CN116319397A - Method, device and storage medium for acquiring user network behavior portraits - Google Patents

Method, device and storage medium for acquiring user network behavior portraits Download PDF

Info

Publication number
CN116319397A
CN116319397A CN202310194719.2A CN202310194719A CN116319397A CN 116319397 A CN116319397 A CN 116319397A CN 202310194719 A CN202310194719 A CN 202310194719A CN 116319397 A CN116319397 A CN 116319397A
Authority
CN
China
Prior art keywords
application
user
data stream
account information
aggregation
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Pending
Application number
CN202310194719.2A
Other languages
Chinese (zh)
Inventor
韩大炜
刘立
李开科
孙浩
王宇
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Dawning Network Technology Co ltd
Original Assignee
Dawning Network Technology Co ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Dawning Network Technology Co ltd filed Critical Dawning Network Technology Co ltd
Priority to CN202310194719.2A priority Critical patent/CN116319397A/en
Publication of CN116319397A publication Critical patent/CN116319397A/en
Pending legal-status Critical Current

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/50—Network service management, e.g. ensuring proper service fulfilment according to agreements
    • H04L41/5061—Network service management, e.g. ensuring proper service fulfilment according to agreements characterised by the interaction between service providers and their network customers, e.g. customer relationship management
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L43/00—Arrangements for monitoring or testing data switching networks
    • H04L43/50—Testing arrangements
    • Y—GENERAL TAGGING OF NEW TECHNOLOGICAL DEVELOPMENTS; GENERAL TAGGING OF CROSS-SECTIONAL TECHNOLOGIES SPANNING OVER SEVERAL SECTIONS OF THE IPC; TECHNICAL SUBJECTS COVERED BY FORMER USPC CROSS-REFERENCE ART COLLECTIONS [XRACs] AND DIGESTS
    • Y02—TECHNOLOGIES OR APPLICATIONS FOR MITIGATION OR ADAPTATION AGAINST CLIMATE CHANGE
    • Y02D—CLIMATE CHANGE MITIGATION TECHNOLOGIES IN INFORMATION AND COMMUNICATION TECHNOLOGIES [ICT], I.E. INFORMATION AND COMMUNICATION TECHNOLOGIES AIMING AT THE REDUCTION OF THEIR OWN ENERGY USE
    • Y02D30/00—Reducing energy consumption in communication networks
    • Y02D30/50—Reducing energy consumption in communication networks in wire-line communication networks, e.g. low power modes or reduced link rate

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Business, Economics & Management (AREA)
  • General Business, Economics & Management (AREA)
  • Information Transfer Between Computers (AREA)

Abstract

The invention discloses a method, a device, electronic equipment and a storage medium for acquiring a user network behavior portrait, which relate to the field of network monitoring and comprise the following steps: acquiring a data stream set in a first preset time; acquiring each aggregation user according to the equipment identification of each data stream and account information of at least one first application in the first type of application; and acquiring the associated data stream of each aggregation user, and respectively acquiring the network behavior portraits of each aggregation user according to the associated data stream of each aggregation user and a preset time window. According to the technical scheme provided by the embodiment of the invention, on the premise of unknown user identities and user numbers, each user in the network is accurately positioned, the aggregate acquisition of real users in the network is ensured, meanwhile, the acquired complete user behavior data is improved, and the accuracy of the constructed user network behavior portraits is improved.

Description

Method, device and storage medium for acquiring user network behavior portraits
Technical Field
The present invention relates to the field of network monitoring, and in particular, to a method, an apparatus, and a storage medium for acquiring a user network behavior portrait.
Background
With the continuous development of internet technology, the behavior of users accessing the network presents diversified characteristics, and a great amount of network traffic also brings potential security risks, which puts higher demands on the acquisition of behavior portraits of the users in the network.
In the prior art, for obtaining a network behavior portrait of a user, a specific user identity is usually known in advance, for example, identification information of a user to be monitored is known, and then the network behavior of the user is monitored according to the identification information; or when the specific user identity is unknown, monitoring the network behavior under the user identity according to the user identity obtained from the traffic.
However, in such a monitoring manner, for a network with an unknown specific user identity, even if certain identification information is extracted from the traffic, the traffic data under the identification information can only reflect part of the behavior data of the user, and the complete behavior data of the user cannot be obtained, so that a great difference exists in the constructed network behavior portraits of the user.
Disclosure of Invention
The invention provides a method, a device, electronic equipment and a storage medium for acquiring a user network behavior portrait, which are used for solving the problem of network behavior data deficiency during construction of the user network behavior portrait.
According to one aspect of the present invention, there is provided a method for acquiring a user network behavior portrait, including:
acquiring a data stream set in a first preset time; each data stream in the data stream set comprises an application type, and the data stream under the first type of application in the application type comprises account information;
acquiring each aggregation user according to the equipment identification of each data stream and account information of at least one first application in the first type of application;
and acquiring the associated data stream of each aggregation user, and respectively acquiring the network behavior portraits of each aggregation user according to the associated data stream of each aggregation user and a preset time window.
The acquiring the associated data stream of each aggregation user comprises the following steps: and taking the rest data streams except the data streams related to the non-affiliated accounts in at least one affiliated device and the data streams related to the affiliated accounts in at least one non-affiliated device as the associated data streams of the current aggregation user. By acquiring the data stream which does not comprise account information in the affiliated device, the data stream generated by the affiliated account in the affiliated device and the data stream generated by the affiliated account in the non-affiliated device, the integrity of the network behavior data of each aggregation user is ensured, and particularly, the loss of the associated data stream in the non-affiliated device and the mismatching of the non-associated data stream in the affiliated device are avoided.
The obtaining each aggregation user according to the device identifier of each data stream and account information of at least one first application in the first type of applications includes: determining a target first application in the first type application according to at least one of the number of data streams, the number of accounts and whether the account information has an identity; acquiring each aggregation user according to the equipment identification of each data stream and the account information of the target first application; and according to the equipment identification of each data stream and the account information of the target first application, the account information of the non-target first application in the first type application and each aggregation user are aggregated again. The number of data flows and the number of accounts reflect the application range of the first application, the larger the number is, the larger the application range is, the acquired number of aggregation users is also larger, each user in the network is represented to the greatest extent, account information containing identity identifiers can be used as an aggregation basis of the user, the identity of the user can be directly represented, in addition, aggregation is continuously carried out through accounts of other first applications and electronic equipment which are not aggregated, so that new aggregation users are acquired, the monitoring range of the current network is further enlarged, and the integrity of monitoring objects in the current network is ensured; meanwhile, the aggregated electronic equipment can also continuously acquire the complete user behavior data of the aggregated user through the re-aggregation with the account numbers of other first applications.
After obtaining each aggregation user according to the device identifier of each data stream and the account information of the target first application, the method further comprises the following steps: judging whether the residual device identifiers which are not aggregated exist or not; if the fact that the non-aggregated residual equipment identifiers exist is determined, according to the equipment identifiers of the data streams and the account information of the target first application, the account information of the non-target first application in the first type application, the aggregated user and the residual equipment identifiers are aggregated again; the step of re-aggregating the account information of the non-target first application in the first type application with each aggregation user according to the device identifier of each data stream and the account information of the target first application, including: if the fact that the non-aggregated residual equipment identifiers do not exist is determined, according to the equipment identifiers of the data streams and the account information of the target first application, the account information of the non-target first application in the first type application and the aggregated users are aggregated again. Therefore, aggregation of a plurality of application accounts and equipment is achieved, complete user behavior data can be conveniently obtained, and the accuracy of obtaining an aggregated user is further improved by means of equipment login relations of different application accounts.
The acquiring the associated data stream of each aggregation user specifically comprises the following steps: and carrying out noise filtering on the data flow set according to at least one of a flow noise list, a flow data volume threshold, flow occurrence time and a flow event volume threshold. Noise filtering is carried out on the data flow set through the flow noise list, the flow data quantity threshold, the flow occurrence time and the flow event quantity threshold, so that the number of data flows to be processed is reduced, the noise flow is prevented from being misclassified into user behavior data, and the accuracy of the acquired user behavior portraits is improved.
If the application type further includes a second type application, and account information of at least one target second application in the second type application is related to an identity, the acquiring each aggregate user according to the device identity of each data stream and account information of at least one first application in the first type application specifically further includes: and aggregating account information of at least one target second application in the second type application with each aggregation user according to the equipment identifier of each data stream so as to obtain the identity identifier of each aggregation user. The account information of each second application under the second type application can be aggregated with each aggregation user, based on the aggregation result, not only the complete associated data stream of the aggregation user in the non-affiliated device can be obtained, and the mismatching of the non-associated data stream in the affiliated device is avoided, but also the true identity information of each aggregation user can be further obtained, so that the information matching of the aggregation user and the true user is realized.
The data flow set comprises a fixed network data flow set and a non-fixed network data flow set; the obtaining each aggregation user according to the device identifier of each data stream and account information of at least one first application in the first type of applications includes: acquiring each aggregation user in the fixed network according to the equipment identification of each data stream in the fixed network data stream set and account information of at least one first application in the first type of application; and aggregating each data flow in the non-fixed network data flow set with each aggregation user in the fixed network. The method and the device realize the acquisition of the user network behavior data in the fixed network state and the non-fixed network state in the same time period, ensure the integrity of the user network behavior data, simultaneously avoid the problem of misdistribution of the non-fixed network data flow caused by the reasons of starting hot spots and the like of equipment, and improve the accuracy of the acquired user network behavior data.
According to another aspect of the present invention, there is provided an apparatus for acquiring a user network behavior portrait, including:
the data flow set acquisition module is used for acquiring a data flow set in a first preset time; each data stream in the data stream set comprises an application type, and the data stream under the first type of application in the application type comprises account information;
The aggregation user acquisition module is used for acquiring each aggregation user according to the equipment identifier of each data stream and account information of at least one first application in the first type of application;
the user portrayal acquisition module is used for acquiring the associated data streams of the aggregation users and respectively acquiring the network behavior portrayal of the aggregation users according to the associated data streams of the aggregation users and a preset time window.
According to another aspect of the present invention, there is provided an electronic apparatus including:
at least one processor; and
a memory communicatively coupled to the at least one processor; wherein,,
the memory stores a computer program executable by the at least one processor to enable the at least one processor to perform the method for acquiring a user network behavior representation according to any one of the embodiments of the present invention.
According to another aspect of the present invention, there is provided a computer readable storage medium storing computer instructions for causing a processor to implement the method for obtaining a user network behavior representation according to any one of the embodiments of the present invention when executed.
According to the technical scheme, after the data flow set in the first preset time is acquired, each aggregation user is acquired according to the equipment identification of each data flow and account information of at least one first application in the first type application, and the network behavior portraits of each aggregation user are acquired according to the associated data flow of each aggregation user and the preset time window, so that each user in the network is accurately positioned on the premise of unknown user identity and user quantity, aggregation acquisition of real users in the network is ensured, meanwhile, acquired complete user behavior data is improved, and the accuracy of the constructed user network behavior portraits is improved.
It should be understood that the description in this section is not intended to identify key or critical features of the embodiments of the invention or to delineate the scope of the invention. Other features of the present invention will become apparent from the description that follows.
Drawings
In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings required for the description of the embodiments will be briefly described below, and it is apparent that the drawings in the following description are only some embodiments of the present invention, and other drawings may be obtained according to these drawings without inventive effort for a person skilled in the art.
FIG. 1 is a flow chart of a method for obtaining a representation of user network behavior according to a first embodiment of the present invention;
FIG. 2 is a flow chart of a method for obtaining a representation of user network behavior according to a second embodiment of the present invention;
FIG. 3 is a flowchart of a method for obtaining a representation of user network behavior according to a third embodiment of the present invention;
FIG. 4 is a schematic diagram of a device for acquiring a user network behavior portrait according to a fourth embodiment of the present invention;
fig. 5 is a schematic structural diagram of an electronic device implementing a method for acquiring a user network behavior portrait according to an embodiment of the present invention.
Detailed Description
In order that those skilled in the art will better understand the present invention, a technical solution in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings in which it is apparent that the described embodiments are only some embodiments of the present invention, not all embodiments. All other embodiments, which can be made by those skilled in the art based on the embodiments of the present invention without making any inventive effort, shall fall within the scope of the present invention.
It should be noted that the terms "first," "second," and the like in the description and the claims of the present invention and the above figures are used for distinguishing between similar objects and not necessarily for describing a particular sequential or chronological order. It is to be understood that the data so used may be interchanged where appropriate such that the embodiments of the invention described herein may be implemented in sequences other than those illustrated or otherwise described herein. Furthermore, the terms "comprises," "comprising," and "having," and any variations thereof, are intended to cover a non-exclusive inclusion, such that a process, method, system, article, or apparatus that comprises a list of steps or elements is not necessarily limited to those steps or elements expressly listed but may include other steps or elements not expressly listed or inherent to such process, method, article, or apparatus.
Example 1
Fig. 1 is a flowchart of a method for obtaining a user network behavior portrait according to an embodiment of the present invention, where the method may be performed by a device for obtaining a user network behavior portrait, and the device for obtaining a user network behavior portrait may be implemented in hardware and/or software, and the device for obtaining a user network behavior portrait is configured in an electronic device. As shown in fig. 1, the method includes:
s101, acquiring a data stream set in a first preset time; each data stream in the data stream set comprises an application type, and the data stream under the first type of application in the application type comprises account information.
The flow, i.e., network flow, is a unidirectional message flow of source IP (Internet Protocol ) address to destination IP address transmissions; each network flow includes five-tuple information, namely a source port number, a destination port number, a source IP address, a destination IP address, and a protocol type; the data flow in the embodiment of the present invention is the data information of each flow recorded in the form of a flow table after extracting the characteristic field of the network flow of the network device (e.g., router) and performing field parsing, which may be stored in a database through a specified data format, for example, XDR (External Data Representation) format (i.e., external data format); that is, after the session of the network flow ends or the session times out, the flow list of the network flow is output as XDR format data and stored in the database.
In particular, XDR data can be independently indexed according to date and application type to facilitate querying and retrieval of data streams. Each data stream includes device identification and timestamp information in addition to the five-tuple information described above; the device identifier is an identifier of an sender device or a receiver device of a network flow, specifically, for an uplink network flow, the identifier of the sender device is obtained, and for a downlink network flow, the identifier of the receiver device is obtained; a MAC (Media Access Control ) address (i.e., hardware address) or device serial number in the network flow may be used as the device identification; the time stamp information is also known as the trigger time of the network flow.
After the network flow is acquired, the application type of the network flow can be acquired through a feature recognition technology, an association recognition technology, a behavior recognition technology or the like, for example, application classification is carried out on the acquired network flow through a pre-constructed service perception feature library; the specific classification of the application type can be set according to the requirement; for example, application types may include social entertainment, internet access, business services, network architecture, and general software, while social entertainment may also include instant messaging in particular, business services may include electronic mailboxes in particular, internet access may include web browsing in particular, and so on sub-categories.
The first type of application is application software of which the network behavior depends on account information, and the instant messaging application and the email box application in the technical scheme all need to take the account information in the application as an access basis; the website browsing does not need to depend on specific account information; therefore, in the embodiment of the invention, the instant messaging application can be used as the first type of application. After each network flow is acquired, if the application type of the network flow is determined to be the first type application, specific application classification (namely, specific application name) and specific account information are continuously acquired, and the specific application classification (namely, specific application name) and the specific account information are added into a flow table. Therefore, each data stream in the data stream set acquired through the database records the respective application type, and for the application containing the account information, the name of the specific application and the account information under the application are also recorded.
S102, acquiring each aggregation user according to the equipment identification of each data stream and account information of at least one first application in the first type of application.
Taking the technical scheme as an example, taking the instant messaging application as a first type application, and determining a pre-designated first application as a target first application in the instant messaging application; extracting account information under all target first applications in the data stream, and carrying out user aggregation according to the association relation between the account information of the target first applications and the equipment identifier; for example, the target first application is application a, and for one account A1 in application a, if the data streams related to the account A1 are all related to the device A1, and no data streams sent by other accounts of the application a exist in the device A1, the account A1 and the device A1 can be aggregated into one aggregated user, that is, one first application account and one device are aggregated into one user.
If the data stream related to the account A1 is related to the device B1 and the device B2, and no data stream of other accounts in the application a exists in the device B1 and the device B2, the account A1 and the device B2 can be aggregated, that is, a first application account and a plurality of devices are aggregated into a user; if the data streams sent by the account A1 and the account A2 are only related to the device A1, and no data streams of other accounts of the application a exist in the device A1, the account A2 and the device A1 may be aggregated into one user, that is, multiple first application accounts and one device may be aggregated into one user.
If the data stream of the account A1 is only related to the device B1 and the device B2, the data stream of the account A2 is also only related to the device B1 and the device B2, and no data stream sent by other accounts of the application a exists in the device B1 and the device B2, the account A1 and the account A2 and the device A1 and the device A2 can be aggregated into one user, that is, multiple first application accounts and multiple devices are aggregated into one user. Thus, the specific user quantity in the network flow in the first preset time is obtained.
Meanwhile, because the temporary login phenomenon exists, namely, in the equipment to which the user A belongs, the situation that the user B temporarily uses and logs in the user B own account can exist, and the use time of the temporary login is generally shorter, the aggregation relationship between the account and the equipment can be determined according to the number of data streams or the number ratio of the data streams of each account on each equipment; for example, if the number of data streams of an account on one device is greater than a first number threshold, or the number of data streams of the account on the device, the number of data streams on all devices is greater than the first number threshold, it may be determined that an aggregation relationship exists between the account and the current device; otherwise, the account is determined to be logged in temporarily, and the account is not aggregated with the current equipment.
In addition, if the account A1 has a flow record in the device A2, but the number of data flows is small (i.e. less than or equal to the first number threshold value), and the number of data flows of the account A1 in the device A1 is large (i.e. greater than the first number threshold value), and the flow record of the account A2 also exists in the device A1, and the flow record of the account A1 does not exist in the device A2, it also indicates that the account A1 is only temporarily logged in the device A2, and the account A1 and the device A2 cannot be aggregated into one user, and obviously, the account A1 and the account A2 cannot be aggregated together with the device A1 and the device A2 into one user.
In particular, if the first type application includes a plurality of first applications, after the target first applications and the respective devices have been aggregated, the account information of the remaining non-target first applications may be continuously aggregated with the respective devices based on the same manner, so as to bind the account information of each first application with the corresponding device respectively.
S103, acquiring the associated data streams of the aggregation users, and respectively acquiring the network behavior portraits of the aggregation users according to the associated data streams of the aggregation users and a preset time window.
The data flow which does not comprise account information in the equipment which the aggregation user belongs to is related to the aggregation user, and the data flow in each equipment (comprising the equipment which the aggregation user belongs to and the equipment which the aggregation user does not belong to) which is the actual attribution flow of the aggregation user, namely the related data flow, wherein the account which the aggregation user belongs to (comprises the account of the target first application and the account of the non-target first application).
Sorting the associated data streams of each aggregation user according to the timestamp information, and after sorting is completed, aggregating the data streams according to the application type of each associated data stream to obtain user behavior records on a time line; for example, user a uses application a at 0 point to 0 point 10 minutes; application B is used at point 05 to point 15; obviously, a user can use a plurality of applications at the same time; after determining the timeline information for each aggregate user, the behavior data of the user within each window may be determined according to a preset time window.
Different time windows, the obtained user network behavior portraits are also different; for example, 15 minutes is a time window; the user A uses the application A and the application B in a first time window and uses the application B in a second time window; and 5 minutes as a time window; the user a uses the application a in a first time window, uses the application a and the application B in a second time window, and uses the application B in a third time window. Based on the user behavior portraits obtained by the technical scheme, the network behavior supervision of each user can be ensured, the occurrence of abnormal network behaviors can be monitored, the network safety can be improved, and the system can be used for helping each user to improve the operation efficiency.
Optionally, in an embodiment of the present invention, the acquiring the associated data stream of each aggregation user includes: and taking the rest data streams except the data streams related to the non-affiliated accounts in at least one affiliated device and the data streams related to the affiliated accounts in at least one non-affiliated device as the associated data streams of the current aggregation user.
Specifically, the device is a device having a attribution relation with the current aggregation user, that is, a device which is determined to be attributed to the current aggregation user according to the aggregation relation; the non-affiliated devices are devices which have no attribution relation with the aggregation user, namely, the devices which are affiliated to other aggregation users are determined according to the aggregation relation; if the current aggregation user belongs to equipment, including other users, to temporarily log in to generate traffic, it is obvious that the partial traffic should be attributed to the actual user, but not to the equipment owner; similarly, traffic generated by the current aggregate user temporarily logging into other user devices should also be attributed to the current aggregate user, but not to the device owner; thus, for each aggregate user, the data streams associated therewith include those that do not include account information in the device to which it belongs, those that are generated by the account in the device to which it belongs, and those that are generated by the account in the device to which it does not belong; by acquiring the data stream which does not comprise account information in the affiliated device, the data stream generated by the affiliated account in the affiliated device and the data stream generated by the affiliated account in the non-affiliated device, the integrity of the network behavior data of each aggregation user is ensured, and particularly, the loss of the associated data stream in the non-affiliated device and the mismatching of the non-associated data stream in the affiliated device are avoided.
Optionally, in an embodiment of the present invention, the acquiring the associated data stream of each aggregation user specifically includes: and carrying out noise filtering on the data flow set according to at least one of a flow noise list, a flow data volume threshold, flow occurrence time and a flow event volume threshold. Specifically, the traffic noise list defines a plurality of application types (for example, input method type applications or system security type applications), or names of a plurality of specific applications (for example, application C), where the type of application is generally a flow generated by upgrading a software version, and is not a flow generated by a user actively triggering a behavior, and therefore, if the application type of the current data flow is an application type defined in the traffic noise list, or the application name is a specific application defined in the traffic noise list, the data flow is regarded as noise flow, and is not an associated data flow of a user behavior image.
The traffic data volume threshold defines the volume of data per unit time; the normal network behavior of the user usually generates a larger data volume, if the data volume in unit time is lower, the data volume may be one or more applications in the system, and the normal communication behavior between the applications and the corresponding servers is not the active triggering behavior of the user, so the data flow can be regarded as noise flow;
The traffic occurrence time, that is, the time when the traffic passes through the network device, the traffic event, that is, the number of data packets in the traffic, may be generated by automatic update of the application software if the traffic occurs in a specific time, for example, 3 to 5 am, or the number of traffic events is too low; in particular, if the number of traffic events within the specific time period is small, each data stream within the time period may be regarded as a noise traffic. Noise filtering is carried out on the data flow set through the flow noise list, the flow data quantity threshold, the flow occurrence time and the flow event quantity threshold, so that the number of data flows to be processed is reduced, the noise flow is prevented from being misclassified into user behavior data, and the accuracy of the acquired user behavior portraits is improved.
Optionally, in an embodiment of the present invention, if the application type further includes a second type application, and account information of at least one target second application in the second type application is related to an identity, the acquiring each aggregate user according to the device identifier of each data stream and the account information of at least one first application in the first type application specifically further includes: and according to the equipment identification of each data stream, associating the account information of at least one target second application in the second type application with each aggregation user so as to obtain the identity identification of each aggregation user.
Specifically, taking the above technical solution as an example, the first type of application may include an instant messaging application, and the second type of application may include an email application; although the application range of instant messaging is wider, account information of the instant messaging may not be related to user identity, and in an email, particularly in a work email of a designated type, the email account of the instant messaging often takes the real name or name abbreviation of the user as a prefix, and the email account itself reflects the real information of the user; therefore, account information of each second application under the second type application can be aggregated with each aggregation user, based on the aggregation result, not only can complete associated data streams of the aggregation user in non-affiliated devices be obtained, mismatching of the non-associated data streams in the affiliated devices be avoided, but also true identity information of each aggregation user can be further obtained, and information matching of the aggregation user and the true user can be achieved.
According to the technical scheme, after the data flow set in the first preset time is acquired, each aggregation user is acquired according to the equipment identification of each data flow and account information of at least one first application in the first type application, and the network behavior portraits of each aggregation user are acquired according to the associated data flow of each aggregation user and the preset time window, so that each user in the network is accurately positioned on the premise of unknown user identity and user quantity, aggregation acquisition of real users in the network is ensured, meanwhile, acquired complete user behavior data is improved, and the accuracy of the constructed user network behavior portraits is improved.
Example two
Fig. 2 is a flowchart of a method for obtaining a user network behavior portrait according to a second embodiment of the present invention, where the relationship between the present embodiment and the above embodiment is that account information of a plurality of first applications in a first type of application and device identifiers are aggregated. As shown in fig. 2, the method includes:
s201, acquiring a data stream set in a first preset time; each data stream in the data stream set comprises an application type, and the data stream under the first type of application in the application type comprises account information.
S202, determining a target first application in the first type application according to at least one of the number of data streams, the number of accounts and whether the account information has an identity.
The number of data streams and the number of accounts both reflect the application range of the first application, the larger the number is, the larger the application range is, and the number of acquired aggregate users is also larger, so that each user in the network is represented to the greatest extent, and therefore the first application with the largest number of data streams or account numbers can be used as the target first application. In addition, the account information of the part of instant messaging applications is composed of the name or the identifier of the real user, and not only can the account information be used as the aggregation basis of the user, but also the identity of the user can be directly represented, so that the first application with the identity identifier of the account information can be used as the target first application.
In particular, the target first application can be determined together according to the number of data streams, the number of accounts and whether the account information has an identity; if the account information of the current first application has an identity, and the number of data streams or the number of accounts is larger than a preset number threshold, the current first application is used as a target first application; if the account information of the current first application has an identity, and the number of data streams or the number of accounts is smaller than or equal to a preset number threshold, the first application with the largest number of data streams or the largest number of accounts is used as the target first application.
S203, acquiring each aggregation user according to the equipment identification of each data stream and the account information of the target first application.
S204, according to the equipment identification of each data stream and the account information of the target first application, the account information of the non-target first application in the first type application and each aggregation user are aggregated again.
According to the technical scheme, after the target first application and the electronic equipment are aggregated, not only the data flow in the electronic equipment to which the aggregation user belongs but also the account number of the target first application to which the aggregation user belongs and the data flow in the equipment not to which the aggregation user belongs can be obtained; similarly, based on the technical scheme, the account numbers of other first applications can be continuously aggregated with the electronic equipment, so that the account numbers of other first applications to which the aggregation user belongs can be obtained, and the data flow in the equipment not to which the aggregation user belongs can be obtained.
Particularly, when the account information of other first applications is aggregated with the aggregation user, the aggregation can be performed according to the association relationship between the account information of other first applications and the account information of the target first application, in addition to the association relationship between the account information and the electronic equipment; for example, if the target first application (for example, the application B1) and the other first applications (for example, the application B2) have a common login device and a non-common login device, but the number of data streams respectively generated in the non-common login device is smaller, and the number of data streams respectively generated in the common login device is larger, it can be considered that the application B1 and the application B2 are the same aggregation user, so that aggregation of a plurality of application accounts and devices is realized, complete user behavior data is conveniently obtained, and the accuracy of obtaining the aggregation user is further improved by means of the device login relationship of different application accounts.
S205, acquiring the associated data streams of the aggregation users, and respectively acquiring the network behavior portraits of the aggregation users according to the associated data streams of the aggregation users and a preset time window.
Optionally, in an embodiment of the present invention, after obtaining each aggregate user according to the device identifier of each data stream and the account information of the target first application, the method further includes: judging whether the residual device identifiers which are not aggregated exist or not; if the fact that the non-aggregated residual equipment identifiers exist is determined, according to the equipment identifiers of the data streams and the account information of the target first application, the account information of the non-target first application in the first type application, the aggregated user and the residual equipment identifiers are aggregated again; the step of re-aggregating the account information of the non-target first application in the first type application with each aggregation user according to the device identifier of each data stream and the account information of the target first application, including: if the fact that the non-aggregated residual equipment identifiers do not exist is determined, according to the equipment identifiers of the data streams and the account information of the target first application, the account information of the non-target first application in the first type application and the aggregated users are aggregated again.
Specifically, although the application range of the target first application is larger, it cannot be guaranteed that each real user in the network has a login behavior under the application, so after the target first application and the device identifier are aggregated, there may be electronic devices that are not aggregated; therefore, the aggregation is continuously carried out through the account numbers of other first applications and the electronic equipment which is not aggregated to obtain new aggregation users, the monitoring range of the current network is further enlarged, and the integrity of the monitored objects in the current network is ensured; meanwhile, the aggregated electronic equipment can also continuously acquire the complete user behavior data of the aggregated user through the re-aggregation with the account numbers of other first applications.
According to the technical scheme, the application range of the first application is reflected by the number of data streams and the number of accounts, the application range is larger, the number of acquired aggregated users is larger, each user in the network is represented to the greatest extent, the account information containing the identity mark can be used as an aggregation basis of the user, the identity of the user can be directly represented, in addition, aggregation is continuously carried out through accounts of other first applications and electronic equipment which are not aggregated, so that new aggregated users are acquired, the monitoring range of the current network is further enlarged, and the integrity of monitoring objects in the current network is ensured; meanwhile, the aggregated electronic equipment can also continuously acquire the complete user behavior data of the aggregated user through the re-aggregation with the account numbers of other first applications.
Example III
Fig. 3 is a flowchart of a method for obtaining a network behavior portrait of a user according to a third embodiment of the present invention, where after an aggregate user under a fixed network is obtained, a non-fixed network data stream set is continuously aggregated with the aggregate user. As shown in fig. 3, the method includes:
S301, acquiring a data stream set in a first preset time; each data stream in the data stream set comprises an application type, and the data stream under the first type of application in the application type comprises account information; the data stream set comprises a fixed network data stream set and a non-fixed network data stream set.
S302, acquiring each aggregation user in the fixed network according to the equipment identification of each data stream in the fixed network data stream set and account information of at least one first application in the first type of application.
S303, aggregating each data flow in the non-fixed network data flow set with each aggregation user in the fixed network.
The fixed network data flow set can be acquired by a router in the local area network, and the non-fixed network data flow set can be acquired by a base station. For the data flow under the non-fixed network, when one electronic device (for example, device a) turns on a hot spot and another electronic device (for example, device B) accesses the base station through the hot spot of device a, since device B obtains the data information through the traffic in device a, the traffic obtained by the base station side substantially only includes the device identifier of device a and does not include the device identifier of device B; therefore, if the user aggregation is directly performed based on the non-fixed network data stream set, the data stream generated by the device B accessing the hot spot is mistakenly considered to be generated by the device a opening the hot spot, so that deviation occurs in the acquired behavior data of the aggregated user corresponding to the device a.
Therefore, when an aggregation user under a fixed network is acquired through the fixed network data stream set, each data stream in the non-fixed network data stream set is distributed to a corresponding aggregation user according to account information of each first application in the first type application, and then a data stream which does not contain the account information is distributed to the corresponding aggregation user according to the equipment identification, so that acquisition of user network behavior data in the fixed network state and the non-fixed network state in the same time period is realized, the integrity of the user network behavior data is ensured, meanwhile, the problem of misdistribution of the non-fixed network data stream caused by the reasons of equipment starting hot spots and the like is avoided, and the accuracy of the acquired user network behavior data is improved.
S304, acquiring the associated data streams of the aggregation users, and respectively acquiring the network behavior portraits of the aggregation users according to the associated data streams of the aggregation users and a preset time window.
According to the technical scheme of the embodiment of the invention, after each aggregation user in the fixed network is acquired according to the equipment identification of each data flow in the fixed network data flow set and the account information of at least one first application in the first type application, each data flow in the non-fixed network data flow set and each aggregation user in the fixed network are aggregated, so that the acquisition of the user network behavior data in the fixed network and the non-fixed network state in the same period is realized, the integrity of the user network behavior data is ensured, meanwhile, the problem of the misdistribution of the non-fixed network data flow caused by the reasons of equipment starting hot spots and the like is avoided, and the accuracy of the acquired user network behavior data is improved.
Example IV
Fig. 4 is a block diagram of a device for obtaining a user network behavior portrait according to a fourth embodiment of the present invention, where the device specifically includes:
a data flow set acquisition module 401, configured to acquire a data flow set within a first preset time; each data stream in the data stream set comprises an application type, and the data stream under the first type of application in the application type comprises account information;
an aggregate user obtaining module 402, configured to obtain each aggregate user according to the device identifier of each data stream and account information of at least one first application in the first type of applications;
the user portrayal obtaining module 403 is configured to obtain an associated data stream of each aggregation user, and obtain a network behavior portrayal of each aggregation user according to the associated data stream of each aggregation user and a preset time window.
According to the technical scheme, after the data flow set in the first preset time is acquired, each aggregation user is acquired according to the equipment identification of each data flow and account information of at least one first application in the first type application, and the network behavior portraits of each aggregation user are acquired according to the associated data flow of each aggregation user and the preset time window, so that each user in the network is accurately positioned on the premise of unknown user identity and user quantity, aggregation acquisition of real users in the network is ensured, meanwhile, acquired complete user behavior data is improved, and the accuracy of the constructed user network behavior portraits is improved.
Optionally, the user portrayal obtaining module 403 is specifically configured to use, as the associated data stream of the current aggregate user, the remaining data streams in at least one affiliated device except the data stream related to the non-affiliated account, and the data stream related to the affiliated account in at least one non-affiliated device.
Optionally, the aggregate user obtaining module 402 is configured to determine a target first application from the first type applications according to at least one of the number of data flows, the number of accounts, and whether the account information has an identity; acquiring each aggregation user according to the equipment identification of each data stream and the account information of the target first application; and according to the equipment identification of each data stream and the account information of the target first application, the account information of the non-target first application in the first type application and each aggregation user are aggregated again.
Optionally, the aggregate user obtaining module 402 is specifically configured to determine whether there are any remaining device identifiers that are not aggregated; if the fact that the non-aggregated residual equipment identifiers exist is determined, according to the equipment identifiers of the data streams and the account information of the target first application, the account information of the non-target first application in the first type application, the aggregated user and the residual equipment identifiers are aggregated again; if the fact that the non-aggregated residual equipment identifiers do not exist is determined, according to the equipment identifiers of the data streams and the account information of the target first application, the account information of the non-target first application in the first type application and the aggregated users are aggregated again.
Optionally, the user profile acquisition module 403 is specifically configured to perform noise filtering on the data flow set according to at least one of a flow noise list, a flow data volume threshold, a flow occurrence time, and a flow event volume threshold.
Optionally, if the application type further includes a second type application, and account information of at least one target second application in the second type application is related to the identity, the aggregate user obtaining module 402 is specifically configured to aggregate, according to the device identity of each data stream, the account information of at least one target second application in the second type application with each aggregate user, so as to obtain the identity of each aggregate user.
Optionally, the data flow set includes a fixed network data flow set and a non-fixed network data flow set;
the aggregate user obtaining module 402 is specifically configured to obtain each aggregate user in the fixed network according to the device identifier of each data flow in the fixed network data flow set and account information of at least one first application in the first type of applications; and aggregating each data flow in the non-fixed network data flow set with each aggregation user in the fixed network.
The device can execute the method for acquiring the user network behavior portrait, which is provided by any embodiment of the invention, and has the corresponding functional modules and beneficial effects of the execution method. Technical details which are not described in detail in the present embodiment can be referred to the method for acquiring a user network behavior portrait provided in any embodiment of the present invention.
Example five
Fig. 5 shows a schematic diagram of the structure of an electronic device 10 that may be used to implement an embodiment of the invention. Electronic devices are intended to represent various forms of digital computers, such as laptops, desktops, workstations, personal digital assistants, servers, blade servers, mainframes, and other appropriate computers. Electronic equipment may also represent various forms of mobile devices, such as personal digital processing, cellular telephones, smartphones, wearable devices (e.g., helmets, glasses, watches, etc.), and other similar computing devices. The components shown herein, their connections and relationships, and their functions, are meant to be exemplary only, and are not meant to limit implementations of the inventions described and/or claimed herein.
As shown in fig. 5, the electronic device 10 includes at least one processor 11, and a memory, such as a Read Only Memory (ROM) 12, a Random Access Memory (RAM) 13, etc., communicatively connected to the at least one processor 11, in which the memory stores a computer program executable by the at least one processor, and the processor 11 may perform various appropriate actions and processes according to the computer program stored in the Read Only Memory (ROM) 12 or the computer program loaded from the storage unit 18 into the Random Access Memory (RAM) 13. In the RAM 13, various programs and data required for the operation of the electronic device 10 may also be stored. The processor 11, the ROM 12 and the RAM 13 are connected to each other via a bus 14. An input/output (I/O) interface 15 is also connected to bus 14.
Various components in the electronic device 10 are connected to the I/O interface 15, including: an input unit 16 such as a keyboard, a mouse, etc.; an output unit 17 such as various types of displays, speakers, and the like; a storage unit 18 such as a magnetic disk, an optical disk, or the like; and a communication unit 19 such as a network card, modem, wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information/data with other devices via a computer network, such as the internet, and/or various telecommunication networks.
The processor 11 may be a variety of general and/or special purpose processing components having processing and computing capabilities. Some examples of processor 11 include, but are not limited to, a Central Processing Unit (CPU), a Graphics Processing Unit (GPU), various specialized Artificial Intelligence (AI) computing chips, various processors running machine learning model algorithms, digital Signal Processors (DSPs), and any suitable processor, controller, microcontroller, etc. The processor 11 performs the various methods and processes described above, such as the acquisition of user network behavior portraits.
In some embodiments, the method of obtaining a representation of user network behavior may be implemented as a computer program tangibly embodied on a computer-readable storage medium, such as a storage unit. In some embodiments, part or all of the computer program may be loaded and/or installed onto the heterogeneous hardware accelerator via the ROM and/or the communication unit. One or more of the steps of the user network behavior representation acquisition method described above may be performed when the computer program is loaded into RAM and executed by a processor. Alternatively, in other embodiments, the processor may be configured to perform the method of obtaining the representation of the user's network behavior in any other suitable manner (e.g., by means of firmware).
Various implementations of the systems and techniques described here above may be implemented in digital electronic circuitry, integrated circuit systems, field Programmable Gate Arrays (FPGAs), application Specific Integrated Circuits (ASICs), application Specific Standard Products (ASSPs), systems On Chip (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and/or combinations thereof. These various embodiments may include: implemented in one or more computer programs, the one or more computer programs may be executed and/or interpreted on a programmable system including at least one programmable processor, which may be a special purpose or general-purpose programmable processor, that may receive data and instructions from, and transmit data and instructions to, a storage system, at least one input device, and at least one output device.
A computer program for carrying out methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general purpose computer, special purpose computer, or other programmable data processing apparatus, such that the computer programs, when executed by the processor, cause the functions/acts specified in the flowchart and/or block diagram block or blocks to be implemented. The computer program may execute entirely on the machine, partly on the machine, as a stand-alone software package, partly on the machine and partly on a remote machine or entirely on the remote machine or server.
In the context of the present invention, a computer-readable storage medium may be a tangible medium that can contain, or store a computer program for use by or in connection with an instruction execution system, apparatus, or device. The computer readable storage medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any suitable combination of the foregoing. Alternatively, the computer readable storage medium may be a machine readable signal medium. More specific examples of a machine-readable storage medium would include an electrical connection based on one or more wires, a portable computer diskette, a hard disk, a Random Access Memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.
To provide for interaction with a user, the systems and techniques described here can be implemented on a heterogeneous hardware accelerator having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to a user; and a keyboard and pointing device (e.g., a mouse or a trackball) through which a user can provide input to the heterogeneous hardware accelerator. Other kinds of devices may also be used to provide for interaction with a user; for example, feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form, including acoustic input, speech input, or tactile input.
The systems and techniques described here can be implemented in a computing system that includes a background component (e.g., as a data server), or that includes a middleware component (e.g., an application server), or that includes a front-end component (e.g., a user computer having a graphical user interface or a web browser through which a user can interact with an implementation of the systems and techniques described here), or any combination of such background, middleware, or front-end components. The components of the system can be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: local Area Networks (LANs), wide Area Networks (WANs), blockchain networks, and the internet.
The computing system may include clients and servers. The client and server are typically remote from each other and typically interact through a communication network. The relationship of client and server arises by virtue of computer programs running on the respective computers and having a client-server relationship to each other. The server can be a cloud server, also called a cloud computing server or a cloud host, and is a host product in a cloud computing service system, so that the defects of high management difficulty and weak service expansibility in the traditional physical hosts and VPS service are overcome.
It should be appreciated that various forms of the flows shown above may be used to reorder, add, or delete steps. For example, the steps described in the present invention may be performed in parallel, sequentially, or in a different order, so long as the desired results of the technical solution of the present invention are achieved, and the present invention is not limited herein.
The above embodiments do not limit the scope of the present invention. It will be apparent to those skilled in the art that various modifications, combinations, sub-combinations and alternatives are possible, depending on design requirements and other factors. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present invention should be included in the scope of the present invention.

Claims (10)

1. The method for acquiring the user network behavior portraits is characterized by comprising the following steps of:
acquiring a data stream set in a first preset time; each data stream in the data stream set comprises an application type, and the data stream under the first type of application in the application type comprises account information;
acquiring each aggregation user according to the equipment identification of each data stream and account information of at least one first application in the first type of application;
And acquiring the associated data stream of each aggregation user, and respectively acquiring the network behavior portraits of each aggregation user according to the associated data stream of each aggregation user and a preset time window.
2. The method of claim 1, wherein said obtaining the associated data stream for each of the aggregated users comprises:
and taking the rest data streams except the data streams related to the non-affiliated accounts in at least one affiliated device and the data streams related to the affiliated accounts in at least one non-affiliated device as the associated data streams of the current aggregation user.
3. The method according to claim 1, wherein the obtaining each aggregate user according to the device identifier of each data stream and account information of at least one first application in the first type of applications includes:
determining a target first application in the first type application according to at least one of the number of data streams, the number of accounts and whether the account information has an identity;
acquiring each aggregation user according to the equipment identification of each data stream and the account information of the target first application;
and according to the equipment identification of each data stream and the account information of the target first application, the account information of the non-target first application in the first type application and each aggregation user are aggregated again.
4. A method according to claim 3, further comprising, after obtaining each aggregate user based on the device identification of each data stream and the account information of the target first application:
judging whether the residual device identifiers which are not aggregated exist or not;
if the fact that the non-aggregated residual equipment identifiers exist is determined, according to the equipment identifiers of the data streams and the account information of the target first application, the account information of the non-target first application in the first type application, the aggregated user and the residual equipment identifiers are aggregated again;
the step of re-aggregating the account information of the non-target first application in the first type application with each aggregation user according to the device identifier of each data stream and the account information of the target first application, including:
if the fact that the non-aggregated residual equipment identifiers do not exist is determined, according to the equipment identifiers of the data streams and the account information of the target first application, the account information of the non-target first application in the first type application and the aggregated users are aggregated again.
5. The method according to claim 1, wherein the obtaining the associated data stream of each aggregation user specifically comprises:
And carrying out noise filtering on the data flow set according to at least one of a flow noise list, a flow data volume threshold, flow occurrence time and a flow event volume threshold.
6. The method according to claim 1, wherein if the application type further includes a second type application, and account information of at least one target second application in the second type application is related to an identity, the obtaining each aggregate user according to the device identity of each data stream and the account information of at least one first application in the first type application specifically further includes:
and aggregating account information of at least one target second application in the second type application with each aggregation user according to the equipment identifier of each data stream so as to obtain the identity identifier of each aggregation user.
7. The method of claim 1, wherein the set of data streams includes a set of fixed network data streams and a set of non-fixed network data streams;
the obtaining each aggregation user according to the device identifier of each data stream and account information of at least one first application in the first type of applications includes:
Acquiring each aggregation user in the fixed network according to the equipment identification of each data stream in the fixed network data stream set and account information of at least one first application in the first type of application;
and aggregating each data flow in the non-fixed network data flow set with each aggregation user in the fixed network.
8. An apparatus for obtaining a representation of a user's network behavior, comprising:
the data flow set acquisition module is used for acquiring a data flow set in a first preset time; each data stream in the data stream set comprises an application type, and the data stream under the first type of application in the application type comprises account information;
the aggregation user acquisition module is used for acquiring each aggregation user according to the equipment identifier of each data stream and account information of at least one first application in the first type of application;
the user portrayal acquisition module is used for acquiring the associated data streams of the aggregation users and respectively acquiring the network behavior portrayal of the aggregation users according to the associated data streams of the aggregation users and a preset time window.
9. An electronic device, the electronic device comprising:
At least one processor; and
a memory communicatively coupled to the at least one processor; wherein,,
the memory stores a computer program executable by the at least one processor to enable the at least one processor to perform the method of acquiring a representation of user network behavior according to any one of claims 1-7.
10. A computer readable storage medium storing computer instructions for causing a processor to implement the method of obtaining a representation of user network behaviour according to any one of claims 1 to 7 when executed.
CN202310194719.2A 2023-02-28 2023-02-28 Method, device and storage medium for acquiring user network behavior portraits Pending CN116319397A (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN202310194719.2A CN116319397A (en) 2023-02-28 2023-02-28 Method, device and storage medium for acquiring user network behavior portraits

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN202310194719.2A CN116319397A (en) 2023-02-28 2023-02-28 Method, device and storage medium for acquiring user network behavior portraits

Publications (1)

Publication Number Publication Date
CN116319397A true CN116319397A (en) 2023-06-23

Family

ID=86823452

Family Applications (1)

Application Number Title Priority Date Filing Date
CN202310194719.2A Pending CN116319397A (en) 2023-02-28 2023-02-28 Method, device and storage medium for acquiring user network behavior portraits

Country Status (1)

Country Link
CN (1) CN116319397A (en)

Similar Documents

Publication Publication Date Title
US11863439B2 (en) Method, apparatus and storage medium for application identification
CN107196949A (en) The system for limiting same user account registration terminal quantity
CN116010220A (en) Alarm diagnosis method, device, equipment and storage medium
CN116661960A (en) Batch task processing method, device, equipment and storage medium
WO2021056739A1 (en) Performance analysis method, device, computer apparatus and storage medium
US11005797B2 (en) Method, system and server for removing alerts
CN117093627A (en) Information mining method, device, electronic equipment and storage medium
CN117040799A (en) Page interception rule generation and page access control method and device and electronic equipment
CN115426287B (en) System monitoring and optimizing method and device, electronic equipment and medium
CN116015796A (en) Flow table updating method and device, firewall equipment and storage medium
CN116319397A (en) Method, device and storage medium for acquiring user network behavior portraits
CN113642919A (en) Risk control method, electronic device, and storage medium
CN114500105A (en) Network packet interception method, device, equipment and storage medium
CN116094908B (en) Log file storage method, device, equipment and storage medium
CN117155755B (en) Alarm information processing method and device, electronic equipment and storage medium
CN117076185B (en) Server inspection method, device, equipment and medium
CN117294578B (en) Communication method, system, computer equipment and storage medium
CN117714200A (en) Network security defense method, device, equipment and storage medium
CN118445732A (en) Abnormal group identification method, device, equipment, medium and program product
CN116340097A (en) Method, device, equipment and storage medium for processing abnormal information
CN113918629A (en) Wind control management method and device
CN116016651A (en) Longitude and latitude correction method and device, electronic equipment and storage medium
CN116827812A (en) Network asset account display method and device, electronic equipment and storage medium
CN117714561A (en) Alarm message processing method, device, equipment and storage medium
CN117093558A (en) Method, device, equipment and medium for generating log file acquisition information

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination