CN111563527B - Abnormal event detection method and device - Google Patents
Abnormal event detection method and device Download PDFInfo
- Publication number
- CN111563527B CN111563527B CN202010238270.1A CN202010238270A CN111563527B CN 111563527 B CN111563527 B CN 111563527B CN 202010238270 A CN202010238270 A CN 202010238270A CN 111563527 B CN111563527 B CN 111563527B
- Authority
- CN
- China
- Prior art keywords
- event
- preset
- period
- events
- main body
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
- 230000002159 abnormal effect Effects 0.000 title claims abstract description 92
- 238000001514 detection method Methods 0.000 title claims abstract description 26
- 238000000034 method Methods 0.000 claims abstract description 70
- 238000013499 data model Methods 0.000 claims abstract description 12
- 238000010586 diagram Methods 0.000 claims description 16
- 239000013598 vector Substances 0.000 claims description 10
- 238000004422 calculation algorithm Methods 0.000 claims description 9
- 230000008569 process Effects 0.000 claims description 8
- 230000001960 triggered effect Effects 0.000 claims description 8
- 238000004364 calculation method Methods 0.000 claims description 6
- 238000004590 computer program Methods 0.000 claims description 3
- 238000012545 processing Methods 0.000 description 7
- 230000000694 effects Effects 0.000 description 3
- 230000003287 optical effect Effects 0.000 description 3
- 230000006978 adaptation Effects 0.000 description 2
- 239000000463 material Substances 0.000 description 2
- 239000013307 optical fiber Substances 0.000 description 2
- 230000000644 propagated effect Effects 0.000 description 2
- 238000004458 analytical method Methods 0.000 description 1
- 210000000026 apposition eye Anatomy 0.000 description 1
- 238000013459 approach Methods 0.000 description 1
- 238000003491 array Methods 0.000 description 1
- 230000008859 change Effects 0.000 description 1
- 238000004891 communication Methods 0.000 description 1
- 150000001875 compounds Chemical class 0.000 description 1
- 238000011161 development Methods 0.000 description 1
- 238000005516 engineering process Methods 0.000 description 1
- 230000002708 enhancing effect Effects 0.000 description 1
- 230000006870 function Effects 0.000 description 1
- 238000007726 management method Methods 0.000 description 1
- 238000012986 modification Methods 0.000 description 1
- 230000004048 modification Effects 0.000 description 1
- 230000002093 peripheral effect Effects 0.000 description 1
- 235000019633 pungent taste Nutrition 0.000 description 1
- 230000003252 repetitive effect Effects 0.000 description 1
- 230000004044 response Effects 0.000 description 1
- 238000012552 review Methods 0.000 description 1
- 239000004065 semiconductor Substances 0.000 description 1
- 230000002123 temporal effect Effects 0.000 description 1
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F18/00—Pattern recognition
- G06F18/20—Analysing
- G06F18/22—Matching criteria, e.g. proximity measures
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
- G06F16/90—Details of database functions independent of the retrieved data types
- G06F16/95—Retrieval from the web
- G06F16/953—Querying, e.g. by the use of web search engines
- G06F16/9536—Search customisation based on social or collaborative filtering
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F18/00—Pattern recognition
- G06F18/20—Analysing
- G06F18/24—Classification techniques
- G06F18/243—Classification techniques relating to the number of classes
- G06F18/2433—Single-class perspective, e.g. one-against-all classification; Novelty detection; Outlier detection
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F40/00—Handling natural language data
- G06F40/20—Natural language analysis
- G06F40/205—Parsing
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F40/00—Handling natural language data
- G06F40/30—Semantic analysis
Abstract
The disclosure relates to an abnormal event detection method, an abnormal event detection device, electronic equipment and a storage medium. Wherein the method comprises the following steps: acquiring event information of a main body related event in a first preset period; acquiring main body related events of a second preset period from the first preset period, and calculating event occurrence data of the second preset period according to the number of the main body related events of the second preset period; and inputting the event occurrence data into a preset peak data model, calculating and judging whether the second preset period is a peak period, and if so, determining that an abnormal event exists in the peak period. The method and the device can greatly improve the accuracy of abnormal event detection.
Description
Technical Field
The present disclosure relates to the field of the internet, and in particular, to an abnormal event detection method, an apparatus, an electronic device, and a computer readable storage medium.
Background
With the development of internet technology, people can acquire various types of information such as news public opinion, industry dynamics, enterprise information and the like through the internet. When a user needs to view information of a specific event type or main body, the user cannot intuitively judge and understand the information of the same event type or main body due to a large amount of continuous inflow of the information and high discreteness of the information of the same event type or main body in release sources and release time. Particularly in public opinion analysis, it is difficult to accurately know whether the event type or the subject has truly important abnormal events in the near future or on a certain day.
Accordingly, there is a need for one or more approaches to address the above-described problems.
It should be noted that the information disclosed in the above background section is only for enhancing understanding of the background of the present disclosure and thus may include information that does not constitute prior art known to those of ordinary skill in the art.
Disclosure of Invention
It is an object of the present disclosure to provide an abnormal event detection method, apparatus, electronic device, and computer-readable storage medium, which overcome, at least in part, one or more of the problems due to the limitations and disadvantages of the related art.
According to one aspect of the present disclosure, there is provided an abnormal event detection method including:
acquiring event information of a main body related event in a first preset period;
acquiring main body related events of a second preset period from the first preset period, and calculating event occurrence data of the second preset period according to the number of the main body related events of the second preset period;
and inputting the event occurrence data into a preset peak data model, calculating and judging whether the second preset period is a peak period, and if so, determining that an abnormal event exists in the peak period.
In one exemplary embodiment of the present disclosure, calculating event occurrence data of a second preset period according to a subject-related event number of the second preset period includes:
Respectively taking each main body related event in a second preset period as a reference event;
calculating the similarity between the reference event and other events, wherein the event with the similarity larger than a preset similarity threshold value is used as a similar event;
the total number of subject related events having similar events is taken as the event occurrence data.
In an exemplary embodiment of the present disclosure, calculating event occurrence data of the second preset period according to the number of subject related events of the second preset period includes any one of the following ways:
calculating the total amount of the main body related events in a second preset period, and taking the total amount of the main body related events as the event occurrence data; or alternatively, the process may be performed,
the event information includes event sources, the number of event sources for acquiring subject related events,
taking the number of event sources as the event occurrence data; or alternatively, the process may be performed,
and calculating the mentioned total quantity of the corresponding subject in other events of the subject related event in a second preset period, and taking the mentioned total quantity of the subject as the event occurrence data.
In an exemplary embodiment of the present disclosure, calculating and determining whether the second preset period is a peak period includes:
Respectively comparing the heat index of each second preset period with event occurrence data of adjacent periods;
judging whether the comparison result meets the preset peak period condition or not;
if yes, determining the current second preset period as the peak period.
In an exemplary embodiment of the present disclosure, the method further comprises:
calculating a heat index of the main body related event in a second preset period according to a preset heat algorithm;
taking a preset number of main body related events with highest heat index in the peak value period as heat events;
and determining the heat event as the abnormal event.
In an exemplary embodiment of the present disclosure, the event information includes an event source, and the calculating the heat index of the subject related event in the second preset period according to the preset heat algorithm includes:
respectively taking each main body related event in a second preset period as a reference event;
calculating the similarity between the reference event and other events, wherein the event with the similarity larger than a preset similarity threshold value is used as a similar event of the reference event;
judging whether the number of similar events of the reference event is smaller than a preset similarity threshold value or not;
If the number of similar events of the reference event is smaller than a preset similar threshold value, acquiring a weight value corresponding to an event source in the reference event, and taking the weight value corresponding to the event source as a heat index of the reference event.
In an exemplary embodiment of the present disclosure, after determining whether the number of similar events of the reference event is less than a preset similarity threshold, the method further includes:
if the number of the similar events of the reference event is larger than or equal to a preset similar threshold value, acquiring a weight value corresponding to the reference event and the event sources of the similar events;
and taking the weight value and the value corresponding to the event sources of the reference event and the similar events as the heat index of the reference event.
In an exemplary embodiment of the present disclosure, the event information includes an event title, and calculating a similarity of the reference event to other events includes:
calculating the intersection length of the event titles of the reference event and other events;
and calculating the similarity of the reference event and the event titles of other events according to the intersection length of the two events.
In an exemplary embodiment of the present disclosure, the event information includes event content, and calculating a similarity of the reference event to other events includes:
Acquiring paragraphs containing preset main body information in the event content;
calculating hash values of paragraphs containing preset main body information in event contents of the reference event and other events, and comparing the hash values;
and calculating the similarity according to the hash value comparison result.
In an exemplary embodiment of the present disclosure, the event information includes event content, and calculating a similarity of the reference event to other events includes:
extracting semantic vectors of key sentences in event contents of the reference event and other events;
and calculating the similarity according to semantic vectors of key sentences in event contents of the reference event and other events.
In an exemplary embodiment of the present disclosure, the method further comprises:
acquiring event content of the hot event, and generating event summary information according to the event content;
and responding to an event display instruction triggered by a user, and displaying the event summary information in a display diagram.
In an exemplary embodiment of the present disclosure, the event information includes an event source, the method further comprising:
acquiring a preset number of heat events with highest heat index in the peak period;
Checking a weight value of an event source of the heat event;
and if the weight values of the event sources are smaller than the preset weight threshold value, modifying the current peak value period into a non-peak value period.
In an exemplary embodiment of the present disclosure, the method further comprises:
and if the number of similar events of the main body related events in the peak period is lower than a preset similarity threshold, modifying the current peak period into a non-peak period.
In an exemplary embodiment of the present disclosure, the method further comprises:
if the number of similar events of the main body related events in the off-peak period is lower than a preset similarity threshold, acquiring an event title of the main body related events in the off-peak period;
matching the event titles in a first preset abnormal information database;
taking a main body related event in the preset first abnormal information database as a hit event, and judging whether event contents in adjacent periods of the hit event and the current non-peak period are repeated or not;
and if not, modifying the current non-peak period into a peak period.
In an exemplary embodiment of the present disclosure, the method further comprises:
acquiring a preset number of heat events with highest heat index in the peak period;
Matching the event information of the heat event in a second preset abnormal information database;
and if the heat event hits the second preset abnormal information database, the current peak value period is modified to be a non-peak value period.
In an exemplary embodiment of the present disclosure, acquiring event information of a subject related event within a first preset period includes:
according to the preset main body information, carrying out key information matching on event information of all events in a first preset period in a main body information database;
and taking the event successfully matched as an event related to the main body, and acquiring information of the event successfully matched.
In an exemplary embodiment of the present disclosure, the event information of the subject related event further includes an event title, and the method further includes:
setting the peak period to be a corresponding abnormal event mark;
generating a display diagram according to the peak period and the abnormal event mark, and displaying;
and responding to an event presentation instruction triggered by a user, and presenting an event title of the abnormal event in a presentation diagram. .
In one aspect of the present disclosure, there is provided an abnormal event detection apparatus including:
the event information acquisition module is used for acquiring event information of related events of the main body in a first preset period;
The event occurrence data calculation module is used for acquiring main body related events of a second preset period from the first preset period and calculating event occurrence data of the second preset period according to the number of the main body related events of the second preset period;
the abnormal event judging module is used for inputting the event occurrence data into a preset peak data model, calculating and judging whether the second preset period is a peak period, and if so, determining that the peak period has an abnormal event.
In one aspect of the present disclosure, there is provided an electronic device comprising:
a processor; and
a memory having stored thereon computer readable instructions which, when executed by the processor, implement a method according to any of the above.
In one aspect of the present disclosure, a computer readable storage medium is provided, on which a computer program is stored, which when executed by a processor, implements a method according to any of the above.
According to the abnormal event detection method in the exemplary embodiment of the disclosure, event information of a main body related event in a first preset period is obtained; acquiring main body related events of a second preset period from the first preset period, and calculating event occurrence data of the second preset period according to the number of the main body related events of the second preset period; and inputting the event occurrence data into a preset peak data model, calculating and judging whether the second preset period is a peak period, and if so, determining that an abnormal event exists in the peak period. The method and the device can greatly improve the accuracy of abnormal event detection.
It is to be understood that both the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the disclosure.
Drawings
The above and other features and advantages of the present disclosure will become more apparent by describing in detail exemplary embodiments thereof with reference to the attached drawings.
FIG. 1 illustrates a flowchart of an abnormal event detection method according to an exemplary embodiment of the present disclosure;
FIG. 2 illustrates a presentation effect diagram of an abnormal event detection method according to an exemplary embodiment of the present disclosure;
FIG. 3 illustrates a schematic block diagram of an abnormal event detection apparatus according to an exemplary embodiment of the present disclosure;
FIG. 4 schematically illustrates a block diagram of an electronic device according to an exemplary embodiment of the present disclosure; and
fig. 5 schematically illustrates a schematic diagram of a computer-readable storage medium according to an exemplary embodiment of the present disclosure.
Detailed Description
Example embodiments will now be described more fully with reference to the accompanying drawings. However, the exemplary embodiments can be embodied in many forms and should not be construed as limited to the embodiments set forth herein; rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the concept of the example embodiments to those skilled in the art. The same reference numerals in the drawings denote the same or similar parts, and thus a repetitive description thereof will be omitted.
Furthermore, the described features, structures, or characteristics may be combined in any suitable manner in one or more embodiments. In the following description, numerous specific details are provided to give a thorough understanding of embodiments of the disclosure. One skilled in the relevant art will recognize, however, that the disclosed aspects may be practiced without one or more of the specific details, or with other methods, components, materials, devices, steps, etc. In other instances, well-known structures, methods, devices, implementations, materials, or operations are not shown or described in detail to avoid obscuring aspects of the disclosure.
The block diagrams depicted in the figures are merely functional entities and do not necessarily correspond to physically separate entities. That is, these functional entities may be implemented in software, or in one or more software-hardened modules, or in different networks and/or processor devices and/or microcontroller devices.
In the present exemplary embodiment, there is first provided an abnormal event detection method; referring to fig. 1, the abnormal event detection method may include the steps of:
Step S110, acquiring event information of a main body related event in a first preset period;
step S120, acquiring main body related events of a second preset period from the first preset period, and calculating event occurrence data of the second preset period according to the number of the main body related events of the second preset period;
step S130, inputting the event occurrence data into a preset peak data model, calculating and judging whether the second preset period is a peak period, if so, determining that an abnormal event exists in the peak period.
According to the abnormal event detection method in the exemplary embodiment of the disclosure, event information of a main body related event in a first preset period is obtained; acquiring main body related events of a second preset period from the first preset period, and calculating event occurrence data of the second preset period according to the number of the main body related events of the second preset period; and inputting the event occurrence data into a preset peak data model, calculating and judging whether the second preset period is a peak period, and if so, determining that an abnormal event exists in the peak period. The method and the device can greatly improve the accuracy of abnormal event detection.
Next, the abnormal event detection method in the present exemplary embodiment will be further described.
In step S110, event information of a subject related event in a first preset period may be acquired.
In an embodiment of the present example, acquiring event information of a subject-related event in a first preset period includes: according to the preset main body information, carrying out key information matching on event information of all events in a first preset period in a main body information database; and taking the event successfully matched as an event related to the main body, and acquiring information of the event successfully matched. The preset subject information may be a business name, a person name, an industry, etc. When the subject is a business, the event information may include an event title, a time source, an event content, other subject information mentioned by the event content, and the like, and taking a related news public opinion that the subject related event is a business as an example, the event information may include an article title, a media distribution source, an article content, a business list mentioned by an article, and other article media distribution sources and numbers similar to the article.
The first preset period may be any time period such as one year, one month, one week or even one day, after the event information of the main related event in the first preset period is obtained, key information matching is performed on the event information in the main information database, and public opinion articles of the enterprise or related personnel of the enterprise or product services of the enterprise are obtained, and further, event information of conditions such as high correlation between the public opinion articles and industries of the enterprise or partners and contests of the enterprise and the like may also be included.
For example, taking the preset subject information as an enterprise (Tian-yan-cha) as an example, if a user needs to query an abnormal event (such as headline news or news of a specific type such as a high management change) in the Tian-yan-cha 2 month of 2019, all event information of the Tian-yan-cha enterprise in the year 2 month of 2019 can be obtained, public opinion articles of all event information of the year 2 month, related personnel of the Tian-yan-cha or products of the Tian-yan-cha, which are related to the Tian-yan-cha, are taken as subject corresponding events of Tian-yan-cha, and event titles, event sources, event contents, other subject information mentioned by the event contents, and the like corresponding to the public opinion articles are obtained, so as to complete the acquisition of subject related events in the first preset period.
In step S120, a main related event of a second preset period may be acquired from the first preset period, and event occurrence data of the second preset period may be calculated according to the number of main related events of the second preset period.
In this exemplary embodiment, the second preset period is an event period unit included in the first preset period, and the event occurrence data is event occurrence data generated by counting the number of related events of the subject based on a preset determination criterion, and specifically, when the first preset period is one month, the second preset period may be one day, and the daily event occurrence data is calculated according to related events of the subject daily in one month.
In an embodiment of the present example, calculating event occurrence data of a second preset period according to a main body related event number of the second preset period includes: respectively taking each main body related event in a second preset period as a reference event; calculating the similarity between the reference event and other events, wherein the event with the similarity larger than a preset similarity threshold value is used as a similar event; the total number of subject related events having similar events is taken as the event occurrence data.
In the embodiment of the present example, in a first preset period, each subject-related event in a second preset period is used as a reference event, similarity between each subject-related event and other events is calculated in a crossing manner, a corresponding threshold is set to determine whether the subject-related event is a similar event, if yes, the similar event is counted up, statistics of the total number of the subject-related events is completed, and finally, the number of the subject-related events is used as event occurrence data in the second preset period.
In the embodiment of the present example, taking all the main body related events of the above-mentioned sky eye examination enterprise in 2 months of a certain year as the reference event, cross-calculating the similarity between each main body related event and other events by taking all the 20 main body related events of 28 days of a certain year as the reference event, setting a corresponding threshold value to determine whether the main body related event is a similar event, if the threshold value is set to 90%, determining that the event is a similar event if the cross-comparison similarity is greater than 90%, and finally determining that 15 similar events are included in the 20 main body related events, then incrementally counting the similar events to complete the total number statistics of the main body related events, and finally, determining that the event occurrence data of the sky eye examination in 28 days of a 2 month is 15.
In an embodiment of the present example, calculating event occurrence data of the second preset period according to the number of subject related events of the second preset period includes any one of the following ways:
calculating the total amount of the main body related events in a second preset period, and taking the total amount of the main body related events as the event occurrence data; or, the event information comprises event sources, the number of event sources of the related events of the main body is obtained, and the number of event sources is used as the event occurrence data; or, calculating the mentioned total amount of the subject related event corresponding to the subject in other events in a second preset period, and taking the mentioned total amount as the event occurrence data.
In the embodiment of the present example, in addition to determining event occurrence data by comparing and judging similar events in the second preset period, event occurrence data may be determined by calculating the total amount of related events of the subject or counting the number of sources of the events.
In the embodiment of the present example, taking the above-mentioned all subject-related events of the sky eye examination enterprise in 2 months of a year as an example, the total of 20 subject-related events may be counted as 20 for 28 days of a month; the media release sources of the 20 main body related events can be counted, for example, the media release sources of the 20 main body related events are a plurality of media release sources such as daily necessities of people, financial news of Zhongguancun, and present headlines, and the number of the media release sources is counted to be 10, and then the event occurrence data can be counted to be 10.
In step S130, the event occurrence data may be input into a predetermined peak data model, and whether the second predetermined period is a peak period is calculated and determined, if yes, that an abnormal event exists in the peak period.
In this exemplary embodiment, after determining the event occurrence data of each second preset period in the first preset period, according to the event occurrence data of the second preset period, calculating and determining whether the second preset period is a peak period through a preset peak data model, so as to complete the determination of whether the second preset period is an abnormal event. It should be noted that the abnormal event may be an abnormal event in the event content sense or an abnormal event having a statistical sense.
In the embodiment of the present example, calculating and judging whether the second preset period is a peak period includes: respectively comparing the heat index of each second preset period with event occurrence data of adjacent periods; judging whether the comparison result meets the preset peak period condition or not; if yes, determining the current second preset period as the peak period.
In this exemplary embodiment, the preset peak data model compares the heat index of each second preset period with the event occurrence data of the adjacent period, specifically, by setting the peak threshold, the event occurrence data of the second preset period is higher than the value of the left neighbor by 20% or the difference between the event occurrence data of the second preset period and the left neighbor by 90% of the maximum value of the difference between the first 5 neighbors, where the left neighbor and the right neighbor are the event occurrence data of the second preset period with the same statistical unit as the second preset period in the first preset period.
In an embodiment of the present example, the method further comprises: calculating a heat index of the main body related event in a second preset period according to a preset heat algorithm; taking a preset number of main related events with highest heat index in the peak period as heat events; and determining the heat event as the abnormal event.
In the embodiment of the present example, after the peak period is determined, a heat event is generated from a plurality of subject related events of the peak period as an abnormal event of the peak period. The heat index of the main body related event in the second preset period can be calculated according to a preset heat algorithm, so that the abnormal event of the peak period is generated.
In the embodiment of the present example, taking the above-mentioned all main related events of the sky eye examination enterprise in 2 months of a certain year as an example, if it is determined that 28 days of 2 months are peak periods and all 20 main related events are shared in 28 days of 2 months, the heat index of the 20 main related events is calculated and calculated respectively by a preset heat algorithm, and the two main related events with the highest heat index are selected as abnormal events in 28 days of 2 months according to the descending order of the heat index.
In an embodiment of the present example, the event information includes an event source, and the calculating the heat index of the subject related event in the second preset period according to the preset heat algorithm includes: respectively taking each main body related event in a second preset period as a reference event; calculating the similarity between the reference event and other events, wherein the event with the similarity larger than a preset similarity threshold value is used as a similar event of the reference event; judging whether the number of similar events of the reference event is smaller than a preset similar threshold value or not; if the number of similar events of the reference event is smaller than a preset similar threshold value, acquiring a weight value corresponding to an event source in the reference event, and taking the weight value corresponding to the event source as a heat index of the reference event.
In this example embodiment, the heat index may have various calculation manners, taking the above-mentioned all main related events of the sky-eye-checking enterprise in 2 months of a certain year as an example, if it is determined that 2 months and 28 days are peak periods and that 2 months and 28 days share all 20 main related events, the heat index may be further determined by calculating the similarity of the 20 main related events, specifically, when the similarity threshold is preset to determine similar events, if the similarity events in the 20 main related events are fewer than the preset threshold, the heat index is further calculated by the weight value corresponding to the event source of the main related event, if the event source of a certain similar event is a daily report of people, the corresponding weight value is 10, the heat index of the event is also 10, and the source of another event is a certain head, the corresponding weight value is 1, and the heat index of the event is also 1.
In an embodiment of the present example, after determining whether the number of similar events of the reference event is less than the preset similarity threshold, the method further includes: if the number of the similar events of the reference event is larger than or equal to a preset similar threshold value, acquiring a weight value corresponding to the reference event and the event sources of the similar events; and taking the weight value and the value corresponding to the event sources of the reference event and the similar events as the heat index of the reference event.
In the embodiment of the present example, when the same event is a similar event and there are a plurality of event sources, the weight values of the plurality of event sources may be summed up as the heat index of the event in the heat index calculation. In the above example, if a subject related event in day eye examination 2 months 28 days has multiple event sources, one is people daily report, one is the Zhongguancun financial network, one is a head, and the weight values of the event sources are counted respectively: the daily weight value of people is 10, the weight value of the financial network of Zhongguancun is 8, the weight value of a certain header is 1, the weight value sum of the event sources is calculated to be 19, and the heat index of the event is obtained to be 19.
In an embodiment of the present example, the event information includes an event title, and calculating a similarity of the reference event to other events includes: calculating the intersection length of the event title of the reference event and other events; and calculating the similarity of the reference event and the event titles of other events according to the intersection length of the reference event and the event titles.
In this exemplary embodiment, the similarity determining method of the subject related event may be event header determination based on event information, a certain subject related event may be recorded as a reference event, intersection lengths of other events and headers of the reference event are calculated respectively, and the similarity between the reference event and other events is determined according to a preset intersection length determining threshold. Specifically, if the header overlap ratio is higher than a certain threshold, the header overlap ratio is calculated by determining the similarity by using the intersection length of the header a and the header B/the smaller value of the header a length and the header B length.
In an embodiment of the present example, the event information includes event content, and calculating a similarity of the reference event to other events includes: acquiring paragraphs containing preset main body information in the event content; calculating hash values of paragraphs containing preset main body information in event contents of the reference event and other events, and comparing the hash values; and calculating the similarity according to the hash value comparison result.
In this exemplary embodiment, the similarity determining method of the subject related event may be a hash value comparison determination of a paragraph of the preset subject information, a certain subject related event may be recorded as a reference event, hash values of other events and paragraphs of the reference event are calculated respectively, and the similarity between the reference event and other events is determined according to a preset hash value determination threshold. Specifically, a minimum hash value is calculated for a paragraph referring to the enterprise through a hash algorithm, and similarity is obtained and judged by comparing the hash values.
In an embodiment of the present example, the event information includes event content, and calculating a similarity of the reference event to other events includes: extracting semantic vectors of key sentences in event contents of the reference event and other events; and calculating the similarity according to the semantic vector of the key sentence in the event content of the reference event and other events. In this example embodiment, the similarity determining method of the subject related event may be a semantic vector comparison determination of a key sentence of the preset subject information, a certain subject related event may be recorded as a reference event, semantic vectors of other events and the key sentence of the reference event are calculated and compared respectively, and the similarity of the reference event and the other events is determined according to a preset semantic vector comparison threshold. Specifically, semantic vectors are obtained through word2vec, ELMO, BERT and the like, and similarity is calculated and judged.
In an embodiment of the present example, the method further comprises: acquiring event content of the hotness event, and generating event abstract information according to the event content; and responding to an event display instruction triggered by a user, and displaying the event summary information in a display diagram.
In the embodiment of the present example, in order to improve user experience, provide a user with intuitive and convenient browsing based on the hot event, a summary of the hot event may be extracted and generated based on a preset method, and an operable instruction is provided on the event display interface, and a display effect corresponding to the operable instruction is correspondingly generated, so that the event summary of the hot event is displayed on the interface.
In an embodiment of the present example, the event information includes an event source, the method further comprising: acquiring a preset number of heat events with highest heat index in the peak period; checking the weight value of the event source of the heat event; if the weight values of the event sources are smaller than the preset weight threshold value, the current peak value period is modified into a non-peak value period.
In this example embodiment, in the application of the subject related event, there are often redundant events including a large amount of useless information, such as advertisement, induced sharing information, etc., and the popularity value is often easily determined as a popularity event due to high similarity, so in the second preset period, it is necessary to review the weight value of the event source of the popularity event, and if the weight values of the event source are all smaller than the preset weight threshold, the current peak period is modified to be a non-peak period.
In an embodiment of the present example, the method further comprises: and if the number of similar events of the main body related events in the peak period is lower than a preset similarity threshold, modifying the current peak period into a non-peak period.
In the embodiment of the present example, in the second preset period, whether the similarity of the events, the number of the events, or the source weight value of the events are used as the judgment criteria of the abnormal events, the second preset period may also appear, which is judged as an abnormal day, but there is no possibility of similar events, so that it is also necessary to re-compound the events of all the abnormal days, and according to the compound result, if there is no similar event in the abnormal day, the abnormal day is changed to a non-peak period.
In an embodiment of the present example, the method further comprises: if the number of similar events of the main body related events in the off-peak period is lower than a preset similarity threshold, acquiring an event title of the main body related events in the off-peak period; matching the event title in a first preset abnormal information database; taking the main body related event hit in the preset first abnormal information database as a hit event, and judging whether the event content in the adjacent period of the hit event and the current non-peak period is repeated or not; and if not, modifying the current non-peak period into a peak period.
In the embodiment of the present example, in addition to the necessary coincidence of event information for all the abnormal days, it is also possible to make a re-determination of the abnormal events for all the non-abnormal days, and to re-delimit the peak period. Specifically, in the first preset period, if the number of similar articles is lower than a preset threshold value and not on an abnormal day, keyword rule matching is performed on the title of each article on the current day, if the article is hit and the articles on the previous and next two days are not repeated, the day is considered to be the abnormal day, and the current non-peak period is modified to be the peak period.
In the embodiment of the present example, if the current off-peak period is modified to be the peak period, the heat event of the day is counted and displayed as an abnormal event.
In an embodiment of the present example, the method further comprises: acquiring a preset number of heat events with highest heat index in the peak period; matching the event information of the heat event in a second preset abnormal information database; if the heat event hits the second preset abnormal information database, the current peak value period is modified to be a non-peak value period.
In the embodiment of the present example, for the heat event in the second preset abnormal period, the header of the heat event is checked, and if the header includes the content in the preset abnormal information database, the current peak period is modified to be a non-peak period. In particular, the anomaly information may be marked as "negative" keyword information that includes, but is not limited to, words that do not positively contribute to the hotspot event, such as lottery news, etc.
In the embodiment of the present example, if the current peak period is modified to the off-peak period, the abnormal event of the day is not revealed.
In an embodiment of the present example, the event information of the subject related event further includes an event title, the method further comprising: setting a corresponding abnormal event mark for the peak period; generating a display diagram according to the peak period and the abnormal event mark, and displaying; and responding to an event presentation instruction triggered by a user, and presenting an event title of the abnormal event in a presentation diagram.
In this exemplary embodiment, as shown in fig. 2, a display effect diagram of the abnormal event detection method is shown, and in a user display interface, the hot event statistics of each second preset period in the first preset period is displayed, and the peak period marks, such as the heartbeat marks in the diagram, are displayed, so that the user can intuitively see all the peak periods of the first preset period and the abnormal events of each peak period. When the user needs to check the abnormal event corresponding to the peak period, the corresponding peak period or heartbeat mark can be triggered, an event display instruction is generated, and the event title or the event abstract of the abnormal news corresponding to the peak period is displayed in response to the event display instruction corresponding to the peak period or heartbeat mark triggered by the user. The event title or the event abstract can be displayed in the form of a URL, and when the user needs to know about the abnormal event, the user can click on the URL link to enter the corresponding detail page.
It should be noted that although the steps of the methods of the present disclosure are illustrated in the accompanying drawings in a particular order, this does not require or imply that the steps must be performed in that particular order or that all of the illustrated steps be performed in order to achieve desirable results. Additionally or alternatively, certain steps may be omitted, multiple steps combined into one step to perform, and/or one step decomposed into multiple steps to perform, etc.
Further, in the present exemplary embodiment, an abnormal event detection apparatus is also provided. Referring to fig. 3, the abnormal event detecting apparatus 300 may include: an event information acquisition module 310, an event occurrence data calculation module 320, and an abnormal event judgment module 330. Wherein:
an event information obtaining module 310, configured to obtain event information of a subject related event in a first preset period;
the event occurrence data calculation module 320 is configured to obtain main body related events of a second preset period from the first preset period, and calculate event occurrence data of the second preset period according to the number of main body related events of the second preset period;
the abnormal event judging module 330 is configured to input the event occurrence data into a preset peak data model, calculate and judge whether the second preset period is a peak period, and if so, determine that an abnormal event exists in the peak period.
The specific details of each abnormal event detection device module are described in detail in the corresponding abnormal event detection method, so that they will not be described in detail here.
It should be noted that although several modules or units of the abnormal event detection apparatus 300 are mentioned in the above detailed description, such division is not mandatory. Indeed, the features and functionality of two or more modules or units described above may be embodied in one module or unit in accordance with embodiments of the present disclosure. Conversely, the features and functions of one module or unit described above may be further divided into a plurality of modules or units to be embodied.
In addition, in an exemplary embodiment of the present disclosure, an electronic device capable of implementing the above method is also provided.
Those skilled in the art will appreciate that the various aspects of the invention may be implemented as a system, method, or program product. Accordingly, aspects of the invention may be embodied in the following forms, namely: an entirely hardware embodiment, an entirely software embodiment (including firmware, micro-code, etc.) or an embodiment combining hardware and software aspects may be referred to herein as a "circuit," module "or" system.
An electronic device 400 according to such an embodiment of the invention is described below with reference to fig. 4. The electronic device 400 shown in fig. 4 is merely an example and should not be construed as limiting the functionality and scope of use of embodiments of the present invention.
As shown in fig. 4, the electronic device 400 is embodied in the form of a general purpose computing device. The components of electronic device 400 may include, but are not limited to: the at least one processing unit 410, the at least one memory unit 420, a bus 430 connecting the different system components (including the memory unit 420 and the processing unit 410), and a display unit 440.
Wherein the storage unit stores program code that is executable by the processing unit 410 such that the processing unit 410 performs steps according to various exemplary embodiments of the present invention described in the above-described "exemplary methods" section of the present specification. For example, the processing unit 410 may perform steps S110 to S130 as shown in fig. 1.
The storage unit 420 may include readable media in the form of volatile storage units, such as Random Access Memory (RAM) 4201 and/or cache memory 4202, and may further include Read Only Memory (ROM) 4203.
The storage unit 420 may also include a program/utility 4204 having a set (at least one) of program modules 4205, such program modules 4205 including, but not limited to: an operating system, one or more application programs, other program modules, and program data, each or some combination of which may include an implementation of a network environment.
Bus 430 may be a local bus representing one or more of several types of bus structures including a memory unit bus or memory unit controller, a peripheral bus, an accelerated graphics port, a processing unit, or using any of a variety of bus architectures.
The electronic device 400 may also communicate with one or more external devices 470 (e.g., keyboard, pointing device, bluetooth device, etc.), one or more devices that enable a user to interact with the electronic device 400, and/or any device (e.g., router, modem, etc.) that enables the electronic device 400 to communicate with one or more other computing devices. Such communication may occur through an input/output (I/O) interface 450. Also, electronic device 400 may communicate with one or more networks such as a Local Area Network (LAN), a Wide Area Network (WAN), and/or a public network, such as the Internet, through network adapter 460. As shown, the network adapter 460 communicates with other modules of the electronic device 400 over the bus 430. It should be appreciated that although not shown, other hardware and/or software modules may be used in connection with electronic device 400, including, but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, data backup storage systems, and the like.
From the above description of embodiments, those skilled in the art will readily appreciate that the example embodiments described herein may be implemented in software, or in combination with the necessary hardware. Thus, the technical solution according to the embodiments of the present disclosure may be embodied in the form of a software product, which may be stored in a non-volatile storage medium (may be a CD-ROM, a U-disk, a mobile hard disk, etc.) or on a network, and includes several instructions to cause a computing device (may be a personal computer, a server, a terminal device, or a network device, etc.) to perform the method according to the embodiments of the present disclosure.
In an exemplary embodiment of the present disclosure, a computer-readable storage medium having stored thereon a program product capable of implementing the method described above in the present specification is also provided. In some possible embodiments, the various aspects of the invention may also be implemented in the form of a program product comprising program code for causing a terminal device to carry out the steps according to the various exemplary embodiments of the invention as described in the "exemplary methods" section of this specification, when said program product is run on the terminal device.
Referring to fig. 5, a program product 500 for implementing the above-described method according to an embodiment of the present invention is described, which may employ a portable compact disc read only memory (CD-ROM) and include program code, and may be run on a terminal device, such as a personal computer. However, the program product of the present invention is not limited thereto, and in this document, a readable storage medium may be any tangible medium that can contain, or store a program for use by or in connection with an instruction execution system, apparatus, or device.
The program product may employ any combination of one or more readable media. The readable medium may be a readable signal medium or a readable storage medium. The readable storage medium can be, for example, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or a combination of any of the foregoing. More specific examples (a non-exhaustive list) of the readable storage medium would include the following: an electrical connection having one or more wires, a portable disk, a hard disk, random Access Memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.
The computer readable signal medium may include a data signal propagated in baseband or as part of a carrier wave with readable program code embodied therein. Such a propagated data signal may take any of a variety of forms, including, but not limited to, electro-magnetic, optical, or any suitable combination of the foregoing. A readable signal medium may also be any readable medium that is not a readable storage medium and that can communicate, propagate, or transport a program for use by or in connection with an instruction execution system, apparatus, or device.
Program code embodied on a readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wireline, optical fiber cable, RF, etc., or any suitable combination of the foregoing.
Program code for carrying out operations of the present invention may be written in any combination of one or more programming languages, including an object oriented programming language such as Java, C++ or the like and conventional procedural programming languages, such as the "C" programming language or similar programming languages, and interpreted programming languages, such as python or the like. The program code may execute entirely on the user's computing device, partly on the user's device, as a stand-alone software package, partly on the user's computing device, partly on a remote computing device, or entirely on the remote computing device or server. In the case of remote computing devices, the remote computing device may be connected to the user computing device through any kind of network, including a Local Area Network (LAN) or a Wide Area Network (WAN), or may be connected to an external computing device (e.g., connected via the Internet using an Internet service provider).
Furthermore, the above-described drawings are only schematic illustrations of processes included in the method according to the exemplary embodiment of the present invention, and are not intended to be limiting. It will be readily appreciated that the processes shown in the above figures do not indicate or limit the temporal order of these processes. In addition, it is also readily understood that these processes may be performed synchronously or asynchronously, for example, among a plurality of modules.
Other embodiments of the disclosure will be apparent to those skilled in the art from consideration of the specification and practice of the disclosure disclosed herein. This application is intended to cover any adaptations, uses, or adaptations of the disclosure following, in general, the principles of the disclosure and including such departures from the present disclosure as come within known or customary practice within the art to which the disclosure pertains. It is intended that the specification and examples be considered as exemplary only, with a true scope and spirit of the disclosure being indicated by the following claims.
It is to be understood that the present disclosure is not limited to the precise arrangements and instrumentalities shown in the drawings, and that various modifications and changes may be effected without departing from the scope thereof. The scope of the present disclosure is limited only by the appended claims.
Claims (18)
1. An abnormal event detection method, the method comprising:
Acquiring event information of a main body related event in a first preset period;
acquiring main body related events of a second preset period from the first preset period, and calculating event occurrence data of the second preset period according to the number of the main body related events of the second preset period;
inputting the event occurrence data into a preset peak data model, calculating and judging whether the second preset period is a peak period, if so, determining that an abnormal event exists in the peak period;
the calculating the event occurrence data of the second preset period according to the main body related event quantity of the second preset period includes:
respectively taking each main body related event in a second preset period as a reference event;
calculating the similarity between the reference event and other events, wherein the event with the similarity larger than a preset similarity threshold value is used as a similar event;
taking the total number of subject related events with similar events as the event occurrence data;
wherein calculating and judging whether the second preset period is a peak period includes:
respectively comparing the event occurrence data of each second preset period with the event occurrence data of the adjacent period;
judging whether the comparison result meets the preset peak period condition or not;
If yes, determining the current second preset period as the peak period.
2. The method of claim 1, wherein calculating event occurrence data for the second preset period based on the number of subject related events for the second preset period, comprises any one of:
calculating the total amount of the main body related events in a second preset period, and taking the total amount of the main body related events as the event occurrence data; or alternatively, the process may be performed,
the event information comprises event sources, the number of event sources of related events of a main body is obtained, and the number of event sources is used as the event occurrence data; or alternatively, the process may be performed,
and calculating the mentioned total quantity of the corresponding subject in other events of the subject related event in a second preset period, and taking the mentioned total quantity of the subject as the event occurrence data.
3. The method of claim 1, wherein the method further comprises:
calculating a heat index of the main body related event in a second preset period according to a preset heat algorithm;
taking a preset number of main body related events with highest heat index in the peak value period as heat events;
and determining the heat event as the abnormal event.
4. The method of claim 3, wherein the event information includes an event source, and wherein the calculating a heat index for the subject-related event within the second predetermined period according to the predetermined heat algorithm includes:
respectively taking each main body related event in a second preset period as a reference event;
calculating the similarity between the reference event and other events, wherein the event with the similarity larger than a preset similarity threshold value is used as a similar event of the reference event;
judging whether the number of similar events of the reference event is smaller than a preset similarity threshold value or not;
if the number of similar events of the reference event is smaller than a preset similar threshold value, acquiring a weight value corresponding to an event source in the reference event, and taking the weight value corresponding to the event source as a heat index of the reference event.
5. The method of claim 4, wherein after determining whether the number of similar events for the reference event is less than a preset similarity threshold, the method further comprises:
if the number of the similar events of the reference event is larger than or equal to a preset similar threshold value, acquiring a weight value corresponding to the reference event and the event sources of the similar events;
And taking the weight value and the value corresponding to the event sources of the reference event and the similar events as the heat index of the reference event.
6. The method of claim 4, wherein the event information includes an event title, and calculating the similarity of the reference event to other events comprises:
calculating the intersection length of the event titles of the reference event and other events;
and calculating the similarity of the reference event and the event titles of other events according to the intersection length of the two events.
7. The method of claim 4, wherein the event information includes event content, and calculating the similarity of the reference event to other events comprises:
acquiring paragraphs containing preset main body information in the event content;
calculating hash values of paragraphs containing preset main body information in event contents of the reference event and other events, and comparing the hash values;
and calculating the similarity according to the hash value comparison result.
8. The method of claim 4, wherein the event information includes event content, and calculating the similarity of the reference event to other events comprises:
extracting semantic vectors of key sentences in event contents of the reference event and other events;
And calculating the similarity according to semantic vectors of key sentences in event contents of the reference event and other events.
9. A method as claimed in claim 3, wherein the method further comprises:
acquiring event content of the hot event, and generating event summary information according to the event content;
and responding to an event display instruction triggered by a user, and displaying the event summary information in a display diagram.
10. The method of claim 3, wherein the event information comprises an event source, the method further comprising:
acquiring a preset number of heat events with highest heat index in the peak period;
checking a weight value of an event source of the heat event;
and if the weight values of the event sources are smaller than the preset weight threshold value, modifying the current peak value period into a non-peak value period.
11. The method of claim 4, wherein the method further comprises:
and if the number of similar events of the main body related events in the peak period is lower than a preset similarity threshold, modifying the current peak period into a non-peak period.
12. The method of claim 4, wherein the method further comprises:
If the number of similar events of the main body related events in the off-peak period is lower than a preset similarity threshold, acquiring an event title of the main body related events in the off-peak period;
matching the event titles in a first preset abnormal information database;
taking the main body related event hit in the first preset abnormal information database as a hit event, and judging whether the event content in the adjacent period of the hit event and the current non-peak period is repeated or not;
and if not, modifying the current non-peak period into a peak period.
13. The method of claim 4, wherein the method further comprises:
acquiring a preset number of heat events with highest heat index in the peak period;
matching the event information of the heat event in a second preset abnormal information database;
and if the heat event hits the second preset abnormal information database, the current peak value period is modified to be a non-peak value period.
14. The method of claim 1, wherein obtaining event information for the subject related event within the first predetermined period comprises:
according to the preset main body information, carrying out key information matching on event information of all events in a first preset period in a main body information database;
And taking the event successfully matched as an event related to the main body, and acquiring information of the event successfully matched.
15. The method of claim 1, wherein the event information of the subject-related event further comprises an event title, the method further comprising:
setting the peak period to be a corresponding abnormal event mark;
generating a display diagram according to the peak period and the abnormal event mark, and displaying;
and responding to an event presentation instruction triggered by a user, and presenting an event title of the abnormal event in a presentation diagram.
16. An abnormal event detection apparatus, the apparatus comprising:
the event information acquisition module is used for acquiring event information of related events of the main body in a first preset period;
the event occurrence data calculation module is used for acquiring main body related events of a second preset period from the first preset period and calculating event occurrence data of the second preset period according to the number of the main body related events of the second preset period;
the abnormal event judging module is used for inputting the event occurrence data into a preset peak data model, calculating and judging whether the second preset period is a peak period, and if so, determining that an abnormal event exists in the peak period;
The calculating the event occurrence data of the second preset period according to the main body related event quantity of the second preset period includes:
respectively taking each main body related event in a second preset period as a reference event;
calculating the similarity between the reference event and other events, wherein the event with the similarity larger than a preset similarity threshold value is used as a similar event;
taking the total number of subject related events with similar events as the event occurrence data;
wherein calculating and judging whether the second preset period is a peak period includes:
respectively comparing the event occurrence data of each second preset period with the event occurrence data of the adjacent period;
judging whether the comparison result meets the preset peak period condition or not;
if yes, determining the current second preset period as the peak period.
17. A computer device comprising a processor and a memory;
wherein the processor runs a program corresponding to executable program code stored in the memory by reading the executable program code for implementing the method according to any of claims 1-15.
18. A computer readable storage medium, on which a computer program is stored, characterized in that the computer program, when being executed by a processor, implements the method according to any of claims 1-15.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202010238270.1A CN111563527B (en) | 2020-03-30 | 2020-03-30 | Abnormal event detection method and device |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202010238270.1A CN111563527B (en) | 2020-03-30 | 2020-03-30 | Abnormal event detection method and device |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN111563527A CN111563527A (en) | 2020-08-21 |
| CN111563527B true CN111563527B (en) | 2024-02-09 |
Family
ID=72073061
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202010238270.1A Active CN111563527B (en) | 2020-03-30 | 2020-03-30 | Abnormal event detection method and device |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN111563527B (en) |
Families Citing this family (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN112800068B (en) * | 2021-02-22 | 2023-05-12 | 首钢京唐钢铁联合有限责任公司 | Method and device for automatically processing energy metering data |
| CN113591467B (en) * | 2021-08-06 | 2023-11-03 | 北京金堤征信服务有限公司 | Event main body recognition method and device, electronic equipment and medium |
Citations (7)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| JP2010267207A (en) * | 2009-05-18 | 2010-11-25 | Nippon Telegr & Teleph Corp <Ntt> | Unusualness evaluation device, unusualness evaluation method, and computer program |
| CN106815255A (en) * | 2015-11-27 | 2017-06-09 | 阿里巴巴集团控股有限公司 | The method and device of detection data access exception |
| WO2017161830A1 (en) * | 2016-03-25 | 2017-09-28 | 乐视控股（北京）有限公司 | Calendar event display method, device, and electronic device |
| CN107426022A (en) * | 2017-07-21 | 2017-12-01 | 上海携程商务有限公司 | Security incident monitoring method and device, electronic equipment, storage medium |
| CN108446546A (en) * | 2018-03-20 | 2018-08-24 | 深信服科技股份有限公司 | Abnormal access detection method, device, equipment and computer readable storage medium |
| CN108959034A (en) * | 2018-07-05 | 2018-12-07 | 北京木瓜移动科技股份有限公司 | A kind of monitoring alarm method, device, electronic equipment and storage medium |
| CN109522190A (en) * | 2018-10-12 | 2019-03-26 | 中国平安人寿保险股份有限公司 | Abnormal user Activity recognition method and device, electronic equipment, storage medium |
Family Cites Families (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN110633330B (en) * | 2018-06-01 | 2022-02-22 | 北京百度网讯科技有限公司 | Event discovery method, device, equipment and storage medium |
-
2020
- 2020-03-30 CN CN202010238270.1A patent/CN111563527B/en active Active
Patent Citations (7)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| JP2010267207A (en) * | 2009-05-18 | 2010-11-25 | Nippon Telegr & Teleph Corp <Ntt> | Unusualness evaluation device, unusualness evaluation method, and computer program |
| CN106815255A (en) * | 2015-11-27 | 2017-06-09 | 阿里巴巴集团控股有限公司 | The method and device of detection data access exception |
| WO2017161830A1 (en) * | 2016-03-25 | 2017-09-28 | 乐视控股（北京）有限公司 | Calendar event display method, device, and electronic device |
| CN107426022A (en) * | 2017-07-21 | 2017-12-01 | 上海携程商务有限公司 | Security incident monitoring method and device, electronic equipment, storage medium |
| CN108446546A (en) * | 2018-03-20 | 2018-08-24 | 深信服科技股份有限公司 | Abnormal access detection method, device, equipment and computer readable storage medium |
| CN108959034A (en) * | 2018-07-05 | 2018-12-07 | 北京木瓜移动科技股份有限公司 | A kind of monitoring alarm method, device, electronic equipment and storage medium |
| CN109522190A (en) * | 2018-10-12 | 2019-03-26 | 中国平安人寿保险股份有限公司 | Abnormal user Activity recognition method and device, electronic equipment, storage medium |
Non-Patent Citations (2)
| Title |
|---|
| 李凌云 ; 敖吉 ; 乔治 ; 李剑 ; .基于微博的安全事件实时监测框架研究.信息网络安全.2015,(01),全文. * |
| 滕靖 ; 刘韶杰 ; 龚越 ; 王文 ; .交通事件网络舆情分析方法.交通信息与安全.2019,(06),全文. * |
Also Published As
| Publication number | Publication date |
|---|---|
| CN111563527A (en) | 2020-08-21 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| Gao et al. | Online app review analysis for identifying emerging issues | |
| Ding et al. | Entity discovery and assignment for opinion mining applications | |
| EP3537325B1 (en) | Interactive user interfaces | |
| US10885131B2 (en) | System and method for temporal identification of latent user communities using electronic content | |
| US9158773B2 (en) | Partial and parallel pipeline processing in a deep question answering system | |
| US10129274B2 (en) | Identifying significant anomalous segments of a metrics dataset | |
| US20140172139A1 (en) | Question classification and feature mapping in a deep question answering system | |
| US9367633B2 (en) | Method or system for ranking related news predictions | |
| Nguyen et al. | Real-time event detection using recurrent neural network in social sensors | |
| CN107908616B (en) | Method and device for predicting trend words | |
| US11921732B2 (en) | Artificial intelligence and/or machine learning systems and methods for evaluating audiences in an embedding space based on keywords | |
| CN111563527B (en) | Abnormal event detection method and device | |
| US9558462B2 (en) | Identifying and amalgamating conditional actions in business processes | |
| CN115329381A (en) | Sensitive data-based analysis and early warning method and device, computer equipment and medium | |
| US20140108439A1 (en) | Interest Expansion Using A Taxonomy | |
| CN113297287B (en) | Automatic user policy deployment method and device and electronic equipment | |
| US9183600B2 (en) | Technology prediction | |
| US10250705B2 (en) | Interaction trajectory retrieval | |
| EP4116889A2 (en) | Method and apparatus of processing event data, electronic device, and medium | |
| US10733221B2 (en) | Scalable mining of trending insights from text | |
| CN111222918B (en) | Keyword mining method and device, electronic equipment and storage medium | |
| CN113779198A (en) | Electronic business card generating method, device, equipment and medium based on artificial intelligence | |
| CN113032515A (en) | Method, system, device and storage medium for generating chart based on multiple data sources | |
| CN111125548A (en) | Public opinion supervision method and device, electronic equipment and storage medium | |
| WO2020005654A1 (en) | Automatically providing information in an application |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |