CN113329037A - Abnormal access data early warning method based on high-dimensional mode and related equipment - Google Patents
Abnormal access data early warning method based on high-dimensional mode and related equipment Download PDFInfo
- Publication number
- CN113329037A CN113329037A CN202110880946.1A CN202110880946A CN113329037A CN 113329037 A CN113329037 A CN 113329037A CN 202110880946 A CN202110880946 A CN 202110880946A CN 113329037 A CN113329037 A CN 113329037A
- Authority
- CN
- China
- Prior art keywords
- flow
- data
- calculating
- target object
- target
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
- H04L63/1425—Traffic logging, e.g. anomaly detection
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F18/00—Pattern recognition
- G06F18/20—Analysing
- G06F18/23—Clustering techniques
Abstract
The embodiment of the application belongs to the field of data processing, is applied to the field of smart cities, and relates to an abnormal visit data early warning method based on a high-dimensional mode, which comprises the steps of collecting flow data of a plurality of target objects according to a time sequence, wherein the flow data comprises daily flow, monthly flow and monthly target flow; calculating a flow index of each target object based on the daily flow, the monthly target flow and the position coordinates of each target object; and obtaining a critical factor, and calculating to obtain the early warning result based on the critical factor, the flow index and the current flow of each target object. The application also provides an abnormal access data early warning device based on the high-dimensional mode, computer equipment and a storage medium. In addition, the application also relates to a block chain technology, and the traffic data is also stored in the block chain. By adopting the method, the early warning accuracy is greatly improved.
Description
Technical Field
The present application relates to the field of data processing, and in particular, to an abnormal access data early warning method and apparatus in a variable weight high-dimensional mode, a computer device, and a storage medium.
Background
Digital data management is an important component of data management at present, and is particularly critical to success or failure of management effect. For almost all management, the effect of the management is continuously observed, and the information of risk early warning or gain prompt can be sent out at the first time, and the digital data management field is increasingly emphasized.
The conventional data analysis and management mode generally acquires historical data of network objects, and then carries out risk control on abnormal data points in a clustering mode, so that more data characteristics of high latitude cannot be considered, and the technical problem that early warning cannot be accurately carried out on abnormal data is caused.
Disclosure of Invention
Based on this, in order to solve the above technical problems, the present application provides an abnormal access data early warning method and apparatus based on a high-dimensional mode, a computer device, and a storage medium, so as to solve the technical problem in the prior art that an early warning cannot be performed on abnormal traffic data.
An abnormal access data early warning method based on a high-dimensional mode comprises the following steps:
collecting flow data of a plurality of target objects in a time sequence, wherein the flow data is one of website visit amount, store people flow amount or product sales amount, and the flow data comprises daily flow amount, monthly flow amount and monthly target flow amount;
calculating a flow index of each target object based on the daily flow, the monthly target flow and the position coordinates of each target object;
and obtaining a critical factor, and calculating to obtain the early warning result based on the critical factor, the flow index and the current flow of each target object.
An abnormal access data early warning device based on a high-dimensional mode, the device comprising:
the data collection module is used for collecting flow data of a plurality of target objects according to a time sequence, wherein the flow data is one of website visit amount, shop people flow amount or product sales amount, and the flow data comprises daily flow amount, monthly flow amount and monthly target flow amount;
the index calculation module is used for calculating and obtaining the flow indexes of all the target objects based on the daily flow, the monthly target flow and the position coordinates of all the target objects;
and the abnormity early warning module is used for acquiring a critical factor and calculating to obtain the early warning result based on the critical factor, the flow index and the current flow of each target object.
A computer device comprising a memory and a processor, and computer readable instructions stored in the memory and executable on the processor, the processor implementing the steps of the above-mentioned high-dimensional pattern-based abnormal access data warning method when executing the computer readable instructions.
A computer readable storage medium, which stores computer readable instructions, and when executed by a processor, implements the steps of the above-mentioned abnormal access data early warning method based on high-dimensional patterns.
The abnormal visit data early warning method, the abnormal visit data early warning device, the computer equipment and the storage medium based on the high-dimensional mode can macroscopically realize the prediction of the flow data of different target objects by mining the multi-dimensional data information, wherein the flow data is the flow data of a website, the pedestrian flow of a treasure house or a network store and the sales volume of products in a physical store, the flow data comprises daily flow, monthly flow and monthly target flow, the flow data is taken as the data characteristic, then the calculation of a flow index based on the high-dimensional mode is carried out by combining the position coordinate of each target object, whether the flow data of the target object meets the requirement is carried out by calculating the critical factor under the current business scene in advance and the current flow of each target object in advance, the abnormal flow data is early warned in advance, and the technical problem that early warning cannot be carried out on the flow data in the prior art is solved.
Drawings
In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings needed to be used in the description of the embodiments of the present invention will be briefly introduced below, and it is obvious that the drawings in the following description are only some embodiments of the present invention, and it is obvious for those skilled in the art that other drawings can be obtained according to these drawings without inventive labor.
FIG. 1 is a schematic diagram of an application environment of an abnormal access data early warning method based on a high-dimensional mode;
FIG. 2 is a schematic flow chart of an abnormal access data early warning method based on a high-dimensional mode;
FIG. 3 is a schematic diagram of an abnormal access data early warning device based on a high-dimensional mode;
FIG. 4 is a diagram of a computer device in one embodiment.
Detailed Description
Unless defined otherwise, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs; the terminology used in the description of the application herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the application; the terms "including" and "having," and any variations thereof, in the description and claims of this application and the description of the above figures are intended to cover non-exclusive inclusions. The terms "first," "second," and the like in the description and claims of this application or in the above-described drawings are used for distinguishing between different objects and not for describing a particular order.
Reference herein to "an embodiment" means that a particular feature, structure, or characteristic described in connection with the embodiment can be included in at least one embodiment of the application. The appearances of the phrase in various places in the specification are not necessarily all referring to the same embodiment, nor are separate or alternative embodiments mutually exclusive of other embodiments. It is explicitly and implicitly understood by one skilled in the art that the embodiments described herein can be combined with other embodiments.
In order to make the objects, technical solutions and advantages of the present application more apparent, the present application is further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative of the present application and are not intended to limit the present application. All other embodiments, which can be derived by a person skilled in the art from the embodiments given herein without making any creative effort, shall fall within the protection scope of the present invention.
The abnormal access data early warning method based on the high-dimensional mode provided by the embodiment of the invention can be applied to the application environment shown in FIG. 1. The application environment may include a terminal 102, a network for providing a communication link medium between the terminal 102 and the server 104, and a server 104, wherein the network may include various connection types, such as wired, wireless communication links, or fiber optic cables, among others.
A user may use the terminal 102 to interact with the server 104 over a network to receive or send messages, etc. The terminal 102 may have installed thereon various communication client applications, such as a web browser application, a shopping application, a search application, an instant messaging tool, a mailbox client, social platform software, and the like.
The terminal 102 may be various electronic devices having a display screen and supporting web browsing, including but not limited to a smart phone, a tablet computer, an e-book reader, an MP3 player (Moving Picture Experts Group Audio Layer III, mpeg compression standard Audio Layer 3), an MP4 player (Moving Picture Experts Group Audio Layer IV, mpeg compression standard Audio Layer 4), a laptop portable computer, a desktop computer, and the like.
The server 104 may be a server that provides various services, such as a background server that provides support for pages displayed on the terminal 102.
It should be noted that the method for early warning abnormal access data based on the high-dimensional mode provided in the embodiment of the present application is generally executed by a server/terminal, and accordingly, the device for early warning abnormal access data based on the high-dimensional mode is generally disposed in the server/terminal.
The application is operational with numerous general purpose or special purpose computing system environments or configurations. For example: personal computers, server computers, hand-held or portable devices, tablet-type devices, multiprocessor systems, microprocessor-based systems, set top boxes, programmable consumer electronics, network PCs, minicomputers, mainframe computers, distributed computing environments that include any of the above systems or devices, and the like. The application may be described in the general context of computer-executable instructions, such as program modules, being executed by a computer. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform particular tasks or implement particular abstract data types. The application may also be practiced in distributed computing environments where tasks are performed by remote processing devices that are linked through a communications network. In a distributed computing environment, program modules may be located in both local and remote computer storage media including memory storage devices.
The method and the system can be applied to the field of smart cities, and are particularly applied to a website access early warning system in a smart enterprise, so that the construction of the smart city is promoted.
It should be understood that the number of terminals, networks and servers in fig. 1 is merely illustrative. There may be any number of terminal devices, networks, and servers, as desired for implementation.
Wherein, the terminal 102 communicates with the server 104 through the network. The server 104 collects flow data of a target object, for example, a product business department, from each terminal 102, calculates a flow index of each target object based on the obtained multiple dimensional characteristics, judges whether the current flow of the target object meets the requirement or not according to the flow index and the critical factor, and generates an early warning. The terminal 102 and the server 104 are connected through a network, the network may be a wired network or a wireless network, the terminal 102 may be, but is not limited to, various personal computers, notebook computers, smart phones, tablet computers, and portable wearable devices, and the server 104 may be implemented by an independent server or a server cluster formed by a plurality of servers.
In an embodiment, as shown in fig. 2, an abnormal access data early warning method based on a high-dimensional mode is provided, which is described by taking the method as an example applied to a server in fig. 1, and includes the following steps:
The technical scheme of the application can be applied to early warning of website access data, different network objects can refer to the same type of websites, for example, different shops selling the same product (network shops or network shops), and the flow data refers to the number of times that a user accesses the shop or the number of product deals.
Specifically, after the flow data of each target object is acquired, the flow data may be preprocessed according to time characteristics, for example, the flow data may be subsequently calculated as high-dimensional characteristics of the abnormality warning according to daily flow, monthly flow, and monthly standard flow, as well as the current flow and the position coordinates of the target object.
And step 204, calculating the flow index of each target object based on the daily flow, the monthly target flow and the position coordinates of each target object.
Daily flow refers to the flow data for the day of the target subject, monthly flow refers to the flow for the month, and monthly target flow refers to the target flow for the month, e.g., the monthly target flow should be 300 times and 290 times in the month.
The position coordinate is a spatial position of the target object, for example, a certain area of a certain province and a certain city of a certain insurance department, namely, the position coordinate of the target object.
The flow index is a data value for measuring whether the flow data of the target object is normal, and in some embodiments, the flow index may be calculated by constructing a depth feature of the target object.
Specifically, calculating an arithmetic average of cumulative achievement proportions of the target objects under the same position coordinates at the same time to obtain a transverse comparison characteristic of each target object, wherein the cumulative achievement proportions are obtained by calculating ratios of daily flow, monthly flow and monthly target flow;
wherein a transverse comparison feature is constructed
The arithmetic mean of the cumulative achievement proportion under the traversal of the breadth is obtained, and in the embodiment, the lateral comparison information is considered:
wherein the content of the first and second substances,
in order to access the unique identification id of the user,
is the cumulative access proportion;
in addition, the arithmetic mean value of the accumulated achievement proportion of the same target object at the same time is calculated to be used as the longitudinal homonymy characteristic of each target object;
the first vertical comparison feature is to accumulate the arithmetic mean of the achievement ratio under the depth traversal, on the same date of the same comparison (for example, all are No. 2 per month), under the same data feature id, and the business meaning here is to consider a plurality of consecutive information of the same comparison:
wherein the content of the first and second substances,
data characteristics of the target object, such as position coordinates, daily flow, etc.
Then, calculating the target objects with the same position coordinate for one month continuously, and accumulating the arithmetic mean of the achievement proportion as the longitudinal ring ratio characteristic of each target object;
in addition, the second vertical comparison feature is an arithmetic mean of cumulative achievement proportions on ring ratio dates (moving average MA of consecutive n days) under the depth traversal, and the same data feature id, here, the business meaning is to consider a plurality of ring ratio information:
and finally, adjusting the weight proportion of the transverse comparison characteristic, the longitudinal same-ratio characteristic and the longitudinal ring ratio characteristic according to a preset weight table, and adding to obtain the flow index of each target object.
And constructing non-uniform weight characteristic weighting indexes, recording the variances of all the individual weighting indexes, and calculating the dispersion factors of all the individual weighting indexes according to the variances of the individual weighting indexes.
In this embodiment, the weight of each individual significance feature can be changed by adjusting the weighting ratio, for example, increasing the weight share between different position coordinates in the transverse comparison:
wherein the weight coefficient
。
According to the method and the device, the index representing the abnormal degree of the target object data is obtained by mining the deep-level data representing whether the target object flow data is abnormal or not from the simple data, and the accuracy of data early warning can be greatly promoted in the subsequent steps.
Alternatively, in addition to obtaining the flow rate index in the above manner, the flow rate data of each target object may be converted into discrete trajectory data by based on the daily flow rate and the monthly flow rate; converting the character type pair discrete track data into numerical data through one-hot characteristic coding; carrying out normalization processing on the numerical data to obtain normalized data with the value between 0 and 1; and calculating oscillation factors of each target object according to the normalized data, and taking the oscillation factors as the flow indexes. Wherein the oscillation factor represents a coefficient of variation of the flow data of the target object over a period of time.
Specifically, the obtaining of the flow index is realized by obtaining a maximum daily flow in a continuous preset time, and calculating an average flow in the continuous preset time; and calculating the flow ratio of the maximum daily flow to the average flow, and taking the flow ratio as the oscillation factor of each target object to obtain the flow index.
For example, if the maximum daily flow rate is 300 and the average flow rate is 216 for three consecutive days, then the flow rate ratio is 216/300, resulting in a concussion factor of 0.72 for three consecutive days. The oscillation factor can represent the change condition of the flow data of the target object within a certain time, the larger the oscillation factor is, the larger the flow change of the target object within the time is, and conversely, the smaller the oscillation factor is, when the oscillation factor, that is, the flow index exceeds a certain value, the more abnormal the flow data of the target object is, and an early warning can be issued under a certain condition. For example, after binding to a subsequent critical factor, an early warning is issued.
Optionally, in order to adapt to more service scenarios, the embodiment may further obtain the flow index by calculating a ratio between a maximum daily flow and a minimum daily flow in a continuous preset time, as an oscillation factor.
The change degree of the data can be reflected very accurately in a certain range through the ratio of the maximum flow to the minimum flow.
Alternatively, before calculating the oscillation factor, the flow data of the target object may be divided averagely, and after calculating the average flows in different time intervals, the ratio between adjacent average flows may be compared, so as to obtain the flow index.
Alternatively, in order to more accurately obtain the degree of change of the flow data, the increment or decrement of the daily flow of each target object relative to the flow of the previous day may be calculated, and the increment and the decrement are added together, and then the average value thereof is calculated to obtain the final oscillation factor.
The oscillation factors obtained in different modes have slight difference, but are within the requirement range of a service scene, so that the final early warning judgment is not influenced.
And after obtaining the oscillation factor, multiplying the oscillation factor by the arithmetic mean of the flow data of the target object in the current month to obtain the flow index.
And step 206, acquiring a critical factor, and calculating to obtain the early warning result based on the critical factor, the flow index and the current flow of each target object.
In the present application, the most important is the calculation of the critical factor, which directly determines the final early warning accuracy. Therefore, for the purpose of early warning, sample data and corresponding position coordinates of a sample object need to be acquired based on the type of a current target object, for example, the target object is a certain type of entity store; and selecting one sample object from the plurality of sample objects to be updated as an original sample object; calculating Euclidean distances between the original sample object and other sample objects, and taking the sample objects with the Euclidean distances smaller than a preset distance value and the number exceeding a preset number as cluster objects of the original sample object; taking the original sample object and the cluster object as a track object cluster, and repeating the operation of updating the original sample object until all sample objects have at least one track object cluster; and calculating the critical factor according to the track object cluster.
Randomly selecting one of the sample objects as an original sample object; calculating Euclidean distances between an original sample object and other sample objects; taking the sample objects which have Euclidean distances smaller than a preset distance value and the number larger than a preset number in a multi-dimensional space from the original sample objects as cluster objects of the original sample objects; the above operations are then repeated until all sample objects have been calculated accordingly.
The critical factor, which is generally the number of samples in the neighborhood, after clustering and generally e, is less than MinPts (minimum number of sample points), but is a boundary value listed in the neighborhood of other core points.
Further, after clustering, sample objects in some clusters are too few, and such clustered clusters should be culled.
After the critical factor is obtained, when the method is used, the type of the target object is judged firstly, then the critical factor of the corresponding type is obtained for subsequent calculation, and specifically, if the current day flow of the target object is not within the range of the sum of the critical factor, the critical factor and the flow index, the early warning result is data anomaly.
In the above abnormal visit data early warning method based on the high-dimensional mode, the flow data of the target objects are collected according to the time sequence, generally, the flow data are the website visit amount of the website, the people flow of the treasure house or the network store and the product sales volume in the entity store, the flow data include daily flow, monthly flow and monthly target flow, these are used as data characteristics, then the calculation of a flow index based on the high-dimensional mode is carried out by combining the position coordinates of each target object, then whether the flow data of the target objects meet the requirements is carried out by the critical factor under the current business scene calculated in advance and the current flow of each target object, the situation of predicting the flow data of different target objects can be macroscopically realized by mining the multi-dimensional data information, and the early warning is carried out on the abnormal flow data in advance, the technical problem that early warning can not be carried out on flow data in the prior art is solved.
It is emphasized that the traffic data may also be stored in a node of a block chain in order to further ensure privacy and security of the traffic data.
It should be understood that, although the steps in the flowchart of fig. 2 are shown in order as indicated by the arrows, the steps are not necessarily performed in order as indicated by the arrows. The steps are not performed in the exact order shown and described, and may be performed in other orders, unless explicitly stated otherwise. Moreover, at least a portion of the steps in fig. 2 may include multiple sub-steps or multiple stages that are not necessarily performed at the same time, but may be performed at different times, and the order of performance of the sub-steps or stages is not necessarily sequential, but may be performed in turn or alternately with other steps or at least a portion of the sub-steps or stages of other steps.
In one embodiment, as shown in fig. 3, an abnormal access data early warning device based on a high-dimensional mode is provided, and the abnormal access data early warning device based on the high-dimensional mode corresponds to the abnormal access data early warning method based on the high-dimensional mode in the above embodiments one to one. The abnormal access data early warning device based on the high-dimensional mode comprises:
a data collection module 302, configured to collect flow data of a plurality of target objects in a time sequence, where the flow data is one of a website visit amount, a store people flow amount, or a product sales amount, and the flow data includes a daily flow amount, a monthly flow amount, and a monthly target flow amount;
an index calculation module 304, configured to calculate a flow index of each target object based on the daily flow, the monthly target flow, and the position coordinates of each target object;
and the anomaly early warning module 306 is configured to obtain a critical factor, and calculate the early warning result based on the critical factor, the flow index, and the current flow of each target object.
Further, before the anomaly early warning module 306, the method further includes:
the positioning module is used for acquiring sample data of the sample object and corresponding position coordinates; and
an updating module for selecting one sample object from the plurality of sample objects to update to an original sample object;
the distance calculation module is used for calculating Euclidean distances between the original sample object and other sample objects, and taking the sample objects with the Euclidean distances smaller than a preset distance value and the number exceeding a preset number as cluster objects of the original sample object;
the training module is used for taking the original sample object and the cluster object as a track object cluster, and repeating the operation of updating the original sample object until all sample objects have at least one track object cluster;
and the critical calculating module is used for calculating the critical factor according to the track object cluster.
Further, the anomaly early warning module 306 includes:
and the early warning sub-module is used for judging that the early warning result is data abnormity if the current day flow of the target object is not in the range of the sum of the critical factor and the flow index.
Further, the index calculation module 304 includes:
the first characteristic submodule is used for calculating the arithmetic mean of the cumulative achievement proportions of the target objects under the same position coordinates at the same time to obtain the transverse comparison characteristic of each target object, wherein the cumulative achievement proportions are obtained by calculating the ratio of daily flow, monthly flow and monthly target flow;
the second characteristic submodule is used for calculating the arithmetic mean value of the accumulated achievement proportion of the same target object at the same time as the longitudinal homonymy characteristic of each target object;
the third characteristic submodule is used for calculating target objects with the same position coordinate for one month continuously, accumulating the arithmetic mean of the achievement proportion and taking the arithmetic mean as the longitudinal ring ratio characteristic of each target object;
and the first index calculation submodule is used for adjusting the weight proportion of the transverse comparison characteristic, the longitudinal same-ratio characteristic and the longitudinal ring-ratio characteristic according to a preset weight table and adding the weight proportions to obtain the flow indexes of the target objects.
Further, the anomaly early warning module 306 further includes:
the data preprocessing submodule is used for converting the flow data of each target object into discrete track data based on daily flow and monthly flow; and are
The data coding submodule is used for converting character type discrete track data into numerical data through one-hot characteristic coding;
the data normalization submodule is used for performing normalization processing on the numerical data to obtain normalized data with the value between 0 and 1;
and the second index calculation submodule is used for calculating the oscillation factor of each target object according to the normalized data and calculating the flow index based on the oscillation factor.
Further, a second index calculation sub-module includes:
the flow acquiring unit is used for acquiring the maximum daily flow in the continuous preset time and calculating the average flow in the continuous preset time;
the index calculation unit is used for calculating the flow ratio of the maximum daily flow to the average flow and taking the flow ratio as the oscillation factor of each target object;
it is emphasized that the traffic data may also be stored in a node of a block chain in order to further ensure privacy and security of the traffic data.
The abnormal visit data early warning device based on the high-dimensional mode collects the flow data of the target objects according to the time sequence, generally, the flow data is the website visit amount of a website, the people flow of a treasure house or a network shop and the product sales volume in a physical store, the flow data comprises daily flow, monthly flow and monthly target flow, the flow data are used as data characteristics, then the calculation of a flow index based on the high-dimensional mode is carried out by combining the position coordinates of each target object, whether the flow data of the target objects meet the requirements is carried out according to the critical factor under the current business scene calculated in advance and the current flow of each target object, the condition of predicting the flow data of different target objects can be macroscopically realized by mining the multi-dimensional data information, and the early warning is carried out on the abnormal flow data in advance, the technical problem that early warning can not be carried out on flow data in the prior art is solved.
In one embodiment, a computer device is provided, which may be a server, the internal structure of which may be as shown in fig. 4. The computer device includes a processor, a memory, a network interface, and a database connected by a system bus. Wherein the processor of the computer device is configured to provide computing and control capabilities. The memory of the computer device comprises a nonvolatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, computer readable instructions, and a database. The internal memory provides an environment for the operating system and execution of computer-readable instructions in the non-volatile storage medium. The database of the computer device is used for storing flow data. The network interface of the computer device is used for communicating with an external terminal through a network connection. The computer readable instructions, when executed by a processor, implement a high-dimensional pattern based abnormal access data early warning method.
As will be understood by those skilled in the art, the computer device is a device capable of automatically performing numerical calculation and/or information processing according to a preset or stored instruction, and the hardware includes, but is not limited to, a microprocessor, an Application Specific Integrated Circuit (ASIC), a Programmable Gate Array (FPGA), a Digital Signal Processor (DSP), an embedded device, and the like.
The present embodiment collects flow data of a target object in time series, which is generally a website visit amount of a website, a flow of people of a treasure house or a web store, and a sales volume of products in a brick and mortar store, the flow data including daily flow, monthly flow, and monthly target flow, as data characteristics, then, combining the position coordinates of each target object, calculating a flow index based on a high-dimensional mode, then, whether the flow data of the target object meets the requirement or not is carried out through the critical factor under the current business scene calculated in advance and the current flow of each target object, and multi-dimensional data information is mined, the method and the device can macroscopically predict the flow data of different target objects, early warn abnormal flow data in advance, and solve the technical problem that early warning cannot be carried out on flow data in the prior art.
In one embodiment, a computer readable storage medium is provided, on which computer readable instructions are stored, and the computer readable instructions, when executed by a processor, implement the steps of the high-dimensional mode based abnormal access data early warning method in the above embodiments, for example, the steps 202 to 206 shown in fig. 2, or the processor, when executing the computer readable instructions, implement the functions of the modules/units of the high-dimensional mode based abnormal access data early warning apparatus in the above embodiments, for example, the functions of the modules 302 to 306 shown in fig. 3.
The present embodiment collects flow data of a target object in time series, which is generally a website visit amount of a website, a flow of people of a treasure house or a web store, and a sales volume of products in a brick and mortar store, the flow data including daily flow, monthly flow, and monthly target flow, as data characteristics, then, combining the position coordinates of each target object, calculating a flow index based on a high-dimensional mode, then, whether the flow data of the target object meets the requirement or not is carried out through the critical factor under the current business scene calculated in advance and the current flow of each target object, and multi-dimensional data information is mined, the method and the device can macroscopically predict the flow data of different target objects, early warn abnormal flow data in advance, and solve the technical problem that early warning cannot be carried out on flow data in the prior art.
It will be understood by those of ordinary skill in the art that all or part of the processes of the methods of the embodiments described above can be implemented by hardware associated with computer readable instructions, which can be stored in a non-volatile computer readable storage medium, and when executed, can include processes of the embodiments of the methods described above. Any reference to memory, storage, database, or other medium used in the embodiments provided herein may include non-volatile and/or volatile memory, among others. Non-volatile memory can include read-only memory (ROM), Programmable ROM (PROM), Electrically Programmable ROM (EPROM), Electrically Erasable Programmable ROM (EEPROM), or flash memory. Volatile memory can include Random Access Memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in a variety of forms such as Static RAM (SRAM), Dynamic RAM (DRAM), Synchronous DRAM (SDRAM), Double Data Rate SDRAM (DDRSDRAM), Enhanced SDRAM (ESDRAM), Synchronous Link DRAM (SLDRAM), Rambus Direct RAM (RDRAM), direct bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM).
The block chain referred by the application is a novel application mode of computer technologies such as distributed data storage, point-to-point transmission, a consensus mechanism, an encryption algorithm and the like. A block chain (Blockchain), which is essentially a decentralized database, is a series of data blocks associated by using a cryptographic method, and each data block contains information of a batch of network transactions, so as to verify the validity (anti-counterfeiting) of the information and generate a next block. The blockchain may include a blockchain underlying platform, a platform product service layer, an application service layer, and the like.
It will be apparent to those skilled in the art that, for convenience and brevity of description, only the above-mentioned division of the functional units and modules is illustrated, and in practical applications, the above-mentioned function distribution may be performed by different functional units and modules according to needs, that is, the internal structure of the apparatus is divided into different functional units or modules to perform all or part of the above-mentioned functions.
The technical features of the above embodiments can be arbitrarily combined, and for the sake of brevity, all possible combinations of the technical features in the above embodiments are not described, but should be considered as the scope of the present specification as long as there is no contradiction between the combinations of the technical features.
The above-mentioned embodiments only express several embodiments of the present application, and the description thereof is more specific and detailed, but not construed as limiting the scope of the invention. It should be noted that, for those skilled in the art, without departing from the spirit and scope of the present invention, several changes, modifications and equivalent substitutions of some technical features may be made, and these changes or substitutions do not make the essence of the same technical solution depart from the spirit and scope of the technical solution of the embodiments of the present invention. Therefore, the protection scope of the present patent shall be subject to the appended claims.
Claims (10)
1. An abnormal access data early warning method based on a high-dimensional mode is characterized by comprising the following steps:
collecting flow data of a plurality of target objects in a time sequence, wherein the flow data is one of website visit amount, store people flow amount or product sales amount, and the flow data comprises daily flow amount, monthly flow amount and monthly target flow amount;
calculating a flow index of each target object based on the daily flow, the monthly target flow and the position coordinates of each target object;
and acquiring a critical factor, and calculating to obtain an early warning result based on the critical factor, the flow index and the current flow of each target object.
2. The method of claim 1, further comprising, before obtaining the critical factor and calculating an early warning result based on the critical factor, the flow index, and the current flow of each of the target objects, the step of:
acquiring sample data and corresponding position coordinates of a sample object; and are
Selecting one sample object from a plurality of sample objects to be updated as an original sample object;
calculating Euclidean distances between the original sample object and other sample objects, and taking the sample objects with the Euclidean distances smaller than a preset distance value and the number exceeding a preset number as cluster objects of the original sample object;
taking the original sample object and the cluster object as a track object cluster, and repeating the operation of updating the original sample object until all sample objects have at least one track object cluster;
and calculating the critical factor according to the track object cluster.
3. The method of claim 1, wherein obtaining the critical factor and calculating an early warning result based on the critical factor, the flow index, and the current flow of each target object comprises:
and if the current day flow of the target object is not in the range of the sum of the critical factor and the flow index, the early warning result is data abnormality.
4. The method of claim 1, wherein calculating a flow index for each target object based on the daily flow, monthly goal, and location coordinates of each target object comprises:
calculating an arithmetic average of cumulative achievement proportions of the target objects under the same position coordinates at the same time to obtain a transverse comparison characteristic of each target object, wherein the cumulative achievement proportions are obtained by calculating ratios of daily flow, monthly flow and monthly target flow;
calculating the arithmetic mean value of the accumulated achievement proportion of the same target object at the same time as the longitudinal homonymy characteristic of each target object;
calculating target objects with the same position coordinate in one month in succession, and accumulating the arithmetic mean of the achievement proportions as the longitudinal ring ratio characteristic of each target object;
and adjusting the weight proportion of the transverse comparison characteristic, the longitudinal same-ratio characteristic and the longitudinal ring ratio characteristic according to a preset weight table, and adding to obtain the flow index of each target object.
5. The method of claim 1, wherein calculating a flow index for each target object based on the daily flow, monthly target flow and location coordinates of each target object further comprises:
converting the flow data of each target object into discrete trajectory data based on the daily flow and the monthly flow; and are
Converting character type discrete track data into numerical type data through one-hot feature coding;
carrying out normalization processing on the numerical data to obtain normalized data with the value between 0 and 1;
and calculating oscillation factors of each target object according to the normalized data, and calculating to obtain the flow index based on the oscillation factors.
6. The method of claim 5, wherein calculating the concussion factor of each target object from the normalized data comprises:
acquiring the maximum daily flow in continuous preset time, and calculating the average flow in the continuous preset time;
and calculating the flow ratio of the maximum daily flow to the average flow, and taking the flow ratio as the oscillation factor of each target object.
7. The method of claim 1, wherein the traffic data is stored in a blockchain.
8. An abnormal access data early warning device based on a high-dimensional mode is characterized by comprising:
the data collection module is used for collecting flow data of a plurality of target objects according to a time sequence, wherein the flow data is one of website visit amount, shop people flow amount or product sales amount, and the flow data comprises daily flow amount, monthly flow amount and monthly target flow amount;
the index calculation module is used for calculating and obtaining the flow indexes of all the target objects based on the daily flow, the monthly target flow and the position coordinates of all the target objects;
and the abnormity early warning module is used for acquiring a critical factor and calculating to obtain an early warning result based on the critical factor, the flow index and the current flow of each target object.
9. A computer device comprising a memory and a processor, the memory storing computer readable instructions, wherein the processor when executing the computer readable instructions implements the steps of the method of any one of claims 1 to 7.
10. A computer readable storage medium having computer readable instructions stored thereon, which when executed by a processor implement the steps of the method of any one of claims 1 to 7.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202110880946.1A CN113329037B (en) | 2021-08-02 | 2021-08-02 | Abnormal access data early warning method based on high-dimensional mode and related equipment |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202110880946.1A CN113329037B (en) | 2021-08-02 | 2021-08-02 | Abnormal access data early warning method based on high-dimensional mode and related equipment |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN113329037A true CN113329037A (en) | 2021-08-31 |
| CN113329037B CN113329037B (en) | 2021-11-16 |
Family
ID=77426677
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202110880946.1A Active CN113329037B (en) | 2021-08-02 | 2021-08-02 | Abnormal access data early warning method based on high-dimensional mode and related equipment |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN113329037B (en) |
Citations (9)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN107370766A (en) * | 2017-09-07 | 2017-11-21 | 杭州安恒信息技术有限公司 | A kind of network flow abnormal detecting method and system |
| CN110086649A (en) * | 2019-03-19 | 2019-08-02 | 深圳壹账通智能科技有限公司 | Detection method, device, computer equipment and the storage medium of abnormal flow |
| CN110544001A (en) * | 2019-07-15 | 2019-12-06 | 中国平安财产保险股份有限公司 | Passenger flow early warning method and device, computer device and storage medium |
| US20200112571A1 (en) * | 2018-10-03 | 2020-04-09 | At&T Intellectual Property I, L.P. | Network security event detection via normalized distance based clustering |
| CN111614690A (en) * | 2020-05-28 | 2020-09-01 | 上海观安信息技术股份有限公司 | Abnormal behavior detection method and device |
| CN111680830A (en) * | 2020-05-25 | 2020-09-18 | 广州衡昊数据科技有限公司 | Epidemic situation prevention method and device based on aggregation risk early warning |
| CN111949834A (en) * | 2019-05-17 | 2020-11-17 | 上海树融数据科技有限公司 | Site selection method and site selection platform |
| CN112288163A (en) * | 2020-10-29 | 2021-01-29 | 平安科技（深圳）有限公司 | Target factor prediction method of target object and related equipment |
| CN112861972A (en) * | 2020-10-26 | 2021-05-28 | 平安科技（深圳）有限公司 | Site selection method and device for exhibition area, computer equipment and medium |
-
2021
- 2021-08-02 CN CN202110880946.1A patent/CN113329037B/en active Active
Patent Citations (9)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN107370766A (en) * | 2017-09-07 | 2017-11-21 | 杭州安恒信息技术有限公司 | A kind of network flow abnormal detecting method and system |
| US20200112571A1 (en) * | 2018-10-03 | 2020-04-09 | At&T Intellectual Property I, L.P. | Network security event detection via normalized distance based clustering |
| CN110086649A (en) * | 2019-03-19 | 2019-08-02 | 深圳壹账通智能科技有限公司 | Detection method, device, computer equipment and the storage medium of abnormal flow |
| CN111949834A (en) * | 2019-05-17 | 2020-11-17 | 上海树融数据科技有限公司 | Site selection method and site selection platform |
| CN110544001A (en) * | 2019-07-15 | 2019-12-06 | 中国平安财产保险股份有限公司 | Passenger flow early warning method and device, computer device and storage medium |
| CN111680830A (en) * | 2020-05-25 | 2020-09-18 | 广州衡昊数据科技有限公司 | Epidemic situation prevention method and device based on aggregation risk early warning |
| CN111614690A (en) * | 2020-05-28 | 2020-09-01 | 上海观安信息技术股份有限公司 | Abnormal behavior detection method and device |
| CN112861972A (en) * | 2020-10-26 | 2021-05-28 | 平安科技（深圳）有限公司 | Site selection method and device for exhibition area, computer equipment and medium |
| CN112288163A (en) * | 2020-10-29 | 2021-01-29 | 平安科技（深圳）有限公司 | Target factor prediction method of target object and related equipment |
Also Published As
| Publication number | Publication date |
|---|---|
| CN113329037B (en) | 2021-11-16 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN107315824B (en) | Method and device for generating thermodynamic diagram | |
| CN111782943A (en) | Information recommendation method, device, equipment and medium based on historical data record | |
| CN112101169B (en) | Attention mechanism-based road image target detection method and related equipment | |
| CN112287244A (en) | Product recommendation method and device based on federal learning, computer equipment and medium | |
| CN112288163A (en) | Target factor prediction method of target object and related equipment | |
| CN111784392A (en) | Abnormal user group detection method, device and equipment based on isolated forest | |
| CN113435583B (en) | Federal learning-based countermeasure generation network model training method and related equipment thereof | |
| CN110555164B (en) | Method, device, computer equipment and storage medium for generating group interest labels | |
| CN113032682A (en) | Product recommendation method, device, equipment and storage medium based on collaborative filtering | |
| CN111835561A (en) | Abnormal user group detection method, device and equipment based on user behavior data | |
| CN112163207A (en) | Business data query method based on dynamic permission and related equipment | |
| CN116223975A (en) | Cable fault point positioning method, device, computer equipment and storage medium | |
| CN113329037B (en) | Abnormal access data early warning method based on high-dimensional mode and related equipment | |
| CN106708869B (en) | Group data processing method and device | |
| CN110598124B (en) | Numerical attribute mining method, device, computer equipment and storage medium | |
| CN108429632B (en) | Service monitoring method and device | |
| CN112651821A (en) | Loan default risk detection method based on multi-view learning and related equipment | |
| CN113283759A (en) | Account risk portrait updating method, device, equipment and storage medium | |
| CN110443560B (en) | Protocol data management method, device, computer equipment and storage medium | |
| CN114531374A (en) | Network monitoring method, device, equipment and storage medium | |
| CN114022184A (en) | Data management method and device, electronic equipment and storage medium | |
| CN113112007B (en) | Method, device and equipment for selecting sequence length in neural network and storage medium | |
| CN112465509A (en) | Signing contract early warning method and device | |
| CN113421118B (en) | Data pushing method, system, computer equipment and computer readable storage medium | |
| CN112039992B (en) | Model management method and system based on cloud computing architecture |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |