, and can completely support the current technical architecture.

1) For a system deployed on a physical machine, import traffic mirroring from the existing traffic switch, and the collection program deployed on the physical collection machine collects the traffic data, and outputs it to the traffic aggregation machine for subsequent analysis.

2) For systems deployed on virtual machines such as WMWare, through the virtual switch (Virtual Switch, VSwitch) mirroring scheme, the virtual machine traffic collection program is deployed in the virtual machine cluster, which can automatically unpack the VMWare network packets and unpack the unpacked The packaged traffic data is output to the traffic aggregator for subsequent analysis.

3) For systems deployed using container technology, due to the dynamic deployment characteristics of containers, the traffic itself cannot be determined. The traffic at the network load layer is collected and output to the traffic aggregation machine for analysis.

For the collected web data, through the preset business information automatic processing function, obtain the job number, IP, business type, address, time and length from the web data, and return the result, and can customize the data conversion and processed data Output as user operation trace according to the specified format.

Step S02, according to the trajectory model obtained in advance through the clustering algorithm, compare the user operation trajectory with all default trajectories with the same business type; wherein, the trajectory model includes at least one default trajectories corresponding to each business type track.

Obtaining in advance the default trajectory corresponding to each business type is equivalent to a typical user operation trajectory when the user handles the business. The acquisition method of the default trajectory may be to directly obtain at least one preset default trajectory according to the classification of each business type and the setting in the entire business center, or to use a preset algorithm for the actual historical data, for example The clustering algorithm is equivalent to obtaining a trajectory model through statistics of user operation trajectories in the actual use process of the user. The trajectory model includes at least one default trajectory corresponding to each business type, such as changing the default package service. The trajectories are operations a1, a2, a3, a4, a5; the default trajectories for ordering traffic are operations b1, b2, b3, b4.

Step S03, if the user operation trajectory is different from the default trajectory, mark the user operation trajectory as an abnormal trajectory.

After comparison, if the user operation trajectory is the same as the default trajectory, no subsequent operation is performed. If different, the user operation track is marked as an abnormal track. Can be alerted or just logged. For example, the user operation trajectory of the user when changing the package service is operation a1, a2, a3, a6, a7, a5, which can be seen to be different from the default trajectory operation a1, a2, a3, a4, a5. The user operation track is recorded as an abnormal track.

In the embodiment of the present invention, by comparing the collected user operation trajectory with the default trajectory of the corresponding business type, if they are different, it is determined that the user operation trajectory is an abnormal trajectory, so that the user operation trajectory can be accurately analyzed more simply and efficiently .

FIG. 2 is a flow chart of another web data-based user operation trajectory analysis method according to an embodiment of the present invention. As shown in FIG. 2 , the method further includes:

Step S10, regularly acquiring all user operation trajectories within a preset historical time range;

In order to obtain the default trajectory corresponding to each business type, it is necessary to obtain in advance all user operation trajectories obtained from web data within a preset historical time range, for example, within half a year before the current moment, or within one year.

Step S11, using a clustering algorithm for all user operation trajectories to obtain at least one cluster.

Using a clustering algorithm, all user operation trajectories are classified and aggregated according to different dimensional conditions. Thus, a cluster set is obtained according to the specific setting of the clustering algorithm, which includes at least one cluster.

Further, the clustering algorithm is K-Means clustering algorithm.

There are many kinds of clustering algorithms, such as K-Means clustering algorithm, K-Medians clustering algorithm, mean shift clustering algorithm, agglomerated layer clustering algorithm, etc. Here, only the K-Means clustering algorithm is taken as an example for illustration.

The K-Means algorithm divides similar user operation trajectories through the preset K value and the initial centroid of each category. And the optimal clustering result is obtained through iterative optimization of the divided mean value. Using Sum of the Squared Error (SSE) as the objective function of clustering, two different clusters generated by running K-means twice, the smaller the SSE, the higher the similarity. Therefore, the clustering at the minimum SSE is the final result. The K value may be set according to the number of service types. And after getting the final clusters, verify and make adjustments as needed.

Step S12 , respectively analyzing the user operation trajectories contained in each cluster to obtain the trajectory model.

By analyzing the user operation trajectory contained in each cluster, the main user operation trajectory contained in each cluster can be obtained, or it can also be considered as the user operation trajectory corresponding to the cluster center, and the user operation trajectory As the default operation track of the corresponding business type. The trajectory model is obtained after statistics.

The trajectory model can be counted regularly according to actual needs, such as one month or half a year, etc., and the new user operation trajectory obtained within this period of time is added to the historical data to obtain a new trajectory model.

The embodiment of the present invention uses a clustering algorithm to analyze all user operation trajectories in the historical time range to obtain the trajectory model, and then compares the user operation trajectory collected in real time with the default trajectory of the corresponding service type, and if they are different, then determine the The user operation trajectory is an abnormal trajectory, so that the user operation trajectory can be accurately analyzed more simply and efficiently.

Fig. 3 is another flow chart of a user operation trajectory analysis method based on web data according to an embodiment of the present invention. As shown in Fig. 3, the method further includes:

Step S20, counting each abnormal trajectory.

All abnormal trajectories obtained will be counted separately according to different business types. Therefore, the types of abnormal trajectories generated by each service type can be obtained, and each abnormal trajectory can be counted. For example, in the process of changing the package, the abnormal trajectory of the user includes operations a1, a2, a3, a6, a7, a5, or operation a1, a2, a3, a8, a5, then it can be determined that there are two abnormal trajectories for the package change business , and each time an abnormal trajectory is received, the corresponding type of abnormal trajectory is counted.

Step S21 , if the count exceeds a preset count threshold, send out an early warning message.

The counting threshold is preset. If the counting of one of the abnormal trajectories exceeds the counting threshold, or exceeds the preset counting threshold within a preset time range, a corresponding early warning message can be issued to inform the corresponding business The default track for a type may have changed or a new default track may have appeared.

In the embodiment of the present invention, through the statistics of the abnormal trajectory of each type of business, if the count of an abnormal trajectory exceeds the preset count threshold, an early warning message will be issued, thereby helping to more simply and efficiently conduct accurate user operation trajectories. analyze.

FIG. 4 is a schematic structural diagram of a device for analyzing user operation traces based on web data according to an embodiment of the present invention. As shown in FIG. 4 , the device includes: a flow collection unit 10, a trace analysis unit 11, and a cross identification unit 12, wherein,

The traffic collection unit 10 is used to obtain user operation trajectories in real time, and the user operation trajectories at least include service types; the trajectory analysis unit 11 is used to combine the user operation trajectories with the All default tracks with the same business type are compared; wherein, the track model includes at least one default track corresponding to each business type; the cross identification unit 12 is used for if the user operation track is different from the default track, Then mark the user operation track as an abnormal track. specifically:

The traffic collection unit 10 can obtain the user operation track when the user handles business by collecting Web data in the network. The user operation track includes multi-dimensional data operated by the user, specifically at least including business type, job number, address, time and duration etc.

The trajectory analysis unit 11 acquires in advance a default trajectory corresponding to each business type, which is equivalent to a typical user operation trajectory when the user handles the business. The acquisition method of the default trajectory may be to directly obtain at least one preset default trajectory according to the classification of each business type and the setting in the entire business center, or the actual historical data may be obtained through a preset algorithm, through A trajectory model is obtained by performing statistics on user operation trajectories during actual use by the user, and the trajectory model includes at least one default trajectory corresponding to each service type.

After comparison, if the user operation trajectory is the same as the default trajectory, no subsequent operation is performed. If they are different, the intersection identification unit 12 marks the user operation track as an abnormal track. Can be alerted or just logged.

The device provided by the embodiment of the present invention is used to execute the above method, and its function refers to the above method embodiment for details, and its specific method flow is not repeated here.

In the embodiment of the present invention, the user operation trajectory collected by the traffic collection unit 10 is compared in the trajectory analysis unit 11 with the default trajectory of the corresponding business type, and if they are different, the cross identification unit 12 determines that the user operation trajectory is abnormal Trajectories, so that it is easier and more efficient to accurately analyze user operation trajectories.

FIG. 5 is a schematic structural diagram of another device for analyzing user operation traces based on web data according to an embodiment of the present invention. As shown in FIG. Data warehouse unit 13, associated calculation unit 14 and modeling unit 15, wherein,

The data warehouse unit 13 is used to regularly obtain all user operation trajectories within the preset historical time range; the associated calculation unit 14 is used to obtain at least one cluster by using a clustering algorithm for all user operation trajectories; the modeling unit 15 is used to separately analyze the user operation trajectory included in each cluster to obtain the trajectory model.

In order to obtain the default trajectory corresponding to each business type, the data warehouse unit 13 needs to obtain in advance all user operation trajectories obtained from web data within the preset historical time range, for example, within half a year before the current moment, or 1 year, etc. .

The association calculation unit 14 uses a clustering algorithm to classify and aggregate all user operation trajectories in the data warehouse unit 13 according to different dimensional conditions. Thus, a cluster set is obtained according to the specific setting of the clustering algorithm, which includes at least one cluster.

Further, the clustering algorithm is K-Means clustering algorithm.

There are many kinds of clustering algorithms, such as K-Means clustering algorithm, K-Medians clustering algorithm, mean shift clustering algorithm, agglomerated layer clustering algorithm, etc. Here, only the K-Means clustering algorithm is taken as an example for illustration.

The K-Means algorithm divides similar user operation trajectories through the preset K value and the initial centroid of each category. And the optimal clustering result is obtained through iterative optimization of the divided mean value. Using Sum of the Squared Error (SSE) as the objective function of clustering, two different clusters generated by running K-means twice, the smaller the SSE, the higher the similarity. Therefore, the clustering at the minimum SSE is the final result. The K value may be set according to the number of service types. And after getting the final clusters, verify and make adjustments as needed.

The modeling unit 15 can obtain the main user operation trajectories contained in each cluster by analyzing the user operation trajectories contained in each cluster obtained by the association calculation unit 14, or it can also be regarded as is the user operation track corresponding to the cluster center, which is used as the default operation track of the corresponding business type. The trajectory model is obtained after statistics and sent to the trajectory analysis unit 11 .

The trajectory model can be regularly counted according to actual needs, and the traffic collection unit 10 will add the new user operation trajectory obtained within this period of time to the data warehouse unit 13, so as to obtain a new trajectory model.

The device provided by the embodiment of the present invention is used to execute the above method, and its function refers to the above method embodiment for details, and its specific method flow is not repeated here.

In the embodiment of the present invention, the correlation calculation unit 14 analyzes all user operation trajectories in the historical time range in the data warehouse unit 13 through a clustering algorithm, and obtains the trajectory model by the modeling unit 15, and then uses the traffic collection unit 10 The user operation trajectory collected in real time is compared with the default trajectory of the corresponding business type in the trajectory analysis unit 11. If they are different, the cross identification unit 12 determines that the user operation trajectory is an abnormal trajectory, so that the user operation can be performed more simply and efficiently. trajectory for accurate analysis.

FIG. 6 is a schematic structural diagram of another device for analyzing user operation traces based on web data according to an embodiment of the present invention. As shown in FIG. 6, the device includes:

Flow collection unit 10, trajectory analysis unit 11, intersection identification unit 12, data warehouse unit 13, correlation calculation unit 14, modeling unit 15 and quantification unit 16, wherein,

The quantization unit 16 is used for counting each abnormal trajectory; the quantization unit 16 is also used for issuing an early warning message if the count exceeds a preset count threshold. specifically:

The quantification unit 16 makes statistics on all obtained abnormal trajectories according to different business types. Therefore, the types of abnormal trajectories generated by each service type can be obtained, and each abnormal trajectory can be counted.

The quantization unit 16 presets a counting threshold, and if the counting of one of the abnormal trajectories exceeds the counting threshold, or exceeds the preset counting threshold within a preset time range, a corresponding warning message can be issued In order to inform that the default track of the corresponding business type may change or a new default track appears.

The device provided by the embodiment of the present invention is used to execute the above method, and its function refers to the above method embodiment for details, and its specific method flow is not repeated here.

In the embodiment of the present invention, through the statistics of the abnormal trajectory of each business type by the quantization unit 16, if the count of an abnormal trajectory exceeds the preset count threshold, an early warning message will be issued, thereby helping to more simply and efficiently operate the user trajectory for accurate analysis.

FIG. 7 illustrates a schematic diagram of a physical structure of an electronic device. As shown in FIG. 7, the server may include: a processor (processor) 810, a communication interface (Communications Interface) 820, a memory (memory) 830, and a communication bus 840, wherein , the processor 810 , the communication interface 820 , and the memory 830 communicate with each other through the communication bus 840 . The processor 810 may call the logic instructions in the memory 830 to perform the following method: acquire user operation trajectories in real time, the user operation trajectories at least including business types; Compare with all default trajectories with the same business type; wherein, the trajectory model includes at least one default trajectory corresponding to each business type; if the user operation trajectory is different from the default trajectory, then the user operation trajectory Marked as abnormal trajectory.

Furthermore, the embodiment of the present invention discloses a computer program product, the computer program product includes a computer program stored on a non-transitory computer-readable storage medium, the computer program includes program instructions, when the program instructions are executed by the computer During execution, the computer can execute the methods provided by the above method embodiments, for example, including: acquiring user operation trajectories in real time, the user operation trajectories at least including business types; The operation trajectory is compared with all default trajectories with the same business type; wherein, the trajectory model includes at least one default trajectory corresponding to each business type; if the user operation trajectory is different from the default trajectory, then the user Operational trajectories are marked as abnormal trajectories.

Furthermore, an embodiment of the present invention provides a non-transitory computer-readable storage medium, the non-transitory computer-readable storage medium stores computer instructions, and the computer instructions cause the computer to execute the methods provided by the above-mentioned method embodiments. The method, for example, includes: acquiring user operation trajectories in real time, the user operation trajectories at least including business types; comparing the user operation trajectories with all default trajectories of the same business type according to a trajectory model obtained in advance through a clustering algorithm ; Wherein, the trajectory model includes at least one default trajectory corresponding to each business type; if the user operation trajectory is different from the default trajectory, the user operation trajectory is marked as an abnormal trajectory.

Those skilled in the art can understand that: in addition, the above logic instructions in the memory 830 can be implemented in the form of software functional units and can be stored in a computer-readable storage medium when sold or used as an independent product. Based on this understanding, the essence of the technical solution of the present invention or the part that contributes to the prior art or the part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including Several instructions are used to make a computer device (which may be a personal computer, a server, or a network device, etc.) execute all or part of the steps of the methods described in various embodiments of the present invention. The aforementioned storage media include: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), magnetic disk or optical disk and other media that can store program codes.

The above-described embodiments such as electronic equipment are only illustrative, and the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, It can be located in one place, or it can be distributed to multiple network elements. Part or all of the modules can be selected according to actual needs to achieve the purpose of the solution of this embodiment. It can be understood and implemented by those skilled in the art without any creative efforts.

Through the above description of the implementations, those skilled in the art can clearly understand that each implementation can be implemented by means of software plus a necessary general-purpose hardware platform, and of course also by hardware. Based on this understanding, the essence of the above technical solution or the part that contributes to the prior art can be embodied in the form of software products, and the computer software products can be stored in computer-readable storage media, such as ROM/RAM, magnetic discs, optical discs, etc., including several instructions to make a computer device (which may be a personal computer, server, or network device, etc.) execute the methods described in various embodiments or some parts of the embodiments.

Finally, it should be noted that: the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that: it can still be Modifications are made to the technical solutions described in the foregoing embodiments, or equivalent replacements are made to some of the technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the various embodiments of the present invention.

Claims (8)

1. A user operation trajectory analysis method based on web data, characterized in that, comprising: Obtaining user operation traces in real time, where the user operation traces at least include business types; According to the trajectory model obtained in advance through the clustering algorithm, the user operation trajectory is compared with all default trajectories with the same business type; wherein the trajectory model includes at least one default trajectory corresponding to each business type; If the user operation trajectory is different from the default trajectory, the user operation trajectory is marked as an abnormal trajectory; Using a clustering algorithm, according to different dimensional conditions, all user operation trajectories are classified and aggregated, and a cluster is obtained according to the specific settings of the clustering algorithm, including at least one cluster; The clustering algorithm is the K-Means clustering algorithm. The K-Means algorithm divides similar user operation trajectories through the preset K value and the initial centroid of each category, and obtains the optimal value through iterative optimization of the divided mean value. Excellent clustering results; Using the sum of squared errors as the objective function of clustering, two different clusters generated by running K-means twice, the smaller the sum of squared errors, the higher the similarity, so the cluster when the sum of squared errors is the smallest is the final result; Wherein the K value is set according to the number of business types, verified after the final cluster is obtained, and adjusted as required; The counting threshold is preset, and if the counting of one of the abnormal trajectories exceeds the counting threshold, or exceeds the preset counting threshold within the preset time range, a corresponding early warning message is issued to notify the corresponding business type The default track changes or a new default track appears. 2. The method according to claim 1, characterized in that the method further comprises: Regularly obtain all user operation trajectories within the preset historical time range; Use a clustering algorithm to obtain at least one cluster for all user operation trajectories; The user operation trajectories included in each cluster are respectively analyzed to obtain the trajectory model. 3. The method according to claim 1, wherein the method further comprises: Count each abnormal trajectory; If the count exceeds a preset count threshold, an early warning message is issued. 4. A user operation trajectory analysis device based on web data, characterized in that, comprising: A traffic collection unit, configured to acquire user operation traces in real time, where the user operation traces at least include service types; A trajectory analysis unit, configured to compare the user operation trajectory with all default trajectories of the same business type according to a trajectory model obtained in advance through a clustering algorithm; wherein the trajectory model includes at least one default track; An intersection identification unit, configured to mark the user operation trajectory as an abnormal trajectory if the user operation trajectory is different from the default trajectory; Using a clustering algorithm, according to different dimensional conditions, all user operation trajectories are classified and aggregated, and a cluster is obtained according to the specific settings of the clustering algorithm, including at least one cluster; The clustering algorithm is the K-Means clustering algorithm. The K-Means algorithm divides similar user operation trajectories through the preset K value and the initial centroid of each category, and obtains the optimal value through iterative optimization of the divided mean value. Excellent clustering results; Using the sum of squared errors as the objective function of clustering, two different clusters generated by running K-means twice, the smaller the sum of squared errors, the higher the similarity, so the cluster when the sum of squared errors is the smallest is the final result; Wherein the K value is set according to the number of business types, verified after the final cluster is obtained, and adjusted as required; The counting threshold is preset, and if the counting of one of the abnormal trajectories exceeds the counting threshold, or exceeds the preset counting threshold within the preset time range, a corresponding early warning message is issued to notify the corresponding business type The default track changes or a new default track appears. 5. The device according to claim 4, further comprising: The data warehouse unit is used to regularly obtain all user operation tracks within the preset historical time range; An associative computing unit, configured to obtain at least one cluster by using a clustering algorithm for all user operation trajectories; The modeling unit is configured to respectively analyze the user operation trajectories contained in each cluster to obtain the trajectory model. 6. The device according to claim 4, further comprising: A quantization unit is used to count each abnormal trajectory; The quantization unit is further configured to issue an early warning message if the count exceeds a preset count threshold. 7. An electronic device comprising a memory, a processor, and a computer program stored on the memory and operable on the processor, wherein the processor implements any of claims 1 to 3 when executing the program. The steps of the user operation trajectory analysis method described in the item. 8. A non-transitory computer-readable storage medium, on which a computer program is stored, characterized in that, when the computer program is executed by a processor, the user operation trajectory analysis method according to any one of claims 1 to 3 is realized step.