CN116185798A - Abnormal operation analysis method and server applied to big data visualization - Google Patents

Abnormal operation analysis method and server applied to big data visualization Download PDF

Info

Publication number
CN116185798A
CN116185798A CN202310135452.XA CN202310135452A CN116185798A CN 116185798 A CN116185798 A CN 116185798A CN 202310135452 A CN202310135452 A CN 202310135452A CN 116185798 A CN116185798 A CN 116185798A
Authority
CN
China
Prior art keywords
wavelet
descriptor
image
user operation
operation track
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Pending
Application number
CN202310135452.XA
Other languages
Chinese (zh)
Inventor
朱思萌
杨熙圣
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Individual
Original Assignee
Individual
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Individual filed Critical Individual
Priority to CN202310135452.XA priority Critical patent/CN116185798A/en
Publication of CN116185798A publication Critical patent/CN116185798A/en
Pending legal-status Critical Current

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F11/00—Error detection; Error correction; Monitoring
    • G06F11/30—Monitoring
    • G06F11/34—Recording or statistical evaluation of computer activity, e.g. of down time, of input/output operation ; Recording or statistical evaluation of user activity, e.g. usability assessment
    • G06F11/3438—Recording or statistical evaluation of computer activity, e.g. of down time, of input/output operation ; Recording or statistical evaluation of user activity, e.g. usability assessment monitoring of user actions
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F11/00—Error detection; Error correction; Monitoring
    • G06F11/30—Monitoring
    • G06F11/34—Recording or statistical evaluation of computer activity, e.g. of down time, of input/output operation ; Recording or statistical evaluation of user activity, e.g. usability assessment
    • G06F11/3452—Performance evaluation by statistical analysis
    • Y—GENERAL TAGGING OF NEW TECHNOLOGICAL DEVELOPMENTS; GENERAL TAGGING OF CROSS-SECTIONAL TECHNOLOGIES SPANNING OVER SEVERAL SECTIONS OF THE IPC; TECHNICAL SUBJECTS COVERED BY FORMER USPC CROSS-REFERENCE ART COLLECTIONS [XRACs] AND DIGESTS
    • Y02—TECHNOLOGIES OR APPLICATIONS FOR MITIGATION OR ADAPTATION AGAINST CLIMATE CHANGE
    • Y02D—CLIMATE CHANGE MITIGATION TECHNOLOGIES IN INFORMATION AND COMMUNICATION TECHNOLOGIES [ICT], I.E. INFORMATION AND COMMUNICATION TECHNOLOGIES AIMING AT THE REDUCTION OF THEIR OWN ENERGY USE
    • Y02D10/00—Energy efficient computing, e.g. low power processors, power management or thermal management

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • General Engineering & Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • Quality & Reliability (AREA)
  • General Physics & Mathematics (AREA)
  • Computer Hardware Design (AREA)
  • Life Sciences & Earth Sciences (AREA)
  • Bioinformatics & Cheminformatics (AREA)
  • Bioinformatics & Computational Biology (AREA)
  • Evolutionary Biology (AREA)
  • Probability & Statistics with Applications (AREA)
  • Testing, Inspecting, Measuring Of Stereoscopic Televisions And Televisions (AREA)

Abstract

The invention provides an abnormal operation analysis method and a server applied to big data visualization, if the accuracy of a wavelet descriptor extraction algorithm is guaranteed, the correlation between the obtained first wavelet extraction descriptor and the obtained second wavelet extraction descriptor is higher, so that the wavelet descriptor extraction algorithm is debugged by combining image relation evaluation vectors between each first wavelet extraction descriptor and each second wavelet extraction descriptor, the image feature mining quality of the wavelet descriptor extraction algorithm can be improved, the accuracy and the richness of the wavelet extraction descriptor obtained by the wavelet descriptor extraction algorithm are improved, the wavelet descriptor extracted by any graphic user interface interactive video can fully represent abnormal user operation behaviors, and a sufficient and accurate data basis/analysis basis can be provided for subsequent abnormal operation analysis.

Description

Abnormal operation analysis method and server applied to big data visualization
Technical Field
The invention relates to the technical field of big data visualization, in particular to an abnormal operation analysis method and a server applied to big data visualization.
Background
The main function of the graphical user interface is to realize man-machine interaction of people and intelligent visual terminals such as computers. The intelligent visual terminal is a tool for data transmission and interactive control between a user and an operating system, the user can control the intelligent visual terminal through certain operation, and the intelligent visual terminal can feed back the result of the user operation through an output interface. As an indispensable link of intelligent visual terminal application, the graphical user interface realizes information interaction between people and software. The man-machine interaction enables the operation of a user to be more convenient. Because of this, various visual interactive services gradually begin to be introduced into the graphical user interface technology for drainage, but as the scale of the visual interactive services is enlarged, the number of participants of the visual interactive services is increased, which brings security challenges to the visual interactive services. At present, the security analysis processing for the visual interactive service is mainly realized based on the abnormal operation analysis of the user, but the traditional scheme is difficult to ensure the precision and the richness of the abnormal operation mining, so that a sufficient and accurate analysis basis is difficult to provide for the abnormal operation analysis.
Disclosure of Invention
The invention provides an abnormal operation analysis method and a server applied to big data visualization.
The first aspect is an abnormal operation analysis method applied to big data visualization, applied to an abnormal operation analysis server, the method comprising:
acquiring a first wavelet descriptor corresponding to each user operation track image in a first graphical user interface interactive video and a second wavelet descriptor corresponding to the first graphical user interface interactive video, wherein the first wavelet descriptor corresponding to the user operation track image reflects abnormal operation tendency of the user operation track image in the first graphical user interface interactive video, and the second wavelet descriptor is determined by combining the first wavelet descriptor corresponding to each user operation track image;
extracting each first wavelet descriptor and each second wavelet descriptor through a wavelet descriptor extracting algorithm to obtain a first wavelet extracted descriptor corresponding to each first wavelet descriptor and a second wavelet extracted descriptor corresponding to each second wavelet descriptor;
Debugging the wavelet descriptor refinement algorithm in combination with a first image association assessment vector between each of the first wavelet refinement descriptor and the second wavelet refinement descriptor, the first image association assessment vector reflecting a correlation between the first wavelet refinement descriptor and the second wavelet refinement descriptor;
and refining the wavelet descriptors of the interactive video of the graphical user interface to be processed through a debugged wavelet descriptor refining algorithm.
In some independently implementable examples, said debugging said wavelet description sub-refinement algorithm in conjunction with a first image contact assessment vector between each of said first wavelet refinement descriptor and said second wavelet refinement descriptor comprises:
combining the first image association evaluation vectors corresponding to each first wavelet extraction descriptor to determine algorithm good and bad variables, wherein the algorithm good and bad variables and the first image association evaluation vectors form a first set relationship;
and debugging the wavelet descriptor refining algorithm by combining the algorithm quality variables.
In some independently implementable examples, the method further comprises, prior to debugging the wavelet description sub-refinement algorithm, combining a first image association assessment vector between each of the first wavelet refinement descriptor and the second wavelet refinement descriptor:
Carrying out decision analysis on the first wavelet extraction descriptor and the second wavelet extraction descriptor through a decision tree algorithm to obtain a decision analysis result, wherein the decision analysis result reflects the probability that a user operation track image corresponding to the first wavelet extraction descriptor belongs to a graphical user interface interactive video corresponding to the second wavelet extraction descriptor;
and determining the decision analysis result as a first image association evaluation vector corresponding to the first wavelet refinement descriptor.
In some independently implementable examples, said debugging said wavelet description sub-refinement algorithm in conjunction with a first image contact assessment vector between each of said first wavelet refinement descriptor and said second wavelet refinement descriptor comprises:
combining the first image association evaluation vectors corresponding to each first wavelet extraction descriptor to determine algorithm good and bad variables, wherein the algorithm good and bad variables and the first image association evaluation vectors form a first set relationship;
and debugging the wavelet descriptor refining algorithm and the decision tree algorithm by combining the algorithm quality variables.
In some examples, which may be implemented independently, the method further comprises: acquiring a third wavelet descriptor corresponding to a user operation track image in a second graphical user interface interactive video, wherein the third wavelet descriptor corresponding to the user operation track image reflects abnormal operation tendency of the user operation track image in the second graphical user interface interactive video, and the second graphical user interface interactive video is different from the first graphical user interface interactive video; refining the third wavelet descriptor through the wavelet descriptor refining algorithm to obtain a third wavelet refined descriptor corresponding to the third wavelet descriptor; determining a second image association evaluation vector between the third wavelet refinement descriptor and the second wavelet refinement descriptor, the second image association evaluation vector reflecting a correlation between the third wavelet refinement descriptor and the second wavelet refinement descriptor;
The determining the algorithm quality variable by combining the first image association evaluation vectors corresponding to each first wavelet refinement descriptor comprises the following steps: and combining each first image association evaluation vector and each second image association evaluation vector to determine the algorithm good and bad variables, wherein the algorithm good and bad variables and the first image association evaluation vectors form a first setting relationship, and the algorithm good and bad variables and the second image association evaluation vectors form a second setting relationship.
In some independently implementable examples, the first graphical user interface interactive video includes user operation track images corresponding to a plurality of video stream timing labels, the determining the algorithm goodness variable in combination with each of the first image association rating vector and the second image association rating vector includes:
determining a debugging cost corresponding to each video stream time sequence label by combining a first image contact evaluation vector and a second image contact evaluation vector corresponding to each video stream time sequence label, wherein the debugging cost and the first image contact evaluation vector are in a second set relation, and the debugging cost and the second image contact evaluation vector are in a first set relation, the first image contact evaluation vector corresponding to the video stream time sequence label is a first image contact evaluation vector corresponding to a user operation track image matching the video stream time sequence label in the first graphical user interface interactive video, and the second image contact evaluation vector corresponding to the video stream time sequence label is a second image contact evaluation vector corresponding to a user operation track image matching the video stream time sequence label in the second graphical user interface interactive video;
And carrying out weighted summation on the debugging cost corresponding to each video stream time sequence label to obtain the algorithm good and bad variables, wherein the algorithm good and bad variables and the debugging cost are in a first set relation.
In some examples, which may be implemented independently, the method further comprises: determining a first video wavelet descriptor corresponding to the first graphical user interface interactive video, wherein the first video wavelet descriptor reflects abnormal operation tendency of the first graphical user interface interactive video; refining the first video wavelet descriptor through the wavelet descriptor refining algorithm to obtain a fourth wavelet refined descriptor; determining a third image association evaluation vector between the fourth wavelet refinement descriptor and the second wavelet refinement descriptor, the third image association evaluation vector reflecting a correlation between the fourth wavelet refinement descriptor and the second wavelet refinement descriptor;
the determining the algorithm quality variable by combining the first image association evaluation vectors corresponding to each first wavelet refinement descriptor comprises the following steps: and combining each first image association evaluation vector and each third image association evaluation vector to determine the algorithm good and bad variables, wherein the algorithm good and bad variables and the first image association evaluation vector and the third image association evaluation vector form a first setting relationship.
In some examples, which may be implemented independently, the method further comprises: determining a second video wavelet descriptor corresponding to a second graphical user interface interactive video, wherein the second video wavelet descriptor reflects abnormal operation tendency of the second graphical user interface interactive video, and the second graphical user interface interactive video is different from the first graphical user interface interactive video; refining the second video wavelet descriptor through the wavelet descriptor refining algorithm to obtain a fifth wavelet refined descriptor; determining a fourth image association evaluation vector between the fifth wavelet refinement descriptor and the second wavelet refinement descriptor, the fourth image association evaluation vector reflecting a correlation between the fifth wavelet refinement descriptor and the second wavelet refinement descriptor;
the determining the algorithm merit variable by combining each of the first image association evaluation vector and the third image association evaluation vector includes: and combining each of the first image association evaluation vector, the third image association evaluation vector and the fourth image association evaluation vector to determine an algorithm good and bad variable, wherein the algorithm good and bad variable is in a first set relation with the first image association evaluation vector and the third image association evaluation vector, and the algorithm good and bad variable is in a second set relation with the fourth image association evaluation vector.
In some examples that may be implemented independently, obtaining a first wavelet descriptor corresponding to each user operation track image in a first graphical user interface interactive video includes:
determining an image wavelet descriptor corresponding to each user operation track image in the first graphical user interface interactive video;
and respectively combining the image wavelet descriptors corresponding to each user operation track image and the image wavelet descriptors corresponding to at least one user operation track image behind each user operation track image to determine a first wavelet descriptor corresponding to each user operation track image.
In some examples of independent implementation, the determining the first wavelet descriptor corresponding to each user operation track image in combination with the image wavelet descriptor corresponding to each user operation track image and the image wavelet descriptor corresponding to at least one user operation track image after each user operation track image includes:
determining a plurality of set numbers which are different and smaller than the number of user operation track images in the first graphical user interface interactive video;
For each set number, determining a user operation track image queue corresponding to the user operation track image, and determining a first local descriptor corresponding to the user operation track image by combining an image wavelet descriptor corresponding to each user operation track image in the user operation track image queue, wherein the user operation track image queue comprises the user operation track image and downstream user operation track images of the user operation track image, the downstream user operation track images of the user operation track image are user operation track images after the user operation track images are matched, and the number of the downstream user operation track images in the user operation track image queue is not more than the set number;
and carrying out weighted summation on a plurality of first local descriptors corresponding to the user operation track image to obtain first wavelet descriptors corresponding to the user operation track image.
In some examples, the determining the user operation track image queue corresponding to the user operation track image includes:
on the basis that the total number of the downstream user operation track images of the user operation track images is not smaller than the set number, determining the user operation track images and the set number of user operation track images behind the user operation track images as a user operation track image queue corresponding to the user operation track images;
And on the basis that the total number of the downstream user operation track images of the user operation track images is smaller than the set number, determining the user operation track images and each user operation track image behind the user operation track images as a user operation track image queue corresponding to the user operation track images.
In some examples, the determining, in combination with the image wavelet descriptors corresponding to each user operation track image in the user operation track image queue, the first local descriptor corresponding to the user operation track image includes:
performing sliding filtering operation on the image wavelet descriptors corresponding to each user operation track image in the user operation track image queue respectively to obtain sliding filtering descriptors corresponding to each user operation track image;
and determining the sliding filter sum descriptors as first local descriptors corresponding to the user operation track images.
In some examples that may be implemented independently, obtaining a second wavelet descriptor corresponding to the first graphical user interface interactive video includes:
downsampling first wavelet descriptors corresponding to a plurality of user operation track images in the first graphical user interface interactive video to obtain second wavelet descriptors;
Or determining the median value of the first wavelet descriptors corresponding to the plurality of user operation track images in the first graphical user interface interactive video as the second wavelet descriptor.
In some examples that may be implemented independently, the refining the wavelet descriptor of the interactive video of the graphical user interface to be processed by the debugged wavelet descriptor refining algorithm includes:
determining an image wavelet descriptor corresponding to each user operation track image in the target graphical user interface interactive video;
combining an image wavelet descriptor corresponding to each user operation track image and an image wavelet descriptor corresponding to at least one user operation track image behind each user operation track image in the target graphical user interface interactive video respectively, and determining a fourth wavelet descriptor corresponding to each user operation track image;
combining the fourth wavelet descriptors corresponding to each user operation track image in the target graphical user interface interactive video to determine a fifth wavelet descriptor corresponding to the target graphical user interface interactive video;
and refining the fifth wavelet descriptor through the debugged wavelet descriptor refining algorithm to obtain a sixth wavelet refined descriptor corresponding to the fifth wavelet descriptor.
In some examples that may be implemented independently, after the extracting, by the debugged wavelet descriptor extracting algorithm, the fifth wavelet descriptor to obtain a sixth wavelet extracted descriptor corresponding to the fifth wavelet descriptor, the method further includes:
acquiring a plurality of to-be-processed wavelet extraction descriptors corresponding to the to-be-processed graphical user interface interactive videos, wherein each to-be-processed wavelet extraction descriptor corresponding to each to-be-processed graphical user interface interactive video is extracted by the debugged wavelet descriptor extraction algorithm;
determining a commonality metric value between each of the to-be-processed wavelet refinement descriptors and the sixth wavelet refinement descriptor;
and determining the to-be-processed graphic user interface interactive video corresponding to the to-be-processed wavelet extraction descriptor with the commonality measurement value larger than the set limit value as a graphic user interface interactive video similar to the target graphic user interface interactive video.
A second aspect is an abnormal operation analysis server including a memory and a processor; the memory is coupled to the processor; the memory is used for storing computer program codes, and the computer program codes comprise computer instructions; wherein the processor, when executing the computer instructions, causes the abnormal operation analysis server to perform the method of the first aspect.
A third aspect is a computer readable storage medium having stored thereon a computer program which, when run, performs the method of the first aspect.
According to one embodiment of the invention, a wavelet descriptor refinement algorithm is utilized to perform descriptor refinement on a first wavelet descriptor and a second wavelet descriptor respectively to obtain the first wavelet refinement descriptor and the second wavelet refinement descriptor, in view of the fact that the first wavelet descriptor carries abnormal operation tendencies of part of user operation track images in the interactive video of a graphical user interface, the second wavelet descriptor carries abnormal operation tendencies of each user operation track image in the interactive video of the same graphical user interface, therefore, the correlation between the first wavelet descriptor and the second wavelet descriptor is higher, and in case that the accuracy of the wavelet descriptor refinement algorithm is guaranteed, the correlation between the obtained first wavelet refinement descriptor and the obtained second wavelet refinement descriptor is also higher, so that the wavelet descriptor refinement algorithm is debugged by combining with image contact evaluation vectors between each first wavelet refinement descriptor and the second wavelet refinement descriptor, the image feature mining quality of the wavelet descriptor refinement algorithm can be improved, the wavelet feature mining quality of the wavelet descriptor algorithm can be improved, and the obtained by the wavelet descriptor algorithm can be fully analyzed according to the abundant in terms of the feature of the window, and the feature of the feature is fully analyzed, and the feature of the feature has sufficient information.
Drawings
Fig. 1 is a flow chart of an abnormal operation analysis method applied to big data visualization according to an embodiment of the present invention.
Detailed Description
Hereinafter, the terms "first," "second," and "third," etc. are used for descriptive purposes only and are not to be construed as indicating or implying relative importance or implicitly indicating the number of technical features indicated. Thus, a feature defining "a first", "a second", or "a third", etc., may explicitly or implicitly include one or more such feature.
Fig. 1 shows a flow chart of an abnormal operation analysis method applied to big data visualization, which is provided by the embodiment of the invention, and the abnormal operation analysis method applied to big data visualization can be implemented by an abnormal operation analysis server, and the abnormal operation analysis server can include a memory and a processor; the memory is coupled to the processor; the memory is used for storing computer program codes, and the computer program codes comprise computer instructions; wherein the processor, when executing the computer instructions, causes the abnormal operation analysis server to execute the technical solution described in step 201-step 204.
Step 201, an abnormal operation analysis server obtains a first wavelet descriptor corresponding to each user operation track image in a first graphical user interface interactive video and a second wavelet descriptor corresponding to the first graphical user interface interactive video.
The first GUI interactive video may be any kind of GUI interactive video, for example, GUI interactive video for an online e-commerce service. The first wavelet descriptors corresponding to the user operation track images reflect abnormal operation tendencies (such as operation habits, operation characteristics and the like with risks) of the user operation track images in the first graphical user interface interactive video, and the second wavelet descriptors are determined by combining the first wavelet descriptors corresponding to each user operation track image, so that the second wavelet descriptors can reflect the abnormal operation tendencies of each user operation track image in the first graphical user interface interactive video. The first wavelet descriptor and the second wavelet descriptor are wavelet descriptors in an image feature relation network. Further, the wavelet descriptor may be understood as characteristic information of the graphic user interface interactive video/user operation track image.
Step 202, the abnormal operation analysis server refines each first wavelet descriptor and each second wavelet descriptor through a wavelet descriptor refinement algorithm to obtain a first wavelet refinement descriptor corresponding to each first wavelet descriptor and a second wavelet refinement descriptor corresponding to each second wavelet descriptor.
Wherein the wavelet descriptor refinement algorithm is used to refine the wavelet descriptor of the graphical user interface interactive video (which can be understood as an image feature encoding process). After obtaining each first wavelet descriptor and each second wavelet descriptor, the abnormal operation analysis server refines each first wavelet descriptor through a wavelet descriptor refinement algorithm to obtain a first wavelet refinement descriptor corresponding to each first wavelet descriptor. And the abnormal operation analysis server refines the second wavelet descriptors through a wavelet descriptor refinement algorithm to obtain second wavelet refinement descriptors corresponding to the second wavelet descriptors. Accordingly, a wavelet refinement descriptor may be understood as a wavelet coding feature.
Step 203, the abnormal operation analysis server combines the first image association evaluation vector between each first wavelet extraction descriptor and each second wavelet extraction descriptor, and debugs the wavelet extraction descriptor refinement algorithm.
The abnormal operation analysis server obtains a first image association evaluation vector between each first wavelet refinement descriptor and each second wavelet refinement descriptor, wherein the first image association evaluation vector corresponding to the first wavelet refinement descriptor can reflect the relevance/association between the first wavelet refinement descriptor and the second wavelet refinement descriptor. The image contact rating vector can thus be understood as an association vector or an association feature.
The abnormal operation analysis server coordinates the wavelet descriptor refinement algorithm in combination with the first image contact evaluation vector. In view of the fact that the first wavelet extraction descriptor and the second wavelet extraction descriptor are obtained by extracting the first wavelet descriptor and the second wavelet descriptor respectively by a wavelet descriptor extracting algorithm, and the first wavelet descriptor and the second wavelet descriptor can reflect abnormal operation tendencies of user operation track images in the same graphic user interface interactive video, the higher the correlation between the first wavelet extraction descriptor and the second wavelet descriptor is, the higher the correlation between the first wavelet extraction descriptor and the second wavelet extraction descriptor is, in other words, the higher the descriptor extracting performance of the wavelet descriptor extracting algorithm is, and in other words, the more accurate the wavelet descriptor extracting algorithm is. In view of the first image association evaluation vector reflecting the correlation between the first wavelet refinement descriptor and the second wavelet refinement descriptor, the abnormal operation analysis server may debug the wavelet descriptor refinement algorithm using the first image association evaluation vector so that the correlation between the wavelet refinement descriptors obtained by the wavelet descriptor refinement algorithm is higher and higher, thereby improving the image feature mining quality of the wavelet descriptor refinement algorithm.
And 204, the abnormal operation analysis server refines the wavelet descriptors of the interactive video of the graphical user interface to be processed through a debugged wavelet descriptor refinement algorithm.
The abnormal operation analysis server is used for debugging the wavelet description sub-extraction algorithm to obtain the debugged wavelet description sub-extraction algorithm. The abnormal operation analysis server can refine the wavelet descriptors of the interactive video of the graphic user interface to be processed through the debugged wavelet descriptor refinement algorithm to obtain corresponding wavelet refinement descriptors.
It will be appreciated that, in order to debug the wavelet descriptor refinement algorithm, the abnormal operation analysis server first obtains a plurality of gui interactive videos as an algorithm debugging basis (sample set), and the process of debugging the wavelet descriptor refinement algorithm in combination with the plurality of gui interactive videos includes multiple cycles of debugging, and at least one gui interactive video is combined for debugging in each cycle of debugging.
It can be seen that, by using the wavelet descriptor refinement algorithm, the first wavelet descriptor and the second wavelet descriptor are respectively refined to obtain the first wavelet refinement descriptor and the second wavelet refinement descriptor, in view of the fact that the first wavelet descriptor carries the abnormal operation tendency of part of the user operation track images in the interactive video of the graphical user interface, the second wavelet descriptor carries the abnormal operation tendency of each user operation track image in the interactive video of the same graphical user interface, so that the correlation between the first wavelet descriptor and the second wavelet descriptor is higher, and in case that the accuracy of the wavelet descriptor refinement algorithm is guaranteed, the correlation between the obtained first wavelet refinement descriptor and the second wavelet refinement descriptor is also higher, so that the image association evaluation vector between each first wavelet refinement descriptor and the second wavelet refinement descriptor is combined to debug the wavelet descriptor refinement algorithm, the image feature mining quality of the wavelet descriptor refinement algorithm can be improved, the correlation between the wavelet descriptor obtained by the wavelet descriptor refinement algorithm and the second wavelet descriptor is improved, and the abnormal operation feature refinement algorithm can be fully analyzed according to any abundant image feature of the obtained by the wavelet descriptor, and the feature of the subsequent wavelet descriptor has sufficient analysis.
In other examples, a design concept of the abnormal operation analysis method applied to big data visualization may further include what is described in steps 301 to 314.
Step 301, an abnormal operation analysis server obtains a first wavelet descriptor corresponding to each user operation track image in a first graphical user interface interactive video and a second wavelet descriptor corresponding to the first graphical user interface interactive video.
The first wavelet descriptors corresponding to the user operation track images reflect abnormal operation tendencies of the user operation track images in the first graphical user interface interactive video, and the second wavelet descriptors are determined by combining the first wavelet descriptors corresponding to each user operation track image. Whereas the first wavelet descriptor may reflect the abnormal operational tendency of a portion of the user operational track images in the first graphical user interface interactive video, the second wavelet descriptor may reflect the abnormal operational tendency of each user operational track image in the first graphical user interface interactive video, and thus it may be understood that the first wavelet descriptor is a "stage" wavelet descriptor of the first graphical user interface interactive video, and the second wavelet descriptor is a "whole" wavelet descriptor of the first graphical user interface interactive video. Each user operation track image in the first graphic user interface interaction video corresponds to a first wavelet descriptor, the first graphic user interface interaction video corresponds to a second wavelet descriptor, and the first wavelet descriptor and the second wavelet descriptor are wavelet descriptors in an image characteristic relation network. Illustratively, the first wavelet descriptor and the second wavelet descriptor are description vectors or knowledge fields, etc.
For some exemplary design ideas, the abnormal operation analysis server acquires a first graphical user interface interaction video, determines an image wavelet descriptor corresponding to each user operation track image in the first graphical user interface interaction video, and respectively combines the image wavelet descriptor corresponding to each user operation track image and at least one image wavelet descriptor corresponding to at least one user operation track image behind each user operation track image to determine a first wavelet descriptor corresponding to each user operation track image. The image wavelet descriptors corresponding to the user operation track images reflect abnormal operation trends corresponding to the user operation track images, for example, the image wavelet descriptors are convolution features or residual features.
The method comprises the steps that a plurality of user operation track images in a first graphical user interface interactive video are ordered according to a video stream sequence, and the ordered plurality of user operation track images form a section of continuous video stream. The image wavelet descriptors corresponding to the user operation track images can only reflect abnormal operation trends of single user operation track images, and cannot reflect abnormal operation trends between front and back in the graphical user interface interactive video. Therefore, for each user operation track image, the abnormal operation analysis server determines an image wavelet descriptor corresponding to the user operation track image and an image wavelet descriptor corresponding to the user operation track image after the user operation track image to determine a first wavelet descriptor corresponding to the user operation track image, wherein the first wavelet descriptor introduces the abnormal operation tendency of the user operation track image and the abnormal operation tendency of the user operation track image neighbor, so that the first wavelet descriptor can reflect the sequential connection between the user operation track image and the user operation track image of the neighbor, and the detail feature record richness of the first wavelet descriptor is improved.
Illustratively, the abnormal operation analysis server determines a plurality of set numbers that are different and less than the number of user operation trace images in the first graphical user interface interactive video. For each set number, determining a user operation track image queue corresponding to the user operation track image, and determining a first local descriptor corresponding to the user operation track image by combining with an image wavelet descriptor corresponding to each user operation track image in the user operation track image queue, wherein the user operation track image queue comprises the user operation track image and downstream user operation track images of the user operation track image, the downstream user operation track images of the user operation track image are user operation track images positioned behind the user operation track image, and the number of the downstream user operation track images in the user operation track image queue is not more than the set number. And the abnormal operation analysis server performs weighted summation on a plurality of first local descriptors corresponding to the user operation track image to obtain first wavelet descriptors corresponding to the user operation track image. For example, the abnormal operation analysis server fuses a plurality of first local descriptors to obtain the first wavelet descriptors.
In order to further improve the detail richness of the first wavelet descriptors, the abnormal operation analysis server may fuse a plurality of first local descriptors corresponding to the user operation track image into the first wavelet descriptors. In order to extract the first local descriptors of different sizes, the different first local descriptors may be determined according to different numbers of image wavelet descriptors corresponding to the user operation trajectory images. Thus, the abnormal operation analysis server first acquires a plurality of different set numbers, which are preset by the abnormal operation analysis server, for example.
For each set number, the abnormal operation analysis server determines at least one downstream user operation track image which is not more than the set number after the user operation track image, forms a user operation track image queue corresponding to the user operation track image and determines an image wavelet descriptor corresponding to the user operation track image and an image wavelet descriptor corresponding to the downstream user operation track image in the user operation track image queue, and determines a first local descriptor corresponding to the user operation track image by combining the image wavelet descriptor corresponding to each user operation track image in the user operation track image queue. The abnormal operation analysis server sequentially walks each set number of the plurality of set numbers based on the above idea, thereby obtaining a first local descriptor corresponding to each set number, in other words, obtaining a plurality of first local descriptors corresponding to the user operation track image.
For each set number, the abnormal operation analysis server determines a user operation trajectory image queue corresponding to the user operation trajectory image, including the following two cases: and on the basis that the total number of the downstream user operation track images of the user operation track images is not smaller than the set number, determining the user operation track images and the set number of user operation track images behind the user operation track images as a user operation track image queue corresponding to the user operation track images. And on the basis that the total number of the downstream user operation track images of the user operation track images is smaller than the set number, determining the user operation track images and each user operation track image behind the user operation track images as a user operation track image queue corresponding to the user operation track images.
The abnormal operation analysis server may load the user operation track image into the user operation track image queue, and acquire a first user operation track image after the user operation track image, load the first user operation track image into the user operation track image queue, and the abnormal operation analysis server continuously acquires a second user operation track image after the user operation track image, load the second user operation track image into the user operation track image queue until the abnormal operation analysis server acquires a first set number of user operation track images after the user operation track image, load the first set number of user operation track images into the user operation track image queue, in other words, on the basis that the total number of downstream user operation track images of the user operation track images is not less than the set number, the abnormal operation analysis server may acquire the set number of downstream user operation track images, so that the abnormal operation analysis server loads the acquired set number of downstream user operation track images into the user operation track image queue. If the abnormal operation analysis server has already acquired the last user operation track image in the first graphical user interface interactive video, and loads the last user operation track image into the user operation track image queue, the abnormal operation analysis server does not acquire the first set number of user operation track images at this time, in other words, on the basis that the total number of the downstream user operation track images of the user operation track images is smaller than the set number, the abnormal operation analysis server cannot acquire the set number of downstream user operation track images, so that the abnormal operation analysis server only loads each acquired downstream user operation track image into the user operation track image queue.
Or, the abnormal operation analysis server may determine the total number of the downstream user operation track images of the user operation track images, determine whether the total number of the downstream user operation track images is smaller than the set number, and if the total number is not smaller than the set number, directly obtain the set number of the downstream user operation track images after the user operation track images, and determine the user operation track images and the obtained set number of the downstream user operation track images as a user operation track image queue corresponding to the user operation track images. If the total number is smaller than the set number, each downstream user operation track image after the user operation track image is directly obtained, and the user operation track image and each obtained downstream user operation track image are determined to be a user operation track image queue corresponding to the user operation track image.
For example, the plurality of setting numbers are 0, 2, and 4, respectively. The abnormal operation analysis server combines the image wavelet descriptors corresponding to the user operation track image to determine a first local descriptor corresponding to the user operation track image, the abnormal operation analysis server combines the image wavelet descriptors corresponding to the user operation track image and the image wavelet descriptors corresponding to the 2 user operation track images after the user operation track image to determine a first local descriptor corresponding to the user operation track image, the abnormal operation analysis server combines the image wavelet descriptors corresponding to the user operation track image and the image wavelet descriptors corresponding to the 4 user operation track images after the user operation track image to determine a first local descriptor corresponding to the user operation track image, and finally 3 first local descriptors corresponding to the user operation track image are obtained.
Illustratively, the abnormal operation analysis server determines a first local descriptor corresponding to the user operation track image in combination with the image wavelet descriptor corresponding to each user operation track image in the user operation track image queue, including: and respectively carrying out sliding filtering operation on the image wavelet descriptors corresponding to each user operation track image in the user operation track image queue to obtain sliding filtering descriptors corresponding to each user operation track image, and determining a plurality of sliding filtering sum descriptors as first local descriptors corresponding to the user operation track images. Illustratively, the abnormal operation analysis server processes the sliding filter sum descriptor by using a sigmoid operator, and determines the processed wavelet descriptor as the first local descriptor.
The abnormal operation analysis server can conduct sliding filtering operation on the image wavelet descriptors corresponding to the first user operation track image in the user operation track image queue to obtain first sliding filtering descriptors, and continues to conduct sliding filtering operation on the image wavelet descriptors corresponding to the second user operation track image in the user operation track image queue to obtain second sliding filtering descriptors until the abnormal operation analysis server obtains the sliding filtering descriptors corresponding to the last user operation track image in the user operation track image queue, so that sliding filtering descriptors corresponding to each user operation track image in the user operation track image queue are obtained. Or the abnormal operation analysis server performs sliding filtering operation on the image wavelet descriptors corresponding to each user operation track image in the user operation track image queue in parallel to obtain sliding filtering descriptors corresponding to each user operation track image.
And if the sliding filter descriptor corresponding to the user operation track image is a description vector, summing the sliding filter descriptors by the abnormal operation analysis server to obtain a sliding filter sum descriptor, and determining the sliding filter sum descriptor as a first local descriptor corresponding to the user operation track image.
For other exemplary embodiments, the abnormal operation analysis server obtains a second wavelet descriptor corresponding to the first graphical user interface interactive video, including: and the abnormal operation analysis server downsamples the first wavelet descriptors corresponding to the plurality of user operation track images in the first graphical user interface interactive video to obtain second wavelet descriptors. Or the abnormal operation analysis server determines the median value of the first wavelet descriptors corresponding to the plurality of user operation track images in the first graphical user interface interactive video as the second wavelet descriptor. In addition, the abnormal operation analysis server may further determine the second wavelet descriptors by using another thought, for example, fusing the first wavelet descriptors corresponding to each user operation track image to obtain the second wavelet descriptors corresponding to the first graphical user interface interactive video.
Step 302, the abnormal operation analysis server refines each first wavelet descriptor and each second wavelet descriptor through a wavelet descriptor refinement algorithm, so as to obtain a first wavelet refinement descriptor corresponding to each first wavelet descriptor and a second wavelet refinement descriptor corresponding to each second wavelet descriptor.
The wavelet descriptor refinement algorithm is used to refine the wavelet descriptor of the graphical user interface interactive video. After obtaining each first wavelet descriptor and each second wavelet descriptor, the abnormal operation analysis server refines each first wavelet descriptor through a wavelet descriptor refinement algorithm to obtain a first wavelet refinement descriptor corresponding to each first wavelet descriptor. And the abnormal operation analysis server refines the second wavelet descriptors through a wavelet descriptor refinement algorithm to obtain second wavelet refinement descriptors corresponding to the second wavelet descriptors.
In view of the fact that the first wavelet extraction descriptor can reflect an abnormal operation tendency of one user operation track image and at least one user operation track image behind the user operation track image, the second wavelet extraction descriptor can reflect an abnormal operation tendency of each user operation track image in the first graphical user interface interactive video, the wavelet extraction descriptor extraction algorithm is debugged by the aid of the first wavelet extraction descriptor and the second wavelet extraction descriptor, the association between the sequence of the user operation track images and the front and back in the graphical user interface interactive video is introduced, so that the wavelet extraction descriptor extraction algorithm can extract flow deduction features among the user operation track images in the graphical user interface interactive video, and accuracy and richness of descriptor extraction are improved.
For some exemplary design considerations, the first wavelet descriptor and the second wavelet descriptor obtained in step 301 are formed from descriptive variables, such as descriptive vectors or knowledge fields. The first wavelet descriptor and the second wavelet descriptor are wavelet descriptors in an image feature relation network, or descriptive variables in the first wavelet descriptor and the second wavelet descriptor are values in the image feature relation network, and the image feature relation network is a space formed by uninterrupted variable intervals, such as variable intervals of 0-1 in the image feature relation network. And the abnormal operation analysis server maps the first graphical user interface interactive video into at least one description variable in the variable interval according to the abnormal operation tendency of the first graphical user interface interactive video to obtain a wavelet descriptor in the image characteristic relation network. In the embodiment of the invention, the wavelet descriptors in the image characteristic relation network are extracted and mapped into the wavelet descriptors in the distributed relation network, so that the first wavelet extraction descriptors and the second wavelet extraction descriptors are the wavelet descriptors in the distributed relation network, or the descriptive variables in the first wavelet extraction descriptors and the second wavelet extraction descriptors are numerical values in the distributed relation network, the distributed relation network is a space formed by discontinuous numerical values, for example, the distributed relation network is 0 and 1, and the abnormal operation analysis server maps the descriptive variables in the first wavelet descriptors and the second wavelet descriptors into the numerical values in the distributed relation network to obtain the wavelet descriptors in the distributed relation network.
In view of the fact that the first wavelet descriptor and the second wavelet descriptor are wavelet descriptors in the image feature relation network, if the first wavelet descriptor and the second wavelet descriptor are directly applied to the task of interactive video recognition of a graphical user interface or interactive video query of the graphical user interface, the computational load is relatively large, and therefore the first wavelet descriptor and the second wavelet descriptor are refined to obtain a first wavelet refined descriptor and a second wavelet refined descriptor in the distributed relation network. By converting the wavelet descriptors of the image characteristic relation network into the wavelet descriptors of the distributed relation network, the operation load can be saved, and the processing efficiency can be improved.
For some exemplary design ideas, the wavelet descriptor refinement algorithm is a deep learning network, or the wavelet descriptor refinement algorithm is a residual network, or the wavelet descriptor refinement algorithm is a recurrent neural network, etc., the embodiments of the present invention do not limit the category of the wavelet descriptor refinement algorithm.
Step 303, the abnormal operation analysis server determines a first image association evaluation vector between each first wavelet refinement descriptor and the second wavelet refinement descriptor.
After obtaining a first wavelet extraction descriptor corresponding to each user operation track image and a second wavelet extraction descriptor corresponding to the first graphical user interface interactive video, the abnormal operation analysis server determines a first image association evaluation vector between each first wavelet extraction descriptor and the second wavelet extraction descriptor, wherein the first image association evaluation vector corresponding to the first wavelet extraction descriptor can reflect the correlation between the first wavelet extraction descriptor and the second wavelet extraction descriptor. Illustratively, the first image association evaluation vector is a wavelet descriptor in numerical form, the larger the first image association evaluation vector, the greater the correlation between the first wavelet refinement descriptor and the second wavelet refinement descriptor, and the smaller the first image association evaluation vector, the smaller the correlation between the first wavelet refinement descriptor and the second wavelet refinement descriptor.
For some exemplary design considerations, the first image-wise evaluation vector is a cross feature between the first wavelet refinement descriptor and the first image-wise evaluation vector, the cross feature being a feature for performing a relevance analysis.
For some exemplary design ideas, the abnormal operation analysis server performs decision analysis (discrimination processing) on the first wavelet extraction descriptor and the second wavelet extraction descriptor through a decision tree algorithm to obtain a decision analysis result, wherein the decision analysis result reflects the probability that the user operation track image corresponding to the first wavelet extraction descriptor belongs to the graphical user interface interactive video corresponding to the second wavelet extraction descriptor. The abnormal operation analysis server determines a decision analysis result as a first image contact evaluation vector corresponding to the first wavelet refinement descriptor.
In the embodiment of the invention, the first wavelet extraction descriptor may reflect the abnormal operation tendency of part of the user operation track images in the first graphical user interface interactive video, the second wavelet extraction descriptor may reflect the abnormal operation tendency of each user operation track image in the first graphical user interface interactive video, it may be understood that the first wavelet extraction descriptor is a "stage wavelet extraction descriptor" corresponding to the first graphical user interface interactive video, the second wavelet extraction descriptor is an "integral wavelet extraction descriptor" corresponding to the first graphical user interface interactive video, and the correlation between the first wavelet extraction descriptor and the second wavelet extraction descriptor may be understood as the probability that the first wavelet extraction descriptor and the second wavelet extraction descriptor correspond to the same graphical user interface interactive video, in other words, the probability that the user operation track image corresponding to the first wavelet extraction descriptor belongs to the graphical user interface interactive video corresponding to the second wavelet extraction descriptor. The higher the correlation between the first wavelet refinement descriptor and the second wavelet refinement descriptor, the higher the probability that the first wavelet refinement descriptor corresponds to the same graphical user interface interactive video as the second wavelet refinement descriptor, the lower the correlation between the first wavelet refinement descriptor and the second wavelet refinement descriptor, and the lower the probability that the first wavelet refinement descriptor corresponds to the same graphical user interface interactive video as the second wavelet refinement descriptor. Thus, the abnormal operation analysis server may determine a decision analysis result of the first wavelet refinement descriptor and the second wavelet refinement descriptor as a first image association evaluation vector between the first wavelet refinement descriptor and the second wavelet refinement descriptor.
And 304, the abnormal operation analysis server acquires a third wavelet descriptor corresponding to the user operation track image in the second graphical user interface interactive video.
The second graphical user interface interactive video is different from the first graphical user interface interactive video, and a third wavelet descriptor corresponding to the user operation track image in the second graphical user interface interactive video reflects abnormal operation tendency of the user operation track image in the second graphical user interface interactive video. The third wavelet descriptor is the same as the first wavelet descriptor in the step, and can be understood as a 'stage wavelet descriptor' of the second graphical user interface interactive video.
And 305, the abnormal operation analysis server refines the third wavelet descriptor through a wavelet descriptor refinement algorithm to obtain a third wavelet refinement descriptor corresponding to the third wavelet descriptor.
Step 306, the abnormal operation analysis server determines a second image association evaluation vector between the third wavelet refinement descriptor and the second wavelet refinement descriptor.
Wherein the second image association evaluation vector reflects a correlation between the third wavelet refinement descriptor and the second wavelet refinement descriptor.
The concept of determining the second image association evaluation vector in the steps 304-306 is similar to the concept of determining the first image association evaluation vector in the steps 301-303.
Step 307, the abnormal operation analysis server determines a first video wavelet descriptor corresponding to the first graphical user interface interactive video.
The abnormal operation analysis server extracts wavelet descriptors of the first graphical user interface interactive video to obtain first video wavelet descriptors corresponding to the first graphical user interface interactive video, wherein the first video wavelet descriptors reflect abnormal operation trends of the first graphical user interface interactive video.
The first wavelet descriptor, the second wavelet descriptor and the third wavelet descriptor are obtained by combining abnormal operation tendency of the user operation track image, the first wavelet descriptor, the second wavelet descriptor and the third wavelet descriptor are wavelet descriptors of the user operation track image dimension, the first video wavelet descriptor is obtained by combining abnormal operation tendency of the graphical user interface interactive video, and the first video wavelet descriptor is a wavelet descriptor of the graphical user interface interactive video dimension.
And 308, the abnormal operation analysis server refines the first video wavelet descriptor through a wavelet descriptor refinement algorithm to obtain a fourth wavelet refinement descriptor.
Step 309, the abnormal operation analysis server determines a third image association evaluation vector between the fourth wavelet refinement descriptor and the second wavelet refinement descriptor.
Wherein the third image association evaluation vector reflects a correlation between the fourth wavelet refinement descriptor and the second wavelet refinement descriptor;
the concept of determining the third image association rating vector in the steps 308-309 is similar to the concept of determining the first image association rating vector in the steps 302-303.
Step 310, the abnormal operation analysis server determines a second video wavelet descriptor corresponding to the second graphical user interface interactive video.
The abnormal operation analysis server extracts wavelet descriptors of the second graphical user interface interactive video to obtain second video wavelet descriptors corresponding to the second graphical user interface interactive video, and the second video wavelet descriptors reflect abnormal operation tendency of the second graphical user interface interactive video. The second video wavelet descriptor is the same as the first video wavelet descriptor in the step, and can be understood as a wavelet descriptor of the graphical user interface interaction video level of the second graphical user interface interaction video.
Step 311, the abnormal operation analysis server refines the second video wavelet descriptor through a wavelet descriptor refinement algorithm to obtain a fifth wavelet refinement descriptor.
Step 312, the abnormal operation analysis server determines a fourth image association assessment vector between the fifth wavelet refinement descriptor and the second wavelet refinement descriptor.
Wherein the fourth image association evaluation vector reflects a correlation between the fifth wavelet refinement descriptor and the second wavelet refinement descriptor.
The concept of determining the fourth image association evaluation vector in the steps 311-312 is similar to the concept of determining the first image association evaluation vector in the steps 302-303.
Step 313, the abnormal operation analysis server combines each of the first image association evaluation vector, the second image association evaluation vector, the third image association evaluation vector and the fourth image association evaluation vector to determine the algorithm quality variable, and debugging the wavelet description sub-refinement algorithm in combination with the algorithm quality variable.
The algorithm good and bad variables, the first image association evaluation vector and the third image association evaluation vector form a first set relation, and the algorithm good and bad variables, the second image association evaluation vector and the fourth image association evaluation vector form a second set relation. The abnormal operation analysis server is combined with the algorithm good and bad variables to debug the wavelet descriptor refining algorithm so as to enable the algorithm good and bad variables (loss function values) to slowly and stably trend. In other words, the larger the first image association evaluation vector and the third image association evaluation vector, the smaller the algorithm merit variable, and the smaller the first image association evaluation vector and the third image association evaluation vector, the larger the algorithm merit variable. The larger the second image association evaluation vector and the fourth image association evaluation vector are, the larger the algorithm quality variable is, and the smaller the second image association evaluation vector and the fourth image association evaluation vector are, the smaller the algorithm quality variable is. The smaller the algorithm quality variable is, the better the image feature mining quality of the wavelet descriptor refining algorithm is, the larger the debugging cost is, and the worse the image feature mining quality of the wavelet descriptor refining algorithm is.
In view of the fact that the first wavelet extraction descriptor and the second wavelet extraction descriptor are obtained by extracting the first wavelet descriptor and the second wavelet descriptor respectively by a wavelet descriptor extracting algorithm, the user operation track image corresponding to the first wavelet descriptor belongs to the graphical user interface interactive video corresponding to the second wavelet descriptor, and the higher the correlation between the first wavelet extraction descriptor and the second wavelet extraction descriptor is, the higher the descriptor extracting performance of the wavelet descriptor extracting algorithm is, in other words, the more accurate the wavelet descriptor extracting algorithm is. In view of the correlation between the first wavelet refinement descriptor and the second wavelet refinement descriptor reflected by the first image association evaluation vector, the abnormal operation analysis server may debug the wavelet description sub-refinement algorithm with the first image association evaluation vector as a positive example of the user operation trajectory image dimension to make the first image association evaluation vector larger and larger, thereby improving the image feature mining quality of the wavelet description sub-refinement algorithm.
In view of the fact that the third wavelet extraction descriptor and the second wavelet extraction descriptor are obtained by extracting the third wavelet descriptor and the second wavelet descriptor respectively by a wavelet descriptor extracting algorithm, the user operation track image corresponding to the third wavelet descriptor does not belong to the graphical user interface interactive video corresponding to the second wavelet descriptor, and the correlation between the third wavelet extraction descriptor and the second wavelet extraction descriptor is lower, the lower the correlation between the third wavelet extraction descriptor and the second wavelet extraction descriptor is, the higher the descriptor extracting performance of the wavelet descriptor extracting algorithm is, in other words, the more accurate the wavelet descriptor extracting algorithm is. In view of the second image association evaluation vector reflecting the correlation between the first wavelet refinement descriptor and the second wavelet refinement descriptor, the abnormal operation analysis server may debug the wavelet description refinement algorithm with the second image association evaluation vector as a negative example of the user operation trace image dimension to make the second image association evaluation vector smaller and smaller, thereby improving the image feature mining quality of the wavelet description refinement algorithm.
The first image association evaluation vector and the second image association evaluation vector belong to the image association evaluation vector of the user operation track image dimension, so that the wavelet description sub-extraction algorithm can extract more abundant and complete abnormal operation tendency information, and the abnormal operation analysis server further adopts a third image association evaluation vector and a fourth image association evaluation vector of the graphical user interface interaction video dimension to debug the wavelet description sub-extraction algorithm.
In view of the fact that the fourth wavelet refinement descriptor and the second wavelet refinement descriptor are obtained by refining the first video wavelet descriptor and the second wavelet descriptor respectively by a wavelet descriptor refining algorithm, the graphical user interface interaction video corresponding to the first video wavelet descriptor and the graphical user interface interaction video corresponding to the second wavelet descriptor belong to the same graphical user interface interaction video, and the correlation of the first video wavelet descriptor and the second wavelet descriptor is higher, the higher the correlation of the fourth wavelet refinement descriptor and the second wavelet refinement descriptor is, the higher the descriptor refining performance of the wavelet descriptor refining algorithm is, in other words, the more accurate the wavelet descriptor refining algorithm is. In view of the third image association evaluation vector reflecting the correlation between the first wavelet refinement descriptor and the second wavelet refinement descriptor, the abnormal operation analysis server may debug the wavelet description refinement algorithm with the third image association evaluation vector as a negative example of the graphical user interface interactive video dimension to make the third image association evaluation vector larger and larger, thereby improving the image feature mining quality of the wavelet description refinement algorithm.
In view of the fact that the fifth wavelet refinement descriptor and the second wavelet refinement descriptor are obtained by refining the second video wavelet descriptor and the second wavelet descriptor by the wavelet descriptor refining algorithm, respectively, the graphical user interface interaction video corresponding to the second video wavelet descriptor and the graphical user interface interaction video corresponding to the second wavelet descriptor do not belong to the same graphical user interface interaction video, and the correlation between the second video wavelet descriptor and the second wavelet descriptor is relatively low, the lower the correlation between the fifth wavelet refinement descriptor and the second wavelet refinement descriptor is, the higher the descriptor refining performance of the wavelet descriptor refining algorithm is, in other words, the more accurate the wavelet descriptor refining algorithm is. In view of the fourth image association evaluation vector reflecting the correlation between the fifth wavelet refinement descriptor and the second wavelet refinement descriptor, the abnormal operation analysis server may debug the wavelet description refinement algorithm with the fourth image association evaluation vector as a negative example of the graphical user interface interactive video dimension to make the fourth image association evaluation vector smaller and smaller, thereby improving the image feature mining quality of the wavelet description refinement algorithm.
The traditional scheme directly uses the image wavelet descriptors corresponding to the user operation track images in the graphic user interface interactive video to debug the wavelet descriptor refining algorithm, but in view of the fact that the descriptor refining process is more biased to classifying features in the wavelet refined descriptors, in other words, the wavelet refined descriptors corresponding to the graphic user interface interactive video of the same classifying label are expected to be similar, so that the wavelet refined descriptors obtained by adopting the traditional scheme carry a lot of noise, and the performance of the wavelet descriptor refining algorithm is difficult to be ensured. In the embodiment of the invention, the correlation between the stage wavelet descriptors (the first wavelet extraction descriptors) and the whole wavelet descriptors (the second wavelet extraction descriptors) is maximized, so that the extracted whole wavelet descriptors keep abnormal operation trend information related to the stage wavelet descriptors as far as possible, and relevant noise in each stage wavelet descriptor is filtered, thereby improving the extraction precision and reliability of the wavelet descriptor extraction algorithm.
For some exemplary design considerations, the first graphical user interface interactive video includes user operation track images corresponding to a plurality of video stream timing labels. The abnormal operation analysis server respectively combines the first image association evaluation vector and the second image association evaluation vector corresponding to each video stream time sequence label, determines the debugging cost corresponding to each video stream time sequence label, wherein the debugging cost and the first image association evaluation vector are in a second set relation, and the debugging cost and the second image association evaluation vector are in a first set relation, the first image association evaluation vector corresponding to the video stream time sequence label is a first image association evaluation vector corresponding to a user operation track image positioned at the video stream time sequence label in the first graphical user interface interactive video, and the second image association evaluation vector corresponding to the video stream time sequence label is a second image association evaluation vector corresponding to a user operation track image positioned at the video stream time sequence label in the second graphical user interface interactive video; and carrying out weighted summation on the debugging cost corresponding to each video stream time sequence label to obtain an algorithm good and bad variable, wherein the algorithm good and bad variable and the debugging cost are in a first set relation.
Wherein the first graphical user interface interactive video comprises user operation track images corresponding to a plurality of video stream timing labels and the second graphical user interface interactive video comprises user operation track images corresponding to a plurality of video stream timing labels. For each video stream time sequence label, the abnormal operation analysis server acquires a first image connection evaluation vector corresponding to a user operation track image positioned in the video stream time sequence label in a first graphical user interface interactive video, acquires a second image connection evaluation vector corresponding to a user operation track image positioned in the video stream time sequence label in a second graphical user interface interactive video, wherein the first image connection evaluation vector is an active example corresponding to the video stream time sequence label, the second image connection evaluation vector is a negative example corresponding to the video stream time sequence label, the abnormal operation analysis server combines the active example and the negative example to determine the debugging cost corresponding to the video stream time sequence label, the larger the first image connection evaluation vector is, the larger the debugging cost is, the smaller the first image connection evaluation vector is, the smaller the debugging cost is, the larger the second image connection evaluation vector is, the debugging cost is smaller, and the smaller the second image connection evaluation vector is, and the debugging cost is larger. The debugging cost can be understood as the accuracy of each wavelet extraction descriptor corresponding to the video stream time sequence label, the larger the debugging cost is, the better the image feature mining quality of the wavelet description sub-extraction algorithm is, the smaller the debugging cost is, and the worse the image feature mining quality of the wavelet description sub-extraction algorithm is.
In view of the fact that the first graphical user interface interactive video corresponds to a plurality of video stream time sequence labels, each video stream time sequence label corresponds to one debugging cost, and therefore a plurality of debugging costs are obtained. And the abnormal operation analysis server performs weighted summation on the plurality of debugging costs to obtain the algorithm quality variable. For example, the abnormal operation analysis server sums the debugging costs and then obtains the opposite number to obtain the algorithm quality variable. The algorithm good and bad variables and the debugging cost are in a first set relation, in other words, the smaller the algorithm good and bad variables are, the smaller the debugging cost is, and the larger the algorithm good and bad variables are.
For other exemplary embodiments, as described in step 303, the abnormal operation analysis server obtains the first image association evaluation vector, the second image association evaluation vector, the third image association evaluation vector, and the fourth image association evaluation vector through a decision tree algorithm, and then the abnormal operation analysis server coordinates the wavelet description sub-refinement algorithm and the decision tree algorithm in combination with the algorithm goodness variable. In other words, the abnormal operation analysis server can debug the wavelet descriptor refining algorithm in combination with the algorithm superior and inferior variables and also debug the decision tree algorithm in combination with the algorithm superior and inferior variables so as to improve the accuracy and richness of the decision tree algorithm.
For further exemplary embodiments, the wavelet descriptor refinement algorithm is configured to perform HASH feature extraction, the first wavelet descriptor, the second wavelet descriptor, the third wavelet descriptor, the first video wavelet descriptor, and the second video wavelet descriptor in the step are wavelet descriptors in an image feature relational network, and the first wavelet refinement descriptor, the second wavelet refinement descriptor, the third wavelet refinement descriptor, the fourth wavelet refinement descriptor, and the fifth wavelet refinement descriptor are HASH descriptors in a distributed relational network, wherein the HASH descriptors obey a set probability distribution.
In some examples, a design concept for algorithm debugging may be implemented as follows.
The first graphical user interface interactive video comprises a user operation track image picture A1, a user operation track image picture A2 and a user operation track image picture A3, the second graphical user interface interactive video comprises a user operation track image picture B1, a user operation track image picture B2 and a user operation track image picture B3, the abnormal operation analysis server obtains a first wavelet extraction description sub-vec 1, a first wavelet extraction description sub-vec 2 and a first wavelet extraction description sub-vec 3 corresponding to the user operation track image in the first graphical user interface interactive video through a wavelet description sub-extraction algorithm, and a second wavelet extraction description sub-and a fourth wavelet extraction description sub-of the user operation track image dimension corresponding to the first graphical user interface interactive video, and obtains a third wavelet extraction description sub-vec 4, a third wavelet extraction description sub-video dimension corresponding to the user operation track image in the second graphical user interface interactive video through a wavelet description sub-extraction algorithm, and a third wavelet extraction description sub-vec 6 corresponding to the third wavelet extraction description sub-vec 2 and the third wavelet extraction description sub-video dimension and a fifth wavelet extraction description sub-vec 3 corresponding to the user operation track image in the first graphical user interface interactive video.
The abnormal operation analysis server processes the first graphical user interface interactive video as a positive example and the second graphical user interface interactive video as a negative example, and then respectively takes each first wavelet extraction descriptor, each third wavelet extraction descriptor, each fourth wavelet extraction descriptor and each fifth wavelet extraction descriptor and the second wavelet extraction descriptor as a binary group, transmits the binary group to a decision tree algorithm for decision analysis, obtains the cross characteristic between each wavelet extraction descriptor and the second wavelet extraction descriptor, and debugs the wavelet extraction algorithm and the decision tree algorithm by maximizing the cross characteristic of the positive example and minimizing the cross characteristic of the negative example.
The abnormal operation analysis server processes the second graphical user interface interactive video as a positive example and the first graphical user interface interactive video as a negative example, and then respectively takes each first wavelet extraction descriptor, each third wavelet extraction descriptor, each fourth wavelet extraction descriptor and each fifth wavelet extraction descriptor and each sixth wavelet extraction descriptor as a binary group, transmits the binary group to a decision tree algorithm for decision analysis, obtains the cross characteristic between each wavelet extraction descriptor and the sixth wavelet extraction descriptor, and debugs the wavelet extraction algorithm and the decision tree algorithm by maximizing the cross characteristic of the positive example and minimizing the cross characteristic of the negative example.
The above debugging process is expected to enable the decision tree algorithm to refine the descriptors according to each wavelet corresponding to the first graphical user interface interactive video and the second graphical user interface interactive video, so as to obtain a correct decision analysis result. For example, "+" reflects that the user operation track image belongs to the graphic user interface interactive video, "-" reflects that the user operation track image does not belong to the graphic user interface interactive video, the correct decision analysis result is that the user operation track image pictureA1, the user operation track image pictureA2 and the user operation track image pictureA3 belong to the first graphic user interface interactive video, the user operation track image pictureB1, the user operation track image pictureB2 and the user operation track image pictureB3 do not belong to the first graphic user interface interactive video, the user operation track image pictureA1, the user operation track image pictureA2 and the user operation track image pictureA3 do not belong to the second graphic user interface interactive video, and the user operation track image pictureB1, the user operation track image pictureB2 and the user operation track image pictureB3 belong to the second graphic user interface interactive video.
It can be appreciated that the embodiment of the present invention only takes the debugging algorithm of the first image association evaluation vector, the second image association evaluation vector, the third image association evaluation vector and the fourth image association evaluation vector as an example. In another embodiment, the abnormal operation analysis server may not implement the steps 304-306, and the abnormal operation analysis server determines an algorithm preference variable in combination with each of the first image association evaluation vector, the third image association evaluation vector and the fourth image association evaluation vector, and adjusts the wavelet descriptor refinement algorithm in combination with the algorithm preference variable. The algorithm good and bad variables are in a first setting relation with the first image association evaluation vector and the third image association evaluation vector, and the algorithm good and bad variables are in a second setting relation with the fourth image association evaluation vector.
Alternatively, the abnormal operation analysis server may not implement the steps 307 to 312, in other words, the abnormal operation analysis server only needs to determine the first image association evaluation vector and the second image association evaluation vector, determine the algorithm preference variable in combination with each of the first image association evaluation vector and the second image association evaluation vector, and debug the wavelet descriptor refinement algorithm in combination with the algorithm preference variable. The algorithm good and bad variables and the first image association evaluation vector are in a first setting relation, and the algorithm good and bad variables and the second image association evaluation vector are in a second setting relation.
Or, the abnormal operation analysis server may not implement the steps 304-306 and 310-312, in other words, the abnormal operation analysis server only needs to determine the first image association evaluation vector and the third image association evaluation vector, determine the algorithm superior and inferior variable in combination with each of the first image association evaluation vector and the third image association evaluation vector, and debug the wavelet descriptor refinement algorithm in combination with the algorithm superior and inferior variable. The algorithm merit variable and the first image association evaluation vector and the third image association evaluation vector form a first setting relationship.
Still alternatively, the abnormal operation analysis server may not implement the steps 304-312, in other words, the abnormal operation analysis server only needs to determine the first image association evaluation vector, and debug the wavelet descriptor refinement algorithm in combination with the first image association evaluation vector between each of the first wavelet refinement descriptor and the second wavelet refinement descriptor. For some exemplary design ideas, the abnormal operation analysis server determines an algorithm quality variable by combining the first image association evaluation vector corresponding to each first wavelet refinement descriptor, and debugs the wavelet descriptor refinement algorithm by combining the algorithm quality variable. Wherein, the algorithm merit variable and the first image association evaluation vector are in a first set relation.
The first set relationship is a negative correlation relationship, and the corresponding second set relationship is a positive correlation relationship.
It can be understood that, in order to debug the wavelet description sub-refinement algorithm, the abnormal operation analysis server firstly obtains a plurality of graphical user interface interactive videos as an algorithm debugging basis, and the process of debugging the wavelet description sub-refinement algorithm by combining the plurality of graphical user interface interactive videos comprises multiple times of cyclic debugging, and two different graphical user interface interactive videos are combined for debugging in each cyclic debugging. Steps 301 to 313 in the embodiment of the present invention take only one cycle of debugging as an example to process the first gui interactive video and the second gui interactive video.
And step 314, the abnormal operation analysis server refines the wavelet descriptors of the interactive video of the graphical user interface to be processed through a debugged wavelet descriptor refinement algorithm.
The abnormal operation analysis server is used for debugging the wavelet description sub-extraction algorithm to obtain the debugged wavelet description sub-extraction algorithm. The abnormal operation analysis server can refine the wavelet descriptors of the interactive video of the graphic user interface to be processed through the debugged wavelet descriptor refinement algorithm to obtain corresponding wavelet refinement descriptors.
It can be seen that, by using the wavelet descriptor refinement algorithm, the first wavelet descriptor and the second wavelet descriptor are respectively refined to obtain the first wavelet refinement descriptor and the second wavelet refinement descriptor, in view of the fact that the first wavelet descriptor carries the abnormal operation tendency of part of the user operation track images in the interactive video of the graphical user interface, the second wavelet descriptor carries the abnormal operation tendency of each user operation track image in the interactive video of the same graphical user interface, so that the correlation between the first wavelet descriptor and the second wavelet descriptor is higher, and in case that the accuracy of the wavelet descriptor refinement algorithm is guaranteed, the correlation between the obtained first wavelet refinement descriptor and the second wavelet refinement descriptor is also higher, so that the image association evaluation vector between each first wavelet refinement descriptor and the second wavelet refinement descriptor is combined to debug the wavelet descriptor refinement algorithm, the image feature mining quality of the wavelet descriptor refinement algorithm can be improved, the correlation between the wavelet descriptor obtained by the wavelet descriptor refinement algorithm and the second wavelet descriptor is improved, and the abnormal operation feature refinement algorithm can be fully analyzed according to any abundant image feature of the obtained by the wavelet descriptor, and the feature of the subsequent wavelet descriptor has sufficient analysis.
In addition, an image wavelet descriptor corresponding to the user operation track image and an image wavelet descriptor corresponding to the user operation track image after the user operation track image are determined to determine a first wavelet descriptor corresponding to the user operation track image, wherein the first wavelet descriptor is introduced with the abnormal operation tendency of the user operation track image and the abnormal operation tendency of the user operation track image neighbors, so that the first wavelet descriptor can reflect the sequential connection between the user operation track image and the neighboring user operation track image, and the detail feature record richness of the first wavelet descriptor is improved.
Further, the first wavelet descriptor and the second wavelet descriptor in the image feature relation network are refined, and the first wavelet refined descriptor and the second wavelet refined descriptor in the distributed relation network are obtained. By converting the wavelet descriptors of the image characteristic relation network into the wavelet descriptors of the distributed relation network, the operation load can be saved, and the processing efficiency can be improved.
Further, the first image association evaluation vector and the second image association evaluation vector belong to the image association evaluation vector of the user operation track image dimension, the third image association evaluation vector and the fourth image association evaluation vector belong to the image association evaluation vector of the sentence dimension, and the wavelet descriptor refining algorithm is debugged by adopting the first image association evaluation vector, the second image association evaluation vector, the third image association evaluation vector and the fourth image association evaluation vector, so that the wavelet descriptor refining algorithm can mine richer and more complete abnormal operation trend information, and the descriptor refining performance, the precision and the richness of the wavelet descriptor refining algorithm are improved.
It can be understood that the first image association evaluation vector and the third image association evaluation vector belong to the image association evaluation vector serving as the positive example, the second image association evaluation vector and the fourth image association evaluation vector belong to the image association evaluation vector serving as the negative example, and the wavelet descriptor refinement algorithm is debugged by adopting the first image association evaluation vector, the second image association evaluation vector, the third image association evaluation vector and the fourth image association evaluation vector, so that the wavelet descriptor refinement algorithm can analyze from two directions of the positive example and the negative example, and the performance, the precision and the richness of the descriptor refinement of the wavelet descriptor refinement algorithm are further improved.
The method for analyzing abnormal operation applied to big data visualization provided by the embodiment of the invention can comprise the technical scheme described in the steps 501-504.
Step 501, the abnormal operation analysis server determines an image wavelet descriptor corresponding to each user operation track image in the target graphical user interface interactive video.
The target graphical user interface interactive video is any graphical user interface interactive video which needs to be processed.
Step 502, the abnormal operation analysis server respectively combines the image wavelet descriptors corresponding to each user operation track image and the image wavelet descriptors corresponding to at least one user operation track image after each user operation track image in the target graphical user interface interactive video to determine a fourth wavelet descriptor corresponding to each user operation track image.
Step 503, the abnormal operation analysis server combines the fourth wavelet descriptors corresponding to each user operation track image in the target graphical user interface interactive video to determine the fifth wavelet descriptors corresponding to the target graphical user interface interactive video.
And 504, the abnormal operation analysis server refines the fifth wavelet descriptor through a debugged wavelet descriptor refinement algorithm to obtain a sixth wavelet refinement descriptor corresponding to the fifth wavelet descriptor.
Wherein the concept of determining the sixth wavelet refinement descriptor in steps 501-504 is similar to the concept of determining the second wavelet refinement descriptor in steps 301-302.
For example, the abnormal operation analysis server performs sliding filtering operation on the image wavelet descriptors corresponding to the user operation track images in the target graphic user interface interactive video frequency to obtain fourth wavelet descriptors vec602 corresponding to each user operation track image, and performs weighted summation on each fourth wavelet descriptor vec602 to obtain fifth wavelet descriptors vec603 corresponding to the target graphic user interface interactive video frequency. The abnormal operation analysis server transmits the fifth wavelet description sub-vec 603 to the wavelet description sub-refinement algorithm, processes the information by the sigmoid operator and the sampling operator in the wavelet description sub-refinement algorithm, and outputs a sixth wavelet refinement description sub-vec 604. Wherein the sixth wavelet refinement descriptor vec604 is a HASH descriptor, which may be a description vector formed by 0 and 1.
Step 505, the abnormal operation analysis server obtains the wavelet extraction descriptors to be processed corresponding to the interactive videos of the multiple graphical user interfaces to be processed.
When the sixth wavelet extraction descriptor obtained by the embodiment of the invention is applied to the query of the interactive video of the graphical user interface, after obtaining the sixth wavelet extraction descriptor corresponding to the interactive video of the target graphical user interface, the abnormal operation analysis server obtains the to-be-processed wavelet extraction descriptors corresponding to the interactive video of the graphical user interface to be processed. The abnormal operation analysis server extracts descriptors according to the wavelets to be processed, and queries graphic user interface interaction videos similar to the target graphic user interface interaction video in the graphic user interface interaction videos to be processed. The wavelet description extraction descriptors to be processed corresponding to the interactive video of each graphical user interface to be processed are extracted by a wavelet description extraction algorithm after debugging. The wavelet extraction descriptor to be processed and the sixth wavelet extraction descriptor are both wavelet extraction descriptors of the user operation track image dimension and belong to an 'integral wavelet descriptor' of the interactive video of the graphic user interface, and the determining thought of the wavelet extraction descriptor to be processed is similar to that of the sixth wavelet extraction descriptor.
For some exemplary design ideas, the abnormal operation analysis server includes an interactive video library, in which the interactive videos of the plurality of to-be-processed gui interactive videos are recorded, and then the abnormal operation analysis server determines, in real time, to-be-processed wavelet extraction descriptors corresponding to each to-be-processed gui interactive video, by adopting ideas similar to the sixth wavelet extraction descriptor determination in steps 501-504, respectively. Or, the abnormal operation analysis server determines in advance the wavelet extraction descriptors to be processed corresponding to the interactive video of each to-be-processed gui in the interactive video library, and records each wavelet extraction descriptor to be processed and the corresponding to the interactive video of the to-be-processed gui in the interactive video library, and then in this step 505, the abnormal operation analysis server directly obtains the wavelet extraction descriptors to be processed corresponding to each to-be-processed gui in the interactive video library.
Step 506, the abnormal operation analysis server determines a commonality metric value between each of the pending wavelet refinement descriptors and the sixth wavelet refinement descriptor, respectively.
In order to determine whether each of the to-be-processed gui interactive videos is similar to the target gui interactive video, the abnormal operation analysis server determines a commonality metric value between each of the to-be-processed wavelet-refined descriptors and the sixth wavelet-refined descriptors, respectively, where the commonality metric value (similarity) between the to-be-processed wavelet-refined descriptors and the sixth wavelet-refined descriptors can reflect the commonality metric value between the corresponding to-be-processed gui interactive video and the target gui interactive video.
For some exemplary design considerations, the abnormal operation analysis server determines a cosine distance between the pending wavelet refinement descriptor and the sixth wavelet refinement descriptor, and determines the cosine distance as a commonality metric value between the pending wavelet refinement descriptor and the sixth wavelet refinement descriptor. Alternatively, the abnormal operation analysis server may further determine a commonality metric value between the wavelet refinement descriptor to be processed and the sixth wavelet refinement descriptor by using another concept, and the determining concept of the commonality metric value is not limited in the embodiment of the present invention.
And 507, determining the to-be-processed graphical user interface interactive video corresponding to the to-be-processed wavelet extraction descriptor with the commonality measurement value larger than the set limit value as a graphical user interface interactive video similar to the target graphical user interface interactive video by the abnormal operation analysis server.
After the abnormal operation analysis server obtains the commonality metric value corresponding to each wavelet extraction descriptor to be processed, determining the wavelet extraction descriptor to be processed with the commonality metric value larger than the set limit value in the wavelet extraction descriptors to be processed, and determining the graphical user interface interactive video to be processed corresponding to the wavelet extraction descriptor to be processed as the graphical user interface interactive video similar to the target graphical user interface interactive video.
The set limit value is, for example, a threshold value preset by the abnormal operation analysis server. And if the commonality metric value corresponding to the wavelet extraction descriptor to be processed is greater than the set limit value, the to-be-processed graphical user interface interactive video corresponding to the wavelet extraction descriptor to be processed is considered to be similar to the target graphical user interface interactive video, and if the commonality metric value corresponding to the wavelet extraction descriptor to be processed is not greater than the set limit value, the to-be-processed graphical user interface interactive video corresponding to the wavelet extraction descriptor to be processed is considered to be dissimilar to the target graphical user interface interactive video.
It will be appreciated that, taking the example of querying a gui interactive video similar to the target gui interactive video, for some exemplary design considerations, the abnormal operation analysis server implements steps 501-507 in the embodiments of the present invention in response to a query request for the target gui interactive video. Alternatively, in another embodiment, the sixth wavelet refinement descriptor is not for making a graphical user interface interactive video query and the abnormal operation analysis server does not implement steps 505-507.
In order to authenticate the accuracy of the wavelet description sub-refinement algorithm debugged by the embodiment of the invention, the wavelet description sub-refinement algorithm is tested on test set test1 and test set test2 respectively. For example, for a gui interactive video, a wavelet descriptor extracting algorithm is used to extract a wavelet descriptor of the gui interactive video to obtain a wavelet extracted descriptor, and the wavelet extracted descriptor of the gui interactive video and the wavelet extracted descriptors of other gui interactive videos in the interactive video library are subjected to commonality metric calculation, so that 1000 gui interactive videos with the highest commonality metric are determined, and how many gui interactive videos in the 1000 searched 1000 gui interactive videos belong to the same classification label as the gui interactive video is manually determined, and the accuracy of the search is used as the performance score of the wavelet descriptor extracting algorithm.
Further, in the gui interactive video query task, based on the above thought, other gui interactive videos similar to any gui interactive video can be queried.
Under some design considerations that can be implemented independently, after extracting the wavelet descriptors of the interactive video of the graphical user interface to be processed, the method may further include the following: performing risk operation behavior recognition based on the wavelet descriptors to be processed of the interactive video of the graphical user interface to be processed to obtain a risk operation behavior recognition result; and performing GUI interactive upgrading treatment according to the risk operation behavior identification result.
In the embodiment of the invention, the risk operation behavior identification can be realized based on the abnormal operation tendency reflected by the wavelet descriptors to be processed, so that the GUI interaction upgrading can be carried out in a targeted manner by combining the risk operation behavior identification result, and the data information security of the relevant server and the client in the GUI interaction process is ensured. For example, if the risk operation behavior recognition result is an information stealing risk, the identity authority can be upgraded aiming at the GUI interaction, so that the authority verification threshold of the GUI interaction is improved, and the safety of the data information of the related server and the client is ensured as much as possible.
Under some design ideas which can be independently implemented, carrying out risk operation behavior recognition based on the wavelet descriptors to be processed of the interactive video of the graphical user interface to be processed, and obtaining a risk operation behavior recognition result, wherein the risk operation behavior recognition result can be realized by the following technical scheme: acquiring an abnormal operation tendency feature set aiming at a wavelet descriptor to be processed, wherein the abnormal operation tendency feature set comprises at least two abnormal operation tendency features; obtaining the matching degree between each abnormal operation tendency characteristic in the abnormal operation tendency characteristic set and the wavelet descriptors to be processed; processing each abnormal operation tendency feature according to the matching degree corresponding to each abnormal operation tendency feature and the risk deduction vector of each abnormal operation tendency feature to obtain a corresponding abnormal operation tendency feature queue; generating a target interactive risk item sequence aiming at the wavelet descriptor to be processed based on the abnormal operation tendency characteristic queue, wherein the target interactive risk item sequence comprises at least two target interactive risk item types.
The target interactive risk item sequence can be understood as a risk operation behavior recognition result, and since the target interactive risk item sequence comprises at least two target interactive risk item types which are sequentially arranged, and the risk level corresponding to the target interactive risk item type with the higher order is higher, the risk protection processing can be realized to the greatest extent by realizing the vector-placed GUI interactive upgrading processing based on the target interactive risk item sequence.
Under some design ideas which can be implemented independently, the processing the abnormal operation tendency features according to the matching degree corresponding to the abnormal operation tendency features and the risk deduction vector of the abnormal operation tendency features to obtain corresponding abnormal operation tendency feature queues includes: according to the matching degree corresponding to each abnormal operation tendency feature and the risk deduction vector of each abnormal operation tendency feature, disassembling each abnormal operation tendency feature to obtain at least two abnormal operation tendency feature subsets; and processing each abnormal operation tendency feature subset, and processing each abnormal operation tendency feature in each abnormal operation tendency feature subset to obtain the abnormal operation tendency feature queue.
Under some design ideas which can be implemented independently, the disassembling is performed on each abnormal operation tendency feature according to the matching degree corresponding to each abnormal operation tendency feature and the risk deduction vector of each abnormal operation tendency feature to obtain at least two abnormal operation tendency feature subsets, including: weighting risk deduction vectors of the abnormal operation tendency features according to the matching degree corresponding to the abnormal operation tendency features respectively to obtain attention risk deduction vectors of the abnormal operation tendency features; grouping the abnormal operation tendency features according to attention risk deduction vectors of the abnormal operation tendency features to obtain at least two abnormal operation tendency feature subsets.
Under some design ideas which can be implemented independently, the processing is performed between the abnormal operation tendency feature subsets, and each abnormal operation tendency feature in the abnormal operation tendency feature subsets is processed respectively, so as to obtain the abnormal operation tendency feature queue, which comprises the following steps: processing each abnormal operation tendency feature subset according to the number of the abnormal operation tendency features contained in the abnormal operation tendency feature subset; and, for each abnormal operation tendency feature subset, respectively implementing the following steps: processing each abnormal operation tendency feature in the abnormal operation tendency feature subset according to the risk deduction vector of each abnormal operation tendency feature in the abnormal operation tendency feature subset and the influence factor of the abnormal operation tendency feature subset; the abnormal operation tendency feature queue is generated based on the ordered outputs between the abnormal operation tendency feature subsets and the ordered outputs of the abnormal operation tendency features in the abnormal operation tendency feature subsets.
The foregoing is only a specific embodiment of the present invention. Variations and alternatives will occur to those skilled in the art based on the detailed description provided herein and are intended to be included within the scope of the invention.

Claims (10)

1. An abnormal operation analysis method applied to big data visualization, characterized in that it is applied to an abnormal operation analysis server, the method comprising:
acquiring a first wavelet descriptor corresponding to each user operation track image in a first graphical user interface interactive video and a second wavelet descriptor corresponding to the first graphical user interface interactive video, wherein the first wavelet descriptor corresponding to the user operation track image reflects abnormal operation tendency of the user operation track image in the first graphical user interface interactive video, and the second wavelet descriptor is determined by combining the first wavelet descriptor corresponding to each user operation track image;
extracting each first wavelet descriptor and each second wavelet descriptor through a wavelet descriptor extracting algorithm to obtain a first wavelet extracted descriptor corresponding to each first wavelet descriptor and a second wavelet extracted descriptor corresponding to each second wavelet descriptor;
Debugging the wavelet descriptor refinement algorithm in combination with a first image association assessment vector between each of the first wavelet refinement descriptor and the second wavelet refinement descriptor, the first image association assessment vector reflecting a correlation between the first wavelet refinement descriptor and the second wavelet refinement descriptor;
and refining the wavelet descriptors of the interactive video of the graphical user interface to be processed through a debugged wavelet descriptor refining algorithm.
2. The method of claim 1, wherein said debugging said wavelet descriptor refinement algorithm in conjunction with a first image association assessment vector between each of said first wavelet refinement descriptor and said second wavelet refinement descriptor comprises:
combining the first image association evaluation vectors corresponding to each first wavelet extraction descriptor to determine algorithm good and bad variables, wherein the algorithm good and bad variables and the first image association evaluation vectors form a first set relationship;
and debugging the wavelet descriptor refining algorithm by combining the algorithm quality variables.
3. The method of claim 1, wherein the associating the first image association assessment vector between each of the first wavelet refinement descriptor and the second wavelet refinement descriptor, prior to debugging the wavelet descriptor refinement algorithm, further comprises: carrying out decision analysis on the first wavelet extraction descriptor and the second wavelet extraction descriptor through a decision tree algorithm to obtain a decision analysis result, wherein the decision analysis result reflects the probability that a user operation track image corresponding to the first wavelet extraction descriptor belongs to a graphical user interface interactive video corresponding to the second wavelet extraction descriptor; determining the decision analysis result as a first image association evaluation vector corresponding to the first wavelet refinement descriptor;
Wherein said debugging said wavelet descriptor refinement algorithm in combination with a first image association assessment vector between each of said first wavelet refinement descriptor and said second wavelet refinement descriptor comprises: combining the first image association evaluation vectors corresponding to each first wavelet extraction descriptor to determine algorithm good and bad variables, wherein the algorithm good and bad variables and the first image association evaluation vectors form a first set relationship; and debugging the wavelet descriptor refining algorithm and the decision tree algorithm by combining the algorithm quality variables.
4. The method according to claim 2, wherein the method further comprises: acquiring a third wavelet descriptor corresponding to a user operation track image in a second graphical user interface interactive video, wherein the third wavelet descriptor corresponding to the user operation track image reflects abnormal operation tendency of the user operation track image in the second graphical user interface interactive video, and the second graphical user interface interactive video is different from the first graphical user interface interactive video; refining the third wavelet descriptor through the wavelet descriptor refining algorithm to obtain a third wavelet refined descriptor corresponding to the third wavelet descriptor; determining a second image association evaluation vector between the third wavelet refinement descriptor and the second wavelet refinement descriptor, the second image association evaluation vector reflecting a correlation between the third wavelet refinement descriptor and the second wavelet refinement descriptor;
The determining the algorithm quality variable by combining the first image association evaluation vectors corresponding to each first wavelet refinement descriptor comprises the following steps: and combining each first image association evaluation vector and each second image association evaluation vector to determine the algorithm good and bad variables, wherein the algorithm good and bad variables and the first image association evaluation vectors form a first setting relationship, and the algorithm good and bad variables and the second image association evaluation vectors form a second setting relationship.
5. The method of claim 4, wherein the first graphical user interface interactive video comprises user operation track images corresponding to a plurality of video stream timing labels, wherein the determining the algorithm merit variable in combination with each of the first image association rating vector and the second image association rating vector comprises:
determining a debugging cost corresponding to each video stream time sequence label by combining a first image contact evaluation vector and a second image contact evaluation vector corresponding to each video stream time sequence label, wherein the debugging cost and the first image contact evaluation vector are in a second set relation, and the debugging cost and the second image contact evaluation vector are in a first set relation, the first image contact evaluation vector corresponding to the video stream time sequence label is a first image contact evaluation vector corresponding to a user operation track image matching the video stream time sequence label in the first graphical user interface interactive video, and the second image contact evaluation vector corresponding to the video stream time sequence label is a second image contact evaluation vector corresponding to a user operation track image matching the video stream time sequence label in the second graphical user interface interactive video;
And carrying out weighted summation on the debugging cost corresponding to each video stream time sequence label to obtain the algorithm good and bad variables, wherein the algorithm good and bad variables and the debugging cost are in a first set relation.
6. The method according to claim 2, wherein the method further comprises: determining a first video wavelet descriptor corresponding to the first graphical user interface interactive video, wherein the first video wavelet descriptor reflects abnormal operation tendency of the first graphical user interface interactive video; refining the first video wavelet descriptor through the wavelet descriptor refining algorithm to obtain a fourth wavelet refined descriptor; determining a third image association evaluation vector between the fourth wavelet refinement descriptor and the second wavelet refinement descriptor, the third image association evaluation vector reflecting a correlation between the fourth wavelet refinement descriptor and the second wavelet refinement descriptor; the determining the algorithm quality variable by combining the first image association evaluation vectors corresponding to each first wavelet refinement descriptor comprises the following steps: combining each first image association evaluation vector and each third image association evaluation vector to determine an algorithm good and bad variable, wherein the algorithm good and bad variable and the first image association evaluation vector and the third image association evaluation vector form a first set relationship;
Wherein the method further comprises: determining a second video wavelet descriptor corresponding to a second graphical user interface interactive video, wherein the second video wavelet descriptor reflects abnormal operation tendency of the second graphical user interface interactive video, and the second graphical user interface interactive video is different from the first graphical user interface interactive video; refining the second video wavelet descriptor through the wavelet descriptor refining algorithm to obtain a fifth wavelet refined descriptor; determining a fourth image association evaluation vector between the fifth wavelet refinement descriptor and the second wavelet refinement descriptor, the fourth image association evaluation vector reflecting a correlation between the fifth wavelet refinement descriptor and the second wavelet refinement descriptor; the determining the algorithm merit variable by combining each of the first image association evaluation vector and the third image association evaluation vector includes: and combining each of the first image association evaluation vector, the third image association evaluation vector and the fourth image association evaluation vector to determine an algorithm good and bad variable, wherein the algorithm good and bad variable is in a first set relation with the first image association evaluation vector and the third image association evaluation vector, and the algorithm good and bad variable is in a second set relation with the fourth image association evaluation vector.
7. The method of claim 1, wherein obtaining a first wavelet descriptor corresponding to each user operation trace image in the first graphical user interface interactive video comprises: determining an image wavelet descriptor corresponding to each user operation track image in the first graphical user interface interactive video; combining the image wavelet descriptors corresponding to each user operation track image and the image wavelet descriptors corresponding to at least one user operation track image behind each user operation track image respectively to determine a first wavelet descriptor corresponding to each user operation track image;
the determining a first wavelet descriptor corresponding to each user operation track image by combining the image wavelet descriptor corresponding to each user operation track image and the image wavelet descriptor corresponding to at least one user operation track image after each user operation track image respectively comprises the following steps: determining a plurality of set numbers which are different and smaller than the number of user operation track images in the first graphical user interface interactive video; for each set number, determining a user operation track image queue corresponding to the user operation track image, and determining a first local descriptor corresponding to the user operation track image by combining an image wavelet descriptor corresponding to each user operation track image in the user operation track image queue, wherein the user operation track image queue comprises the user operation track image and downstream user operation track images of the user operation track image, the downstream user operation track images of the user operation track image are user operation track images after the user operation track images are matched, and the number of the downstream user operation track images in the user operation track image queue is not more than the set number; carrying out weighted summation on a plurality of first local descriptors corresponding to the user operation track image to obtain first wavelet descriptors corresponding to the user operation track image;
The determining the user operation track image queue corresponding to the user operation track image includes: on the basis that the total number of the downstream user operation track images of the user operation track images is not smaller than the set number, determining the user operation track images and the set number of user operation track images behind the user operation track images as a user operation track image queue corresponding to the user operation track images; on the basis that the total number of the downstream user operation track images of the user operation track images is smaller than the set number, determining the user operation track images and each user operation track image behind the user operation track images as a user operation track image queue corresponding to the user operation track images;
wherein the determining, in combination with the image wavelet descriptors corresponding to each user operation track image in the user operation track image queue, a first local descriptor corresponding to the user operation track image includes: performing sliding filtering operation on the image wavelet descriptors corresponding to each user operation track image in the user operation track image queue respectively to obtain sliding filtering descriptors corresponding to each user operation track image; and determining the sliding filter sum descriptors as first local descriptors corresponding to the user operation track images.
8. The method of claim 1, wherein obtaining a second wavelet descriptor corresponding to the first graphical user interface interactive video comprises:
downsampling first wavelet descriptors corresponding to a plurality of user operation track images in the first graphical user interface interactive video to obtain second wavelet descriptors;
or determining the median value of the first wavelet descriptors corresponding to the plurality of user operation track images in the first graphical user interface interactive video as the second wavelet descriptor.
9. The method according to claim 1, wherein said refining the wavelet descriptors of the graphical user interface interactive video to be processed by the debugged wavelet descriptor refining algorithm comprises: determining an image wavelet descriptor corresponding to each user operation track image in the target graphical user interface interactive video; combining an image wavelet descriptor corresponding to each user operation track image and an image wavelet descriptor corresponding to at least one user operation track image behind each user operation track image in the target graphical user interface interactive video respectively, and determining a fourth wavelet descriptor corresponding to each user operation track image; combining the fourth wavelet descriptors corresponding to each user operation track image in the target graphical user interface interactive video to determine a fifth wavelet descriptor corresponding to the target graphical user interface interactive video; refining the fifth wavelet descriptor through the debugged wavelet descriptor refining algorithm to obtain a sixth wavelet refined descriptor corresponding to the fifth wavelet descriptor;
The method further includes, after the extracting the fifth wavelet descriptor by the debugged wavelet descriptor extracting algorithm to obtain a sixth wavelet extracted descriptor corresponding to the fifth wavelet descriptor: acquiring a plurality of to-be-processed wavelet extraction descriptors corresponding to the to-be-processed graphical user interface interactive videos, wherein each to-be-processed wavelet extraction descriptor corresponding to each to-be-processed graphical user interface interactive video is extracted by the debugged wavelet descriptor extraction algorithm; determining a commonality metric value between each of the to-be-processed wavelet refinement descriptors and the sixth wavelet refinement descriptor; and determining the to-be-processed graphic user interface interactive video corresponding to the to-be-processed wavelet extraction descriptor with the commonality measurement value larger than the set limit value as a graphic user interface interactive video similar to the target graphic user interface interactive video.
10. An abnormal operation analysis server, comprising: a memory and a processor; the memory is coupled to the processor; the memory is used for storing computer program codes, and the computer program codes comprise computer instructions; wherein the computer instructions, when executed by the processor, cause the abnormal operation analysis server to perform the method of any of claims 1-9.
CN202310135452.XA 2023-02-20 2023-02-20 Abnormal operation analysis method and server applied to big data visualization Pending CN116185798A (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN202310135452.XA CN116185798A (en) 2023-02-20 2023-02-20 Abnormal operation analysis method and server applied to big data visualization

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN202310135452.XA CN116185798A (en) 2023-02-20 2023-02-20 Abnormal operation analysis method and server applied to big data visualization

Publications (1)

Publication Number Publication Date
CN116185798A true CN116185798A (en) 2023-05-30

Family

ID=86451931

Family Applications (1)

Application Number Title Priority Date Filing Date
CN202310135452.XA Pending CN116185798A (en) 2023-02-20 2023-02-20 Abnormal operation analysis method and server applied to big data visualization

Country Status (1)

Country Link
CN (1) CN116185798A (en)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN117112605A (en) * 2023-09-13 2023-11-24 甘肃松鼠教育科技有限公司 Interactive behavior big data mining method and system applied to visual database

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN117112605A (en) * 2023-09-13 2023-11-24 甘肃松鼠教育科技有限公司 Interactive behavior big data mining method and system applied to visual database

Similar Documents

Publication Publication Date Title
Mayer et al. Forensic similarity for digital images
Eraslan et al. Eye tracking scanpath analysis techniques on web pages: A survey, evaluation and comparison
CN112837069B (en) Block chain and big data based secure payment method and cloud platform system
US20100312763A1 (en) Generic biometric filter
CN114139209B (en) Information anti-theft method and system applied to big data of business user
CN113051543B (en) Cloud service security verification method and cloud service system in big data environment
CN116185798A (en) Abnormal operation analysis method and server applied to big data visualization
Banda et al. An experimental evaluation of popular image parameters for monochromatic solar image categorization
CN113918621A (en) Big data protection processing method based on internet finance and server
CN115620211B (en) Performance data processing method and system of flame-retardant low-smoke halogen-free sheath
CN115830649A (en) Network asset fingerprint feature identification method and device and electronic equipment
CN113486983A (en) Big data office information analysis method and system for anti-fraud processing
CN114417405B (en) Privacy service data analysis method based on artificial intelligence and server
CN113722719A (en) Information generation method and artificial intelligence system for security interception big data analysis
CN114638234A (en) Big data mining method and system applied to online business handling
CN113297061A (en) Test case generation method, device and system, offline server and storage medium
CN113391867A (en) Big data service processing method and service server based on digitization and visualization
CN115757900B (en) User demand analysis method and system applying artificial intelligent model
Tseytlin et al. Content based video retrieval system for distorted video queries
CN113946819A (en) Online payment information intrusion detection method based on cloud computing and server
CN112866295B (en) Big data crawler-prevention processing method and cloud platform system
Zhu et al. Heterogeneous distance learning based on kernel analysis-synthesis dictionary for semi-supervised image to video person re-identification
de Jongh et al. Performance evaluation of automated fingerprint identification systems for specific conditions observed in casework using simulated fingermarks
Park et al. Experiment and analysis services in a fingerprint digital library for collaborative research
CN115442149B (en) Data intrusion analysis method and server based on deep learning

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination