CN113922895A

CN113922895A - Abnormal behavior monitoring and collecting method applied to talkback terminal

Info

Publication number: CN113922895A
Application number: CN202110959672.5A
Authority: CN
Inventors: 戎檄
Original assignee: Shijiazhuang Shanli Tongyi Technology Co ltd
Current assignee: Shijiazhuang Shanli Tongyi Technology Co ltd
Priority date: 2020-09-29
Filing date: 2021-08-20
Publication date: 2022-01-11
Also published as: CN112235060A

Abstract

The invention discloses an abnormal behavior monitoring and collecting method applied to an intercom terminal, which comprises the following steps: the function module is communicated with the server to realize network data transceiving; judging service, namely judging abnormal behaviors of each network communication behavior of the functional module through a preset judgment rule by the judging service, recording the behavior characteristics of the network communication belonging to the abnormal behaviors, and summarizing the behavior characteristics to generate a behavior characteristic file for storage; and the uploading unit is used for remotely transmitting the behavior characteristic file to a remote analysis platform. A judgment layer is added, the framework integrity is changed after the whole framework is changed, and a closed-loop network is formed by the framework integrity and a remote judgment platform, so that the intelligent and high-integration guidance requirement is met.

Description

Abnormal behavior monitoring and collecting method applied to talkback terminal

Technical Field

The invention relates to the field of monitoring of equipment modules, in particular to an abnormal behavior monitoring and collecting method applied to an intercom terminal.

Background

The POC cluster talkback service generally comprises a terminal, a signal broadcast tower or a signal broadcast base station, an Ethernet, a server for receiving remote transmission signals, and a talkback network cluster for receiving centralized management of a speaking station and a dispatching station, wherein in the using process, because a data packet is initiated from the terminal, the terminal uses the broadcast station to search a registration port of a server for an Ethernet address and establish network connection with the server, the server returns a corresponding response packet to the terminal along the original path, wherein the talkback service of the voice network service is that after the terminal is connected with the server, the server establishes a talkback UDP channel between the corresponding terminals, each terminal monitors the UDP channel, when voice data frames are generated, therefore, in POC cluster talkback, the voice service is provided by depending on the network, so that the interference, fluctuation and network disconnection of the network can influence the voice quality of the talkback service, and the situation needs to be avoided as much as possible from multiple dimensions.

The interference, fluctuation and network disconnection of the network can be counted as network abnormality, when the network abnormality occurs, a part of reasons are from network congestion, but data deadlock, data congestion and packet loss caused by the terminal per se also exist to cause unsmooth receiving and sending, so that the process in which the terminal per se is located when the network abnormality occurs needs to be combined with the network fluctuation and the process processing result, and the learning and reporting are carried out.

In the daily module operation process, the dispatching desk is used as the right center and has the highest authority, but the dispatching desk cannot be combined with actual operation in use, network abnormality possibly existing in the operation is combined with the state of the terminal at the time of occurrence of the abnormality, common points existing in the network abnormality are searched, the data effectiveness of the common points is determined and judged, and the method is one of the problems to be solved in the current trunking talkback service.

Disclosure of Invention

The embodiment of the invention provides an abnormal behavior monitoring and collecting method applied to an intercom terminal, which at least solves the technical problems that the abnormal behavior of a module cannot be sniffed in advance, the abnormal characteristics of the module are difficult to collect and the comprehensive review is difficult.

An abnormal behavior monitoring and collecting method applied to an intercom terminal comprises the following steps:

the function module is communicated with the server to realize network data transceiving;

judging service, namely judging abnormal behaviors of each network communication behavior of the functional module through a preset judgment rule by the judging service, recording the behavior characteristics of the network communication belonging to the abnormal behaviors, and summarizing the behavior characteristics to generate a behavior characteristic file for storage;

and the uploading unit is used for remotely transmitting the behavior characteristic file to a remote analysis platform.

Further, in the above-mentioned case,

in the process of generating the behavior characteristic file by summarizing the behavior characteristics, the behavior characteristics are sequentially added into the data linked list in a time sequence arrangement mode, the data linked list is cached in the caching module, and the data linked list is stored to the behavior characteristic file when reaching the preset length.

Furthermore, during the process of transmitting the behavior characteristic file to a remote analysis platform, a UDP transmission protocol is adopted to communicate with the server, the behavior characteristic file is constructed into a json sequence to be uploaded, and the server responds to the return information after the uploading is successful.

Further, the method also comprises the following steps: inputting an account number to log in a terminal, inputting an account number password to initiate an authentication request to a server, after the server passes the authentication, realizing the communication between a functional module and the server, counting the high-frequency use time period and the low-frequency use time period of the starting time period of each account number by a flow counting module, and remotely transmitting the behavior feature file to a remote analysis platform by an execution uploading unit in the low-frequency use time period.

The method further comprises a control file used for defining a behavior characteristic storage address, wherein the control file is written into the memory in advance, the storage address of the behavior characteristic is read after the control file is accessed preferentially by the service is judged, the function module is accessed at regular time by a preset timer, the behavior characteristic of the function module is recorded by the storage address, and abnormal behavior judgment is carried out.

Further, the abnormal behavior judgment comprises network disconnection judgment, disconnection reconnection judgment, voice loss judgment, stuck judgment, login failure judgment and GPS positioning judgment.

And (4) the talkback terminal.

Further, before the uploading unit transmits the behavior feature file to the remote analysis platform, the uploading unit preferentially performs the steps of:

judging and uploading: judging whether behavior feature files which are not uploaded exist or not, uploading the corresponding behavior feature files if the behavior feature files exist, searching the memory linked list if the behavior feature files do not exist, checking whether the memory linked list has the data which are not uploaded or not, uploading the data one by one if the memory linked list has the data which are not uploaded, and judging whether the behavior feature files which are not uploaded exist or not through backtracking check if the memory linked list does not have the data which are not uploaded, wherein the period of the backtracking check is 1-10 seconds.

Further, the network strength is preferentially judged when the behavior feature file is uploaded in the judging and uploading step, if the network strength is lower than a preset value, uploading is stopped, abnormal behaviors are continuously recorded, if the network strength is higher than the preset value, the weight priority of the current processing task weight and the uploading task weight is judged, if the current processing task weight is larger than the uploading task weight, uploading of the behavior feature file is stopped, and if the current processing task weight is smaller than the uploading task weight, file uploading is started.

Further, the behavior feature file is preferentially sent to the server after the self-compression unlocking is finished when being uploaded, the server returns the actual received byte number at any moment, the network strength and the current processing task weight are detected at any moment, the uploading is stopped when the network strength is low and/or the current processing task weight is high, and the behavior feature file is continuously uploaded by taking the uploaded actual received byte number as a starting point when the network strength is high and/or the current processing task weight is low. 10. A storage device applied to an abnormal behavior monitoring and collecting method of an intercom terminal is characterized in that:

the processor is suitable for realizing the abnormal behavior monitoring and collecting method applied to the talkback terminal; and

the storage unit is suitable for realizing any abnormal behavior monitoring and collecting method applied to the talkback terminal, and the processor loads and executes the abnormal behavior monitoring and collecting method applied to the talkback terminal.

Drawings

The accompanying drawings, which are included to provide a further understanding of the invention and are incorporated in and constitute a part of this application, illustrate embodiment(s) of the invention and together with the description serve to explain the invention without limiting the invention. In the drawings:

fig. 1 is a schematic diagram of network connection of the functional module in communication with a server and interaction with a remote analysis platform according to the present invention.

Fig. 2 is a signal interaction flow chart of functional modules in the invention.

FIG. 3 is a diagram of a multi-level data-storing structure of a memory linked list according to the present invention.

Fig. 4 is a protocol communication diagram of the terminal and the remote analysis platform.

Fig. 5 is a terminal power-on self-test flowchart.

Fig. 6 is a flow chart of recording behavior characteristics of network communication with abnormal behavior.

Fig. 7 is a diagram of the abnormal behavior specification and the judgment rule.

Detailed Description

In order to make the technical solutions of the present invention better understood, the technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the drawings in the embodiments of the present invention, and it is obvious that the described embodiments are only a part of the embodiments of the present invention, and not all of the embodiments. All other embodiments, which can be derived by a person skilled in the art from the embodiments given herein without making any creative effort, shall fall within the protection scope of the present invention.

It should be noted that the terms in the description, the claims and the drawings of the present invention are used for distinguishing between similar objects, and the terms first, second and the like are not used for describing a detailed technical solution of the present invention. It is to be understood that the data so used is interchangeable under appropriate circumstances such that the embodiments of the invention described herein are capable of operation in sequences other than those illustrated or described herein. Furthermore, the terms "comprises," "comprising," and "having," and any variations thereof, are intended to cover a non-exclusive inclusion, such that a process, method, system, article, or apparatus that comprises a list of steps or elements is not necessarily limited to those steps or elements expressly listed, but may include other steps or elements not expressly listed or inherent to such process, method, article, or apparatus.

Example one

As shown in fig. 1, fig. 2, fig. 6 and fig. 7, there is provided an abnormal behavior monitoring and collecting method applied to an intercom terminal, including a functional module for implementing each service;

s200, the functional module communicates with a server to realize network data receiving and sending;

specifically, as shown in fig. 1, the function module is integrated in the terminal, the function module includes a session service, a talk-back service, a PTT button triggering and releasing detection service, a network initiation service, a video service, and other services integrated in the module, and also includes a GPS module, a network module, a power circuit module, a signal transceiver module, and other function modules, which are operated in an automated execution computing service platform such as an android platform, an apple platform, a PC platform, and the like, the function module performs service interaction according to a preset interaction chain according to a function selected by a terminal operator, and finally collects into a data packet to be uploaded through the network module, the data packet flows through a broadcast base station to communicate with the ethernet according to a preset protocol and is simultaneously distributed to a remote analysis platform and a server, the server decodes and stores the data packet according to a preset session protocol, the remote analysis platform can be called by a local hard disk, the server memory data can be called by the communication between the remote analysis platform and the server.

S201, judging service, namely judging abnormal behaviors of each network communication behavior of the functional module by the judging service through a preset judging rule, recording behavior characteristics of the network communication behaviors belonging to the abnormal behaviors, and summarizing the behavior characteristics to generate a behavior characteristic file for storage;

in the implementation process, the judgment service is integrated on each functional module, the judgment service is divided into a GPS judgment service, a POC judgment service and a network communication judgment service,

the method comprises the following steps:

the method comprises the steps that a GPS judgment service is integrated in a GPS module, the GPS module picks up position information such as speed, time, longitude, latitude, orientation, height and signal intensity in the average time of the GPS module, uploads the position information, part of the uploaded position information is stored in a local backup, the position information is simultaneously transmitted to a server and stored in a cloud end, a remote analysis platform can call the position information from the server, the position information is used as global coordinate points according to the longitude and the latitude, a hexagonal area with the size of 50 meters preset in the range is used as a global distribution grid area with the global coordinate points, the position information of each coordinate point in the hexagonal grid area is uploaded as a regional file sample, or the position information of each coordinate point is selected and uploaded to the server;

the method comprises the steps of calculating the average speed, time, height and signal intensity of a regional file sample in a server, picking up and comparing the position information of the regional file sample by a GPS judgment service when a GPS module sends out, and taking the error range of comparison as an effective position point when the error range is within a preset range

Or

GPS judgment service in the uploading process of the GPS module, collecting sample points or reading position information of corresponding position points and comparing the position information, wherein the comparison error range is an effective position point when the error range is within a preset range

And the effective position point judgment of the parallel processing triggers the judgment rule and the acquisition information of the GPS judgment service when the uploading initiating time and the server returning time of the effective position point pass the post-timing and often exceed the preset regulation or no return packet:

and exceeding the preset time.

Data point not matching valid location point trigger:

data point drift and noise.

Effective location point upload incomplete

(iii) GPS module damage

Drift, noise, damage, timeout, failed positioning are included in the above-mentioned abnormal behavior.

The GPS acquisition mode provided by the method can quickly acquire the geographical position information in the grid area through the regional rule of all-terrain all-coverage, can acquire the grid area information according to the requirement and acquire other abnormal behaviors in the grid to upload, avoids the conventional rule method of acquiring one-point-to-one correspondence, can be covered in all-terrain and has universality.

And 2, the POC module is integrated with POC judgment services, the POC module is used for realizing the services of the service core service module, and comprises a session service, a talkback service, a PTT key triggering service and a network initiation service, and the session service, the talkback service, the PTT key triggering service and the network initiation service are all in communication interconnection with the POC judgment services.

Triggering a service by a PTT key to acquire the pressing of the PTT key, namely initiating a session service to acquire voice information and identify voice information end points, framing by the voice length between the end points, wherein the frame length is not more than one fifth to one eighth of the length of a preset frame, taking the voice information of each adjacent frame end point and compressing after framing is finished, taking the compressed voice information of the adjacent frame end point as the actual end point of each frame packet, distributing frame packet numbers, notifying an intercom service to send data to a selected user after the frame packet distribution is finished after voice recording is finished, recording the ID of the user, notifying a network to initiate the service after the user or group information is recorded, and packaging into a packaged packet with preset protocol content for uploading;

and the corresponding receiving account terminal decodes after receiving the packaging packet, starts a receiving terminal identification record and records the receiving post-processing process, and the compressed voice information of the adjacent frame endpoints is overlapped and sequentially played in the decoding process after the frame packet is sent.

The receiving post-processing process comprises recording the time of receiving a first frame, the total number of received packets, the maximum jitter and the average jitter;

after the POC identification PTT key is pressed, the identification number is distributed, a memory linked list is constructed, and the segment identification record is sent out.

Starting to record service behavior characteristics, service failure/service failure, comprising the following authentication items and collecting the following information:

recording session service initiation service failure/service failure,

After the voice frame is framed by the recording session service, the frame packet transmission service fails/fails in the compression process or the transmission process,

corresponding to frame number frame packet sending time, identifying the heartbeat packet initiation and return of the network initiation service, defining success when the time is less than the preset initiation/return, and defining success when the time is more than the preset initiation/return;

if the POC judges that the service identifies that any one or more services fail, the POC records a memory linked list corresponding to the identification number newly added and informs a corresponding receiving account terminal receiving the voice information through a server that the received post-processing process is stored with the same identification number.

When the sender authentication record and the receiver authentication record both reach the maximum storage value, the sender authentication record and the receiver authentication record are sent to the server, the server informs the remote analysis platform that the information is received, and the sender authentication record and the receiver authentication record are combined into a POC abnormal service file.

The information collected by the method and the frame combination method have the advantages of fast combination and noise elimination, and the integration of the method into the abnormal information collection work can reduce the speech blur, improve the fast uploading and playing of the speech frames and effectively reduce the generation of abnormal information.

3. Network communication judgment service is integrated in the network module, when the network module is a functional module and needs to initiate a data packet such as voice data, test data and a handshake packet, the network module receives the data packet and sends the data to the server, and the network module is a receiving module at the same time, and the network module receives data communication initiated by other terminals with the terminals where the network module is located, so the judgment rule of the network communication judgment service is as follows:

when initiating data packet uploading, whether the network fluctuation quantity exceeds a preset toggle range or not.

The method is used for judging abnormal behaviors such as network disconnection, network fluctuation and the like and monitoring the communication smoothness of the network initiating module and the network module.

The network communication judges the amount of network fluctuation when the service acquisition information is uploaded.

The network module simultaneously provides network parameter service in abnormal behaviors for the judgment service of the POC module and the GPS module.

As described above, the information collected by the behavior profile is collected into the behavior profile.

The details are given in the following table:

as shown in fig. 7, abnormal behavior is classified as:

TABLE 1

The behavior characteristics are classified as:

serial number	Type of exception	Behavioral characteristic statistics
			1	Broken net	Time of occurrence, cause of occurrence, GPS information, network information
2	Reconnection of	Time of occurrence, reason of occurrence, length of reconnectionReconnection times, GPS information, network information
			3	Losing sound	Time of occurrence, packet loss sequence number, GPS information, network information
4	Catton	Occurrence time, silent frame number, GPS information, network information
			5	Failure of login	Time of occurrence, cause of occurrence, GPS information, network information
6	Failure of GPS positioning	Time of occurrence, GPS information, network information

TABLE 2

The behavior characteristics are the constituent elements constituting the behavior characteristics file, and include the contents shown in fig. 7 and tables 1 and 2 above.

And S203, an uploading unit for remotely transmitting the behavior characteristic file to a remote analysis platform.

As shown in fig. 5 and fig. 6, in the implementation process, the uploading unit is used to detect and report the behavior feature file, the uploading unit reads the control file, determines the storage address of the behavior feature file in the memory according to the control file,

if the behavior feature file is stored and read in the memory, the behavior feature file is exported to the storage address and is carried out according to the priority reporting rule;

if the behavior feature file is not stored in the memory, reading the data linked list in the generation process, checking the data content in the data linked list in the generation process, and if the data content is empty, finishing the reporting;

if the data linked list is being generated, storing data content, checking the number of written data, if the number of the written data is larger than a preset value, taking 10 written data within 5 minutes as a boundary, if the number of the written data is larger than the boundary value, directly packaging and reporting the data linked list, and after the reporting is finished, adding the data linked list to the tail part of the previous behavior feature file at the server.

And if the data content is less than the limit value, copying the data content written into the data linked list, transferring the subsequent written content to a blank behavior characteristic file, writing the subsequent written content into the blank behavior characteristic file in a cyclic overwriting or additional writing mode, and reporting the subsequent written content.

The functional module is based on an integrated judgment service, the judgment service is used for sniffing sensitive data points and summarizing the sensitive data points, the integration is strong, the functional module is easy to integrate into various functional modules, the conformity with a neural network BP algorithm is high, an API interface is reserved in the functional module, the high-weight interface is removed, the judgment service is packaged into a whole with the functional module, the interface protocol adopts a preset protocol, the communication performance is good, the integration of the existing equipment is high, a judgment layer is added, the framework integrity is changed, and a closed-loop network is formed with a remote judgment platform, so that the intelligent and high-integration guidance requirements are met.

Compared with the existing circulation method, the monitoring and collecting method can achieve sensitive collection, silent uploading and smooth communication, is complementary with a remote analysis platform to be used as an intelligent control information collecting end, and can carry out all-around collection on the behavior logic of the whole equipment and corresponding numerical values and parameter methods.

Optionally, in the process of generating the behavior feature file by summarizing the behavior features, the behavior features are sequentially added into the data linked list in a time sequence arrangement, the data linked list is cached in the caching module, and the data linked list is stored to the behavior feature file when reaching a preset length.

As shown in fig. 3, in the implementation, the data chain table has multiple structures, each data chain has a head portion, data, a data ID, a data field, and a tail portion, and multiple data chains exist in parallel, each unit of the head portion, the data ID, the data field, and the tail portion of each data chain has a preamble continuation code and a subsequent continuation code, the subsequent continuation code points to the preamble continuation code of another unit, and each code is sequentially read from the preamble continuation code at the position pointed by the subsequent continuation code in the reading process to the next unit, thereby implementing the application combination of the data chain table.

As shown in fig. 4, optionally, in the process of remotely transmitting the behavior feature file to the remote analysis platform, a UDP transport protocol is used to communicate with the server, the behavior feature file is constructed as a json sequence to be uploaded, and the server responds to the return information after the uploading is successful.

It should be noted that the json sequence allocates a key pair to each behavior feature file, and a plurality of associated arrays correspond to the key pair, where each associated array is the data linked list structure, after uploading of the behavior feature file is completed, the remote analysis platform obtains a key value list of the behavior feature file, and after the remote analysis platform translates the key value list, the key value list can be combined with the linked list feature units to realize the free combination statistics of the data linked list.

Therefore, the data linked list structure is adopted, the structure performance is excellent, data integration and classification are easy to carry out, the module replacement performance is excellent, the table set exists in the linked list mode and is realized, the longitudinal file readability is realized, and the performance is excellent when the table set is used as a data grid.

Optionally, before the uploading module remotely transmits the behavior feature file to the far-end analysis platform through the network module, the uploading module performs a step of selecting the uploading time period to avoid the peak voice intercom time period, so as to prevent the bandwidth of the foundation public network intercom such as voice intercom, video intercom and the like from being invaded.

Optionally, the traffic statistics module calculates the network bandwidth occupation at the time, obtains the size of the remaining bandwidth at the time, calculates the uploading bandwidth occupied by uploading the behavior feature file, compares the ratio of the uploading bandwidth to the remaining bandwidth, and starts the uploading task if the ratio is less than 1 and the uploading task weight is greater than the current processing task weight.

Specifically, comparing the current processing task weight with the uploading task weight, if the current processing task weight is high and is not finished, suspending the uploading of the behavior feature file,

when the current processing task weight is low or has ended,

and the network module detects the network intensity at any moment, and when the network intensity is lower than a preset threshold value and the ratio of the occupied uploading bandwidth required by uploading the behavior characteristic file to the current residual bandwidth is calculated to be less than 1, the uploading is started.

And if the ratio of the occupied uploading bandwidth required by the uploading of the behavior characteristic file to the current residual bandwidth is greater than 1, stopping the uploading when the network intensity is lower than a preset threshold value.

The upload priorities are arranged in the following order of priority.

Disconnected network, reconnection, lost voice, stuck in, login failure, GPS positioning failure

Optionally, the method includes the steps of inputting an account number to log in a terminal, inputting an account number password to initiate an authentication request to a server, after the server passes the authentication, enabling a functional module to communicate with the server, enabling a flow statistics module to count a high-frequency usage period and a low-frequency usage period of a starting time period of each account number, and enabling an uploading unit to be executed in the low-frequency usage period to remotely transmit the behavior feature file to a remote analysis platform.

The network module detects the peak flow time period and the valley flow time period of each account, determines the high-frequency use time period and the low-frequency use time period of each account, and switches to a high-frequency service identification mode in the high-frequency use time period,

high frequency service authentication mode: and inquiring the network strength at low frequency, suspending uploading of the behavior characteristic file and continuously starting the judgment service until the network flow is in flow silence or low flow jitter within continuous preset minutes, and switching to a low-frequency service identification mode.

Low frequency service authentication mode: and judging whether the high-weight function module is working at the moment, if the voice module is talkbacking, inquiring the network strength at a high frequency, starting behavior feature file uploading work, continuously starting the judgment service until the network flow is in a flow peak value within continuous preset minutes, and switching to a high-frequency service identification mode.

Optionally, the abnormal behavior determination further acquires hardware information of the corresponding terminal and login information of an account logged in by the corresponding terminal.

In the implementation process, the hardware information includes: the terminal type, the model, the manufacturer, the IP address, the terminal unique code, the SIM card unique code, the software version, the login account and the account unique code.

As shown in fig. 5, optionally, the method further includes a control file for defining a behavior feature storage address, where the control file is written into the memory in advance, the storage address of the behavior feature is read after the service is judged to access the control file preferentially, the judgment service accesses the function module regularly by using a preset timer, and records the behavior feature of the function module by using the storage address, and performs abnormal behavior judgment.

As shown in fig. 7, the abnormal behavior determination includes network disconnection determination, disconnection reconnection determination, voice loss determination, stuck determination, login failure determination, GPS positioning determination, and network information.

The judgment logic refers to that shown in step S20, and judges the content.

Wherein the stuck determination is collected from network fluctuation information.

And judging login failure, and acquiring the communication condition of the network module and the server or judging the working condition of the server.

The network information comprises collected network modes (2/3/4G, WIFI) and signal strength (0-100).

Optionally, before the uploading unit transmits the behavior feature file to the remote analysis platform, the following steps are preferentially performed:

judging and uploading: judging whether behavior feature files which are not uploaded exist or not, uploading the corresponding behavior feature files if the behavior feature files exist, searching the memory linked list if the behavior feature files do not exist, checking whether the memory linked list has the data which are not uploaded or not, uploading the data one by one if the memory linked list has the data which are not uploaded, and judging whether the behavior feature files which are not uploaded exist or not through backtracking check if the memory linked list does not have the data which are not uploaded, wherein the backtracking check period is 1-5 seconds.

Optionally, the network strength is preferentially determined when the behavior feature file is uploaded in the determining and uploading step, if the network strength is lower than a preset value, the uploading is stopped, abnormal behaviors are continuously recorded, if the network strength is higher than the preset value, the weight priority of the current processing task weight and the uploading task weight is determined, if the current processing task weight is greater than the uploading task weight, the uploading of the behavior feature file is stopped, and if the current processing task weight is smaller than the uploading task weight, the uploading of the file is started.

Optionally, when the behavior feature file is uploaded, the behavior feature file is preferentially sent to the server after the self-compression unlocking is finished, the server returns the actual received byte number at any moment, detects the network strength and the current processing task weight at any moment, and stops uploading when the network strength is low and/or the current processing task weight is high until the uploaded actual received byte number is taken as a starting point to continue uploading the behavior feature file when the network strength is high and/or the current processing task weight is low.

In the case of the example 2, the following examples are given,

the storage device applied to the abnormal behavior monitoring and collecting method of the talkback terminal is characterized in that:

a processor, adapted to implement the abnormal behavior monitoring and collecting method for intercom according to any one of claims 1-5; and

the storage unit is suitable for storing the abnormal behavior monitoring and collecting method applied to the talkback and used for realizing any one of claims 1 to 5, and the abnormal behavior monitoring and collecting method applied to the talkback and used for realizing any one of claims 1 to 5 is loaded and executed by the processor.

In the above embodiments of the present invention, the descriptions of the respective embodiments have respective emphasis, and for parts that are not described in detail in a certain embodiment, reference may be made to related descriptions of other embodiments.

In the embodiments provided in the present application, it should be understood that the disclosed technology can be implemented in other ways. The above-described embodiments of the apparatus are merely illustrative, and for example, the division of the units may be a logical division, and in actual implementation, there may be another division, for example, multiple units or components may be combined or integrated into another system, or some features may be omitted, or not executed. In addition, the shown or discussed mutual coupling or direct coupling or communication connection may be an indirect coupling or communication connection through some interfaces, units or modules, and may be in an electrical or other form.

The units described as separate parts may or may not be physically separate, and parts displayed as units may or may not be physical units, may be located in one place, or may be distributed on a plurality of units. Some or all of the units can be selected according to actual needs to achieve the purpose of the solution of the embodiment.

In addition, functional units in the embodiments of the present invention may be integrated into one processing unit, or each unit may exist alone physically, or two or more units are integrated into one unit. The integrated unit can be realized in a form of hardware, and can also be realized in a form of a software functional unit.

The integrated unit, if implemented in the form of a software functional unit and sold or used as a stand-alone product, may be stored in a computer readable storage medium. Based on such understanding, the technical solution of the present invention may be embodied in the form of a software product, which is stored in a storage medium and includes instructions for causing a computer device (which may be a personal computer, a server, or a network device) to execute all or part of the steps of the method according to the embodiments of the present invention. And the aforementioned storage medium includes: a U-disk, a Read-Only Memory (ROM), a Random Access Memory (RAM), a removable hard disk, a magnetic or optical disk, and other various media capable of storing program codes.

The foregoing is only a preferred embodiment of the present invention, and it should be noted that, for those skilled in the art, various modifications and decorations can be made without departing from the principle of the present invention, and these modifications and decorations should also be regarded as the protection scope of the present invention.

Claims

1. The abnormal behavior monitoring and collecting method applied to the talkback terminal is characterized by comprising the following steps of:

2. The abnormal behavior monitoring and collecting method applied to the intercom terminal according to claim 1, characterized in that:

3. The method for monitoring and collecting the abnormal behavior applied to the intercom terminal according to claim 1, wherein the behavior feature file is communicated with the server by adopting a UDP transmission protocol in the process of being remotely transmitted to a remote analysis platform, the behavior feature file is constructed into a json sequence to be uploaded, and the server responds to return information after the uploading is successful.

4. The method for monitoring and collecting abnormal behaviors applied to the intercom terminal according to claim 1, further comprising the following steps: inputting an account number to log in a terminal, inputting an account number password to initiate an authentication request to a server, after the server passes the authentication, realizing the communication between a functional module and the server, counting the high-frequency use time period and the low-frequency use time period of the starting time period of each account number by a flow counting module, and remotely transmitting the behavior feature file to a remote analysis platform by an execution uploading unit in the low-frequency use time period.

5. The abnormal behavior monitoring and collecting method applied to the intercom terminal according to claim 1, further comprising a control file for defining a behavior feature storage address, wherein the control file is written into a memory in advance, the storage address of the behavior feature is read after the control file is accessed preferentially by a judgment service, the function module is accessed periodically by a preset timer, the behavior feature of the function module is recorded by the storage address, and abnormal behavior judgment is performed.

6. The method according to claim 2, wherein the abnormal behavior judgment comprises a network disconnection judgment, a disconnection reconnection judgment, a voice loss judgment, a stuck judgment, a login failure judgment and a GPS positioning judgment.

7. The abnormal behavior monitoring and collecting method applied to the intercom terminal according to claim 4, wherein the uploading unit preferentially performs the judging and uploading step before the behavior feature file is remotely transmitted to the remote analysis platform:

8. The method according to claim 7, wherein the judgment and uploading step preferentially judges the network strength when the behavior feature file is uploaded, stops uploading to continue recording abnormal behavior if the network strength is lower than a preset value, judges the weight priority of the current processing task weight and the uploading task weight if the network strength is higher than the preset value, stops the uploading of the behavior feature file if the current processing task weight is greater than the uploading task weight, and starts the file uploading if the current processing task weight is less than the uploading task weight.

9. The abnormal behavior monitoring and collecting method applied to the intercom terminal according to claim 8, characterized in that the behavior feature file is preferentially sent to the server after the compression and the unlocking are finished when being uploaded, the server constantly returns the actual number of bytes received, constantly detects the network strength and the current processing task weight, and stops uploading when the network strength is low and/or the current processing task weight is high until the uploaded actual number of bytes received is taken as a starting point to continue uploading the behavior feature file when the network strength is high and/or the current processing task weight is low.

10. A storage device applied to an abnormal behavior monitoring and collecting method of an intercom terminal is characterized in that:

a processor, adapted to implement the abnormal behavior monitoring and collecting method applied to the intercom terminal according to any one of claims 1 to 9; and

the storage unit is suitable for storing the abnormal behavior monitoring and collecting method applied to the talkback terminal and used for realizing any one of claims 1 to 9, and the processor loads and executes the abnormal behavior monitoring and collecting method applied to the talkback terminal and used for realizing any one of claims 1 to 9.