CN111786934A - Method and device for detecting normal user of client - Google Patents
Method and device for detecting normal user of client Download PDFInfo
- Publication number
- CN111786934A CN111786934A CN201910791159.2A CN201910791159A CN111786934A CN 111786934 A CN111786934 A CN 111786934A CN 201910791159 A CN201910791159 A CN 201910791159A CN 111786934 A CN111786934 A CN 111786934A
- Authority
- CN
- China
- Prior art keywords
- operation instruction
- client
- page
- user behavior
- event
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
- H04L63/1416—Event detection, e.g. attack signature detection
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/30—Monitoring
- G06F11/34—Recording or statistical evaluation of computer activity, e.g. of down time, of input/output operation ; Recording or statistical evaluation of user activity, e.g. usability assessment
- G06F11/3438—Recording or statistical evaluation of computer activity, e.g. of down time, of input/output operation ; Recording or statistical evaluation of user activity, e.g. usability assessment monitoring of user actions
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1441—Countermeasures against malicious traffic
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1441—Countermeasures against malicious traffic
- H04L63/1466—Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks
Landscapes
- Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- General Engineering & Computer Science (AREA)
- Computer Hardware Design (AREA)
- Signal Processing (AREA)
- Computer Networks & Wireless Communication (AREA)
- Computing Systems (AREA)
- Theoretical Computer Science (AREA)
- Quality & Reliability (AREA)
- Physics & Mathematics (AREA)
- General Physics & Mathematics (AREA)
- Information Transfer Between Computers (AREA)
- User Interface Of Digital Computer (AREA)
Abstract
The embodiment of the disclosure discloses a method and a device for detecting normal users of a client, wherein a specific embodiment of the method comprises the following steps: responding to the operation instruction received by the client, and judging whether a user behavior triggering the operation instruction exists or not; and in response to the fact that the user behavior triggering the operation instruction exists, determining whether an object implementing the user behavior is a normal user or not according to interface data generated by the client executing the operation instruction and access frequency statistical data of an access client in a preset time period, wherein the preset time period comprises the moment of executing the operation instruction. The embodiment of the disclosure can be applied to the field of computers, and the abnormal user can be identified at the client by combining a plurality of dimensions of the interface execution sequence, the IP request frequency and the specific interface request frequency through the user behavior, so that the abnormal user request can be intercepted, and the pressure of the server is reduced.
Description
Technical Field
The embodiment of the application relates to the technical field of computers, in particular to a method and a device for detecting normal users of a client.
Background
With the development of the internet, various electronic commerce rises rapidly. Most merchants attract and retain users in the form of issuing coupons, gifts, cashbacks, and the like. In this large environment, a miscreant quickly discovered a "business opportunity": they register a large number of new users in a short time by using a machine, earn benefits and earn violence. This seriously impairs the interests of the merchant and the user, and also draws the attention of companies, businesses, merchants, and the like.
The existing method for identifying abnormal users comprises the following steps: the server generates and returns a verification code to allow the user to input or select corresponding content; judging according to an IP address blacklist stored in a server; the server judges whether the user is a normal user according to the interface request frequency and the like; judging by a wind control model at the server according to the existing account information; and judging according to the basic information such as the geographic position, the user identification, the equipment and the like. It is obvious that the current user identification is mainly performed at the server, but actually, the client sends the request to the server, which wastes a certain time, and if the brushing amount is large, the part of machine users already put a certain pressure on the server, which may affect the access of normal users. Moreover, when the machine and the real user operate, the behaviors are different, such as whether scrolling exists or not, the interface calling sequence and the like, and the client can identify the abnormal user according to the operation behaviors. Therefore, according to the operation behavior of the user at the client, the client performs pre-judgment once, and the identification accuracy and efficiency of the abnormal user are improved. The interface request of the abnormal user is intercepted, and the pressure of the request of the server side is reduced.
Disclosure of Invention
The embodiment of the application provides a method and a device for detecting normal users of a client.
In a first aspect, an embodiment of the present application provides a method for detecting a normal user of a client, including: responding to the operation instruction received by the client, and judging whether a user behavior triggering the operation instruction exists or not; and in response to the fact that the user behavior triggering the operation instruction exists, determining whether an object implementing the user behavior is a normal user or not according to interface data generated by the client executing the operation instruction and access frequency statistical data of an access client in a preset time period, wherein the preset time period comprises the moment of executing the operation instruction.
In some embodiments, in response to determining that there is no user behavior that triggers an operation instruction, an object that triggers the operation instruction is determined to be an abnormal user.
In some embodiments, the determining whether there is a user behavior triggering an operation instruction in response to the client receiving the operation instruction includes: and responding to the operation instruction received by the client, and judging whether the user behavior triggering the operation instruction exists according to the acquired page parameter of the client and the monitored page event of the client.
In some embodiments, the above determining, in response to the client receiving the operation instruction, whether a user behavior triggering the operation instruction exists according to the obtained page parameter of the client and the monitored page event of the client includes: determining the current page position based on the acquired page parameters in response to the client receiving the operation instruction; determining a page event to be detected based on the determined current page position, wherein the page event to be detected is at least one of the monitored page events of the client; and judging whether the user behavior triggering the operation instruction exists according to the operation information of the page event to be detected.
In some embodiments, the determining the page event to be detected based on the determined current page position includes: in response to the fact that the current page position is determined to be the page initial screen, determining that the page event to be detected is a page click event; the above determining whether there is a user behavior triggering an operation instruction according to the operation information of the page event to be detected includes: and judging whether a user behavior triggering an operation instruction exists according to the initial time difference of the page clicking event, wherein the initial time difference is the time difference from the clicking starting time to the clicking ending time of the page clicking event detected by the client.
In some embodiments, the determining the page event to be detected based on the determined current page position includes: in response to the fact that the current page position is determined to be the non-first screen of the page, determining that the page event to be detected comprises a page scrolling event and a page clicking event; the above determining whether there is a user behavior triggering an operation instruction according to the operation information of the page event to be detected includes: and judging whether a user behavior triggering an operation instruction exists according to the initial time difference of the page clicking event, wherein the initial time difference is the time difference from the clicking starting time to the clicking ending time of the page clicking event detected by the client.
In some embodiments, in response to not listening to the page event to be detected, it is determined that there is no user behavior that triggers an operation instruction.
In some embodiments, the determining whether the user behavior triggering the operation instruction exists according to the start time difference of the page click event includes: determining a time difference threshold value based on the terminal type of the client; and determining that the user behavior triggering the operation instruction exists in response to the click operation starting time difference exceeding the determined time difference threshold.
In some embodiments, the interface data generated by the client executing the operation instruction includes: the interface calls the order, the visit frequency statistical data of visiting the customer end in the preset time interval includes: IP request frequency, specific interface calling frequency; the determining, in response to determining that the user behavior triggering the operation instruction exists, whether an object implementing the user behavior is a normal user according to interface data generated by the client executing the operation instruction and access frequency statistical data of the access client within a preset time period includes: and in response to the fact that the user behavior triggering the operation instruction exists, determining whether an object implementing the user behavior is a normal user or not according to an interface calling sequence of the client executing the operation instruction, the IP request frequency of the access client in a preset time period and the specific interface calling frequency.
In some embodiments, the determining, in response to determining that the user behavior triggering the operation instruction exists, whether an object implementing the user behavior is a normal user according to an interface calling sequence in which the client executes the operation instruction, and an IP request frequency for accessing the client and a specific interface calling frequency in a preset time period includes: responding to the user behavior of determining that the trigger operation instruction exists, comparing the IP request frequency with a preset IP request frequency, comparing the specific interface calling frequency with a preset interface calling frequency, and comparing the interface calling sequence with a preset interface calling sequence; and determining that the object is a normal user in response to the fact that the interface calling sequence is matched with a preset interface calling sequence corresponding to the operation instruction, the IP request frequency is less than or equal to a preset IP request frequency threshold value, and the specific interface calling frequency is less than or equal to a preset interface calling frequency.
In a second aspect, an embodiment of the present application provides an apparatus for detecting a normal user of a client, including: the user behavior judging unit is configured to respond to the fact that the client receives the operation instruction and judge whether the user behavior triggering the operation instruction exists or not; and the normal user judging unit is configured to respond to the fact that the user behavior triggering the operation instruction exists, and determine whether an object implementing the user behavior is a normal user according to interface data generated by the client executing the operation instruction and access frequency statistical data of the access client in a preset time period, wherein the preset time period comprises the moment of executing the operation instruction.
In some embodiments, the normal user determination unit is further configured to determine that an object of the trigger operation instruction is an abnormal user in response to determining that there is no user behavior of the trigger operation instruction.
In some embodiments, the user behavior determination unit is configured to, in response to the client receiving the operation instruction, determine whether there is a user behavior triggering the operation instruction according to the obtained page parameter of the client and the monitored page event of the client.
In some embodiments, the user behavior determination unit is configured to determine, in response to the client receiving the operation instruction, a current page position based on the acquired page parameter; determining a page event to be detected based on the determined current page position, wherein the page event to be detected is at least one of the monitored page events of the client; and judging whether the user behavior triggering the operation instruction exists according to the operation information of the page event to be detected.
In some embodiments, the user behavior determination unit is configured to determine that the page event to be detected is a page click event in response to determining that the current page position is a page top screen; and judging whether a user behavior triggering an operation instruction exists according to the initial time difference of the page clicking event, wherein the initial time difference is the time difference from the clicking starting time to the clicking ending time of the page clicking event detected by the client.
In some embodiments, the user behavior determination unit is configured to determine that the page event to be detected includes a page scroll event and a page click event in response to determining that the current page position is a page non-top screen; and judging whether a user behavior triggering an operation instruction exists according to the initial time difference of the page clicking event, wherein the initial time difference is the time difference from the clicking starting time to the clicking ending time of the page clicking event detected by the client.
In some embodiments, the user behavior determination unit is configured to determine that there is no user behavior triggering the operation instruction in response to not monitoring the page event to be detected.
In some embodiments, the user behavior determination unit is configured to determine the time difference threshold based on a terminal type to which the client belongs; and determining that the user behavior triggering the operation instruction exists in response to the click operation starting time difference exceeding the determined time difference threshold.
In some embodiments, the interface data generated by the client executing the operation instruction includes: the interface calls the order, the visit frequency statistical data of visiting the customer end in the preset time interval includes: IP request frequency, specific interface calling frequency; and the normal user judging unit is configured to respond to the user behavior for determining that the triggering operation instruction exists, and determine whether an object implementing the user behavior is a normal user according to the interface calling sequence of the client executing the operation instruction, the IP request frequency of the access client in a preset time period and the specific interface calling frequency.
In some embodiments, the normal user determination unit is configured to, in response to determining that there is a user behavior triggering an operation instruction, compare the IP request frequency with a preset IP request frequency, compare the specific interface call frequency with a preset interface call frequency, and compare the interface call order with a preset interface call order; and determining that the object is a normal user in response to the fact that the interface calling sequence is matched with a preset interface calling sequence corresponding to the operation instruction, the IP request frequency is less than or equal to a preset IP request frequency threshold value, and the specific interface calling frequency is less than or equal to a preset interface calling frequency.
In a third aspect, the present application provides a computer readable medium, on which a computer program is stored, where the program, when executed by a processor, implements the method as described in any implementation manner of the first aspect.
In a fourth aspect, an embodiment of the present application provides an electronic device, including: one or more processors; a storage device having one or more programs stored thereon; when the one or more programs are executed by the one or more processors, the one or more processors are caused to implement the method as described in any implementation of the first aspect.
The method and the device for detecting the normal user of the client respond to the fact that the client receives an operation instruction and judge whether a user behavior triggering the operation instruction exists or not; and in response to the fact that the user behavior triggering the operation instruction exists, determining whether an object implementing the user behavior is a normal user according to interface data generated by the client executing the operation instruction and access frequency statistical data of the access client in a preset time period. The abnormal user is identified at the client through the user behavior by combining a plurality of dimensionalities of the interface execution sequence, the IP request frequency and the specific interface request frequency, the abnormal user request can be intercepted, and the pressure of the server is relieved.
Drawings
Other features, objects and advantages of the present application will become more apparent upon reading of the following detailed description of non-limiting embodiments thereof, made with reference to the accompanying drawings in which:
FIG. 1 is an exemplary system architecture diagram in which one embodiment of the present application may be applied;
FIG. 2 is a flow diagram of one embodiment of a method of detecting normal users of a client according to the present application;
fig. 3 is a schematic diagram of an application scenario of the method for detecting a normal user of a client according to the present embodiment;
FIG. 4 is a flow diagram of yet another embodiment of a method of detecting normal users of a client according to the present application;
FIG. 5 is a block diagram of one embodiment of an apparatus for detecting normal users of a client in accordance with the present application;
FIG. 6 is a block diagram of a computer system suitable for use in implementing embodiments of the present application.
Detailed Description
The present application will be described in further detail with reference to the following drawings and examples. It is to be understood that the specific embodiments described herein are merely illustrative of the relevant invention and not restrictive of the invention. It should be noted that, for convenience of description, only the portions related to the related invention are shown in the drawings.
It should be noted that the embodiments and features of the embodiments in the present application may be combined with each other without conflict. The present application will be described in detail below with reference to the embodiments with reference to the attached drawings.
In a typical configuration of the present application, the client and the server each include one or more processors (CPUs), input/output interfaces, network interfaces, and memory. The memory may include forms of volatile memory in a computer readable medium, Random Access Memory (RAM) and/or non-volatile memory, such as Read Only Memory (ROM) or flash memory (flash RAM). Memory is an example of a computer-readable medium.
Computer-readable media, which include both non-transitory and non-transitory, removable and non-removable media, may implement the information storage by any method or technology. The information may be computer readable instructions, data structures, modules of a program, or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), Static Random Access Memory (SRAM), Dynamic Random Access Memory (DRAM), other types of Random Access Memory (RAM), Read Only Memory (ROM), Electrically Erasable Programmable Read Only Memory (EEPROM), flash memory or other memory technology, compact disc read only memory (CD-ROM), Digital Versatile Discs (DVD) or other optical storage, magnetic cassettes, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other non-transmission medium that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include non-transitory computer readable media (transmyedia), such as modulated data signals and carrier waves.
Fig. 1 illustrates an exemplary architecture 100 of a method or apparatus for detecting normal users of a client to which embodiments of the present disclosure may be applied.
As shown in fig. 1, the system architecture 100 may include terminal devices 101, 102, 103, a network 104, and a server 105. The network 104 serves as a medium for providing communication links between the terminal devices 101, 102, 103 and the server 105. Network 104 may include various connection types, such as wired, wireless communication links, or fiber optic cables, to name a few.
The user may use the terminal devices 101, 102, 103 to interact with the server 105 via the network 104 to receive or send messages or the like. The terminal devices 101, 102, 103 may have installed thereon various shopping client applications, such as a web browser application, a shopping-like application, and the like.
The terminal apparatuses 101, 102, and 103 may be hardware or software. When the terminal devices 101, 102, 103 are hardware, they may be various electronic devices having a display screen and supporting web browsing, including but not limited to smart phones, tablet computers, e-book readers, laptop portable computers, desktop computers, and the like. When the terminal apparatuses 101, 102, 103 are software, they can be installed in the electronic apparatuses listed above. It may be implemented, for example, as multiple software or software modules to provide distributed services, or as a single software or software module. And is not particularly limited herein.
The server 105 may be a server providing various services, such as a background web server providing support for shopping web pages displayed on the terminal devices 101, 102, 103. The background web server may analyze and perform other processing on the received data such as the web page request, and feed back a processing result (e.g., web page data) to the terminal device.
It should be noted that the method for detecting a normal user of a client provided by the embodiment of the present disclosure may be executed by the terminal devices 101, 102, and 103, and may also be executed by the server 105. Accordingly, the means for detecting the normal user of the client may be provided in the terminal apparatuses 101, 102, 103, or may be provided in the server 105. And is not particularly limited herein.
The server may be hardware or software. When the server is hardware, it may be implemented as a distributed server cluster formed by multiple servers, or may be implemented as a single server. When the server is software, it may be implemented as multiple pieces of software or software modules, for example, to provide distributed services, or as a single piece of software or software module. And is not particularly limited herein.
It should be understood that the number of terminal devices and servers in fig. 1 is merely illustrative. There may be any number of terminal devices and servers, as desired for implementation.
With continuing reference to FIG. 2, a flow 200 of one embodiment of a method of detecting normal users of a client according to the present application is shown, comprising the steps of:
step 201: and responding to the operation instruction received by the client, and judging whether the user behavior triggering the operation instruction exists.
In this embodiment, the user behavior is a behavior of a person as an object that directly triggers the operation instruction. With respect to the user behavior, the object directly triggering the operation instruction may be a computer program, a machine, or the like having the capability of triggering the operation instruction. For example, a programmer may write a program so that the program can directly trigger a click event of a client page.
In this embodiment, the operation instruction may be any instruction received by the client, and the object implementing the operation instruction may be any object having the capability of triggering the operation instruction, including but not limited to the operator of the client, the computer program and the machine that can trigger the operation instruction of the client. When the operation instruction is implemented manually, the operation instruction includes, but is not limited to, a selection instruction, a verification code input instruction, a sending instruction and a deleting instruction on a display screen of the client. The client display screen may be a touch screen with a touch function, such as a touch screen of a smart phone or a tablet computer, and the operation instruction may be an instruction obtained by a user performing a corresponding touch operation on the touch screen. The client display screen may also be a display without a touch function, such as a display of a notebook computer or a desktop computer, in which case, the operation instruction may be an instruction obtained by a user through an input device of the client, such as a mouse, a keyboard, and the like. When the operation instruction is triggered corresponding to the computer program, the operation instruction is computer code for triggering the above instructions such as a selection instruction, a verification code input instruction, a sending instruction, a deleting instruction and the like, and the application program in the client performs corresponding operation in response to the operation instruction triggered by the computer program.
In this embodiment, an execution main body (for example, the terminal device shown in fig. 1) in this embodiment may determine whether a user behavior triggering an operation instruction exists according to the obtained page parameter of the client and the monitored page event of the client. The page parameter includes a page height and a UA (User Agent), and according to the UA, it can be determined whether the client is a mobile terminal, and in addition, if the client is a mobile terminal, the type of the mobile terminal can be further determined by using the UA. In some optional embodiments of this embodiment, a UA library of the mobile terminal may be established according to the mobile terminal UA in the market, and an executing entity (for example, the terminal device shown in fig. 1) in this embodiment compares the obtained UA with the UA type in the UA library of the mobile terminal to determine whether the UA is a mobile terminal.
In this embodiment, when the client is a mobile terminal, the monitored page events include, but are not limited to, a touch screen click event and a screen sliding event; when the client is a non-mobile terminal, the page events monitored include, but are not limited to, a mouse click event and a scroll event. The screen sliding event refers to a page sliding event on a touch screen of the terminal equipment, and the screen scrolling event refers to a page scrolling event on a display screen of the terminal equipment through input equipment such as a mouse.
In this embodiment, according to the monitored page event, parameter information related to the page event can be obtained, and the historical information of the page event is counted; and determining whether the user behavior exists in the triggering operation instruction according to the monitored parameter information and the statistical data of the page event. For example, the execution main body (for example, the terminal device shown in fig. 1) in this embodiment monitors a touch screen click event, and counts the history information of the touch screen click event, and determines that there is no user behavior that triggers an operation instruction if the touch screen click frequency within a preset time period exceeds a normal human click frequency. The normal human click frequency is a click frequency peak value when a click is performed manually, that is, a click frequency maximum value when a click operation is performed manually.
In some optional implementations of this embodiment, in response to the client receiving the operation instruction, a specific process of determining whether there is a user behavior triggering the operation instruction according to the obtained page parameter of the client and the monitored page event of the client is as follows:
first, an execution subject (for example, the terminal device shown in fig. 1) of this embodiment determines a current page position based on an acquired page parameter in response to a client receiving an operation instruction; the page position is a trigger position of the operation instruction on a display screen of the client device, the page position can be at the first screen of the page or the non-first screen of the page, and the trigger position can be judged to be at the first screen of the page or the non-first screen of the page according to the page height of a display of the client device. When the distance between the trigger position and the top of the webpage exceeds the height of the webpage of the display of the client equipment, determining that the trigger position is on the non-first screen of the webpage; otherwise, determining that the trigger position is at the first screen of the page. In this embodiment, the first page refers to a page displayed on a screen of the terminal device after the terminal device responds to a touch screen click or a mouse click; the non-first screen of the page refers to a page which is not displayed on the screen of the terminal device after the terminal device responds to a touch screen click or a mouse click.
Then, determining a page event to be detected based on the determined current page position, wherein the page event to be detected is at least one of the monitored page events of the client, including but not limited to: a touch screen click event, a slide screen event, a mouse click event, a scroll event. In this embodiment, in response to not monitoring the page event to be detected, it is determined that there is no user behavior triggering the operation instruction.
And finally, judging whether the user behavior triggering the operation instruction exists according to the operation information of the page event to be detected. In response to the fact that the current page position is determined to be a page first screen, determining that a page event to be detected is a page click event, wherein the page click event comprises but is not limited to a touch screen click event on a touch screen of the mobile terminal and a mouse click event on a non-touch screen; and judging whether a user behavior triggering an operation instruction exists according to the initial time difference of the page clicking event, wherein the initial time difference is the time difference from the clicking starting time to the clicking ending time of the page clicking event detected by the client. And determining that the user behavior triggering the operation instruction exists in response to the click operation starting time difference exceeding the determined time difference threshold. The time difference threshold may be set based on historical statistics for click events, business requirements, and the like. For example, historical statistics showing a normal user click interval of 100ms, the time difference threshold may be set to 100 ms. Of course, the time difference threshold set for different terminal types is different, for example, different time difference thresholds are set for a touch click event of a touch terminal and a mouse click event on a non-touch screen, which is a consideration of the operation habits of real users.
In response to determining that the current page position is a non-top page, an execution main body (for example, the terminal device shown in fig. 1) of this embodiment determines that the page event to be detected includes a page scroll event and a page click event; the page scrolling event includes, but is not limited to, a sliding screen event on a touch screen of the mobile terminal, and a mouse scrolling event on a non-touch screen. And judging whether a user behavior triggering an operation instruction exists according to the initial time difference of the page clicking event, wherein the initial time difference is the time difference from the clicking starting time to the clicking ending time of the page clicking event detected by the client. And determining that the user behavior triggering the operation instruction exists in response to the click operation starting time difference exceeding the determined time difference threshold. As mentioned above, the time difference threshold is described in detail, and is not described herein again.
Step 202: and in response to the fact that the user behavior triggering the operation instruction exists, determining whether an object implementing the user behavior is a normal user or not according to interface data generated by the client executing the operation instruction and access frequency statistical data of an access client in a preset time period, wherein the preset time period comprises the moment of executing the operation instruction.
In this embodiment, the interface data generated by the client executing the operation instruction includes: the interface calls the order, the visit frequency statistical data of visiting the customer end in the preset time interval includes: IP request frequency, specific interface calling frequency; an execution main body (for example, the terminal device shown in fig. 1) of this embodiment compares an IP request frequency with a preset IP request frequency, compares a specific interface calling frequency with a preset interface calling frequency, and compares an interface calling sequence with a preset interface calling sequence; and determining that the object is a normal user in response to the fact that the interface calling sequence is matched with a preset interface calling sequence corresponding to the operation instruction, the IP request frequency is less than or equal to a preset IP request frequency threshold value, and the specific interface calling frequency is less than or equal to a preset interface calling frequency. That is, when at least one of the following occurs, it is determined that the object is an abnormal user: the interface calling sequence is not matched with a preset interface calling sequence corresponding to the operation instruction, the IP request frequency exceeds a preset IP request frequency threshold value, and the specific interface calling frequency exceeds a preset interface calling frequency. The IP request frequency threshold and the preset interface calling frequency may be specifically set according to actual conditions, and are not limited herein.
In this embodiment, the preset interface calling sequence is a correct interface sequence manually set. Taking the mobile phone number registration step as an example for explanation, the correct registration process needs to call the interface for obtaining the picture verification code, the interface for obtaining the short message verification code and the registration interface in sequence. Firstly, two variables a (whether a picture verification code is acquired) and b (whether a short message verification code is acquired) are defined, and initial values are false. And setting the corresponding variable to true when the interface is called, judging whether a is true when the interface for obtaining the short message verification code is called, if so, continuing the following steps in a correct sequence, and if not, determining that the sequence is wrong. Similarly, when the registration interface is called, whether a and b are both true is judged; determining that the variables a and b are true, and then the interface calling sequence is correct; otherwise, the interface calling sequence is wrong, and the object for implementing the user behavior is judged to be an abnormal user.
In this embodiment, the client IP may be acquired through WebRTC. WebRTC (Web Real-time communication) is an API (Application Programming Interface) that supports a Web browser to perform Real-time voice conversation or video conversation. Storing the IP request times and the request time in a local storage of the client, calculating the current IP request frequency before the client initiates a request, comparing the current IP request frequency with a preset IP request frequency threshold value for 10 times/s, if the current IP request frequency exceeds the preset IP request frequency threshold value, the IP request frequency is too high, and judging that the implementation user behavior object is an abnormal user.
In this embodiment, a specific interface and a preset interface calling frequency may be specifically set according to a service scenario, for example, when a mobile phone number is registered, a registered interface is selected as the specific interface, and the preset interface calling frequency is set to 5 times/s; when a user receives the coupons, selecting a coupon receiving interface as a specific interface, and setting the calling frequency of a preset interface as 10 times/s; when a user places an order, the order list interface is selected as a specific interface, and the calling frequency of the preset interface is set to be 15 times/s and the like.
In this embodiment, a client ID (Identity document) with a unique identifier may be configured for each client, and a detection dimension for an abnormal user and a detection parameter corresponding to the detection dimension may be selected and set according to the client ID. The detection parameters include, but are not limited to, the aforementioned preset IP request frequency, the preset interface calling sequence, and the preset start time difference. The client side obtains the detection dimension and the detection parameters according to the ID of the client side, and customizes and detects whether the user is an abnormal user or not according to the detection parameters.
In the embodiment, the client identifies the abnormal user by user behavior detection and combining with multiple dimensions of the interface execution sequence, the IP request frequency and the specific interface request frequency, so that the abnormal user request can be intercepted at the client, and the pressure of the server is reduced.
With continued reference to fig. 3, one application scenario for detecting normal users of a client is schematically illustrated. A user purchases a short-sleeve vest on a shopping platform through an intelligent mobile phone, and can take coupons in the ordering process. The first page 301 of the shopping webpage of the corresponding clothes of the shopping platform comprises: information such as clothing pictures, prices, color sizes, etc., in the non-first screen 302 of the page includes: coupons, shopping reviews, etc. The coupon getting key in the corresponding interface of the shopping platform is on the page of the mobile phone screen, which is not the first screen 302, that is, if a normal user wants to get the coupon, the normal user needs to first perform a screen sliding operation, so that the coupon getting key is displayed on the mobile phone screen. However, the execution subject (e.g., the mobile phone) in this embodiment detects that no screen sliding event occurs, determines that the behavior specified by the implementation domain coupon operation is not the user behavior, and at this time, the mobile phone screen may display a prompt message of "no pickup".
With continuing reference to FIG. 4, a flow 400 of yet another embodiment of a method of detecting normal users of a client according to the present application is shown, comprising the steps of:
step 401: and responding to the operation instruction received by the client, and judging whether the user behavior triggering the operation instruction exists.
In this embodiment, step 401 is performed in a manner similar to step 201, and is not described herein again.
Step 402: in response to the fact that the user behavior triggering the operation instruction exists, determining whether an object implementing the user behavior is a normal user or not according to interface data generated by the client executing the operation instruction and access frequency statistical data of an access client in a preset time period, wherein the preset time period comprises the moment of executing the operation instruction; and in response to determining that the user behavior triggering the operation instruction does not exist, determining that an object triggering the operation instruction is an abnormal user.
In this embodiment, in response to determining that there is no user behavior triggering the operation instruction, it may be directly determined that an object triggering the operation instruction is an abnormal user, and it is no longer necessary to determine the interface execution order, the IP request frequency, the specific interface request frequency, and the like.
As can be seen from fig. 4, compared with the embodiment corresponding to fig. 2, the flow 400 of the method for detecting a normal user of a client in this embodiment specifically illustrates a method for determining a normal user when it is determined that there is no user behavior of a trigger operation instruction, and in response to determining that there is no user behavior of a trigger operation instruction, it is not necessary to perform determination in terms of an interface execution sequence, an IP request frequency, a specific interface request frequency, and the like, and an object of the trigger operation instruction can be directly determined to be an abnormal user.
With continuing reference to fig. 5, as an implementation of the methods shown in the above-mentioned figures, the present disclosure provides an embodiment of an apparatus for detecting a normal user of a client, where the embodiment of the apparatus corresponds to the embodiment of the method shown in fig. 2, and the apparatus may be specifically applied to various electronic devices.
As shown in fig. 5, the detecting device 500 of the present embodiment includes: a user behavior judging unit 501 and a normal user judging unit 502.
The user behavior determination unit 501 is configured to determine whether there is a user behavior triggering an operation instruction in response to the client receiving the operation instruction. Judging whether the user behavior triggering the operation instruction exists or not can be judged according to the acquired page parameters of the client and the monitored page events of the client, and the specific process is as follows:
determining the current page position based on the acquired page parameters in response to the client receiving the operation instruction; determining a page event to be detected based on the determined current page position, wherein the page event to be detected is at least one of the monitored page events of the client; and judging whether the user behavior triggering the operation instruction exists according to the operation information of the page event to be detected. In response to the fact that the current page position is determined to be the page initial screen, determining that the page event to be detected is a page click event; and judging whether a user behavior triggering an operation instruction exists according to the initial time difference of the page clicking event, wherein the initial time difference is the time difference from the clicking starting time to the clicking ending time of the page clicking event detected by the client. In response to the fact that the current page position is determined to be the non-first screen of the page, determining that the page event to be detected comprises a page scrolling event and a page clicking event; and judging whether a user behavior triggering an operation instruction exists according to the initial time difference of the page clicking event, wherein the initial time difference is the time difference from the clicking starting time to the clicking ending time of the page clicking event detected by the client. And determining that no user behavior triggering an operation instruction exists in response to not monitoring the page event to be detected. Determining a time difference threshold value based on the terminal type of the client; and determining that the user behavior triggering the operation instruction exists in response to the click operation starting time difference exceeding the determined time difference threshold.
The normal user determination unit 502 is configured to, in response to determining that there is a user behavior triggering an operation instruction, determine whether an object implementing the user behavior is a normal user according to interface data generated by the client executing the operation instruction and access frequency statistical data of an access client within a preset time period, where the preset time period includes a time when the operation instruction is executed. The interface data generated by the client executing the operation instruction comprises: the interface calls the order, the visit frequency statistical data of visiting the customer end in the preset time interval includes: IP request frequency, specific interface calling frequency; and the normal user judging unit is configured to respond to the user behavior for determining that the triggering operation instruction exists, and determine whether an object implementing the user behavior is a normal user according to the interface calling sequence of the client executing the operation instruction, the IP request frequency of the access client in a preset time period and the specific interface calling frequency. The specific judgment process is as follows: responding to the user behavior of determining that the trigger operation instruction exists, comparing the IP request frequency with a preset IP request frequency, comparing the specific interface calling frequency with a preset interface calling frequency, and comparing the interface calling sequence with a preset interface calling sequence; determining that the object is a normal user in response to determining that the interface calling sequence is matched with a preset interface calling sequence corresponding to the operation instruction, the IP request frequency is less than or equal to a preset IP request frequency threshold value, and the specific interface calling frequency is less than or equal to a preset interface calling frequency
Referring now to FIG. 6, a block diagram of a computer system 600 suitable for use in implementing the devices of the embodiments of the present application (e.g., terminal devices 101, 102, 103 and server 105 of FIG. 1) is shown. The apparatus shown in fig. 6 is only an example, and should not bring any limitation to the function and use range of the embodiments of the present application.
As shown in fig. 6, the computer system 600 includes a processor (e.g., a central processing unit CPU)601 that can perform various appropriate actions and processes according to a program stored in a Read Only Memory (ROM)602 or a program loaded from a storage section 608 into a Random Access Memory (RAM) 603. In the RAM603, various programs and data necessary for the operation of the system 600 are also stored. The processor 601, the ROM602, and the RAM603 are connected to each other via a bus 604. An input/output (I/O) interface 605 is also connected to bus 604.
The following components are connected to the I/O interface 605: an input portion 606 including a keyboard, a mouse, and the like; an output portion 607 including a display such as a Cathode Ray Tube (CRT), a Liquid Crystal Display (LCD), and the like, and a speaker; a storage section 608 including a hard disk and the like; and a communication section 609 including a network interface card such as a LAN card, a modem, or the like. The communication section 609 performs communication processing via a network such as the internet. The driver 610 is also connected to the I/O interface 605 as needed. A removable medium 611 such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, or the like is mounted on the drive 610 as necessary, so that a computer program read out therefrom is mounted in the storage section 608 as necessary.
In particular, according to an embodiment of the present disclosure, the processes described above with reference to the flowcharts may be implemented as computer software programs. For example, embodiments of the present disclosure include a computer program product comprising a computer program embodied on a computer readable medium, the computer program comprising program code for performing the method illustrated in the flow chart. In such an embodiment, the computer program may be downloaded and installed from a network through the communication section 609, and/or installed from the removable medium 611. The computer program, when executed by the processor 601, performs the above-described functions defined in the method of the present application.
It should be noted that the computer readable medium of the present application can be a computer readable signal medium or a computer readable storage medium or any combination of the two. A computer readable storage medium may be, for example, but not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination of the foregoing. More specific examples of the computer readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer diskette, a hard disk, a Random Access Memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing. In the present application, a computer readable storage medium may be any tangible medium that can contain, or store a program for use by or in connection with an instruction execution system, apparatus, or device. In this application, however, a computer readable signal medium may include a propagated data signal with computer readable program code embodied therein, for example, in baseband or as part of a carrier wave. Such a propagated data signal may take many forms, including, but not limited to, electro-magnetic, optical, or any suitable combination thereof. A computer readable signal medium may also be any computer readable medium that is not a computer readable storage medium and that can communicate, propagate, or transport a program for use by or in connection with an instruction execution system, apparatus, or device. Program code embodied on a computer readable medium may be transmitted using any appropriate medium, including but not limited to: wireless, wire, fiber optic cable, RF, etc., or any suitable combination of the foregoing.
Computer program code for carrying out operations for aspects of the present application may be written in any combination of one or more programming languages, including an object oriented programming language such as Java, Smalltalk, C + + or the like and conventional procedural programming languages, such as the "C" programming language or similar programming languages. The program code may execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer or entirely on the remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any type of network, including a Local Area Network (LAN) or a Wide Area Network (WAN), or the connection may be made to an external computer (for example, through the Internet using an Internet service provider).
The flowchart and block diagrams in the figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods and computer program products according to various embodiments of the present application. In this regard, each block in the flowchart or block diagrams may represent a module, segment, or portion of code, which comprises one or more executable instructions for implementing the specified logical function(s). It should also be noted that, in some alternative implementations, the functions noted in the block may occur out of the order noted in the figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently, or the blocks may sometimes be executed in the reverse order, depending upon the functionality involved. It will also be noted that each block of the block diagrams and/or flowchart illustration, and combinations of blocks in the block diagrams and/or flowchart illustration, can be implemented by special purpose hardware-based systems which perform the specified functions or acts, or combinations of special purpose hardware and computer instructions.
The units described in the embodiments of the present application may be implemented by software or hardware. The described units may also be provided in a processor, and may be described as: a processor includes a user behavior determination unit and a normal user determination unit. Here, the names of these units do not constitute a limitation to the unit itself in some cases, and for example, the user behavior determination unit may also be described as "a unit that determines whether there is a user behavior that triggers an operation instruction in response to the client receiving the operation instruction".
As another aspect, the present application also provides a computer-readable medium, which may be contained in the apparatus described in the above embodiments; or may be separate and not incorporated into the device. The computer readable medium carries one or more programs which, when executed by the apparatus, cause the apparatus to: responding to the operation instruction received by the client, and judging whether a user behavior triggering the operation instruction exists or not; and in response to the fact that the user behavior triggering the operation instruction exists, determining whether an object implementing the user behavior is a normal user or not according to interface data generated by the client executing the operation instruction and access frequency statistical data of an access client in a preset time period, wherein the preset time period comprises the moment of executing the operation instruction.
The above description is only a preferred embodiment of the application and is illustrative of the principles of the technology employed. It will be appreciated by those skilled in the art that the scope of the invention herein disclosed is not limited to the particular combination of features described above, but also encompasses other arrangements formed by any combination of the above features or their equivalents without departing from the spirit of the invention. For example, the above features may be replaced with (but not limited to) features having similar functions disclosed in the present application.
Claims (13)
1. A method for detecting normal users of a client comprises the following steps:
responding to an operation instruction received by a client, and judging whether a user behavior triggering the operation instruction exists or not;
and in response to the fact that the user behavior triggering the operation instruction exists, determining whether an object implementing the user behavior is a normal user or not according to interface data generated by the client executing the operation instruction and access frequency statistical data accessing the client within a preset time period, wherein the preset time period comprises the moment of executing the operation instruction.
2. The method of claim 1, wherein the method further comprises:
and in response to determining that there is no user behavior triggering the operation instruction, determining that an object triggering the operation instruction is an abnormal user.
3. The method of claim 1, wherein the determining whether a user behavior triggering an operation instruction exists in response to a client receiving the operation instruction comprises:
and responding to the operation instruction received by the client, and judging whether the user behavior triggering the operation instruction exists according to the acquired page parameter of the client and the monitored page event of the client.
4. The method of claim 3, wherein, in response to a client receiving the operation instruction, determining whether there is a user behavior triggering the operation instruction according to the obtained page parameter of the client and the monitored page event of the client comprises:
responding to the client receiving the operation instruction, and determining the current page position based on the acquired page parameters;
determining a page event to be detected based on the determined current page position, wherein the page event to be detected is at least one of the monitored page events of the client;
and judging whether the user behavior triggering the operation instruction exists according to the operation information of the page event to be detected.
5. The method of claim 4, wherein determining a page event to be detected based on the determined current page position comprises:
in response to the fact that the current page position is determined to be the page initial screen, determining that the page event to be detected is a page click event;
the step of judging whether a user behavior triggering the operation instruction exists according to the operation information of the page event to be detected comprises the following steps:
and judging whether the user behavior triggering the operation instruction exists according to the initial time difference of the page clicking event, wherein the initial time difference is the time difference from the clicking starting time to the clicking ending time of the page clicking event detected by the client.
6. The method of claim 4, wherein determining a page event to be detected based on the determined current page position comprises:
in response to the fact that the current page position is determined to be a non-first page, determining that the page event to be detected comprises a page scrolling event and a page clicking event;
the step of judging whether a user behavior triggering the operation instruction exists according to the operation information of the page event to be detected comprises the following steps:
and judging whether the user behavior triggering the operation instruction exists according to the initial time difference of the page clicking event, wherein the initial time difference is the time difference from the clicking starting time to the clicking ending time of the page clicking event detected by the client.
7. The method of claim 4, wherein,
and determining that no user behavior triggering the operation instruction exists in response to not monitoring the page event to be detected.
8. The method according to claim 5 or 6, wherein the determining whether there is a user behavior triggering the operation instruction according to the starting time difference of the page click event comprises:
determining a time difference threshold value based on the terminal type of the client;
and determining that the user behavior triggering the operation instruction exists in response to the click operation starting time difference exceeding the determined time difference threshold.
9. The method of claim 1, wherein the interface data generated by the client executing the operation instructions comprises: an interface calling sequence, wherein the access frequency statistical data of the access to the client in the preset time period comprises: IP request frequency, specific interface calling frequency;
the responding to the determination that the user behavior triggering the operation instruction exists, and determining whether an object implementing the user behavior is a normal user according to interface data generated by the client executing the operation instruction and access frequency statistical data accessing the client in a preset time period, includes:
and in response to the fact that the user behavior triggering the operation instruction exists, determining whether an object implementing the user behavior is a normal user or not according to an interface calling sequence of the client executing the operation instruction, an IP request frequency for accessing the client in a preset time period and a specific interface calling frequency.
10. The method of claim 9, wherein the determining, in response to determining that there is a user behavior triggering the operation instruction, whether an object implementing the user behavior is a normal user according to an interface calling order in which the client executes the operation instruction and an IP request frequency and a specific interface calling frequency for accessing the client within a preset time period comprises:
responding to the fact that the user behavior triggering the operation instruction exists, comparing the IP request frequency with a preset IP request frequency, comparing the specific interface calling frequency with a preset interface calling frequency, and comparing an interface calling sequence with a preset interface calling sequence;
and determining that the object is a normal user in response to determining that the interface calling sequence is matched with a preset interface calling sequence corresponding to the operation instruction, the IP request frequency is less than or equal to the preset IP request frequency threshold, and the specific interface calling frequency is less than or equal to the preset interface calling frequency.
11. An apparatus for detecting normal users of a client, comprising:
the user behavior judging unit is configured to respond to the fact that the client receives an operation instruction and judge whether user behaviors triggering the operation instruction exist or not;
and the normal user judging unit is configured to, in response to determining that there is a user behavior triggering the operation instruction, determine whether an object implementing the user behavior is a normal user according to interface data generated by the client executing the operation instruction and access frequency statistical data of accessing the client within a preset time period, where the preset time period includes a time when the operation instruction is executed.
12. A computer-readable medium, on which a computer program is stored which, when being executed by a processor, carries out the method according to any one of claims 1-10.
13. An electronic device, comprising:
one or more processors;
a storage device having one or more programs stored thereon;
when executed by the one or more processors, cause the one or more processors to implement the method of any one of claims 1-10.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201910791159.2A CN111786934A (en) | 2019-08-26 | 2019-08-26 | Method and device for detecting normal user of client |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201910791159.2A CN111786934A (en) | 2019-08-26 | 2019-08-26 | Method and device for detecting normal user of client |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN111786934A true CN111786934A (en) | 2020-10-16 |
Family
ID=72754914
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201910791159.2A Pending CN111786934A (en) | 2019-08-26 | 2019-08-26 | Method and device for detecting normal user of client |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN111786934A (en) |
Cited By (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN116049551A (en) * | 2023-01-13 | 2023-05-02 | 北京景安云信科技有限公司 | Webpage operation identification management and control system |
Citations (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN106101191A (en) * | 2016-05-31 | 2016-11-09 | 乐视控股（北京）有限公司 | A kind of Web access method, client and service end |
| CN107026839A (en) * | 2016-11-16 | 2017-08-08 | 阿里巴巴集团控股有限公司 | A kind of query-attack treating method and apparatus |
| CN108600270A (en) * | 2018-05-10 | 2018-09-28 | 北京邮电大学 | A kind of abnormal user detection method and system based on network log |
| CN108665297A (en) * | 2017-03-31 | 2018-10-16 | 北京京东尚科信息技术有限公司 | Detection method, device, electronic equipment and the storage medium of abnormal access behavior |
| CN109670934A (en) * | 2018-09-26 | 2019-04-23 | 深圳壹账通智能科技有限公司 | Personal identification method, equipment, storage medium and device based on user behavior |
| CN109687991A (en) * | 2018-09-07 | 2019-04-26 | 平安科技（深圳）有限公司 | User behavior recognition method, apparatus, equipment and storage medium |
-
2019
- 2019-08-26 CN CN201910791159.2A patent/CN111786934A/en active Pending
Patent Citations (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN106101191A (en) * | 2016-05-31 | 2016-11-09 | 乐视控股（北京）有限公司 | A kind of Web access method, client and service end |
| CN107026839A (en) * | 2016-11-16 | 2017-08-08 | 阿里巴巴集团控股有限公司 | A kind of query-attack treating method and apparatus |
| CN108665297A (en) * | 2017-03-31 | 2018-10-16 | 北京京东尚科信息技术有限公司 | Detection method, device, electronic equipment and the storage medium of abnormal access behavior |
| CN108600270A (en) * | 2018-05-10 | 2018-09-28 | 北京邮电大学 | A kind of abnormal user detection method and system based on network log |
| CN109687991A (en) * | 2018-09-07 | 2019-04-26 | 平安科技（深圳）有限公司 | User behavior recognition method, apparatus, equipment and storage medium |
| CN109670934A (en) * | 2018-09-26 | 2019-04-23 | 深圳壹账通智能科技有限公司 | Personal identification method, equipment, storage medium and device based on user behavior |
Cited By (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN116049551A (en) * | 2023-01-13 | 2023-05-02 | 北京景安云信科技有限公司 | Webpage operation identification management and control system |
| CN116049551B (en) * | 2023-01-13 | 2023-08-25 | 北京景安云信科技有限公司 | Webpage operation identification management and control system |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| US10581770B2 (en) | Method and system for communication in instant messaging application | |
| JP6470735B2 (en) | Estimating the visibility of content items | |
| US8910284B1 (en) | Detecting malware | |
| WO2019037417A1 (en) | Webpage data crawling method and apparatus, webpage data crawling platform, and storage medium | |
| US11416887B1 (en) | Methods and apparatus for mobile device messaging-based communications using custom-generated deeplinks and based on the Hyper Text Transfer Protocol (HTTP) | |
| US20170364904A1 (en) | Payment information processing method, apparatus, and user device | |
| US20150310480A1 (en) | Method, server and system for monitoring and identifying target terminal devices | |
| JP2015528606A (en) | Method and apparatus for responding to web page access request | |
| CN105376719A (en) | Information pushing method and device | |
| CN112817831A (en) | Application performance monitoring method, device, computer system and readable storage medium | |
| CN111966273A (en) | Information display processing method and device | |
| CN115470432A (en) | Page rendering method and device, electronic equipment and computer readable medium | |
| US10599505B1 (en) | Event handling system with escalation suppression | |
| WO2016107277A1 (en) | Telephone-number-based information loading method and device | |
| CN111786934A (en) | Method and device for detecting normal user of client | |
| CN112346608A (en) | Page display method and device based on business activity result display and electronic equipment | |
| US11036638B2 (en) | Prefetching data for application usage | |
| CN110858238B (en) | Data processing method and device | |
| US10044823B2 (en) | Social content aggregation | |
| CN111124627A (en) | Method, device, terminal and storage medium for determining application program caller | |
| CN115187364A (en) | Method and device for monitoring deposit risk under bank distributed scene | |
| US9232388B2 (en) | Initiation of wireless service | |
| CN110995641A (en) | Harassment information identification method, harassment information identification device, electronic equipment and medium | |
| CN111367898A (en) | Data processing method, device, system, electronic equipment and storage medium | |
| CN113449230A (en) | Method and system for determining exposure element, client and server |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| RJ01 | Rejection of invention patent application after publication | ||
| RJ01 | Rejection of invention patent application after publication |
Application publication date: 20201016 |