WO2018028430A1 - 识别及辅助识别虚假流量的方法、装置及系统 - Google Patents

识别及辅助识别虚假流量的方法、装置及系统 Download PDF

Info

Publication number
WO2018028430A1
WO2018028430A1 PCT/CN2017/094423 CN2017094423W WO2018028430A1 WO 2018028430 A1 WO2018028430 A1 WO 2018028430A1 CN 2017094423 W CN2017094423 W CN 2017094423W WO 2018028430 A1 WO2018028430 A1 WO 2018028430A1
Authority
WO
WIPO (PCT)
Prior art keywords
traffic
data
feature data
false
access
Prior art date
Application number
PCT/CN2017/094423
Other languages
English (en)
French (fr)
Inventor
王鹏
王中要
徐萧萧
Original Assignee
阿里巴巴集团控股有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 阿里巴巴集团控股有限公司 filed Critical 阿里巴巴集团控股有限公司
Publication of WO2018028430A1 publication Critical patent/WO2018028430A1/zh
Priority to US16/271,654 priority Critical patent/US10848511B2/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H04L63/1416—Event detection, e.g. attack signature detection
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H04L63/1425—Traffic logging, e.g. anomaly detection
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
    • G06N20/00—Machine learning
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/14—Network analysis or design
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L43/00—Arrangements for monitoring or testing data switching networks
    • H04L43/06—Generation of reports
    • H04L43/062—Generation of reports related to network traffic
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H04L63/0227—Filtering policies
    • H04L63/0236—Filtering by address, protocol, port number or service, e.g. IP-address or URL
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H04L63/102—Entity profiles
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/01—Protocols

Definitions

  • the present application relates to the field of Internet technologies, and in particular, to a method, device, and system for identifying and assisting in identifying false traffic.
  • False traffic or machine traffic
  • This false traffic not only does not generate any commercial and social value, but also brings the availability and stability risks to the network server, which brings inconvenience to the access of normal users, and also brings a large error to the traffic analysis of the website. Therefore, it is necessary to identify false traffic in order to control the false traffic, prevent the above-mentioned effects on the network, and ensure normal user access and a better user experience.
  • the method for identifying the fake traffic is as follows: the client collects the network access traffic data, and sends the collected data to the server, and the server determines, according to the access traffic data, whether the access traffic is a false traffic.
  • the solution client extracts the feature data of the collected content and the related aspects of the collected network access traffic data, including: the URL, the access time, the ip, the login id, and the like, and sends the extracted feature data to the server.
  • the shortcoming of this scheme is that, due to the development of the brush flow technology and the interest industry, the performance of the script program in accessing content and means cannot be distinguished from the normal traffic. Therefore, it is difficult for the server to accurately identify the false based on the access content and means. flow.
  • Another solution client sends network access traffic detail data to the server.
  • the disadvantage of this solution is that the traffic volume sent to the server is obviously increased due to the increase of data storage volume, and the bandwidth is also higher, which even becomes a bottleneck of processing efficiency.
  • One of the technical problems solved by the present application is to provide a method, device and system for identifying and assisting in identifying false traffic, thereby realizing accurate identification of false traffic while reducing stress on network transmission.
  • a method for assisting in identifying false traffic comprising:
  • a method of identifying a false traffic comprising:
  • an apparatus for assisting in identifying false traffic comprising:
  • a collection unit for collecting network access traffic data
  • a statistical unit configured to collect preset feature data of the access traffic data
  • a sending unit configured to send the preset feature data to the server, so that the server identifies the fake traffic according to the preset feature data.
  • an apparatus for identifying spurious traffic comprising:
  • a preset feature data receiving unit configured to receive preset feature data of the access traffic data sent by the client;
  • the identifying unit inputs the preset feature data into the fake traffic identification model obtained by pre-training to obtain whether the access traffic data is a recognition result of the false traffic.
  • a system for identifying a fake traffic includes: a terminal device, configured to collect network access traffic data, and collect preset feature data of the access traffic data, and send The preset feature data is sent to the server, so that the server identifies the false traffic according to the preset feature data;
  • the server is configured to receive the preset feature data of the access traffic data sent by the client, and input the preset feature data into the fake traffic identification model obtained by the pre-training to obtain whether the access traffic data is a false traffic identification result.
  • the feature data required to identify the false traffic is determined in advance as the preset feature data, and the guest
  • the preset feature data of the network access traffic data collected by the client and the network access traffic is sent to the server.
  • the preset feature data needs to be obtained by the client based on the collected access traffic data, instead of the detailed data of the access traffic. It can not only accurately identify the false traffic, but also effectively reduce the amount of data transmitted by the client to the server, reducing the pressure on storage and transmission.
  • 1 is an implementation framework diagram for identifying false traffic according to an embodiment of the present application
  • FIG. 2 is a flow chart of a method of assisting in identifying false traffic in accordance with an embodiment of the present application
  • FIG. 3 is a flow chart of a method of identifying false traffic according to an embodiment of the present application.
  • FIG. 4 is a schematic structural diagram of an apparatus for assisting in identifying false traffic according to an embodiment of the present application
  • FIG. 5 is a schematic structural diagram of an apparatus for identifying a false traffic according to an embodiment of the present application.
  • FIG. 6 is a block diagram of a system for identifying false traffic according to an embodiment of the present application.
  • the computer device includes a user device and a network device.
  • the user equipment includes, but is not limited to, a computer, a smart phone, a PDA, etc.
  • the network device includes but is not limited to a single network server, a server group composed of multiple network servers, or a cloud computing based computer Or a network of web servers, Among them, cloud computing is a kind of distributed computing, a super virtual computer composed of a group of loosely coupled computers.
  • the computer device can be operated separately to implement the present application, and can also access the network and implement the application through interaction with other computer devices in the network.
  • the network in which the computer device is located includes, but is not limited to, the Internet, a wide area network, a metropolitan area network, a local area network, a VPN network, and the like.
  • the user equipment, the network equipment, the network, and the like are only examples, and other existing or future computer equipment or networks may be applicable to the present application, and should also be included in the scope of the present application. It is included here by reference.
  • the embodiment of the present application determines the feature data of the access traffic required for the server to identify the false traffic through the machine learning process of the offline big data, and the feature data determined by the machine learning process ensures the accuracy of identifying the false traffic. It can effectively reduce the amount of data transmitted by the client to the server, and improve the efficiency of data transmission and false traffic judgment.
  • FIG. 1 is a schematic diagram of an implementation of identifying a false traffic in the embodiment of the present application.
  • the client collects access traffic data, and the client includes but is not limited to: a PC, a PAD, a mobile terminal, and the like.
  • feature extraction and analysis are performed on the collected access traffic data, that is, the preset feature data of the access traffic data is obtained by statistics, and the preset feature data obtained by the statistics is transmitted to the server through the network, so that the server according to the pre- Let feature data identify false traffic.
  • the method is used for the client to collect feature data required for the server to identify false traffic, and send the feature data to the server, thereby assisting the server to identify the false traffic.
  • the method mainly includes the following steps:
  • the network access traffic data described in step S110 includes but is not limited to the following types of data:
  • the content of the website visited including but not limited to: the domain name of each website visited, the business content contained in the page, and the upstream and downstream relationship of the page.
  • the means used to access the website including but not limited to: PC or wireless, ip address, mac address, wifi name, wifimac address, sessionid, login id and other data.
  • the above user access habit data can identify false traffic from the user's operational behavior habits, and is more in line with the logic of the actual business scenario.
  • the preset feature data is determined by the machine learning process in step S120; the specific determining manner is determined by the machine learning process based on the large data amount when the server is offline.
  • the extraction of this feature is done by the client.
  • the preset feature data needs to be obtained by the client based on the collected access traffic data for statistical calculation, and is not the detailed data of the access traffic.
  • the preset feature data of the required statistics includes but is not limited to at least one of the following:
  • the preset duration for example, the number of pages accessed by the user and the number of page jumps within 1 second, 10 seconds, 20 seconds, or 1 minute.
  • the embodiment of the present application converts the network access traffic detail data with a large amount of storage into the access traffic feature data with a small amount of storage, thereby effectively reducing the storage and transmission pressure, and the preset feature data is determined based on machine learning. Therefore, based on the data, it is sufficient to accurately identify whether the access traffic is a false traffic.
  • the preset feature data when the machine learning determines the preset feature data, the preset feature data may be further determined.
  • the pre-judgment feature data is feature data with a larger weight in the preset feature data, that is, the pre-judgment feature data has a greater influence on the false traffic identification result.
  • the pre-judging rule corresponding to the predicted feature data may be a corresponding threshold range.
  • the predictive feature data includes: the number of pages accessed by the user, the duration of the keyboard tap, and the speed of the mouse slide.
  • the pre-judgment rule corresponding to the number of pages accessed by the user may be the threshold of the number of pages accessed by the user in a unit time; the pre-judging rule corresponding to the duration of the keyboard tap may be a keyboard tap duration threshold; the pre-judgment corresponding to the speed of the mouse sliding
  • the rule can slide the speed threshold by the mouse; to prevent false positives, the threshold corresponding to each pre-judgment rule is set higher to avoid accidentally killing the normal user's access behavior. Therefore, according to the predicted feature data, it is possible to initially identify whether the traffic is a false traffic.
  • the client may save the pre-judgment feature data and the pre-judgment rule corresponding to each pre-judgment feature data.
  • the fake traffic may be performed on the access traffic data according to the predicted feature data in the preset feature data and the pre-judgment rule corresponding to the predicted feature data.
  • the pre-control includes but is not limited to: human-machine verification, current limit control, and the like. For example, if the preliminary recognition result is a false traffic, the identification result is sent to the server, and the verification code returned by the server for performing the human-machine verification is received to implement the human-machine verification, or the client is locally generated for performing. Verification code for man-machine verification.
  • Step S130 is to send the preset feature data to the server, so that the server identifies the false traffic according to the preset feature data.
  • the client uses the pre-judgment feature data and the pre-judgment rule corresponding to the pre-judgment feature data to perform preliminary identification of the false traffic on the access traffic data, and the recognition result is a false traffic, and the recognition result may be used.
  • Sending to the server, sending the preset feature data to the server at the same time, or in order to alleviate the network transmission pressure, may only send the preliminary identification result without transmitting the preset feature data of the network access traffic that is initially identified as the false traffic.
  • the server may identify whether the network access traffic is a fake traffic according to the preset feature data, and send the identification result to the client.
  • the client determines whether the preliminary identification result is consistent with the identification result of the server for the network access traffic initially identified as the false traffic; that is, the initial identification is determined to be Whether the recognition result returned by the server corresponding to the access traffic of the fake traffic is a false traffic; if the identification result of the server is not a false traffic, the pre-control of the access traffic is released.
  • the pre-control of the access traffic is released, and if they are consistent, the pre-control of the access traffic is maintained, and further enforcement measures may be taken, for example, shielding the access traffic corresponding device.
  • further enforcement measures may be taken, for example, shielding the access traffic corresponding device.
  • the recognition result of the received server is inconsistent with the preliminary recognition result of the client, it indicates that the pre-judgment rule corresponding to the applied pre-judgment feature data is not accurate enough. In this case, the corresponding pre-judgment feature data may be adjusted.
  • Pre-judging rules For example, suppose the client initially identifies the access traffic according to the number of pages accessed by the user and the threshold of the number of pages accessed by the corresponding user unit time, and the preliminary identification result is false traffic. The threshold of the number of pages accessed by the user in the user unit is relatively loose, and the threshold of the number of pages accessed by the normal user can reach the threshold, and the threshold of the number of pages accessed by the user unit time needs to be raised.
  • an adjustment range may be preset, and the pre-judgment rule may be adjusted according to the preset adjustment range, or the pre-judgment feature parameter may be adjusted, that is, the pre-judgment of the participation pre-judgment is adjusted.
  • the feature data for example, the pre-judgment based on a pre-judgment feature data is not accurate enough, and the pre-judgment feature parameter is no longer used as the pre-judgment parameter.
  • the access traffic whose initial identification result is normal traffic after receiving the identification result returned by the server, it may determine whether it is a false traffic according to the identification result of the server, and further determine whether to control the access traffic.
  • FIG. 3 is a flowchart of a method for identifying a fake traffic according to an embodiment of the present application.
  • the method is used to perform a false traffic identification operation according to the preset feature data after receiving a preset feature data sent by a client.
  • the method mainly includes the following steps:
  • S210 Receive preset feature data of the access traffic data sent by the client.
  • S220 Input the preset feature data into a false traffic identification model obtained by pre-training to obtain whether the access traffic data is a recognition result of the false traffic.
  • the preset feature data in step S210 is determined by a machine learning process; the machine learning process may be performed offline at the server.
  • the machine learning process includes:
  • sample data is collected; existing false traffic marker data and normal access data can be used as sample data; it can be understood that the larger the sample data collected by the machine learning process, the higher the accuracy of the trained model. .
  • the embodiment of the present application can perform training based on a large amount of sample data offline. Therefore, the feature data required to identify the false traffic and the weight of each feature data can be accurately determined, and the feature data with larger weight can be further determined as a pre-judgment.
  • the feature data for example, the feature data whose weight exceeds the preset weight threshold is determined as the pre-judgment feature data.
  • the pre-judgment rule corresponding to each pre-judgment feature data may be determined, and the pre-judgment rule is as described in the previous embodiment, and details are not described herein again.
  • the determined preset feature data, the pre-judgment feature data, and the pre-judgment rule corresponding to each pre-judgment feature data may be sent to the client and saved in the client.
  • the preset feature data of the extracted sample data is input into the false traffic recognition model to be trained;
  • the required feature data is predetermined, so that the weight of each feature data is determined by the training process.
  • the preset feature data can be continuously updated according to actual conditions on the line, and the fake traffic identification model is trained based on the updated preset feature data.
  • the false traffic identification model outputs a false traffic identification result, and at the same time determines the preset feature data required by the false traffic recognition model and the weight of each feature data.
  • the false traffic identification result may be a probability that the access traffic is a false traffic.
  • the access traffic may be considered to be a false traffic. That is, a probability threshold is preset to determine whether the probability that the access traffic output by the false traffic identification model is a false traffic reaches the probability threshold. If the probability threshold is reached, the access traffic is determined to be a false traffic, otherwise it is not a false traffic.
  • the content of the website accessed by the user including the number of pages accessed by the user and the number of page jumps;
  • the means used by the user to access the website includes: the network ip, mac, wifimac, sessionid, and login id that the user initiates the access request through the client; wherein the counted number of pages accessed by the user and the number of page jumps may be preset durations Within the scope, for example, the number of pages accessed by the user and the number of page jumps within 1 second, 10 seconds, or 20 seconds.
  • the time period distribution sequence of the user accessing different types of pages the average page access duration, and the variance of the page access duration.
  • the input time interval mean and variance of consecutive characters when entering a character string in the user text box, the mean and variance of the duration of the tap key of different characters, the key sequence and time interval of the specific character combination input by the user, and the duration of the keyboard stroke.
  • the mean and variance of the user's mouse wheel scrolling the mean and variance of the wheel time interval, and the mean and variance of the scrolling range (screen number) of the wheel.
  • the feature data determined by the above-mentioned machine learning includes the access content and the access means, and the user's operation behavior habits, so that the logic of the actual business scenario is more suitable, and the data amount is sufficient for the server to identify the false traffic, and is effectively reduced. Smaller pressure on network transmission.
  • Step S220 is a process of identifying a false traffic based on the preset feature data received from the client, and inputting the preset feature data into a false traffic identification model obtained by offline training to obtain whether the access traffic data is a false traffic. Identify the results.
  • the server can locally save the preset feature data whose recognition result is false traffic, so as to perform corresponding control according to the subsequent access traffic of the device corresponding to the fake traffic.
  • the control includes, but is not limited to, multiple verification, current limit control, and even mask control.
  • the server sends the identification result to the client, so that the client controls the access traffic according to the identification result.
  • An embodiment of the present application is directed to a scenario in which a client sends preset feature data of all access traffic to a server, that is, a preset feature data that the server receives all access traffic (including a preliminary identification result that is a false traffic access). And the preset feature data of the traffic may send the identification result to the client, so that the client controls or releases the access traffic according to the recognition result. That is, all identification results (including the recognition result as normal traffic and false traffic) are sent to the client.
  • the scenario that the client sends the preset feature data of all the access traffic to the server that is, the server receives the preset feature data of all the access traffic (including the initial identification result is the access of the fake traffic). If the preliminary identification result is received at the same time, and the preliminary recognition result is received at the same time, after the recognition result is obtained, whether the comparison result is compared with the preliminary recognition result received from the client is consistent, and if not, the identification is sent. The result is to the client. It can be seen from the introduction of the foregoing embodiment that the client only sends the preliminary identification result that is the preliminary identification result to the false traffic to the server, and the server determines the server identification result after obtaining the recognition result that the preliminary identification result is the false traffic.
  • the client may not send the recognition result. If the recognition result is not a false traffic, it indicates that the initial identification of the client is misjudged.
  • the recognition result is sent to the client to release the pre-control. This not only achieves timely control of false traffic, but also effectively avoids false positives. That is, the preliminary identification of the false traffic of the access traffic data by the pre-judging rule corresponding to the pre-judgment feature data and the pre-judgment feature data in the preset feature data sent by the receiving client in this embodiment After the result is identified, whether the recognition result of the false traffic identification model is consistent with the preliminary identification result, and if not, the identification result is sent to the client.
  • the pre-judgment rule corresponding to the pre-judgment feature data may be adjusted, and the adjusted pre-judgment corresponding to the pre-judgment feature data is sent. Rules are given to the client.
  • the adjustment amplitude value and the pre-judgment characteristic parameter of each pre-judgment rule may be preset, and the pre-judgment rule is adjusted according to the amplitude value and the pre-judgment characteristic parameter.
  • the client only sends the preliminary identification result to the server end corresponding to the normal traffic corresponding to the normal traffic
  • the identification result may be obtained, only the recognition result of the fake traffic may be sent to the client.
  • the identification result may be recorded, and the subsequent traffic of the device corresponding to the false traffic is controlled. That is, for this scenario, the initial recognition result of the client is directly accepted.
  • the embodiment of the present application further provides an apparatus for assisting in identifying false traffic corresponding to the foregoing method for assisting in identifying false traffic.
  • the schematic structure of the device is as shown in FIG. 4, and the device mainly includes the following units:
  • the collecting unit 310 is configured to collect network access traffic data.
  • the statistic unit 320 is configured to collect preset feature data of the access traffic data; the preset feature data is determined by a machine learning process.
  • the sending unit 330 is configured to send the preset feature data to the server, so that the server identifies the fake traffic according to the preset feature data.
  • the device also includes:
  • the preliminary identification unit 340 is configured to perform preliminary identification of the false traffic on the access traffic data according to the predicted feature data in the preset feature data and the pre-judging rule corresponding to the predicted feature data, to obtain a preliminary recognition result;
  • the pre-control unit 350 is configured to pre-control the access traffic if the preliminary recognition result is a false traffic.
  • the device also includes:
  • the receiving unit 360 is configured to receive, by the server, whether the access traffic returned by the server is a recognition result of a false traffic.
  • the determining unit 370 is configured to determine whether the recognition result returned by the server corresponding to the access traffic whose initial recognition result is a false traffic is a false traffic;
  • the pre-control unit 380 is configured to release the pre-control of the access traffic when the determining unit determines that the recognition result is not a false traffic.
  • the device also includes:
  • the adjusting unit 390 is configured to adjust a pre-judging rule corresponding to the predicted feature data when the determining unit determines that the recognition result is not a false traffic.
  • the device also includes:
  • the preliminary identification result sending unit 3110 is configured to send a preliminary identification result that is a preliminary identification result to the server.
  • the embodiment of the present application further provides an apparatus for identifying a false traffic corresponding to the foregoing method for identifying a false traffic.
  • the schematic structure of the device is as shown in FIG. 5, and the device mainly includes the following units:
  • the preset feature data receiving unit 410 is configured to receive preset feature data of the access traffic data sent by the client; the preset feature data is determined by a machine learning process.
  • the identifying unit 420 is configured to input the preset feature data into a false traffic identification model obtained by pre-training to obtain whether the access traffic data is a recognition result of the false traffic.
  • the recognition result includes:
  • the device also includes:
  • the sending unit 430 is configured to send the identification result to the client.
  • the device also includes:
  • the preliminary identification result receiving unit 440 is configured to receive, by the client, a preliminary identification of the false traffic according to the pre-judgment feature data in the preset feature data and the pre-judgment rule corresponding to the pre-judgment feature data Preliminary identification result;
  • the comparison unit 450 is configured to compare whether the recognition result of the false flow identification model is consistent with the preliminary identification result
  • the adjusting unit 460 is configured to adjust a pre-judging rule corresponding to the predicted feature data when the recognition result of the false traffic identification model is inconsistent with the preliminary identification result;
  • the pre-judgment rule sending unit 470 is configured to send the pre-judgment rule corresponding to the adjusted pre-judgment feature data to the client.
  • FIG. 6 is a schematic structural diagram of a system for identifying a fake traffic according to an embodiment of the present disclosure.
  • the system includes: a terminal device 610, configured to collect network access traffic data, and collect preset feature data of the access traffic data, and send a Presetting characteristic data to the server, so that the server identifies the false traffic according to the preset feature data;
  • the server 620 is configured to receive the preset feature data of the access traffic data sent by the client, and input the preset feature data into the fake traffic identification model obtained by the pre-training to obtain whether the access traffic data is a false traffic identification result. .
  • the embodiment of the present application determines the feature data required to identify the false traffic as a preset feature.
  • Data the preset feature data of the network access traffic data collected by the client and the network access traffic is sent to the server, and the preset feature data needs the client to obtain the statistical calculation based on the collected access traffic data, instead of accessing the traffic.
  • Detailed data can not only accurately identify false traffic, but also effectively reduce the amount of data transmitted by the client to the server, reducing the pressure on storage and transmission.
  • the present application can be implemented in software and/or a combination of software and hardware, for example, using an application specific integrated circuit (ASIC), a general purpose computer, or any other similar hardware device.
  • the software program of the present application can be executed by a processor to implement the steps or functions described above.
  • the software programs (including related data structures) of the present application can be stored in a computer readable recording medium such as a RAM memory, a magnetic or optical drive or a floppy disk and the like.
  • some of the steps or functions of the present application may be implemented in hardware, for example, as a circuit that cooperates with a processor to perform various steps or functions.
  • a portion of the present application can be applied as a computer program product, such as computer program instructions, which, when executed by a computer, can invoke or provide a method and/or technical solution in accordance with the present application.
  • the program instructions for invoking the method of the present application may be stored in a fixed or removable recording medium, and/or transmitted by a data stream in a broadcast or other signal bearing medium, and/or stored in a The working memory of the computer device in which the program instructions are run.
  • an embodiment in accordance with the present application includes a device including a memory for storing computer program instructions and a processor for executing program instructions, wherein when the computer program instructions are executed by the processor, triggering
  • the apparatus operates based on the aforementioned methods and/or technical solutions in accordance with various embodiments of the present application.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Security & Cryptography (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Computer Hardware Design (AREA)
  • Theoretical Computer Science (AREA)
  • Software Systems (AREA)
  • Evolutionary Computation (AREA)
  • Data Mining & Analysis (AREA)
  • Medical Informatics (AREA)
  • Computer Vision & Pattern Recognition (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Mathematical Physics (AREA)
  • Artificial Intelligence (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)
  • Telephonic Communication Services (AREA)
  • Computer And Data Communications (AREA)

Abstract

本申请提供了一种识别及辅助识别虚假流量的方法、装置及系统，所述辅助识别虚假流量的方法包括：收集网络访问流量数据；统计所述访问流量数据的预设特征数据；发送所述预设特征数据给服务器，以便服务器依据所述预设特征数据识别虚假流量。所述识别虚假流量的方法包括：接收客户端发送的访问流量数据的预设特征数据；将所述预设特征数据输入预先训练获得的虚假流量识别模型，以得到所述访问流量数据是否为虚假流量的识别结果。本申请实现了准确识别虚假流量的同时减轻对网络传输造成的压力。

Description

识别及辅助识别虚假流量的方法、装置及系统
本申请要求2016年08月08日递交的申请号为201610645819.2、发明名称为“识别及辅助识别虚假流量的方法、装置及系统”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及互联网技术领域，尤其涉及一种识别及辅助识别虚假流量的方法、装置及系统。
背景技术
虚假流量即机器流量，是恶意访问者通过脚本程序自动频繁地向网络服务器发送请求。该虚假流量不仅不产生任何商业和社会价值，还给网络服务器带来可用性和稳定性风险，给正常用户的访问也带来了不便，同时也对网站的流量分析带来了较大的误差。因此，需要识别出虚假流量，以便对虚假流量进行控制，防止对网络产生的上述影响，保证正常用户的访问和更好的用户体验。
目前，识别虚假流量的方法为：客户端收集网络访问流量数据，将收集到的数据发送到服务器端，服务器根据这些访问流量数据来判断该访问流量是否为虚假流量。
其中，一种方案客户端提取所收集的网络访问流量数据的访问内容和手段相关方面的特征数据，包括：网址、访问时间、ip、登陆id等数据，将提取的特征数据发送给服务器端。该方案的缺点在于：由于随着刷流量技术和利益产业的发展，脚本程序在访问内容和手段上的表现已无法和正常流量区分，因此，服务器端基于访问内容和手段很难准确识别出虚假流量。
另一种方案客户端将网络访问流量明细数据发送给服务器端。该方案的缺点在于：由于发送给服务器端的访问流量明显数据存储量的增长导致数据传输的压力越来越大，对带宽也有了更高的要求，甚至成为了处理效率的瓶颈。
可见，已有的虚假流量识别方案中存在着数据量不足无法准确识别虚假流量的问题，或者数据量过大给网络传输造成压力的问题。因此有必要提供一种新的识别虚假流量的方案，以实现准确识别虚假流量的同时减轻对网络传输造成的压力。
发明内容
本申请解决的技术问题之一是提供一种识别及辅助识别虚假流量的方法、装置及系统，实现了准确识别虚假流量的同时减轻对网络传输造成的压力。
根据本申请一方面的一个实施例，提供了一种辅助识别虚假流量的方法，所述方法包括：
收集网络访问流量数据；
统计所述访问流量数据的预设特征数据；
发送所述预设特征数据给服务器，以便服务器依据所述预设特征数据识别虚假流量。
根据本申请另一方面的一个实施例，提供了一种识别虚假流量的方法，所述方法包括：
接收客户端发送的访问流量数据的预设特征数据；
将所述预设特征数据输入预先训练获得的虚假流量识别模型，以得到所述访问流量数据是否为虚假流量的识别结果。
根据本申请另一方面的一个实施例，提供了一种辅助识别虚假流量的装置，所述装置包括：
收集单元，用于收集网络访问流量数据；
统计单元，用于统计所述访问流量数据的预设特征数据；
发送单元，用于发送所述预设特征数据给服务器，以便服务器依据所述预设特征数据识别虚假流量。
根据本申请另一方面的一个实施例，提供了一种识别虚假流量的装置，所述装置包括：
预设特征数据接收单元，用于接收客户端发送的访问流量数据的预设特征数据；
识别单元，用将所述预设特征数据输入预先训练获得的虚假流量识别模型，以得到所述访问流量数据是否为虚假流量的识别结果。
根据本申请另一方面的一个实施例，提供了一种识别虚假流量的系统，所述系统包括：终端设备，用于收集网络访问流量数据，统计所述访问流量数据的预设特征数据，发送所述预设特征数据给服务器，以便服务器依据所述预设特征数据识别虚假流量；
服务器，用于接收客户端发送的访问流量数据的预设特征数据，将所述预设特征数据输入预先训练获得的虚假流量识别模型，以得到所述访问流量数据是否为虚假流量的识别结果。
本申请实施例通过预先确定识别虚假流量所需的特征数据作为预设特征数据，由客 户端收集网络访问流量数据并统计网络访问流量的预设特征数据发送给服务器端，该预设特征数据需要客户端基于所收集的访问流量数据进行统计计算获得，而并非访问流量的明细数据，既能满足准确识别虚假流量，同时有效降低了客户端传输给服务器端的数据量，减轻了存储及传输的压力。
本领域普通技术人员将了解，虽然下面的详细说明将参考图示实施例、附图进行，但本申请并不仅限于这些实施例。而是，本申请的范围是广泛的，且意在仅通过后附的权利要求限定本申请的范围。
附图说明
通过阅读参照以下附图所作的对非限制性实施例所作的详细描述，本申请的其它特征、目的和优点将会变得更明显：
图1是根据本申请一个实施例的识别虚假流量的实现框架图；
图2是根据本申请一个实施例的辅助识别虚假流量的方法的流程图；
图3是根据本申请一个实施例的识别虚假流量的方法的流程图；
图4是根据本申请一个实施例的辅助识别虚假流量的装置的结构示意图；
图5是根据本申请一个实施例的识别虚假流量的装置的结构示意图；
图6是根据本申请一个实施例的识别虚假流量的系统的架构示意图。
本领域普通技术人员将了解，虽然下面的详细说明将参考图示实施例、附图进行，但本申请并不仅限于这些实施例。而是，本申请的范围是广泛的，且意在仅通过后附的权利要求限定本申请的范围。
具体实施方式
在更加详细地讨论示例性实施例之前应当提到的是，一些示例性实施例被描述成作为流程图描绘的处理或方法。虽然流程图将各项操作描述成顺序的处理，但是其中的许多操作可以被并行地、并发地或者同时实施。此外，各项操作的顺序可以被重新安排。当其操作完成时所述处理可以被终止，但是还可以具有未包括在附图中的附加步骤。所述处理可以对应于方法、函数、规程、子例程、子程序等等。
所述计算机设备包括用户设备与网络设备。其中，所述用户设备包括但不限于电脑、智能手机、PDA等；所述网络设备包括但不限于单个网络服务器、多个网络服务器组成的服务器组或基于云计算(Cloud Computing)的由大量计算机或网络服务器构成的云， 其中，云计算是分布式计算的一种，由一群松散耦合的计算机集组成的一个超级虚拟计算机。其中，所述计算机设备可单独运行来实现本申请，也可接入网络并通过与网络中的其他计算机设备的交互操作来实现本申请。其中，所述计算机设备所处的网络包括但不限于互联网、广域网、城域网、局域网、VPN网络等。
需要说明的是，所述用户设备、网络设备和网络等仅为举例，其他现有的或今后可能出现的计算机设备或网络如可适用于本申请，也应包含在本申请保护范围以内，并以引用方式包含于此。
后面所讨论的方法(其中一些通过流程图示出)可以通过硬件、软件、固件、中间件、微代码、硬件描述语言或者其任意组合来实施。当用软件、固件、中间件或微代码来实施时，用以实施必要任务的程序代码或代码段可以被存储在机器或计算机可读介质(比如存储介质)中。(一个或多个)处理器可以实施必要的任务。
这里所公开的具体结构和功能细节仅仅是代表性的，并且是用于描述本申请的示例性实施例的目的。但是本申请可以通过许多替换形式来具体实现，并且不应当被解释成仅仅受限于这里所阐述的实施例。
应当理解的是，虽然在这里可能使用了术语“第一”、“第二”等等来描述各个单元，但是这些单元不应当受这些术语限制。使用这些术语仅仅是为了将一个单元与另一个单元进行区分。举例来说，在不背离示例性实施例的范围的情况下，第一单元可以被称为第二单元，并且类似地第二单元可以被称为第一单元。这里所使用的术语“和/或”包括其中一个或更多所列出的相关联项目的任意和所有组合。
应当理解的是，当一个单元被称为“连接”或“耦合”到另一单元时，其可以直接连接或耦合到所述另一单元，或者可以存在中间单元。与此相对，当一个单元被称为“直接连接”或“直接耦合”到另一单元时，则不存在中间单元。应当按照类似的方式来解释被用于描述单元之间的关系的其他词语(例如“处于...之间”相比于“直接处于...之间”，“与...邻近”相比于“与...直接邻近”等等)。
这里所使用的术语仅仅是为了描述具体实施例而不意图限制示例性实施例。除非上下文明确地另有所指，否则这里所使用的单数形式“一个”、“一项”还意图包括复数。还应当理解的是，这里所使用的术语“包括”和/或“包含”规定所陈述的特征、整数、步骤、操作、单元和/或组件的存在，而不排除存在或添加一个或更多其他特征、整数、步骤、操作、单元、组件和/或其组合。
还应当提到的是，在一些替换实现方式中，所提到的功能/动作可以按照不同于附图 中标示的顺序发生。举例来说，取决于所涉及的功能/动作，相继示出的两幅图实际上可以基本上同时执行或者有时可以按照相反的顺序来执行。
本申请发明人在对已有识别虚假流量的技术方案进行分析过程中发现，已有技术在识别虚假流量时，由于无法准确确定服务器端识别虚假流量所需的网络访问流量数据的特征信息，导致发送给服务器端的数据量不足或者数据量过大，从而造成服务器端无法准确识别虚假流量，或者对网络传输造成压力，造成处理效率的性能瓶颈。本申请实施例为克服该问题通过离线大数据的机器学习过程确定服务器端识别虚假流量所需的访问流量的特征数据，该机器学习过程所确定的特征数据既保证了识别虚假流量的准确性，又能有效减少客户端传送给服务器端的数据量，提升了数据传输以及虚假流量判断的效率。
下面结合附图对本申请的技术方案作进一步详细描述。
图1是本申请实施例识别虚假流量的实现框架图，由图1可以看出，客户端收集访问流量数据，所述客户端包括但不限于：PC、PAD、移动终端等。之后，针对收集的访问流量数据进行特征提取和分析，也就是统计获得所述访问流量数据的预设特征数据，再将统计获得的预设特征数据通过网络传输给服务器，以便服务器依据所述预设特征数据识别虚假流量。
图2是根据本申请一个实施例的辅助识别虚假流量的方法的流程图，该方法用于客户端收集服务器端识别虚假流量所需的特征数据发送给服务器端，从而辅助服务器端识别虚假流量，所述方法主要包括如下步骤：
S110、收集网络访问流量数据；
S120、统计所述访问流量数据的预设特征数据；
S130、发送所述预设特征数据给服务器，以便服务器依据所述预设特征数据识别虚假流量。
下面对上述各步骤做进一步详细介绍。
步骤S110中所述的网络访问流量数据包括但不限于如下几类数据：
(1)所访问的网站内容，包括但不限于：所访问网站的各级域名，页面所包含的业务内容，页面的跳转上下游关系等数据。
(2)访问网站所使用的手段，包括但不限于：PC or无线，ip地址，mac地址，wifi名称，wifimac地址，sessionid，登陆id等数据。
(3)用户访问习惯数据，包括但不限于：访问每个页面的具体时刻及停留时长，文 本框输入的字符内容、顺序、具体时刻及敲击按键时长，访问时鼠标划动轨迹坐标及具体时刻，访问时滚轮滚动具体时刻及幅度，用户使用触屏设备时手指滑动和拖动的幅度及具体时刻等数据。
上述用户访问习惯数据能够从用户的操作行为习惯上来识别虚假流量，更加符合实际业务场景的逻辑。
步骤S120所述预设特征数据为通过机器学习过程确定；具体确定方式为：服务器在离线时基于大数据量的机器学习过程所确定。由客户端完成该特征的提取。该预设特征数据需要客户端基于所收集的访问流量数据进行统计计算获得，而并非访问流量的明细数据。所需统计的预设特征数据包括但不限于如下至少一项：
a.统计用户访问的页面数，页面跳转次数，用户通过客户端发起访问请求的网络ip，mac，wifimac，sessionid，登陆id；其中，所统计的用户访问的页面数及页面跳转次数可以为预设时长范围内，例如，1秒、10秒、20秒或1分钟内用户访问的页面数及页面跳转次数。
b.计算用户访问不同类型页面的时间段分布序列，页面访问时长平均值，页面访问时长方差。
c.计算用户文本框输入字符串时连续字符的输入时间间隔均值和方差，输入不同字符的敲击按键的时长均值和方差，用户输入特定字符组合的按键顺序和时间间隔、键盘敲击的时长(敲击一个键的持续时长)。
d.计算用户鼠标划动轨迹的X轴和Y轴两个方向的坐标最大和最小值，鼠标滑动的速度，计算用户最频繁出现的屏幕相对位置区域的频率。
e.计算用户鼠标滚轮滚动时长的均值和方差，两次滚轮时间间隔的均值和方差，滚轮滚动幅度(屏数)的均值和方差。
f.计算用户操作触屏设备时手指滑动和拖动的幅度(屏数)的均值和方差，页面跳转时用户手指滑动和拖动的时长均值和方差，页面跳转时间间隔均值和方差。
可见，本申请实施例将存储量较大的网络访问流量明细数据转换为存储量较少的访问流量特征数据，有效降低了存储及传输压力，且该预设特征数据为基于机器学习所确定，因此依据该数据足以准确识别该访问流量是否为虚假流量。
可以理解的是，上述预设特征数据仅为发明人所列举的几种实例，而本申请实施例并不局限于此，具体的特征数量更多，而且具体使用哪些是由机器学习算法来决定。
本申请实施例在机器学习确定预设特征数据时，可进一步确定上述预设特征数据中 的预判特征数据及预判特征数据对应的预判规则。所述预判特征数据为所述预设特征数据中权重较大的特征数据，也就是该预判特征数据对虚假流量识别结果影响较大。所述预判特征数据对应的预判规则可以为对应的阈值范围。例如，所述预判特征数据包括：用户访问的页面数、键盘敲击的时长及鼠标滑动的速度。用户访问的页面数对应的预判规则可以为用户单位时间内访问的页面数的阈值；键盘敲击的时长对应的预判规则可以为一键盘敲击时长阈值；鼠标滑动的速度对应的预判规则可以鼠标滑动速度阈值；为防止误判，会将各预判规则对应的阈值设置的较高，避免误杀正常用户的访问行为。从而根据该预判特征数据即可初步识别该流量是否为虚假流量。客户端可以保存所述预判特征数据及各预判特征数据对应的预判规则。从而在统计所述访问流量数据的预设特征数据后，可根据所述预设特征数据中的预判特征数据及所述预判特征数据对应的预判规则对所述访问流量数据进行虚假流量的初步识别，得到初步识别结果。若所述初步识别结果为是虚假流量，则可对所述访问流量进行预控制。所述预控制包括但不限于：人机验证、限流控制等。例如，在初步识别结果为是虚假流量的情况下，将该识别结果发送给服务器，并接收服务器返回的用于进行人机验证的验证码以实现人机验证，或者客户端本地产生用于进行人机验证的验证码。
步骤S130为发送所述预设特征数据给服务器，以便服务器依据所述预设特征数据识别虚假流量。其中，对于客户端利用预判特征数据及所述预判特征数据对应的预判规则对所述访问流量数据进行虚假流量的初步识别，且识别结果为是虚假流量的情况，可以将该识别结果发送给服务器，同时发送所述预设特征数据给服务器，或者为减轻网络传输压力，可以仅发送该初步识别结果，而不发送该被初步识别为虚假流量的网络访问流量的预设特征数据。
本申请实施例在将预设特征数据发送给服务器后，服务器可依据该预设特征数据识别该网络访问流量是否为虚假流量，并将识别结果发送给客户端。客户端接收该服务器返回的所述访问流量是否为虚假流量的识别结果后，针对初步识别为虚假流量的网络访问流量，判断初步识别结果与服务器的识别结果是否一致；也就是判断初步识别为是虚假流量的访问流量所对应的所述服务器返回的识别结果是否为是虚假流量；若服务器的识别结果不是虚假流量，则解除对所述访问流量的预控制。也就是服务器与客户端的初步识别结果不一致，则解除对上述访问流量的预控制，若一致，则保持对该访问流量的预控制，并可进一步采取强制控制措施，例如，屏蔽该访问流量对应设备的后续访问流量。
另外，若所接收的服务器的识别结果与客户端的初步识别结果不一致，则说明所应用的预判特征数据对应的预判规则不够准确，在此情况下，可调整所述预判特征数据对应的预判规则。例如，假设客户端依据用户访问的页面数及对应的用户单位时间内访问的页面数的阈值对访问流量进行初步识别，初步识别结果为是虚假流量。而接收的服务器返回的识别结果为不是虚假流量，则说明该用户单位时间访问的页面数的阈值较宽松，正常用户的访问可以达到该阈值，需要提升该用户单位时间访问的页面数的阈值。针对每一预判特征数据的预判规则可预先设置一调整幅度，则可按照该预先设置的调整幅度调整所述预判规则，或者调整预判特征参数，也就是调整参与预判的预判特征数据，例如，根据一预判特征数据进行预判不够准确，不再利用该预判特征参数作为预判参数。
可以理解的是，针对初步识别结果为正常流量的访问流量，在接收到服务器返回的识别结果后，可根据该服务器的识别结果确定是否为虚假流量，进而确定是否对该访问流量进行控制。
图3是根据本申请一个实施例的识别虚假流量的方法的流程图，该方法用于服务器接收到客户端发送的预设特征数据后，依据该预设特征数据执行虚假流量的识别操作，所述方法主要包括如下步骤：
S210、接收客户端发送的访问流量数据的预设特征数据；
S220、将所述预设特征数据输入预先训练获得的虚假流量识别模型，以得到所述访问流量数据是否为虚假流量的识别结果。
下面对上述各步骤做进一步详细介绍。
步骤S210所述预设特征数据为通过机器学习过程确定；所述的机器学习的过程可以在服务器离线执行。所述机器学习过程包括：
首先，收集样本数据；可将已有的虚假流量标记数据以及正常访问数据作为样本数据；可以理解的是，机器学习过程所收集的样本数据数量越大，则所训练的模型的准确性越高。本申请实施例可离线进行基于大量的样本数据进行训练，因此，可准确确定出识别虚假流量所需的特征数据，以及各特征数据的权重，并可进一步确定权重较大的特征数据为预判特征数据，例如，将权重超过预设权重阈值的特征数据确定为预判特征数据。同时可确定各预判特征数据对应的预判规则，所述预判规则如前面实施例中所述，此处不再赘述。所确定的预设特征数据、预判特征数据以及各预判特征数据对应的预判规则可发送给客户端，并保存在客户端。
之后，提取样本数据的预设特征数据输入到待训练的虚假流量识别模型中；
也就是，在训练虚假流量识别模型时，预先确定所需要的特征数据，从而通过训练过程确定各特征数据的权重大小。可以理解的是，可根据线上实际情况，不断更新所述预设特征数据，并基于更新的预设特征数据训练所述虚假流量识别模型。
最后，所述虚假流量识别模型输出虚假流量识别结果，同时确定了所述虚假流量识别模型所需要的预设特征数据以及各特征数据的权重。其中，该虚假流量识别结果可以为访问流量是虚假流量的概率。当该概率到达预设概率阈值时，可以认为该访问流量为虚假流量。也就是预置一个概率阈值，判断虚假流量识别模型输出的该访问流量为虚假流量的概率是否达到该概率阈值，若达到该概率阈值，则确定该访问流量为虚假流量，否则不是虚假流量。
本申请一种实施例离线通过机器学习过程所确定的预设特征数据包括但不限于：
用户所访问的网站内容，包括：用户访问的页面数，页面跳转次数；
用户访问网站所使用的手段，包括：用户通过客户端发起访问请求的网络ip，mac，wifimac，sessionid，登陆id；其中，所统计的用户访问的页面数及页面跳转次数可以为预设时长范围内，例如，1秒、10秒或20秒内用户访问的页面数及页面跳转次数。
用户访问习惯数据，包括：
用户访问不同类型页面的时间段分布序列，页面访问时长平均值，页面访问时长方差。
用户文本框输入字符串时连续字符的输入时间间隔均值和方差，输入不同字符的敲击按键的时长均值和方差，用户输入特定字符组合的按键顺序和时间间隔、键盘敲击的时长。
用户鼠标划动轨迹的X轴和Y轴两个方向的坐标最大和最小值，鼠标滑动的速度、计算用户最频繁出现的屏幕相对位置区域的概率。
用户鼠标滚轮滚动的时长均值和方差，滚轮时间间隔均值和方差，滚轮滚动幅度(屏数)的均值和方差。
用户手指滑动和拖动的幅度(屏数)的均值和方差，页面跳转时用户手指滑动和拖动的时长均值和方差，页面跳转时间间隔均值和方差。
上述基于机器学习所确定的特征数据即包含访问内容及访问手段，又包含用户的操作行为习惯，因此更加符合实际业务场景的逻辑，该数据量足以满足服务器端识别虚假流量所需，又有效减小了对网络传输造成压力。
步骤S220为线上基于从客户端接收的预设特征数据识别虚假流量的过程，将所述预设特征数据输入离线训练获得的虚假流量识别模型，以得到所述访问流量数据是否为虚假流量的识别结果。
服务器端本地可保存识别结果为虚假流量的预设特征数据，以便根据对虚假流量对应的设备的后续访问流量进行相应控制。所述控制包括但不限于：多重校验、限流控制甚至屏蔽控制等。或者服务器端将识别结果发送给客户端，以便客户端根据该识别结果对访问流量进行控制。
本申请一种实施例针对客户端将所有访问流量的预设特征数据均发送给服务器端的场景，也就是服务器端接收到所有访问流量的预设特征数据(包括初步识别结果为是虚假流量的访问流量的预设特征数据)，可发送所述识别结果给所述客户端，以便所述客户端根据所述识别结果对所述访问流量进行控制或解除预控制。也就是将所有识别结果(包括识别结果为正常流量和虚假流量)均发送给客户端。
另一种实施例，针对客户端将所有访问流量的预设特征数据均发送给服务器端的场景，也就是服务器端接收到所有访问流量的预设特征数据(包括初步识别结果为是虚假流量的访问流量的预设特征数据)，且同时接收到初步识别结果，则在得到识别结果后，可将该识别结果与从客户端接收的初步识别结果进行比对是否一致，若不一致，则发送该识别结果给客户端。由前面实施例的介绍可知，客户端仅将初步识别结果为是虚假流量的初步识别结果发送给服务器，则服务器端在得到该初步识别结果为是虚假流量的识别结果后，判断服务器的识别结果是否也是虚假流量，若是虚假流量，由于此时客户端已经对该虚假流量进行了预控制，则可以不发送给识别结果，若识别结果为不是虚假流量，说明客户端的初步识别出现误判，则将识别结果发送给客户端，以解除所述预控制。这样既实现了虚假流量的及时控制，又有效避免了误判现象。也就是本实施例中在接收客户端发送的根据所述预设特征数据中的预判特征数据及所述预判特征数据对应的预判规则对所述访问流量数据进行虚假流量初步识别的初步识别结果后，比对所述虚假流量识别模型的识别结果与所述初步识别结果是否一致，若不一致，则发送识别结果给客户端。
可以理解的是，对于未接收到初步识别结果的访问流量，可以仅发送是虚假流量的识别结果，也可以所有识别结果给客户端。
另外，本申请实施例在虚假流量识别模型的识别结果与初步识别结果不一致情况下，可以调整预判特征数据对应的预判规则，并发送调整后的所述预判特征数据对应的预判 规则给所述客户端。可以预置各预判规则的调整幅度值及预判特征参数，根据该幅度值及预判特征参数调整预判规则。
又一种实施例，针对客户端仅将初步识别结果为正常流量对应的预设特征数据发送给服务器端的情况，在得到识别结果后，可以仅将虚假流量的识别结果发送给客户端。而对于接收的是虚假流量的初步识别结果，可以记录该识别结果，并对该虚假流量对应设备的后续流量进行控制。也就是针对此场景，直接接受客户端的初步识别结果。
本申请实施例还提供一种与上述辅助识别虚假流量的方法对应的辅助识别虚假流量的装置，所述装置结构示意图如图4所示，所述装置主要包括如下单元：
收集单元310，用于收集网络访问流量数据；
统计单元320，用于统计所述访问流量数据的预设特征数据；所述预设特征数据为通过机器学习过程确定。
发送单元330，用于发送所述预设特征数据给服务器，以便服务器依据所述预设特征数据识别虚假流量。
所述装置还包括：
初步识别单元340，用于根据所述预设特征数据中的预判特征数据及所述预判特征数据对应的预判规则对所述访问流量数据进行虚假流量的初步识别，得到初步识别结果；
预控制单元350，用于在所述初步识别结果为是虚假流量情况下，对所述访问流量进行预控制。
所述装置还包括：
接收单元360，用于接收所述服务器返回的所述访问流量是否为虚假流量的识别结果；
判断单元370，用于判断初步识别结果为是虚假流量的访问流量所对应的所述服务器返回的识别结果是否为是虚假流量；
解除预控制单元380，用于在所述判断单元判断所述识别结果不是虚假流量情况下，解除对所述访问流量的预控制。
所述装置还包括：
调整单元390，用于在所述判断单元判断所述识别结果不是虚假流量情况下，调整所述预判特征数据对应的预判规则。
所述装置还包括：
初步识别结果发送单元3110，用于发送初步识别结果为是虚假流量的初步识别结果给所述服务器。
本申请实施例还提供一种与上述识别虚假流量的方法对应的识别虚假流量的装置，所述装置结构示意图如图5中所示，所述装置主要包括如下单元：
预设特征数据接收单元410，用于接收客户端发送的访问流量数据的预设特征数据；所述预设特征数据为通过机器学习过程确定。
识别单元420，用将所述预设特征数据输入预先训练获得的虚假流量识别模型，以得到所述访问流量数据是否为虚假流量的识别结果。
所述识别结果包括：
识别所述访问流量数据为虚假流量的概率。
所述装置还包括：
发送单元430，用于发送所述识别结果给所述客户端。
所述装置还包括：
初步识别结果接收单元440，用于接收客户端发送的根据所述预设特征数据中的预判特征数据及所述预判特征数据对应的预判规则对所述访问流量数据进行虚假流量初步识别的初步识别结果；
比对单元450，用于比对所述虚假流量识别模型的识别结果与所述初步识别结果是否一致；
调整单元460，用于在所述虚假流量识别模型的识别结果与所述初步识别结果不一致情况下，调整所述预判特征数据对应的预判规则；
预判规则发送单元470，用于发送调整后的所述预判特征数据对应的预判规则给所述客户端。
如图6所示为本申请实施例的识别虚假流量的系统的架构示意图，该系统包括：终端设备610，用于收集网络访问流量数据，统计所述访问流量数据的预设特征数据，发送所述预设特征数据给服务器，以便服务器依据所述预设特征数据识别虚假流量；
服务器620，用于接收客户端发送的访问流量数据的预设特征数据，将所述预设特征数据输入预先训练获得的虚假流量识别模型，以得到所述访问流量数据是否为虚假流量的识别结果。
综上所述，本申请实施例通过预先确定识别虚假流量所需的特征数据作为预设特征 数据，由客户端收集网络访问流量数据并统计网络访问流量的预设特征数据发送给服务器端，该预设特征数据需要客户端基于所收集的访问流量数据进行统计计算获得，而并非访问流量的明细数据，既能满足准确识别虚假流量，同时有效降低了客户端传输给服务器端的数据量，减轻了存储及传输的压力。
需要注意的是，本申请可在软件和/或软件与硬件的组合体中被实施，例如，可采用专用集成电路(ASIC)、通用目的计算机或任何其他类似硬件设备来实现。在一个实施例中，本申请的软件程序可以通过处理器执行以实现上文所述步骤或功能。同样地，本申请的软件程序(包括相关的数据结构)可以被存储到计算机可读记录介质中，例如，RAM存储器，磁或光驱动器或软磁盘及类似设备。另外，本申请的一些步骤或功能可采用硬件来实现，例如，作为与处理器配合从而执行各个步骤或功能的电路。
另外，本申请的一部分可被应用为计算机程序产品，例如计算机程序指令，当其被计算机执行时，通过该计算机的操作，可以调用或提供根据本申请的方法和/或技术方案。而调用本申请的方法的程序指令，可能被存储在固定的或可移动的记录介质中，和/或通过广播或其他信号承载媒体中的数据流而被传输，和/或被存储在根据所述程序指令运行的计算机设备的工作存储器中。在此，根据本申请的一个实施例包括一个装置，该装置包括用于存储计算机程序指令的存储器和用于执行程序指令的处理器，其中，当该计算机程序指令被该处理器执行时，触发该装置运行基于前述根据本申请的多个实施例的方法和/或技术方案。
对于本领域技术人员而言，显然本申请不限于上述示范性实施例的细节，而且在不背离本申请的精神或基本特征的情况下，能够以其他的具体形式实现本申请。因此，无论从哪一点来看，均应将实施例看作是示范性的，而且是非限制性的，本申请的范围由所附权利要求而不是上述说明限定，因此旨在将落在权利要求的等同要件的含义和范围内的所有变化涵括在本申请内。不应将权利要求中的任何附图标记视为限制所涉及的权利要求。此外，显然“包括”一词不排除其他单元或步骤，单数不排除复数。系统权利要求中陈述的多个单元或装置也可以由一个单元或装置通过软件或者硬件来实现。第一，第二等词语用来表示名称，而并不表示任何特定的顺序。

Claims (18)

  1. 一种识别虚假流量的系统，其特征在于，包括：
    终端设备，用于收集网络访问流量数据，统计所述访问流量数据的预设特征数据，发送所述预设特征数据给服务器，以便服务器依据所述预设特征数据识别虚假流量；
    服务器，用于接收客户端发送的访问流量数据的预设特征数据，将所述预设特征数据输入预先训练获得的虚假流量识别模型，以得到所述访问流量数据是否为虚假流量的识别结果。
  2. 一种辅助识别虚假流量的方法，其特征在于，所述方法包括：
    收集网络访问流量数据；
    统计所述访问流量数据的预设特征数据；
    发送所述预设特征数据给服务器，以便服务器依据所述预设特征数据识别虚假流量。
  3. 如权利要求2所述的方法，其特征在于，统计所述访问流量数据的预设特征数据后，所述方法还包括：
    根据所述预设特征数据中的预判特征数据及所述预判特征数据对应的预判规则对所述访问流量数据进行虚假流量的初步识别，得到初步识别结果；
    若所述初步识别结果为是虚假流量，则对所述访问流量进行预控制。
  4. 如权利要求3所述的方法，其特征在于，所述方法还包括：
    接收所述服务器返回的所述访问流量是否为虚假流量的识别结果；
    判断初步识别结果为是虚假流量的访问流量所对应的所述服务器返回的识别结果是否为是虚假流量；
    若不是虚假流量，则解除对所述访问流量的预控制。
  5. 如权利要求4所述的方法，其特征在于，若不是虚假流量，所述方法还包括：
    调整所述预判特征数据对应的预判规则。
  6. 如权利要求3所述的方法，其特征在于，所述预判规则包括：预判特征数据对应的阈值范围及预判特征参数。
  7. 如权利要求3所述的方法，其特征在于，若所述初步识别结果为是虚假流量，所述方法还包括：
    发送所述初步识别结果给所述服务器。
  8. 如权利要求2所述的方法，其特征在于，收集网络访问流量数据前，所述方法还 包括：
    在离线计算框架下，利用已有的虚假流量标记数据，使用预先收集到的流量的预设特征数据，训练机器学习模型，得到模型的各项参数。
  9. 如权利要求2所述的方法，其特征在于，收集的所述网络访问流量数据包括但不限于如下至少一类数据：
    所访问的网站内容、访问网站所使用的手段、用户访问习惯数据。
  10. 如权利要求2所述的方法，其特征在于，所述预设特征数据包括如下至少一项：
    用户所访问的网站内容，包括：用户访问的页面数，页面跳转次数；
    用户访问网站所使用的手段，包括：用户通过客户端发起访问请求的网络ip，mac，wifimac，sessionid，登陆id；
    用户访问习惯数据，包括：用户访问不同类型页面的时间段分布序列，页面访问时长平均值，页面访问时长方差；
    用户文本框输入字符串时连续字符的输入时间间隔均值和方差，输入不同字符的敲击按键的时长均值和方差，用户输入特定字符组合的按键顺序和时间间隔、键盘敲击的时长；
    用户鼠标划动轨迹的X轴和Y轴两个方向的坐标最大和最小值，鼠标滑动的速度，用户最频繁出现的屏幕相对位置区域的频率；
    用户鼠标滚轮滚动时长的均值和方差，两次滚轮时间间隔的均值和方差，滚轮滚动幅度的均值和方差；
    用户操作触屏设备时手指滑动和拖动的幅度的均值和方差，页面跳转时用户手指滑动和拖动的时长均值和方差，页面跳转时间间隔均值和方差。
  11. 一种识别虚假流量的方法，其特征在于，所述方法包括：
    接收客户端发送的访问流量数据的预设特征数据；
    将所述预设特征数据输入预先训练获得的虚假流量识别模型，以得到所述访问流量数据是否为虚假流量的识别结果。
  12. 如权利要求11所述的方法，其特征在于，所述识别结果包括：
    识别所述访问流量数据为虚假流量的概率。
  13. 如权利要求11所述的方法，其特征在于，所述方法还包括：
    发送所述识别结果给所述客户端。
  14. 如权利要求11所述的方法，其特征在于，所述方法还包括：
    接收客户端发送的根据所述预设特征数据中的预判特征数据及所述预判特征数据对应的预判规则对所述访问流量数据进行虚假流量初步识别的初步识别结果；
    比对所述虚假流量识别模型的识别结果与所述初步识别结果是否一致；
    若不一致，则调整所述预判特征数据对应的预判规则；
    发送调整后的所述预判特征数据对应的预判规则给所述客户端。
  15. 如权利要求11所述的方法，其特征在于，所述方法还包括：
    在离线计算框架下，利用已有的虚假流量标记数据，使用预先收集到的流量的预设特征数据，训练所述虚假流量识别模型，得到模型的各项参数。
  16. 如权利要求15所述的方法，其特征在于，所述方法还包括：
    将所述识别结果作为离线计算框架下训练所述虚假流量识别模型的迭代输入，以实现对所述虚假流量识别模型进行迭代训练。
  17. 一种辅助识别虚假流量的装置，其特征在于，所述装置包括：
    收集单元，用于收集网络访问流量数据；
    统计单元，用于统计所述访问流量数据的预设特征数据；
    发送单元，用于发送所述预设特征数据给服务器，以便服务器依据所述预设特征数据识别虚假流量。
  18. 一种识别虚假流量的装置，其特征在于，所述装置包括：
    预设特征数据接收单元，用于接收客户端发送的访问流量数据的预设特征数据；
    识别单元，用将所述预设特征数据输入预先训练获得的虚假流量识别模型，以得到所述访问流量数据是否为虚假流量的识别结果。
PCT/CN2017/094423 2016-08-08 2017-07-26 识别及辅助识别虚假流量的方法、装置及系统 WO2018028430A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
US16/271,654 US10848511B2 (en) 2016-08-08 2019-02-08 Method and apparatus for identifying fake traffic

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201610645819.2 2016-08-08
CN201610645819.2A CN107707509B (zh) 2016-08-08 2016-08-08 识别及辅助识别虚假流量的方法、装置及系统

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US16/271,654 Continuation US10848511B2 (en) 2016-08-08 2019-02-08 Method and apparatus for identifying fake traffic

Publications (1)

Publication Number Publication Date
WO2018028430A1 true WO2018028430A1 (zh) 2018-02-15

Family

ID=61162753

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2017/094423 WO2018028430A1 (zh) 2016-08-08 2017-07-26 识别及辅助识别虚假流量的方法、装置及系统

Country Status (4)

Country Link
US (1) US10848511B2 (zh)
CN (1) CN107707509B (zh)
TW (1) TWI735594B (zh)
WO (1) WO2018028430A1 (zh)

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111953654A (zh) * 2020-07-08 2020-11-17 北京明略昭辉科技有限公司 虚假流量的识别方法及装置
US10848511B2 (en) 2016-08-08 2020-11-24 Alibaba Group Holding Limited Method and apparatus for identifying fake traffic
CN112351006A (zh) * 2020-10-27 2021-02-09 杭州安恒信息技术股份有限公司 一种网站访问攻击拦截方法及相关组件

Families Citing this family (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN108810948B (zh) * 2018-05-29 2021-03-19 每日互动股份有限公司 一种鉴别真实流量的方法
CN109284833B (zh) * 2018-08-22 2023-07-18 中国平安人寿保险股份有限公司 为机器学习模型获取特征数据的方法、设备和存储介质
CN110913396B (zh) * 2019-12-10 2022-05-17 秒针信息技术有限公司 虚假流量识别方法、装置、服务器及可读存储介质
CN111061588A (zh) * 2019-12-13 2020-04-24 北京奇艺世纪科技有限公司 一种定位数据库异常来源的方法及装置
CN111461545B (zh) * 2020-03-31 2023-11-10 北京深演智能科技股份有限公司 机器访问数据的确定方法及装置
CN112529051B (zh) * 2020-11-25 2024-04-09 微梦创科网络科技（中国）有限公司 一种刷量用户识别方法及装置
CN112822680B (zh) * 2021-01-07 2023-09-22 北京明略昭辉科技有限公司 用户移动端的虚假流量识别方法、系统及计算机设备
CN113473179B (zh) * 2021-06-30 2022-12-02 北京百度网讯科技有限公司 视频处理方法、装置、电子设备和介质
CN115065644A (zh) * 2022-06-20 2022-09-16 支付宝(杭州)信息技术有限公司 用于阻止机器流量的方法和系统

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20030227917A1 (en) * 2002-06-11 2003-12-11 Netrake Corporation Device for enabling trap and trace of internet protocol communications
CN105119735A (zh) * 2015-07-15 2015-12-02 百度在线网络技术（北京）有限公司 一种用于确定流量类型的方法和装置
CN105187396A (zh) * 2015-08-11 2015-12-23 小米科技有限责任公司 识别网络爬虫的方法及装置
CN105808639A (zh) * 2016-02-24 2016-07-27 平安科技（深圳）有限公司 网络访问行为识别方法和装置

Family Cites Families (39)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US6321338B1 (en) * 1998-11-09 2001-11-20 Sri International Network surveillance
US8438241B2 (en) * 2001-08-14 2013-05-07 Cisco Technology, Inc. Detecting and protecting against worm traffic on a network
US8127356B2 (en) * 2003-08-27 2012-02-28 International Business Machines Corporation System, method and program product for detecting unknown computer attacks
US8171553B2 (en) * 2004-04-01 2012-05-01 Fireeye, Inc. Heuristic based capture with replay to virtual machine
GB2421142A (en) * 2004-12-09 2006-06-14 Agilent Technologies Inc Detecting malicious traffic in a communications network
US7724717B2 (en) * 2005-07-22 2010-05-25 Sri International Method and apparatus for wireless network security
US7624447B1 (en) * 2005-09-08 2009-11-24 Cisco Technology, Inc. Using threshold lists for worm detection
US7698548B2 (en) * 2005-12-08 2010-04-13 Microsoft Corporation Communications traffic segregation for security purposes
US8001601B2 (en) * 2006-06-02 2011-08-16 At&T Intellectual Property Ii, L.P. Method and apparatus for large-scale automated distributed denial of service attack detection
US8533819B2 (en) * 2006-09-29 2013-09-10 At&T Intellectual Property Ii, L.P. Method and apparatus for detecting compromised host computers
US7768921B2 (en) * 2006-10-30 2010-08-03 Juniper Networks, Inc. Identification of potential network threats using a distributed threshold random walk
US8391288B2 (en) * 2007-01-31 2013-03-05 Hewlett-Packard Development Company, L.P. Security system for protecting networks from vulnerability exploits
US8504504B2 (en) * 2008-09-26 2013-08-06 Oracle America, Inc. System and method for distributed denial of service identification and prevention
US8914878B2 (en) * 2009-04-29 2014-12-16 Juniper Networks, Inc. Detecting malicious network software agents
US8789173B2 (en) * 2009-09-03 2014-07-22 Juniper Networks, Inc. Protecting against distributed network flood attacks
US8726376B2 (en) * 2011-03-11 2014-05-13 Openet Telecom Ltd. Methods, systems and devices for the detection and prevention of malware within a network
US8402543B1 (en) * 2011-03-25 2013-03-19 Narus, Inc. Machine learning based botnet detection with dynamic adaptation
CN102821002B (zh) * 2011-06-09 2015-08-26 中国移动通信集团河南有限公司信阳分公司 网络流量异常检测方法和系统
US8516592B1 (en) * 2011-06-13 2013-08-20 Trend Micro Incorporated Wireless hotspot with lightweight anti-malware
EP2737741A4 (en) * 2011-07-27 2015-01-21 Seven Networks Inc SURVEILLANCE OF MOBILE APPLICATION ACTIVITIES IN SEARCH OF MALICIOUS TRAFFIC ON A MOBILE DEVICE
WO2013032473A1 (en) * 2011-08-31 2013-03-07 Hewlett-Packard Development Company, L.P. Tiered deep packet inspection in network devices
US8549645B2 (en) * 2011-10-21 2013-10-01 Mcafee, Inc. System and method for detection of denial of service attacks
US9094288B1 (en) * 2011-10-26 2015-07-28 Narus, Inc. Automated discovery, attribution, analysis, and risk assessment of security threats
US8418249B1 (en) * 2011-11-10 2013-04-09 Narus, Inc. Class discovery for automated discovery, attribution, analysis, and risk assessment of security threats
US9686023B2 (en) * 2013-01-02 2017-06-20 Qualcomm Incorporated Methods and systems of dynamically generating and using device-specific and device-state-specific classifier models for the efficient classification of mobile device behaviors
CN103150506B (zh) * 2013-02-17 2016-03-30 北京奇虎科技有限公司 一种恶意程序检测的方法和装置
EP2959698A1 (en) * 2013-02-22 2015-12-30 Adaptive Mobile Security Limited System and method for embedded mobile (em)/machine to machine (m2m) security, pattern detection, mitigation
US9288219B2 (en) * 2013-08-02 2016-03-15 Globalfoundries Inc. Data protection in a networked computing environment
EP3036863A1 (en) * 2013-08-19 2016-06-29 Hewlett Packard Enterprise Development LP Adaptive network security policies
TWI510109B (zh) * 2013-09-25 2015-11-21 Chunghwa Telecom Co Ltd 遞迴式異常網路流量偵測方法
US10320813B1 (en) * 2015-04-30 2019-06-11 Amazon Technologies, Inc. Threat detection and mitigation in a virtualized computing environment
US10536357B2 (en) * 2015-06-05 2020-01-14 Cisco Technology, Inc. Late data detection in data center
CN105187392B (zh) * 2015-08-10 2018-01-02 济南大学 基于网络接入点的移动终端恶意软件检测方法及其系统
US10187401B2 (en) * 2015-11-06 2019-01-22 Cisco Technology, Inc. Hierarchical feature extraction for malware classification in network traffic
US20170149804A1 (en) * 2015-11-20 2017-05-25 Lastline, Inc. Methods and systems for malware host correlation
CN105554016A (zh) * 2015-12-31 2016-05-04 山石网科通信技术有限公司 网络攻击的处理方法和装置
US10230745B2 (en) * 2016-01-29 2019-03-12 Acalvio Technologies, Inc. Using high-interaction networks for targeted threat intelligence
CN107707509B (zh) 2016-08-08 2020-09-29 阿里巴巴集团控股有限公司 识别及辅助识别虚假流量的方法、装置及系统
US10812520B2 (en) * 2018-04-17 2020-10-20 BitSight Technologies, Inc. Systems and methods for external detection of misconfigured systems

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20030227917A1 (en) * 2002-06-11 2003-12-11 Netrake Corporation Device for enabling trap and trace of internet protocol communications
CN105119735A (zh) * 2015-07-15 2015-12-02 百度在线网络技术（北京）有限公司 一种用于确定流量类型的方法和装置
CN105187396A (zh) * 2015-08-11 2015-12-23 小米科技有限责任公司 识别网络爬虫的方法及装置
CN105808639A (zh) * 2016-02-24 2016-07-27 平安科技（深圳）有限公司 网络访问行为识别方法和装置

Cited By (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US10848511B2 (en) 2016-08-08 2020-11-24 Alibaba Group Holding Limited Method and apparatus for identifying fake traffic
CN111953654A (zh) * 2020-07-08 2020-11-17 北京明略昭辉科技有限公司 虚假流量的识别方法及装置
CN111953654B (zh) * 2020-07-08 2023-08-01 北京明略昭辉科技有限公司 虚假流量的识别方法及装置
CN112351006A (zh) * 2020-10-27 2021-02-09 杭州安恒信息技术股份有限公司 一种网站访问攻击拦截方法及相关组件

Also Published As

Publication number Publication date
CN107707509B (zh) 2020-09-29
US20190173905A1 (en) 2019-06-06
US10848511B2 (en) 2020-11-24
TWI735594B (zh) 2021-08-11
TW201815132A (zh) 2018-04-16
CN107707509A (zh) 2018-02-16

Similar Documents

Publication Publication Date Title
WO2018028430A1 (zh) 识别及辅助识别虚假流量的方法、装置及系统
US10938927B2 (en) Machine learning techniques for processing tag-based representations of sequential interaction events
TWI676913B (zh) 資料處理方法、資料發送方法、風險識別方法及設備
JP6681342B2 (ja) 行動イベント計測システム及び関連する方法
CN110442712B (zh) 风险的确定方法、装置、服务器和文本审理系统
US10885167B1 (en) Intrusion detection based on anomalies in access patterns
CN104318138A (zh) 一种验证用户身份的方法和装置
US20200301972A1 (en) Graph analysis of time-series cluster data
US11694293B2 (en) Techniques for generating analytics based on interactions through digital channels
CN108521405B (zh) 一种风险管控方法、装置及存储介质
WO2017031837A1 (zh) 磁盘容量的预测方法、装置及设备
CN109194671A (zh) 一种异常访问行为的识别方法及服务器
US9886701B1 (en) Endorsement abuse detection via social interactions
CN111611519B (zh) 一种个人异常行为检测方法及装置
WO2020257991A1 (zh) 用户识别方法及相关产品
WO2023055426A1 (en) Techniques for input classification and responses using generative neural networks
US20130347067A1 (en) Dynamic human interactive proof
CN110460593B (zh) 一种移动流量网关的网络地址识别方法、装置及介质
CN110276183B (zh) 反向图灵验证方法及装置、存储介质、电子设备
WO2020258509A1 (zh) 终端设备异常访问的隔离方法和装置
CN116049808A (zh) 一种基于大数据的设备指纹采集系统及方法
CN110287315A (zh) 舆情确定方法、装置、设备及存储介质
CN112230815B (zh) 智能求助方法、装置、设备及存储介质
CN111612280B (zh) 一种数据分析方法和装置
KR101553923B1 (ko) 시스템 사용량 분석 장치 및 방법

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 17838560

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 17838560

Country of ref document: EP

Kind code of ref document: A1