WO2019136990A1 - 网络数据检测方法、装置、计算机设备和存储介质 - Google Patents

网络数据检测方法、装置、计算机设备和存储介质 Download PDF

Info

Publication number
WO2019136990A1
WO2019136990A1 PCT/CN2018/099948 CN2018099948W WO2019136990A1 WO 2019136990 A1 WO2019136990 A1 WO 2019136990A1 CN 2018099948 W CN2018099948 W CN 2018099948W WO 2019136990 A1 WO2019136990 A1 WO 2019136990A1
Authority
WO
WIPO (PCT)
Prior art keywords
data
network data
detected
cheat
historical network
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Ceased
Application number
PCT/CN2018/099948
Other languages
English (en)
French (fr)
Inventor
羊志敏
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
OneConnect Smart Technology Co Ltd
Original Assignee
OneConnect Smart Technology Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by OneConnect Smart Technology Co Ltd filed Critical OneConnect Smart Technology Co Ltd
Publication of WO2019136990A1 publication Critical patent/WO2019136990A1/zh
Anticipated expiration legal-status Critical
Ceased legal-status Critical Current

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H04L63/1425—Traffic logging, e.g. anomaly detection
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F18/00—Pattern recognition
    • G06F18/20—Analysing
    • G06F18/24—Classification techniques
    • G06F18/241—Classification techniques relating to the classification model, e.g. parametric or non-parametric approaches
    • G06F18/2415—Classification techniques relating to the classification model, e.g. parametric or non-parametric approaches based on parametric or probabilistic models, e.g. based on likelihood ratio or false acceptance rate versus a false rejection rate
    • G06F18/24155—Bayesian classification

Definitions

  • the application relates to a network data detecting method, device, computer device and storage medium.
  • the wool party refers to active on various internet financial platforms and collects majors. Investors who earn small rewards for information on promotional activities such as e-shops, banks, and physical stores, and free services.
  • the inventor realized that it is conventionally based on pre-existing rules, that is, whether the corresponding network data is cheat data by prior rules to determine whether the user corresponding to the network data is a wool party.
  • the rule-based anti-cheat system needs to make rules in advance, and judge the network data according to the rules.
  • the rules are manually adjusted according to the characteristics of the wool party.
  • the rules of manual adjustment are prone to errors. Therefore, it is easy to cause the wool party's judgment to be wrong by manually adjusting the rules.
  • a network data detecting method, apparatus, computer device, and storage medium are provided.
  • a network data detection method includes:
  • the network data to be detected is marked as cheat data.
  • a network data detecting device includes:
  • An intercepting module configured to intercept network data to be detected, and store the intercepted network data to be detected into a data queue
  • a machine learning model judging module configured to input the network data to be detected stored in the data queue into a machine learning model for processing to obtain an initial judgment result
  • a rule judging module configured to: when the initial judgment result indicates that the to-be-detected network data is the first cheat data, match the first cheat data with the second cheat data in the rule base;
  • the marking module is configured to mark the to-be-detected network data as cheat data when the first cheat data is successfully matched with the second cheat data in the rule base.
  • a computer device comprising a memory and one or more processors having stored therein computer readable instructions, the computer readable instructions being executable by the processor to cause the one or more processors to execute The following steps: intercepting the network data to be detected, and storing the intercepted network data to be detected into the data queue; and inputting the network data to be detected stored in the data queue into the machine learning model for processing to obtain an initial judgment result; When the initial judgment result indicates that the to-be-detected network data is the first cheat data, matching the first cheat data with the second cheat data in the rule base; and when the first cheat data and the When the second cheat data in the rule base is successfully matched, the network data to be detected is marked as cheat data.
  • One or more non-transitory computer readable storage mediums storing computer readable instructions, when executed by one or more processors, cause one or more processors to perform the steps of: intercepting a network to be detected Data, and the intercepted network data to be detected is stored in the data queue; the network data to be detected stored in the data queue is input into a machine learning model for processing to obtain an initial judgment result; when the initial judgment result is expressed When the network data to be detected is the first cheat data, matching the first cheat data with the second cheat data in the rule base; and when the first cheat data and the second in the rule base When the cheat data is successfully matched, the network data to be detected is marked as cheat data.
  • FIG. 1 is an application scenario diagram of a network data detecting method according to one or more embodiments.
  • FIG. 2 is an architectural diagram of a detection platform in accordance with one or more embodiments.
  • FIG. 3 is a flow diagram of a method of network data detection in accordance with one or more embodiments.
  • FIG. 4 is a block diagram of a network data detecting device in accordance with one or more embodiments.
  • FIG. 5 is a block diagram of a computer device in accordance with one or more embodiments.
  • the network data detecting method provided by the present application can be applied to an application environment as shown in FIG. 1.
  • the terminal communicates with the server through the network through the network.
  • the detection platform can intercept the network data that the terminal communicates with the server, and detect the network data. For example, after the detection platform intercepts the network data to be detected, the intercepted network data to be detected is stored in the data queue, and then the network data to be detected in the data queue is sequentially passed through the rules in the machine learning model and the rule base. The detection is performed. When the rules in the machine learning model and the rule base determine that the network data to be detected is cheat data, the network data to be detected is marked as cheat data.
  • the terminal can be, but is not limited to, various personal computers, notebook computers, smart phones, tablets, and portable wearable devices.
  • the server is a network server, which can be implemented by a stand-alone server or a server cluster composed of multiple servers.
  • the detection platform can also be implemented in the form of a server cluster composed of a server or
  • FIG. 2 is a structural diagram of a detection platform in an embodiment, including an H5 detection engine, an Android detection engine, an IOS detection engine, a data queue module, a machine learning model module, a rule management module, a wind control engine, Activity management module, decision engine module, log management module, data monitoring platform, blacklist library and whitelist library.
  • the H5 detection engine, the Android detection engine, and the IOS detection engine are used to intercept the network data to be detected, and the intercepted network data to be detected is placed in the data queue, and the machine learning model module is used to intercept the received data.
  • the network data is detected to determine the initial judgment result.
  • the cheating data is further determined by the rule management module calling the rules in the risk control engine.
  • the corresponding rules are stored in the wind control engine, the corresponding activities are stored in the activity management module, and the relationship between the activities and the rules is established, and the decision engine module outputs the judgment result to the data monitoring platform, and the data monitoring platform can view the system. Data and management of activities and the like.
  • the black list library stores the cheat data
  • the white list library stores the normal data.
  • a network data detection method is provided.
  • the method is applied to the detection platform in FIG. 1 as an example, and includes the following steps:
  • S302 Intercept the network data to be detected, and store the intercepted network data to be detected into the data queue.
  • the detecting platform may intercept the network data to be detected by setting a proxy server, for example, setting a proxy server, and setting a calling program in advance in the terminal.
  • the proxy server may obtain the calling program through the calling program.
  • the network data to be detected sent by the terminal is sent to the detection platform, so that the detection platform stores the data to be detected in the data queue after receiving the data to be detected, thereby ensuring subsequent detection.
  • the platform can take data from the data queue for processing. The reason why the data queue is pre-stored is to prevent the detection platform from being faulty when the large amount of data occurs.
  • the detection platform can still obtain a corresponding number of network data to be detected according to the current processing situation, thereby ensuring that the detection platform is processed in an orderly manner. Network data to be detected.
  • the machine learning model is a pre-set model that can process the detected network data to determine whether the network data to be detected is cheat data, and the machine learning model can be learned according to historical network data.
  • the machine learning model may obtain the network data to be detected from the data queue according to the number of network data to be detected currently being processed, or may acquire the network data to be detected from the data queue in batches, that is, the network to be detected currently being processed. After the data processing is completed, the data to be detected next to be processed will be obtained from the data queue.
  • the machine learning model can process multiple network data to be detected at the same time, for example, by multi-threading, etc., to improve the speed of data processing.
  • the rule base may perform further judgment to ensure that the judgment result of the machine learning model is correct.
  • the initial judgment result that is, the network data to be detected obtained by the machine learning model is normal data
  • the network data to be detected is not intercepted, etc., to ensure normal communication between the terminal and the server, or normal data may be
  • the second judgment is sent to the rule base to prevent the machine learning model from judging the occurrence of the cheat data as normal data.
  • the rule base stores a large number of data rules for determining whether the network data to be detected is cheat data, and the first cheat data can be matched with the data in the rules in the rule base.
  • the network data to be detected is cheat data, so that the mutual correction of the gaps can improve the accuracy of the judgment and prevent the machine.
  • the learning model produces a false positive.
  • the first cheat data and the second cheat data in the rule base are not successfully matched, the first cheat data may also be output, so that the user performs manual intervention, adjusts the rule base, and the like, for example, when manually determining the
  • the rule base may be adjusted, the corresponding rule is added, and the rule library is expanded; when the first cheat data is manually determined not to be cheat data, the first rule may be adopted.
  • the cheat data corrects the machine learning model to further improve the accuracy of the machine learning model.
  • the detection platform After the detection platform intercepts the network data to be detected, it is necessary to determine whether the network data is the network data sent by the wool party terminal, that is, the cheat data, and in order to detect that the platform can operate normally when receiving a large amount of data, the detection platform firstly The network data to be detected is stored in the data queue, and then the data to be detected is pre-judged by the machine learning model to obtain an initial judgment result, that is, according to the big data intelligent model (AI learning model, that is, the above-mentioned machine learning model) The detection data is initially determined.
  • AI learning model that is, the above-mentioned machine learning model
  • the cheat data is re-entered into the rule base for detection, thereby ensuring that the judgment made by the machine learning model is correct, and the detection network is first processed by the machine learning model.
  • the reason why the data is judged, instead of first judging the network data through the rule base is that the judgment speed of the machine learning model is faster, so that the detection speed of the network data to be detected can be improved, since most of the network data are normal networks.
  • Data, not wool Network data sent from the terminal it is possible to reduce the large amount of data is input to the network to be detected by the machine learning rule base model, as compared to a more efficient manner to be determined by the rule base.
  • the method for determining the network data to be detected may be the first to extract the feature data of the network data to be detected, and the method for extracting the feature data may be the same according to the method for extracting the feature data of the historical network data, that is, the network data to be detected is firstly Performing word segmentation processing, then calculating the word frequency of the current word segment in the current network data to be detected, and obtaining the inverse document frequency of the current word segment according to the number of the network data to be detected including the current word segment and the total number of network data to be detected; The word frequency of the current participle and the inverse document frequency are used to calculate the word weight of the current participle; the current participle with the largest word weight is obtained as the feature data of the current network data to be detected; and the extracted feature data is compared with the feature data in the machine model.
  • the network data to be detected is cheat data, that is, whether the data is sent by the terminal corresponding to the wool party, and if so, the cheat data is continuously input into the rule base, and the cheat data is performed through the rule base. Further judgment due to the machine learning model Faster processing, can filter out most of the invalid data in advance, and then transmitted to the rule base, may improve the efficiency of determination.
  • the above network data detection method firstly makes a preliminary judgment on the network data to be detected by the machine learning model, and then judges through the rule base, and the two can check each other to fill the gap, which can improve the accuracy of the judgment, and the processing speed of the machine learning model is faster. You can filter out most of the invalid data in advance and then transfer it to the rule base, which can improve the efficiency of judgment. And the machine learning model can generate a large number of new rules based on historical network data, without manual addition, reducing manpower input.
  • the generation of the machine learning model mainly includes three steps: defining a target problem, collecting data and features, and training the model. Therefore, the method further includes a machine learning model generating step, the machine learning model generating step may include: acquiring the marked historical network data, and extracting the feature data of the historical network data; adding the historical network data marked as the cheat data to the black The list library adds the historical network data marked as normal data to the whitelist library; the machine learning model is established according to the feature data of the historical network data in the blacklist library and the feature data of the historical network data in the whitelist library.
  • the feature data may be data that can represent the network data, that is, if a certain feature data has a large frequency appearing in a certain network data, and is rarely present in other network data, the feature data is considered to have a good category.
  • the capability is differentiated, so the feature data can represent the network data.
  • the feature data can be a word or a phrase.
  • the detection platform may obtain historical network data that has been previously marked, and the historical network data has been classified into two categories, that is, the normal data and the cheat data have been classified according to the mark, and the normal data may be stored in the white list library.
  • the cheat data is stored in the blacklist library; and the feature data of the historical network data is extracted, and the machine learning model can be modeled by the Bayesian algorithm according to the feature data and the type of the historical network data.
  • a cross-training step may also be included, that is, other historical network data may be acquired as a test set to optimize the machine learning model.
  • the parameters in the machine learning model are optimized by the GridSearchCV model, that is, traversing a plurality of parameter combinations in the machine learning model, and determining the optimal effect parameters through cross-validation.
  • the parameter may include the similarity between the network data in the test set and the feature data in the machine learning model, and the parameter with the appropriate similarity is selected as the parameter of the machine learning model. For example, when the similarity is greater than 90%, the network data to be detected is considered to be The feature data in the machine learning model is the same. At this time, the machine learning model has the best judgment accuracy, and the parameter is the most machine learning model parameter.
  • the model is stored for use as a standard model.
  • the machine learning model is reliable, and the machine learning model is cross-trained after the model is generated. Participation further improves the reliability of the machine learning model.
  • the step of extracting feature data of the historical network data may include: performing word segmentation processing on the historical network data; word frequency according to the current word segmentation in the current historical network data, and according to the bar of the historical network data including the current segmentation word.
  • the number of the number and the total number of historical network data obtains the inverse document frequency of the current participle; the word weight of the current participle is calculated according to the word frequency and the inverse document frequency of the current participle; and the current participle with the largest word weight is obtained as the characteristic data of the current historical network data.
  • the historical network data may be subjected to word segmentation processing, and the word segmentation processing may be performed according to a preset word segmentation logic or a random word segmentation of historical network data, and is not limited herein.
  • the word segmentation logic library may be set. Before the word segmentation process, the word segmentation logic library is first obtained, and the word segmentation in the word segmentation logic library is matched with the historical network data, and the matching is successful. Add a participle before and after the word to perform participle. If the historical network data is randomly segmented, the word segmentation step can be set in advance. For example, the preset step size can be set to 3 characters, 5 characters, and the like.
  • the specific preset step size can be set according to actual experience.
  • the detection platform divides the historical network data into a plurality of word segments according to a preset step size according to a preset segmentation sequence, and the preset segmentation order may be from right to left or from left to right. For other orders.
  • the word frequency of the current participle in the current historical network data the number of occurrences of the current participle in the current historical network data / the total score data of the current historical network data;
  • the inverse document frequency of the current participle log (the historical network data containing the current participle) Number of bars) / (total number of historical network data + 1);
  • word weight word frequency * inverse document frequency.
  • the first historical network data of an activity contains 1000
  • the first historical network data has a total of 10 words, there are 3 single quotes, and there are 3 from, and 10 of the 1000 historical network data contain single quotes.
  • the feature data may be data that can represent the network data, that is, if a certain feature data has a large frequency appearing in a certain network data, and is rarely present in other network data, the feature data is considered to have Good class distinguishing ability, so the feature data can represent the network data. Therefore, by calculating the word weight of the word segmentation, it can accurately determine whether the word segment can be used as feature data, which lays a foundation for improving the accuracy of the subsequent machine learning model.
  • the machine learning model is no longer adapted to the current wool party's judgment, and in order to avoid this, a machine learning model may be generated.
  • the historical network data in the blacklist library and the whitelist library are optimized to improve the accuracy of the sample, so that the machine learning model can be regenerated by setting the time period to improve the adaptability of the machine learning model.
  • the optimization of historical network data in the blacklist library and the whitelist library may include the addition of historical network data and the deletion of historical network data.
  • the increase of historical network data may include the addition and whitelisting of historical network data in the blacklist library. An increase in instance network data in the library.
  • the deletion of historical network data is mainly for data deduplication and deletion of encrypted data.
  • the increase of the historical network data in the blacklist database may be after the step of intercepting the network data to be detected, that is, after the step of intercepting the network data to be detected, the network address of the terminal corresponding to the network data to be detected may be acquired; The frequency of the network data to be detected sent by the terminal corresponding to the intercepted network address is counted; when the frequency is greater than the preset frequency, the network data to be detected is added to the blacklist database. That is, the dynamic management network address blacklist can be collected by the log management module, and the network data sent by the dynamic network address is added to the blacklist.
  • the detection platform continuously considers that the network data corresponding to a certain network address is intercepted, and the network address is considered as the network address.
  • the corresponding network data is cheat data, so the frequency of the network data to be detected sent by the terminal corresponding to the intercepted network address can be counted, that is, the number of times the network data sent by the network address is intercepted within a preset time period, if If it is greater than the preset number, the network data is considered as cheat data and can be directly added to the blacklist database.
  • the adding of the historical network data in the blacklist database may include: when the initial judgment result indicates that the network data to be detected is not the first cheat data, marking the network data to be detected as normal data; adding normal data to the white list.
  • the whitelist data may include normal data determined by the machine learning model, and may also include After the manual intervention, the first cheat data of the normal data is determined, which can increase the diversity of the normal data and improve the coverage of the normal data, thereby ensuring the coverage of the network data in the whitelist library is more comprehensive.
  • the network data marked as normal data can be periodically added to the whitelist library.
  • the detection platform can obtain the log data in the log management module, and select new network data marked as normal data, for example. New network data after the last added date can be obtained based on the date added last time, and the new network data can be added to the corresponding whitelisted library.
  • the deletion of the historical network data includes deduplication and deletion of the encrypted data
  • the de-duplication includes obtaining the same historical network data in the blacklist library according to the order of the historical network data in the blacklist library; according to the history in the whitelist library
  • the order of the network data acquires the same historical network data in the whitelist library; the same historical network data is deduplicated.
  • the first historical network data in the blacklist database may be used to sequentially match other historical network data in the blacklist database.
  • the similarity between the two historical network data is greater than the preset similarity, the two historical networks are considered. The data is the same, so delete one and leave only one historical network data.
  • the first historical network data in the whitelisted library can be used to sequentially match other historical network data in the whitelisted library.
  • the similarity between the two historical network data is greater than the preset similarity, then It is considered that the two historical network data are the same, so one piece is deleted, and only one historical network data is reserved, so that the number of samples can be increased as much as possible, and the efficiency of data processing is improved.
  • the deduplication of the encrypted data it may be de-duplicated from the whitelist library and the blacklist library according to the preset parameter name.
  • the name of the encrypted parameter may be stored in advance, when the name of the parameter exists in the historical network data. , the network data corresponding to the parameter is directly deleted from the whitelist library and the blacklist library.
  • the historical network data in the white list library and the black list library are cleaned, and a large number of samples can be learned by the machine and new samples are generated, thereby greatly releasing the original manual maintenance amount.
  • the method further includes a pair of machine learning models for evaluating, the step may be performed after the step of generating the machine learning model, that is, the feature data and the white list of the historical network data according to the blacklist library.
  • the feature data of the historical network data in the library may further include: inputting the preset positive sample and the preset negative sample into the machine learning model to obtain the test result; comparing the test result with the expected result Comparing results; according to the comparison result, the score of the computer learning model; when the score is less than the preset score, the machine learning model is corrected by the preset positive sample and the preset negative sample; when the score is greater than or equal to the preset score, the continuation is continued.
  • the network data to be detected stored in the data queue is input into a machine learning model for processing to obtain an initial judgment result.
  • the preset positive sample and the negative sample are network data that have been determined to be normal data or cheat data, and the network data is input into the machine learning model to obtain a test result, and the test result is compared with the expected result. The results are compared and the scores of the machine learning model can be obtained based on the comparison results. See for example the table below:
  • the score of the computer learning model the parameters of the score include: accuracy rate, misclassification rate, recall rate, precision rate, TPR, FAR, FRR, and f1-score, etc., and the specific calculation methods of these parameters are as follows:
  • Recall rate recall rate, hit probability: TP / (TP + FN), how many of all normal data are identified as normal data;
  • TPR TruePositive Rate: TP / (TP + FN), which is actually Recall;
  • FAR False Acceptance Rate
  • FPR False Positive Rate
  • FRR FalseRejection Rate: FN/(TP+FN), error rejection rate, rejection rate, how many of all normal data are identified as cheat data, which is equal to 1-Recall;
  • the machine learning model can be scored or graded based on the calculated parameters, and only machine learning models with appropriate scores or grades will be put into use. That is, when the score is greater than or equal to the preset score, the network data to be detected stored in the data queue is continuously input into the machine learning model for processing to obtain an initial judgment result. When the score is less than the preset score, the machine learning model is corrected by the preset positive sample and the preset negative sample, for example, by performing the training on the machine learning model by the preset normal book and the preset negative sample.
  • the machine learning model is not directly put into use, but the machine learning model is scored, and only the machine learning model with the appropriate score is put into use, further improving the network data to be detected. Detection accuracy.
  • steps in the flowchart of FIG. 3 are sequentially displayed as indicated by the arrows, these steps are not necessarily performed in the order indicated by the arrows. Except as explicitly stated herein, the execution of these steps is not strictly limited, and the steps may be performed in other orders. Moreover, at least some of the steps in FIG. 3 may include a plurality of sub-steps or stages, which are not necessarily performed at the same time, but may be performed at different times, and the execution of these sub-steps or stages The order is also not necessarily sequential, but may be performed alternately or alternately with other steps or at least a portion of the sub-steps or stages of the other steps.
  • a network data detecting apparatus including: an intercepting module 100, a machine learning model determining module 200, a rule determining module 300, and a marking module 400, wherein:
  • the intercepting module 100 is configured to intercept the network data to be detected, and store the intercepted network data to be detected into the data queue.
  • the machine learning model judging module 200 is configured to input the network data to be detected stored in the data queue into a machine learning model for processing to obtain an initial judgment result.
  • the rule judging module 300 is configured to match the first cheat data with the second cheat data in the rule base when the initial judgment result indicates that the network data to be detected is the first cheat data.
  • the marking module 400 is configured to mark the network data to be detected as cheat data when the first cheat data is successfully matched with the second cheat data in the rule base.
  • the apparatus further includes:
  • the feature data extraction module is configured to acquire the historical network data that has been marked, and extract feature data of the historical network data.
  • a library generation module is configured to add historical network data marked as cheat data to the blacklist library, and add historical network data marked as normal data to the whitelist library.
  • the machine learning model generating module is configured to establish a machine learning model according to the feature data of the historical network data in the blacklist library and the feature data of the historical network data in the whitelist library.
  • the feature data extraction module includes:
  • a word segmentation unit for word segmentation of historical network data for word segmentation of historical network data.
  • the word feature acquiring unit is configured to obtain the inverse document frequency of the current word segment according to the word frequency in the current historical network data according to the current word segmentation, and according to the number of pieces of historical network data including the current word segment and the total number of pieces of historical network data.
  • the word weight calculation unit is configured to calculate the word weight of the current participle according to the word frequency of the current participle and the inverse document frequency.
  • the feature data extracting unit is configured to obtain the current word segment with the largest word weight as the feature data of the current historical network data.
  • the apparatus further includes:
  • the network address obtaining module is configured to acquire a network address of the terminal corresponding to the network data to be detected after intercepting the network data to be detected.
  • the frequency statistics module is configured to count the frequency of the network data to be detected sent by the terminal corresponding to the intercepted network address.
  • the blacklist library adds a module, when the frequency is greater than the preset frequency, the network data to be detected is added to the blacklist library.
  • the marking module 400 is further configured to mark the network data to be detected as normal data when the initial determination result indicates that the network data to be detected is not the first cheat data.
  • the device also includes a whitelist library adding module for adding normal data to the whitelist library.
  • the apparatus further includes:
  • the same data acquisition module is configured to obtain the same historical network data in the blacklist database according to the historical network data in the blacklist database; and obtain the same historical network data in the whitelist database according to the historical network data in the whitelist database. .
  • the de-duplication module is used to de-reprocess the same historical network data.
  • the apparatus further includes:
  • the test module is configured to input the preset positive sample and the preset negative sample into the machine learning model to obtain the test result.
  • a comparison module for comparing the test results with the expected results to obtain a comparison result.
  • a scoring module for scoring the model based on the comparison result computing machine.
  • the correction module is configured to correct the machine learning model by using the preset positive sample and the preset negative sample when the score is less than the preset score.
  • the machine learning model judging module is further configured to: when the score is greater than or equal to the preset score, continue to input the network data to be detected stored in the data queue into the machine learning model for processing to obtain an initial judgment result.
  • Each of the above-described network data detecting devices may be implemented in whole or in part by software, hardware, and a combination thereof.
  • Each of the above modules may be embedded in or independent of the processor in the computer device, or may be stored in a memory in the computer device in a software form, so that the processor invokes the operations corresponding to the above modules.
  • a computer device which may be a server, and its internal structure diagram may be as shown in FIG.
  • the computer device includes a processor, memory, network interface, and database connected by a system bus.
  • the processor of the computer device is used to provide computing and control capabilities.
  • the memory of the computer device includes a non-volatile storage medium, an internal memory.
  • the non-volatile storage medium stores an operating system, computer readable instructions, and a database.
  • the internal memory provides an environment for operation of an operating system and computer readable instructions in a non-volatile storage medium.
  • the database of the computer device is used to store a blacklist library, a whitelist library, log data, and the like.
  • the network interface of the computer device is used to communicate with an external terminal via a network connection.
  • the computer readable instructions are executed by a processor to implement a network data detection method.
  • FIG. 5 is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation of the computer device to which the solution of the present application is applied.
  • the specific computer device may It includes more or fewer components than those shown in the figures, or some components are combined, or have different component arrangements.
  • a computer device comprising a memory and one or more processors, the memory storing computer readable instructions, the computer readable instructions being executed by the processor, causing the one or more processors to perform the step of: intercepting network data to be detected And storing the intercepted network data to be detected into the data queue; inputting the to-be-detected network data stored in the data queue into the machine learning model for processing to obtain an initial judgment result; and when the initial judgment result indicates that the network data to be detected is
  • the first cheat data is used, the first cheat data is matched with the second cheat data in the rule base; when the first cheat data matches the second cheat data in the rule base, the network data to be detected is marked as Cheating data.
  • the processor when executing the computer readable instructions, further implements the steps of: acquiring historical network data that has been marked, and extracting feature data of historical network data; adding historical network data marked as cheat data to the blacklist library The historical network data marked as normal data is added to the whitelist library; the machine learning model is established according to the feature data of the historical network data in the blacklist library and the feature data of the historical network data in the whitelist library.
  • the step of extracting the feature data of the historical network data implemented by the processor when the processor executes the computer readable instructions may include: performing word segmentation processing on the historical network data; and using a word frequency in the current historical network data according to the current word segmentation, And obtaining the inverse document frequency of the current participle according to the number of historical network data including the current participle and the total number of historical network data; calculating the word weight of the current participle according to the word frequency of the current participle and the inverse document frequency; obtaining the maximum weight of the word The current participle is used as the characteristic data of the current historical network data.
  • the processor may further include: acquiring a network address of the terminal corresponding to the network data to be detected; and counting the network address corresponding to the intercepted network address.
  • the frequency of the network data to be detected sent by the terminal; when the frequency is greater than the preset frequency, the network data to be detected is added to the blacklist database.
  • the processor executes the computer readable instructions, the following steps are further implemented: when the initial judgment result indicates that the network data to be detected is not the first cheat data, the network data to be detected is marked as normal data; Add to the whitelisted library.
  • the processor executes the computer readable instructions, the following steps are further performed: acquiring the same historical network data in the blacklist library according to the order of the historical network data in the blacklist library; and following the historical network data in the whitelist library The order of the same historical network data in the whitelist library is obtained; the same historical network data is deduplicated.
  • the step of establishing a machine learning model according to the feature data of the historical network data in the blacklist library and the feature data of the historical network data in the whitelist library is further implemented.
  • the method may include: inputting a preset positive sample and a preset negative sample into a machine learning model to obtain a test result; comparing the test result with the expected result to obtain a comparison result; and calculating a score of the computer learning model according to the comparison result; when the score is less than a preset When the score is obtained, the machine learning model is corrected by the preset positive sample and the preset negative sample; when the score is greater than or equal to the preset score, the network data to be detected stored in the data queue is continuously input into the machine learning model.
  • the processing obtains the initial judgment result.
  • One or more non-transitory computer readable storage mediums storing computer readable instructions, when executed by one or more processors, cause one or more processors to perform the steps of: intercepting a network to be detected Data, and the intercepted network data to be detected is stored in the data queue; the network data to be detected stored in the data queue is input into the machine learning model for processing to obtain an initial judgment result; when the initial judgment result indicates the network data to be detected
  • the first cheat data is used, the first cheat data is matched with the second cheat data in the rule base; when the first cheat data and the second cheat data in the rule base are successfully matched, the network data to be detected is marked. For cheating data.
  • the computer readable instructions when executed by the processor, further implement the steps of: acquiring historical network data that has been marked, and extracting feature data of historical network data; adding historical network data marked as cheat data to the blacklist
  • the library adds historical network data marked as normal data to the whitelist library; the machine learning model is established according to the feature data of the historical network data in the blacklist library and the feature data of the historical network data in the whitelist library.
  • the step of extracting the feature data of the historical network data implemented by the processor when the computer readable instructions are executed by the processor may include: performing word segmentation processing on the historical network data; and word frequency in the current historical network data according to the current word segmentation. And obtaining the inverse document frequency of the current participle according to the number of historical network data including the current participle and the total number of historical network data; calculating the word weight of the current participle according to the word frequency and the inverse document frequency of the current participle; The current participle is used as the characteristic data of the current historical network data.
  • the method may further include: acquiring a network address of the terminal corresponding to the network data to be detected; and correspondingly collecting the network address that is intercepted The frequency of the network data to be detected sent by the terminal; when the frequency is greater than the preset frequency, the network data to be detected is added to the blacklist database.
  • the following steps are further implemented: when the initial judgment result indicates that the network data to be detected is not the first cheat data, the network data to be detected is marked as normal data; Data is added to the whitelist library.
  • the following steps are further performed: obtaining the same historical network data in the blacklist library according to the order of historical network data in the blacklist library; according to the historical network in the whitelist library The order of the data obtains the same historical network data in the whitelist library; the same historical network data is deduplicated.
  • the step of establishing a machine learning model based on the feature data of the historical network data in the blacklist library and the feature data of the historical network data in the whitelist library is implemented.
  • the method may further include: inputting a preset positive sample and a preset negative sample into the machine learning model to obtain a test result; comparing the test result with the expected result to obtain a comparison result; and comparing the score of the computer learning model according to the comparison result;
  • the score is set, the machine learning model is corrected by the preset positive sample and the preset negative sample; when the score is greater than or equal to the preset score, the network data to be detected stored in the data queue is continuously input into the machine learning model.
  • Non-volatile memory can include read only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory.
  • Volatile memory can include random access memory (RAM) or external cache memory.
  • RAM is available in a variety of formats, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronization chain.
  • SRAM static RAM
  • DRAM dynamic RAM
  • SDRAM synchronous DRAM
  • DDRSDRAM double data rate SDRAM
  • ESDRAM enhanced SDRAM
  • Synchlink DRAM SLDRAM
  • Memory Bus Radbus
  • RDRAM Direct RAM
  • DRAM Direct Memory Bus Dynamic RAM
  • RDRAM Memory Bus Dynamic RAM

Landscapes

  • Engineering & Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • Computer Security & Cryptography (AREA)
  • Data Mining & Analysis (AREA)
  • Theoretical Computer Science (AREA)
  • General Engineering & Computer Science (AREA)
  • Evolutionary Computation (AREA)
  • Life Sciences & Earth Sciences (AREA)
  • Computer Vision & Pattern Recognition (AREA)
  • Evolutionary Biology (AREA)
  • Bioinformatics & Cheminformatics (AREA)
  • Artificial Intelligence (AREA)
  • General Physics & Mathematics (AREA)
  • Bioinformatics & Computational Biology (AREA)
  • Probability & Statistics with Applications (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Information Retrieval, Db Structures And Fs Structures Therefor (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

一种网络数据检测方法，包括：截取待检测网络数据，并将所截取的待检测网络数据存放至数据队列中；将存储在所述数据队列中的待检测网络数据输入至机器学习模型中进行处理得到初始判断结果；当所述初始判断结果表示所述待检测网络数据为第一作弊数据时，则将所述第一作弊数据与规则库中的第二作弊数据进行匹配；当所述第一作弊数据与所述规则库中的第二作弊数据匹配成功时，则将所述待检测网络数据标记为作弊数据。

Description

网络数据检测方法、装置、计算机设备和存储介质
相关申请的交叉引用
本申请要求于2018年1月12日提交中国专利局，申请号为2018100322785，申请名称为“网络数据检测方法、装置、计算机设备和存储介质”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及一种网络数据检测方法、装置、计算机设备和存储介质。
背景技术
随着计算机技术的发展，出现了各种各样的营销活动，但是为了获取到该些营销活动中的奖励，出现了羊毛党，，羊毛党是指活跃在各互联网金融平台上，搜集各大电子商城、银行、实体店等各渠道的优惠促销活动、免费业务之类的信息，以此赚取小额奖励的投资者。
为了识别出该些羊毛党，发明人意识到，传统上是基于事前规则进行的，即通过事前规则判断对应的网络数据是否为作弊数据来判断该网络数据对应的用户是否为羊毛党。然而基于规则的反作弊系统需要事先制定规则，并根据该制定的规则对网络数据进行判断，并根据羊毛党的特征手动调整规则，但是这种判断方式中，由于手动调整的规则极易出现错误，因此通过手动调整规则极易造成羊毛党的判断错误。
发明内容
根据本申请公开的各种实施例，提供一种网络数据检测方法、装置、计算机设备和存储介质。
一种网络数据检测方法，包括：
截取待检测网络数据，并将所截取的待检测网络数据存放至数据队列中；
将存储在所述数据队列中的待检测网络数据输入至机器学习模型中进行处理得到初始判断结果；
当所述初始判断结果表示所述待检测网络数据为第一作弊数据时，则将所述第一作弊数据与规则库中的第二作弊数据进行匹配；及
当所述第一作弊数据与所述规则库中的第二作弊数据匹配成功时，则将所述待检测网络数据标记为作弊数据。
一种网络数据检测装置，包括：
截取模块，用于截取待检测网络数据，并将所截取的待检测网络数据存放至数据队列 中；
机器学习模型判断模块，用于将存储在所述数据队列中的待检测网络数据输入至机器学习模型中进行处理得到初始判断结果；
规则判断模块，用于当所述初始判断结果表示所述待检测网络数据为第一作弊数据时，则将所述第一作弊数据与规则库中的第二作弊数据进行匹配；及
标记模块，用于当所述第一作弊数据与所述规则库中的第二作弊数据匹配成功时，则将所述待检测网络数据标记为作弊数据。
一种计算机设备，包括存储器和一个或多个处理器，所述存储器中储存有计算机可读指令，所述计算机可读指令被所述处理器执行时，使得所述一个或多个处理器执行以下步骤：截取待检测网络数据，并将所截取的待检测网络数据存放至数据队列中；将存储在所述数据队列中的待检测网络数据输入至机器学习模型中进行处理得到初始判断结果；当所述初始判断结果表示所述待检测网络数据为第一作弊数据时，则将所述第一作弊数据与规则库中的第二作弊数据进行匹配；及当所述第一作弊数据与所述规则库中的第二作弊数据匹配成功时，则将所述待检测网络数据标记为作弊数据。
一个或多个存储有计算机可读指令的非易失性计算机可读存储介质，计算机可读指令被一个或多个处理器执行时，使得一个或多个处理器执行以下步骤：截取待检测网络数据，并将所截取的待检测网络数据存放至数据队列中；将存储在所述数据队列中的待检测网络数据输入至机器学习模型中进行处理得到初始判断结果；当所述初始判断结果表示所述待检测网络数据为第一作弊数据时，则将所述第一作弊数据与规则库中的第二作弊数据进行匹配；及当所述第一作弊数据与所述规则库中的第二作弊数据匹配成功时，则将所述待检测网络数据标记为作弊数据。
本申请的一个或多个实施例的细节在下面的附图和描述中提出。本申请的其它特征和优点将从说明书、附图以及权利要求书变得明显。
附图说明
为了更清楚地说明本申请实施例中的技术方案，下面将对实施例中所需要使用的附图作简单地介绍，显而易见地，下面描述中的附图仅仅是本申请的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动的前提下，还可以根据这些附图获得其它的附图。
图1为根据一个或多个实施例中网络数据检测方法的应用场景图。
图2为根据一个或多个实施例中的检测平台的架构图。
图3为根据一个或多个实施例中网络数据检测方法的流程示意图。
图4为根据一个或多个实施例中网络数据检测装置的框图。
图5为根据一个或多个实施例中计算机设备的框图。
具体实施方式
为了使本申请的技术方案及优点更加清楚明白，以下结合附图及实施例，对本申请进行进一步详细说明。应当理解，此处描述的具体实施例仅仅用以解释本申请，并不用于限定本申请。
本申请提供的网络数据检测方法，可以应用于如图1所示的应用环境中。终端通过网络与服务器通过网络进行通信。检测平台可以截取到终端与服务器通信的网络数据，并对该网络数据进行检测。例如，在检测平台截取到待检测网络数据后，则将所截取的待检测网路数据存放在数据队列中，然后依次通过机器学习模型和规则库中的规则对数据队列中的待检测网络数据进行检测，在机器学习模型和规则库中的规则均判定该待检测网络数据为作弊数据时，则将该待检测网络数据标记为作弊数据。终端可以但不限于是各种个人计算机、笔记本电脑、智能手机、平板电脑和便携式可穿戴设备，服务器即为网络服务器，其可以用独立的服务器或者是多个服务器组成的服务器集群来实现。检测平台也可以是以服务器或者多个服务器组成的服务器集群的形式实现。
参见图2，图2为一实施例中检测平台的架构图，包括H5侦测引擎、Android侦测引擎、IOS侦测引擎、数据队列模块、机器学习模型模块、规则管理模块、风控引擎、活动管理模块、决策引擎模块、日志管理模块、数据监控平台、黑名单库和白名单库。H5侦测引擎、Android侦测引擎、IOS侦测引擎用于截取待检测网络数据，并将所截取到的待检测网络数据放在数据队列中，机器学习模型模块用于对所截取到的待检测网络数据进行判断得到初始判断结果，当初始判断结果为作弊数据时，则继续通过规则管理模块调用风控引擎中的规则对该作弊数据进行进一步的判断。风控引擎中存储有对应的规则，活动管理模块中存储有对应的活动，且建立活动与规则之间的关系，决策引擎模块即将判断结果输出至数据监控平台，数据监控平台可以查看系统中的数据并对活动等进行管理。日志管理模块中存储有每次的判断记录，黑名单库中存储有作弊数据，白名单库中存储有正常数据等。
在其中一个实施例中，如图3所示，提供了一种网络数据检测方法，以该方法应用于图1中的检测平台为例进行说明，包括以下步骤：
S302：截取待检测网络数据，并将所截取的待检测网络数据存放至数据队列中。
具体地，该检测平台可以通过设置代理服务器的方式截取待检测网络数据，例如设置代理服务器，并在终端预先设置调用程序，当终端与服务器发生数据交互时，则代理服务器可以通过该调用程序获取到终端所发出的待检测网络数据，并将该待检测网络数据发送给检测平台，从而检测平台在接收到该待检测网络数据后将该待检测网络数据存储至数据队列中，从而保证后续检测平台可以从数据队列中获取数据进行处理。之所以设置数据队列预先存储是为了在大量数据的情况出现时，可以防止检测平台故障，检测平台依然可以根据当前处理情况获取到对应数量的待检测网络数据进行处理，从而保证检测平台有条不紊地处理待检测网络数据。
S304：将存储在数据队列中的待检测网络数据输入至机器学习模型中进行处理得到 初始判断结果。
具体地，机器学习模型是预先设置的模型，该模型可以对待检测网络数据进行处理以判断该待检测网络数据是否为作弊数据，该机器学习模型可以是根据历史网络数据学习得到的。
机器学习模型可以根据当前在处理的待检测网络数据的数量从数据队列中获取待检测网络数据，还可以是分批从数据队列中获取到待检测网络数据，即在当前在处理的待检测网络数据处理完成后，才会从数据队列中获取到下一次要处理的待检测网络数据。机器学习模型可以同时对多个待检测网络数据进行处理，例如通过多线程的方式实现等，以提高数据处理的速度。
S306：当初始判断结果表示待检测网络数据为第一作弊数据时，则将第一作弊数据与规则库中的第二作弊数据进行匹配。
具体地，当初始判断结果，即经过机器学习模型所得到的待检测网络数据为作弊数据时，则可以通过规则库进行进一步的判断，以保证机器学习模型的判断结果正确。当初始判断结果，即经过机器学习模型所得到的待检测网络数据为正常数据时，则不会对该待检测网络数据进行拦截等，以保证终端与服务器的正常通信，或者也可以将正常数据发送至规则库中进行二次判断，以防止机器学习模型将作弊数据判断为正常数据的情况的发生。
，规则库中存储有大量的用于判断待检测网络数据是否为作弊数据的数据规则，可以第一作弊数据与规则库中的规则中的数据进行匹配。
S308：当第一作弊数据与规则库中的第二作弊数据匹配成功时，则将待检测网络数据标记为作弊数据。
具体地，当第一作弊数据与规则库中的第二作弊数据匹配成功时，则说明该待检测网络数据为作弊数据，从而通过两者相互查漏补缺，可以提高判断的准确率，防止机器学习模型产生误判的情况。且当第一作弊数据与规则库中的第二作弊数据未匹配成功时，还可以将该第一作弊数据输出，以便于用户进行人工干预，对规则库进行调整等，例如当人工判断出该第一作弊数据确实为作弊数据时，则可以对规则库进行调整，增加相应的规则，实现规则库的扩充；当人工判断出该第一作弊数据不为作弊数据时，则可以通过该第一作弊数据对机器学习模型进行修正，以进一步提高机器学习模型的准确度。
，当检测平台截取到待检测网络数据后，需要判断该网络数据是否为羊毛党的终端发出的网络数据，即作弊数据，且为了在接收大量数据情况下检测平台能够正常运行，检测平台首先将待检测网络数据存放在数据队列中，然后通过机器学习模型对该待检测数据进行预判断得到初始判断结果，即先根据大数据智能模型(AI学习模型，即上述的机器学习模型)对该待检测数据进行初始判断，当该待检测网络数据为作弊数据时，则将该作弊数据再输入至规则库中进行检测，从而确保机器学习模型所作出的判断正确，通过机器学习模型首先对待检测网络数据进行判断，而不是首先通过规则库对待检测网络数据进行 判断的原因是由于机器学习模型的判断速度更加快，从而可以提高待检测网络数据的检测速度，其由于大多数网络数据均是正常网络数据，而非羊毛党的终端发出的网络数据，因此通过机器学习模型可以大量地减少输入至规则库的待检测网络数据，从而相比于先通过规则库进行判断的方式效率更高。
通过机器学习模型的判断，可以是首先提取到待检测网络数据的特征数据，该特征数据的提取方式可以是根据下文中提取历史网络数据的特征数据的方式相同，即首先对该待检测网络数据进行分词处理，然后计算当前分词在当前待检测网络数据中的词频，并根据包含当前分词的待检测网络数据的条数以及待检测网络数据的总条数获取到当前分词的逆文档频率；根据当前分词的词频和逆文档频率计算当前分词的词权重；获取词权重最大的当前分词作为当前待检测网络数据的特征数据；并通过所提取到的特征数据与机器模型中的特征数据进行比对，从而可以判断出该待检测网络数据是否为作弊数据，即是否为羊毛党对应的终端发出的数据，如果是，则继续将该作弊数据输入至规则库，并通过规则库对该作弊数据进行进一步的判断，由于机器学习模型的处理速度比较快，可以预先过滤掉大部分无效数据，再传输给规则库，可以提高判断的效率。
上述网络数据检测方法，首先通过机器学习模型对待检测网络数据进行初步判断，然后再通过规则库进行判断，两者相互查漏补缺，可以提高判断的准确率，且机器学习模型的处理速度比较快，可以预先过滤掉大部分无效数据，再传输给规则库，可以提高判断的效率。且机器学习模型的可以根据历史网络数据产生大量的新的规则，不需要人工添加，减少人力投入。
在其中一个实施例中，机器学习模型的生成主要包括三个步骤：定义目标问题，收集数据和特征，训练模型。因此该方法还包括一机器学习模型生成步骤，该机器学习模型生成步骤可以包括：获取已经标记的历史网络数据，并提取历史网络数据的特征数据；将标记为作弊数据的历史网络数据添加至黑名单库，将标记为正常数据的历史网络数据添加至白名单库；根据黑名单库中的历史网络数据的特征数据以及白名单库中的历史网络数据的特征数据建立机器学习模型。
，特征数据可以是可以代表该网络数据的数据，即如果某个特征数据在某一网络数据中出现的频率大，并且在其他网络数据中很少出现，则认为此特征数据具有很好的类别区分能力，因此该特征数据可以代表该网络数据，可选地，该特征数据可以为某一个词或某一个短语。
具体地，检测平台可以获取到以前标记完成的历史网络数据，该些历史网络数据已经进行了二分类，即已经根据标记分为正常数据和作弊数据，可以将正常数据存放在白名单库中，将作弊数据存放在黑名单库中；并提取该些历史网络数据的特征数据，根据特征数据和历史网络数据的类型即可以通过贝叶斯算法来进行建模生成机器学习模型。
，在生成机器学习模型后，还可以包括一个交叉训练步骤，即可以获取到其他的历史网络数据作为测试集用来对该机器学习模型进行优化。例如，通过GridSearchCV模型 对机器学习模型中的参数进行优化，即遍历机器学习模型中多种参数组合，通过交叉验证确定最佳效果参数。，参数可以包括测试集中的网络数据与机器学习模型中的特征数据的相似度等，选择相似度合适的参数作为机器学习模型的参数，例如当大于90％的相似度则认为待检测网络数据与机器学习模型中的特征数据相同，此时机器学习模型的判断准确率最好，则将该参数最为机器学习模型的参数。在对机器学习模型进行交叉训练后，将模型进行存储，以作为标准模型进行使用。
上述实施例中，通过对历史网络数据进行二分类和提取特征，并根据贝叶斯算来生成机器学习模型，使得该机器学习模型可靠，且在生成模型后对该机器学习模型进行交叉训练调参，进一步提高了机器学习模型的可靠性。
在其中一个实施例中，提取历史网络数据的特征数据的步骤可以包括：对历史网络数据进行分词处理；根据当前分词在当前历史网络数据中的词频，并根据包含当前分词的历史网络数据的条数以及历史网络数据的总条数获取到当前分词的逆文档频率；根据当前分词的词频和逆文档频率计算当前分词的词权重；获取词权重最大的当前分词作为当前历史网络数据的特征数据。
具体地，可以对历史网络数据进行分词处理，该分词处理可以是根据预设的分词逻辑进行处理或者是对历史网络数据进行随机分词，在此不做限制。如果根据预设的分词逻辑进行处理时，可以设置分词逻辑库，在分词处理之前，首先获取到该分词逻辑库，再将该分词逻辑库中的分词与历史网络数据进行匹配，匹配成功，则在该词前后加入分词符以进行分词。如果是对历史网络数据进行随机分词，则可以预先设定分词步长，例如可以将预设步长设定为3个字符、5个字符等等。具体的预设步长可以根据实际经验进行设置。检测平台根据预设步长按照预设切分顺序将历史网络数据依次切分成多个分词，预设切分顺序可以为由右至左的顺序，也可以为由左至右的顺序，也可以为其他顺序。
，当前分词在当前历史网络数据中的词频＝当前分词在当前历史网络数据中出现的次数/当前历史网络数据的总分词数据；当前分词的逆文档频率＝log(包含当前分词的历史网络数据的条数)/(历史网络数据的总条数+1)；词权重＝词频*逆文档频率。
例如，当某次活动的历史网络数据包含1000条，第一条历史网络数据共计10个单词，单引号有3个，from也有3个，1000条历史网络数据中有10条语句包含单引号，100条语句包含from，则当前分词“单引号”的词频＝3/10＝0.3，逆文档频率＝log(10/(1000+1))＝1.958，因此词权重＝0.3*1.958＝0.5874。当前分词“from”的词频＝3/10＝0.3，逆文档频率＝log(100/(1000+1))＝0.995，因此词权重＝0.3*0.995＝0.3318。具体可以参见下表：
Figure PCTCN2018099948-appb-000001
，单引号的词权重＝0.587>from的词权重＝0.3318，因此单引号的词权重对比之下更大，比from更能代表一条历史网络数据是否是攻击语句，即作弊数据。
上述实施例中，特征数据可以是可以代表该网络数据的数据，即如果某个特征数据在某一网络数据中出现的频率大，并且在其他网络数据中很少出现，则认为此特征数据具有很好的类别区分能力，因此该特征数据可以代表该网络数据，因此通过计算分词的词权重可以准确地判断出该分词是否可以作为特征数据，为提高后续机器学习模型的准确性奠定基础。
在其中一个实施例中，由于羊毛党可能根据机器学习对数据进行一定的修改，因此使得机器学习模型不再适应当前羊毛党的判断，为了避免这种情况的发生，可以对生成机器学习模型的黑名单库和白名单库中的历史网络数据进行优化，以提高样本的准确性，从而可以设置时间段重新生成该机器学习模型，提高机器学习模型的适应性。对于黑名单库和白名单库中的历史网络数据的优化可以包括历史网络数据的增加以及历史网络数据的删除，对于历史网络数据的增加可以包括黑名单库中的历史网络数据的增加和白名单库中的实例网络数据的增加。对于历史网络数据的删除主要是针对数据去重和加密数据的删除。
具体地，对于黑名单库中历史网络数据的增加可以是在截取待检测网络数据的步骤之后，即在截取待检测网络数据的步骤之后还可以包括获取待检测网络数据对应的终端的网络地址；统计截取到的网络地址对应的终端发送的待检测网络数据的频率；当频率大于预设频率时，则将待检测网络数据添加到黑名单库中。即可以通过日志管理模块搜集动态网络地址黑名单，将动态网络地址所发送的网络数据添加到黑名单中，一般会认为检测平台持续截取到某一网络地址对应的网络数据，则认为该网络地址所对应的网络数据为作弊数据，因此可以统计截取到的网络地址对应的终端发送的待检测网络数据的频率，即在预设时间段内截取到该网络地址所发送的网络数据的次数，如果大于预设次数，则认为该网络数据为作弊数据，直接加入到黑名单库中即可。
具体地，对于黑名单库中历史网络数据的增加可以包括当初始判断结果表示待检测网络数据不为第一作弊数据时，则将待检测网络数据标记为正常数据；将正常数据添加到白名单库中。即可以定期获取到正常数据的原始网络数据添加到白名单库中，以更新白名单库，保证白名单库的时效性，白名单数据可以包括通过机器学习模型判断得到的正常数据，还可以包括人工干预后确定的为正常数据的第一作弊数据，这样可以增加正常数据的多样性，提高正常数据的覆盖范围，从而可以保证白名单库中的网络数据的覆盖面更全。在该实施例中，可以定期将标记为正常数据的网络数据添加到白名单库中，例如检测平台可以获取到日志管理模块中的日志数据，从选取标记为正常数据的新的网络数据，例如可以根据上次添加的日期，获取上次添加日期后的新的网络数据，将该新的网络数据添加至对应的白名单库中。
具体地，对于历史网络数据的删除包括去重和加密数据的删除，去重包括按照黑名单库中的历史网络数据的顺序获取黑名单库中相同的历史网络数据；按照白名单库中的历史网络数据的顺序获取白名单库中相同的历史网络数据；对相同的历史网络数据进行去重处理。例如可以通过黑名单库中的第一条历史网络数据依次去匹配黑名单库中的其他历史网络数据，当两条历史网络数据的相似度大于预设相似度时，则认为该两条历史网络数据相同，因此删除掉一条，仅保留一条历史网络数据即可。同样地对于白名单库，可以通过白名单库中的第一条历史网络数据依次去匹配白名单库中的其他历史网络数据，当两条历史网络数据的相似度大于预设相似度时，则认为该两条历史网络数据相同，因此删除掉一条，仅保留一条历史网络数据即可，这样可以尽可能地将样本的数量，提高数据处理的效率。对于加密数据的去重，可以是根据预设参数名称从白名单库和黑名单库中去重，例如可以将加密的参数的名称预先进行存储，当该历史网络数据中存在该参数的名称时，则直接从白名单库和黑名单库中删除该参数对应的网络数据。
上述实施例中，对白名单库和黑名单库中的历史网络数据进行清洗，可以通过机器学习大量的样本并产生新的样本，大大释放原有人工的维护量。
在其中一个实施例中，还包括一对机器学习模型进行评估的步骤，该步骤可以是在生成机器学习模型的步骤之后进行，即在根据黑名单库中的历史网络数据的特征数据以及白名单库中的历史网络数据的特征数据建立机器学习模型的步骤之后，还可以包括：将预设正样本和预设负样本输入至机器学习模型中得到测试结果；将测试结果与预期结果进行比较得到比较结果；根据比较结果计算机器学习模型的评分；当评分小于预设分数时，则通过预设正样本和预设负样本对机器学习模型进行修正；当评分大于等于预设分数时，则继续将存储在数据队列中的待检测网络数据输入至机器学习模型中进行处理得到初始判断结果。
具体地，预设的正样本和负样本是已经确定其为正常数据还是作弊数据的网络数据，将该网络数据输入至机器学习模型中可以得到测试结果，将该测试结果与预期结果进行比较得到比较结果，并可以根据比较结果得到机器学习模型的评分。例如参见下表所示：
Figure PCTCN2018099948-appb-000002
将该测试结果与预期结果进行比较得到比较结果：TP：正确肯定——实际是正常数据，识别为正常数据；FN：错误否定(漏报)——实际是正常数据，却识别成了作弊数据；FP：错误肯定(误报)——实际是作弊数据，却识别成了正常数据；TN：正确否定——实际是作弊数据，识别为作弊数据。并根据比较结果计算机器学习模型的评分：评分的参数包括：准确率、误分率、召回率、查准率、TPR、FAR、FRR以及f1-score等，该 些参数的具体计算方式如下：
AccuracyRate(准确率)：(TP+TN)/(TP+TN+FN+FP)；
ErrorRate(误分率)：(FN+FP)/(TP+TN+FN+FP)；
Recall(召回率、查全率、击中概率)：TP/(TP+FN)，在所有正常数据中有多少被识别为正常数据；
Precision(查准率)：TP/(TP+FP)，在所有识别成正常数据中有多少是真正的正常数据；
TPR(TruePositive Rate)：TP/(TP+FN)，实际就是Recall；
FAR(FalseAcceptance Rate)或FPR(False Positive Rate)：FP/(FP+TN)，错误接收率，误报率，在所有作弊数据中有多少被识别为正常数据；
FRR(FalseRejection Rate)：FN/(TP+FN)，错误拒绝率，拒真率，在所有正常数据中有多少被识别为作弊数据，它等于1-Recall；
f1-score是召回率和准确率的调和平均数，并假设两者一样重要,计算公式：f1-score＝(2*Recall*Accuracy)/(Recall+Accuracy)。
根据所计算的参数可以对机器学习模型进行打分或分级，只有分数或等级合适的机器学习模型才会投入使用。即当评分大于等于预设分数时，则继续将存储在数据队列中的待检测网络数据输入至机器学习模型中进行处理得到初始判断结果。当评分小于预设分数时，则通过预设正样本和预设负样本对机器学习模型进行修正，例如通过预设正常本和预设负样本对在机器学习模型的基础上再次进行训练等。
上述实施例中，在生成机器学习模型之后，并非直接将机器学习模型投入使用，而是对机器学习模型进行打分，只有分数合适的机器学习模型才会投入使用，进一步提高了待检测网络数据的检测准确性。
应该理解的是，虽然图3的流程图中的各个步骤按照箭头的指示依次显示，但是这些步骤并不是必然按照箭头指示的顺序依次执行。除非本文中有明确的说明，这些步骤的执行并没有严格的顺序限制，这些步骤可以以其它的顺序执行。而且，图3中的至少一部分步骤可以包括多个子步骤或者多个阶段，这些子步骤或者阶段并不必然是在同一时刻执行完成，而是可以在不同的时刻执行，这些子步骤或者阶段的执行顺序也不必然是依次进行，而是可以与其它步骤或者其它步骤的子步骤或者阶段的至少一部分轮流或者交替地执行。
在一个实施例中，如图4所示，提供了一种网络数据检测装置，包括：截取模块100、机器学习模型判断模块200、规则判断模块300、标记模块400，其中：
截取模块100，用于截取待检测网络数据，并将所截取的待检测网络数据存放至数据队列中。
机器学习模型判断模块200，用于将存储在数据队列中的待检测网络数据输入至机器学习模型中进行处理得到初始判断结果。
规则判断模块300，用于当初始判断结果表示待检测网络数据为第一作弊数据时，则将第一作弊数据与规则库中的第二作弊数据进行匹配。
标记模块400，用于当第一作弊数据与规则库中的第二作弊数据匹配成功时，则将待检测网络数据标记为作弊数据。
在其中一个实施例中，装置还包括：
特征数据提取模块，用于获取已经标记的历史网络数据，并提取历史网络数据的特征数据。
库生成模块，用于将标记为作弊数据的历史网络数据添加至黑名单库，将标记为正常数据的历史网络数据添加至白名单库。
机器学习模型生成模块，用于根据黑名单库中的历史网络数据的特征数据以及白名单库中的历史网络数据的特征数据建立机器学习模型。
在其中一个实施例中，特征数据提取模块包括：
分词单元，用于对历史网络数据进行分词处理。
词特征获取单元，用于根据当前分词在当前历史网络数据中的词频，并根据包含当前分词的历史网络数据的条数以及历史网络数据的总条数获取到当前分词的逆文档频率。
词权重计算单元，用于根据当前分词的词频和逆文档频率计算当前分词的词权重。
特征数据提取单元，用于获取词权重最大的当前分词作为当前历史网络数据的特征数据。
在其中一个实施例中，装置还包括：
网络地址获取模块，用于在截取待检测网络数据后，获取待检测网络数据对应的终端的网络地址。
频率统计模块，用于统计截取到的网络地址对应的终端发送的待检测网络数据的频率。
黑名单库添加模块，用于当频率大于预设频率时，则将待检测网络数据添加到黑名单库中。
在其中一个实施例中，标记模块400还用于当初始判断结果表示待检测网络数据不为第一作弊数据时，则将待检测网络数据标记为正常数据。
装置还包括：白名单库添加模块，用于将正常数据添加到白名单库中。
在其中一个实施例中，装置还包括：
相同数据获取模块，用于按照黑名单库中的历史网络数据的顺序获取黑名单库中相同的历史网络数据；按照白名单库中的历史网络数据的顺序获取白名单库中相同的历史网络数据。
去重模块，用于对相同的历史网络数据进行去重处理。
在其中一个实施例中，装置还包括：
测试模块，用于将预设正样本和预设负样本输入至机器学习模型中得到测试结果。
比较模块，用于将测试结果与预期结果进行比较得到比较结果。
评分模块，用于根据比较结果计算机器学习模型的评分。
修正模块，用于当评分小于预设分数时，则通过预设正样本和预设负样本对机器学习模型进行修正。
机器学习模型判断模块还用于当评分大于等于预设分数时，则继续将存储在数据队列中的待检测网络数据输入至机器学习模型中进行处理得到初始判断结果。
关于网络数据检测装置的具体限定可以参见上文中对于网络数据检测方法的限定，在此不再赘述。上述网络数据检测装置中的各个模块可全部或部分通过软件、硬件及其组合来实现。上述各模块可以硬件形式内嵌于或独立于计算机设备中的处理器中，也可以以软件形式存储于计算机设备中的存储器中，以便于处理器调用执行以上各个模块对应的操作。
在一个实施例中，提供了一种计算机设备，该计算机设备可以是服务器，其内部结构图可以如图5所示。该计算机设备包括通过系统总线连接的处理器、存储器、网络接口和数据库。，该计算机设备的处理器用于提供计算和控制能力。该计算机设备的存储器包括非易失性存储介质、内存储器。该非易失性存储介质存储有操作系统、计算机可读指令和数据库。该内存储器为非易失性存储介质中的操作系统和计算机可读指令的运行提供环境。该计算机设备的数据库用于存储黑名单库、白名单库以及日志数据等。该计算机设备的网络接口用于与外部的终端通过网络连接通信。该计算机可读指令被处理器执行时以实现一种网络数据检测方法。
本领域技术人员可以理解，图5中示出的结构，仅仅是与本申请方案相关的部分结构的框图，并不构成对本申请方案所应用于其上的计算机设备的限定，具体的计算机设备可以包括比图中所示更多或更少的部件，或者组合某些部件，或者具有不同的部件布置。
一种计算机设备，包括存储器和一个或多个处理器，存储器中储存有计算机可读指令，计算机可读指令被处理器执行时，使得一个或多个处理器执行以下步骤：截取待检测网络数据，并将所截取的待检测网络数据存放至数据队列中；将存储在数据队列中的待检测网络数据输入至机器学习模型中进行处理得到初始判断结果；当初始判断结果表示待检测网络数据为第一作弊数据时，则将第一作弊数据与规则库中的第二作弊数据进行匹配；当第一作弊数据与规则库中的第二作弊数据匹配成功时，则将待检测网络数据标记为作弊数据。
在一个实施例中，处理器执行计算机可读指令时还实现以下步骤：获取已经标记的历史网络数据，并提取历史网络数据的特征数据；将标记为作弊数据的历史网络数据添加至黑名单库，将标记为正常数据的历史网络数据添加至白名单库；根据黑名单库中的历史网络数据的特征数据以及白名单库中的历史网络数据的特征数据建立机器学习模型。
在一个实施例中，处理器执行计算机可读指令时所实现的提取历史网络数据的特征数据的步骤，可以包括：对历史网络数据进行分词处理；根据当前分词在当前历史网络数 据中的词频，并根据包含当前分词的历史网络数据的条数以及历史网络数据的总条数获取到当前分词的逆文档频率；根据当前分词的词频和逆文档频率计算当前分词的词权重；获取词权重最大的当前分词作为当前历史网络数据的特征数据。
在一个实施例中，处理器执行计算机可读指令时所实现的截取待检测网络数据的步骤之后，还可以包括：获取待检测网络数据对应的终端的网络地址；统计截取到的网络地址对应的终端发送的待检测网络数据的频率；当频率大于预设频率时，则将待检测网络数据添加到黑名单库中。
在一个实施例中，处理器执行计算机可读指令时还实现以下步骤：当初始判断结果表示待检测网络数据不为第一作弊数据时，则将待检测网络数据标记为正常数据；将正常数据添加到白名单库中。
在一个实施例中，处理器执行计算机可读指令时还实现以下步骤：按照黑名单库中的历史网络数据的顺序获取黑名单库中相同的历史网络数据；按照白名单库中的历史网络数据的顺序获取白名单库中相同的历史网络数据；对相同的历史网络数据进行去重处理。
在一个实施例中，处理器执行计算机可读指令时所实现的根据黑名单库中的历史网络数据的特征数据以及白名单库中的历史网络数据的特征数据建立机器学习模型的步骤之后，还可以包括：将预设正样本和预设负样本输入至机器学习模型中得到测试结果；将测试结果与预期结果进行比较得到比较结果；根据比较结果计算机器学习模型的评分；当评分小于预设分数时，则通过预设正样本和预设负样本对机器学习模型进行修正；当评分大于等于预设分数时，则继续将存储在数据队列中的待检测网络数据输入至机器学习模型中进行处理得到初始判断结果。
一个或多个存储有计算机可读指令的非易失性计算机可读存储介质，计算机可读指令被一个或多个处理器执行时，使得一个或多个处理器执行以下步骤：截取待检测网络数据，并将所截取的待检测网络数据存放至数据队列中；将存储在数据队列中的待检测网络数据输入至机器学习模型中进行处理得到初始判断结果；当初始判断结果表示待检测网络数据为第一作弊数据时，则将第一作弊数据与规则库中的第二作弊数据进行匹配；当第一作弊数据与规则库中的第二作弊数据匹配成功时，则将待检测网络数据标记为作弊数据。
在一个实施例中，计算机可读指令被处理器执行时还实现以下步骤：获取已经标记的历史网络数据，并提取历史网络数据的特征数据；将标记为作弊数据的历史网络数据添加至黑名单库，将标记为正常数据的历史网络数据添加至白名单库；根据黑名单库中的历史网络数据的特征数据以及白名单库中的历史网络数据的特征数据建立机器学习模型。
在一个实施例中，计算机可读指令被处理器执行时所实现的提取历史网络数据的特征数据的步骤，可以包括：对历史网络数据进行分词处理；根据当前分词在当前历史网络数据中的词频，并根据包含当前分词的历史网络数据的条数以及历史网络数据的总条数获取到当前分词的逆文档频率；根据当前分词的词频和逆文档频率计算当前分词的词权重；获取词权重最大的当前分词作为当前历史网络数据的特征数据。
在一个实施例中，计算机可读指令被处理器执行时所实现的截取待检测网络数据的步骤之后，还可以包括：获取待检测网络数据对应的终端的网络地址；统计截取到的网络地址对应的终端发送的待检测网络数据的频率；当频率大于预设频率时，则将待检测网络数据添加到黑名单库中。
在一个实施例中，计算机可读指令被处理器执行时还实现以下步骤：当初始判断结果表示待检测网络数据不为第一作弊数据时，则将待检测网络数据标记为正常数据；将正常数据添加到白名单库中。
在一个实施例中，计算机可读指令被处理器执行时还实现以下步骤：按照黑名单库中的历史网络数据的顺序获取黑名单库中相同的历史网络数据；按照白名单库中的历史网络数据的顺序获取白名单库中相同的历史网络数据；对相同的历史网络数据进行去重处理。
在一个实施例中，计算机可读指令被处理器执行时所实现的根据黑名单库中的历史网络数据的特征数据以及白名单库中的历史网络数据的特征数据建立机器学习模型的步骤之后，还可以包括：将预设正样本和预设负样本输入至机器学习模型中得到测试结果；将测试结果与预期结果进行比较得到比较结果；根据比较结果计算机器学习模型的评分；当评分小于预设分数时，则通过预设正样本和预设负样本对机器学习模型进行修正；当评分大于等于预设分数时，则继续将存储在数据队列中的待检测网络数据输入至机器学习模型中进行处理得到初始判断结果。本领域普通技术人员可以理解实现上述实施例方法中的全部或部分流程，是可以通过计算机可读指令来指令相关的硬件来完成，所述的计算机可读指令可存储于一非易失性计算机可读取存储介质中，该计算机可读指令在执行时，可包括如上述各方法的实施例的流程。，本申请所提供的各实施例中所使用的对存储器、存储、数据库或其它介质的任何引用，均可包括非易失性和/或易失性存储器。非易失性存储器可包括只读存储器(ROM)、可编程ROM(PROM)、电可编程ROM(EPROM)、电可擦除可编程ROM(EEPROM)或闪存。易失性存储器可包括随机存取存储器(RAM)或者外部高速缓冲存储器。作为说明而非局限，RAM以多种形式可得，诸如静态RAM(SRAM)、动态RAM(DRAM)、同步DRAM(SDRAM)、双数据率SDRAM(DDRSDRAM)、增强型SDRAM(ESDRAM)、同步链路(Synchlink)DRAM(SLDRAM)、存储器总线(Rambus)直接RAM(RDRAM)、直接存储器总线动态RAM(DRDRAM)、以及存储器总线动态RAM(RDRAM)等。
以上实施例的各技术特征可以进行任意的组合，为使描述简洁，未对上述实施例中的各个技术特征所有可能的组合都进行描述，然而，只要这些技术特征的组合不存在矛盾，都应当认为是本说明书记载的范围。
以上所述实施例仅表达了本申请的几种实施方式，其描述较为具体和详细，但并不能因此而理解为对发明专利范围的限制。应当指出的是，对于本领域的普通技术人员来说，在不脱离本申请构思的前提下，还可以做出若干变形和改进，这些都属于本申请的保护范 围。因此，本申请专利的保护范围应以所附权利要求为准。

Claims (20)

  1. 一种网络数据检测方法，包括：
    截取待检测网络数据，并将所截取的待检测网络数据存放至数据队列中；
    将存储在所述数据队列中的待检测网络数据输入至机器学习模型中进行处理得到初始判断结果；
    当所述初始判断结果表示所述待检测网络数据为第一作弊数据时，则将所述第一作弊数据与规则库中的第二作弊数据进行匹配；及
    当所述第一作弊数据与所述规则库中的第二作弊数据匹配成功时，则将所述待检测网络数据标记为作弊数据。
  2. 根据权利要求1所述的方法，其特征在于，所述方法还包括：
    获取已经标记的历史网络数据，并提取所述历史网络数据的特征数据；
    将标记为作弊数据的所述历史网络数据添加至黑名单库，将标记为正常数据的所述历史网络数据添加至白名单库；及
    根据所述黑名单库中的历史网络数据的特征数据以及所述白名单库中的历史网络数据的特征数据建立机器学习模型。
  3. 根据权利要求2所述的方法，其特征在于，所述提取所述历史网络数据的特征数据，包括：
    对所述历史网络数据进行分词处理；
    根据当前分词在当前历史网络数据中的词频，并根据包含所述当前分词的历史网络数据的条数以及所述历史网络数据的总条数获取到所述当前分词的逆文档频率；
    根据所述当前分词的词频和逆文档频率计算所述当前分词的词权重；及
    获取词权重最大的当前分词作为所述当前历史网络数据的特征数据。
  4. 根据权利要求2或3所述的方法，其特征在于，所述截取待检测网络数据之后，还包括：
    获取所述待检测网络数据对应的终端的网络地址；
    统计截取到的所述网络地址对应的终端发送的所述待检测网络数据的频率；及
    当所述频率大于预设频率时，则将所述待检测网络数据添加到所述黑名单库中。
  5. 根据权利要求2或3所述的方法，其特征在于，所述方法还包括：
    当所述初始判断结果表示所述待检测网络数据不为第一作弊数据时，则将所述待检测网络数据标记为正常数据；及
    将所述正常数据添加到所述白名单库中。
  6. 根据权利要求2或3所述的方法，其特征在于，所述方法还包括：
    按照所述黑名单库中的历史网络数据的顺序获取所述黑名单库中相同的历史网络数据；
    按照所述白名单库中的历史网络数据的顺序获取所述白名单库中相同的历史网络数 据；及
    对所述相同的历史网络数据进行去重处理。
  7. 根据权利要求2或3所述的方法，其特征在于，所述根据所述黑名单库中的历史网络数据的特征数据以及所述白名单库中的历史网络数据的特征数据建立机器学习模型之后，还包括：
    将预设正样本和预设负样本输入至所述机器学习模型中得到测试结果；
    将所述测试结果与预期结果进行比较得到比较结果；
    根据所述比较结果计算所述机器学习模型的评分；
    当所述评分小于预设分数时，则通过所述预设正样本和预设负样本对所述机器学习模型进行修正；及
    当所述评分大于等于所述预设分数时，则继续将存储在所述数据队列中的待检测网络数据输入至机器学习模型中进行处理得到初始判断结果。
  8. 一种网络数据检测装置，包括：
    截取模块，用于截取待检测网络数据，并将所截取的待检测网络数据存放至数据队列中；
    机器学习模型判断模块，用于将存储在所述数据队列中的待检测网络数据输入至机器学习模型中进行处理得到初始判断结果；
    规则判断模块，用于当所述初始判断结果表示所述待检测网络数据为第一作弊数据时，则将所述第一作弊数据与规则库中的第二作弊数据进行匹配；及
    标记模块，用于当所述第一作弊数据与所述规则库中的第二作弊数据匹配成功时，则将所述待检测网络数据标记为作弊数据。
  9. 一种计算机设备，包括存储器及一个或多个处理器，所述存储器中储存有计算机可读指令，所述计算机可读指令被所述一个或多个处理器执行时，使得所述一个或多个处理器执行以下步骤：截取待检测网络数据，并将所截取的待检测网络数据存放至数据队列中；将存储在所述数据队列中的待检测网络数据输入至机器学习模型中进行处理得到初始判断结果；当所述初始判断结果表示所述待检测网络数据为第一作弊数据时，则将所述第一作弊数据与规则库中的第二作弊数据进行匹配；及当所述第一作弊数据与所述规则库中的第二作弊数据匹配成功时，则将所述待检测网络数据标记为作弊数据。
  10. 根据权利要9所述的计算机设备，其特征在于，所述处理器执行所述计算机可读指令时还执行以下步骤：获取已经标记的历史网络数据，并提取所述历史网络数据的特征数据；将标记为作弊数据的所述历史网络数据添加至黑名单库，将标记为正常数据的所述历史网络数据添加至白名单库；及根据所述黑名单库中的历史网络数据的特征数据以及所述白名单库中的历史网络数据的特征数据建立机器学习模型。
  11. 根据权利要10所述的计算机设备，其特征在于，所述处理器执行所述计算机可读指令时所实现的所述提取所述历史网络数据的特征数据，包括：对所述历史网络数据进 行分词处理；根据当前分词在当前历史网络数据中的词频，并根据包含所述当前分词的历史网络数据的条数以及所述历史网络数据的总条数获取到所述当前分词的逆文档频率；根据所述当前分词的词频和逆文档频率计算所述当前分词的词权重；及获取词权重最大的当前分词作为所述当前历史网络数据的特征数据。
  12. 根据权利要10或11所述的计算机设备，其特征在于，所述处理器执行所述计算机可读指令时所实现的所述截取待检测网络数据之后，还包括：获取所述待检测网络数据对应的终端的网络地址；统计截取到的所述网络地址对应的终端发送的所述待检测网络数据的频率；及当所述频率大于预设频率时，则将所述待检测网络数据添加到所述黑名单库中。
  13. 根据权利要10或11所述的计算机设备，其特征在于，所述处理器执行所述计算机可读指令时还执行以下步骤：当所述初始判断结果表示所述待检测网络数据不为第一作弊数据时，则将所述待检测网络数据标记为正常数据；及将所述正常数据添加到所述白名单库中。
  14. 根据权利要10或11所述的计算机设备，其特征在于，所述处理器执行所述计算机可读指令时还执行以下步骤：按照所述黑名单库中的历史网络数据的顺序获取所述黑名单库中相同的历史网络数据；按照所述白名单库中的历史网络数据的顺序获取所述白名单库中相同的历史网络数据；及对所述相同的历史网络数据进行去重处理。
  15. 根据权利要10或11所述的计算机设备，其特征在于，所述处理器执行所述计算机可读指令时所实现的所述根据所述黑名单库中的历史网络数据的特征数据以及所述白名单库中的历史网络数据的特征数据建立机器学习模型之后，还包括：将预设正样本和预设负样本输入至所述机器学习模型中得到测试结果；将所述测试结果与预期结果进行比较得到比较结果；根据所述比较结果计算所述机器学习模型的评分；当所述评分小于预设分数时，则通过所述预设正样本和预设负样本对所述机器学习模型进行修正；及当所述评分大于等于所述预设分数时，则继续将存储在所述数据队列中的待检测网络数据输入至机器学习模型中进行处理得到初始判断结果。
  16. 一个或多个存储有计算机可读指令的非易失性计算机可读存储介质，所述计算机可读指令被一个或多个处理器执行时，使得所述一个或多个处理器执行以下步骤：截取待检测网络数据，并将所截取的待检测网络数据存放至数据队列中；将存储在所述数据队列中的待检测网络数据输入至机器学习模型中进行处理得到初始判断结果；当所述初始判断结果表示所述待检测网络数据为第一作弊数据时，则将所述第一作弊数据与规则库中的第二作弊数据进行匹配；及当所述第一作弊数据与所述规则库中的第二作弊数据匹配成功时，则将所述待检测网络数据标记为作弊数据。
  17. 根据权利要16所述的存储介质，其特征在于，所述计算机可读指令被所述处理器执行时还执行以下步骤：获取已经标记的历史网络数据，并提取所述历史网络数据的特征数据；将标记为作弊数据的所述历史网络数据添加至黑名单库，将标记为正常数据的所 述历史网络数据添加至白名单库；及根据所述黑名单库中的历史网络数据的特征数据以及所述白名单库中的历史网络数据的特征数据建立机器学习模型。
  18. 根据权利要17所述的存储介质，其特征在于，所述计算机可读指令被所述处理器执行时所实现的所述提取所述历史网络数据的特征数据，包括：对所述历史网络数据进行分词处理；根据当前分词在当前历史网络数据中的词频，并根据包含所述当前分词的历史网络数据的条数以及所述历史网络数据的总条数获取到所述当前分词的逆文档频率；根据所述当前分词的词频和逆文档频率计算所述当前分词的词权重；及获取词权重最大的当前分词作为所述当前历史网络数据的特征数据。
  19. 根据权利要17或18所述的存储介质，其特征在于，所述计算机可读指令被所述处理器执行时所实现的所述截取待检测网络数据之后，还包括：获取所述待检测网络数据对应的终端的网络地址；统计截取到的所述网络地址对应的终端发送的所述待检测网络数据的频率；及当所述频率大于预设频率时，则将所述待检测网络数据添加到所述黑名单库中。
  20. 根据权利要17或18所述的存储介质，其特征在于，所述计算机可读指令被所述处理器执行时还执行以下步骤：当所述初始判断结果表示所述待检测网络数据不为第一作弊数据时，则将所述待检测网络数据标记为正常数据；及将所述正常数据添加到所述白名单库中。
PCT/CN2018/099948 2018-01-12 2018-08-10 网络数据检测方法、装置、计算机设备和存储介质 Ceased WO2019136990A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201810032278.5 2018-01-12
CN201810032278.5A CN108306864B (zh) 2018-01-12 2018-01-12 网络数据检测方法、装置、计算机设备和存储介质

Publications (1)

Publication Number Publication Date
WO2019136990A1 true WO2019136990A1 (zh) 2019-07-18

Family

ID=62868987

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2018/099948 Ceased WO2019136990A1 (zh) 2018-01-12 2018-08-10 网络数据检测方法、装置、计算机设备和存储介质

Country Status (2)

Country Link
CN (1) CN108306864B (zh)
WO (1) WO2019136990A1 (zh)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111813827A (zh) * 2020-06-22 2020-10-23 中国工商银行股份有限公司 黑名单筛查方法和装置、电子设备以及存储介质
CN113743392A (zh) * 2020-05-28 2021-12-03 阿里巴巴集团控股有限公司 识别模型的训练方法、识别方法和装置

Families Citing this family (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN108306864B (zh) * 2018-01-12 2021-02-26 深圳壹账通智能科技有限公司 网络数据检测方法、装置、计算机设备和存储介质
CN110928537B (zh) * 2018-09-19 2023-08-11 百度在线网络技术（北京）有限公司 模型评测方法、装置、设备及计算机可读介质
CN109657892A (zh) * 2018-09-27 2019-04-19 深圳壹账通智能科技有限公司 基于数据分析的机器行为识别方法、装置、设备和介质
CN111833064B (zh) * 2019-04-17 2022-04-12 马上消费金融股份有限公司 一种作弊检测方法及装置
CN110347724A (zh) * 2019-07-12 2019-10-18 深圳众赢维融科技有限公司 异常行为识别方法、装置、电子设备及介质
CN111262923B (zh) * 2020-01-14 2022-08-19 深圳壹账通智能科技有限公司 数据同步方法、装置、计算机设备及存储介质
CN113743619B (zh) * 2020-05-27 2023-09-29 西交利物浦大学 基于关联网络行为的作弊用户识别方法和装置
US11743272B2 (en) * 2020-08-10 2023-08-29 International Business Machines Corporation Low-latency identification of network-device properties
CN113132359A (zh) * 2021-03-30 2021-07-16 深圳市吉方工控有限公司 一种网络安全数据信息检测方法

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103077172A (zh) * 2011-10-26 2013-05-01 腾讯科技（深圳）有限公司 一种挖掘作弊用户的方法与装置
CN103312703A (zh) * 2013-05-31 2013-09-18 西南大学 基于模式识别的网络入侵检测方法及系统
CN105488091A (zh) * 2015-06-19 2016-04-13 哈尔滨安天科技股份有限公司 一种基于关键字匹配的网络数据检测方法及系统
CN107274212A (zh) * 2017-05-26 2017-10-20 北京小度信息科技有限公司 作弊识别方法及装置
CN108306864A (zh) * 2018-01-12 2018-07-20 深圳壹账通智能科技有限公司 网络数据检测方法、装置、计算机设备和存储介质

Family Cites Families (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103377245B (zh) * 2012-04-27 2018-09-11 深圳市世纪光速信息技术有限公司 一种自动问答方法及装置
CN103036896B (zh) * 2012-12-20 2015-07-01 北京奇虎科技有限公司 用于检测恶意链接的方法及系统
CN104091122A (zh) * 2014-06-17 2014-10-08 北京邮电大学 一种移动互联网恶意数据的检测系统
CN105357167B (zh) * 2014-08-19 2019-06-11 阿里巴巴集团控股有限公司 业务处理方法和装置
CN105592008A (zh) * 2014-10-23 2016-05-18 腾讯科技（深圳）有限公司 用户网络行为处理方法及装置
CN105681250B (zh) * 2014-11-17 2019-04-02 中国信息安全测评中心 一种僵尸网络分布式实时检测方法和系统
KR101767454B1 (ko) * 2015-11-12 2017-08-14 주식회사 엔젠소프트 다양한 웹 서비스 환경에서 사용자의 행위 패턴 분석을 통한 이상행위 탐지 방법과 그를 위한 장치
CN107451476A (zh) * 2017-07-21 2017-12-08 上海携程商务有限公司 基于云平台的网页后门检测方法、系统、设备及存储介质

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103077172A (zh) * 2011-10-26 2013-05-01 腾讯科技（深圳）有限公司 一种挖掘作弊用户的方法与装置
CN103312703A (zh) * 2013-05-31 2013-09-18 西南大学 基于模式识别的网络入侵检测方法及系统
CN105488091A (zh) * 2015-06-19 2016-04-13 哈尔滨安天科技股份有限公司 一种基于关键字匹配的网络数据检测方法及系统
CN107274212A (zh) * 2017-05-26 2017-10-20 北京小度信息科技有限公司 作弊识别方法及装置
CN108306864A (zh) * 2018-01-12 2018-07-20 深圳壹账通智能科技有限公司 网络数据检测方法、装置、计算机设备和存储介质

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113743392A (zh) * 2020-05-28 2021-12-03 阿里巴巴集团控股有限公司 识别模型的训练方法、识别方法和装置
CN111813827A (zh) * 2020-06-22 2020-10-23 中国工商银行股份有限公司 黑名单筛查方法和装置、电子设备以及存储介质

Also Published As

Publication number Publication date
CN108306864B (zh) 2021-02-26
CN108306864A (zh) 2018-07-20

Similar Documents

Publication Publication Date Title
WO2019136990A1 (zh) 网络数据检测方法、装置、计算机设备和存储介质
CN108259482B (zh) 网络异常数据检测方法、装置、计算机设备及存储介质
CN109564641B (zh) 数据填补方法和装置
CN109522304B (zh) 异常对象识别方法及装置、存储介质
CN111259952B (zh) 异常用户识别方法、装置、计算机设备及存储介质
WO2019218699A1 (zh) 欺诈交易判断方法、装置、计算机设备和存储介质
CN110263326B (zh) 一种用户行为预测方法、预测装置、存储介质及终端设备
WO2020215571A1 (zh) 一种识别敏感数据的方法、装置、存储介质及计算机设备
CN109858405A (zh) 基于微表情的满意度评价方法、装置、设备及存储介质
WO2020125463A1 (zh) 报表生成方法、装置、计算机设备及可读存储介质
CN108491714A (zh) 验证码的人机识别方法
CN110912908B (zh) 网络协议异常检测方法、装置、计算机设备和存储介质
WO2021143478A1 (zh) 识别对抗样本以保护模型安全的方法及装置
CN112100250A (zh) 数据处理方法及装置
CN112819611A (zh) 欺诈识别方法、装置、电子设备和计算机可读存储介质
CN110334544B (zh) 联邦模型退化处理方法、装置、联邦训练系统及存储介质
CN113689292B (zh) 基于图像背景识别的用户聚集识别方法及系统
WO2020232902A1 (zh) 异常对象识别方法、装置、计算设备和存储介质
CN115499187A (zh) Api安全监测模型训练方法、监测方法、装置及设备
CN110798463A (zh) 基于信息熵的网络隐蔽信道的检测方法及装置
CN112966988A (zh) 基于XGBoost模型的数据评估方法、装置、设备及存储介质
CN112132074A (zh) 人脸图像验证方法、装置、计算机设备及存储介质
CN112396047B (zh) 训练样本生成方法、装置、计算机设备和存储介质
WO2019114246A1 (zh) 一种身份认证方法、服务器及客户端设备
CN114785616A (zh) 数据风险检测方法、装置、计算机设备及存储介质

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 18899875

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

32PN Ep: public notification in the ep bulletin as address of the adressee cannot be established

Free format text: NOTING OF LOSS OF RIGHTS PURSUANT TO RULE 112(1) EPC (EPO FORM 1205 DATED 11/11/2020)

122 Ep: pct application non-entry in european phase

Ref document number: 18899875

Country of ref document: EP

Kind code of ref document: A1