Detailed Description
In order to more clearly illustrate the technical solution of the embodiments of the present invention, the drawings that are required to be used in the description of the embodiments will be briefly described below. It is apparent that the drawings in the following description are only some examples or embodiments of the present invention, and it is apparent to those of ordinary skill in the art that the present invention may be applied to other similar situations according to the drawings without inventive effort. Unless otherwise apparent from the context of the language or otherwise specified, like reference numerals in the figures refer to like structures or operations.
It will be appreciated that "system," "apparatus," "unit" and/or "module" as used herein is one method for distinguishing between different components, elements, parts, portions or assemblies of different levels. However, if other words can achieve the same purpose, the words can be replaced by other expressions.
As used in the specification and in the claims, the terms "a," "an," "the," and/or "the" are not specific to a singular, but may include a plurality, unless the context clearly dictates otherwise. In general, the terms "comprises" and "comprising" merely indicate that the steps and elements are explicitly identified, and they do not constitute an exclusive list, as other steps or elements may be included in a method or apparatus.
A flowchart is used in the present invention to describe the operations performed by a system according to embodiments of the present invention. It should be appreciated that the preceding or following operations are not necessarily performed in order precisely. Rather, the steps may be processed in reverse order or simultaneously. Also, other operations may be added to or removed from these processes.
Aiming at the problems in the background art, the inventor provides a digital business analysis method and a cloud server based on big data, which can analyze business vulnerability classification characteristics of different business vulnerability category items of digital interaction service items, further ensure the integrity of business vulnerability detection results of the digital interaction service items and avoid abnormal subsequent digital service interaction caused by missing detection and false detection of individual business vulnerabilities.
First, referring to fig. 1, which is a flowchart illustrating an exemplary big data based digital service analysis method and/or process according to some embodiments of the present invention, the big data based digital service analysis method may include the following technical solutions described in step S10 and step S20.
S10, based on the received digital business interaction data uploaded by each digital business device, determining digital interaction service items corresponding to the interaction operation label information in the digital business interaction data, and acquiring a plurality of groups of digital business interaction data of the digital interaction service items recorded by each digital business device in a preset vulnerability detection period;
in this embodiment, the method may be applied to a cloud server communicatively connected to a plurality of digital service devices, where the cloud server may provide different digital service services for the digital service devices, and the digital service services may relate to a plurality of service fields in daily production and life, such as digital shopping service, digital cloud office service, digital cloud education service, digital cloud game service, digital government enterprise service, digital internet of things service, digital platform operation and maintenance service, and the like, which are not limited herein.
In general, the cloud server may be a cloud server or a cloud server cluster, the digital service interaction device may be an intelligent electronic device with a service interaction function (such as a visual interaction function), such as a mobile phone, a tablet computer, a notebook computer, etc., which is not limited herein, and on the basis, the digital service interaction data may be service interaction data generated in a process of communication between the digital service devices or in a process of communication between the digital service devices and the cloud server, where the digital service interaction data has bi-directionality, and can reflect detailed interaction situations of both service interaction parties.
Further, the interactive operation tag information is used for distinguishing different interactive operations. For example, in the digital shopping service, the interactive operation tag information "a1" may represent a ordering operation, the interactive operation tag information "a2" may represent a return operation, and the interactive operation tag information "a3" may represent a complaint operation. In the digital government enterprise service, the interactive operation tag information "b1" may represent a query operation, the interactive operation tag information "b2" may represent an upload operation, and the interactive operation tag information "b3" may represent a download operation. In the digital platform operation and maintenance service, the interactive operation label information 'c 1' can represent software testing operation, the interactive operation label information 'c 2' can represent script repairing operation, and the interactive operation label information 'c 3' can represent product online operation.
It can be understood that different interactive operation tag information may correspond to different interactive operation and digital interactive service items, so that the corresponding digital interactive service items can be accurately positioned through the interactive operation tag information in the digital business interactive data, thereby realizing classification processing of vulnerability detection, ensuring integrity of vulnerability detection, and avoiding omission and false detection.
In the actual implementation process, the preset vulnerability detection period may be determined according to the vulnerability event recorded by the cloud server, for example, in a past period of time, if the vulnerability event recorded by the cloud server is x1 pieces, the preset vulnerability detection period may be t1, and if the vulnerability event recorded by the cloud server is x2 pieces, the preset vulnerability detection period may be t2. By means of the design, the integrity of the digital business interaction data can be ensured based on the digital business equipment side by acquiring the plurality of groups of digital business interaction data of the digital interaction service matters recorded by the digital business equipment in the preset vulnerability detection period.
It can be understood that the digital service interaction data obtained by the cloud server are divided into two types, the first type of data is uploaded by each digital service device, the second type of data is recorded by each digital service device in a preset vulnerability detection period and corresponds to the digital interaction service item, in colloquial terms, the cloud server can determine the corresponding digital interaction service item m1 according to the uploaded digital service interaction data1, and determine the corresponding digital interaction service item m1 based on the digital service interaction data1 to obtain multiple groups of digital service interaction data12 of the digital interaction service item m1 recorded by each digital service device in the preset vulnerability detection period, in this embodiment, the digital service interaction data1 and the multiple groups of digital service interaction data12 may or may not overlap, and in particular, analysis can be performed based on actual conditions, which is not limited.
Based on the foregoing, in some possible embodiments, in order to completely obtain multiple sets of digital service interaction data of digital service items so as to implement subsequent service vulnerability detection, the step of determining, based on the received digital service interaction data uploaded by each digital service device, a digital service item corresponding to interaction operation tag information in the digital service interaction data, and obtaining multiple sets of digital service interaction data of the digital service item recorded by each digital service device in a preset vulnerability detection period may include the following steps: receiving digital business interaction data uploaded by each digital business device, wherein the digital business interaction data comprises interaction operation label information of digital interaction service matters, and an information generation period and an information generation mode of the interaction operation label information; and determining corresponding digital interaction service items according to the interaction operation label information in the digital service interaction data aiming at each received set of digital service interaction data, and obtaining a plurality of sets of digital service interaction data of the digital interaction service items recorded by each digital service device in a preset vulnerability detection period.
For example, the information generating period of the interactive operation tag information may be used to indicate when the interactive operation tag information is generated, and the information generating manner of the interactive operation tag information may be used to distinguish the generating manner of the interactive operation tag information, such as whether the interactive operation tag information is generated in real time or delayed, and whether the interactive operation tag information is generated in a business interaction process or a non-business interaction process, which is not limited herein.
On the basis of the above, the digital interaction service items of each group of digital service interaction data can be positioned, and then multiple groups of digital service interaction data of the digital interaction service items recorded by each digital service device in a preset vulnerability detection period are acquired, so that multiple groups of digital service interaction data of different digital interaction service items recorded by each digital service device in the preset vulnerability detection period can be ensured to be completely acquired.
For example, for the digitized business interaction data1, the corresponding digitized interaction service item may be the digitized interaction service item m1, and further, multiple sets of digitized business interaction data of the digitized interaction service item m1 recorded by each digitized business device in the preset vulnerability detection period may be data12. For another example, for the digitized business interaction data2, the corresponding digitized interaction service item may be the digitized interaction service item m2, and further, multiple sets of digitized business interaction data of the digitized interaction service item m2 recorded by each digitized business device in the preset vulnerability detection period may be data22. For another example, for the digitized business interaction data3, the corresponding digitized interaction service item may be the digitized interaction service item m3, and further, multiple sets of digitized business interaction data of the digitized interaction service item m3 recorded by each digitized business device in the preset vulnerability detection period may be data32.
By the design, corresponding digital interaction service items can be determined based on different digital service interaction data, and complete multiple groups of digital service interaction data of the digital interaction service items can be further obtained, so that multiple types of service vulnerability analysis and detection can be conveniently carried out subsequently, and missing detection and false detection are avoided.
S20, determining business vulnerability classification characteristics of at least one business vulnerability category item of the digital interaction service item according to information generation time periods and information generation modes in the plurality of groups of digital business interaction data of the digital interaction service item, and determining a business vulnerability detection result of the digital interaction service item.
In the actual implementation process, each set of digital business interaction data in the plurality of sets of digital business interaction data of the digital interaction service item also comprises the corresponding interactive operation label information of the digital interaction service item, and the information generation period and the information generation mode of the interactive operation label information, and as each digital interaction service item corresponds to the plurality of sets of digital business interaction data, the business vulnerability classification characteristics of at least one business vulnerability category item of the digital interaction service item can be determined.
For example, business vulnerability category items may include a wide variety of items, such as, but not limited to, multi-terminal interaction scenario category items, associated business category items, operational behavior category items, and network delay category items. The business vulnerability classification features can be used for describing business vulnerability situations of different business vulnerability category items, so that the business vulnerability detection results of digital interaction service items can be conveniently carried out later. In the subsequent implementation process, business vulnerability detection can be respectively performed based on the multi-terminal interaction scene category item, the associated business category item, the operation behavior category item and the network delay category item, so that a corresponding business vulnerability detection result is obtained. By the design, business vulnerability classification characteristics of different business vulnerability category items of the digital interaction service items can be analyzed, so that the integrity of business vulnerability detection results of the digital interaction service items is ensured, and abnormal subsequent digital service interaction caused by missing detection and false detection of individual business vulnerabilities is avoided.
Based on the above, the step of determining the business vulnerability classification characteristic of at least one business vulnerability category item of the digital interactive service item according to the information generation period and the information generation mode in the plurality of sets of digital business interactive data of the digital interactive service item and determining the business vulnerability detection result of the digital interactive service item may include the following steps: determining a business interaction error report log of the digital interaction service item in a preset business vulnerability running environment according to information generation time periods and information generation modes in the plurality of groups of digital business interaction data of the digital interaction service item, and determining business vulnerability classification characteristics of at least one business vulnerability category item of the digital interaction service item according to the business interaction error report log; and determining a business vulnerability detection result of the digital interaction service item according to the business vulnerability classification characteristics of the at least one business vulnerability category item.
For example, the business vulnerability running environment may be understood as a digital business interaction scenario where business service vulnerabilities easily occur, and the business vulnerability running environment may be different for different business fields. Further, the business interaction error reporting log may be used to record error reporting events related to business service vulnerabilities, for example, in the digital shopping service, the business interaction error reporting log may record "order loss error reporting event", "repeated payment error reporting event", and the like, which are not limited herein. It can be understood that the business vulnerability classification characteristic of at least one business vulnerability category item of the digital interaction service item can be completely determined through the business interaction error reporting log, and then the business vulnerability detection result of the digital interaction service item can be completely determined through the business vulnerability classification characteristic.
In some possible embodiments, the preset business vulnerability running environment may include a preset multi-terminal interaction scene, the at least one business vulnerability category item includes a multi-terminal interaction scene category item, based on which the step of determining a business vulnerability classification feature of the at least one business vulnerability category item of the digital interaction service item according to the information generation period and the information generation mode in the plurality of sets of digital business interaction data of the digital interaction service item may include the following steps: the multiple groups of digital business interaction data of the digital interaction service items are arranged according to an information generation period; determining a comparison result of information generation time periods of every two groups of adjacent digital business interaction data, and judging whether a business vulnerability running environment of a first digital business interaction data in which the information generation time periods are prior in the two groups of adjacent digital business interaction data is the preset multi-terminal interaction scene or not if the comparison result of the information generation time periods reaches a first set duration; and if the service vulnerability is the preset multi-terminal interaction scene, determining the service vulnerability classification characteristic corresponding to the multi-terminal interaction scene category item of the digital interaction service item based on the preset multi-terminal interaction scene.
For example, the sets of digitized business interaction data of the digitized interaction service item may be sorted in a positive order or a reverse order of an information generation period, such as the digitized business interaction data of the digitized interaction service item m1 being digitized business interaction data12a, digitized business interaction data12b, digitized business interaction data12c, digitized business interaction data12d, and digitized business interaction data12e.
For example, after the digitized business interaction data of the digitized interaction service item m1 is the digitized business interaction data12a, the digitized business interaction data12b, the digitized business interaction data12c, the digitized business interaction data12d and the digitized business interaction data12e according to the positive sequence of the information generation period, the obtained data sequence may be: the digitized business interaction data12 c-digitized business interaction data12 a-digitized business interaction data12 e-digitized business interaction data12 d-digitized business interaction data12b.
For another example, after the digitized business interaction data of the digitized interaction service item m1 is the digitized business interaction data12a, the digitized business interaction data12b, the digitized business interaction data12c, the digitized business interaction data12d and the digitized business interaction data12e are sorted according to the reverse order of the information generation period, the obtained data sequence may be: the digitized business interaction data12 b-digitized business interaction data12 d-digitized business interaction data12 e-digitized business interaction data12 a-digitized business interaction data12c.
Further, every two sets of adjacent digitized business interaction data may be digitized business interaction data12b and digitized business interaction data12d, digitized business interaction data12d and digitized business interaction data12e, digitized business interaction data12e and digitized business interaction data12a, digitized business interaction data12a and digitized business interaction data12c. On the basis of the above, the comparison result of the information generation periods of every two adjacent groups of digital business interaction data can be a period difference value, and can be generally determined by an intermediate event point of the information generation period.
On the premise that the comparison result of the information generation time period reaches the first set duration, the information generation continuity of every two groups of adjacent digital business interaction data can be represented to be influenced, and in this case, whether the business vulnerability running environment of the first digital business interaction data in the information generation time period in the two groups of adjacent digital business interaction data is the preset multi-terminal interaction scene can be judged. If the business vulnerability running environment of the first digital business interaction data with the previous information generation period in the two sets of adjacent digital business interaction data is the preset multi-terminal interaction scene, the business vulnerability classification feature corresponding to the multi-terminal interaction scene category item of the digital interaction service item can be determined based on the preset multi-terminal interaction scene and the business interaction fault report log of the digital interaction service item under the preset business vulnerability running environment (multi-terminal interaction scene). Therefore, the targeted analysis of different business vulnerability running environments can be realized, and the business vulnerability classification features corresponding to the multi-terminal interaction scene category items of the digital interaction service items can be accurately extracted.
In some other embodiments, the at least one business vulnerability category item may include an associated business category item, on the basis of which, the step of determining a business interaction fault log of the digital interaction service item in a preset business vulnerability running environment according to an information generation period and an information generation mode in the plurality of sets of digital business interaction data of the digital interaction service item, and determining a business vulnerability classification feature of the at least one business vulnerability category item of the digital interaction service item according to the business interaction fault log may further include the following contents: acquiring each group of digital business interaction data recorded by each digital business device in the preset vulnerability detection period, and determining associated digital business interaction content corresponding to the business interaction event record of the digital interaction service item according to the information generation period and the information generation mode in the acquired digital business interaction data; if the associated digital business interaction content carries vulnerability restoration information, determining a first business vulnerability classification characteristic of an associated business category item of the digital interaction service item according to the vulnerability restoration information; judging whether a business vulnerability running environment of the digital business interaction data is the preset multi-terminal interaction scene according to each group of digital business interaction data of the associated digital business interaction content, if so, determining a second business vulnerability classification characteristic of an associated business category item of the associated digital business interaction content according to the preset multi-terminal interaction scene; the feature content of the business vulnerability classification feature of the associated business category item is one of the first business vulnerability classification feature, the second business vulnerability classification feature and a feature fusion result of the first business vulnerability classification feature and the second business vulnerability classification feature.
For example, the business interaction event record may be used to record and store different business interaction events, and the associated digital business interaction content includes business interaction content of a prior business interaction event corresponding to the digital interaction service item or a business interaction event having an interaction object delivery relationship, and the associated digital business interaction content may be visual content, such as text, image, etc., which is not limited herein. Further, if the associated digital business interaction content carries vulnerability restoration information, it indicates that a business service vulnerability exists before a business service corresponding to the associated digital business interaction content, in this case, a first business vulnerability classification feature of an associated business category item of the digital interaction service item may be determined according to the vulnerability restoration information, where the associated business category item corresponds to the associated digital business interaction content.
Further, for each group of digital business interaction data of the related digital business interaction content, by judging whether the business vulnerability running environment of the digital business interaction data is the preset multi-terminal interaction scene, the positioning of the business vulnerability running environment can be realized, so that when the business vulnerability running environment of the digital business interaction data is judged to be the preset multi-terminal interaction scene, the second business vulnerability classification characteristic of the related business category item of the related digital business interaction content is determined according to the preset multi-terminal interaction scene. Because the feature content of the business vulnerability classification feature of the associated business category item is one of the first business vulnerability classification feature, the second business vulnerability classification feature and the feature fusion result of the first business vulnerability classification feature and the second business vulnerability classification feature, the global integrity and the scene suitability of the business vulnerability classification feature can be ensured.
In some other embodiments, the at least one business vulnerability category item further includes an operation behavior category item, based on which the following business vulnerability classification feature may relate to feature information related to operation behavior, for example, the step of determining a business vulnerability classification feature of the at least one business vulnerability category item of the digital interaction service item according to an information generation period and an information generation manner in the plurality of sets of digital business interaction data of the digital interaction service item may include: according to the information generation time period, the digital business interaction data of the related digital business interaction content are tidied; for every two groups of adjacent digital business interaction data of the digital interaction service items in the preset vulnerability detection period, if the information generation mode in the first digital business interaction data of the preceding information generation period is the preset multi-terminal interaction scene, determining the operation behavior of the digital interaction service items based on the information generation mode in the second digital business interaction data of the following information generation period; for every two groups of adjacent digital business interaction data of the related digital business interaction content in the preset vulnerability detection period, if the business vulnerability running environment in the first digital business interaction data is the preset multi-terminal interaction scene, determining the operation behavior of the related digital business interaction content based on the information generation mode corresponding to the second digital business interaction data; if the similarity of the operational behaviors of the associated digital business interaction content and the behavior characteristics of the operational behaviors of the digital interaction service items is within a preset similarity interval, and the comparison result of the information generation periods of two groups of second digital business interaction data corresponding to the operational behaviors of the associated digital business interaction content and the operational behaviors of the digital interaction service items is smaller than a second set period, determining the business vulnerability classification characteristics corresponding to the operational behavior category items of the digital interaction service items through the operational behaviors of the associated digital business interaction content and the operational behaviors of the digital interaction service items.
For example, determining the operation behavior of the digital interactive service item based on the information generation manner in the second digital business interactive data after the information generation period may be achieved by: analyzing the information generation mode in the second digital business interaction data after the information generation period to obtain operation feedback information corresponding to the information generation mode in the second digital business interaction data after the information generation period, and determining the operation behavior of the digital interaction service item through the operation feedback information, wherein the operation behavior can be image selection behavior if the operation feedback information is image display.
For example, for every two sets of adjacent digital business interaction data of the related digital business interaction content within the preset vulnerability detection period, one set of adjacent digital business interaction data can be defined as first digital business interaction data, and the other set of adjacent digital business interaction data can be defined as second digital business interaction data.
For example, for different operation behaviors, if the similarity of the behavior characteristics (such as cosine similarity of the behavior characteristic vector) of the operation behavior f1 of the related digital service interaction content and the operation behavior f2 of the digital interaction service item is within a preset similarity interval (flexibly adjusted according to the actual service situation), and the comparison result (such as the time interval difference of the information generation time interval) of the information generation time interval of the two sets of second digital service interaction data corresponding to the operation behavior f1 of the related digital service interaction content and the operation behavior f2 of the digital interaction service item is smaller than the second set time interval (set according to the actual situation, without limitation), the service vulnerability classification feature corresponding to the operation behavior category item of the digital interaction service item is determined through the operation behavior f1 of the related digital service interaction content and the operation behavior f2 of the digital interaction service item. In this way, the behavioral feature similarity of different operation behaviors can be analyzed, and the business vulnerability classification features corresponding to the operation behavior category items of the digital interaction service items are determined by combining the comparison results of the information generation time periods, so that comprehensive consideration of the operation behaviors and the time sequence features is realized, and the credibility of the business vulnerability classification features corresponding to the operation behavior category items is ensured.
In some possible embodiments, based on the above, the method may further include: determining associated operation behaviors of the digital interaction service matters and the associated digital business interaction content in a first vulnerability detection period according to the digital business interaction data of the digital interaction service matters and the associated digital business interaction content in the first vulnerability detection period; and updating the preset multi-terminal interaction scene according to the determined associated operation behavior.
For example, the associated operation behavior may be used to characterize the digital interaction service item and the dynamic service interaction condition of the associated digital service interaction content in the first vulnerability detection period, and the associated operation behavior may include an operation behavior of a service participant corresponding to the digital interaction service item and an interaction behavior corresponding to the associated digital service interaction content, which is not limited herein. In this way, the multi-terminal interaction scene is updated through the associated operation behaviors, so that timeliness of the multi-terminal interaction scene can be ensured. For example, the scene tag or scene feature of the multi-terminal interaction scene may be modified and adjusted according to the call path of the behavior function of the related operation behavior, or the preset multi-terminal interaction scene may be updated in combination with the related operation behavior in other manners, which is not limited herein.
In yet another embodiment, the at least one business hole category item includes a network delay category item, where network delay may be understood as a data information transmission delay caused by insufficient communication bandwidth, such as slow page refresh, interaction response delay, etc., which is not limited herein. Based on this, the step of determining a business interaction fault report log of the digital interaction service item in a preset business fault running environment according to an information generation period and an information generation mode in the plurality of sets of digital business interaction data of the digital interaction service item, and determining a business fault classification feature of at least one business fault category item of the digital interaction service item according to the business interaction fault report log may further include the following contents: determining a business vulnerability running environment as a business transfer track of the digital business interaction data of the preset multi-terminal interaction scene from the plurality of groups of digital business interaction data of the digital interaction service items; and determining the business vulnerability classification characteristics corresponding to the network delay category items of the digital interaction service items according to the determined business transfer track.
For example, the service transmission track of the digitized service interaction data may be a Knowledge Graph (knowledgegraph) formed by association conditions between different service events, and the execution logic relationship and the causal relationship between different service events corresponding to the digitized service interaction data may be obtained through the service transmission track, so that the service vulnerability classification feature corresponding to the network delay category item of the digitized service interaction event may be completely determined through the service transmission track. For example, the business vulnerability classification feature corresponding to the network delay class item of the digital interaction service item can be determined through the node with abnormal attribute information in the business transfer track. In general, the business vulnerability classification features corresponding to the network delay class items may include network parameter features and bandwidth occupation features corresponding to different business interaction events, and may also include other types of features, which are not limited herein.
Based on the foregoing, the preset business vulnerability operating environment may include a preset offline business interaction scenario, and based on this, the method may further include the following two embodiments, which are embodiment 1 and embodiment 2, respectively, where embodiment 1 and embodiment 2 may be implemented alternatively or in parallel according to actual situations.
In embodiment 1, for each digital interaction service item, digital service interaction data of the digital interaction service item recorded by each digital service device in a second vulnerability detection period is obtained, a service interaction error report log of the digital interaction service item in the preset offline service interaction scene is determined according to the obtained digital service interaction data, and a service vulnerability classification feature of a first service state category item of the digital interaction service item is updated according to the service interaction error report log of the digital interaction service item in the preset offline service interaction scene.
In embodiment 1, the second vulnerability detection period may be adjusted according to the actual situation, for example, the second vulnerability detection period may be determined according to the received offline service trigger identifier, on this basis, the service interaction fault report log of the digital interaction service item in the preset offline service interaction scene is determined according to the obtained digital service interaction data, and the fault report event related to the offline service (offline service) is realized in combination with the offline time period corresponding to the second vulnerability detection period. In this way, the business vulnerability classification feature of the first business state category item of the digital interaction service item can be performed according to the business interaction error report log of the digital interaction service item in the preset offline business interaction scene. In this embodiment, the first traffic state category item may be understood as a real-time traffic state category item.
Embodiment 2, for each digital interaction service item, acquiring a service assistant detection record of the digital interaction service item in a third vulnerability detection period, and updating a service vulnerability classification feature of a second service state category item of the digital interaction service item according to the acquired service assistant detection record; the business vulnerability detection result of the digital interaction service item is determined based on the business vulnerability classification characteristic of the at least one business vulnerability category item and the business vulnerability classification characteristic of at least one of the first business state category item and the second business state category item.
In embodiment 2, the third vulnerability detection period may be determined according to the activation period of the service assistant software, and the service assistant detection record is used to record the service assistant software usage, for example, in the visual interactive service, the corresponding digital interactive service item may be implemented by starting the service assistant software (remote manual collaboration operation service). By the design, the business assistant detection record of the business assistant software can be taken into consideration, so that the business vulnerability classification characteristic of the second business state category item of the digital interaction service item is updated, and high correlation between the business vulnerability classification characteristic and actual business interaction is ensured.
In some alternative embodiments, based on the foregoing, the method may further include: determining business vulnerability classification characteristics of vulnerability restoration category items of the digital interaction service items according to vulnerability restoration information of the digital interaction service items; the business vulnerability detection result of the digital interaction service item is determined based on the business vulnerability classification characteristic of the at least one business vulnerability category item of the digital interaction service item and the business vulnerability classification characteristic of the vulnerability restoration category item. By the design, the business vulnerability classification features can be completely and accurately positioned based on specific vulnerability restoration information, so that the accuracy and reliability of the business vulnerability classification features are ensured.
In some alternative embodiments, the business vulnerability detection result of the digital interaction service item is obtained by determining the feature content of the business vulnerability classification feature based on the business vulnerability classification feature of each category item of the digital interaction service item, based on which the method may further include the following: and outputting vulnerability restoration prompt information when the content description value of the characteristic content of the business vulnerability classification characteristic of the business vulnerability detection result representing the digital interaction service item meets a preset trigger condition, wherein the vulnerability restoration prompt information comprises an information generation mode of the latest digital business interaction data of the digital interaction service item.
For example, the feature content of the business vulnerability classification feature may be a feature vector, the content description value may quantitatively express the feature content, the content description value may be any integer between 0 to 10 or 0 to 100, different content description values refer to different feature content, and correspondingly, the preset triggering condition may be a condition for vulnerability restoration prompt, for example, the content description value 8 satisfies the preset triggering condition (for example, less than 10 and greater than 5), and then the content description value 8 may represent that vulnerability restoration needs exist, and at this time, vulnerability restoration prompt information may be output. The bug fix prompt information may be output to a digital service device or may be output to a third party operation and maintenance platform, which is not limited herein. Because the bug fix prompt information comprises the information generation mode of the latest digital business interaction data of the digital interaction service item, the follow-up business service bug fix can be ensured to consider the latest digital business interaction data, so that the processing of the latest digital business interaction data can be realized quickly after the business service bug fix, the interaction efficiency of the digital service is improved, and the occurrence of unnecessary abnormal conditions is avoided as far as possible.
In some alternative embodiments, the step of determining the business vulnerability detection result of the digital interaction service item according to the business vulnerability classification feature of the at least one business vulnerability category item may be implemented by a method described in the following steps (1) - (5).
(1) And acquiring event type labels of each interactive event content block in the to-be-detected interactive service content corresponding to the digital interactive service items, and classifying the interactive event content blocks according to event types according to the event type labels. For example, the interactive event content blocks can be obtained by event splitting the interactive service content to be detected, and the event category labels are used for distinguishing the interactive event content blocks.
(2) And obtaining the event category heat distribution and the content validity detection result distribution of the interactive event content blocks of each event category in the interactive service content to be detected according to the event category labels. For example, the event category popularity distribution and the content validity detection result distribution may be expressed in a list or a graph, where the event category popularity distribution is used to record interaction popularity and popularity of different events, and the content validity detection result distribution is used to record validity of different events. In some specific examples, the step of obtaining the event category popularity distribution and the content validity detection result distribution of the interactive event content block of each event category in the interactive service content to be detected according to the event category label may include the following: obtaining global relevance description values of the interactive event content blocks of each event category in the interactive service content to be detected according to the event category labels; according to the global relevance description value of the interactive event content blocks of each event category in the interactive service content to be detected, an event category heat change track of the interactive event content blocks is used as the event category heat distribution; obtaining the relative word vector distance between each interactive event content block and each preset category label in the interactive service content to be detected according to the event category label; and obtaining the change track of the content validity detection result distribution of the interactive event content block of each event category in the interactive service content to be detected according to the relative word vector distance, and taking the change track as the content validity detection result distribution. Therefore, the occurrence of missing of event category heat distribution and content validity detection result distribution can be avoided.
Still further, the step of obtaining the global relevance description value of the interactivity event content block of each event category in the interactivity service content to be detected according to the event category label may include the following steps: obtaining the content block distribution condition of the number of the interactive event content blocks of any event category in the number of all the interactive event content blocks according to the event category label; according to the event category labels, acquiring the number of the to-be-detected interactive service contents of the interactive event content blocks of any event category from a pre-stored to-be-detected interactive service content candidate set; the candidate set of the interactive service contents to be detected comprises at least two interactive service contents to be detected; obtaining a global relevance description value of the interactive event content blocks of any event category in the interactive service content to be detected according to the content block distribution condition of the interactive event content blocks of any event category in all the interactive event content blocks, the number of the interactive service content to be detected of the interactive event content blocks of any event category in the candidate set of the interactive service content to be detected, and the number of the interactive service content to be detected in the candidate set of the interactive service content to be detected; and sequentially obtaining the global relevance description value of the interactive event content block of each event category in the interactive service content to be detected. By the design, different global relevance description values can be determined rapidly and accurately, and mutual interference among the global relevance description values is avoided.
(3) And obtaining the content correlation coefficients of the to-be-detected interactive service content and the preset sample interactive service content according to the content block heat distribution of the interactive event and the content validity detection result distribution. For example, the content correlation coefficient may be expressed by a different type of correlation coefficient, such as pearson correlation coefficient (Pearson Correlation Coefficient).
(4) And taking the interaction service content to be detected, of which the content correlation coefficient is larger than the set correlation coefficient, as the potential abnormal interaction service content. For example, the set correlation coefficient may be designed according to the actual service situation, which is not described herein.
(5) Determining a content feature map in the potential abnormal interaction service content, and matching the business vulnerability classification feature of the at least one business vulnerability category item with the content feature map to obtain a matching result; and determining a business vulnerability detection result of the digital interaction service item according to the matching result. For example, the content feature map may be expressed in a form of map Data (Graphic Data), the business vulnerability classification feature of the at least one business vulnerability category item and the content feature map may be matched by calculating a euclidean distance between the business vulnerability classification feature of the at least one business vulnerability category item and the content feature map, the matching result may include a matching rate between the business vulnerability classification feature of the business vulnerability category item and the content feature map, and then the content feature map corresponding to the matching result with the matching rate in the set interval may be retained, so that the retained content feature map is identified, and a business vulnerability detection result of the corresponding digital interaction service item is obtained. It can be appreciated that the business vulnerability detection result may include different types of business service vulnerabilities, so that the integrity of business vulnerability detection can be ensured, and the influence of missed detection or false detection on subsequent normal business handling is avoided.
In summary, by implementing the above scheme, the digital interaction service item corresponding to the interaction operation tag information in the digital service interaction data uploaded by each digital service device can be determined, so that the digital interaction service item is accurately positioned, and then multiple groups of digital service interaction data of the digital interaction service item recorded by each digital service device in the preset vulnerability detection period are obtained to perfect the collection of the interaction data of the digital interaction service item, so that the business vulnerability classification feature of at least one business vulnerability category item of the digital interaction service item can be completely and comprehensively determined based on the information generation period and the information generation mode in the multiple groups of digital service interaction data of the digital interaction service item, further the integrity of the business vulnerability detection result of the digital interaction service item is ensured, and the subsequent digital service interaction abnormality caused by the omission and false detection of individual business vulnerabilities is avoided.
Next, for the above-mentioned digitized service analysis method based on big data, the embodiment of the present invention further provides an exemplary digitized service analysis device based on big data, as shown in fig. 2, the digitized service analysis device 200 based on big data may include the following functional modules.
The interaction data obtaining module 210 is configured to determine, based on the received digitized service interaction data uploaded by each digitized service device, a digitized interaction service item corresponding to the interaction operation tag information in the digitized service interaction data, and obtain multiple sets of digitized service interaction data of the digitized interaction service item recorded by each digitized service device in a preset vulnerability detection period.
The detection result determining module 220 is configured to determine a business vulnerability classification feature of at least one business vulnerability category item of the digital interaction service item according to an information generation period and an information generation manner in the plurality of sets of digital business interaction data of the digital interaction service item, and determine a business vulnerability detection result of the digital interaction service item.
Then, based on the above-mentioned method embodiment and device embodiment, the embodiment of the present invention also proposes a system embodiment, that is, a digitalized service analysis system based on big data, referring to fig. 3 in combination, the digitalized service analysis system 30 based on big data may include the cloud server 10 and the digitalized service device 20. Wherein the cloud server 10 communicates with the digital service device 20 to implement the above method, further the functionality of the big data based digital service analysis system 30 is described as follows. The cloud server 10 determines digital interaction service items corresponding to the interaction operation label information in the digital service interaction data based on the received digital service interaction data uploaded by each digital service device, and obtains a plurality of groups of digital service interaction data of the digital interaction service items recorded by each digital service device in a preset vulnerability detection period; and determining business vulnerability classification characteristics of at least one business vulnerability category item of the digital interaction service item according to information generation time periods and information generation modes in the plurality of groups of digital business interaction data of the digital interaction service item, and determining a business vulnerability detection result of the digital interaction service item.
It will be appreciated that the description of the apparatus embodiment and the system embodiment described above refers to the description of the method shown in fig. 1, and will not be repeated here.
Further, referring to fig. 4 in combination, cloud server 10 may include a processing engine 110, a network module 120, and a memory 130, where processing engine 110 and memory 130 communicate via network module 120.
Processing engine 110 may process the relevant information and/or data to perform one or more functions described herein. For example, in some embodiments, processing engine 110 may include at least one processing engine (e.g., a single core processing engine or a multi-core processor). By way of example only, the processing engine 110 may include a central processing unit (Central Processing Unit, CPU), application-specific integrated circuit (ASIC), application-specific instruction Set Processor (ASIP), graphics processing unit (Graphics Processing Unit, GPU), physical processing unit (Physics Processing Unit, PPU), digital signal Processor (Digital Signal Processor, DSP), field programmable gate array (Field Programmable Gate Array, FPGA), programmable logic device (Programmable Logic Device, PLD), controller, microcontroller unit, reduced instruction Set Computer (Reduced Instruction-Set Computer, RISC), microprocessor, or the like, or any combination thereof.
The network module 120 may facilitate the exchange of information and/or data. In some embodiments, the network module 120 may be any type of wired or wireless network or combination thereof. By way of example only, the network module 120 may include a cable network, a wire network, a fiber optic network, a telecommunications network, an intranet, the internet, a local area network (Local Area Network, LAN), a wide area network (Wide Area Network, WAN), a wireless local area network (Wireless Local Area Network, WLAN), a metropolitan area network (Metropolitan Area Network, MAN), a public switched telephone network (Public Telephone Switched Network, PSTN), a bluetooth network, a wireless personal area network, a near field communication (Near Field Communication, NFC) network, or the like, or any combination of the foregoing examples. In some embodiments, the network module 120 may include at least one network access point. For example, the network module 120 may include a wired or wireless network access point, such as a base station and/or a network access point.
The Memory 130 may be, but is not limited to, random access Memory (Random Access Memory, RAM), read Only Memory (ROM), programmable Read Only Memory (Programmable Read-Only Memory, PROM), erasable Read Only Memory (Erasable Programmable Read-Only Memory, EPROM), electrically erasable Read Only Memory (Electric Erasable Programmable Read-Only Memory, EEPROM), etc. The memory 130 is used for storing a program, and the processing engine 110 executes the program after receiving an execution instruction.
It is to be understood that the configuration shown in fig. 4 is merely illustrative, and that cloud server 10 may also include more or fewer components than those shown in fig. 4, or have a different configuration than that shown in fig. 4. The components shown in fig. 4 may be implemented in hardware, software, or a combination thereof.
It should be understood that, for the above, those skilled in the art can clearly determine the meaning of the related technical terms by performing the forward and backward deduction according to the above description, for example, for terms such as values, coefficients, weights, indexes, factors, etc., those skilled in the art can perform deduction and determination according to the forward and backward logical relationship, and the value ranges of these values can be selected according to practical situations, for example, 0 to 1, for example, 1 to 10, for example, 50 to 100, which are not limited herein.
The person skilled in the art can undoubtedly determine some preset, reference, predetermined, set and target technical features/technical terms, such as threshold values, threshold value intervals, threshold value ranges, etc., from what has been shown above. For some technical feature terms which are not explained, a person skilled in the art can reasonably and unambiguously derive based on the logical relation of the context, so that the technical scheme can be clearly and completely implemented. The prefixes of technical feature terms not explained, such as "first", "second", "last", "next", "previous", "next", "current", "history", "latest", "best", "target", "specified", and "real-time", etc., can be unambiguously deduced and determined from the context. Suffixes of technical feature terms, such as "list", "feature", "sequence", "set", "matrix", "unit", "element", "track" and "list", etc., that are not explained, may also be unambiguously deduced and determined from the context.
The foregoing will be apparent to and are fully apparent to those skilled in the art from the following description. It should be appreciated that the development and analysis of technical terms not explained based on the above-described illustrations by those skilled in the art is based on the description of the present invention, and thus the above-described description is not an inventive judgment of the overall scheme.
It should be appreciated that the systems and modules thereof shown above may be implemented in a variety of ways. For example, in some embodiments, the system and its modules may be implemented in hardware, software, or a combination of software and hardware. Wherein the hardware portion may be implemented using dedicated logic; the software portions may then be stored in a memory and executed by a suitable instruction execution system, such as a microprocessor or special purpose design hardware. Those skilled in the art will appreciate that the methods and systems described above may be implemented using computer executable instructions and/or embodied in processor control code, such as provided on a carrier medium such as a magnetic disk, CD or DVD-ROM, a programmable memory such as read only memory (firmware), or a data carrier such as an optical or electronic signal carrier. The system of the present invention and its modules may be implemented not only with hardware circuitry such as very large scale integrated circuits or gate arrays, semiconductors such as logic chips, transistors, etc., or programmable hardware devices such as field programmable gate arrays, programmable logic devices, etc., but also with software executed by various types of processors, for example, and with a combination of the above hardware circuitry and software (e.g., firmware).
It should be noted that, the advantages that may be generated by different embodiments may be different, and in different embodiments, the advantages that may be generated may be any one or a combination of several of the above, or any other possible advantages that may be obtained.
While the basic concepts have been described above, it will be apparent to those skilled in the art that the foregoing detailed disclosure is by way of example only and is not intended to be limiting. Although not explicitly described herein, various modifications, improvements and adaptations of the invention may occur to one skilled in the art. Such modifications, improvements, and modifications are intended to be suggested within the present disclosure, and therefore, such modifications, improvements, and adaptations are intended to be within the spirit and scope of the exemplary embodiments of the present disclosure.
Meanwhile, the present invention uses specific words to describe embodiments of the present invention. Reference to "one embodiment," "an embodiment," and/or "some embodiments" means that a particular feature, structure, or characteristic is associated with at least one embodiment of the invention. Thus, it should be emphasized and should be appreciated that two or more references to "an embodiment" or "one embodiment" or "an alternative embodiment" in various positions in this specification are not necessarily referring to the same embodiment. Furthermore, certain features, structures, or characteristics of one or more embodiments of the invention may be combined as suitable.
Furthermore, those skilled in the art will appreciate that the various aspects of the invention are illustrated and described in the context of a number of patentable categories or circumstances, including any novel and useful procedures, machines, products, or materials, or any novel and useful modifications thereof. Accordingly, aspects of the invention may be performed entirely by hardware, entirely by software (including firmware, resident software, micro-code, etc.) or by a combination of hardware and software. The above hardware or software may be referred to as a "data block," module, "" engine, "" unit, "" component, "or" system. Furthermore, aspects of the invention may take the form of a computer product, comprising computer-readable program code, embodied in one or more computer-readable media.
The computer storage medium may contain a propagated data signal with the computer program code embodied therein, for example, on a baseband or as part of a carrier wave. The propagated signal may take on a variety of forms, including electro-magnetic, optical, etc., or any suitable combination thereof. A computer storage medium may be any computer readable medium that can communicate, propagate, or transport a program for use by or in connection with an instruction execution system, apparatus, or device. Program code located on a computer storage medium may be propagated through any suitable medium, including radio, cable, fiber optic cable, RF, or the like, or a combination of any of the foregoing.
The computer program code necessary for operation of portions of the present invention may be written in any one or more programming languages, including an object oriented programming language such as Java, scala, smalltalk, eiffel, JADE, emerald, C ++, c#, vb net, python, etc., a conventional programming language such as C language, visual Basic, fortran 2003, perl, COBOL 2002, PHP, ABAP, dynamic programming languages such as Python, ruby and Groovy, or other programming languages, etc. The program code may execute entirely on the user's computer or as a stand-alone software package, partly on the user's computer and partly on a remote computer or entirely on the remote computer or server. In the latter scenario, the remote computer may be connected to the user's computer through any form of network, such as a Local Area Network (LAN) or a Wide Area Network (WAN), or the connection may be made to an external computer (for example, through the Internet), or the use of services such as software as a service (SaaS) in a cloud computing environment.
Furthermore, the order in which the elements and sequences are presented, the use of numerical letters, or other designations are used in the invention is not intended to limit the sequence of the processes and methods unless specifically recited in the claims. While certain presently useful inventive embodiments have been discussed in the foregoing disclosure, by way of example, it is to be understood that such details are merely illustrative and that the appended claims are not limited to the disclosed embodiments, but, on the contrary, are intended to cover all modifications and equivalent arrangements included within the spirit and scope of the embodiments of the invention. For example, while the system components described above may be implemented by hardware devices, they may also be implemented solely by software solutions, such as installing the described system on an existing server or mobile device.
Similarly, it should be noted that in order to simplify the description of the present disclosure and thereby aid in understanding one or more inventive embodiments, various features are sometimes grouped together in a single embodiment, figure, or description thereof. This method of disclosure, however, is not intended to imply that more features than are required by the subject invention. Indeed, less than all of the features of a single embodiment disclosed above.
In some embodiments, numbers describing the components, number of attributes are used, it being understood that such numbers being used in the description of embodiments are modified in some examples by the modifier "about," approximately, "or" substantially. Unless otherwise indicated, "about," "approximately," or "substantially" indicate that the numbers allow for adaptive variation. Accordingly, in some embodiments, numerical parameters set forth in the specification and claims are approximations that may vary depending upon the desired properties sought to be obtained by the individual embodiments. In some embodiments, the numerical parameters should take into account the specified significant digits and employ a method for preserving the general number of digits. Although the numerical ranges and parameters set forth herein are approximations in some embodiments for use in determining the breadth of the range, in particular embodiments, the numerical values set forth herein are as precisely as possible.
Each patent, patent application publication, and other material, such as articles, books, specifications, publications, documents, etc., cited herein is hereby incorporated by reference in its entirety. Except for the application history file that is inconsistent or conflicting with this disclosure, the file (currently or later attached to this disclosure) that limits the broadest scope of the claims of this disclosure is also excluded. It is noted that the description, definition, and/or use of the term in the appended claims controls the description, definition, and/or use of the term in this invention if there is a discrepancy or conflict between the description, definition, and/or use of the term in the appended claims.
Finally, it should be understood that the embodiments described herein are merely illustrative of the principles of the embodiments of the present invention. Other variations are also possible within the scope of the invention. Thus, by way of example, and not limitation, alternative configurations of embodiments of the invention may be considered in keeping with the teachings of the invention. Accordingly, the embodiments of the present invention are not limited to the embodiments explicitly described and depicted herein.