CN111563527A - Abnormal event detection method and device - Google Patents
Abnormal event detection method and device Download PDFInfo
- Publication number
- CN111563527A CN111563527A CN202010238270.1A CN202010238270A CN111563527A CN 111563527 A CN111563527 A CN 111563527A CN 202010238270 A CN202010238270 A CN 202010238270A CN 111563527 A CN111563527 A CN 111563527A
- Authority
- CN
- China
- Prior art keywords
- event
- period
- preset
- events
- main body
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
- 230000002159 abnormal effect Effects 0.000 title claims abstract description 91
- 238000001514 detection method Methods 0.000 title claims abstract description 22
- 238000000034 method Methods 0.000 claims abstract description 71
- 238000013499 data model Methods 0.000 claims abstract description 12
- 238000010586 diagram Methods 0.000 claims description 17
- 239000013598 vector Substances 0.000 claims description 10
- 238000004422 calculation algorithm Methods 0.000 claims description 9
- 230000001960 triggered effect Effects 0.000 claims description 8
- 238000004364 calculation method Methods 0.000 claims description 4
- 238000004590 computer program Methods 0.000 claims description 4
- 230000002547 anomalous effect Effects 0.000 claims 1
- 238000012545 processing Methods 0.000 description 7
- 230000008569 process Effects 0.000 description 4
- 230000000694 effects Effects 0.000 description 3
- 230000003287 optical effect Effects 0.000 description 3
- 230000004044 response Effects 0.000 description 3
- 210000000026 apposition eye Anatomy 0.000 description 2
- 230000006870 function Effects 0.000 description 2
- 239000000463 material Substances 0.000 description 2
- 239000013307 optical fiber Substances 0.000 description 2
- 230000000644 propagated effect Effects 0.000 description 2
- 230000006978 adaptation Effects 0.000 description 1
- 238000004458 analytical method Methods 0.000 description 1
- 238000003491 array Methods 0.000 description 1
- 230000008859 change Effects 0.000 description 1
- 238000004891 communication Methods 0.000 description 1
- 238000011161 development Methods 0.000 description 1
- 238000005516 engineering process Methods 0.000 description 1
- 230000006698 induction Effects 0.000 description 1
- 238000007726 management method Methods 0.000 description 1
- 238000012986 modification Methods 0.000 description 1
- 230000004048 modification Effects 0.000 description 1
- 230000002093 peripheral effect Effects 0.000 description 1
- 235000019633 pungent taste Nutrition 0.000 description 1
- 238000005215 recombination Methods 0.000 description 1
- 230000006798 recombination Effects 0.000 description 1
- 230000003252 repetitive effect Effects 0.000 description 1
- 239000004065 semiconductor Substances 0.000 description 1
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F18/00—Pattern recognition
- G06F18/20—Analysing
- G06F18/22—Matching criteria, e.g. proximity measures
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
- G06F16/90—Details of database functions independent of the retrieved data types
- G06F16/95—Retrieval from the web
- G06F16/953—Querying, e.g. by the use of web search engines
- G06F16/9536—Search customisation based on social or collaborative filtering
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F18/00—Pattern recognition
- G06F18/20—Analysing
- G06F18/24—Classification techniques
- G06F18/243—Classification techniques relating to the number of classes
- G06F18/2433—Single-class perspective, e.g. one-against-all classification; Novelty detection; Outlier detection
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F40/00—Handling natural language data
- G06F40/20—Natural language analysis
- G06F40/205—Parsing
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F40/00—Handling natural language data
- G06F40/30—Semantic analysis
Abstract
The disclosure relates to an abnormal event detection method, an abnormal event detection device, an electronic device and a storage medium. Wherein, the method comprises the following steps: acquiring event information of a host related event in a first preset period; acquiring main body related events of a second preset period from the first preset period, and calculating event occurrence data of the second preset period according to the number of the main body related events of the second preset period; inputting the event occurrence data into a preset peak data model, calculating and judging whether the second preset period is a peak period, and if so, determining that the peak period has an abnormal event. The method and the device can greatly improve the accuracy of abnormal event detection.
Description
Technical Field
The present disclosure relates to the field of internet, and in particular, to an abnormal event detection method, apparatus, electronic device, and computer-readable storage medium.
Background
With the development of internet technology, people can acquire various types of information such as news public sentiment, industry trends, enterprise information and the like through the internet. When a user needs to check information of a specific event type or subject, the user cannot intuitively distinguish and understand the information of the same event type or subject due to the fact that a large amount of information is continuously input and the information of the same event type or subject has high discreteness in the publishing source and publishing time. Particularly, in public opinion analysis, it is difficult to accurately know whether there is a truly important abnormal event occurring in the recent time or in the event type or subject at a certain day.
Accordingly, there is a need for one or more methods to address the above-mentioned problems.
It is to be noted that the information disclosed in the above background section is only for enhancement of understanding of the background of the present disclosure, and thus may include information that does not constitute prior art known to those of ordinary skill in the art.
Disclosure of Invention
An object of the present disclosure is to provide an abnormal event detection method, apparatus, electronic device, and computer-readable storage medium, thereby overcoming, at least to some extent, one or more of the problems due to the limitations and disadvantages of the related art.
According to an aspect of the present disclosure, there is provided an abnormal event detection method including:
acquiring event information of a host related event in a first preset period;
acquiring main body related events of a second preset period from the first preset period, and calculating event occurrence data of the second preset period according to the number of the main body related events of the second preset period;
inputting the event occurrence data into a preset peak data model, calculating and judging whether the second preset period is a peak period, and if so, determining that the peak period has an abnormal event.
In an exemplary embodiment of the present disclosure, calculating event occurrence data for a second preset period according to a number of subject-related events for the second preset period includes:
respectively taking each main body related event in a second preset period as a reference event;
calculating the similarity of the reference event and other events, and taking the event with the similarity larger than a preset similarity threshold as a similar event;
and taking the total number of the main body related events with similar events as the event occurrence data.
In an exemplary embodiment of the present disclosure, calculating event occurrence data of a second preset period according to the number of subject-related events of the second preset period includes any one of the following manners:
calculating the total amount of the main body related events in a second preset period, and taking the total amount of the main body related events as the event occurrence data; alternatively, the first and second electrodes may be,
the event information comprises event sources, the number of the event sources for acquiring the events related to the main body,
taking the event source number as the event occurrence data; alternatively, the first and second electrodes may be,
and calculating the total quantity of the main body in other events corresponding to the main body related events in a second preset period, and taking the total quantity of the main body as the event occurrence data.
In an exemplary embodiment of the present disclosure, calculating and determining whether the second preset period is a peak period includes:
respectively comparing the heat index of each second preset period with the event occurrence data of the adjacent period;
judging whether the comparison result meets a preset peak value period condition or not;
and if so, determining that the current second preset period is the peak period.
In an exemplary embodiment of the present disclosure, the method further comprises:
calculating the heat index of the main body related event in a second preset period according to a preset heat algorithm;
taking the main body related events with the highest heat index in the peak value period as heat events in a preset number;
determining that the heat event is the abnormal event.
In an exemplary embodiment of the present disclosure, the event information includes an event source, and the calculating a heat index of the subject-related event in a second preset period according to a preset heat algorithm includes:
respectively taking each main body related event in a second preset period as a reference event;
calculating the similarity of the reference event and other events, and taking the event with the similarity larger than a preset similarity threshold as the similar event of the reference event;
judging whether the number of the similar events of the reference event is smaller than a preset similar threshold value or not;
if the number of the similar events of the reference event is smaller than a preset similar threshold, acquiring a weight value corresponding to an event source in the reference event, and taking the weight value corresponding to the event source as a heat index of the reference event.
In an exemplary embodiment of the present disclosure, after determining whether the number of similar events of the reference event is smaller than a preset similar threshold, the method further includes:
if the number of the similar events of the reference event is greater than or equal to a preset similar threshold, acquiring a weight value corresponding to the event source of the reference event and the similar events thereof;
and taking the weight value and the value corresponding to the event sources of the reference event and the similar events thereof as the heat index of the reference event.
In an exemplary embodiment of the present disclosure, the event information includes an event title, and calculating a similarity between the reference event and other events includes:
calculating the intersection length of the event titles of the reference event and other events;
and calculating the similarity of the reference event and the event titles of other events according to the intersection length of the two events.
In an exemplary embodiment of the present disclosure, the event information includes event content, and calculating a similarity between the reference event and other events includes:
acquiring a paragraph containing preset main body information in the event content;
calculating hash values of sections containing preset main body information in the event contents of the reference event and other events, and comparing the hash values;
and calculating the similarity according to the hash value comparison result.
In an exemplary embodiment of the present disclosure, the event information includes event content, and calculating a similarity between the reference event and other events includes:
extracting semantic vectors of key sentences in the event contents of the reference event and other events;
and calculating the similarity according to semantic vectors of key sentences in the event contents of the reference event and other events.
In an exemplary embodiment of the present disclosure, the method further comprises:
acquiring event content of the heat event, and generating event summary information according to the event content;
and responding to an event showing instruction triggered by a user, and showing the event summary information in a showing diagram.
In an exemplary embodiment of the present disclosure, the event information includes an event source, the method further includes:
acquiring a preset number of heat events with the highest heat index in the peak value period;
checking a weight value of an event source of the heat event;
and if the weighted values of the event sources are all smaller than a preset weighted threshold, modifying the current peak period to be a non-peak period.
In an exemplary embodiment of the present disclosure, the method further comprises:
and if the number of the similar events of the main body related events in the peak value period is lower than a preset similar amount threshold value, modifying the current peak value period into a non-peak value period.
In an exemplary embodiment of the present disclosure, the method further comprises:
if the number of the similar events of the main body related event in the non-peak value period is lower than a preset similar amount threshold value, acquiring an event title of the main body related event in the non-peak value period;
matching the event titles in a first preset abnormal information database;
taking a main body related event hitting the preset first abnormal information database as a hit event, and judging whether the hit event is repeated with the event content in the adjacent period of the current non-peak value period;
if not, modifying the current non-peak period into the peak period.
In an exemplary embodiment of the present disclosure, the method further comprises:
acquiring a preset number of heat events with the highest heat index in the peak value period;
matching the event information of the heat event in a second preset abnormal information database;
and if the heat event hits the second preset abnormal information database, modifying the current peak period into a non-peak period.
In an exemplary embodiment of the present disclosure, acquiring event information of a subject-related event in a first preset period includes:
according to preset main information, matching key information of event information of all events in a first preset period in a main information database;
and taking the event which is successfully matched as the event related to the main body, and acquiring the information of the event which is successfully matched.
In an exemplary embodiment of the present disclosure, the event information of the subject-related event further includes an event title, and the method further includes:
setting a corresponding abnormal event mark for the peak value period;
generating a display diagram according to the peak value period and the abnormal event mark, and displaying the display diagram;
and responding to an event presentation instruction triggered by a user, and presenting an event title of the abnormal event in a presentation graphic. .
In one aspect of the present disclosure, there is provided an abnormal event detecting apparatus including:
the event information acquisition module is used for acquiring event information of main body related events in a first preset period;
the event occurrence data calculation module is used for acquiring main body related events of a second preset period from the first preset period and calculating event occurrence data of the second preset period according to the number of the main body related events of the second preset period;
and the abnormal event judging module is used for inputting the event occurrence data into a preset peak data model, calculating and judging whether the second preset period is a peak period, and if so, determining that the peak period has an abnormal event.
In one aspect of the present disclosure, there is provided an electronic device including:
a processor; and
a memory having computer readable instructions stored thereon which, when executed by the processor, implement a method according to any of the above.
In an aspect of the disclosure, a computer-readable storage medium is provided, on which a computer program is stored, which computer program, when being executed by a processor, realizes the method according to any one of the above.
In the abnormal event detection method in the exemplary embodiment of the present disclosure, event information of a main body related event in a first preset period is acquired; acquiring main body related events of a second preset period from the first preset period, and calculating event occurrence data of the second preset period according to the number of the main body related events of the second preset period; inputting the event occurrence data into a preset peak data model, calculating and judging whether the second preset period is a peak period, and if so, determining that the peak period has an abnormal event. The method and the device can greatly improve the accuracy of abnormal event detection.
It is to be understood that both the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the disclosure.
Drawings
The above and other features and advantages of the present disclosure will become more apparent by describing in detail exemplary embodiments thereof with reference to the attached drawings.
FIG. 1 shows a flow diagram of an abnormal event detection method according to an exemplary embodiment of the present disclosure;
FIG. 2 illustrates a presentation effect diagram of an abnormal event detection method according to an exemplary embodiment of the present disclosure;
FIG. 3 shows a schematic block diagram of an abnormal event detection apparatus according to an exemplary embodiment of the present disclosure;
FIG. 4 schematically illustrates a block diagram of an electronic device according to an exemplary embodiment of the present disclosure; and
fig. 5 schematically illustrates a schematic diagram of a computer-readable storage medium according to an exemplary embodiment of the present disclosure.
Detailed Description
Example embodiments will now be described more fully with reference to the accompanying drawings. Example embodiments may, however, be embodied in many different forms and should not be construed as limited to the embodiments set forth herein; rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the concept of example embodiments to those skilled in the art. The same reference numerals denote the same or similar parts in the drawings, and thus, a repetitive description thereof will be omitted.
Furthermore, the described features, structures, or characteristics may be combined in any suitable manner in one or more embodiments. In the following description, numerous specific details are provided to give a thorough understanding of embodiments of the disclosure. One skilled in the relevant art will recognize, however, that the embodiments of the disclosure can be practiced without one or more of the specific details, or with other methods, components, materials, devices, steps, and so forth. In other instances, well-known structures, methods, devices, implementations, materials, or operations are not shown or described in detail to avoid obscuring aspects of the disclosure.
The block diagrams shown in the figures are functional entities only and do not necessarily correspond to physically separate entities. That is, these functional entities may be implemented in the form of software, or in one or more software-hardened modules, or in different networks and/or processor devices and/or microcontroller devices.
In the present exemplary embodiment, an abnormal event detection method is first provided; referring to fig. 1, the abnormal event detecting method may include the steps of:
step S110, acquiring event information of a main body related event in a first preset period;
step S120, acquiring main body related events of a second preset period from the first preset period, and calculating event occurrence data of the second preset period according to the number of the main body related events of the second preset period;
step S130, inputting the event occurrence data into a preset peak data model, calculating and judging whether the second preset period is a peak period, and if so, determining that an abnormal event exists in the peak period.
In the abnormal event detection method in the exemplary embodiment of the present disclosure, event information of a main body related event in a first preset period is acquired; acquiring main body related events of a second preset period from the first preset period, and calculating event occurrence data of the second preset period according to the number of the main body related events of the second preset period; inputting the event occurrence data into a preset peak data model, calculating and judging whether the second preset period is a peak period, and if so, determining that the peak period has an abnormal event. The method and the device can greatly improve the accuracy of abnormal event detection.
Next, the abnormal event detection method in the present exemplary embodiment will be further explained.
In step S110, event information of a subject-related event within a first preset period may be acquired.
In the embodiment of the present example, the obtaining of the event information of the subject-related event in the first preset period includes: according to preset main information, matching key information of event information of all events in a first preset period in a main information database; and taking the event which is successfully matched as the event related to the main body, and acquiring the information of the event which is successfully matched. The preset subject information may be a name of an enterprise, a name of a person, an industry, and the like. When the subject is a certain enterprise, the event information may include an event title, a time source, event content, other subject information mentioned by the event content, and the like, and taking the related news public opinion of the certain enterprise as an example, the related event of the subject may include an article title, a media publishing source, article content, an enterprise list mentioned by the article, media publishing sources and quantity of other articles similar to the article, and the like.
The first preset period may be any time period such as one year, one month, one week, even one day, and the like, and after obtaining event information of a main body related event in the first preset period, key information matching is performed on the event information in the main body information database, and a public opinion article related to the enterprise, or related personnel of the enterprise, or product service of the enterprise is obtained, and further, event information and the like of situations such as high correlation between the public opinion article and the industry to which the enterprise belongs, or a partner and an auction of the enterprise can be further included.
For example, taking the preset subject information as an enterprise (sky-eye survey) as an example, if the user needs to query abnormal events (e.g., special types of news such as headline news or high-traffic management change) in the year 2 of the year 2019 for the sky-eye survey, all event information of the year 2 of the year 2019 for the sky-eye survey enterprise can be obtained, a public sentiment article of the year 2 month all event information of the year 2019 and related people of the year survey company or the year or product service of the year survey can be obtained as a subject corresponding event of the year, and an event title, an event source, event content, other subject information mentioned by the event content and the like corresponding to the public sentiment article can be obtained, so as to complete obtaining the subject related events in the first preset period.
In step S120, the subject-related events of the second preset period may be obtained from the first preset period, and the event occurrence data of the second preset period is calculated according to the number of the subject-related events of the second preset period.
In this exemplary embodiment, the second preset period is an event period unit included in the first preset period, and the event occurrence data is event occurrence data generated by counting the number of the subject-related events based on a preset judgment criterion, specifically, if the first preset period is one month, the second preset period may be one day, and the event occurrence data of each day is calculated according to the subject-related events of each day in one month.
In the embodiment of the present example, calculating event occurrence data for a second preset period according to the number of subject-related events for the second preset period includes: respectively taking each main body related event in a second preset period as a reference event; calculating the similarity of the reference event and other events, and taking the event with the similarity larger than a preset similarity threshold as a similar event; the total number of subject related events having similar events is taken as the event occurrence data.
In the embodiment of the present example, in a first preset period, each subject-related event in a second preset period is respectively used as a reference event, the similarity between each subject-related event and other events is cross-calculated, and a corresponding threshold is set to determine whether the subject-related event is a similar event, if yes, the similar event is counted up, the total number of the subject-related events is counted up, and finally, the number of the subject-related events is used as event occurrence data in the second preset period.
In the embodiment of the present invention, taking all the main body related events of the day-eye checking enterprise in 2 months of a year as an example, taking all 20 main body related events in 28 days of 2 months as reference events, cross-calculating the similarity between each main body related event and other events, and setting a corresponding threshold value to determine whether the main body related event is a similar event, if the threshold value is set to 90%, if the cross-contrast similarity is greater than 90%, determining that the event is a similar event, and if the final determination result is that 15 similar events are shared among the 20 main body related events, counting the similar events incrementally, completing statistics of the total number of the main body related events, and finally, checking that the event occurrence data in 28 days of 2 months by day-eye checking is 15.
In the embodiment of the present example, the step of calculating the event occurrence data of the second preset period according to the number of the subject-related events of the second preset period includes any one of the following manners:
calculating the total amount of the main body related events in a second preset period, and taking the total amount of the main body related events as the event occurrence data; or, the event information includes event sources, the number of event sources of the main body related events is obtained, and the number of event sources is used as the event occurrence data; or, calculating the total amount of the subject related event corresponding to the subject in the second preset period in other events, and using the total amount as the event occurrence data.
In the embodiment of the present example, in addition to determining the event occurrence data by comparing and judging similar events in the second preset period, the event occurrence data may be determined by calculating the total amount of the subject-related events or counting the number of event sources.
In the embodiment of the present example, taking the above-mentioned eye-to-eye company as an example of all subject-related events in 2 months of a year, and all 20 subject-related events in 28 days of 2 months, the event occurrence data may be counted as 20; the media publishing sources of the 20 main body related events can be counted, for example, the media publishing sources of the 20 main body related events are a plurality of media publishing sources such as the daily report of people, the financial news of the middle and high villages, the top of today, and the like, and if the number of the media publishing sources is counted to be 10, the event occurrence data can be counted to be 10.
In step S130, the event occurrence data may be input into a preset peak data model, and whether the second preset period is a peak period is calculated and determined, and if so, it is determined that an abnormal event exists in the peak period.
In the embodiment of the present example, after the event occurrence data of each second preset period in the first preset period is determined, according to the event occurrence data of the second preset period, whether the second preset period is a peak period is calculated and determined through a preset peak data model, and then the determination of whether the second preset period is an abnormal event is completed. It should be noted that the abnormal event may be an abnormal event in the meaning of the event content, or an abnormal event with statistical significance.
In the embodiment of the present example, calculating and determining whether the second preset period is a peak period includes: respectively comparing the heat index of each second preset period with the event occurrence data of the adjacent period; judging whether the comparison result meets a preset peak value period condition or not; and if so, determining that the current second preset period is the peak period.
In the embodiment of the present invention, the preset peak data model compares the heat index of each second preset period with the event occurrence data of the adjacent period, specifically, by setting the peak threshold, the event occurrence data of the second preset period is higher than the value of the left neighbor and higher than the right neighbor by 20% of the right neighbor, or the difference between the event occurrence data of the second preset period and the left neighbor is higher than 90% of the maximum value of the differences between the first 5 neighbors, and the left neighbor and the right neighbor are both event occurrence data of the second preset period in the first preset period in the same statistical unit as the second preset period.
In an embodiment of the present example, the method further comprises: calculating the heat index of the main body related event in a second preset period according to a preset heat algorithm; taking the main body related events with the highest heat index in the peak value period as heat events in a preset number; and determining the heat event as the abnormal event.
In the embodiment of the present example, after the peak period is determined, a heat event is generated from a plurality of subject-related events of the peak period as an abnormal event of the peak period. The heat index of the main body related event in the second preset period can be calculated according to a preset heat algorithm, and then the abnormal event of the peak value period is generated.
In the embodiment of the present example, taking all subject related events of the above-mentioned skyhook check enterprise in 2 months of a year as an example, if it is determined that 28 days in 2 months is a peak period and 28 days in 2 months have all 20 subject related events, calculating and respectively calculating the heat indexes of the 20 subject related events through a preset heat algorithm, and selecting two subject related events with the highest heat indexes as abnormal events in 28 days in 2 months through descending order of the heat indexes.
In an embodiment of the present example, the event information includes an event source, and the calculating the heat index of the subject-related event in the second preset period according to the preset heat algorithm includes: respectively taking each main body related event in a second preset period as a reference event; calculating the similarity of the reference event and other events, and taking the event with the similarity larger than a preset similarity threshold as the similar event of the reference event; judging whether the number of the similar events of the reference event is smaller than a preset similar threshold value or not; if the number of the similar events of the reference event is smaller than a preset similar threshold, acquiring a weight value corresponding to an event source in the reference event, and taking the weight value corresponding to the event source as a heat index of the reference event.
In the embodiment of the present example, the heat index may be calculated in various ways, taking the above-mentioned eye-based survey of all subject related events of the enterprise in 2 months of a year as an example, if it is determined that 28 days in 2 months is the peak period and 28 days in 2 months have 20 pieces of subject related events, the similarity of the 20 main body related events can be calculated to further determine the heat index, specifically, after determining the similar events according to the preset similarity threshold, if there are fewer similar events in the 20 main body related events, which are less than the preset threshold, then further calculating the heat index by the weight value corresponding to the event source of the main body related event, if the event source of a similar event is the daily report of people, the corresponding weight value is 10, the heat index of the event is also 10, and the source of another event is a certain headline, the corresponding weight value is 1, and the heat index of the event is also 1.
In an embodiment of the present invention, after determining whether the number of similar events of the reference event is smaller than a preset similar threshold, the method further includes: if the number of the similar events of the reference event is greater than or equal to a preset similar threshold, acquiring a weight value corresponding to the event source of the reference event and the similar events thereof; and taking the weight value and the value corresponding to the event sources of the reference event and the similar events thereof as the heat index of the reference event.
In the embodiment of the present example, in the calculation of the heat index, when the same event is a similar event and there are multiple event sources, the weighted values of the multiple event sources may be summed to serve as the heat index of the event. In the above example, if a certain main body related event in the day-to-eye 2-month-28 days has a plurality of event sources, one is a daily report of people, one is a financial network in the middle customs area, and one is a certain leader, the weight values of the event sources are respectively counted: the weight value of the daily newspaper of people is 10, the weight value of the financial network of the middle Guancun village and village is 8, the weight value of a certain leader is 1, the weight value and the value of the source of each event are calculated to be 19, and the heat index of the event is 19.
In the embodiment of the present example, the event information includes an event title, and calculating the similarity between the reference event and other events includes: calculating the intersection length of the event titles of the reference event and other events; and calculating the similarity of the reference event and the event titles of other events according to the intersection length of the two events.
In the embodiment of the present example, the similarity determination method for the subject-related event may be event title determination based on event information, and may mark a certain subject-related event as a reference event, respectively calculate intersection lengths of other events and a title of the reference event, and determine the similarity between the reference event and other events according to a preset intersection length determination threshold. Specifically, whether the title coincidence degree is higher than a certain threshold value or not is determined by judging the similarity through the intersection length of the title a and the title B/the smaller value of the length of the title a and the length of the title B.
In the embodiment of the present example, the event information includes event content, and calculating the similarity between the reference event and other events includes: acquiring a paragraph containing preset main body information in the event content; calculating hash values of sections containing preset main body information in the event contents of the reference event and other events, and comparing the hash values; and calculating the similarity according to the hash value comparison result.
In this example, the similarity determination method for the subject-related event may be hash value comparison determination of a paragraph of preset subject information, and may mark a certain subject-related event as a reference event, respectively calculate hash values of other events and the paragraph of the reference event, and determine the similarity between the reference event and other events according to a preset hash value determination threshold. Specifically, the minimum hash value of the segment mentioned in the enterprise is calculated through a hash algorithm, and the hash value is compared to obtain and judge the similarity.
In the embodiment of the present example, the event information includes event content, and calculating the similarity between the reference event and other events includes: extracting semantic vectors of key sentences in the event contents of the reference event and other events; and calculating the similarity according to the semantic vectors of the key sentences in the event contents of the reference event and other events. In the embodiment of the present example, the similarity determination method for the subject-related event may be semantic vector comparison determination of a key sentence of preset subject information, and may mark a certain subject-related event as a reference event, respectively calculate and compare semantic vectors of key sentences of other events and the reference event, and determine the similarity between the reference event and other events according to a preset semantic vector comparison threshold. Specifically, semantic vectors are obtained through word2vec, ELMO, BERT and the like, and similarity is calculated and judged.
In an embodiment of the present example, the method further comprises: acquiring event content of the hotness event, and generating event summary information according to the event content; and in response to an event showing instruction triggered by a user, showing the event summary information in a showing diagram.
In the embodiment of the example, in order to improve user experience and provide a user with intuitive and convenient browsing based on the heat event, the abstract of the heat event can be extracted and generated based on a preset method, an operable instruction is provided on the event display interface, a display effect corresponding to the operable instruction is correspondingly generated, and the event abstract of the hot event is displayed on the interface.
In an embodiment of the present example, the event information includes an event source, the method further comprising: acquiring a preset number of heat events with the highest heat index in the peak value period; checking the weight value of the event source of the heat event; and if the weighted values of the event sources are all smaller than a preset weighted threshold, modifying the current peak period to be a non-peak period.
In the embodiment of the present invention, in the application of the subject-related event, there are often redundant events including a large amount of useless information, such as advertisements and induction sharing information, and the hot value of the redundant event is often determined as a hot event due to high similarity, so in a second preset period, the weighted value of the event source of the hot event needs to be rechecked, and if the weighted values of the event source are all smaller than the preset weighted threshold, the current peak period is modified to a non-peak period.
In an embodiment of the present example, the method further comprises: and if the number of the similar events of the main body related events in the peak value period is lower than a preset similar amount threshold value, modifying the current peak value period into a non-peak value period.
In the embodiment of the present invention, in the second preset period, whether the similarity of the events, the number of events, or the source weight of the events is used as the criterion for determining the abnormal event, there may be a possibility that the second preset period is determined as the abnormal day, but there is no possibility of the similar event, so it is further necessary to recombine the events of all the abnormal days, and according to the recombination result, if there is no similar event in the abnormal day, the abnormal day is changed to the non-peak period.
In an embodiment of the present example, the method further comprises: if the number of the similar events of the main body related event in the non-peak value period is lower than a preset similar amount threshold value, acquiring an event title of the main body related event in the non-peak value period; matching the event title in a first preset abnormal information database; taking a main body related event hitting the preset first abnormal information database as a hit event, and judging whether the hit event is repeated with the event content in the adjacent period of the current non-peak value period; if not, modifying the current non-peak period into the peak period.
In the embodiment of the present example, in addition to performing necessary matching on event information on all abnormal days, abnormal events in all non-abnormal days are determined again, and the peak period is redefined. Specifically, in a first preset period, if the non-abnormal day and the number of similar articles are lower than a preset threshold, keyword rule matching is performed on the titles of each article on the current day, if the hit and hit article are not repeated with the articles on the previous and next two days, the current non-peak period is modified to be the peak period, and the current non-peak period is considered to be the abnormal day.
In the embodiment of the present example, if the current non-peak period is modified to be the peak period, the heat event of the day is counted and displayed as the abnormal event.
In an embodiment of the present example, the method further comprises: acquiring a preset number of heat events with the highest heat index in the peak value period; matching the event information of the heat event in a second preset abnormal information database; and if the heat event hits the second preset abnormal information database, modifying the current peak period into a non-peak period.
In the embodiment of the present example, for a hot event in a second preset abnormal period, a title of the hot event is checked, and if the title contains content in a preset abnormal information database, a current peak period is modified to a non-peak period. Specifically, the anomaly information may be labeled as "negative" keyword information, which includes, but is not limited to, words that do not positively contribute to the hotspot event, such as lottery news, and the like.
In the embodiment of the present example, if the current peak period is modified to be the non-peak period, the abnormal event of the day is not shown.
In the embodiment of the present example, the event information of the subject-related event further includes an event title, and the method further includes: setting a corresponding abnormal event mark for the peak value period; generating a display diagram according to the peak value period and the abnormal event mark, and displaying; and in response to an event presentation instruction triggered by a user, presenting an event title of the abnormal event in a presentation diagram.
In the embodiment of the present example, as shown in fig. 2, which is a display effect diagram of the abnormal event detection method, in a user display interface, hot spot events of the second preset periods in the first preset period are statistically displayed, and peak period marks are displayed, such as heartbeat marks in the diagram, so that a user can visually see all peak periods of the first preset period and abnormal events of each peak period. When a user needs to check the abnormal event corresponding to the peak value period, the corresponding peak value period or heartbeat mark can be triggered to generate an event display instruction, and the event title or the event abstract of the abnormal news corresponding to the peak value period is displayed in response to the event display instruction, triggered by the user, corresponding to the peak value period or heartbeat mark. The event title or the event summary can be shown in the form of a URL, and when the user needs to know the abnormal event deeply, the user can click the URL link to enter the corresponding detail page.
It should be noted that although the various steps of the methods of the present disclosure are depicted in the drawings in a particular order, this does not require or imply that these steps must be performed in this particular order, or that all of the depicted steps must be performed, to achieve desirable results. Additionally or alternatively, certain steps may be omitted, multiple steps combined into one step execution, and/or one step broken down into multiple step executions, etc.
Further, in the present exemplary embodiment, an abnormal event detecting apparatus is also provided. Referring to fig. 3, the abnormal event detecting apparatus 300 may include: an event information acquiring module 310, an event occurrence data calculating module 320 and an abnormal event judging module 330. Wherein:
an event information obtaining module 310, configured to obtain event information of a host related event in a first preset period;
the event occurrence data calculation module 320 is configured to obtain subject-related events of a second preset period from the first preset period, and calculate event occurrence data of the second preset period according to the number of the subject-related events of the second preset period;
the abnormal event determining module 330 is configured to input the event occurrence data into a preset peak data model, calculate and determine whether the second preset period is a peak period, and if so, determine that an abnormal event exists in the peak period.
The specific details of each abnormal event detection device module are already described in detail in the corresponding abnormal event detection method, and therefore are not described herein again.
It should be noted that although several modules or units of the abnormal event detecting apparatus 300 are mentioned in the above detailed description, such division is not mandatory. Indeed, the features and functionality of two or more modules or units described above may be embodied in one module or unit, according to embodiments of the present disclosure. Conversely, the features and functions of one module or unit described above may be further divided into embodiments by a plurality of modules or units.
In addition, in an exemplary embodiment of the present disclosure, an electronic device capable of implementing the above method is also provided.
As will be appreciated by one skilled in the art, aspects of the present invention may be embodied as a system, method or program product. Thus, various aspects of the invention may be embodied in the form of: an entirely hardware embodiment, an entirely software embodiment (including firmware, microcode, etc.) or an embodiment combining hardware and software aspects that may all generally be referred to herein as a "circuit," module "or" system.
An electronic device 400 according to such an embodiment of the invention is described below with reference to fig. 4. The electronic device 400 shown in fig. 4 is only an example and should not bring any limitation to the function and the scope of use of the embodiments of the present invention.
As shown in fig. 4, electronic device 400 is embodied in the form of a general purpose computing device. The components of electronic device 400 may include, but are not limited to: the at least one processing unit 410, the at least one memory unit 420, a bus 430 connecting different system components (including the memory unit 420 and the processing unit 410), and a display unit 440.
Wherein the storage unit stores program code that is executable by the processing unit 410 to cause the processing unit 410 to perform steps according to various exemplary embodiments of the present invention as described in the above section "exemplary methods" of the present specification. For example, the processing unit 410 may perform steps S110 to S130 as shown in fig. 1.
The storage unit 420 may include readable media in the form of volatile storage units, such as a random access memory unit (RAM)4201 and/or a cache memory unit 4202, and may further include a read only memory unit (ROM) 4203.
The storage unit 420 may also include a program/utility 4204 having a set (at least one) of program modules 4205, such program modules 4205 including, but not limited to: an operating system, one or more application programs, other program modules, and program data, each of which, or some combination thereof, may comprise an implementation of a network environment.
The electronic device 400 may also communicate with one or more external devices 470 (e.g., keyboard, pointing device, bluetooth device, etc.), with one or more devices that enable a user to interact with the electronic device 400, and/or with any devices (e.g., router, modem, etc.) that enable the electronic device 400 to communicate with one or more other computing devices. Such communication may occur via input/output (I/O) interfaces 450. Also, the electronic device 400 may communicate with one or more networks (e.g., a Local Area Network (LAN), a Wide Area Network (WAN), and/or a public network, such as the internet) via the network adapter 460. As shown, the network adapter 460 communicates with the other modules of the electronic device 400 over the bus 430. It should be appreciated that although not shown in the figures, other hardware and/or software modules may be used in conjunction with electronic device 400, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems, among others.
Through the above description of the embodiments, those skilled in the art will readily understand that the exemplary embodiments described herein may be implemented by software, or by software in combination with necessary hardware. Therefore, the technical solution according to the embodiments of the present disclosure may be embodied in the form of a software product, which may be stored in a non-volatile storage medium (which may be a CD-ROM, a usb disk, a removable hard disk, etc.) or on a network, and includes several instructions to enable a computing device (which may be a personal computer, a server, a terminal device, or a network device, etc.) to execute the method according to the embodiments of the present disclosure.
In an exemplary embodiment of the present disclosure, there is also provided a computer-readable storage medium having stored thereon a program product capable of implementing the above-described method of the present specification. In some possible embodiments, aspects of the invention may also be implemented in the form of a program product comprising program code means for causing a terminal device to carry out the steps according to various exemplary embodiments of the invention described in the above-mentioned "exemplary methods" section of the present description, when said program product is run on the terminal device.
Referring to fig. 5, a program product 500 for implementing the above method according to an embodiment of the present invention is described, which may employ a portable compact disc read only memory (CD-ROM) and include program code, and may be run on a terminal device, such as a personal computer. However, the program product of the present invention is not limited in this regard and, in the present document, a readable storage medium may be any tangible medium that can contain, or store a program for use by or in connection with an instruction execution system, apparatus, or device.
The program product may employ any combination of one or more readable media. The readable medium may be a readable signal medium or a readable storage medium. A readable storage medium may be, for example, but not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination of the foregoing. More specific examples (a non-exhaustive list) of the readable storage medium include: an electrical connection having one or more wires, a portable disk, a hard disk, a Random Access Memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.
A computer readable signal medium may include a propagated data signal with readable program code embodied therein, for example, in baseband or as part of a carrier wave. Such a propagated data signal may take many forms, including, but not limited to, electro-magnetic, optical, or any suitable combination thereof. A readable signal medium may also be any readable medium that is not a readable storage medium and that can communicate, propagate, or transport a program for use by or in connection with an instruction execution system, apparatus, or device.
Program code embodied on a readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wireline, optical fiber cable, RF, etc., or any suitable combination of the foregoing.
Program code for carrying out operations for aspects of the present invention may be written in any combination of one or more programming languages, including an object oriented programming language such as Java, C + + or the like and conventional procedural programming languages, such as the "C" programming language or similar programming languages, and interpreted programming languages, such as python and the like. The program code may execute entirely on the user's computing device, partly on the user's device, as a stand-alone software package, partly on the user's computing device and partly on a remote computing device, or entirely on the remote computing device or server. In the case of a remote computing device, the remote computing device may be connected to the user computing device through any kind of network, including a Local Area Network (LAN) or a Wide Area Network (WAN), or may be connected to an external computing device (e.g., through the internet using an internet service provider).
Furthermore, the above-described figures are merely schematic illustrations of processes involved in methods according to exemplary embodiments of the invention, and are not intended to be limiting. It will be readily understood that the processes shown in the above figures are not intended to indicate or limit the chronological order of the processes. In addition, it is also readily understood that these processes may be performed synchronously or asynchronously, e.g., in multiple modules.
Other embodiments of the disclosure will be apparent to those skilled in the art from consideration of the specification and practice of the disclosure disclosed herein. This application is intended to cover any variations, uses, or adaptations of the disclosure following, in general, the principles of the disclosure and including such departures from the present disclosure as come within known or customary practice within the art to which the disclosure pertains. It is intended that the specification and examples be considered as exemplary only, with a true scope and spirit of the disclosure being indicated by the following claims.
It will be understood that the present disclosure is not limited to the precise arrangements described above and shown in the drawings and that various modifications and changes may be made without departing from the scope thereof. The scope of the present disclosure is to be limited only by the terms of the appended claims.
Claims (20)
1. A method of anomalous event detection, said method comprising:
acquiring event information of a host related event in a first preset period;
acquiring main body related events of a second preset period from the first preset period, and calculating event occurrence data of the second preset period according to the number of the main body related events of the second preset period;
inputting the event occurrence data into a preset peak data model, calculating and judging whether the second preset period is a peak period, and if so, determining that the peak period has an abnormal event.
2. The method of claim 1, wherein calculating event occurrence data for a second predetermined period based on the number of subject-related events for the second predetermined period comprises:
respectively taking each main body related event in a second preset period as a reference event;
calculating the similarity of the reference event and other events, and taking the event with the similarity larger than a preset similarity threshold as a similar event;
and taking the total number of the main body related events with similar events as the event occurrence data.
3. The method of claim 1, wherein calculating the event occurrence data for the second predetermined period according to the number of the subject-related events for the second predetermined period comprises any one of:
calculating the total amount of the main body related events in a second preset period, and taking the total amount of the main body related events as the event occurrence data; alternatively, the first and second electrodes may be,
the event information comprises event sources, the number of the event sources of the main body related events is obtained, and the number of the event sources is used as the event occurrence data; alternatively, the first and second electrodes may be,
and calculating the total quantity of the main body in other events corresponding to the main body related events in a second preset period, and taking the total quantity of the main body as the event occurrence data.
4. The method of claim 1, wherein calculating and determining whether the second predetermined period is a peak period comprises:
respectively comparing the event occurrence data of each second preset period with the event occurrence data of the adjacent period;
judging whether the comparison result meets a preset peak value period condition or not;
and if so, determining that the current second preset period is the peak period.
5. The method of claim 1, wherein the method further comprises:
calculating the heat index of the main body related event in a second preset period according to a preset heat algorithm;
taking the main body related events with the highest heat index in the peak value period as heat events in a preset number;
determining that the heat event is the abnormal event.
6. The method of claim 5, wherein the event information comprises event sources, and the calculating the heat index of the subject-related event in the second preset period according to the preset heat algorithm comprises:
respectively taking each main body related event in a second preset period as a reference event;
calculating the similarity of the reference event and other events, and taking the event with the similarity larger than a preset similarity threshold as the similar event of the reference event;
judging whether the number of the similar events of the reference event is smaller than a preset similar threshold value or not;
if the number of the similar events of the reference event is smaller than a preset similar threshold, acquiring a weight value corresponding to an event source in the reference event, and taking the weight value corresponding to the event source as a heat index of the reference event.
7. The method of claim 6, wherein after determining whether the number of similar events of the reference event is less than a preset similarity threshold, the method further comprises:
if the number of the similar events of the reference event is greater than or equal to a preset similar threshold, acquiring a weight value corresponding to the event source of the reference event and the similar events thereof;
and taking the weight value and the value corresponding to the event sources of the reference event and the similar events thereof as the heat index of the reference event.
8. The method of claim 6, wherein the event information includes an event title, and wherein calculating the similarity of the reference event to other events comprises:
calculating the intersection length of the event titles of the reference event and other events;
and calculating the similarity of the reference event and the event titles of other events according to the intersection length of the two events.
9. The method of claim 6, wherein the event information includes event content, and wherein calculating the similarity of the reference event to other events comprises:
acquiring a paragraph containing preset main body information in the event content;
calculating hash values of sections containing preset main body information in the event contents of the reference event and other events, and comparing the hash values;
and calculating the similarity according to the hash value comparison result.
10. The method of claim 6, wherein the event information includes event content, and wherein calculating the similarity of the reference event to other events comprises:
extracting semantic vectors of key sentences in the event contents of the reference event and other events;
and calculating the similarity according to semantic vectors of key sentences in the event contents of the reference event and other events.
11. The method of claim 5, wherein the method further comprises:
acquiring event content of the heat event, and generating event summary information according to the event content;
and responding to an event showing instruction triggered by a user, and showing the event summary information in a showing diagram.
12. The method of claim 5, wherein the event information comprises an event source, the method further comprising:
acquiring a preset number of heat events with the highest heat index in the peak value period;
checking a weight value of an event source of the heat event;
and if the weighted values of the event sources are all smaller than a preset weighted threshold, modifying the current peak period to be a non-peak period.
13. The method of claim 6, wherein the method further comprises:
and if the number of the similar events of the main body related events in the peak value period is lower than a preset similar amount threshold value, modifying the current peak value period into a non-peak value period.
14. The method of claim 6, wherein the method further comprises:
if the number of the similar events of the main body related event in the non-peak value period is lower than a preset similar amount threshold value, acquiring an event title of the main body related event in the non-peak value period;
matching the event titles in a first preset abnormal information database;
taking a main body related event hitting the preset first abnormal information database as a hit event, and judging whether the hit event is repeated with the event content in the adjacent period of the current non-peak value period;
if not, modifying the current non-peak period into the peak period.
15. The method of claim 6, wherein the method further comprises:
acquiring a preset number of heat events with the highest heat index in the peak value period;
matching the event information of the heat event in a second preset abnormal information database;
and if the heat event hits the second preset abnormal information database, modifying the current peak period into a non-peak period.
16. The method of claim 1, wherein obtaining event information of subject-related events within a first predetermined period comprises:
according to preset main information, matching key information of event information of all events in a first preset period in a main information database;
and taking the event which is successfully matched as the event related to the main body, and acquiring the information of the event which is successfully matched.
17. The method of claim 1, wherein the event information of the subject-related event further includes an event title, the method further comprising:
setting a corresponding abnormal event mark for the peak value period;
generating a display diagram according to the peak value period and the abnormal event mark, and displaying the display diagram;
and responding to an event presentation instruction triggered by a user, and presenting an event title of the abnormal event in a presentation graphic.
18. An abnormal event detection apparatus, comprising:
the event information acquisition module is used for acquiring event information of main body related events in a first preset period;
the event occurrence data calculation module is used for acquiring main body related events of a second preset period from the first preset period and calculating event occurrence data of the second preset period according to the number of the main body related events of the second preset period;
and the abnormal event judging module is used for inputting the event occurrence data into a preset peak data model, calculating and judging whether the second preset period is a peak period, and if so, determining that the peak period has an abnormal event.
19. A computer device comprising a processor and a memory;
wherein the processor executes a program corresponding to the executable program code by reading the executable program code stored in the memory for implementing the method according to any one of claims 1 to 17.
20. A computer-readable storage medium, on which a computer program is stored, characterized in that the computer program realizes the method according to any of claims 1-17 when executed by a processor.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202010238270.1A CN111563527B (en) | 2020-03-30 | 2020-03-30 | Abnormal event detection method and device |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202010238270.1A CN111563527B (en) | 2020-03-30 | 2020-03-30 | Abnormal event detection method and device |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN111563527A true CN111563527A (en) | 2020-08-21 |
| CN111563527B CN111563527B (en) | 2024-02-09 |
Family
ID=72073061
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202010238270.1A Active CN111563527B (en) | 2020-03-30 | 2020-03-30 | Abnormal event detection method and device |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN111563527B (en) |
Cited By (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN112800068A (en) * | 2021-02-22 | 2021-05-14 | 首钢京唐钢铁联合有限责任公司 | Method and device for automatically processing energy metering data |
| CN113591467A (en) * | 2021-08-06 | 2021-11-02 | 北京金堤征信服务有限公司 | Event subject identification method and apparatus, electronic device, medium, and program |
Citations (8)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| JP2010267207A (en) * | 2009-05-18 | 2010-11-25 | Nippon Telegr & Teleph Corp <Ntt> | Unusualness evaluation device, unusualness evaluation method, and computer program |
| CN106815255A (en) * | 2015-11-27 | 2017-06-09 | 阿里巴巴集团控股有限公司 | The method and device of detection data access exception |
| WO2017161830A1 (en) * | 2016-03-25 | 2017-09-28 | 乐视控股（北京）有限公司 | Calendar event display method, device, and electronic device |
| CN107426022A (en) * | 2017-07-21 | 2017-12-01 | 上海携程商务有限公司 | Security incident monitoring method and device, electronic equipment, storage medium |
| CN108446546A (en) * | 2018-03-20 | 2018-08-24 | 深信服科技股份有限公司 | Abnormal access detection method, device, equipment and computer readable storage medium |
| CN108959034A (en) * | 2018-07-05 | 2018-12-07 | 北京木瓜移动科技股份有限公司 | A kind of monitoring alarm method, device, electronic equipment and storage medium |
| CN109522190A (en) * | 2018-10-12 | 2019-03-26 | 中国平安人寿保险股份有限公司 | Abnormal user Activity recognition method and device, electronic equipment, storage medium |
| US20190370330A1 (en) * | 2018-06-01 | 2019-12-05 | Beijing Baidu Netcom Science Technology Co., Ltd. | Method, apparatus for event detection, device and storage medium |
-
2020
- 2020-03-30 CN CN202010238270.1A patent/CN111563527B/en active Active
Patent Citations (8)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| JP2010267207A (en) * | 2009-05-18 | 2010-11-25 | Nippon Telegr & Teleph Corp <Ntt> | Unusualness evaluation device, unusualness evaluation method, and computer program |
| CN106815255A (en) * | 2015-11-27 | 2017-06-09 | 阿里巴巴集团控股有限公司 | The method and device of detection data access exception |
| WO2017161830A1 (en) * | 2016-03-25 | 2017-09-28 | 乐视控股（北京）有限公司 | Calendar event display method, device, and electronic device |
| CN107426022A (en) * | 2017-07-21 | 2017-12-01 | 上海携程商务有限公司 | Security incident monitoring method and device, electronic equipment, storage medium |
| CN108446546A (en) * | 2018-03-20 | 2018-08-24 | 深信服科技股份有限公司 | Abnormal access detection method, device, equipment and computer readable storage medium |
| US20190370330A1 (en) * | 2018-06-01 | 2019-12-05 | Beijing Baidu Netcom Science Technology Co., Ltd. | Method, apparatus for event detection, device and storage medium |
| CN108959034A (en) * | 2018-07-05 | 2018-12-07 | 北京木瓜移动科技股份有限公司 | A kind of monitoring alarm method, device, electronic equipment and storage medium |
| CN109522190A (en) * | 2018-10-12 | 2019-03-26 | 中国平安人寿保险股份有限公司 | Abnormal user Activity recognition method and device, electronic equipment, storage medium |
Non-Patent Citations (2)
| Title |
|---|
| 李凌云;敖吉;乔治;李剑;: "基于微博的安全事件实时监测框架研究" * |
| 滕靖;刘韶杰;龚越;王文;: "交通事件网络舆情分析方法" * |
Cited By (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN112800068A (en) * | 2021-02-22 | 2021-05-14 | 首钢京唐钢铁联合有限责任公司 | Method and device for automatically processing energy metering data |
| CN112800068B (en) * | 2021-02-22 | 2023-05-12 | 首钢京唐钢铁联合有限责任公司 | Method and device for automatically processing energy metering data |
| CN113591467A (en) * | 2021-08-06 | 2021-11-02 | 北京金堤征信服务有限公司 | Event subject identification method and apparatus, electronic device, medium, and program |
| CN113591467B (en) * | 2021-08-06 | 2023-11-03 | 北京金堤征信服务有限公司 | Event main body recognition method and device, electronic equipment and medium |
Also Published As
| Publication number | Publication date |
|---|---|
| CN111563527B (en) | 2024-02-09 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| US11625407B2 (en) | Website scoring system | |
| Kolajo et al. | Big data stream analysis: a systematic literature review | |
| Gao et al. | Online app review analysis for identifying emerging issues | |
| Jin et al. | What makes consumers unsatisfied with your products: Review analysis at a fine-grained level | |
| CN106027577A (en) | Exception access behavior detection method and device | |
| CN107729376B (en) | Insurance data auditing method and device, computer equipment and storage medium | |
| TWI643076B (en) | Financial analysis system and method for unstructured text data | |
| CN111666304B (en) | Data processing device, data processing method, storage medium, and electronic apparatus | |
| CN111210335A (en) | User risk identification method and device and electronic equipment | |
| Yang et al. | Duplication detection for software bug reports based on bm25 term weighting | |
| CN111127051B (en) | Multi-channel dynamic attribution method, device, server and storage medium | |
| US9558462B2 (en) | Identifying and amalgamating conditional actions in business processes | |
| CN111210336A (en) | User risk model generation method and device and electronic equipment | |
| CN111583018A (en) | Credit granting strategy management method and device based on user financial performance analysis and electronic equipment | |
| CN111563527B (en) | Abnormal event detection method and device | |
| CN111191677B (en) | User characteristic data generation method and device and electronic equipment | |
| CN113297287B (en) | Automatic user policy deployment method and device and electronic equipment | |
| CN112084448A (en) | Similar information processing method and device | |
| US10250705B2 (en) | Interaction trajectory retrieval | |
| CN111222918B (en) | Keyword mining method and device, electronic equipment and storage medium | |
| CN111383725B (en) | Adverse reaction data identification method and device, electronic equipment and readable medium | |
| CN113032515A (en) | Method, system, device and storage medium for generating chart based on multiple data sources | |
| CN111125548A (en) | Public opinion supervision method and device, electronic equipment and storage medium | |
| WO2020005654A1 (en) | Automatically providing information in an application | |
| CN113609407B (en) | Regional consistency verification method and device |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |