CN117499201A

CN117499201A - Abnormal webpage alarm method and device, electronic equipment and medium

Info

Publication number: CN117499201A
Application number: CN202311297621.6A
Authority: CN
Inventors: 王勇; 郝运顺; 颜国栋; 蒋道新
Original assignee: Fusionskye Beijing Software Co ltd
Current assignee: Fusionskye Beijing Software Co ltd
Priority date: 2023-10-09
Filing date: 2023-10-09
Publication date: 2024-02-02

Abstract

The embodiment of the invention discloses an abnormal webpage alarm method, an abnormal webpage alarm device, electronic equipment and a medium. One embodiment of the method comprises the following steps: acquiring a webpage starting time length data sequence; checking the webpage starting duration data sequence; responding to the fact that the webpage verification result meets a first verification condition, and inputting a webpage starting time length data sequence into a first abnormal webpage starting time length data generation model; responding to the fact that the webpage verification result does not meet the first verification condition and meets the second verification condition, and inputting the webpage starting duration data sequence into a second abnormal webpage starting duration data generation model; responding to the fact that the webpage verification result does not meet the first verification condition and the second verification condition and meets the third verification condition, and inputting the webpage starting duration data sequence into a third abnormal webpage starting duration data generation model; and carrying out alarm processing on the associated web pages. This embodiment may alert a portion of the web page.

Description

Abnormal webpage alarm method and device, electronic equipment and medium

Technical Field

The embodiment of the disclosure relates to the technical field of computers, in particular to an abnormal webpage alarm method, an abnormal webpage alarm device, electronic equipment and a medium.

Background

An abnormal web page is identified (e.g., the open time is too long), and the abnormal web page may be alerted to increase the web page open time. At present, the abnormal webpage is alarmed by adopting the following general modes: when the webpage starting time length is larger than a preset webpage starting time length threshold value, alarming the webpage, or dividing the webpage starting time length data sequence into webpage starting time length data sections with different time periods, determining the webpage starting time length threshold value corresponding to each webpage starting time length data section through a single algorithm, and carrying out alarming processing on the webpage according to the determined webpage starting time length threshold value.

However, the following technical problems generally exist in the above manner:

firstly, the accuracy of a preset webpage starting time length threshold is low, and the accuracy of an abnormal webpage identified according to the preset webpage starting time length threshold is low, so that the alarm of partial abnormal webpages is difficult to carry out;

secondly, when each piece of webpage starting duration data in the webpage starting duration data sequence represents discrete data, the acquired time points of the webpage starting duration data have randomness, so that the determined webpage starting duration threshold is low in accuracy, abnormal webpages are difficult to accurately identify, and part of webpages are difficult to alarm;

Thirdly, as the number of the webpage starting time length data intervals is large, a large amount of calculation resources are required to be consumed to determine the webpage starting time length threshold value corresponding to each webpage starting time length data interval, so that the calculation resources are wasted;

fourth, since the web page start duration data sequence may have different periodicity (e.g., the day period, zhou Zhouqi) at the same time, a single algorithm can only consider one periodicity, resulting in lower accuracy of the determined web page start duration threshold, lower accuracy of the identified abnormal web page, and difficulty in alerting a part of the web page.

The above information disclosed in this background section is only for enhancement of understanding of the background of the inventive concept and, therefore, may contain information that does not form the prior art that is already known to those of ordinary skill in the art in this country.

Disclosure of Invention

The disclosure is in part intended to introduce concepts in a simplified form that are further described below in the detailed description. The disclosure is not intended to identify key features or essential features of the claimed subject matter, nor is it intended to be used to limit the scope of the claimed subject matter.

Some embodiments of the present disclosure propose an abnormal web page alert method, apparatus, electronic device, and computer readable medium to solve one or more of the technical problems mentioned in the background section above.

In a first aspect, some embodiments of the present disclosure provide an abnormal web page alerting method, the method including: acquiring a webpage starting time length data sequence; checking the webpage starting duration data sequence to generate a webpage checking result; responding to the fact that the webpage verification result meets a first verification condition, inputting the webpage starting duration data sequence into a pre-trained first abnormal webpage starting duration data generation model, and obtaining an abnormal webpage starting duration data set; responding to the fact that the webpage verification result does not meet the first verification condition and meets the second verification condition, inputting the webpage starting duration data sequence into a pre-trained second abnormal webpage starting duration data generation model, and obtaining an abnormal webpage starting duration data set; in response to determining that the webpage verification result does not meet the first verification condition and the second verification condition and meets a third verification condition, inputting the webpage starting duration data sequence into a pre-trained third abnormal webpage starting duration data generation model to obtain an abnormal webpage starting duration data set; and carrying out alarm processing on the associated webpage based on the abnormal webpage starting duration data set.

In a second aspect, some embodiments of the present disclosure provide an abnormal web page warning apparatus, the apparatus including: the acquisition unit is configured to acquire a webpage starting duration data sequence; the verification unit is configured to perform verification processing on the webpage starting duration data sequence so as to generate a webpage verification result; the first input unit is configured to input the webpage starting duration data sequence to a pre-trained first abnormal webpage starting duration data generation model to obtain an abnormal webpage starting duration data set in response to determining that the webpage verification result meets a first verification condition; the second input unit is configured to input the webpage starting duration data sequence to a pre-trained second abnormal webpage starting duration data generation model to obtain an abnormal webpage starting duration data set in response to determining that the webpage verification result does not meet the first verification condition and meets a second verification condition; the third input unit is configured to input the webpage starting duration data sequence to a pre-trained third abnormal webpage starting duration data generation model to obtain an abnormal webpage starting duration data set in response to determining that the webpage verification result does not meet the first verification condition and the second verification condition and meets a third verification condition; and the alarm unit is configured to perform alarm processing on the associated webpage based on the abnormal webpage starting duration data set.

In a third aspect, some embodiments of the present disclosure provide an electronic device comprising: one or more processors; a storage device having one or more programs stored thereon, which when executed by one or more processors causes the one or more processors to implement the method described in any of the implementations of the first aspect above.

In a fourth aspect, some embodiments of the present disclosure provide a computer readable medium having a computer program stored thereon, wherein the program, when executed by a processor, implements the method described in any of the implementations of the first aspect above.

The above embodiments of the present disclosure have the following advantageous effects: by the abnormal webpage alarming method of some embodiments of the present disclosure, part of abnormal webpages can be alarmed. Specifically, the reason why it is difficult to alert a part of the abnormal web page is that: the accuracy of the preset webpage starting time length threshold is low, and the accuracy of the abnormal webpage identified according to the preset webpage starting time length threshold is low. Based on this, in the abnormal web page warning method of some embodiments of the present disclosure, first, a web page start duration data sequence is obtained. And secondly, checking the webpage starting duration data sequence to generate a webpage checking result. Therefore, the webpage verification result can be obtained, and the webpage verification result can be input into the first abnormal webpage starting time length data generation model, the second abnormal webpage starting time length data generation model or the third abnormal webpage starting time length data generation model. And then, in response to determining that the webpage verification result meets a first verification condition, inputting the webpage starting duration data sequence into a pre-trained first abnormal webpage starting duration data generation model to obtain an abnormal webpage starting duration data set. Therefore, a relatively accurate abnormal webpage starting duration data set can be obtained through the first abnormal webpage starting duration data generation model. And then, in response to determining that the webpage verification result does not meet the first verification condition and meets the second verification condition, inputting the webpage starting duration data sequence into a pre-trained second abnormal webpage starting duration data generation model to obtain an abnormal webpage starting duration data set. Therefore, a relatively accurate abnormal webpage starting duration data set can be obtained through the second abnormal webpage starting duration data generation model. And then, in response to determining that the webpage verification result does not meet the first verification condition and the second verification condition and meets a third verification condition, inputting the webpage starting duration data sequence into a pre-trained third abnormal webpage starting duration data generation model to obtain an abnormal webpage starting duration data set. Therefore, a relatively accurate abnormal webpage starting duration data set can be obtained through the third abnormal webpage starting duration data generation model. And finally, carrying out alarm processing on the associated webpage based on the abnormal webpage starting duration data set. Therefore, the webpage can be accurately alarmed according to the accurate abnormal webpage starting time length data set. Therefore, the alarm can be given to partial abnormal webpages.

Drawings

The above and other features, advantages, and aspects of embodiments of the present disclosure will become more apparent by reference to the following detailed description when taken in conjunction with the accompanying drawings. The same or similar reference numbers will be used throughout the drawings to refer to the same or like elements. It should be understood that the figures are schematic and that elements and components are not necessarily drawn to scale.

FIG. 1 is a flow chart of some embodiments of an abnormal web page alerting method according to the present disclosure;

FIG. 2 is a schematic diagram of the structure of some embodiments of an anomaly web page alert device according to the present disclosure;

fig. 3 is a schematic structural diagram of an electronic device suitable for use in implementing some embodiments of the present disclosure.

Detailed Description

Embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. While certain embodiments of the present disclosure are shown in the drawings, it should be understood that the present disclosure may be embodied in various forms and should not be construed as limited to the embodiments set forth herein. Rather, these embodiments are provided so that this disclosure will be thorough and complete. It should be understood that the drawings and embodiments of the present disclosure are for illustration purposes only and are not intended to limit the scope of the present disclosure.

It should be noted that, for convenience of description, only the portions related to the present invention are shown in the drawings. Embodiments of the present disclosure and features of embodiments may be combined with each other without conflict.

It should be noted that the terms "first," "second," and the like in this disclosure are merely used to distinguish between different devices, modules, or units and are not used to define an order or interdependence of functions performed by the devices, modules, or units.

It should be noted that references to "one", "a plurality" and "a plurality" in this disclosure are intended to be illustrative rather than limiting, and those of ordinary skill in the art will appreciate that "one or more" is intended to be understood as "one or more" unless the context clearly indicates otherwise.

The names of messages or information interacted between the various devices in the embodiments of the present disclosure are for illustrative purposes only and are not intended to limit the scope of such messages or information.

The present disclosure will be described in detail below with reference to the accompanying drawings in conjunction with embodiments.

Referring to FIG. 1, a flow 100 of some embodiments of an anomaly web page alert method according to the present disclosure is shown. The abnormal webpage alarm method comprises the following steps:

Step 101, acquiring a webpage starting duration data sequence.

In some embodiments, the execution body (e.g., a computing device) of the abnormal web page alert method may acquire the web page start duration data sequence from the terminal device through a wired connection or a wireless connection. The web page start duration data in the web page start duration data sequence may include, but is not limited to, at least one of the following: webpage identification and webpage starting time. The web page identification may uniquely identify a web page. The web page start time may be a time period required from when the web page is clicked to when the loading of the web page is completed. For example, the web page may include an html format, an xhtml format, an asp format, a php format, a jsp format, a shtml format, a nsp format, an xml format, or other web pages in a format to be developed in the future (as long as a web page file in such a format can be opened by a browser and browsed to include pictures, animations, text, and the like).

In practice, the execution body may acquire the web page start duration data sequence through the following steps:

firstly, acquiring initial webpage starting duration data of each time granularity in a preset time period, and obtaining an initial webpage starting duration data sequence. Wherein, the initial web page starting duration data in the initial web page starting duration data sequence may include, but is not limited to, at least one of the following: webpage identification, initial webpage starting duration. The initial web page start-up duration may be the duration required from the start of clicking on the web page to the completion of the web page loading. For example, the predetermined period of time may be 2022.1.1-2023.1.1. The predetermined period of time may also be 2022.6.1-2023.1.1. The predetermined period of time may also be 2022.6.1-2022.7.1. The above-described temporal granularity may be, but is not limited to: one month, one day, one minute.

And secondly, performing data cleaning processing on the initial webpage starting time length data sequence to generate a webpage starting time length cleaning data sequence. In practice, first, for each initial web page start duration data in the initial web page start duration data sequence, the execution body may execute the following data cleaning steps: first, in response to determining that the initial web page starting duration data meets a preset first deletion condition, the initial web page starting duration is removed from the initial web page starting duration data sequence, so that the initial web page starting duration data sequence is updated. Second, in response to determining that the initial web page starting duration data meets a preset second missing condition, updating the initial web page starting duration included in the initial web page starting duration data through a preset cleaning algorithm so as to update the initial web page starting duration data sequence. Then, the execution body may determine the updated initial web page start time length data sequence as a web page start time length cleaning data sequence. The preset first deletion condition may be that the initial web page starting duration data is null. The preset second deletion condition may be: the initial webpage starting time length data comprises the initial webpage starting time length which is empty, and the webpage identifier which is included in the initial webpage starting time length data exists. For example, the preset cleaning algorithm may be, but is not limited to: linear interpolation algorithm, periodic compensation algorithm.

And thirdly, carrying out standardization processing on the webpage starting time length cleaning data sequence to generate a webpage starting time length data sequence. In practice, first, for each web page start time duration cleaning data in the web page start time duration cleaning data sequence, the execution body may execute the following steps: first, converting an initial webpage starting time length representing a first format included in the webpage starting time length cleaning data into a webpage starting time length representing a second format. Secondly, determining the webpage identification corresponding to the webpage starting time length and the webpage starting time length cleaning data as webpage starting time length data. The execution body may then determine the determined respective web page start time length data as a web page start time length data sequence. Here, the second format may be ms (millisecond). The first format may be, but is not limited to: s (seconds), ms (milliseconds), ns (nanoseconds).

Step 102, performing verification processing on the webpage starting duration data sequence to generate a webpage verification result.

In some embodiments, the execution body may perform a verification process on the web page start duration data sequence to generate a web page verification result.

In practice, the execution body may perform verification processing on the webpage starting duration data sequence through the following steps to generate a webpage verification result:

in the first step, in response to determining that the number of the webpage starting duration data in the webpage starting duration data sequence is greater than the number of the preset webpage starting duration data, continuous verification processing is performed on the webpage starting duration data sequence to generate a continuous verification result. In practice, in response to determining that the number of the webpage starting duration data in the webpage starting duration data sequence is greater than the number of the preset webpage starting duration data, the execution body may perform continuous verification processing on the webpage starting duration data sequence through a preset continuous verification algorithm, so as to generate a continuous verification result. Wherein, the continuous check result can be characterized as follows: the web page start duration data sequence is continuous data or the web page start duration data sequence is discrete data. For example, the number of preset web page start duration data may be 200. The preset continuous checking algorithm may be a Boosting (lifting method) algorithm.

And secondly, responding to the fact that the continuous check result meets the preset continuous check condition, and performing periodic check processing on the webpage starting duration data sequence to generate a periodic check result. In practice, in response to determining that the continuous verification result meets a preset continuous verification condition, the execution body may perform a periodic verification process on the web page start duration data sequence through a preset periodic verification algorithm to generate a periodic verification result. Wherein, the preset continuous check condition may be: the continuous check result represents that the webpage starting duration data sequence is continuous data. The above-mentioned periodic verification result can be characterized as: the web page start duration data sequence has periodicity or the web page start duration data sequence has no periodicity. For example, the preset periodic verification algorithm may be, but is not limited to: ACF (Autocorrelation Function autocorrelation function) algorithm, PACF (Partial Autocorrelation Function), partial autocorrelation function) algorithm.

And thirdly, determining preset discrete information as a webpage verification result in response to determining that the continuous verification result does not meet the preset continuous verification condition. Wherein, the preset discrete information can be characterized by: the web page start duration data sequence is discrete data.

And fourthly, determining the preset continuous period information as a webpage verification result in response to determining that the period verification result meets the preset period verification condition. The preset period verification condition may be: the period check result represents that the webpage starting duration data sequence has periodicity. The preset continuous period information may be characterized as follows: the web page start duration data sequence is continuous periodic data.

And fifthly, determining the preset continuous non-periodic information as a webpage verification result in response to determining that the periodic verification result does not meet the preset periodic verification condition. Wherein, the preset continuous non-periodic information can be characterized by: the web page start duration data sequence is continuous non-periodic data.

And step 103, in response to determining that the webpage verification result meets a first verification condition, inputting the webpage starting duration data sequence into a pre-trained first abnormal webpage starting duration data generation model to obtain an abnormal webpage starting duration data set.

In some embodiments, the executing body may input the sequence of the web page start duration data to a pre-trained first abnormal web page start duration data generation model to obtain an abnormal web page start duration data set in response to determining that the web page verification result meets a first verification condition. Wherein, the first verification condition may be: the webpage verification result is preset discrete information. The abnormal web page start duration data in the abnormal web page start duration data set may represent a web page start duration of an abnormal web page (for example, the abnormal web page may be a web page with an excessively long open time). The first abnormal web page starting duration data generation model may be a neural network model which is trained in advance, takes a web page starting duration data sequence as input, and takes an abnormal web page starting duration data set as output.

Alternatively, the pre-trained first abnormal web page start duration data generation model may be trained by:

first, a first training sample set is obtained.

In some embodiments, the executing entity may obtain the first training sample set from the terminal device through a wired connection or a wireless connection. Wherein, the first training samples in the first training sample set include: a sample web page start duration data sequence and a sample abnormal web page start duration data set.

And secondly, determining a first initial abnormal webpage starting time length data generation model.

In some embodiments, the executing entity may determine a first initial abnormal web page start duration data generation model. The first initial abnormal web page starting duration data generating model may include, but is not limited to, at least one of the following: the system comprises a first initial split model, a first initial threshold generation model and a first initial comparison model.

Here, the first initial splitting model may be a model that takes a sample web page start duration data sequence as input and takes a first initial splitting web page start duration data sequence set as output. For example, the first initial splitting model may determine each sample web page starting duration data corresponding to the first target time granularity in the sample web page starting duration data sequence as a first initial splitting web page starting duration data sequence, to obtain a first initial splitting web page starting duration data sequence set. Here, the first target time granularity may be, but is not limited to: one quarter, one month, one day.

The first initial threshold generation model may be a model that takes a first initial split web page start duration data sequence as input and takes a first initial threshold as output. The first initial threshold may represent a maximum web page starting duration corresponding to a normal web page (e.g., the normal web page may represent that the web page opening time meets the user requirement). For example, the first initial threshold generation model may be a Bagging (Bootstrap aggregating, guided-aggregation algorithm) algorithm.

The first initial comparison model may be a model that takes a first initial threshold and first initial splitting webpage starting duration data as input and takes a first comparison result as output. The first comparison result can represent that the first initial split webpage starting time length data is normal or abnormal. For example, the first initial contrast model may be: firstly, in response to determining that the first initial split webpage starting duration data is greater than or equal to the first initial threshold, determining information representing abnormality of the webpage starting duration data as a first comparison result. And then, in response to determining that the first initial split webpage starting time length data is smaller than the first initial threshold value, determining the information which characterizes that the webpage starting time length data is normal to a first comparison result.

And thirdly, selecting a first training sample from the first training sample set.

In some embodiments, the executing entity may select a first training sample from the first training sample set. In practice, the executing entity may randomly select a first training sample from the first training sample set.

And step four, inputting a sample webpage starting time length data sequence included in the first training sample into the first initial splitting model to obtain a first initial splitting webpage starting time length data sequence set.

In some embodiments, the execution body may input a sample web page start duration data sequence included in the first training sample into the first initial split model to obtain a first initial split web page start duration data sequence set.

Fifth, for each first initial split web page start duration data sequence in the first initial split web page start duration data sequence set, the following input substeps are executed:

and a first sub-step of inputting the first initial splitting webpage starting time length data sequence into the first initial threshold generating model to obtain a first initial threshold.

In some embodiments, the executing body may input the first initial splitting webpage starting duration data sequence into the first initial threshold generating model to obtain a first initial threshold.

And a second sub-step of inputting the first initial threshold and the last first initial split webpage starting duration data in the first initial split webpage starting duration data sequence into the first initial comparison model to obtain a first comparison result.

In some embodiments, the execution body may input the first initial threshold and the last first initial split web page start duration data in the first initial split web page start duration data sequence into the first initial comparison model, to obtain a first comparison result.

And a third sub-step of adding last first initial split webpage starting duration data in the first initial split webpage starting duration data sequence to a first initial abnormal webpage starting duration data set in response to determining that the first comparison result meets a first preset comparison condition.

In some embodiments, the executing body may add last first initial split web page start duration data in the first initial split web page start duration data sequence to the first initial abnormal web page start duration data set in response to determining that the first comparison result satisfies a first preset comparison condition. Wherein the first initial abnormal webpage starting duration data set is initially empty. The first preset comparison condition may be that the first comparison result represents that the web page starting duration data is abnormal.

And a sixth step of determining a first difference value between the first initial abnormal webpage starting time length data set and the sample abnormal webpage starting time length data set included in the first training sample based on a preset first loss function.

In some embodiments, the execution body may determine a first difference value between the first initial abnormal web page start duration data set and a sample abnormal web page start duration data set included in the first training sample based on a preset first loss function. The preset first loss function may be, but is not limited to: mean square error loss function (MSE), cross entropy loss function (cross entropy), 0-1 loss function, absolute loss function, log loss function, square loss function, exponential loss function, and the like.

And seventhly, responding to the fact that the first difference value is smaller than or equal to a first preset difference value, and adjusting network parameters of the first initial abnormal webpage starting duration data generation model.

In some embodiments, in response to determining that the first difference value is less than or equal to a first preset difference value, the execution body may adjust a network parameter of the first initial abnormal web page start duration data generation model. For example, the first difference value and the first preset difference value may be differentiated. On this basis, the error value is transmitted forward from the last layer of the model by using back propagation, random gradient descent and the like to adjust the parameters of each layer. Of course, a network freezing (dropout) method may be used as needed, and network parameters of some layers therein may be kept unchanged and not adjusted, which is not limited in any way. The setting of the first preset difference value is not limited, and for example, the first preset difference value may be 0.1.

The optional technical content in step 103 and the technical content in step 106 are taken as an invention point of the embodiment of the disclosure, and the second technical problem mentioned in the background art is solved, which results in that the warning of partial web pages is difficult. The factors that cause difficulty in alerting a portion of a web page are often as follows: when each piece of webpage starting duration data in the webpage starting duration data sequence represents discrete data, the acquired time points of the webpage starting duration data have randomness, so that the determined webpage starting duration threshold is low in accuracy, and abnormal webpages are difficult to accurately identify. If the above factors are solved, the effect of warning part of the web pages can be achieved. To achieve this, first, a first training sample set is acquired. And secondly, determining a first initial abnormal webpage starting duration data generation model. The first initial abnormal webpage starting duration data generation model comprises the following steps: the system comprises a first initial split model, a first initial threshold generation model and a first initial comparison model. Therefore, the first initial abnormal webpage starting time length data generation model can be determined, and the first initial abnormal webpage starting time length data generation model can be trained later. Then, a first training sample is selected from the first training sample set. And then, inputting a sample webpage starting time length data sequence included in the first training sample into the first initial splitting model to obtain a first initial splitting webpage starting time length data sequence set. Therefore, the first initial split webpage starting time length data sequence set can be obtained, so that the abnormal webpage starting time length data can be identified by taking the first initial split webpage starting time length data sequence as a whole. Then, for each first initial split web page start duration data sequence in the sample web page start duration data sequence set included in the first training sample, the following input steps are executed: firstly, inputting the first initial splitting webpage starting time length data sequence into the first initial threshold generating model to obtain a first initial threshold. Secondly, inputting the first initial threshold value and last first initial split webpage starting time length data in the first initial split webpage starting time length data sequence into the first initial comparison model to obtain a first comparison result. Thirdly, in response to determining that the first comparison result meets a first preset comparison condition, adding last first initial split webpage starting duration data in the first initial split webpage starting duration data sequence to a first initial abnormal webpage starting duration data set. Therefore, the abnormal webpage starting time length data in the first initial split webpage starting time length data sequence set can be accurately determined through the first initial threshold generating model and the first initial comparison model. And then, based on a preset first loss function, determining a first difference value between the first initial abnormal webpage starting time length data set and a sample abnormal webpage starting time length data set included in the first training sample. Therefore, a first difference value can be obtained through the first loss function so as to subsequently adjust the first initial abnormal webpage starting duration data generation model. And finally, in response to determining that the first difference value is smaller than or equal to a first preset difference value, adjusting network parameters of the first initial abnormal webpage starting duration data generation model. Therefore, the first initial abnormal webpage starting time length data generation model can be continuously adjusted according to the first difference value, so that the more accurate first abnormal webpage starting time length data generation model can be obtained later. Therefore, a relatively accurate abnormal webpage starting duration data set can be obtained according to the relatively accurate first abnormal webpage starting duration data generation model. Therefore, the abnormal webpage can be accurately alarm-processed by the accurate abnormal webpage starting duration data set. Thus, an alarm can be given to a part of the web page.

Optionally, in response to determining that the first difference value is greater than the first preset difference value, determining the first initial abnormal web page start duration data generation model as a trained first abnormal web page start duration data generation model.

In some embodiments, the executing body may determine the first initial abnormal web page start duration data generation model as the trained first abnormal web page start duration data generation model in response to determining that the first difference value is greater than the first preset difference value.

And 104, in response to determining that the webpage verification result does not meet the first verification condition and meets the second verification condition, inputting the webpage starting duration data sequence into a pre-trained second abnormal webpage starting duration data generation model to obtain an abnormal webpage starting duration data set.

In some embodiments, the execution body may input the web page start duration data sequence to a pre-trained second abnormal web page start duration data generation model to obtain an abnormal web page start duration data set in response to determining that the web page verification result does not satisfy the first verification condition and satisfies a second verification condition. Wherein the second check-up condition may be: the webpage verification result is preset continuous and periodic-free information. The second abnormal web page starting duration data generating model may be a neural network model which is trained in advance, takes a web page starting duration data sequence as input, and takes an abnormal web page starting duration data set as output.

Alternatively, the pre-trained second abnormal web page start duration data generation model may be trained by:

first, a second training sample set is obtained.

In some embodiments, the executing entity may obtain the second training sample set from the terminal device through a wired connection or a wireless connection. Wherein the second training samples in the second training sample set include: a sample web page start duration data sequence and a sample abnormal web page start duration data set.

And secondly, determining a second initial abnormal webpage starting time length data generation model.

In some embodiments, the executing entity may determine a second initial abnormal web page start duration data generation model. Wherein, the second initial abnormal webpage starting duration data generating model may include, but is not limited to, at least one of the following: the system comprises a second initial split model, a second initial threshold generation model and a second initial comparison model.

Here, the second initial splitting model may be a model that takes a sample web page start duration data sequence as input and takes a second initial splitting web page start duration data sequence set as output. For example, the second initial splitting model may determine each sample web page starting duration data corresponding to the second target time granularity in the sample web page starting duration data sequence as a second initial splitting web page starting duration data sequence, to obtain a second initial splitting web page starting duration data sequence set. Here, the second target temporal granularity may be, but is not limited to: one quarter, one month, one day.

The second initial threshold generation model may be a second custom model that takes the second web page start duration removal data sequence as input and takes the first web page start duration threshold interval as output. The first threshold interval may represent a web page start duration interval corresponding to a normal web page. The second custom model can be divided into three layers:

the first layer may be an input layer for passing the second web page launch duration removal data sequence to the second layer.

The second layer may include: a first sub-model and a second sub-model. The first sub-model may be a time series prediction model that takes as input the second web page start time length removal data sequence and as output the first initial web page start time length threshold interval. The second sub-model may be a time series prediction model that takes as input a second web page start time length removal data sequence and takes as output a second initial web page start time length threshold interval. The first initial webpage starting duration threshold interval may be a webpage starting duration interval corresponding to the characterization normal webpage obtained through the first sub-model. The second initial webpage starting duration threshold interval may be a webpage starting duration interval corresponding to the characterization normal webpage obtained through the second sub-model. For example, the first sub-model may be a Box-Janues (Box-Jenkins) model. For example, the second sub-model may be an exponential smoothing model.

The third layer may be an output layer for receiving the outputs of the first sub-model and the second sub-model, respectively, and taking an average of the outputs of the first sub-model and the second sub-model as the output of the entire second custom model. For example, first, an average value of the minimum value of the first initial web page start time period threshold output by the first sub-model and the minimum value of the second initial web page start time period threshold output by the second sub-model is determined as a target minimum value. And then, determining the average value of the maximum value of the first initial webpage starting time length threshold interval output by the first sub-model and the maximum value of the second initial webpage starting time length threshold interval output by the second sub-model as a target maximum value. And finally, determining the interval from the target minimum value to the target maximum value as a first threshold interval to be used as the output of the whole second custom model.

The second initial comparison model may be a model that takes the first threshold interval and the second initial split web page starting duration data as input and takes the second comparison result as output. The second comparison result may represent that the second initial split webpage starting duration data is normal or abnormal. For example, the second initial contrast model may be: firstly, in response to determining that the second initial split webpage starting time length data is within a first threshold value interval, determining information representing that the webpage starting time length data is normal as a second comparison result. And then, in response to determining that the second initial split webpage starting time length data is not in the first threshold interval, determining information representing abnormality of the webpage starting time length data as a second comparison result.

And thirdly, selecting a second training sample from the second training sample set.

In some embodiments, the executing entity may select a second training sample from the second training sample set. In practice, the executing entity may randomly select a second training sample from the second training sample set.

And step four, inputting a sample webpage starting time length data sequence included in the second training sample into the second initial splitting model to obtain a second initial splitting webpage starting time length data sequence set.

In some embodiments, the execution body may input a sample web page start duration data sequence included in the second training sample into the second initial split model to obtain a second initial split web page start duration data sequence set.

Fifth, for each second initial split web page start duration data sequence in the second initial split web page start duration data sequence set, the following determining sub-steps are executed:

and a first sub-step of determining the last second initial split webpage starting time length data in the second initial split webpage starting time length data sequence as second target split webpage starting time length data.

In some embodiments, the executing body may determine the last second initial split webpage start duration data in the second initial split webpage start duration data sequence as the second target split webpage start duration data.

And a second sub-step of determining a second initial split webpage starting time length data sequence from which the second target split webpage starting time length data is removed as a second webpage starting time length removal data sequence.

In some embodiments, the execution body may determine a second initial split web page start duration data sequence from which the second target split web page start duration data is removed as the second web page start duration removal data sequence.

And a third sub-step of inputting the second webpage starting time length removing data sequence into the second initial threshold generating model to obtain a first webpage starting time length threshold interval.

In some embodiments, the execution body may input the second web page start duration removal data sequence into the second initial threshold generation model to obtain a first web page start duration threshold interval.

And a fourth sub-step of inputting last second initial split webpage starting time length data in the first webpage starting time length threshold interval and the second initial split webpage starting time length data sequence into the second initial comparison model to obtain a second comparison result.

In some embodiments, the execution body may input the last second initial split webpage starting duration data in the first webpage starting duration threshold interval and the second initial split webpage starting duration data sequence into the second initial comparison model, so as to obtain a second comparison result.

And a fifth sub-step of adding last second initial split webpage starting duration data in the second initial split webpage starting duration data sequence to a second initial abnormal webpage starting duration data set in response to determining that the second comparison result meets a second preset comparison condition.

In some embodiments, the executing body may add last second initial split web page start duration data in the second initial split web page start duration data sequence to a second initial abnormal web page start duration data set in response to determining that the second comparison result satisfies a second preset comparison condition. Wherein the second initial abnormal webpage starting duration data set is initially empty. Here, the second preset comparison condition may be that the second comparison result represents that the web page starting duration data is abnormal.

And a sixth step of determining a second difference value between the second initial abnormal webpage starting time length data set and the sample abnormal webpage starting time length data set included in the second training sample based on a second preset loss function.

In some embodiments, the executing body may determine a second difference value between the second initial abnormal web page start time duration data set and a sample abnormal web page start time duration data set included in the second training sample based on a second predetermined loss function. The preset second loss function may be, but is not limited to: mean square error loss function (MSE), cross entropy loss function (cross entropy), 0-1 loss function, absolute loss function, log loss function, square loss function, exponential loss function, and the like.

And seventhly, responding to the fact that the second difference value is smaller than or equal to a second preset difference value, and adjusting network parameters of the second initial abnormal webpage starting duration data generation model.

In some embodiments, the executing entity may adjust the network parameters of the second initial abnormal web page start duration data generation model in response to determining that the second difference value is less than or equal to a second preset difference value. For example, the second difference value and the second preset difference value may be differentiated. On this basis, the error value is transmitted forward from the last layer of the model by using back propagation, random gradient descent and the like to adjust the parameters of each layer. Of course, a network freezing (dropout) method may be used as needed, and network parameters of some layers therein may be kept unchanged and not adjusted, which is not limited in any way. The setting of the second preset difference value is not limited, and for example, the second preset difference value may be 0.1.

The optional technical content in step 104 is taken as an invention point of the embodiment of the present disclosure, and solves the third "technical problem mentioned in the background art, which causes waste of computing resources". Factors that lead to wasted computing resources are often as follows: because the number of the webpage starting time length data intervals is large, a large amount of calculation resources are required to be consumed to determine the webpage starting time length threshold value corresponding to each webpage starting time length data interval. If the above factors are solved, the effect of reducing the waste of the computing resources can be achieved. To achieve this, first, a second training sample set is acquired. Wherein the second training samples in the second training sample set include: a sample web page start duration data sequence and a sample abnormal web page start duration data set. And secondly, determining a second initial abnormal webpage starting duration data generation model. The second initial abnormal webpage starting duration data generation model comprises the following steps: the system comprises a second initial split model, a second initial threshold generation model and a second initial comparison model. Therefore, the second initial abnormal webpage starting time length data generation model can be determined, and the second initial abnormal webpage starting time length data generation model can be trained later. Then, a second training sample is selected from the second training sample set. And then, inputting a sample webpage starting time length data sequence included in the second training sample into the second initial splitting model to obtain a second initial splitting webpage starting time length data sequence set. Therefore, the second initial split webpage starting time length data sequence set can be obtained, so that the abnormal webpage starting time length data can be identified by taking the second initial split webpage starting time length data sequence as a whole. Then, for each second initial split web page start duration data sequence in the second initial split web page start duration data sequence set, the following determination steps are executed: first, determining the last second initial split webpage starting time length data in the second initial split webpage starting time length data sequence as second target split webpage starting time length data. And secondly, determining a second initial split webpage starting time length data sequence from which the second target split webpage starting time length data is removed as a second webpage starting time length removal data sequence. Thirdly, the second webpage starting time length removing data sequence is input into the second initial threshold generating model, and a first webpage starting time length threshold interval is obtained. Fourth, the last initial split webpage starting time length data in the first webpage starting time length threshold interval and the second initial split webpage starting time length data sequence are input into the second initial comparison model, and a second comparison result is obtained. Fifthly, in response to determining that the second comparison result meets a second preset comparison condition, adding last second initial split webpage starting duration data in the second initial split webpage starting duration data sequence to a second initial abnormal webpage starting duration data set. Therefore, a more accurate first webpage starting duration threshold interval can be identified through a first sub-model and a second sub-model included in the second initial threshold generation model, and a more accurate second initial abnormal webpage starting duration data set can be identified according to the second initial comparison model. And then, based on a preset second loss function, determining a second difference value between the second initial abnormal webpage starting time length data set and the sample abnormal webpage starting time length data set included in the second training sample. Therefore, a second difference value can be obtained through the second loss function so as to subsequently adjust the second initial abnormal webpage starting time length data generation model. And finally, in response to determining that the second difference value is smaller than or equal to a second preset difference value, adjusting network parameters of the second initial abnormal webpage starting duration data generation model. Therefore, the second initial abnormal webpage starting time length data generation model can be continuously adjusted according to the second difference value, so that the accurate second abnormal webpage starting time length data generation model is obtained. Therefore, the webpage starting time length data sequence is input into the model to replace the fact that a large amount of computing resources are consumed to identify each webpage starting time length data interval corresponding to the webpage starting time length data sequence, and the webpage starting time length threshold is obtained. Therefore, the model is used for directly processing the webpage starting time length data sequence, and the step of obtaining the webpage starting time length threshold value from the webpage starting time length data sequence can be simplified. Thus, the waste of computing resources can be reduced.

Optionally, in response to determining that the second difference value is greater than the second preset difference value, determining the second initial abnormal web page start duration data generation model as a trained second abnormal web page start duration data generation model.

In some embodiments, the executing body may determine the second initial abnormal web page start duration data generation model as the trained second abnormal web page start duration data generation model in response to determining that the second difference value is greater than the second preset difference value.

Step 105, in response to determining that the web page verification result does not meet the first verification condition and the second verification condition and meets a third verification condition, inputting the web page starting duration data sequence to a pre-trained third abnormal web page starting duration data generation model, and obtaining an abnormal web page starting duration data set.

In some embodiments, the execution body may input the web page start duration data sequence to a pre-trained third abnormal web page start duration data generation model to obtain an abnormal web page start duration data set in response to determining that the web page verification result does not satisfy the first verification condition and the second verification condition and satisfies a third verification condition. Wherein, the third verification condition may be: the webpage verification result is preset continuous periodic information. The third abnormal web page starting duration data generation model may be a neural network model which is trained in advance, takes a web page starting duration data sequence as input, and takes an abnormal web page starting duration data set as output.

Alternatively, the pre-trained third abnormal web page start duration data generation model may be trained by:

first, a third training sample set is obtained.

In some embodiments, the executing entity may obtain the third training sample set from the terminal device through a wired connection or a wireless connection. Wherein, the third training samples in the third training sample set may include, but are not limited to, at least one of the following: a sample web page start duration data sequence and a sample abnormal web page start duration data set.

And secondly, determining a third initial abnormal webpage starting time length data generation model.

In some embodiments, the executing entity may determine a third initial abnormal web page start duration data generation model. The third initial abnormal web page starting duration data generating model may include, but is not limited to, at least one of the following: a third initial split model, a third initial threshold generation model, and a third initial comparison model.

Here, the third initial splitting model may be a model that takes a sample web page start duration data sequence as input and takes a third initial splitting web page start duration data sequence set as output. For example, the third initial splitting model may determine each sample web page starting duration data corresponding to the third target time granularity in the sample web page starting duration data sequence as a third initial splitting web page starting duration data sequence, to obtain a third initial splitting web page starting duration data sequence set. Here, the third target temporal granularity may be, but is not limited to: one quarter, one month, one day.

The third initial threshold generation model may be a third custom model that takes a third web page start duration removal data sequence as input and takes a second web page start duration threshold interval as output. The second threshold interval may represent a web page start duration interval corresponding to a normal web page. The third custom model may include, but is not limited to: a third sub-model sequence. The third sub-model in the third sub-model sequence may be a cycle prediction model supporting the target cycle. For example, the target period may be, but is not limited to: day period, week period, month period. For example, the third sub-model may be an STL (Seasonal and Trend decomposition using Loess, time series decomposition) model. Here, the third web page start duration removal data sequence may be input to the first third sub-model in the above third sub-model sequence, then sequentially input the output of the last third sub-model to the next third sub-model, and finally determine the output of the last third sub-model as the output of the third initial threshold generation model.

The third initial comparison model may be a model in which the second threshold interval and the third initial splitting webpage starting duration data are input and the third comparison result is output. The third comparison result may represent that the third initial split webpage starting duration data is normal or abnormal. For example, the third initial contrast model may be: and firstly, in response to determining that the third initial split webpage starting time length data is within a second threshold interval, determining information representing that the webpage starting time length data is normal as a third comparison result. And then, in response to determining that the third initial split webpage starting duration data is not in the second threshold interval, determining information representing abnormality of the webpage starting duration data as a third comparison result.

And thirdly, selecting a third training sample from the third training sample set.

In some embodiments, the executing entity may select a third training sample from the third training sample set. In practice, the executing entity may randomly select a third training sample from the third training sample set.

And step four, inputting a sample webpage starting time length data sequence included in the third training sample into the third initial splitting model to obtain a third initial splitting webpage starting time length data sequence set.

In some embodiments, the execution body may input a sample web page start duration data sequence included in the third training sample into the third initial split model to obtain a third initial split web page start duration data sequence set.

Fifth, for each third initial split web page start duration data sequence in the third initial split web page start duration data sequence set, the following determining sub-steps are executed:

and a first sub-step of determining the last third initial split webpage starting time length data in the third initial split webpage starting time length data sequence as third target split webpage starting time length data.

In some embodiments, the execution body may determine the last third initial split webpage start time length data in the third initial split webpage start time length data sequence as the third target split webpage start time length data.

And a second sub-step of determining a third initial split webpage starting time length data sequence from which the third target split webpage starting time length data is removed as a third webpage starting time length removal data sequence.

In some embodiments, the execution body may determine a third initial split webpage launch duration data sequence from which the third target split webpage launch duration data is removed as a third webpage launch duration removal data sequence.

And a third sub-step of inputting the third webpage starting time length removing data sequence into the third initial threshold generating model to obtain a second webpage starting time length threshold interval.

In some embodiments, the execution body may input the third web page start duration removal data sequence into the third initial threshold generation model to obtain a second web page start duration threshold interval.

And a fourth sub-step of inputting last initial split webpage starting time length data in the second webpage starting time length threshold interval and the third initial split webpage starting time length data sequence into the third initial comparison model to obtain a third comparison result.

In some embodiments, the execution body may input the second web page start duration threshold interval and the last initial split web page start duration data in the third initial split web page start duration data sequence into the third initial comparison model, to obtain a third comparison result.

And a fifth sub-step of adding last third initial split webpage starting duration data in the third initial split webpage starting duration data sequence to a third initial abnormal webpage starting duration data set in response to determining that the third comparison result meets a third preset comparison condition.

In some embodiments, the executing body may add the last third initial split web page start duration data in the third initial split web page start duration data sequence to a third initial abnormal web page start duration data set in response to determining that the third comparison result satisfies a third preset comparison condition. And the third initial abnormal webpage starting duration data set is initially empty. The third preset comparison condition may be that the third comparison result represents that the web page starting duration data is abnormal.

And a sixth step of determining a third difference value between the third initial abnormal webpage starting time length data set and the sample abnormal webpage starting time length data set included in the third training sample based on a preset third loss function.

In some embodiments, based on a third predetermined loss function, the execution body may determine a third difference value between the third initial abnormal web page start duration data set and a sample abnormal web page start duration data set included in the third training sample. The third loss function may be, but is not limited to: mean square error loss function (MSE), cross entropy loss function (cross entropy), 0-1 loss function, absolute loss function, log loss function, square loss function, exponential loss function, and the like.

And seventhly, responding to the third difference value being smaller than or equal to a third preset difference value, and adjusting network parameters of the third initial abnormal webpage starting duration data generation model.

In some embodiments, the executing body may adjust the network parameter of the third initial abnormal web page start duration data generation model in response to the third difference value being less than or equal to a third preset difference value. For example, the third difference value and the third preset difference value may be differentiated. On the basis, parameters of the third initial abnormal webpage starting duration data generation model are adjusted by using methods of back propagation, gradient descent and the like. It should be noted that the back propagation algorithm and the gradient descent method are well known techniques widely studied and applied at present, and will not be described herein. The setting of the third preset difference value is not limited, and for example, the third preset difference value may be 0.1.

The optional technical content in step 105 and the technical content in step 106 are taken as an invention point of the embodiment of the present disclosure, and the fourth "causing difficulty in alerting to a part of web pages" of the technical problem mentioned in the background art is solved. The factors that cause difficulty in alerting a portion of a web page are often as follows: since the web page start duration data sequence may have different periodicity (e.g., day period, zhou Zhouqi) at the same time, a single algorithm can only consider one periodicity, resulting in a lower accuracy of the determined web page start duration threshold and a lower accuracy of the identified abnormal web page. If the above factors are solved, the effect of warning part of the web pages can be achieved. To achieve this, first, a third training sample set is acquired. Wherein the third training samples in the third training sample set include: a sample web page start duration data sequence and a sample abnormal web page start duration data set. And secondly, determining a third initial abnormal webpage starting duration data generation model. The third initial abnormal webpage starting duration data generation model comprises the following steps: a third initial split model, a third initial threshold generation model, and a third initial comparison model. Therefore, the third initial abnormal webpage starting time length data generation model can be determined, and the third initial abnormal webpage starting time length data generation model can be trained later. Then, a third training sample is selected from the third training sample set. And then, inputting a sample webpage starting time length data sequence included in the third training sample into the third initial splitting model to obtain a third initial splitting webpage starting time length data sequence set. Therefore, the third initial split webpage starting time length data sequence set can be obtained, so that the abnormal webpage starting time length data can be identified by taking the third initial split webpage starting time length data sequence as a whole. Then, for each third initial split web page start duration data sequence in the third initial split web page start duration data sequence set, the following determining steps are executed: first, determining the last third initial split webpage starting time length data in the third initial split webpage starting time length data sequence as third target split webpage starting time length data. And secondly, determining a third initial split webpage starting time length data sequence from which the third target split webpage starting time length data is removed as a third webpage starting time length removal data sequence. Thirdly, the third webpage starting time length removing data sequence is input into the third initial threshold generating model, and a second webpage starting time length threshold interval is obtained. Fourth, the second webpage starting time length threshold interval and the last initial split webpage starting time length data in the third initial split webpage starting time length data sequence are input into the third initial comparison model, and a third comparison result is obtained. Fifthly, in response to determining that the third comparison result meets a third preset comparison condition, adding last third initial split webpage starting duration data in the third initial split webpage starting duration data sequence to a third initial abnormal webpage starting duration data set. Therefore, a more accurate second webpage starting duration threshold interval considering different periodic characteristics can be identified through a third sub-model sequence included in the third initial threshold generation model, and a more accurate third initial abnormal webpage starting duration data set can be identified according to the third initial comparison model. And then, based on a preset third loss function, determining a third difference value between the third initial abnormal webpage starting time length data set and the sample abnormal webpage starting time length data set included in the third training sample. Therefore, a third difference value can be obtained through a third loss function so as to subsequently adjust a third initial abnormal webpage starting duration data generation model. And finally, in response to determining that the third difference value is smaller than or equal to a third preset difference value, adjusting network parameters of the third initial abnormal webpage starting duration data generation model. Therefore, the third initial abnormal webpage starting time length data generation model can be continuously adjusted according to the third difference value, so that the accurate third abnormal webpage starting time length data generation model can be obtained. Therefore, a relatively accurate abnormal webpage starting duration data set can be obtained according to the relatively accurate third abnormal webpage starting duration data generation model. Therefore, the webpage can be subjected to alarm processing through the accurate abnormal webpage starting duration data set.

Optionally, in response to determining that the third difference value is greater than the third preset difference value, determining the third initial abnormal web page start duration data generation model as a trained third abnormal web page start duration data generation model.

In some embodiments, the executing body may determine the third initial abnormal web page start duration data generation model as a trained third abnormal web page start duration data generation model in response to determining that the third difference value is greater than the third preset difference value.

And 106, performing alarm processing on the associated web page based on the abnormal web page starting duration data set.

In some embodiments, the executing body may perform alarm processing on the associated web page based on the abnormal web page start duration data set. In practice, first, the executing body may determine, in response to determining that the abnormal web page start duration data set is not empty, a web page corresponding to the abnormal web page start duration data set as an abnormal web page, and then, the executing body may perform alarm processing on the abnormal web page. The alarm processing may be to display warning text or control the speaker to give out prompt sound. For example, warning text may include, but is not limited to: and starting the time length data set by the abnormal webpage.

With further reference to FIG. 2, as an implementation of the method illustrated in the above figures, the present disclosure provides some embodiments of an anomaly web page alert device that corresponds to those method embodiments illustrated in FIG. 1, which can be particularly applicable in a variety of electronic devices.

As shown in fig. 2, the abnormal web page warning apparatus 200 of some embodiments includes: an acquisition unit 201, a verification unit 202, a first input unit 203, a second input unit 204, a third input unit 205, and an alarm unit 206. Wherein, the obtaining unit 201 is configured to obtain a webpage starting duration data sequence; a verification unit 202 configured to perform verification processing on the webpage starting duration data sequence to generate a webpage verification result; a first input unit 203, configured to input the above-mentioned webpage starting duration data sequence to a first abnormal webpage starting duration data generating model trained in advance to obtain an abnormal webpage starting duration data set in response to determining that the above-mentioned webpage verification result meets a first verification condition; a second input unit 204 configured to input the web page start duration data sequence to a pre-trained second abnormal web page start duration data generation model to obtain an abnormal web page start duration data set in response to determining that the web page verification result does not satisfy the first verification condition and satisfies a second verification condition; a third input unit 205 configured to input the web page start duration data sequence to a pre-trained third abnormal web page start duration data generation model to obtain an abnormal web page start duration data set in response to determining that the web page verification result does not satisfy the first verification condition and the second verification condition and satisfies a third verification condition; and an alarm unit 206 configured to perform alarm processing on the relevant networking page based on the abnormal web page start duration data set.

It will be appreciated that the elements described in the anomaly web page alert device 200 correspond to the various steps in the method described with reference to FIG. 1. Thus, the operations, features and the beneficial effects described above for the method are equally applicable to the abnormal web page warning device 200 and the units contained therein, and are not described herein again.

Referring now to FIG. 3, a schematic diagram of an electronic device (e.g., computing device) 300 suitable for use in implementing some embodiments of the present disclosure is shown. The electronic devices in some embodiments of the present disclosure may include, but are not limited to, mobile terminals such as mobile phones, notebook computers, digital broadcast receivers, PDAs (personal digital assistants), PADs (tablet computers), PMPs (portable multimedia players), car terminals (e.g., car navigation terminals), and the like, as well as stationary terminals such as digital TVs, desktop computers, and the like. The electronic device shown in fig. 3 is merely an example and should not impose any limitations on the functionality and scope of use of embodiments of the present disclosure.

As shown in fig. 3, the electronic device 300 may include a processing means (e.g., a central processing unit, a graphics processor, etc.) 301 that may perform various suitable actions and processes in accordance with a program stored in a Read Only Memory (ROM) 302 or a program loaded from a storage means 308 into a Random Access Memory (RAM) 303. In the RAM303, various programs and data required for the operation of the electronic apparatus 300 are also stored. The processing device 301, the ROM302, and the RAM303 are connected to each other via a bus 304. An input/output (I/O) interface 305 is also connected to bus 304.

In general, the following devices may be connected to the I/O interface 305: input devices 306 including, for example, a touch screen, touchpad, keyboard, mouse, camera, microphone, accelerometer, gyroscope, etc.; an output device 307 including, for example, a Liquid Crystal Display (LCD), a speaker, a vibrator, and the like; storage 308 including, for example, magnetic tape, hard disk, etc.; and communication means 309. The communication means 309 may allow the electronic device 300 to communicate with other devices wirelessly or by wire to exchange data. While fig. 3 shows an electronic device 300 having various means, it is to be understood that not all of the illustrated means are required to be implemented or provided. More or fewer devices may be implemented or provided instead. Each block shown in fig. 3 may represent one device or a plurality of devices as needed.

In particular, according to some embodiments of the present disclosure, the processes described above with reference to flowcharts may be implemented as computer software programs. For example, some embodiments of the present disclosure include a computer program product comprising a computer program embodied on a computer readable medium, the computer program comprising program code for performing the method shown in the flow chart. In such embodiments, the computer program may be downloaded and installed from a network via communications device 309, or from storage device 308, or from ROM 302. The above-described functions defined in the methods of some embodiments of the present disclosure are performed when the computer program is executed by the processing means 301.

It should be noted that, the computer readable medium described in some embodiments of the present disclosure may be a computer readable signal medium or a computer readable storage medium, or any combination of the two. The computer readable storage medium can be, for example, but not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or a combination of any of the foregoing. More specific examples of the computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer diskette, a hard disk, a Random Access Memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing. In some embodiments of the present disclosure, a computer readable storage medium may be any tangible medium that can contain, or store a program for use by or in connection with an instruction execution system, apparatus, or device. In some embodiments of the present disclosure, however, the computer-readable signal medium may comprise a data signal propagated in baseband or as part of a carrier wave, with the computer-readable program code embodied therein. Such a propagated data signal may take any of a variety of forms, including, but not limited to, electro-magnetic, optical, or any suitable combination of the foregoing. A computer readable signal medium may also be any computer readable medium that is not a computer readable storage medium and that can communicate, propagate, or transport a program for use by or in connection with an instruction execution system, apparatus, or device. Program code embodied on a computer readable medium may be transmitted using any appropriate medium, including but not limited to: electrical wires, fiber optic cables, RF (radio frequency), and the like, or any suitable combination of the foregoing.

In some implementations, the clients, servers may communicate using any currently known or future developed network protocol, such as HTTP (HyperText Transfer Protocol ), and may be interconnected with any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include a local area network ("LAN"), a wide area network ("WAN"), the internet (e.g., the internet), and peer-to-peer networks (e.g., ad hoc peer-to-peer networks), as well as any currently known or future developed networks.

The computer readable medium may be contained in the electronic device; or may exist alone without being incorporated into the electronic device. The computer readable medium carries one or more programs which, when executed by the electronic device, cause the electronic device to: acquiring a webpage starting time length data sequence; checking the webpage starting duration data sequence to generate a webpage checking result; responding to the fact that the webpage verification result meets a first verification condition, inputting the webpage starting duration data sequence into a pre-trained first abnormal webpage starting duration data generation model, and obtaining an abnormal webpage starting duration data set; responding to the fact that the webpage verification result does not meet the first verification condition and meets the second verification condition, inputting the webpage starting duration data sequence into a pre-trained second abnormal webpage starting duration data generation model, and obtaining an abnormal webpage starting duration data set; in response to determining that the webpage verification result does not meet the first verification condition and the second verification condition and meets a third verification condition, inputting the webpage starting duration data sequence into a pre-trained third abnormal webpage starting duration data generation model to obtain an abnormal webpage starting duration data set; and carrying out alarm processing on the associated webpage based on the abnormal webpage starting duration data set.

Computer program code for carrying out operations for some embodiments of the present disclosure may be written in one or more programming languages, including an object oriented programming language such as Java, smalltalk, C ++ and conventional procedural programming languages, such as the "C" programming language or similar programming languages. The program code may execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer or entirely on the remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any kind of network, including a Local Area Network (LAN) or a Wide Area Network (WAN), or may be connected to an external computer (for example, through the Internet using an Internet service provider).

The flowcharts and block diagrams in the figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each block in the flowchart or block diagrams may represent a module, segment, or portion of code, which comprises one or more executable instructions for implementing the specified logical function(s). It should also be noted that, in some alternative implementations, the functions noted in the block may occur out of the order noted in the figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently, or the blocks may sometimes be executed in the reverse order, depending upon the functionality involved. It will also be noted that each block of the block diagrams and/or flowchart illustration, and combinations of blocks in the block diagrams and/or flowchart illustration, can be implemented by special purpose hardware-based systems which perform the specified functions or acts, or combinations of special purpose hardware and computer instructions.

The units described in some embodiments of the present disclosure may be implemented by means of software, or may be implemented by means of hardware. The described units may also be provided in a processor, for example, described as: a processor includes an acquisition unit, a verification unit, a first input unit, a second input unit, a third input unit, and an alarm unit. The names of these units do not constitute a limitation on the unit itself in some cases, and the acquisition unit may also be described as "a unit that acquires a web page start duration data sequence", for example.

The functions described above herein may be performed, at least in part, by one or more hardware logic components. For example, without limitation, exemplary types of hardware logic components that may be used include: a Field Programmable Gate Array (FPGA), an Application Specific Integrated Circuit (ASIC), an Application Specific Standard Product (ASSP), a system on a chip (SOC), a Complex Programmable Logic Device (CPLD), and the like.

The foregoing description is only of the preferred embodiments of the present disclosure and description of the principles of the technology being employed. It will be appreciated by those skilled in the art that the scope of the invention in the embodiments of the present disclosure is not limited to the specific combination of the above technical features, but encompasses other technical features formed by any combination of the above technical features or their equivalents without departing from the spirit of the invention. Such as the above-described features, are mutually substituted with (but not limited to) the features having similar functions disclosed in the embodiments of the present disclosure.

Claims

1. An abnormal web page warning method, comprising:

acquiring a webpage starting time length data sequence;

performing verification processing on the webpage starting duration data sequence to generate a webpage verification result;

responding to the fact that the webpage verification result meets a first verification condition, inputting the webpage starting duration data sequence into a pre-trained first abnormal webpage starting duration data generation model, and obtaining an abnormal webpage starting duration data set;

responding to the fact that the webpage verification result does not meet the first verification condition and meets a second verification condition, inputting the webpage starting duration data sequence into a pre-trained second abnormal webpage starting duration data generation model, and obtaining an abnormal webpage starting duration data set;

responding to the fact that the webpage verification result does not meet the first verification condition and the second verification condition and meets a third verification condition, inputting the webpage starting duration data sequence into a pre-trained third abnormal webpage starting duration data generation model, and obtaining an abnormal webpage starting duration data set;

and carrying out alarm processing on the associated webpage based on the abnormal webpage starting duration data set.

2. The method of claim 1, wherein the obtaining a web page start duration data sequence comprises:

acquiring initial webpage starting duration data of each time granularity in a preset time period, and acquiring an initial webpage starting duration data sequence;

performing data cleaning processing on the initial webpage starting time length data sequence to generate a webpage starting time length cleaning data sequence;

and carrying out standardized processing on the webpage starting time length cleaning data sequence to generate a webpage starting time length data sequence.

3. The method of claim 1, wherein the verifying the web page start duration data sequence to generate a web page verification result comprises:

in response to determining that the number of the webpage starting duration data in the webpage starting duration data sequence is greater than the number of the preset webpage starting duration data, performing continuous verification processing on the webpage starting duration data sequence to generate a continuous verification result;

responding to the fact that the continuous check result meets a preset continuous check condition, and performing periodic check processing on the webpage starting duration data sequence to generate a periodic check result;

determining preset discrete information as a webpage verification result in response to determining that the continuous verification result does not meet the preset continuous verification condition;

Determining preset continuous period information as a webpage verification result in response to determining that the period verification result meets a preset period verification condition;

and in response to determining that the period verification result does not meet the preset period verification condition, determining preset continuous non-period information as a webpage verification result.

4. An abnormal web page warning device, comprising:

the acquisition unit is configured to acquire a webpage starting duration data sequence;

the verification unit is configured to perform verification processing on the webpage starting duration data sequence so as to generate a webpage verification result;

the first input unit is configured to input the webpage starting duration data sequence to a pre-trained first abnormal webpage starting duration data generation model to obtain an abnormal webpage starting duration data set in response to determining that the webpage verification result meets a first verification condition;

the second input unit is configured to input the webpage starting duration data sequence to a pre-trained second abnormal webpage starting duration data generation model to obtain an abnormal webpage starting duration data set in response to the fact that the webpage verification result does not meet the first verification condition and meets a second verification condition;

The third input unit is configured to input the webpage starting duration data sequence to a pre-trained third abnormal webpage starting duration data generation model to obtain an abnormal webpage starting duration data set in response to determining that the webpage verification result does not meet the first verification condition and the second verification condition and meets a third verification condition;

and the alarm unit is configured to perform alarm processing on the associated webpage based on the abnormal webpage starting duration data set.

5. An electronic device, comprising:

one or more processors;

a storage device having one or more programs stored thereon;

when executed by the one or more processors, causes the one or more processors to implement the method of any of claims 1-3.

6. A computer readable medium having stored thereon a computer program, wherein the computer program, when executed by a processor, implements the method of any of claims 1-3.