CN117215747A - Client-oriented abnormal operation processing method, storage medium and related equipment - Google Patents
Client-oriented abnormal operation processing method, storage medium and related equipment Download PDFInfo
- Publication number
- CN117215747A CN117215747A CN202311185498.9A CN202311185498A CN117215747A CN 117215747 A CN117215747 A CN 117215747A CN 202311185498 A CN202311185498 A CN 202311185498A CN 117215747 A CN117215747 A CN 117215747A
- Authority
- CN
- China
- Prior art keywords
- abnormal
- client
- user
- data
- abnormal operation
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
- 230000002159 abnormal effect Effects 0.000 title claims abstract description 288
- 238000003860 storage Methods 0.000 title claims abstract description 22
- 238000003672 processing method Methods 0.000 title claims abstract description 11
- 239000012634 fragment Substances 0.000 claims abstract description 161
- 238000000034 method Methods 0.000 claims abstract description 59
- 238000011156 evaluation Methods 0.000 claims abstract description 58
- 230000008014 freezing Effects 0.000 claims abstract description 13
- 238000007710 freezing Methods 0.000 claims abstract description 13
- 230000006399 behavior Effects 0.000 claims description 89
- 238000012545 processing Methods 0.000 claims description 17
- 230000004048 modification Effects 0.000 claims description 13
- 238000012986 modification Methods 0.000 claims description 13
- 238000005520 cutting process Methods 0.000 claims description 4
- 238000004891 communication Methods 0.000 claims description 3
- 230000004044 response Effects 0.000 claims description 3
- 238000013473 artificial intelligence Methods 0.000 abstract description 6
- 206010000117 Abnormal behaviour Diseases 0.000 description 7
- 230000009471 action Effects 0.000 description 7
- 238000012544 monitoring process Methods 0.000 description 7
- 238000004590 computer program Methods 0.000 description 6
- 238000010586 diagram Methods 0.000 description 6
- 230000008569 process Effects 0.000 description 4
- 230000008901 benefit Effects 0.000 description 3
- 230000006870 function Effects 0.000 description 3
- 238000004080 punching Methods 0.000 description 3
- 230000005540 biological transmission Effects 0.000 description 2
- 238000004364 calculation method Methods 0.000 description 2
- 230000000694 effects Effects 0.000 description 2
- 238000005516 engineering process Methods 0.000 description 2
- 230000003287 optical effect Effects 0.000 description 2
- 238000004458 analytical method Methods 0.000 description 1
- 230000008859 change Effects 0.000 description 1
- 238000004801 process automation Methods 0.000 description 1
- 238000012216 screening Methods 0.000 description 1
- 230000003068 static effect Effects 0.000 description 1
- 238000006467 substitution reaction Methods 0.000 description 1
Classifications
-
- Y—GENERAL TAGGING OF NEW TECHNOLOGICAL DEVELOPMENTS; GENERAL TAGGING OF CROSS-SECTIONAL TECHNOLOGIES SPANNING OVER SEVERAL SECTIONS OF THE IPC; TECHNICAL SUBJECTS COVERED BY FORMER USPC CROSS-REFERENCE ART COLLECTIONS [XRACs] AND DIGESTS
- Y02—TECHNOLOGIES OR APPLICATIONS FOR MITIGATION OR ADAPTATION AGAINST CLIMATE CHANGE
- Y02D—CLIMATE CHANGE MITIGATION TECHNOLOGIES IN INFORMATION AND COMMUNICATION TECHNOLOGIES [ICT], I.E. INFORMATION AND COMMUNICATION TECHNOLOGIES AIMING AT THE REDUCTION OF THEIR OWN ENERGY USE
- Y02D10/00—Energy efficient computing, e.g. low power processors, power management or thermal management
Abstract
The abnormal operation processing method, the storage medium and the related equipment for the client side can be used in the artificial intelligence field or the financial field. The method comprises the steps of performing operation path matching on operation fragment data of a user on a client in a preset flow library, and sequentially obtaining total abnormal operation times of the user on the client, abnormal operation times and abnormal operation evaluation values on operation objects in the client; based on the abnormal operation evaluation value, searching out an interrupt operation matched with the operation object in a preset flow library; and executing interrupt operation on the operation object, and freezing the operation object. According to the method and the device, the operation path matching is carried out on the operation fragment data of the user on the client through the preset flow library, the abnormal operation evaluation value of the user can be counted, the abnormal operation evaluation value of the user is used as the basis of the intervention time of the abnormal operation behavior, the abnormal operation behavior of the user on the operation object on the client can be interrupted in time, and effective abnormal operation management and control is achieved.
Description
Technical Field
The present disclosure relates to the field of artificial intelligence, and in particular, to a method for processing abnormal operations for a client, a storage medium, and related devices.
Background
In order to better support the operation of the enterprise, monitoring needs to be performed on the operation behaviors of the user on the client so as to discover the abnormal operation behaviors of the user in time.
However, the current means for monitoring the operation behavior mainly relies on monitoring the screen of the client device in real time, or storing the operation behavior data generated by the user on the client and then screening the abnormal operation behavior. The means for monitoring the operation behaviors not only has low recognition efficiency on the abnormal operation behaviors, but also is unfavorable for timely intervening the abnormal operation behaviors of the user, and cannot achieve a good control effect on the abnormal operation behaviors of the user on the client.
Therefore, how to provide an effective abnormal operation control manner is a technical problem that needs to be solved by those skilled in the art.
Disclosure of Invention
In view of the foregoing, the present disclosure provides a method for handling abnormal operation of a client, a storage medium, and related devices, which overcome or at least partially solve the foregoing problems, and the technical solutions are as follows:
A method for processing abnormal operation facing to a client comprises the following steps:
obtaining operation flow data of a user on a client;
performing data division on the operation flow data to obtain a plurality of operation fragment data;
performing operation path matching on the operation fragment data in a preset flow library to obtain the total number of abnormal operation times of the user on the client;
obtaining the abnormal operation times of the user on each operation object in the client under the condition that the total abnormal operation times are larger than a preset abnormal evaluation threshold;
obtaining an abnormal operation evaluation value of the user by using the abnormal operation times;
searching an interrupt operation matched with the operation object in the preset flow library under the condition that the abnormal operation evaluation value is larger than a preset abnormal control threshold value;
and executing the interrupt operation on the operation object, and freezing the operation object.
Optionally, the data dividing the operation flow data to obtain a plurality of operation fragment data includes:
dividing the operation flow data into a plurality of first operation fragment data;
and cutting out second operation fragment data between the two first operation fragment data according to the window size of a preset operation window based on the connection position of the two connected first operation fragment data.
Optionally, the performing operation path matching on each piece of operation fragment data in a preset flow library to obtain total abnormal operation times of the user on the client, including:
performing operation path matching on the first operation fragment data in a preset flow library to obtain the number of first abnormal operation fragments;
performing operation path matching on the second operation fragment data in the preset flow library to obtain the number of second abnormal operation fragments;
and obtaining the total number of abnormal operations of the user on the client by at least using the first abnormal operation fragment number and the second abnormal operation fragment number.
Optionally, the method further comprises:
under the condition that the matching of the operation path of any one of the first operation fragment data fails, carrying out data division on the first operation fragment data to obtain a plurality of third operation fragment data;
and performing operation path matching on the third operation fragment data in the preset flow library to obtain the number of third abnormal operation fragments.
Optionally, the obtaining the total number of abnormal operations of the user on the client by using at least the first abnormal operation segment number and the second abnormal operation segment number includes:
And counting the number of the first abnormal operation fragments, the number of the second abnormal operation fragments and the number of the third abnormal operation fragments to obtain the total number of abnormal operations of the user on the client.
Optionally, before the obtaining the operation flow data of the user on the client, the method further includes:
obtaining a current operation path of each operation object in the client;
performing operation path matching on the current operation path in the preset flow library to obtain an operation path matching result;
based on the operation path matching result, adding a first behavior type identifier to the current operation path;
and storing the current operation path added with the first behavior type identifier into the preset flow library.
Optionally, after the storing the current operation path added with the first behavior type identifier in the preset flow library, the method further includes:
obtaining a behavior type modification instruction sent by an administrator to the current operation path;
and in response to the behavior type modification instruction, modifying the first behavior type identifier of the current operation path into a second behavior type identifier.
A client-oriented abnormal operation processing apparatus, comprising: an operation flow data obtaining unit, an operation fragment data obtaining unit, an abnormal operation total number obtaining unit, an abnormal operation evaluation value obtaining unit, an interrupted operation retrieving unit, and an interrupted operation executing unit,
the operation flow data obtaining unit is used for obtaining operation flow data of a user on a client;
the operation fragment data obtaining unit is used for carrying out data division on the operation flow data to obtain a plurality of operation fragment data;
the abnormal operation total times obtaining unit is used for carrying out operation path matching on the operation fragment data in a preset flow library to obtain the abnormal operation total times of the user on the client;
the abnormal operation frequency obtaining unit is used for obtaining the abnormal operation frequency of the user on each operation object in the client side under the condition that the total abnormal operation frequency is larger than a preset abnormal evaluation threshold value;
the abnormal operation evaluation value obtaining unit is used for obtaining the abnormal operation evaluation value of the user by using the abnormal operation times;
the interrupt operation searching unit is used for searching interrupt operation matched with the operation object in the preset flow library under the condition that the abnormal operation evaluation value is larger than a preset abnormal control threshold value;
The interrupt operation execution unit is used for executing the interrupt operation on the operation object and freezing the operation object.
A computer-readable storage medium having stored thereon a program which, when executed by a processor, implements the client-oriented abnormal operation processing method of any one of the above.
An electronic device comprising at least one processor, and at least one memory, bus connected to the processor; the processor and the memory complete communication with each other through the bus; the processor is configured to call the program instructions in the memory to execute the method for handling abnormal operation of the client according to any one of the above.
By means of the technical scheme, the abnormal operation processing method, the storage medium and the related equipment for the client side, which are provided by the disclosure, can be used in the artificial intelligence field or the financial field. The method comprises the steps of obtaining operation flow data of a user on a client; performing data division on the operation flow data to obtain a plurality of operation fragment data; performing operation path matching on the operation fragment data in a preset flow library to obtain the total number of abnormal operation times of a user on a client; obtaining the abnormal operation times of the user on each operation object in the client under the condition that the total abnormal operation times are larger than a preset abnormal evaluation threshold; obtaining an abnormal operation evaluation value of the user by using the abnormal operation times; under the condition that the abnormal operation evaluation value is larger than a preset abnormal control threshold value, searching out an interrupt operation matched with the operation object in a preset flow library; and executing interrupt operation on the operation object, and freezing the operation object. According to the method and the device, the operation path matching is carried out on the operation fragment data of the user on the client through the preset flow library, the abnormal operation evaluation value of the user can be counted, the abnormal operation evaluation value of the user is used as the basis of the intervention time of the abnormal operation behavior, the abnormal operation behavior of the user on the operation object on the client can be interrupted in time, and effective abnormal operation management and control is achieved.
The foregoing description is merely an overview of the technical solutions of the present disclosure, and may be implemented according to the content of the specification in order to make the technical means of the present disclosure more clearly understood, and in order to make the above and other objects, features and advantages of the present disclosure more clearly understood, the following specific embodiments of the present disclosure are specifically described.
Drawings
Various other advantages and benefits will become apparent to those of ordinary skill in the art upon reading the following detailed description of the preferred embodiments. The drawings are only for purposes of illustrating the preferred embodiments and are not to be construed as limiting the disclosure. Also, like reference numerals are used to designate like parts throughout the figures. In the drawings:
FIG. 1 is a schematic flow chart of an embodiment of a method for handling abnormal operations of a client according to an embodiment of the disclosure;
FIG. 2 is a schematic flow chart of another embodiment of a method for handling abnormal operations for a client according to an embodiment of the present disclosure;
FIG. 3 is a schematic flow chart of another embodiment of a method for handling abnormal operations for a client according to an embodiment of the present disclosure;
FIG. 4 is a schematic flow chart of another embodiment of a method for handling abnormal operations for a client according to an embodiment of the present disclosure;
Fig. 5 illustrates a schematic structural diagram of a client-oriented abnormal operation processing apparatus provided in an embodiment of the present disclosure;
fig. 6 shows a schematic structural diagram of an electronic device provided by an embodiment of the disclosure.
Detailed Description
Exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. While exemplary embodiments of the present disclosure are shown in the drawings, it should be understood that the present disclosure may be embodied in various forms and should not be limited to the embodiments set forth herein. Rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the scope of the disclosure to those skilled in the art.
As shown in fig. 1, a flowchart of an implementation manner of a method for processing abnormal operation of a client according to an embodiment of the present disclosure may include:
s100, obtaining operation flow data of a user on a client.
Wherein the client is an application program related to enterprise operation. The client is usually mounted on a client, and the client may be a computer, a card punch, or the like.
Wherein the operation flow data is data related to an operation performed by a user on the client. For example: the operational flow data may include operational data of a user on a client using various input devices. The input devices may include a mouse and a keyboard. For example: the operation flow data of the user on the client may include operation data of opening a business system card punching login interface by the user through a mouse, operation data of inputting a login password in the business system login interface through a keyboard, operation data of clicking the card punching by using the mouse, and operation data of clicking an exit button by using the mouse.
The embodiment of the disclosure can record the operation performed by the user on the client by using the RPA (Robotic Process Automation robot flow automation) monitoring end to generate operation flow data.
The method and the device can obtain the operation flow data of the user on the client in a specific time period. For example: embodiments of the present disclosure may obtain operational flow data of a user on a client in the last hour.
S200, data division is carried out on the operation flow data, and a plurality of operation fragment data are obtained.
Optionally, in the embodiment of the present disclosure, the operation flow data may be data-divided according to an operation object that a user performs an operation, so as to divide operation fragment data corresponding to each operation object. For example: according to the embodiment of the disclosure, the operation flow data can be subjected to data division, the operation fragment data A corresponding to the station equipment is divided, and the operation fragment data B corresponding to the card punching machine is divided.
Optionally, in the embodiment of the present disclosure, the operation flow data may be data-divided according to a preset data-dividing period, so as to divide a plurality of operation fragment data with equal time spans. For example: in the case that the preset data dividing time is 10 minutes, the embodiment of the disclosure may divide the operation flow data with the total duration of 1 hour into 6 operation fragment data.
S300, performing operation path matching on the operation fragment data in a preset flow library to obtain the total number of abnormal operation times of a user on the client.
The preset flow library is an RPA flow library. The RPA flow library may have a plurality of operation paths stored therein. Each operation path is added with a corresponding operation object identifier and a behavior type identifier. The operation object identifier is a unique identification of the operation object and is used for distinguishing operation paths of different operation objects. The behavior type is identified as the behavior class to which the operation path belongs. Alternatively, the behavior type identifier may include a normal behavior identifier, an abnormal behavior identifier, and an interrupt behavior identifier.
The operation path is the operation behavior data of the client terminal which is recorded in advance and defines the behavior classification. For example: according to the embodiment of the disclosure, the operation path of a user for executing normal operation on the station equipment can be recorded in advance, the operation path is stored in the preset flow library, when any operation fragment data is obtained, the operation fragment data is matched with the operation path in the preset flow library, and if the matching is successful, the operation fragment data is determined to correspond to normal operation behaviors. Similarly, the embodiment of the disclosure may pre-record an operation path of a user performing an abnormal operation on the station device, store the operation path in a preset flow library, and determine that any operation fragment data is an abnormal operation behavior if any operation fragment data is successfully matched with the operation path, and add 1 to the total number of abnormal operations of the user on the client.
Optionally, the embodiment of the disclosure may set a corresponding normal behavior library and an abnormal behavior library for the user, add the operation fragment data determined as the normal operation behavior to the normal behavior library, and add the operation fragment data determined as the abnormal operation behavior to the abnormal behavior library, so as to count the total number of abnormal operations of the user on the client.
S400, obtaining the abnormal operation times of the user on each operation object in the client under the condition that the total abnormal operation times are larger than a preset abnormal evaluation threshold.
The preset abnormal evaluation threshold is an index parameter for evaluating abnormal operation of the user. The embodiment of the disclosure can configure the preset abnormal evaluation threshold according to actual requirements.
According to the method and the device for processing the operation fragment data, the total number of abnormal operations can be compared with the preset abnormal evaluation threshold, and under the condition that the total number of abnormal operations is larger than the preset abnormal evaluation threshold, the operation fragment data identified as abnormal operation behaviors are respectively counted according to the operation objects, so that the abnormal operation times of a user on each operation object in the client are obtained.
S500, obtaining an abnormal operation evaluation value of the user by using the abnormal operation times.
Specifically, the embodiment of the disclosure may perform weighted calculation based on the number of abnormal operations of the user on each operation object of the client, to obtain the abnormal operation evaluation value of the user.
Optionally, according to the embodiment of the disclosure, according to the number of abnormal operations of the user on each operation object of the client, the weight configured by the operation object with the number of abnormal operations higher than a preset threshold value of the number of abnormal operations by a certain proportion is increased, and then the weight calculation is performed based on the number of abnormal operations of the user on each operation object of the client, so as to obtain the abnormal operation evaluation value of the user. According to the method and the device for evaluating the abnormal operation of the user, the weight of the operation object is increased, the abnormal operation of the user on the client can be evaluated integrally based on the frequency degree of the abnormal operation behavior of any operation object, and a more effective abnormal operation evaluation value is obtained, so that a more reasonable basis is provided for the subsequent intervention of the abnormal operation behavior of the user.
And S600, searching out the interrupt operation matched with the operation object in a preset flow library under the condition that the abnormal operation evaluation value is larger than a preset abnormal control threshold value.
The method comprises the steps of presetting an abnormal control threshold value as an index parameter for controlling abnormal operation behaviors of a user on each operation object on a client. According to the embodiment of the disclosure, the preset abnormal control threshold value can be configured according to actual requirements.
Specifically, the embodiment of the disclosure may compare the abnormal operation evaluation value with a preset abnormal control threshold, and when the abnormal operation evaluation value is greater than the preset abnormal control threshold, search for an operation path carrying the operation object identifier and the interrupt behavior identifier in a preset flow library by using the operation object identifier on the operation path matched with the operation fragment data identified as the abnormal operation behavior as a search condition, and confirm the interrupt operation indicated by the operation path.
S700, executing interrupt operation on the operation object and freezing the operation object.
The method and the device can execute interrupt operations matched with the operation objects for the operation objects with abnormal operation behaviors on the client side by the aid of the method and the device, freeze the operation objects, and enable the user to be incapable of executing any operation behaviors on the operation objects. For example: the small game module in the client is assumed to have frequent clicking actions, the small game module is confirmed to be abnormal operation actions through matching, the small game freezing operation path can be obtained through searching out the interrupt operation of the small game module, and the small game module can be automatically frozen by the RPA system through executing the small game freezing operation path, so that the small game module does not respond to any operation actions executed by the user, and the effect of timely intervening the abnormal operation actions of the user is achieved.
The abnormal operation processing method facing the client side can be used in the artificial intelligence field or the financial field. The method comprises the steps of obtaining operation flow data of a user on a client; performing data division on the operation flow data to obtain a plurality of operation fragment data; performing operation path matching on the operation fragment data in a preset flow library to obtain the total number of abnormal operation times of a user on a client; obtaining the abnormal operation times of the user on each operation object in the client under the condition that the total abnormal operation times are larger than a preset abnormal evaluation threshold; obtaining an abnormal operation evaluation value of the user by using the abnormal operation times; under the condition that the abnormal operation evaluation value is larger than a preset abnormal control threshold value, searching out an interrupt operation matched with the operation object in a preset flow library; and executing interrupt operation on the operation object, and freezing the operation object. According to the method and the device, the operation path matching is carried out on the operation fragment data of the user on the client through the preset flow library, the abnormal operation evaluation value of the user can be counted, the abnormal operation evaluation value of the user is used as the basis of the intervention time of the abnormal operation behavior, the abnormal operation behavior of the user on the operation object on the client can be interrupted in time, and effective abnormal operation management and control is achieved.
Optionally, based on the method shown in fig. 1, as shown in fig. 2, a flowchart of another implementation of the method for handling abnormal operation of a client according to an embodiment of the present disclosure may include:
s210, dividing the operation flow data into a plurality of first operation fragment data.
Specifically, in the embodiment of the present disclosure, the data of the operation flow may be divided according to a preset data dividing period, so as to divide a plurality of first operation fragment data with equal time spans.
S220, cutting out second operation fragment data between the two first operation fragment data according to the window size of a preset operation window based on the connection position of the two connected first operation fragment data.
In practical applications, the operation data corresponding to one operation behavior of the user on the client may be just divided into two continuous first operation fragment data, in order to avoid missing the operation behavior, in the embodiments of the present disclosure, the window size of the preset operation window may be configured, the connection position of the two connected first operation fragment data is taken as the window center line, and the second operation fragment data is cut, that is, the first half of the second operation fragment data is from one first operation fragment data, and the second half of the second operation fragment data is from another first operation fragment data connected with and after the first operation fragment data.
According to the embodiment of the disclosure, the second operation fragment data is cut off at the connecting position of the two connected first operation fragment data, so that the omission of the operation behaviors in the second operation fragment data can be avoided, the second operation fragment data can be used for participating in subsequent operation path matching, and therefore more accurate abnormal operation evaluation and abnormal operation behavior management and control can be performed.
Optionally, based on the method shown in fig. 2, as shown in fig. 3, a flowchart of another implementation of the method for handling abnormal operation of a client according to an embodiment of the present disclosure may include:
s310, performing operation path matching on the first operation fragment data in a preset flow library to obtain the number of the first abnormal operation fragments.
Specifically, the embodiment of the disclosure may match each first operation fragment data with each operation path in a preset flow library, and count the number of first abnormal operation fragments matched to the first operation fragments of the operation path carrying the abnormal behavior identifier.
S320, performing operation path matching on the second operation fragment data in a preset flow library to obtain the number of the second abnormal operation fragments.
Specifically, the embodiment of the disclosure may match each second operation fragment data with each operation path in a preset flow library, and count the number of second abnormal operation fragments matched to the second operation fragments of the operation path carrying the abnormal behavior identifier.
S330, obtaining the total number of abnormal operations of the user on the client by at least using the first abnormal operation fragment number and the second abnormal operation fragment number.
Optionally, the embodiment of the present disclosure may sum the first number of abnormal operation segments and the second number of abnormal operation segments, and confirm the result of the summation as the total number of abnormal operations of the user on the client.
According to the embodiment of the disclosure, through performing operation path matching on the first operation fragment data and the second operation fragment data, the corresponding number of the first abnormal operation fragments and the corresponding number of the second abnormal operation fragments can be accurately counted, so that more accurate total times of abnormal operation are obtained.
Optionally, in the embodiment of the present disclosure, in case that matching of an operation path of any one first operation fragment data fails, the first operation fragment data may be subjected to data division, so as to obtain a plurality of third operation fragment data. And performing operation path matching on the data of each third operation fragment in a preset flow library to obtain the number of the third abnormal operation fragments.
In practical applications, there may be an excessively large time span of the first operation segments, and it may be difficult to match the first operation segments as a whole to the corresponding operation paths in the preset flow library, so secondary data division needs to be performed on these first operation segments, and third operation segment data with a time span smaller than that of the first operation segments is obtained.
Specifically, the embodiment of the disclosure may configure a secondary data dividing period, and perform data division on the first operation fragment data according to the secondary data dividing period to obtain a plurality of third operation fragment data. Wherein, the time span of the secondary data dividing period is shorter than the time span of the preset data dividing period.
Specifically, the embodiment of the disclosure may match each third operation fragment data with each operation path in a preset flow library, and count the number of third abnormal operation fragments matched to the third operation fragments of the operation path carrying the abnormal behavior identifier.
According to the embodiment of the disclosure, through carrying out secondary data division on the first operation fragment data with failed operation path matching, the operation path matching can be carried out on the third operation fragments which are divided, the corresponding number of the third abnormal operation fragments can be accurately counted, and more accurate total abnormal operation times can be obtained.
Optionally, the embodiment of the present disclosure may count the number of the first abnormal operation segments, the number of the second abnormal operation segments, and the number of the third abnormal operation segments, so as to obtain the total number of abnormal operations of the user on the client.
The embodiment of the disclosure can sum the first abnormal operation fragment number, the second abnormal operation fragment number and the third abnormal operation fragment number, and confirm the summation result as the total abnormal operation times of the user on the client.
According to the embodiment of the disclosure, the number of the third abnormal operation fragments is used as one of the bases for counting the total number of abnormal operations, so that the more accurate total number of abnormal operations can be obtained, and the more accurate abnormal operation evaluation and abnormal operation behavior management and control can be facilitated.
Optionally, based on the method shown in fig. 1, as shown in fig. 4, a flowchart of another implementation of a method for handling abnormal operations of a client according to an embodiment of the present disclosure may further include, before step S100:
s10, obtaining the current operation path of each operation object in the client.
Specifically, the embodiment of the disclosure may configure a full-quantity network segment address with an abnormal operation behavior monitoring requirement in an RPA monitoring end, monitor an operation object of a client pointed by the network segment address, and record a current operation path of each operation object in the client.
S20, performing operation path matching on the current operation path in a preset flow library to obtain an operation path matching result.
Specifically, the embodiment of the disclosure may use an existing operation path in a preset flow library to perform operation path matching on a current operation path of each operation object in the client, so as to obtain an operation path matching result.
S30, adding a first behavior type identifier to the current operation path based on the operation path matching result.
Specifically, according to the embodiment of the disclosure, the same first behavior type identifier can be added to the current operation path according to the first behavior type identifier carried by the operation path matched by the current operation path in the preset flow library in the operation path matching result.
And S40, storing the current operation path added with the first behavior type identifier into a preset flow library.
According to the embodiment of the disclosure, the matching range of the operation path matching can be enlarged by automatically expanding the operation path in the preset flow library, so that the identification capability of abnormal behavior operation is enhanced, and accurate data is provided in the operation stage to perform abnormal operation assessment and abnormal operation management and control.
Optionally, the embodiment of the present disclosure may further obtain, after step S40, a behavior type modification instruction sent by the administrator to the current operation path. In response to the behavior type modification instruction, modifying the first behavior type identification of the current operation path to a second behavior type identification.
In order to prevent the first behavior type identifier from not matching with the actual operation behavior type corresponding to the current operation path, the embodiment of the disclosure provides an administrator modifying function, and the administrator modifies the current operation path added with the first behavior type identifier in the preset flow library so that the current operation path is added with the second behavior type identifier matching with the actual operation behavior type.
According to the method and the device for classifying the operation paths, the administrator manages the behavior type identifiers of the operation paths in the preset flow library, so that the classification accuracy of the operation paths in the preset flow library can be improved, the operation fragment data corresponding to the abnormal operation behaviors can be accurately identified later, and accurate data are provided in the operation stage to conduct abnormal operation assessment and abnormal operation behavior management and control.
Optionally, the embodiment of the present disclosure may verify the accuracy of the operation behavior classification of the preset flow library, and execute step S100 under the condition that the accuracy meets the preset operation accuracy threshold, so as to ensure that the abnormal operation evaluation and the abnormal operation behavior management and control are accurately controlled in the abnormal operation processing process.
Although operations are depicted in a particular order, this should not be understood as requiring that such operations be performed in the particular order shown or in sequential order. In certain circumstances, multitasking and parallel processing may be advantageous.
It should be understood that the various steps recited in the method embodiments of the present disclosure may be performed in a different order and/or performed in parallel. Furthermore, method embodiments may include additional steps and/or omit performing the illustrated steps. The scope of the present disclosure is not limited in this respect.
Corresponding to the method embodiment, the embodiment of the present disclosure further provides a device for processing abnormal operations towards a client, where the structure of the device is shown in fig. 5, and the device may include: an operation flow data obtaining unit 100, an operation fragment data obtaining unit 200, an abnormal operation total number obtaining unit 300, an abnormal operation number obtaining unit 400, an abnormal operation evaluation value obtaining unit 500, an interrupted operation retrieving unit 600, and an interrupted operation executing unit 700.
An operation flow data obtaining unit 100 for obtaining operation flow data of a user on a client.
An operation fragment data obtaining unit 200, configured to obtain a plurality of operation fragment data by performing data division on the operation stream data.
The abnormal operation total number obtaining unit 300 is configured to perform operation path matching on each operation fragment data in a preset flow library, so as to obtain the abnormal operation total number of the user on the client.
An abnormal operation number obtaining unit 400, configured to obtain the abnormal operation number of the user on each operation object in the client in a case where the total number of abnormal operations is greater than a preset abnormal evaluation threshold.
An abnormal operation evaluation value obtaining unit 500 for obtaining an abnormal operation evaluation value of the user using the number of abnormal operations.
And an interrupt operation retrieving unit 600, configured to retrieve an interrupt operation matching the operation object from the preset flow library, in a case where the abnormal operation evaluation value is greater than the preset abnormal control threshold.
An interrupt operation execution unit 700 for executing an interrupt operation on the operation object, freezing the operation object.
Optionally, the operation fragment data obtaining unit 200 includes: a first operation fragment data obtaining subunit and a second operation fragment data obtaining subunit.
A first operation fragment data obtaining subunit for dividing the operation stream data into a plurality of first operation fragment data.
And the second operation fragment data obtaining subunit is used for cutting out the second operation fragment data between the two first operation fragment data according to the window size of the preset operation window based on the connection position of the two connected first operation fragment data.
Alternatively, the abnormal operation total number obtaining unit 300 may include: a first abnormal operation segment number obtaining subunit, a second abnormal operation segment number obtaining subunit, and an abnormal operation total number obtaining subunit.
The first abnormal operation fragment number obtaining subunit is used for carrying out operation path matching on each first operation fragment data in a preset flow library to obtain the first abnormal operation fragment number.
The second abnormal operation fragment number obtaining subunit is used for carrying out operation path matching on the second operation fragment data in the preset flow library to obtain the second abnormal operation fragment number.
The abnormal operation total number obtaining subunit is configured to obtain the abnormal operation total number of the user on the client by using at least the first abnormal operation segment number and the second abnormal operation segment number.
Optionally, the device for processing abnormal operation facing to the client may further include: a third operation fragment data obtaining unit and a third abnormal operation fragment number obtaining unit.
The third operation fragment data obtaining unit is used for carrying out data division on the first operation fragment data under the condition that the operation path matching of any one of the first operation fragment data fails, so as to obtain a plurality of third operation fragment data.
The third abnormal operation fragment number obtaining unit is used for carrying out operation path matching on the third operation fragment data in the preset flow library to obtain the third abnormal operation fragment number.
Optionally, the abnormal operation total number obtaining subunit may be further specifically configured to count the number of the first abnormal operation segments, the number of the second abnormal operation segments, and the number of the third abnormal operation segments, to obtain the abnormal operation total number of the user on the client.
Optionally, the device for processing abnormal operation facing to the client may further include: the system comprises a current operation path obtaining unit, an operation path matching result obtaining unit, a behavior type identification adding unit and an operation path storage unit.
A current operation path obtaining unit for obtaining a current operation path of each operation object in the client before the operation flow data obtaining unit 100 obtains the operation flow data of the user on the client.
The operation path matching result obtaining unit is used for carrying out operation path matching on the current operation path in the preset flow library to obtain an operation path matching result.
And the behavior type identification adding unit is used for adding a first behavior type identification to the current operation path based on the operation path matching result.
And the operation path storage unit is used for storing the current operation path added with the first behavior type identifier into a preset flow library.
Optionally, the device for processing abnormal operation facing to the client may further include: a behavior type modification instruction obtaining unit and a behavior type identification modifying unit.
The behavior type modification instruction obtaining unit is used for obtaining the behavior type modification instruction sent by the administrator to the current operation path after the operation path storage unit stores the current operation path added with the first behavior type identifier into the preset flow library.
And the behavior type identification modification unit is used for responding to the behavior type modification instruction and modifying the first behavior type identification of the current operation path into the second behavior type identification.
The abnormal operation processing device facing the client side can be used in the artificial intelligence field or the financial field. The method comprises the steps of obtaining operation flow data of a user on a client; performing data division on the operation flow data to obtain a plurality of operation fragment data; performing operation path matching on the operation fragment data in a preset flow library to obtain the total number of abnormal operation times of a user on a client; obtaining the abnormal operation times of the user on each operation object in the client under the condition that the total abnormal operation times are larger than a preset abnormal evaluation threshold; obtaining an abnormal operation evaluation value of the user by using the abnormal operation times; under the condition that the abnormal operation evaluation value is larger than a preset abnormal control threshold value, searching out an interrupt operation matched with the operation object in a preset flow library; and executing interrupt operation on the operation object, and freezing the operation object. According to the method and the device, the operation path matching is carried out on the operation fragment data of the user on the client through the preset flow library, the abnormal operation evaluation value of the user can be counted, the abnormal operation evaluation value of the user is used as the basis of the intervention time of the abnormal operation behavior, the abnormal operation behavior of the user on the operation object on the client can be interrupted in time, and effective abnormal operation management and control is achieved.
The specific manner in which the individual units perform the operations in relation to the apparatus of the above embodiments has been described in detail in relation to the embodiments of the method and will not be described in detail here.
The client-oriented abnormal operation processing apparatus includes a processor and a memory, the above-described operation flow data obtaining unit 100, operation fragment data obtaining unit 200, abnormal operation total number obtaining unit 300, abnormal operation number obtaining unit 400, abnormal operation evaluation value obtaining unit 500, interrupt operation retrieving unit 600, interrupt operation executing unit 700, and the like are stored in the memory as program units, and the above-described program units stored in the memory are executed by the processor to realize the corresponding functions.
The processor includes a kernel, and the kernel fetches the corresponding program unit from the memory. The kernel can be provided with one or more than one, and operation path matching is carried out on each operation fragment data of the user on the client in a preset flow library by adjusting kernel parameters, so that the total number of abnormal operations of the user on the client, the number of abnormal operations on each operation object in the client and an abnormal operation evaluation value are sequentially obtained; based on the abnormal operation evaluation value, searching out an interrupt operation matched with the operation object in a preset flow library; and executing interrupt operation on the operation object, and freezing the operation object, so that the abnormal operation behavior of a user on the operation object on the client side is interrupted in time, and effective abnormal operation management and control is realized.
Embodiments of the present disclosure provide a computer-readable storage medium having stored thereon a program that, when executed by a processor, implements the client-oriented abnormal operation processing method.
The embodiment of the disclosure provides a processor for running a program, wherein the program runs to execute the abnormal operation processing method facing to the client.
As shown in fig. 6, an embodiment of the present disclosure provides an electronic device 1000, the electronic device 1000 comprising at least one processor 1001, and at least one memory 1002, bus 1003 connected to the processor 1001; wherein, the processor 1001 and the memory 1002 complete communication with each other through the bus 1003; the processor 1001 is configured to call program instructions in the memory 1002 to execute the above-described method for handling abnormal operation of the client. The electronic device herein may be a server, a PC, a PAD, a mobile phone, etc.
The present disclosure also provides a computer program product adapted to perform a program initialized with the steps of a method of handling client-oriented abnormal operations when executed on an electronic device.
It should be noted that, the method for processing abnormal operation of client-oriented provided by the present disclosure, the storage medium and the related devices may be used in the artificial intelligence field or the financial field. The foregoing is merely an example, and does not limit the application fields of the client-oriented abnormal operation processing method, the storage medium and the related devices provided in the present disclosure.
It should be noted that, the user information (including, but not limited to, user equipment information, user personal information, etc.) and the data (including, but not limited to, data for analysis, stored data, presented data, etc.) related to the present disclosure are information and data authorized by the user or sufficiently authorized by each party, and the collection, use, and processing of the related data need to comply with the related laws and regulations and standards of the related countries and regions.
The present disclosure is described with reference to flowchart illustrations and/or block diagrams of methods, apparatus, electronic devices (systems), and computer program products according to embodiments of the disclosure. It will be understood that each flow and/or block of the flowchart illustrations and/or block diagrams, and combinations of flows and/or blocks in the flowchart illustrations and/or block diagrams, can be implemented by computer program instructions. These computer program instructions may be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable apparatus, create means for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.
In one typical configuration, the electronic device includes one or more processors (CPUs), memory, and a bus. The electronic device may also include input/output interfaces, network interfaces, and the like.
The memory may include volatile memory, random Access Memory (RAM) and/or nonvolatile memory, such as Read Only Memory (ROM) or flash memory (flashRAM), among other forms in computer readable media, the memory including at least one memory chip. Memory is an example of a computer-readable medium.
Computer readable media, including both non-transitory and non-transitory, removable and non-removable media, may implement information storage by any method or technology. The information may be computer readable instructions, data structures, modules of a program, or other data. Examples of storage media for a computer include, but are not limited to, phase change memory (PRAM), static Random Access Memory (SRAM), dynamic Random Access Memory (DRAM), other types of Random Access Memory (RAM), read Only Memory (ROM), electrically Erasable Programmable Read Only Memory (EEPROM), flash memory or other memory technology, compact disc read only memory (CD-ROM), digital Versatile Discs (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices, or any other non-transmission medium, which can be used to store information that can be accessed by a computing device. Computer-readable media, as defined herein, does not include transitory computer-readable media (transmission media), such as modulated data signals and carrier waves.
In the description of the present disclosure, it should be understood that, if the directions or positional relationships indicated by the terms "upper", "lower", "front", "rear", "left" and "right", etc., are based on the directions or positional relationships shown in the drawings, are merely for convenience of describing the present invention and simplifying the description, and do not indicate or imply that the positions or elements referred to must have a specific orientation, be constructed and operated in a specific orientation, and thus should not be construed as limitations of the present disclosure.
It is noted that relational terms such as first and second, and the like are used solely to distinguish one entity or action from another entity or action without necessarily requiring or implying any actual such relationship or order between such entities or actions. It should also be noted that the terms "comprises," "comprising," or any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but may include other elements not expressly listed or inherent to such process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one … …" does not exclude the presence of other like elements in a process, method, article or apparatus that comprises an element.
It will be appreciated by those skilled in the art that embodiments of the present disclosure may be provided as a method, system, or computer program product. Accordingly, the present disclosure may take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment combining software and hardware aspects. Furthermore, the present disclosure may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) having computer-usable program code embodied therein.
The foregoing is merely exemplary of the present disclosure and is not intended to limit the present disclosure. Various modifications and variations of this disclosure will be apparent to those skilled in the art. Any modifications, equivalent substitutions, improvements, or the like, which are within the spirit and principles of the present disclosure, are intended to be included within the scope of the claims of the present disclosure.
Claims (10)
1. The abnormal operation processing method facing to the client is characterized by comprising the following steps:
obtaining operation flow data of a user on a client;
performing data division on the operation flow data to obtain a plurality of operation fragment data;
performing operation path matching on the operation fragment data in a preset flow library to obtain the total number of abnormal operation times of the user on the client;
Obtaining the abnormal operation times of the user on each operation object in the client under the condition that the total abnormal operation times are larger than a preset abnormal evaluation threshold;
obtaining an abnormal operation evaluation value of the user by using the abnormal operation times;
searching an interrupt operation matched with the operation object in the preset flow library under the condition that the abnormal operation evaluation value is larger than a preset abnormal control threshold value;
and executing the interrupt operation on the operation object, and freezing the operation object.
2. The method of claim 1, wherein the data dividing the operation flow data to obtain a plurality of operation fragment data comprises:
dividing the operation flow data into a plurality of first operation fragment data;
and cutting out second operation fragment data between the two first operation fragment data according to the window size of a preset operation window based on the connection position of the two connected first operation fragment data.
3. The method according to claim 2, wherein performing operation path matching on each operation fragment data in a preset flow library to obtain a total number of abnormal operations of the user on the client comprises:
Performing operation path matching on the first operation fragment data in a preset flow library to obtain the number of first abnormal operation fragments;
performing operation path matching on the second operation fragment data in the preset flow library to obtain the number of second abnormal operation fragments;
and obtaining the total number of abnormal operations of the user on the client by at least using the first abnormal operation fragment number and the second abnormal operation fragment number.
4. A method according to claim 3, further comprising:
under the condition that the matching of the operation path of any one of the first operation fragment data fails, carrying out data division on the first operation fragment data to obtain a plurality of third operation fragment data;
and performing operation path matching on the third operation fragment data in the preset flow library to obtain the number of third abnormal operation fragments.
5. The method of claim 4, wherein the obtaining the total number of abnormal operations of the user on the client using at least the first number of abnormal operation segments and the second number of abnormal operation segments comprises:
and counting the number of the first abnormal operation fragments, the number of the second abnormal operation fragments and the number of the third abnormal operation fragments to obtain the total number of abnormal operations of the user on the client.
6. The method of claim 1, wherein prior to said obtaining operational flow data of a user on a client, the method further comprises:
obtaining a current operation path of each operation object in the client;
performing operation path matching on the current operation path in the preset flow library to obtain an operation path matching result;
based on the operation path matching result, adding a first behavior type identifier to the current operation path;
and storing the current operation path added with the first behavior type identifier into the preset flow library.
7. The method of claim 6, wherein after the storing the current operation path with the first behavior type identifier added thereto in the preset flow library, the method further comprises:
obtaining a behavior type modification instruction sent by an administrator to the current operation path;
and in response to the behavior type modification instruction, modifying the first behavior type identifier of the current operation path into a second behavior type identifier.
8. A client-oriented abnormal operation processing apparatus, comprising: an operation flow data obtaining unit, an operation fragment data obtaining unit, an abnormal operation total number obtaining unit, an abnormal operation evaluation value obtaining unit, an interrupted operation retrieving unit, and an interrupted operation executing unit,
The operation flow data obtaining unit is used for obtaining operation flow data of a user on a client;
the operation fragment data obtaining unit is used for carrying out data division on the operation flow data to obtain a plurality of operation fragment data;
the abnormal operation total times obtaining unit is used for carrying out operation path matching on the operation fragment data in a preset flow library to obtain the abnormal operation total times of the user on the client;
the abnormal operation frequency obtaining unit is used for obtaining the abnormal operation frequency of the user on each operation object in the client side under the condition that the total abnormal operation frequency is larger than a preset abnormal evaluation threshold value;
the abnormal operation evaluation value obtaining unit is used for obtaining the abnormal operation evaluation value of the user by using the abnormal operation times;
the interrupt operation searching unit is used for searching interrupt operation matched with the operation object in the preset flow library under the condition that the abnormal operation evaluation value is larger than a preset abnormal control threshold value;
the interrupt operation execution unit is used for executing the interrupt operation on the operation object and freezing the operation object.
9. A computer-readable storage medium having a program stored thereon, wherein the program, when executed by a processor, implements the client-oriented abnormal operation processing method according to any one of claims 1 to 7.
10. An electronic device comprising at least one processor, and at least one memory, bus connected to the processor; the processor and the memory complete communication with each other through the bus; the processor is configured to call program instructions in the memory to perform the client-oriented exception handling method according to any one of claims 1 to 7.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202311185498.9A CN117215747A (en) | 2023-09-14 | 2023-09-14 | Client-oriented abnormal operation processing method, storage medium and related equipment |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202311185498.9A CN117215747A (en) | 2023-09-14 | 2023-09-14 | Client-oriented abnormal operation processing method, storage medium and related equipment |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN117215747A true CN117215747A (en) | 2023-12-12 |
Family
ID=89045687
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202311185498.9A Pending CN117215747A (en) | 2023-09-14 | 2023-09-14 | Client-oriented abnormal operation processing method, storage medium and related equipment |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN117215747A (en) |
-
2023
- 2023-09-14 CN CN202311185498.9A patent/CN117215747A/en active Pending
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN109918279B (en) | Electronic device, method for identifying abnormal operation of user based on log data and storage medium | |
| CN110232010A (en) | A kind of alarm method, alarm server and monitoring server | |
| CN108366012B (en) | Social relationship establishing method and device and electronic equipment | |
| CN109542737A (en) | Platform alert processing method, device, electronic device and storage medium | |
| CN108509634A (en) | Jitterbug monitoring method, monitoring device and computer readable storage medium | |
| CN110021150B (en) | Data processing method, device and equipment | |
| CN112181767A (en) | Method and device for determining software system exception and storage medium | |
| US8705800B2 (en) | Profiling activity through video surveillance | |
| CN112187914A (en) | Remote control robot management method and system | |
| CN109951326B (en) | Data processing method, device, storage medium and processor | |
| CN115905450A (en) | Unmanned aerial vehicle monitoring-based water quality abnormity tracing method and system | |
| CN110941632A (en) | Database auditing method, device and equipment | |
| CN113626241B (en) | Abnormality processing method, device, equipment and storage medium for application program | |
| CN112488138A (en) | User category identification method and device, electronic equipment and storage medium | |
| CN108111328B (en) | Exception handling method and device | |
| CN111949696A (en) | Full-factor correlation analysis method and device | |
| CN112241362A (en) | Test method, test device, server and storage medium | |
| CN117215747A (en) | Client-oriented abnormal operation processing method, storage medium and related equipment | |
| CN115687659A (en) | ERP information publishing method and AI system based on artificial intelligence | |
| JP7339321B2 (en) | Machine learning model update method, computer program and management device | |
| CN114650218B (en) | Data acquisition method, device, system and storage medium | |
| CN114281549A (en) | Data processing method and device | |
| CN108255715B (en) | Test result processing method and terminal equipment | |
| CN112631850A (en) | Fault scene simulation method and device | |
| CN113411405A (en) | Information security processing method for cloud computing environment and artificial intelligence server |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination |