KR20200025408A - Method and server system for providnig real-time offer by using real-time event processing - Google Patents

Abstract

Provided are a method and a server system for providing a real-time offer by using real-time event processing. In order to solve the technical task of the present invention, the method for providing a real-time offer according to an embodiment of the present invention can comprise the steps of: capturing a packet transmitted and received between a user terminal and a web server; generating an event stream by using the captured packet; analyzing the event stream to determine whether an event rule is fulfilled; and providing a real-time offer when the event rule is fulfilled.

Description

Real-time offer providing method and server system using real-time event processing {METHOD AND SERVER SYSTEM FOR PROVIDNIG REAL-TIME OFFER BY USING REAL-TIME EVENT PROCESSING}

The present invention relates to a method and server system for providing a real time offer using real time event processing. More specifically, the present invention relates to a method and server system capable of providing real-time offers by analyzing customer data in real time using packet capture and real-time event processing techniques.

As part of online marketing, more and more web sites are provided that provide advertisements, marketing, or promotions provided in web sites by analyzing logs generated by a user while searching for information or visiting a product on a web site.

To do this, the web site operator can tell you how many people visited your website, where they came from, and how many people entered your website if you started a search ad. It analyzes which categories, products or services are most popular within the website, and actively utilizes them in advertising, marketing or promotions to activate the website and maximize sales.

As described above, accurate web analytics is required to operate a web site optimized for users and maximize sales. When a web site visitor accesses a web site, the web server leaves a log. 'Analytics' refers to analyzing web logs and analyzing who, when, where and how.

There are two methods of analyzing web analytics: the web site operator analyzes the weblog file generated on the web server directly and inserts a script into the web page to analyze the weblog. Direct analysis of log files generated by a web server is difficult to apply to small businesses because it can be used only if the web site administrator directly manages the web server and has the technology to analyze the numerous logs accumulated on the web server. .

In contrast, the script method inserts a simple script (e.g. javascript) into a web page (e.g. .html page) to analyze the weblog sent by the execution of the scrap, and uses Google Analytics (Google Analytics). It is easy to use in small companies as well as large companies because various analysis tools are provided.

Briefly describing the scripted web analytics process, when a user visits a web site through a web browser, the script installed in the web page source is executed, and when the web log related to the user is sent by the script, the web log is transmitted according to a certain rule. Analyze and provide advertising, marketing and promotions. The web site operator can assist the marketing activities of the marketing department by collecting and analyzing the user's weblogs and converting the analyzed weblogs into statistical data by using visualization tools and the like.

Analytics tools like Google Analytics use all kinds of information to define a user's characteristics, such as the user's funnel, location, search terms, OS / browser, etc. Analyze the service. When using the data of the operation DB that stores the user's personal information and transaction history, information about the user's age, gender, place of residence, purchase history, purchase price, purchase trend changes can also be used as data.

User information collected during analytics can be largely divided into user characteristics and user behavior. User characteristics are information about what network, device, and computing environment the visitor has, gender, age range, where is the purchase history, and what is the purchase history. User behavior is tracking user behavior on the website. For example, behavior within a website is information about moving to another page, clicking, converting, leaving, returning to, and so on.

Websites that sell products or services over the web can drive sales revenue through analytics. If accurate analytics is available, you can focus your marketing capabilities by segmenting and targeting potential converts.

By using web analytics programs provided by Internet service providers such as Google, Daum, and Naver, we can collect visitors' web logs and use them for advertising or marketing purposes. The analytics program is not executed by installing .exe file like an application program and installed on your own computer, but all the functions are implemented on the web, and the analytics program provided by your own analytics program or internet company such as Google Inject the relevant script into your website to start tracking your logs.

The script is largely composed of a tracking script and a conversion script, which must be inserted on every page, and the conversion script must be inserted on the page targeted by the operator. For example, the conversion script may be inserted into a payment completion page of a shopping mall or a consultation form transmission completion page of a consulting website.

In order to manage the history according to the use of the web site, web log data should be extracted and analyzed with a web log analyzer to extract information on the web usage status and then stored in the DB. Web log extraction and analysis is necessary to perform improved web service by analyzing the members of each site and the information inputted by users.

However, if we collect the weblog using scripts and then analyze it using the collected weblog, the real-time will be degraded. Once the web logs are accumulated, the offer is provided on the user's viewing screen through the web analytics. Therefore, it takes a lot of time from the web log collection to the offer to the user. As a result, it is not possible to adequately meet the consumption tendency of recent users who quickly decide items to purchase and make payments through simple payment.

For example, if your website has about 5000 visitors per day, one user logs 1kB per second, and the average visit time is 30 minutes, the amount of logs you accumulate during the day is huge, The time it takes to analyze and store in DB is also considerable. Unnecessary filtering of logs and cleansing of incorrectly stacked logs are also required to increase in proportion to the amount of logs. All this time, the analysis results of the current website are obtained, the marketing strategy is established, and reflected on the actual website. This will take several days. However, the main landing page on your website will fluctuate several times a day, depending on the issues that occur every hour, real-time search queries on your portal site, etc. Changing the offer does not give the user the necessary information, but gives the user unnecessary information, causing inconvenience to the user.

For the same reason, the necessity of technology for extracting and analyzing web logs in real time and reflecting them in real time has emerged.

Korea Patent Publication No. 10-2008-0096004 (Published October 30, 2008)

The technical problem to be solved by the present invention is to provide a method for analyzing a behavior pattern in a user's web site in real time to provide a user with an offer in the web site in real time. For example, by analyzing the customer's purchase patterns, browsing patterns, existing purchase history in real time in the mall, product offers, coupon offers, reserve offers, discount promotions, affiliate service links, entry page changes, user interface changes to customers , Layout changes and the like can be offered in real time.

Another technical problem to be solved by the present invention is a method of collecting a user's behavior pattern in real time by capturing packets transmitted and received between the user terminal and the web server in analyzing the behavior pattern in the user's web site in real time. To provide. For example, after capturing packets transmitted and received between the user terminal and the web server, the event stream may be generated using the same, and the event stream may be filtered and analyzed according to preset criteria to analyze the user's behavior pattern in real time.

The technical problems of the present invention are not limited to the above-mentioned technical problems, and other technical problems not mentioned will be clearly understood by those skilled in the art from the following description.

According to an aspect of the present invention, there is provided a method of providing a real time offer, the method comprising: capturing a packet transmitted and received between a user terminal and a web server, generating an event stream using the captured packet, The method may include analyzing an event stream to determine whether an event rule is satisfied and providing a real-time offer when the event rule is satisfied.

In an embodiment, the determining of whether the event rule is satisfied may include: filtering an event meeting a predetermined filtering criterion among events included in the event stream, and analyzing the filtered event stream to satisfy the event rule. It may include determining whether or not.

In an embodiment, the determining whether the event rule is satisfied may include analyzing the event stream and the operation DB data to determine whether the event rule is satisfied.

In an embodiment, the determining of whether the event rule is satisfied may include analyzing the event stream and data of a replica DB that duplicates the operation DB to determine whether the event rule is satisfied.

In one embodiment, after the providing of the real-time offer, further comprising the step of automatically generating a new event rule, the step of automatically generating a new event rule, a plurality of received from a plurality of user terminals The method may include collecting an event stream, analyzing a pattern common to event streams having a predetermined ratio among the collected plurality of event streams, and generating the new event rule using the pattern.

The real-time offer providing method according to another embodiment of the present invention for solving the technical problem, the step of executing a script for transmitting the input of the user terminal that satisfies a predetermined condition, of the user terminal transmitted by the script Generating an event stream using an input, analyzing the event stream to determine whether an event rule is satisfied, and providing a real-time offer when the event rule is satisfied.

The server system according to another embodiment of the present invention for solving the technical problem, a web server for providing a web page to the user terminal, a packet capture unit for capturing packets transmitted and received between the user terminal and the web server and the capture And a real time event processor for generating an event stream using the received packet, analyzing the event stream to determine whether the event rule is satisfied, and transmitting a result of determining the event rule to the web page. When the event rule is satisfied, a real time offer may be provided to the user terminal.

Computing device according to another embodiment of the present invention for solving the above technical problem, includes a memory for loading a computer program executed by the processor and storage for storing the computer program, the computer program Is an instruction for capturing a packet transmitted / received between a user terminal and a web server, an instruction for generating an event stream using the captured packet, an instruction for analyzing the event stream to determine whether an event rule is satisfied, and an event rule. It may include instructions that provide a real-time offer.

According to an embodiment of the present invention, by analyzing the behavioral pattern in the user's web site in real time to provide the user with an offer in the web site, by reflecting the user's tendency to change every hour within the web site Can provide users with timely and necessary information. This can increase the return rate of the user's website and increase sales.

According to another embodiment of the present invention, by analyzing the behavior patterns in the user's web site in real time by capturing packets transmitted and received between the user terminal and the web server by collecting a record of the user's behavior pattern in real time, User analysis can be performed with improved real-time compared to the existing script method. This reduces delays in checking and feedbacking the user's response and improves the user's satisfaction through immediate feedback.

The effect of the present invention is not limited to the above-mentioned effects, and other effects, which are not mentioned, may be exerted in the technical field of the present invention.

1 is a diagram illustrating a conventional web analytics system.
2 is a diagram illustrating a basic configuration of a real-time analytics system according to a first embodiment of the present invention.
3 is a diagram illustrating an extended configuration of a real-time analytics system according to a first embodiment of the present invention.
4 is a diagram illustrating the basic configuration of a real-time web analytics system according to a second embodiment of the present invention.
5 is a diagram illustrating an extended configuration of a real-time web analytics system according to a second embodiment of the present invention.
6 is a diagram illustrating an event detection timing according to an embodiment of the present invention.
7 is a diagram illustrating an attribute of an event type according to an embodiment of the present invention.
8 is a diagram illustrating an example of an individual event according to an embodiment of the present invention.
9 is a diagram illustrating an event stream and an event processor according to an embodiment of the present invention.
FIG. 10 is a diagram illustrating an event filtering process according to an event type name in an event stream according to an embodiment of the present invention.
11 is a diagram illustrating an event filtering process according to an event attribute in an event stream according to an embodiment of the present invention.
12 is a diagram illustrating an event filtering process according to a time window in an event stream according to an embodiment of the present invention.
13 is a flowchart illustrating a method of providing a real-time offer according to an embodiment of the present invention.
14 is a hardware block diagram of an exemplary computing device that can implement a method of providing a real-time offer according to an embodiment of the present invention.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings. Advantages and features of the present invention, and methods for achieving them will be apparent with reference to the embodiments described below in detail in conjunction with the accompanying drawings. However, the present invention is not limited to the embodiments disclosed below, but can be implemented in various forms, and only the embodiments are intended to complete the disclosure of the present invention, and the general knowledge in the art to which the present invention pertains. It is provided to fully inform the person having the scope of the invention, which is defined only by the scope of the claims. Like reference numerals refer to like elements throughout.

Unless otherwise defined, all terms used in the present specification (including technical and scientific terms) may be used as meanings that can be commonly understood by those skilled in the art. In addition, terms that are defined in a commonly used dictionary are not ideally or excessively interpreted unless they are specifically defined clearly. The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the invention. In this specification, the singular forms also include the plural unless specifically stated otherwise in the phrases.

The expression 'comprises' or 'comprising' as used herein does not exclude the presence or addition of any other configuration / step / operation other than the configuration / step / operation mentioned.

Hereinafter, for the convenience of description, the web analytics will be described using an online shopping mall as an example among various types of web sites. However, the technical spirit or scope of the present invention is not limited to an online shopping mall, and the technical spirit or scope of the present invention may be applied to any kind of web site where a customer is provided with a service or a product through a network such as the Internet. It should be borne in mind that this may apply.

Prior to the description herein, some terms used in this specification will be described in detail.

In the technical field to which the present invention pertains, 'Web server (WS)' refers to a server that receives an HTTP request from a web browser client on the Internet and transmits web pages such as .html documents. In a nutshell, the HTTP request finds the appropriate web page stored on the server and delivers it to the client. When a client makes a request to a web server, the web server provides web content (.html, .png, .css, etc.) according to the client's request. In other words, the web server waits for a request from a client and creates a response to the request. The content provided by the web server is transmitted to the client's web browser through the HTTP protocol, and the tasks that the web server cannot process are delivered to the web application server so that the web application server side processes the application. Web server related programs include Apache, IIS, nginx, and GWS.

In the technical field to which the present invention belongs, the term 'web application server (WAS)' refers to middleware that executes an application to a user computer or a device through HTTP over the Internet. The web application server executes a web application written in a web language such as Servlet, ASP, JSP, PHP, etc. on the server side and passes the execution result to the user. The user's web browser interprets the result received from the web application server. Will be displayed on the screen. Web application server related programs include WebLogic, GlassFish, WebSphere, Resin, JBoss, Tomcat, JRun, Zeus, and Interstage.

In the technical field to which the present invention pertains, 'CEP (Complex Event Processing)' refers to a technology for finding, filtering, and analyzing meaningful events in numerous events. Specifically, CEP is a real-time event data that is produced in the form of 1) individual events, 2) an event stream in which individual events of the same attribute occur sequentially, and 3) a number of other event streams associated with homogeneous event streams. It is a data processing technology that immediately interprets the flow of data and meaningful values hidden in these flows and reflects them to the business at the time of event occurrence. CEP-related programs include Storm, Esper, siddhi CEP, Spring XD, and Jboss Droos.

In the technical field to which the present invention belongs, 'target marketing' refers to extracting a target customer group and developing a target campaign at any time for the purpose of selling products. Many companies collect, hack, or illegally purchase and use customer information for targeted marketing. Customers are becoming a hunting target for companies, and are stressed by SMS, E-mail, etc. that are sent out at any time.

In the technical field of the present invention, 'EBM (Event Based Marketing)' refers to a technology that detects various events occurring to customers and induces differentiated marketing or customer management activities for each event situation. EBM is in the spotlight because it can increase the response rate of customers more than the existing target marketing techniques. True CRM is about delivering value to your customers and making them pay for them. Therefore, companies need to understand the customer's experiences and needs from the existing target marketing, and find out the needs of each customer and provide the offer 1: 1. The detection of the event should be detected by tracking whether or not the corresponding event has occurred, or the pattern change that the customer has maintained so far, and in the following specification, a description of how to detect and analyze the event in the EBM will be described. Explain through.

In the present specification, the web service providing unit means a component that provides a web service to a user terminal. The web service provider may be configured as a web server, a web application server, or a combination of a web server and a web application server. The web service provider may receive a request from the user terminal through the HTTP protocol, and may include static content such as .html documents and images stored in the web server, Send dynamic content processed in the application of the web application server.

In the present specification, the operation DB means a database that stores various data necessary for website operation. As an example of a shopping mall, various data necessary for operating the shopping mall, such as personal information (ID, password, address, etc.), order history, purchase history, product inventory, price information, sales information, and discount information of the customer, may be stored in the operation DB. . Each data may be divided into detailed items and stored. For example, the order history is divided into detailed items such as order history before payment, order history ready, order history ready for delivery, order history delivered, order completed, cancellation, exchange, return, and refund. Can be. When both the deposit and delivery are completed, the items in the order history are stored as a purchase history, and the database can be configured to easily search for the actual purchase of the customer.

In the present specification, the replica DB means a database that replicates an operation DB. Replica DB can be used for data backup purpose to prevent the damage of the operation DB, load reduction for reducing the load of the operation DB. Replication DB to be described in this specification is to prevent the occurrence of additional load on the operation DB due to event processing by determining whether to meet the event rules by connecting to the replication DB, not the operation DB during real-time event analysis and processing. However, side effects such as data backup also occur.

In the present specification, the packet capture unit refers to a component for capturing a packet transmitted and received between the user terminal and the web service provider in the middle. When the packet capture unit starts capturing, the packet number (No), time, address (Source), packet destination address (Destination), and protocol of the packet transmitted and received between the user terminal and the web service provider. Type, length of packet (Length), packet body (Capody) is captured and transmitted to the weblog collection unit. Programs related to packet capture include Wireshark and Fiddler. In particular, Fiddler is widely used for HTTP web packet capture.

In the present specification, the weblog collection unit refers to a component that collects and stores a weblog transmitted by a script in a packet captured by a packet capture unit or a web service provider. For large and many visitors, the amount of logs accumulated during the day is huge. Therefore, it is desirable to implement a web log collector using a large amount of storage such as Hadoop to store and process a large amount of web log data. However, if you delete a web log that has already been processed for an event, or delete a weblog stored in a storage at regular intervals, such as NAS (Network Attached Storage), HDD (Hard Disk Drive), and Solid State Drive (SDD) It is also possible to implement a weblog collection unit using a common storage medium.

In the present specification, the large data analysis unit refers to a component for efficiently processing, managing, and monitoring large data transfer between systems. The large-capacity data analysis unit makes it easier and safer to move large amounts of data between complex systems and enables systematic management of the dataflow. Specifically, the large-capacity data analysis unit provides various useful functions necessary for real-time data transmission, provides a user interface for easily checking data movement and data contents between systems, and provides multi-tenancy through powerful resource and authority management. tenant, resource sharing). Various tools are provided for analyzing large amounts of data. For example, Hadoop can be used for analyzing large amounts of data. You can also use Hive as a data warehouse (DW) package that can easily process data stored in Hadoop.

In the present specification, the event stream refers to a data stream composed of events flowing in real time generated by arranging and purifying data occurring in real time in a chronological order. The fluctuations in stock prices in financial market transactions are typical event streams. In an embodiment of the present invention, an event stream is generated by collecting and refining packets corresponding to a predetermined event type among real-time HTTP packets transmitted and received between a user terminal and a web server in order of time. The process of generating an event stream may include integrating streaming data from various sources and individual data elements, normalizing / cleaning the data, and handling missing data problems or problems with different transmission speeds and / or protocols for each format. Can be. Since the event stream can be used to grasp the data flow in real time, the event stream in one embodiment of the present invention is used for real-time event processing.

In the present specification, the real-time event processing unit performs a function similar to the CEP, and analyzes a user's behavior pattern in real time by using an event stream generated in each user terminal, a user's taste, an imminent problem, a matter to be supplemented, and a provision to be provided. It analyzes offers and provides them to the web service provider or business unit terminal. Real-time event processing can be used to detect signs of potential fraud, or to capture the opportunity to use a personalized marketing offer to instantly alert the user. If the real-time event processor detects an individual event or an event stream that satisfies the preset event rule, the real-time event processor transmits the event rule fulfillment to the business unit terminal to induce the person in charge to take the prescribed action. have. This can include blocking access to specific users, interrupting Web services, changing sales terms, changing sales amounts, changing product inventories, and changing marketing offers.

As used herein, the term 'unit' and / or 'module' may refer to a software component such as a function, an object, a class, or a module that performs a specific function in the software. Alternatively, the “unit” and / or “module” may mean a hardware component for performing a specific function, such as a field programmable gate array (FPGA) or an application specific integrated circuit (ASIC). However, the 'parts' and / or 'modules' are not limited to software or hardware components. The 'unit' and / or 'module' may be configured to reside in an addressable storage medium, or may be configured to execute one or more processors. The functions provided in the above components may be implemented by more subdivided components, or may be implemented as one component that performs a specific function by combining a plurality of components.

Hereinafter, embodiments of the present invention will be described with reference to the drawings.

1 is a diagram illustrating a conventional web analytics system.

As shown in FIG. 1, the conventional web analytics system includes a web service provider 110, an operation DB 120, a weblog collector 130, and a visualization unit 140.

The conventional web analytics system receives a request from a user terminal to provide a web service, collects a request received from the user terminal, generates statistical information such as user behavior data, and visualizes it in the visualization unit 140. In this case, the person in charge of the business unit can modify the website.

In the conventional web analytics system, the web service provider 110 provides a web service such as product purchase, consultation, and multimedia content provision to a user terminal through a web site. The web service providing unit 110 may include a web server and / or a web application server, and the web server and / or the web application server may include a web page to be displayed in a web browser of the user terminal when the user visits the website. It is stored.

Business personnel insert scripts, such as javascript, to collect user behavior data in web pages stored on web servers and / or web application servers. When the user accesses the web site and visits the web page where the script is installed, the script stored in the web page is executed and the user behavior data satisfying the condition defined by the script is transmitted to the weblog collection unit 130.

According to the conventional method described above, in order to identify a user's web site usage pattern, a separate script should be inserted into a web page, and the user behavior data should be analyzed by batch processing the data collected by executing the script. . That is, the conventional method does not analyze user behavior data in real time, but employs a method of collectively processing the collected data after a predetermined amount of data collection is completed.

Batch processing is characterized by processing 'bulk data' and 'bulk' at a 'specific time', so that offers within the website, such as product offers, coupon offers, reserve offers, Providing discount promotions, affiliate service links, etc., real-time processing is impossible and a gap of at least one day occurs after the user's actions. In addition, such script-based user behavior data cannot be linked with the user's order history and purchase history data, which makes it difficult to provide an offer in connection with a detailed activity history.

2 is a diagram illustrating a basic configuration of a real-time analytics system according to a first embodiment of the present invention. The real-time analytics system according to the first embodiment of the present invention illustrated in FIG. 2 may be implemented as one or more servers, and each component of FIG. 2 may be a component of the server.

As shown in FIG. 2, the real-time web analytics system according to the first embodiment of the present invention includes a web service provider 210, an operation DB 220, a packet capture unit 230, a packet collector 240, and The real time event processor 250 is included. The real-time web analytics system according to the first embodiment of the present invention has a feature of analyzing user behavior data by capturing packets transmitted and received between the user terminal and the web service provider 210.

In the real-time web analytics system according to the first embodiment of the present invention, the web service provider 210 provides a web service such as product purchase, consultation, and multimedia content provision to a user terminal through a web site. The web service providing unit 210 may include a web server and / or a web application server, and the web server and / or web application server may include a web page to be displayed in a web browser of the user terminal when the user visits the corresponding web site. It is stored. Preferably, the web service providing unit 110 according to the first embodiment of the present invention may be implemented as a web server.

Unlike the conventional method described with reference to FIG. 1, the real-time analytics system according to the first embodiment of the present invention has a difference in that a separate script for collecting user behavior data is not inserted into a web page. Of course, since the packet captured data is very large and unrefined, a separate script can be stored in the web page for accurate data collection to meet the analysis purpose.But basically, user action is made through packet capture rather than the script stored in the web page. Data is collected.

In the real-time analytics system according to the first embodiment of the present invention, the operation DB 220 is a customer's personal information, order history, purchase history, product inventory, price information, sales information, discount required for the operation and provision of web services. Information is stored. The web service provider 210 receives various data necessary for providing a web service from the operation DB 220 and transmits the data to the user terminal.

In the real-time web analytics system according to the first embodiment of the present invention, the packet capture unit 230 captures packets transmitted and received between the user terminal and the web service provider 210 in the middle. The packet capture unit 230 includes a packet number, a time, a source, a packet destination address, and a protocol of a packet transmitted and received between the user terminal and the web service provider 210. Type, length (Length), packet body (Body) of the packet is captured and transmitted to the packet collector 240. In the real-time web analytics system according to the first embodiment of the present invention, the packet captured by the packet capture unit 230 may be an HTTP web packet transmitted in the HTTP transaction process.

An HTTP web packet is a packet exchanged between a web server and a client through an HTTP protocol. An HTTP transaction made through the HTTP protocol is performed by a web browser installed on a user terminal sending a request to a web server, and then the web server processes the request and transmits a response. Looking at the one-time transaction between the web server and the client, 1) the user terminal is connected to the host where the web server is installed through the web browser, 2) the user terminal generates a request packet through the web browser, 3) A user terminal transmitting and waiting for a request packet (header, data) to a web server through a web browser, 4) a web server receiving the request packet, separating the packet into headers and data, and processing a request; 5) web The server processes the request and generates a response packet, and 6) the web server sends the response packet to the web browser and disconnects. Each transaction executed in the HTTP protocol is independent of each other, and the web server treats each successive transaction as an independent event, thereby reducing the load on the web server and supporting a large number of clients at the same time.

HTTP messages are largely divided into request messages and response messages. The request message is delivered by the client to cause the web server to operate, and the response message is the web server's reply to it. Among the HTTP web packets, a packet related to user behavior is a packet for a request message.

The request message packet includes a method field, a host field, and a request header field. The method field refers to an HTTP command that a client sends to the web server to cause an operation on the server. The host field means a host name and a port number for the requesting host. The Request Header is used to request a response that the client can understand by specifying the language, encoding method, compression method, media type, priority, etc. that the client can understand. Attributes and processing of packets captured by the packet capture unit 230 will be described in detail with reference to FIGS. 6 to 12.

In the real-time web analytics system according to the first embodiment of the present invention, the packet collector 240 collects and stores the packets captured by the packet capture unit 230. In order to store and process massive packet data, the packet collector 240 may be implemented in a distributed storage method such as Hadoop, but may be implemented as storage such as NAS, HDD, SDD, or a single server.

In the real-time web analytics system according to the first embodiment of the present invention, the real-time event processor 250 may generate an event stream generated using a packet stored in the packet collector 240 or a packet stored in the packet collector 240. By analyzing, the user's taste, impending problems, items to be supplemented, offers to be provided are analyzed and provided to the web service providing unit 210 or the business unit terminal.

An analysis process of a packet or an event stream performed by the real time event processor 250 will be described in detail with reference to FIGS. 6 to 12.

Through the above-described configuration, the real-time web analytics system according to the first embodiment of the present invention captures packets transmitted and received between the user terminal and the web service provider 210 to analyze user behavior data, thereby analyzing and providing data. The real time of provision can be achieved.

3 is a diagram illustrating an extended configuration of a real-time analytics system according to a first embodiment of the present invention. The real-time analytics system according to the first embodiment of the present invention illustrated in FIG. 3 may be implemented as one or more servers, and each component of FIG. 3 may be a component of the server.

As shown in FIG. 3, the real-time web analytics system according to the first embodiment of the present invention includes a web service provider 210, an operation DB 220, a packet capture unit 230, a packet collector 240, The real time event processor 250, the replication DB 221, a large data analysis unit 241, and a visualization unit 260 may be included. Compared with the basic configuration of the real-time analytics system according to the first embodiment of the present invention illustrated in FIG. 2, the expanded configuration includes a replica DB 221, a large data analysis unit 241, and a visualization unit 260. Is added.

In the extended configuration of the real-time analytics system according to the first embodiment of the present invention, the replication DB 221 is a database that replicates the operation DB. The replication DB 221 is a real-time event processing unit 250 is frequently operated by the real-time event processing unit 250 when the real-time event processing unit 250 wants to refer to user information, transaction history, etc. stored in the operation DB 220 for real-time event processing. Is used to prevent increasing the load of the operation DB (220).

In the extended configuration of the real-time web analytics system according to the first embodiment of the present invention, the large-capacity data analysis unit 241 is a component for efficiently processing, managing and monitoring large-scale data transmission between systems. The large-capacity data analysis unit 241 may generate a meaningful scenario by verifying the large-capacity data received from the packet collection unit 240 by statistical analysis, or verify whether or not the existing event rule fits well.

In the expanded configuration of the real-time web analytics system according to the first embodiment of the present invention, the visualization unit 260 visualizes the result of analyzing the data received by the large-capacity data analyzer 241 from the packet collector 240. It is a component to generate a report and provide it to the field manager. After the data stored in the packet collector 240 is analyzed by the large-capacity data analyzer 241, a report including statistics, graphs, and the like may be generated by the visualization unit 260 and transmitted to the mobile terminal. The report generated at this time may be a structured report or an unstructured report. The person in charge of the business department may change the configuration of the web page stored in the web server or the web application server of the web service provider 210, the content of the offer, and the like by referring to the content of the report.

In the real-time web analytics system according to the first embodiment of the present invention, the real-time event processor 250 may generate an event stream generated using a packet stored in the packet collector 240 or a packet stored in the packet collector 240. By analyzing, the user's taste, impending problems, items to be supplemented, offers to be provided are analyzed and provided to the web service providing unit 210 or the business unit terminal. At this time, the result from the mass data analysis unit 241 may be linked with the real time event processor to register or revise the real time event rule in real time in the real time event processor 250.

The real-time event processing unit 250 may verify the validity of the event rule registered on the basis of the real-time analysis result.

For example, suppose that if the same product has been viewed three times, an event rule for providing a real-time offer (for example, a discount promotion) has been set. According to the analysis of the large-capacity data analysis unit 241, if a purchase rate increases as a result of giving a real-time offer to a person who actually viewed the same product three times, the real-time event processing unit 250 indicates that the event rule registered in advance is valid. You can judge. If the event rule is valid, the real-time event processor 250 may maintain the event rule.

If the purchase rate is the same or decreases even when the same product is viewed three times, the real-time event processor 250 may determine that the event rule registered in advance is not valid. If the event rule is not valid, the real time event processor 250 may change the event rule. For example, the real-time event processor 250 may automatically revise the event rule in real time to give a real-time offer to a person who has seen the same product four times.

The real time event processor 250 may revise the event rule by changing a variable itself used for determining a condition, instead of simply changing a numerical value of the event rule.

The http request message packet may have a 'GET' method, a 'POST' method, and the like. The 'GET' method asks the client to look up a specific URL that the server has. The 'POST' method allows the client to actively send data such as a search expression to the server. For example, to change the variable itself used to determine a condition, if the existing event rule provided a real-time offer based on the number of inquiry requests (GET method) of how many times the same product was viewed, the revised event rule would be A real-time offer may be provided based on the number of times a product is actively searched for by entering a keyword.

Alternatively, the real time event processor 250 may revise the event rule by changing a target product of the real time offer.

Alternatively, the real time event processor 250 may revise the event rule by changing a type of a real time offer, for example, a product offer, a coupon offer, a reserve offer, a discount promotion, an affiliate service link, and the like.

The real time event processor 250 may continue to revise the event rule in the above manner until the desired target value is achieved. For example, when a real-time offer is provided, the validity of the event rule can be continuously determined and the event rule can be revived in real time until the purchase rate is 50% or more.

4 is a diagram illustrating the basic configuration of a real-time web analytics system according to a second embodiment of the present invention. The real-time analytics system according to the second embodiment of the present invention illustrated in FIG. 4 may be implemented as one or more servers, and each component of FIG. 4 may be a component of the server.

As shown in FIG. 4, the real-time web analytics system according to the second embodiment of the present invention includes a web service provider 410, an operation DB 420, a web log collector 440, and a real-time event processor 450. It includes. Unlike the first embodiment, the real-time web analytics system according to the second embodiment of the present invention has a feature of collecting user behavior data using a script stored in a web page without packet capture.

In the real-time web analytics system according to the second embodiment of the present invention, the web service provider 410 provides a web service such as product purchase, consultation, and multimedia content provision to a user terminal through a web site, and provides a user with a web page. Since a script for collecting behavior data is inserted, behavior data that a user performs in a web page is transmitted to the weblog collection unit 440.

In the real time web analytics system according to the second embodiment of the present invention, the real time event processor 450 analyzes the web logs stored in the web log collector 440 in real time. The real-time event processor 450 does not perform analytics through batch processing after weblog data stored in the weblog collector 440 is collected in a predetermined amount, and a script embedded in a web page is executed to execute the web. When the web log is transmitted to the log collection unit 440, an event stream is generated using the web logs transmitted in real time, and the event stream is analyzed in real time to provide user's taste, impending problems, supplementary matters, and offers to be provided. The web service provider 410 or the business unit terminal is analyzed and the like. An analysis process of a packet or an event stream performed by the real time event processor 450 will be described in detail with reference to FIGS. 6 to 12.

5 is a diagram illustrating an extended configuration of a real-time web analytics system according to a second embodiment of the present invention. The real-time analytics system according to the second embodiment of the present invention illustrated in FIG. 5 may be implemented as one or more servers, and each component of FIG. 5 may be a component of the server.

As shown in FIG. 5, the real-time web analytics system according to the second embodiment of the present invention includes a web service provider 410, an operation DB 420, a web log collector 440, and a real-time event processor 450. It may include a replication DB 421, a large data analysis unit 441, and a visualization unit 460. Compared with the basic configuration of the real-time analytics system according to the second embodiment of the present invention illustrated in FIG. 4, the expanded configuration includes a replica DB 421, a large data analysis unit 441, and a visualization unit 460. Is added.

Since the contents of the replica DB 421, the large-capacity data analyzer 441, and the visualization unit 460 are similar to those described with reference to FIG. 3, repeated descriptions of overlapping contents will be omitted.

6 is a diagram illustrating an event detection timing according to an embodiment of the present invention.

Events in the CEP are sorted by detection time. In one example, the event indicating the server status in the CEP is added to the event stream at a certain time, for example, 1 second without any conditions, since the current status of the server must be continuously monitored. As another example, a login event for counting a user's visit to a website at a website is added to the event stream each time the user logs in. As another example, a stock price that is changed in a stock management system is added to the event stream every time the stock price changes (stock tick).

In the real-time event processor according to an embodiment of the present invention, the packet data may be a packet for a request message transmitted from the user terminal to the web service provider. Specifically, whenever a user terminal transmits a request packet to a web service provider, the request packet may be added to the event stream.

The request message packet includes a method field, a host field, and a request header field. The method field is an HTTP command sent by the client to the web server to cause an operation on the server. The method field includes information useful for analyzing user behavior patterns. Representative methods include 'GET' method and 'POST' method. The 'GET' method requests the server-side information of a specific URL and is sent in the form of GET [URL]? Query-String HTTP / 1.1 \ r \ n. The 'POST' method transmits data to the server by the user terminal, and includes a body as well as a header.

As shown in FIG. 6, the event detection timing according to an embodiment of the present invention may be when the user terminal transmits a request packet to the web service provider. Whenever a user terminal sends a request packet to a web service provider, the request packets are arranged in time order and added to the event stream. 6 shows that a request packet including a GET method is transmitted at time t1, a request packet including a POST method is transmitted at time t2, and a request packet including a GET method at time t3. The event stream generated when this is transmitted is illustrated.

7 is a diagram illustrating an attribute of an event type according to an embodiment of the present invention.

In the real-time event processor, each event may be typed as an event type. Event type consists of event information and attributes.

In the event type according to an embodiment of the present invention, the event information may be designated as 'GET', 'POST' and the like. The event attribute may be a URL address value when the type name is 'GET' and may be a body body when the event information is 'POST'.

8 is a diagram illustrating an example of an individual event according to an embodiment of the present invention.

Individual events are specific to the event type and are also called Event Instances. 8 shows an example of four event instances for a 'GET' event.

The first instance of the 'GET' event has a time when the 'GET' command was sent on July 26, 2018 at 17:53:25, and the URL address targeted for 'GET' is' http://www.shilladfs.com/ estore / us / en / Sk-Ii / Dutyfree-Only-Set / p / 3111170 '.

The second instance of the 'GET' event has the time the 'GET' command was sent at 17:53:35 seconds on July 26, 2018, and the URL address targeted for 'GET' is' http://www.shilladfs.com/ estore / us / en / search? text =% EC% 8B% 9C% EA% B3% 84 '.

The third instance of the 'GET' event has the time the 'GET' command was sent at 17:53:38 on July 26, 2018, and the URL address targeted for 'GET' is' http://www.shilladfs.com/ estore / us / en / Watch-Jewelry / Watch / Fashion-Casual / p / 3042555 '.

The fourth instance of the 'GET' event has a time when the 'GET' command was sent at 17:57:42 on July 26, 2018, and the URL address targeted for 'GET' is' http://www.shilladfs.com/ estore / en / en / Watch-Jewelry / Watch / Fashion-Casual / p / 3702351 '.

9 is a diagram illustrating an event stream and an event processor according to an embodiment of the present invention.

An event processor refers to a software component that performs an operation on an event stream in real time. The event processor performs operations on the event in one direction of the event stream.

As shown in FIG. 9, the event processor performs real-time arithmetic processing on the event stream, and specifically, arithmetic on the event itself or on a property value of the event.

The operations performed by the event processor on the event itself include filtering by event type, building an event processing network (which constitutes the processing topology of the event stream and the event processor for event processing), and events. Event Counting, Time Window, etc.

Operations performed by the event processor on the event's attribute values include filtering by data, event attribute value extraction, set operations (minimum, maximum, sum, average, etc.), and other operations ( Groupings, joins, etc.).

FIG. 10 is a diagram illustrating an event filtering process according to an event type name in an event stream according to an embodiment of the present invention.

As shown in FIG. 10, the event processor may perform filtering by event type as an operation performed on the event itself.

As described above, in the real-time event processor, each event may be typed as an event type, and the event processor may filter a specific type of event among the events of the event stream.

10 is a diagram illustrating a process of filtering only an event having a 'GET' event type in the real time event processor. In FIG. 10, the event stream before passing through the event processor includes both a 'GET' event and a 'POST' event. The event processor illustrated in FIG. 10 performs an operation of filtering only the 'GET' event, and as a result, the event stream passing through the event processor illustrated in FIG. 10 includes only the 'GET' event.

11 is a diagram illustrating an event filtering process according to an event attribute in an event stream according to an embodiment of the present invention.

As shown in FIG. 11, the event processor may perform filtering by data as an operation performed on an attribute value of an event.

FIG. 11 is a diagram illustrating a process of filtering only an event including a string 'SEARCH' in an attribute value, that is, a URL address value, of a 'GET' event in the real-time event processor. In FIG. 11, the event stream before passing through the event processor includes both an event in which the string 'SEARCH' is included in the URL address value and an event in which the string 'SEARCH' is not included in the URL address value. The event processor illustrated in FIG. 11 performs an operation of filtering only events in which the string 'SEARCH' is included in the URL address value. As a result, the event stream passing through the event processor illustrated in FIG. 11 is assigned to the URL address value. It only contains events that contain the string 'SEARCH'.

12 is a diagram illustrating an event filtering process according to a time window in an event stream according to an embodiment of the present invention.

As shown in FIG. 12, the event processor may perform filtering according to a time window as an operation performed on the event itself.

The filtering according to the time window is to filter events whose event detection time is within a preset time from a specific time point.

Filtering according to a time window is a filtering method used when the meaning or importance of an event is related to the number of events made within a specific time.

For example, if a login failure event occurs five or more times in the last five seconds with the same ID, it may be determined as a hacking attempt using a macro. In this case, it may be useful to filter only events within 5 seconds from a specific time point and use them for event analysis. In this case, the time window is used.

In the real-time event handler according to an embodiment of the present invention, if there is no GET request for another URL for more than a preset time after the GET command for a specific URL is performed, the user is interested in the web page indicated by the current URL. It can be judged that.

As illustrated in FIG. 12, when an event is filtered using a 5 second time window and only one event exists in the time window, it may be analyzed that the user is interested in the corresponding event URL.

13 is a flowchart illustrating a method of providing a real-time offer according to an embodiment of the present invention. In detail, FIG. 13 is a flowchart illustrating a real-time offer providing method according to a first embodiment of the present invention.

The real-time offer providing method according to an embodiment of the present invention illustrated in FIG. 13 may be executed by one or more servers. Or by any type of computing device having a processor, memory, storage, and network interface.

As shown in Figure 13, the real-time offer providing method according to an embodiment of the present invention in the step of capturing packets transmitted and received between the user terminal and the web service provider (S1310), generating an event stream using the captured packets In operation S1320, the event stream may be analyzed to determine whether the event rule is satisfied (S1330), and when the event rule is satisfied, the real-time offer may be provided (S1340).

According to an embodiment, after determining whether the event rule is satisfied (S1340), if it is determined that the event rule is not satisfied as a result of analyzing the event stream, the method may include revising the event rule. .

In an embodiment, revoking the event rule may include changing a numerical value of a variable included in the event rule.

In one embodiment, revoking the event rule may include changing a variable included in the event rule.

In one embodiment, the step of changing the variable included in the event rule, if the variable is a 'GET' method of the http request packet transmitted by the user terminal, the step of changing the variable to the 'POST' method of the http request packet It may include.

In one embodiment, revoking the event rule may include changing a target product of the real-time offer.

In one embodiment, revoking the event rule may include changing the type of real-time offer.

In an embodiment, reviving the event rule may include reviving the event rule when a purchase rate after providing a real-time offer is equal to or less than a preset probability.

In step S1310, capturing a packet transmitted and received between the user terminal and the web service provider, the web service provider may be a web server, and the packet transmitted and received between the user terminal and the web service provider may be HTTP between the user terminal and the web server. It may be an HTTP web packet transmitted by a protocol.

The generating of the event stream using the captured packet in operation S1320 may be to generate an event stream using a packet for a request message transmitted from the user terminal to the web service provider. Specifically, whenever a user terminal transmits a request packet to a web service provider, the request packet may be added to the event stream.

In operation S1330, the event stream is analyzed to determine whether the event rule is satisfied. The filtering of the event meeting the predetermined filtering criteria among the events included in the event stream and analyzing the filtered event stream to determine whether the event rule is satisfied. Determining may include.

The filtering may include filtering an event that is a URL request (URL). In the HTTP packet, the 'GET' method is a request for information of a specific URL to the server side. As illustrated in FIG. 10, only a packet including the 'GET' method is requested among the request packets as illustrated in FIG. 10. -URL) events can be filtered.

The filtering may include filtering an event including a preset string in an event attribute value. The event attribute value may be, for example, a URL address value. If you enter a specific search expression on a Web site, 'search' may be included in the URL address value, such as 'http://www.shilladfs.com/estore/en/en/search?text=(keyword)'. Similarly, when performing a keyword search in the portal site Naver, the URL is in the form of 'https://search.naver.com/search.naver?ie=UTF-8&query=(keyword)'. That is, simply determining whether a URL address contains a specific string, such as 'search', does the user perform a search with a specific keyword, or simply clicks a link or form button to get to another page? Can be determined. Therefore, when filtering only events that include 'search' in the URL address value, the user's search pattern, main interests, and interest conversion process can be identified.

The determining of whether the event rule is satisfied (S1330) may include determining whether the next event occurs within a preset time after a specific event occurs in the filtered event stream. After the GET command for the specific URL is performed by the user, if there is no GET request for the other URL from the user for a preset time, the user may determine that there is much interest in the web page indicated by the current URL.

The determining of whether the event rule is satisfied (S1330) may include extracting a URL address value of each event included in the filtered event stream.

When the URL address value is extracted, it is possible to determine which product is the URL address value. As a result of analyzing the URL address value, if the product description page URL of the product of a specific category is counted more than a predetermined number of times, it may be determined that the user is interested in the corresponding category. For example, if a URL request including 'Watch-Jewelry' in a URL address value is counted more than a predetermined number of times, the user may determine that the user is interested in the 'Watch / Jewelry' category.

When the URL address value is extracted, it may be determined whether the URL address value is a URL for putting a product of a specific category into a shopping cart. As a result of analyzing the URL address value, when a URL for putting a product of a specific category into a shopping bag is counted more than a predetermined number of times, the user may determine that there is a considerable interest in the category. It may be determined that the URL for the shopping cart more strongly reflects the user's interest than the URL for the product description page.

When the URL address value is extracted, it may be determined whether the URL address value is a URL for purchasing a product of a specific category. As a result of analyzing the URL address value, when a URL for purchasing a product of a specific category is counted more than a predetermined number of times, it may be determined that the user is very interested in the category. It may be determined that the URL to purchase more strongly reflects the user's interest than the URL to add to the shopping cart.

When the URL address value is extracted, it may be determined whether the URL address value is a URL for searching for a specific keyword. As a result of analyzing the URL address value, when a URL for searching for a specific keyword is input, it may be determined that the user is interested in the keyword. Even if the input keyword is not a specific category name (eg, 'watch', 'clothes', 'cosmetics', 'fragrance', etc.), the input keyword may reflect the user's taste in various ways. For example, if a user searches for the keyword 'minimal' within a web site, the user may determine that the user prefers a minimalist product and may recommend a minimally designed product. As another example, when a user searches for the keyword 'Nordic' within a web site, the user may recommend a Nordic style product by determining that the user prefers a Nordic style product.

The determining of whether the event rule is satisfied (S1330) may include determining whether the event rule is satisfied by analyzing data of the event stream and the operation DB. The operational DB stores sensitive personal information about the user, such as the user's age, gender, residence, purchase history, purchase amount, and purchase trends. Since the user behavior data only reflects the user's behavior pattern in the current web site, it is impossible to determine the event rule that perfectly reflects the user's disposition when using only the user behavior data. Therefore, by accessing the operation DB and inquiring personal information for analyzing the user's disposition from the operation DB, it is possible to determine the event rule more accurately considering the user's disposition.

However, when the event rule is determined by receiving data from the operation DB for real-time event analysis and processing as described above, excessive load may occur on the operation DB. For example, if the event is conducted for customers who have purchased more than 1 million won within the past two years, there will be an excessive load because it needs to look up two years of member data of all connected customers. At this time, it can reduce the load of the operation DB and prevent the server down of the operation DB by making a query of the replication DB instead of the operation DB.

In order to reduce the load on the operational DB, the real-time event processor does not receive data directly from the operational DB, but preferably receives data from a replica DB that replicates the operational DB. That is, when the real-time event processing unit needs to refer to user information, transaction history, etc. stored in the operation DB for real-time event processing, the data received from the replica D replicating the operation DB can be used instead of the operation DB.

Replica DB is configured separately from the production DB by replicating the same data as the production DB in real time. In the case of using the replica DB, the method may further include updating the replica DB before the step of capturing the packet (S1310). The updating of the replication DB may include identifying a change item of the operation DB and updating the replication DB using the change item.

Identifying the change item may include capturing change data (CDC). Only the items that have changed in the operation database are sent to the replication database in real time, and the replication database updates only the value of the changed part of the entire column, enabling quick synchronization between the operation database and the replication database.

As an example of an event rule, when a URL request including 'Watch-Jewelry' is included in a URL address value in user behavior data is counted more than a predetermined number of times, the user may determine that the user is interested in the 'clock / jewelry' category. However, user behavioral data alone is not enough to determine whether a user prefers to watch or jewelry. In this case, after accessing the replication DB and querying the purchase history of the user, it may be determined that there is a lot of interest in a product having a large number of purchase history among 'clock' or 'jewelry', and an offer for the corresponding product may be provided. . If the user purchases 'watch' once and 'jewelry' has been purchased 5 times as a result of the user's purchase history inquiry, the user may be determined to be interested in the 'jewelry' and may offer an offer for 'jewelry'. .

When determining whether the event rule is satisfied by referring to the data of the replication DB, determining whether the event rule is satisfied (S1330) may include: querying a purchase history within a predetermined period of the user from the replication DB, and setting a preset value from the purchase history. Summing up the purchase amount within the period and determining whether the sum of the purchase amount is greater than or equal to the predetermined amount. If the purchase amount within the user's predetermined period is greater than or equal to a certain amount, the consumption tendency of the user may be regarded as high, and thus, the user may induce a purchase by providing an additional promotion for a category or product determined to be of interest.

Providing a real time offer (S1340) may include providing a product offer to a user terminal. Specifically, when real-time event analysis is performed by referring to current user behavior data in the web site and user personal information stored in the replication DB, if a specific event rule is satisfied, the product offer is presented to the user as an output according to the satisfied event rule. Can provide. For example, if the user who purchased the brand A bag among the users who purchased more than 200,000 won in the past two years has set the event rule based on the statistics that they are more likely to purchase the brand B watch, the current user on the website Behavioral data (i.e., whether or not A brand is purchased) and user's personal information stored in the replica DB (i.e., whether the purchase amount is more than US $ 200) in the last two years is determined in real time, and the user is Product offers for watches can be provided.

In an embodiment, the offer provided to the user meeting the event rule in operation S1340 may be a coupon offer.

In an embodiment, the offer provided to the user who satisfies the event rule at step S1340 may be a reserve offer.

In an embodiment, the offer provided to the user meeting the event rule in operation S1340 may be a discount promotion.

In an embodiment, the offer provided to the user meeting the event rule in operation S1340 may be to provide a link to an affiliate service.

In one embodiment, the offer provided to the user meeting the event rule in the step S1340 of providing a real-time offer may be to change the entry page of the web site provided by the web server for the user terminal. For example, the entry page may be changed so that products, brands, and the like, which are analyzed to be of high interest to the user, are displayed from the first access to the website.

In one embodiment, the offer provided to the user meeting the event rule in the step S1340 of providing a real-time offer may be to change the user interface of the web site provided by the web server for the user terminal. For example, the user interface may be changed to facilitate viewing and purchasing products, brands, and the like, which are analyzed to be of interest to the user.

In an embodiment, the offer provided to the user who satisfies the event rule in operation S1340 may be to change the layout of the web site provided by the web server for the user terminal. For example, the layout of the web site may be changed so that the layout area occupied by the web page by products, brands, etc. analyzed by the user's interest is enlarged.

Event rules can be set manually by the person in charge of the business unit or can be generated automatically. When automatically generating an event rule, the method may further include automatically generating a new event rule after providing a real-time offer (S1340).

The step of automatically generating a new event rule may include collecting a plurality of event streams received from a plurality of user terminals, analyzing a pattern that event streams having a predetermined ratio among a plurality of collected event streams have in common; It may include generating a new event rule using a pattern.

For example, when a plurality of event streams received from a plurality of user terminals are analyzed, and if A is found and a pattern is found in which B is purchased within at least n Request-URL packet transmissions, n is returned to the person who purchased A. You can automatically generate an event rule to provide an offer for B before one click / touch.

As another example, when a plurality of event streams received from a plurality of user terminals are analyzed and a pattern of purchasing B is found within at least t hours when A is purchased, an offer for B within t hours is provided to the person who purchased A. You can automatically create an event rule to provide.

As another example, when a plurality of event streams received from a plurality of user terminals are analyzed, and if A is found in the shopping cart, a pattern having a high probability of purchasing to A is found. Event rules can be automatically generated to provide large discount promotions for the product.

Unlike the real-time offer providing method according to the first embodiment, the real-time offer providing method according to the second embodiment of the present invention collects user behavior data using a script stored in a web page without capturing packets.

In detail, the method for providing a real-time offer according to the second embodiment of the present invention may include executing a script for transmitting an input of a user terminal that satisfies a preset condition, and using the input of the user terminal transmitted by the script. And generating an event rule, determining whether the event rule is satisfied, and providing a real-time offer when the event rule is satisfied.

Since the real-time offer providing method according to the second embodiment of the present invention is the same as the real-time offer providing method according to the first embodiment except that user behavior data is collected using a script stored in a web page without packet capture, Detailed description of repeated parts is omitted.

Meanwhile, the real-time offer providing method according to the second embodiment of the present invention may be executed by one or more servers. Or by any type of computing device having a processor, memory, storage, and network interface.

14 is a hardware block diagram of an exemplary computing device that can implement a method of providing a real-time offer according to an embodiment of the present invention.

Exemplary computing devices capable of implementing a method of providing a real-time offer according to an embodiment of the present invention include one or more processors 1410, a memory 1420 for loading a computer program executed by the processor 1410, The storage 1430 may include a bus and a network interface 1440. 14, only components relevant to embodiments of the present invention are shown. Therefore, it will be appreciated by those skilled in the art that the present invention may further include other general purpose components in addition to the components shown in FIG. 14.

A computing device capable of implementing the method according to embodiments of the present invention may include one or more processors.

The processor 1410 controls the overall operation of each component of the computing device capable of implementing the method according to embodiments of the present invention. The processor 1410 includes a central processing unit (CPU), a micro processor unit (MPU), a micro controller unit (MCU), a graphics processing unit (GPU), or any type of processor well known in the art. Can be. In addition, the processor 1410 may perform an operation on at least one application or program for executing a method according to embodiments of the present invention.

The memory 1420 stores various data, commands, and / or information. Memory 1420 may load one or more computer programs from storage 1430 to execute a method in accordance with embodiments of the present invention.

The storage 1430 may non-temporarily store one or more computer programs. The storage 1430 may be a non-volatile memory such as a read only memory (ROM), an erasable programmable ROM (EPROM), an electrically erasable programmable ROM (EEPROM), a flash memory, a hard disk, a removable disk, or a technical field to which the present invention pertains. And any known type of computer readable recording medium. The storage 1430 stores a computer program for performing a method according to embodiments of the present invention.

A bus provides a communication function between components of a computing device capable of implementing the method according to embodiments of the present invention. The bus may be implemented as various types of buses such as an address bus, a data bus, and a control bus.

The network interface 1440 is an interface for communicating with clients, servers, and other computing devices connected to the network.

A computing device according to an embodiment of the present invention includes one or more processors 1410, a memory 1420 for loading a computer program executed by the processor 1410, and a storage 1430 for storing the computer program, The computer program may include instructions for capturing packets transmitted and received between the user terminal and the web server, instructions for generating an event stream using the captured packets, instructions for analyzing the event stream to determine whether the event rules are met, and real-time when event rules are met. It may include instructions that provide an offer.

Each instruction of the computer program stored in the storage 1430 of the computing device according to an embodiment of the present invention may perform the real-time offer providing method described above. The description of the overlapping contents will be omitted.

The methods according to the embodiments of the present invention described so far may be performed by execution of a computer program implemented in computer readable code. The computer program may be transmitted from the first computing device to the second computing device via a network such as the Internet and installed in the second computing device, thereby being used in the second computing device. The first computing device and the second computing device both include a server device, a physical server belonging to a server pool for cloud services, and a stationary computing device such as a desktop PC.

In addition, the inventive concept may be embodied in computer readable code on a computer readable medium. The computer-readable recording medium may be a removable recording medium (CD, DVD, Blu-ray Disc, USB storage device, removable hard disk) or a fixed recording medium (ROM, RAM, computer-equipped hard disk). A computer program recorded on a computer readable recording medium may be transmitted to another computing device and installed in another computing device through a network such as the Internet, thereby being used in another computing device.

Although the operations are shown in a specific order in the drawings, it should not be understood that the operations must be performed in the specific order or sequential order shown or that all the illustrated operations must be executed to achieve the desired results. In certain situations, multitasking and parallel processing may be advantageous. Moreover, the separation of the various configurations in the embodiments described above should not be understood as such separation being necessary, and the described program components and systems may generally be integrated together into a single software product or packaged into multiple software products. Should be understood.

Although the embodiments of the present invention have been described above with reference to the accompanying drawings, those skilled in the art to which the present invention pertains may be embodied in other specific forms without changing the technical spirit or essential features of the present invention. I can understand. Therefore, it is to be understood that the embodiments described above are exemplary in all respects and not restrictive.

Claims (41)

A method performed by one or more servers,
Capturing packets transmitted and received between the user terminal and the web server;
Generating an event stream using the captured packet;
Analyzing the event stream to determine whether an event rule is satisfied; And
Providing a real-time offer upon meeting the event rule,
How to offer live offers. The method of claim 1,
Determining whether the event rule is satisfied,
Filtering an event meeting a predetermined filtering criterion among the events included in the event stream; And
Analyzing the filtered event stream to determine whether the event rule is satisfied.
How to offer live offers. The method of claim 2,
The filtering may include filtering an event that is a URL request (URL).
How to offer live offers. The method of claim 2,
The filtering may include filtering an event including a preset string in an event attribute value.
How to offer live offers. The method of claim 2,
Determining whether the event rule is satisfied includes determining whether a next event occurs within a preset time after a specific event occurs in the filtered event stream.
How to offer live offers. The method of claim 2,
Determining whether the event rule is satisfied includes extracting a URL address value of each event included in the filtered event stream.
How to offer live offers. The method of claim 6,
The determining of whether the event rule is satisfied may include determining whether an event having a product description page URL of a product of a specific category as an attribute value in the filtered event stream has been counted more than a preset number of times.
How to offer live offers. The method of claim 6,
The determining of whether the event rule is satisfied may include determining whether an event having a URL as an attribute value for including a product of a specific category in a shopping cart in the filtered event stream is counted more than a preset number of times.
How to offer live offers. The method of claim 6,
The determining whether the event rule is satisfied may include determining whether an event having a URL as an attribute value for purchasing a product of a specific category in the filtered event stream is counted more than a preset number of times.
How to offer live offers. The method of claim 6,
The determining of whether the event rule is satisfied may include determining whether an event having a URL as an attribute value for adding a specific product to a shopping cart in the filtered event stream has been counted more than a preset number of times.
How to offer live offers. The method of claim 6,
The determining of whether the event rule is satisfied includes determining whether an event having a URL for a keyword search as an attribute value has occurred in the filtered event stream.
How to offer live offers. The method of claim 1,
After determining whether the event rule is satisfied,
And analyzing the event stream and determining that the event rule is not satisfied, revising the event rule.
How to offer live offers. The method of claim 12,
Reviving the event rule,
Changing a numerical value of a variable included in the event rule;
How to offer live offers. The method of claim 12,
Reviving the event rule,
Changing a variable included in the event rule;
How to offer live offers. The method of claim 14,
Changing the variable included in the event rule,
If the variable is a 'GET' method of the http request packet transmitted by the user terminal, comprising the step of changing the variable to the 'POST' method of the http request packet,
How to offer live offers. The method of claim 12,
Reviving the event rule,
Changing a target product of the real-time offer;
How to offer live offers. The method of claim 12,
Reviving the event rule,
Changing the type of real-time offer;
How to offer live offers. The method of claim 12,
Reviving the event rule,
If the purchase rate after providing the real-time offer is less than or equal to a preset probability, reviving the event rule;
How to offer live offers. The method of claim 1,
Determining whether or not the event rule is satisfied includes determining whether the event rule is satisfied by analyzing data of the replication DB that replicates the event stream and the operation DB.
How to offer live offers. The method of claim 19,
Determining whether the event rule is satisfied,
Retrieving a purchase history within a predetermined period of the user from the replica DB;
Summing transaction amounts within the predetermined period from the purchase history; And
Determining whether the summed transaction amount is greater than or equal to a predetermined amount;
How to offer live offers. The method of claim 19,
Before the step of capturing the packet, further comprising updating the replica DB,
Updating the replica DB,
Identifying a change item of the operation DB; And
Updating the replication DB using the change item;
How to offer live offers. The method of claim 1,
The providing of the real-time offer includes providing a product offer to the user terminal.
How to offer live offers. The method of claim 1,
Providing the real-time offer includes providing a coupon offer to the user terminal.
How to offer live offers. The method of claim 1,
Providing the real-time offer includes providing a reserve offer to the user terminal.
How to offer live offers. The method of claim 1,
The providing of the real-time offer may include providing a discount promotion for a specific product to the user terminal.
How to offer live offers. The method of claim 1,
The providing of the real-time offer includes providing a link to an affiliate service to the user terminal.
How to offer live offers. The method of claim 1,
The providing of the real-time offer may include changing an entry page of a web site provided by the web server with respect to the user terminal.
How to offer live offers. The method of claim 1,
The providing of the real-time offer may include changing a user interface of a web site provided by the web server for the user terminal.
How to offer live offers. The method of claim 1,
The providing of the real-time offer may include changing a layout of a web site provided by the web server for the user terminal.
How to offer live offers. The method of claim 1,
After providing the real-time offer, further comprising the step of automatically generating a new event rule,
Automatically generating the new event rule,
Collecting a plurality of event streams received from the plurality of user terminals;
Analyzing a pattern that event streams having a preset ratio among the collected plurality of event streams have in common; And
Generating the new event rule using the pattern;
How to offer live offers. A web server for providing a web page to a user terminal;
A packet capture unit which captures packets transmitted and received between the user terminal and the web server; And
A real time event processor for generating an event stream using the captured packet, analyzing the event stream to determine whether an event rule is satisfied, and transmitting a result of determining whether the event rule is satisfied to the web page;
The web server provides a real time offer to the user terminal when the event rule is satisfied.
Server system. The method of claim 31, wherein
The real-time event processor is configured to filter an event meeting a predetermined filtering criterion among events included in the event stream, and determine whether the event rule is satisfied by analyzing the filtered event stream.
Server system. The method of claim 31, wherein
The server further includes a replica DB replicating the operational DB,
The real time event processing unit, by analyzing the data of the event stream and the replication DB to determine whether the event rule is satisfied,
Server system. The method of claim 31, wherein
The real-time offer is to change the layout of the web page displayed on the screen of the user terminal,
Server system. The method of claim 31, wherein
The real-time event processing unit collects a plurality of event streams received from a plurality of user terminals, analyzes a pattern common to event streams having a predetermined ratio among the collected plurality of event streams, and generates a new event rule. ,
Server system. One or more processors;
A memory for loading a computer program executed by the processor; And
Storage for storing the computer program,
The computer program,
Instructions for capturing packets transmitted and received between a user terminal and a web server;
Instructions for generating an event stream using the captured packets;
An instruction for analyzing the event stream to determine whether an event rule is satisfied; And
Including an instruction that provides a real-time offer upon meeting the event rule,
Computing device. The method of claim 36, wherein
The instruction for determining whether the event rule is satisfied,
Instructions for filtering an event that meets predetermined filtering criteria among the events included in the event stream; And
And an instruction for analyzing the filtered event stream to determine whether the event rule is satisfied.
Computing device. The method of claim 36, wherein
The instruction for determining whether the event rule is satisfied includes an instruction for determining whether the event rule is satisfied by analyzing data of the replica DB that duplicates the event stream and the operation DB.
Computing device. The method of claim 36, wherein
The instruction providing the real time offer includes instructions for changing the layout of the web page displayed on the screen of the user terminal.
Computing device. The method of claim 36, wherein
After the instruction providing the real-time offer, further comprising an instruction for automatically generating a new event rule,
The instruction to automatically generate the new event rule is
Instructions for collecting a plurality of event streams received from the plurality of user terminals;
An instruction for analyzing a pattern that event streams having a predetermined ratio among the collected plurality of event streams have in common; And
Instructions for generating the new event rule using the pattern,
Computing device. A computer readable recording medium having stored thereon a computer program for causing a computer to perform the method of any one of claims 1-30.

Images