CN114491407A - Traffic cheating identification method, device, equipment and storage medium - Google Patents

Abstract

The invention belongs to the technical field of internet big data analysis, and discloses a flow cheating identification method, a flow cheating identification device, flow cheating identification equipment and a storage medium. The method comprises the steps of obtaining natural flow distribution probability and flow distribution data of flow to be detected; determining a cheating score corresponding to the flow to be detected according to the flow distribution data and the natural flow distribution probability; and judging whether the flow to be detected has flow cheating according to the cheating values. The flow distribution data of the flow to be detected and the natural flow distribution probability obtained by statistics of the big data are compared and calculated to obtain the corresponding cheating score, and the cheating score can represent the difference degree between the flow distribution of the flow to be detected and the natural flow without flow cheating, so that whether the flow cheating exists can be judged according to the cheating score, and the proper rights and interests of flow buyers can be protected.

Description

Traffic cheating identification method, device, equipment and storage medium

technical field

The invention relates to the technical field of Internet big data analysis, and in particular, to a traffic cheating identification method, device, equipment and storage medium.

Background technique

Nowadays, traffic monetization has brought a lot of benefits to various enterprises. Driven by the benefits of traffic monetization, traffic fraud has become more and more rampant, and the forms and technical means of traffic fraud have become more advanced. No matter what form of cheating, the ones who lose the most in the end are the traffic buyers who pay for the traffic. Traffic buyers use a lot of capital budget to buy traffic. The purpose is to bring in new users. Due to the existence of a large number of fake traffic, such fake traffic does not bring new users that can actually be retained, nor can it bring income. It greatly damages the legitimate rights and interests of traffic buyers, and traffic anti-cheating can not only promote the positive growth of enterprise business ecology, but also save a certain capital budget and protect the legitimate rights and interests of traffic buyers. Therefore, traffic anti-cheating is imminent.

The above content is only used to assist the understanding of the technical solutions of the present invention, and does not mean that the above content is the prior art.

SUMMARY OF THE INVENTION

The main purpose of the present invention is to provide a traffic cheating identification method, device, equipment and storage medium, aiming at solving the technical problem of how to detect whether there is traffic cheating so as to protect the legitimate rights and interests of traffic buyers.

In order to achieve the above object, the invention provides a kind of traffic cheating identification method, the method comprises the following steps:

Obtain the natural traffic distribution probability and the traffic distribution data of the traffic to be detected;

Determine the cheating score corresponding to the traffic to be detected according to the traffic distribution data and the natural traffic distribution probability;

Determine whether there is traffic fraud in the traffic to be detected according to the fraud score.

Optionally, before the step of acquiring the natural traffic distribution probability and the traffic distribution data of the traffic to be detected, the method further includes:

Determine the user's thinking time according to the user operation information contained in the traffic to be detected;

The traffic distribution data of the traffic to be detected is determined according to the user's thinking time.

Optionally, the step of determining the user's thinking duration according to the user operation information contained in the traffic to be detected includes:

Obtain the user operation information contained in the traffic to be detected to determine the operation time of adjacent user operations;

The operation time difference between adjacent user operations is determined according to the operation time, and the operation time difference is used as the corresponding user thinking time period.

Optionally, the step of determining the traffic distribution data of the traffic to be detected according to the user's thinking time includes:

Group the user thinking durations according to preset time distribution intervals, and use the number of user thinking durations corresponding to each preset time distribution interval as the corresponding traffic distribution number;

Determine the traffic distribution probability of each preset time distribution interval according to the traffic distribution quantity and the total number of user thinking time;

The flow distribution data of the flow to be detected is determined according to the flow distribution probability and the flow distribution quantity.

Optionally, the step of determining the cheating score corresponding to the traffic to be detected according to the traffic distribution data and the natural traffic distribution probability includes:

obtaining the traffic distribution probability and the traffic distribution quantity in the traffic distribution data;

The cheating score corresponding to the traffic to be detected is determined according to the traffic distribution probability, the traffic distribution quantity and the natural traffic distribution probability.

Optionally, the step of determining the cheating score corresponding to the traffic to be detected according to the traffic distribution probability, the traffic distribution quantity and the natural traffic distribution probability includes:

According to the traffic distribution probability, the traffic distribution quantity and the natural traffic distribution probability, the cheating score corresponding to the traffic to be detected is determined by the cheating score calculation formula;

The formula for calculating the cheating score is:

In the formula, score is the cheating score, P(organicBin _i ) is the distribution probability of natural traffic in the ith time distribution interval, P(channelBin _i ) is the distribution probability of the traffic to be detected in the ith time distribution interval, and N is the distribution probability of the traffic to be detected in the ith time distribution interval. The distribution quantity of the detected traffic in the ith time distribution interval, P(organicBin _j ) is the distribution probability of the natural traffic in the jth time distribution interval, P(channelBin _j ) is the distribution of the traffic to be detected in the jth time distribution interval probability, M is the distribution quantity of the traffic to be detected in the jth time distribution interval.

Optionally, before the step of determining the cheating score corresponding to the traffic to be detected according to the traffic distribution data and the natural traffic distribution probability, the method further includes:

Calculate the relative entropy value according to the traffic distribution data and the natural traffic distribution probability;

When the relative entropy value satisfies the cheating score calculation condition, the step of determining the cheating score corresponding to the traffic to be detected according to the traffic distribution data and the natural traffic distribution probability is performed.

Optionally, the step of calculating the relative entropy value according to the traffic distribution data and the natural traffic distribution probability includes:

obtaining the traffic distribution probability in the traffic distribution data;

The relative entropy value is calculated according to the flow distribution probability and the natural flow distribution probability.

Optionally, the step of calculating the relative entropy value according to the traffic distribution probability and the natural traffic distribution probability includes:

Calculate the relative entropy value through the relative entropy calculation formula according to the flow distribution probability and the natural flow distribution probability;

The relative entropy calculation formula is:

In the formula, D _KL (p||q) is the relative entropy value, p(x _i ) is the distribution probability of natural flow in the ith time distribution interval, q is the distribution probability of the flow to be detected in the ith time distribution interval , N is the total number of time distribution intervals.

Optionally, before the step of judging whether there is traffic cheating in the traffic to be detected according to the cheating score, the method further includes:

Calculate the relative entropy value according to the traffic distribution data and the natural traffic distribution probability;

The step of judging whether there is traffic cheating in the traffic to be detected according to the cheating score includes:

According to the cheating score and the relative entropy value, it is determined whether there is traffic cheating in the to-be-detected traffic.

Optionally, the step of judging whether there is traffic cheating in the traffic to be detected according to the cheating score and the relative entropy value includes:

When the cheating score is greater than the preset cheating threshold and the relative entropy value is greater than the preset relative entropy threshold, it is determined that the traffic to be detected has traffic cheating;

When the cheating score is not greater than the preset cheating threshold or the relative entropy value is not greater than the preset relative entropy threshold, it is determined that there is no traffic cheating in the traffic to be detected.

Optionally, the step of judging whether there is traffic cheating in the traffic to be detected according to the cheating score includes:

When the cheating score is greater than a preset cheating threshold, it is determined that the flow to be detected has flow cheating;

When the cheating score is less than or equal to the preset cheating threshold, it is determined that there is no flow cheating in the traffic to be detected.

In addition, in order to achieve the above purpose, the present invention also provides a traffic cheating identification device, characterized in that the traffic cheating identification device includes:

The data acquisition module is used to acquire the natural traffic distribution probability and the traffic distribution data of the traffic to be detected;

a score calculation module, configured to determine the cheating score corresponding to the traffic to be detected according to the traffic distribution data and the natural traffic distribution probability;

A cheating identification module, configured to determine whether there is traffic cheating in the traffic to be detected according to the cheating score.

Optionally, the data acquisition module is further configured to determine the user's thinking duration according to the user operation information contained in the traffic to be detected; and determine the traffic distribution data of the traffic to be detected according to the user's thinking duration.

Optionally, the data acquisition module is further configured to acquire the user operation information contained in the traffic to be detected to determine the operation time of the adjacent user operation; determine the operation time difference of the adjacent user operation according to the operation time, and determine the operation time difference of the adjacent user operation. The above operation time difference is used as the corresponding user thinking time.

Optionally, the score calculation module is further configured to calculate the relative entropy value according to the traffic distribution data and the natural traffic distribution probability; when the relative entropy value satisfies the cheating score calculation condition, execute the The flow distribution data and the natural flow distribution probability determine the cheating score corresponding to the flow to be detected.

Optionally, the score calculation module is further configured to calculate a relative entropy value according to the flow distribution data and the natural flow distribution probability;

The cheating identification module is further configured to judge whether the flow to be detected has flow cheating according to the cheating score and the relative entropy value.

Optionally, the cheating identification module is further configured to determine that there is traffic cheating in the traffic to be detected when the cheating score is greater than a preset cheating threshold; when the cheating score is less than or equal to the preset cheating When the threshold is reached, it is determined that there is no traffic cheating in the traffic to be detected.

In addition, in order to achieve the above object, the present invention also provides a traffic cheating identification device, the traffic cheating identification device includes: a memory, a processor, and a traffic cheating identification device stored in the memory and running on the processor A program, when the traffic cheating identification program is executed by the processor, implements the steps of the traffic cheating identification method according to any one of the above.

In addition, in order to achieve the above object, the present invention also provides a computer-readable storage medium, where a traffic cheating identification program is stored on the computer-readable storage medium, and the flow cheating identification program is executed as described in any of the above. The steps of the traffic cheating identification method.

The invention obtains the natural flow distribution probability and the flow distribution data of the to-be-detected flow; determines the cheating score corresponding to the to-be-detected flow according to the flow distribution data and the natural flow distribution probability; Because the traffic distribution data of the traffic to be detected is compared with the natural traffic distribution probability obtained by big data statistics, the corresponding cheating score is obtained. The cheating score can represent the traffic distribution of the traffic to be detected and the natural traffic without traffic cheating. Therefore, according to the cheating score, it can be judged whether there is traffic cheating, which is beneficial to protect the legitimate rights and interests of traffic buyers.

Description of drawings

1 is a schematic structural diagram of an electronic device of a hardware operating environment involved in an embodiment of the present invention;

2 is a schematic flowchart of a first embodiment of a method for identifying traffic cheating according to the present invention;

3 is a schematic flowchart of a second embodiment of a traffic cheating identification method according to the present invention;

4 is a schematic flowchart of a third embodiment of a traffic cheating identification method according to the present invention;

FIG. 5 is a structural block diagram of the first embodiment of the apparatus for identifying traffic cheating according to the present invention.

The realization, functional characteristics and advantages of the present invention will be further described with reference to the accompanying drawings in conjunction with the embodiments.

Detailed ways

It should be understood that the specific embodiments described herein are only used to explain the present invention, but not to limit the present invention.

Referring to FIG. 1 , FIG. 1 is a schematic structural diagram of a device for identifying traffic cheating in a hardware operating environment according to an embodiment of the present invention.

As shown in FIG. 1 , the electronic device may include: a processor 1001 , such as a central processing unit (Central Processing Unit, CPU), a communication bus 1002 , a user interface 1003 , a network interface 1004 , and a memory 1005 . Among them, the communication bus 1002 is used to realize the connection and communication between these components. The user interface 1003 may include a display screen (Display), an input unit such as a keyboard (Keyboard), and the optional user interface 1003 may also include a standard wired interface and a wireless interface. Optionally, the network interface 1004 may include a standard wired interface and a wireless interface (such as a wireless fidelity (WIreless-FIdelity, WI-FI) interface). The memory 1005 may be a high-speed random access memory (Random Access Memory, RAM) memory, or may be a stable non-volatile memory (Non-Volatile Memory, NVM), such as a disk memory. Optionally, the memory 1005 may also be a storage device independent of the aforementioned processor 1001 .

Those skilled in the art can understand that the structure shown in FIG. 1 does not constitute a limitation on the electronic device, and may include more or less components than the one shown, or combine some components, or arrange different components.

As shown in FIG. 1 , the memory 1005 as a storage medium may include an operating system, a network communication module, a user interface module, and a traffic cheating identification program.

In the electronic device shown in FIG. 1, the network interface 1004 is mainly used for data communication with the network server; the user interface 1003 is mainly used for data interaction with the user; the processor 1001 and the memory 1005 in the electronic device of the present invention can be set in In the traffic fraud identification device, the electronic device invokes the traffic fraud identification program stored in the memory 1005 through the processor 1001, and executes the traffic fraud identification method provided by the embodiment of the present invention.

An embodiment of the present invention provides a method for identifying traffic cheating. Referring to FIG. 2 , FIG. 2 is a schematic flowchart of a first embodiment of a method for identifying traffic cheating according to the present invention.

In this embodiment, the traffic cheating identification method includes the following steps:

Step S10: Obtain the natural traffic distribution probability and the traffic distribution data of the traffic to be detected.

It should be noted that the execution body of this embodiment may be the traffic cheating identification device, and the traffic cheating identification device may be an electronic device such as a personal computer or a server, or may be other devices that can implement the same or similar functions. The embodiment does not limit this. In this embodiment and the following embodiments, the traffic fraud identification method of the present invention is described by taking a traffic fraud identification device as an example.

It should be noted that the natural traffic distribution probability may be the probability that the user's thinking time is distributed in each preset time distribution interval obtained by performing big data statistics on normal traffic without cheating phenomenon. The user's thinking time is the operation time difference between adjacent user operations, and the distribution probability is the ratio of the number of user's thinking time within the preset time distribution interval to the total user's thinking time. For example: two adjacent user operation times are: 9 :00:01, 9:00:03, the operation time difference is 2 seconds, the corresponding user thinking time is 2 seconds. The preset time distribution interval can be divided according to actual needs. For example, if the time distribution interval is divided into a time period of 3 seconds, the corresponding time distribution interval can be 0-3 seconds, 3-6 seconds, 6-9 seconds, etc., Can be written as [0,3), [3,6), [6,9).

It should be noted that the traffic to be detected may be traffic that needs to be detected whether there is traffic cheating. The traffic distribution data of the traffic to be detected may include the probability of traffic distribution and the number of traffic distribution, the number of traffic distribution is the number of the thinking time durations of each user corresponding to the traffic to be detected distributed in the preset time distribution interval, and the probability of traffic distribution is the corresponding to the traffic to be detected. The probability of each user's thinking time distribution within the preset time distribution interval.

Step S20: Determine a cheating score corresponding to the traffic to be detected according to the traffic distribution data and the natural traffic distribution probability.

It should be noted that the cheating score may be a quantitative score used to indicate the possibility of traffic cheating in the traffic to be detected.

Further, in order to facilitate the calculation of the cheating score, step S20 in this embodiment may be:

Obtain the traffic distribution probability and the traffic distribution quantity in the traffic distribution data; determine the cheating score corresponding to the traffic to be detected according to the traffic distribution probability, the traffic distribution quantity and the natural traffic distribution probability.

In actual use, the cheating score corresponding to the traffic to be detected may be determined by using the cheating score calculation formula according to the traffic distribution probability, the traffic distribution quantity and the natural traffic distribution probability.

The formula for calculating cheating points is:

In the formula, score is the cheating score, P(organicBin _i ) is the distribution probability of natural traffic in the ith time distribution interval, P(channelBin _i ) is the distribution probability of the traffic to be detected in the ith time distribution interval, and N is the distribution probability of the traffic to be detected in the ith time distribution interval. The distribution quantity of the detected traffic in the ith time distribution interval, P(organicBin _j ) is the distribution probability of the natural traffic in the jth time distribution interval, P(channelBin _j ) is the distribution of the traffic to be detected in the jth time distribution interval probability, M is the distribution quantity of the traffic to be detected in the jth time distribution interval.

For example, suppose the natural flow distribution probability is: the distribution probability of the first preset time distribution interval is 1/10, the distribution probability of the second preset time distribution interval is 4/10, and the distribution probability of the third preset time distribution interval is 2/10, and the distribution probability of the fourth preset time distribution interval is 3/10. The distribution probability of the traffic to be detected in the first preset time distribution interval is 1/3, the distribution quantity is 1, the distribution probability of the traffic to be detected in the fourth preset time distribution interval is 2/3, and the distribution quantity is 2, then calculate The cheating score score=[(1/3-1/10)*1+(2/3-3/10)*2]/(1+2)=0.322.

Step S30: Determine whether there is traffic cheating in the traffic to be detected according to the cheating score.

It should be noted that, under the condition that the experiment is unchanged, the frequency of the random event is approximated to its probability by repeating the experiment many times. When the actual purchase traffic reaches a certain level, the distribution of the user's thinking time should be consistent with the distribution in the natural traffic. Therefore, the higher the cheating score, the larger the distribution gap between the traffic to be detected and the natural traffic. The value can determine whether there is traffic cheating in the traffic to be detected.

In actual use, the cheating threshold can be preset. When the cheating score is greater than the preset cheating threshold, it is determined that there is traffic cheating in the traffic to be detected; when the cheating score is less than or equal to the preset cheating threshold, it is determined that there is no traffic in the traffic to be detected. Cheating.

For example, the preset cheating threshold is 0.4. When the calculated cheating score is greater than 0.4, it is determined that there is traffic cheating in the traffic to be detected. When the calculated cheating score is less than or equal to 0.4, it is determined that there is no traffic cheating in the traffic to be detected.

In this embodiment, the natural traffic distribution probability and the traffic distribution data of the to-be-detected traffic are obtained; the cheating score corresponding to the to-be-detected traffic is determined according to the traffic distribution data and the natural traffic distribution probability; and whether the to-be-detected traffic has traffic cheating is determined according to the cheating score. Since the traffic distribution data of the traffic to be detected is compared with the natural traffic distribution probability obtained by big data statistics, the corresponding cheating score is obtained. The cheating score can represent the traffic distribution of the traffic to be detected and the natural traffic without traffic cheating. Therefore, according to the cheating score, it can be judged whether there is traffic cheating, which is beneficial to protect the legitimate rights and interests of traffic buyers.

Referring to FIG. 3 , FIG. 3 is a schematic flowchart of a second embodiment of a traffic cheating identification method according to the present invention.

Based on the above-mentioned first embodiment, before the step S10, the method for identifying traffic cheating in this embodiment further includes:

Step S01: Determine the user thinking time period according to the user operation information included in the traffic to be detected.

It should be noted that the user operation information may include user operation type, user operation time and other information.

Further, in order to determine the user's thinking time, step S01 in this embodiment may be:

Obtain the user operation information contained in the traffic to be detected to determine the operation time of adjacent user operations; determine the operation time difference of the adjacent user operations according to the operation time, and use the operation time difference as the corresponding user thinking time.

For example, according to the user operation information, it can be determined that user A has a total of three operations, and the operation times are: 9:00:00, 9:00:02, and 9:00:03, then there are two corresponding user thinking times, one for the user Thinking time A, 2 seconds, user thinking time B, 1 second.

Step S02: Determine the traffic distribution data of the traffic to be detected according to the user's thinking time.

It can be understood that the traffic distribution data may include the number of traffic distributions and the probability of traffic distribution, and the corresponding number of traffic distributions and probability of traffic distribution can be obtained by grouping the time distribution durations according to the preset time distribution interval and calculating the corresponding number of traffic distributions and probability of traffic distribution. The traffic distribution data of the traffic to be detected can be determined by combining with the traffic distribution probability.

In actual use, the user's thinking time can be grouped according to the preset time distribution interval, and the number of the user's thinking time corresponding to each preset time distribution interval is used as the corresponding traffic distribution quantity; Determine the traffic distribution probability of each preset time distribution interval; determine the traffic distribution data of the traffic to be detected according to the traffic distribution probability and the traffic distribution quantity.

For example, the time distribution interval is divided into a period of 3 seconds, and there are 4 preset time distribution intervals: the first time distribution interval [0,3), the second time distribution interval [3,6), and the third time distribution interval [6 ,9), the fourth time distribution interval [9,12); there are 6 user operations, and the operation times are: 9:00:00, 9:00:02, 9:00:03, 9:00:07, 9:00:17, 9:00:00, the user thinks for a total of 5 times, denoted as A, B, C, D, E, and the user thinks for 2 seconds, 1 second, 4 seconds, 7 seconds, 10 seconds, the user thinking time corresponding to the first time distribution interval is A and B, and the number of distributions is 2; the user thinking time corresponding to the second time distribution interval is C, the distribution number is 1, and the third time distribution interval corresponds to The user’s thinking time is D, the number of distributions is 1, the user’s thinking time corresponding to the fourth time distribution interval is E, and the number of distributions is 1, then the distribution probability corresponding to each time distribution interval is 2/5, 1/5, 1/5, 1/5, 1/5.

Further, in order to determine whether the cheating score needs to be calculated, before step S20 in this embodiment, the method may further include:

Calculate the relative entropy value according to the traffic distribution data and the natural traffic distribution probability; when the relative entropy value satisfies the cheating score calculation condition, execute the determining according to the traffic distribution data and the natural traffic distribution probability. Describe the steps of the cheating score corresponding to the traffic to be detected.

It should be noted that not all traffic needs to be calculated for cheating score. The relative entropy value corresponding to the traffic to be detected can be calculated first, and the relative entropy value can be used to evaluate the possibility of traffic cheating in the traffic to be detected. When the score calculation condition is used, that is, when the possibility of traffic cheating is high, the calculated cheat score is used to determine whether there is traffic cheating in the traffic to be detected.

In actual use, a relative entropy threshold may be preset, and when the calculated relative entropy value is greater than the preset relative entropy threshold, it is determined that the relative entropy value satisfies the cheating score calculation condition.

For example, the preset relative entropy threshold is 0.5, and the calculated relative entropy value is 0.6. At this time, it is determined that the relative entropy value satisfies the cheating score calculation conditions, and the cheating score can be calculated to determine whether there is traffic cheating in the traffic to be detected.

Further, in order to facilitate the calculation of the relative entropy value, the step of calculating the relative entropy value according to the traffic distribution data and the natural traffic distribution probability in this embodiment may be:

Obtain the traffic distribution probability in the traffic distribution data; calculate the relative entropy value according to the traffic distribution probability and the natural traffic distribution probability.

In actual use, the relative entropy value can be calculated by the relative entropy calculation formula according to the flow distribution probability and the natural flow distribution probability;

The relative entropy calculation formula is:

In the formula, D _KL (p||q) is the relative entropy value, p(x _i ) is the distribution probability of natural flow in the ith time distribution interval, q is the distribution probability of the flow to be detected in the ith time distribution interval , N is the total number of time distribution intervals.

In this embodiment, the user's thinking duration is determined according to the user operation information included in the traffic to be detected, and the traffic distribution data of the traffic to be detected is determined according to the user's thinking duration. Various data required for calculating cheating points can be constructed in advance, which is convenient for calculating cheating points and improves the efficiency of calculating cheating points.

Referring to FIG. 4 , FIG. 4 is a schematic flowchart of a third embodiment of a traffic cheating identification method according to the present invention.

Based on the above-mentioned first embodiment, before the step S30, the method for identifying traffic cheating in this embodiment further includes:

Step S201: Calculate a relative entropy value according to the flow distribution data and the natural flow distribution probability;

Further, in order to facilitate the calculation of the relative entropy value, step S201 in this embodiment may be:

Obtain the traffic distribution probability in the traffic distribution data; calculate the relative entropy value according to the traffic distribution probability and the natural traffic distribution probability.

In actual use, the relative entropy value can be calculated by the relative entropy calculation formula according to the flow distribution probability and the natural flow distribution probability;

The relative entropy calculation formula is:

In the formula, D _KL (p||q) is the relative entropy value, p(x _i ) is the distribution probability of natural flow in the ith time distribution interval, q is the distribution probability of the flow to be detected in the ith time distribution interval , N is the total number of time distribution intervals.

Correspondingly, the step S30 in this embodiment includes:

Step S30': Determine whether there is traffic cheating in the traffic to be detected according to the cheating score and the relative entropy value.

It is understandable that there may be a misjudgment of the traffic to be detected only by the cheating score. Therefore, the relative entropy value can be calculated, and the relative entropy value and the cheating score can be used to determine whether there is traffic cheating in the traffic to be detected. more precise.

In actual use, the cheating threshold and the preset relative entropy threshold can be preset, and when the cheating score is greater than the preset cheating threshold and the relative entropy value is greater than the preset relative entropy threshold, it is determined that there is traffic cheating in the traffic to be detected; When it is not greater than the preset cheating threshold or the relative entropy value is not greater than the preset relative entropy threshold, it is determined that there is no traffic cheating in the traffic to be detected.

For example: the preset cheating threshold is 0.4, the preset relative entropy threshold is 0.5, when the cheating score of the traffic to be detected is 0.6, and the relative entropy value is 0.7, it is determined that there is traffic cheating in the traffic to be detected, and the cheating score of the traffic to be detected is determined. When the value is 0.3 and the relative entropy value is 0.6, it is determined that there is no traffic cheating in the traffic to be detected. When the cheating score of the traffic to be detected is 0.5 and the relative entropy value is 0.4, it is determined that there is no traffic cheating in the traffic to be detected. When the fraud score of the traffic is 0.3 and the relative entropy value is 0.3, it is determined that there is no traffic fraud in the traffic to be detected.

In this embodiment, the relative entropy value is calculated according to the traffic distribution data and the natural traffic distribution probability, and then it is judged whether the traffic to be detected has traffic cheating according to the cheating score and the relative entropy value. At the same time, the cheating score and relative entropy value are used to judge whether there is traffic cheating in the traffic to be detected, which makes the traffic cheating judgment more accurate and less easy to be cracked by the traffic cheating party, and improves the accuracy and reliability of the traffic cheating identification method.

In addition, an embodiment of the present invention further provides a storage medium, where a traffic cheating identification program is stored thereon, and when the flow cheating identification program is executed by a processor, the steps of the traffic cheating identification method as described above are implemented.

Referring to FIG. 5 , FIG. 5 is a structural block diagram of the first embodiment of the apparatus for identifying traffic cheating according to the present invention.

As shown in FIG. 5 , the device for identifying traffic cheating provided by the embodiment of the present invention includes:

The data acquisition module 501 is used for acquiring the natural traffic distribution probability and the traffic distribution data of the traffic to be detected;

A score calculation module 502, configured to determine the cheating score corresponding to the traffic to be detected according to the traffic distribution data and the natural traffic distribution probability;

The cheating identification module 503 is configured to judge whether the flow to be detected has flow cheating according to the cheating score.

In this embodiment, the natural traffic distribution probability and the traffic distribution data of the to-be-detected traffic are obtained; the cheating score corresponding to the to-be-detected traffic is determined according to the traffic distribution data and the natural traffic distribution probability; and whether the traffic to be detected has traffic cheating is determined according to the cheating score. Because the traffic distribution data of the traffic to be detected is compared with the natural traffic distribution probability obtained by big data statistics, the corresponding cheating score is obtained. The cheating score can represent the traffic distribution of the traffic to be detected and the natural traffic without traffic cheating. Therefore, according to the cheating score, it can be judged whether there is traffic cheating, which is beneficial to protect the legitimate rights and interests of traffic buyers.

Further, the data acquisition module 501 is further configured to determine the user's thinking duration according to the user operation information contained in the traffic to be detected; and determine the traffic distribution data of the traffic to be detected according to the user's thinking duration.

Further, the data acquisition module 501 is further configured to acquire the user operation information contained in the traffic to be detected to determine the operation time of adjacent user operations; determine the operation time difference of the adjacent user operations according to the operation time, The above operation time difference is used as the corresponding user thinking time.

Further, the data acquisition module 501 is further configured to group the user thinking durations according to preset time distribution intervals, and use the number of user thinking durations corresponding to each preset time distribution interval as the corresponding traffic distribution quantity; The traffic distribution number and the total number of user thinking time determine the traffic distribution probability of each preset time distribution interval; the traffic distribution data of the traffic to be detected is determined according to the traffic distribution probability and the traffic distribution number.

Further, the score calculation module 502 is further configured to obtain the flow distribution probability and the flow distribution quantity in the flow distribution data; determine the flow distribution probability according to the flow distribution probability, the flow distribution quantity and the natural flow distribution probability. Fraud score corresponding to the traffic to be detected.

Further, the score calculation module 502 is further configured to determine the cheating score corresponding to the traffic to be detected through the cheating score calculation formula according to the traffic distribution probability, the traffic distribution quantity and the natural traffic distribution probability. ;

The formula for calculating the cheating score is:

In the formula, score is the cheating score, P(organicBin _i ) is the distribution probability of natural traffic in the ith time distribution interval, P(channelBin _i ) is the distribution probability of the traffic to be detected in the ith time distribution interval, and N is the distribution probability of the traffic to be detected in the ith time distribution interval. The distribution quantity of the detected traffic in the ith time distribution interval, P(organicBin _j ) is the distribution probability of the natural traffic in the jth time distribution interval, P(channelBin _j ) is the distribution of the traffic to be detected in the jth time distribution interval probability, M is the distribution quantity of the traffic to be detected in the jth time distribution interval.

Further, the score calculation module 502 is further configured to calculate the relative entropy value according to the traffic distribution data and the natural traffic distribution probability; when the relative entropy value satisfies the cheating score calculation condition, execute the The flow distribution data and the natural flow distribution probability determine the cheating score corresponding to the flow to be detected.

Further, the score calculation module 502 is further configured to obtain the traffic distribution probability in the traffic distribution data; calculate the relative entropy value according to the traffic distribution probability and the natural traffic distribution probability.

Further, the score calculation module 502 is further configured to calculate the relative entropy value through the relative entropy calculation formula according to the flow distribution probability and the natural flow distribution probability;

The relative entropy calculation formula is:

In the formula, D _KL (p||q) is the relative entropy value, p(x _i ) is the distribution probability of natural flow in the ith time distribution interval, q is the distribution probability of the flow to be detected in the ith time distribution interval , N is the total number of time distribution intervals.

Further, the score calculation module 502 is further configured to calculate the relative entropy value according to the flow distribution data and the natural flow distribution probability;

The cheating identification module 503 is further configured to judge whether the flow to be detected has flow cheating according to the cheating score and the relative entropy value.

Further, the cheating identification module 503 is further configured to determine that the flow to be detected has flow cheating when the cheating score is greater than a preset cheating threshold and the relative entropy value is greater than a preset relative entropy threshold; When the cheating score is not greater than the preset cheating threshold or the relative entropy value is not greater than the preset relative entropy threshold, it is determined that there is no traffic cheating in the traffic to be detected.

Further, the cheating identification module 503 is further configured to determine that there is traffic cheating in the traffic to be detected when the cheating score is greater than a preset cheating threshold; when the cheating score is less than or equal to the preset cheating When the threshold is reached, it is determined that there is no traffic cheating in the traffic to be detected.

It should be understood that the above are only examples, and do not constitute any limitation to the technical solutions of the present invention. In specific applications, those skilled in the art can make settings as required, which is not limited by the present invention.

It should be noted that the above-described workflow is only illustrative, and does not limit the protection scope of the present invention. In practical applications, those skilled in the art can select some or all of them to implement according to actual needs. The purpose of the solution in this embodiment is not limited here.

In addition, for technical details that are not described in detail in this embodiment, reference may be made to the traffic cheating identification method provided by any embodiment of the present invention, and details are not repeated here.

Furthermore, it should be noted that, herein, the terms "comprising", "comprising" or any other variation thereof are intended to encompass non-exclusive inclusion, such that a process, method, article or system comprising a series of elements includes not only those elements, but also other elements not expressly listed or inherent to such a process, method, article or system. Without further limitation, an element qualified by the phrase "comprising a..." does not preclude the presence of additional identical elements in the process, method, article or system that includes the element.

The above-mentioned serial numbers of the embodiments of the present invention are only for description, and do not represent the advantages or disadvantages of the embodiments.

From the description of the above embodiments, those skilled in the art can clearly understand that the method of the above embodiment can be implemented by means of software plus a necessary general hardware platform, and of course can also be implemented by hardware, but in many cases the former is better implementation. Based on such understanding, the technical solutions of the present invention can be embodied in the form of software products in essence or the parts that make contributions to the prior art, and the computer software products are stored in a storage medium (such as a read-only memory). , ROM)/RAM, magnetic disk, optical disk), including several instructions to make a terminal device (which may be a mobile phone, a computer, a server, or a network device, etc.) execute the methods described in the various embodiments of the present invention.

The above are only preferred embodiments of the present invention, and are not intended to limit the scope of the present invention. Any equivalent structure or equivalent process transformation made by using the contents of the description and drawings of the present invention, or directly or indirectly applied in other related technical fields , are similarly included in the scope of patent protection of the present invention.

The present invention discloses A1, a method for identifying traffic cheating. The method for identifying traffic cheating includes the following steps:

Obtain the natural traffic distribution probability and the traffic distribution data of the traffic to be detected;

Determine the cheating score corresponding to the traffic to be detected according to the traffic distribution data and the natural traffic distribution probability;

Determine whether there is traffic fraud in the traffic to be detected according to the fraud score.

A2. The method for identifying traffic cheating according to A1, before the step of acquiring the natural traffic distribution probability and the traffic distribution data of the traffic to be detected, further comprising:

Determine the user's thinking time according to the user operation information contained in the traffic to be detected;

The traffic distribution data of the traffic to be detected is determined according to the user's thinking time.

A3. The method for identifying traffic cheating according to A2, wherein the step of determining the user's thinking time according to the user operation information contained in the traffic to be detected includes:

Obtain the user operation information contained in the traffic to be detected to determine the operation time of adjacent user operations;

The operation time difference between adjacent user operations is determined according to the operation time, and the operation time difference is used as the corresponding user thinking time period.

A4. The method for identifying traffic cheating according to A2, wherein the step of determining the traffic distribution data of the traffic to be detected according to the user's thinking time includes:

Group the user thinking durations according to preset time distribution intervals, and use the number of user thinking durations corresponding to each preset time distribution interval as the corresponding traffic distribution number;

Determine the traffic distribution probability of each preset time distribution interval according to the traffic distribution quantity and the total number of user thinking time;

The flow distribution data of the flow to be detected is determined according to the flow distribution probability and the flow distribution quantity.

A5. The traffic cheating identification method according to A1, wherein the step of determining the cheating score corresponding to the traffic to be detected according to the traffic distribution data and the natural traffic distribution probability includes:

obtaining the traffic distribution probability and the traffic distribution quantity in the traffic distribution data;

The cheating score corresponding to the traffic to be detected is determined according to the traffic distribution probability, the traffic distribution quantity and the natural traffic distribution probability.

A6. The method for identifying traffic cheating according to A5, wherein the step of determining the cheating score corresponding to the traffic to be detected according to the traffic distribution probability, the traffic distribution quantity and the natural traffic distribution probability includes:

According to the traffic distribution probability, the traffic distribution quantity and the natural traffic distribution probability, the cheating score corresponding to the traffic to be detected is determined by the cheating score calculation formula;

The formula for calculating the cheating score is:

In the formula, score is the cheating score, P(organicBin _i ) is the distribution probability of natural traffic in the ith time distribution interval, P(channelBin _i ) is the distribution probability of the traffic to be detected in the ith time distribution interval, and N is the distribution probability of the traffic to be detected in the ith time distribution interval. The distribution quantity of the detected traffic in the ith time distribution interval, P(organicBin _j ) is the distribution probability of the natural traffic in the jth time distribution interval, P(channelBin _j ) is the distribution of the traffic to be detected in the jth time distribution interval probability, M is the distribution quantity of the traffic to be detected in the jth time distribution interval.

A7. The traffic cheating identification method according to A1, before the step of determining the cheating score corresponding to the traffic to be detected according to the traffic distribution data and the natural traffic distribution probability, further comprising:

Calculate the relative entropy value according to the traffic distribution data and the natural traffic distribution probability;

When the relative entropy value satisfies the cheating score calculation condition, the step of determining the cheating score corresponding to the traffic to be detected according to the traffic distribution data and the natural traffic distribution probability is performed.

A8. The method for identifying traffic cheating according to A7, wherein the step of calculating the relative entropy value according to the traffic distribution data and the natural traffic distribution probability includes:

obtaining the traffic distribution probability in the traffic distribution data;

The relative entropy value is calculated according to the flow distribution probability and the natural flow distribution probability.

A9. The method for identifying traffic cheating according to A8, wherein the step of calculating the relative entropy value according to the traffic distribution probability and the natural traffic distribution probability includes:

Calculate the relative entropy value through the relative entropy calculation formula according to the flow distribution probability and the natural flow distribution probability;

The relative entropy calculation formula is:

In the formula, D _KL (p||q) is the relative entropy value, p(x _i ) is the distribution probability of natural flow in the ith time distribution interval, q is the distribution probability of the flow to be detected in the ith time distribution interval , N is the total number of time distribution intervals.

A10. The method for identifying traffic cheating according to A1, before the step of judging whether there is traffic cheating in the traffic to be detected according to the cheating score, further comprising:

Calculate the relative entropy value according to the traffic distribution data and the natural traffic distribution probability;

The step of judging whether there is traffic cheating in the traffic to be detected according to the cheating score includes:

According to the cheating score and the relative entropy value, it is determined whether there is traffic cheating in the to-be-detected traffic.

A11. The method for identifying traffic fraud according to A10, wherein the step of judging whether the traffic to be detected has traffic fraud according to the fraud score and the relative entropy value includes:

When the cheating score is greater than the preset cheating threshold and the relative entropy value is greater than the preset relative entropy threshold, it is determined that the traffic to be detected has traffic cheating;

When the cheating score is not greater than the preset cheating threshold or the relative entropy value is not greater than the preset relative entropy threshold, it is determined that there is no traffic cheating in the traffic to be detected.

A12. The method for identifying traffic cheating according to any one of A1-A9, wherein the step of judging whether there is traffic cheating in the traffic to be detected according to the cheating score includes:

When the cheating score is greater than a preset cheating threshold, it is determined that the flow to be detected has flow cheating;

When the cheating score is less than or equal to the preset cheating threshold, it is determined that there is no flow cheating in the traffic to be detected.

The present invention discloses B13, a traffic cheating identification device, and the traffic cheating identification device includes:

The data acquisition module is used to acquire the natural traffic distribution probability and the traffic distribution data of the traffic to be detected;

a score calculation module, configured to determine the cheating score corresponding to the traffic to be detected according to the traffic distribution data and the natural traffic distribution probability;

A cheating identification module, configured to determine whether there is traffic cheating in the traffic to be detected according to the cheating score.

B14. The device for identifying traffic cheating according to B13, wherein the data acquisition module is further configured to determine the user's thinking time according to the user operation information contained in the traffic to be detected; and determine the traffic distribution data of the to-be-detected traffic according to the user's thinking time .

B15. The device for identifying traffic cheating according to B13, wherein the data acquisition module is further configured to acquire user operation information included in the traffic to be detected to determine the operation time of adjacent user operations; determine the adjacent user operation time according to the operation time The operation time difference of the user operation is used as the corresponding user thinking time period.

B16. The traffic cheating identification device according to B13, the score calculation module is further configured to calculate a relative entropy value according to the traffic distribution data and the natural traffic distribution probability; when the relative entropy value satisfies the cheating score When calculating the condition, the step of determining the cheating score corresponding to the traffic to be detected according to the traffic distribution data and the natural traffic distribution probability is performed.

B17. The traffic cheating identification device according to B13, wherein the score calculation module is further configured to calculate a relative entropy value according to the traffic distribution data and the natural traffic distribution probability;

The cheating identification module is further configured to judge whether the flow to be detected has flow cheating according to the cheating score and the relative entropy value.

B18. The device for identifying traffic cheating according to B13, wherein the cheating identification module is further configured to determine that there is traffic cheating in the traffic to be detected when the cheating score is greater than a preset cheating threshold; When it is less than or equal to the preset cheating threshold, it is determined that there is no flow cheating in the to-be-detected flow.

The present invention discloses C19, a traffic cheating identification device. The traffic cheating identification device includes: a memory, a processor, and a traffic cheating identification program stored in the memory and running on the processor. When the cheating identification program is executed by the processor, the steps of the traffic cheating identification method as described above are implemented.

The present invention discloses D20, a computer-readable storage medium, characterized in that a traffic cheating identification program is stored on the computer-readable storage medium, and the traffic cheating identification method as described above is implemented when the flow cheating identification program is executed. A step of.

Claims (10)

1. a traffic cheating identification method, is characterized in that, described traffic cheating identification method comprises the following steps: Obtain the natural traffic distribution probability and the traffic distribution data of the traffic to be detected; Determine the cheating score corresponding to the traffic to be detected according to the traffic distribution data and the natural traffic distribution probability; Determine whether there is traffic fraud in the traffic to be detected according to the fraud score. 2. The method for identifying traffic cheating as claimed in claim 1, wherein before the step of obtaining the natural traffic distribution probability and the traffic distribution data of the traffic to be detected, the method further comprises: Determine the user's thinking time according to the user operation information contained in the traffic to be detected; The traffic distribution data of the traffic to be detected is determined according to the user's thinking time. 3. The method for identifying traffic cheating as claimed in claim 2, wherein the step of determining the user's thinking duration according to the user operation information contained in the traffic to be detected comprises: Obtain the user operation information contained in the traffic to be detected to determine the operation time of adjacent user operations; The operation time difference between adjacent user operations is determined according to the operation time, and the operation time difference is used as the corresponding user thinking time period. 4. The method for identifying traffic cheating according to claim 2, wherein the step of determining the traffic distribution data of the traffic to be detected according to the user's thinking time length comprises: Group the user thinking durations according to preset time distribution intervals, and use the number of user thinking durations corresponding to each preset time distribution interval as the corresponding traffic distribution number; Determine the traffic distribution probability of each preset time distribution interval according to the traffic distribution quantity and the total number of user thinking time; The flow distribution data of the flow to be detected is determined according to the flow distribution probability and the flow distribution quantity. 5. The method for identifying traffic cheating according to claim 1, wherein the step of determining the cheating score corresponding to the traffic to be detected according to the traffic distribution data and the natural traffic distribution probability comprises: obtaining the traffic distribution probability and the traffic distribution quantity in the traffic distribution data; The cheating score corresponding to the traffic to be detected is determined according to the traffic distribution probability, the traffic distribution quantity and the natural traffic distribution probability. 6. The traffic cheating identification method according to claim 5, wherein the step of determining the cheating score corresponding to the traffic to be detected according to the traffic distribution probability, the traffic distribution quantity and the natural traffic distribution probability ,include: According to the traffic distribution probability, the traffic distribution quantity and the natural traffic distribution probability, the cheating score corresponding to the traffic to be detected is determined by the cheating score calculation formula; The formula for calculating the cheating score is:

In the formula, score is the cheating score, P(organicBin _i ) is the distribution probability of natural traffic in the ith time distribution interval, P(channelBin _i ) is the distribution probability of the traffic to be detected in the ith time distribution interval, and N is the distribution probability of the traffic to be detected in the ith time distribution interval. The distribution quantity of the detected traffic in the ith time distribution interval, P(organicBin _j ) is the distribution probability of the natural traffic in the jth time distribution interval, P(channelBin _j ) is the distribution of the traffic to be detected in the jth time distribution interval probability, M is the distribution quantity of the traffic to be detected in the jth time distribution interval. 7. The method for identifying traffic cheating according to claim 1, wherein before the step of determining the cheating score corresponding to the traffic to be detected according to the traffic distribution data and the natural traffic distribution probability, the method further comprises: : Calculate the relative entropy value according to the traffic distribution data and the natural traffic distribution probability; When the relative entropy value satisfies the cheating score calculation condition, the step of determining the cheating score corresponding to the traffic to be detected according to the traffic distribution data and the natural traffic distribution probability is performed. 8. A traffic cheating identification device, characterized in that, the traffic cheating identification device comprises: The data acquisition module is used to acquire the natural traffic distribution probability and the traffic distribution data of the traffic to be detected; a score calculation module, configured to determine the cheating score corresponding to the traffic to be detected according to the traffic distribution data and the natural traffic distribution probability; A cheating identification module, configured to determine whether there is traffic cheating in the traffic to be detected according to the cheating score. 9. A traffic cheating identification device, characterized in that, the traffic cheating identification device comprises: a memory, a processor, and a traffic cheating identification program stored on the memory and running on the processor, the traffic When the cheating identification program is executed by the processor, the steps of the traffic cheating identification method according to any one of claims 1-7 are implemented. 10. A computer-readable storage medium, wherein a traffic cheating identification program is stored on the computer-readable storage medium, and the flow cheating identification program is executed as described in any one of claims 1-7. The steps of the traffic cheating identification method.

Images