WO2020000744A1 - Deduplication traffic prompting method and apparatus, and server and storage medium - Google Patents

Abstract

Disclosed are a deduplication traffic prompting method and apparatus, and a server and a storage medium. The method comprises: where it is determined that traffic corresponding to a message is target deduplication traffic, determining deduplication traffic data used for recording deduplication values of historical deduplication traffic, respectively corresponding to a plurality of target time windows and required when the target deduplication traffic is calculated, and determining, according to a pre-set traffic rule, a deduplication threshold value for calculating the target deduplication traffic; acquiring deduplication values, the quantity of which is equal to the deduplication threshold value, from the deduplication traffic data of target time windows to obtain deduplication value sets respectively corresponding to the target time windows; and then determining, according to the quantity of deduplication values in the deduplication value sets, whether the target deduplication traffic meets the pre-set traffic rule, and if so, outputting prompting information. Applying the present application can reduce the quantity of deduplication values to be acquired in a target time window, increase calculation efficiency and facilitate prompting a user to perform risk control more efficiently.

Description

Method, device, server and storage medium for prompting deduplication traffic

This application claims the priority of a Chinese patent application filed on June 30, 2018 with the Chinese Patent Office, application number 201810704335.X, and application name "A Method, Device, Server, and Storage Medium for Deduplication Traffic Alert" The entire contents are incorporated herein by reference.

Technical field

The present application relates to the field of computer technology, and in particular, to a method, a device, a server, and a storage medium for prompting deduplication traffic.

Background technique

At present, in order to strengthen risk control, an alarm message is usually output when it is determined that a certain de-duplication traffic hits a preset traffic rule. However, when determining whether a certain deduplication flow hits the traffic rule, it is usually necessary to take out all deduplication values corresponding to the time period to be counted for calculation, and then judge based on the number of deduplication values taken out. Whether the deduplication traffic hits the rule. When encountering extreme rules, the number of deduplication values may be tens of thousands. In this case, if all deduplication values are taken out in the time period to be counted, the io will be too high, and the calculation efficiency will be low, which will reduce the prompt. effectiveness.

Summary of the invention

The embodiments of the present application provide a method, a device, a server and a storage medium for prompting deduplication traffic, which can reduce the number of deduplication values obtained in the time period to be counted, improve the calculation efficiency, and help to prompt the user to perform risk control more efficiently.

In a first aspect, an embodiment of the present application provides a deduplication flow recording method, which includes:

If a message is received, determining whether the traffic corresponding to the message is a target deduplication traffic that matches a preset traffic rule;

If it is determined that the traffic corresponding to the packet is a target deduplication traffic that matches a preset traffic rule, a plurality of targets for calculating the target deduplication traffic are determined according to the preset traffic rule and the current system time. Time window

Obtaining respective deduplication traffic data corresponding to the multiple target time windows, where the deduplication traffic data is used to record deduplication values of historical deduplication traffic;

Determining a deduplication threshold value for calculating the target deduplication traffic according to the preset traffic rule, and obtaining a quantity equal to the deduplication traffic data in each of the target time windows in the multiple target time windows The deduplication value of the deduplication threshold, to obtain the deduplication value set corresponding to each target time window;

Determining whether the target deduplication traffic hits the preset traffic rule according to the number of deduplication values in the deduplication value set corresponding to each target time window, and if it hits, outputting a prompt message.

In a second aspect, an embodiment of the present application provides a deduplication flow prompting device, and the deduplication flow prompting device includes a unit for executing the method in the first aspect.

In a third aspect, an embodiment of the present application provides a server. The server includes a processor, a network interface, and a memory. The processor, the network interface, and the memory are connected to each other. The network interface is controlled by the processor. The memory is configured to receive and send messages, and the memory is configured to store a computer program that supports a server to execute the foregoing method, the computer program includes program instructions, and the processor is configured to call the program instructions to execute the method of the first aspect.

In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium. The computer-readable storage medium stores a computer program, where the computer program includes program instructions, and the program instructions, when executed by a processor, cause all the The processor executes the method of the first aspect.

By adopting this application, the number of deduplication values in the target time window can be reduced, the calculation efficiency can be improved, and it is helpful to prompt the user to perform risk control more efficiently.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is a schematic flowchart of a method for prompting deduplication traffic according to an embodiment of the present application; FIG.

FIG. 2 is a schematic flowchart of another method for prompting deduplication traffic according to an embodiment of the present application; FIG.

3 is a schematic diagram of an operation interface for configuring a traffic rule according to an embodiment of the present application;

4 is a schematic block diagram of a deduplication traffic prompting device according to an embodiment of the present application;

FIG. 5 is a schematic block diagram of a server according to an embodiment of the present application.

detailed description

The technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, but not all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by a person of ordinary skill in the art without creative efforts shall fall within the protection scope of this application.

Referring to FIG. 1, FIG. 1 is a schematic flowchart of a method for prompting deduplication traffic according to an embodiment of the present application. As shown in the figure, the method for prompting deduplication traffic may include:

101. In the case of receiving a message, the server determines whether the traffic corresponding to the message is a target deduplication traffic that matches a preset traffic rule.

In one embodiment, the user can pre-configure the traffic rule (that is, a preset traffic rule) through the traffic rule configuration page. The purpose of the configuration is to determine what kind of traffic to execute the traffic rule, and the statistical duration for executing the traffic rule. Wait, this application mainly configures deduplication traffic rules and implements the traffic rules for deduplication traffic. Among them, deduplication traffic is traffic that focuses on different deduplication values, and the deduplication value can be a unique identifier, such as a device number, ID number, account number, and so on. For example, a traffic is the number of transactions of different users with the same device number, where the unique identifier of the user can be a user account, then the user account is a deduplication value. This traffic focuses on different users (that is, deduplication values). To de-duplicate traffic.

In this case, after receiving the packet, the server can parse the field point information of the fixed packet. If the field point information is parsed to determine that the traffic corresponding to the packet is the same as the pre-configured traffic rule (that is, a preset rule) ) Match, it can be determined that the traffic rule corresponding to the message needs to be executed, that is, the traffic corresponding to the message is the target deduplication traffic.

102. If the server determines that the traffic corresponding to the packet is a target deduplication traffic that matches a preset traffic rule, then determines multiple target time windows for calculating the target deduplication traffic according to the preset traffic rule and the current system time. .

The multiple target time windows are classified by time granularity, and each target time window has a priority, such as: second level> minute level> hour level> day level> week level> month level.

In one embodiment, the preset traffic rule also predefines the statistical duration of the target deduplication traffic. After the server determines that the traffic corresponding to the packet is the target deduplication traffic that matches the preset traffic rule, it can analyze The preset traffic rule determines the statistical duration of the statistical target deduplication traffic and the time granularity corresponding to the statistical duration, and determines the statistical time period for calculating the target deduplication traffic according to the statistical duration and the current system time. Multiple target time windows matching the time granularity for calculating the target deduplication traffic are determined within the time period.

Exemplarily, the target deduplication traffic is a piece of traffic from device D. The user's predefined statistics duration on the traffic rule configuration page is 10 minutes. The statistical duration corresponds to the time granularity of minutes. The current system time is 2018-05-04T10. : 08: 34. In this case, the server will determine the time period of the target deduplicated traffic by the current system time of 10 minutes, that is, the target deduplicated traffic statistics time period is 2018-05-04T09: 58: 34—2018-05-04T10: 08: 34. Further, a plurality of target time windows with a time granularity of minutes regarding the device D are determined within the statistical time period. The multiple target time windows are the following 10-minute time windows:

a device D-2018-05-04T10: 08: 00

b device D-2018-05-04T10: 07: 00

c device D-2018-05-04T10: 06: 00

d device D-2018-05-04T10: 05: 00

e device D-2018-05-04T10: 04: 00

f device D-2018-05-04T10: 03: 00

g device D-2018-05-04T10: 02: 00

h device D-2018-05-04T10: 01: 00

i device D-2018-0.5-04T10: 00: 00

jDevice D-2018-05-04T9: 59: 00

103. The server obtains deduplication traffic data corresponding to multiple target time windows, and the deduplication traffic data is used to record deduplication values of historical deduplication traffic.

In one embodiment, historical deduplication traffic (that is, deduplication traffic data) is recorded under each target time window, and the recording form is to record the number of times that the deduplication value corresponding to each historical deduplication traffic appears in each target time window. For example, the target time window g, the recorded data can be: device D-2018-05-04T10: 02: 00 → [(U101,1)], where U101 is the deduplication value, 1 indicates that the deduplication value U101 is at the target The time window g appears once. In this case, after the server determines multiple target time windows for counting the target deduplication traffic, it can obtain the deduplication traffic data recorded under each target time window.

104. The server determines a deduplication threshold used to calculate the target deduplication traffic according to a preset traffic rule, and obtains a number of deduplication traffic data equal to the deduplication threshold from the deduplication traffic data of each target time window in multiple target time windows. Re-evaluation to obtain the de-duplication value set corresponding to each target time window.

When the server needs to determine the deduplication threshold required to calculate the target deduplication traffic, it can parse the preset traffic rule, determine the target operator and the feature threshold corresponding to the target operator, and based on the preset value rule To determine the deduplication threshold required to calculate the target deduplication traffic that matches the target operator and feature threshold.

The target operator may include at least one of greater than, less than, equal to, greater than or equal to, and less than or equal to. Which operator is selected is determined according to a preset traffic rule. For example, if the preset traffic rule is "the number of successful transactions of different users on the same device is greater than 10 times within 10 minutes", then the server can determine the target operator as "greater than" by parsing the preset traffic rule, and corresponding the target operator The feature threshold is determined as "10".

In one embodiment, the server may identify the target operator, and when the target operator is greater than, equal to, or less than or equal to, the value after the feature threshold is increased by 1 is determined as the deduplication threshold for calculating the target deduplication traffic. When the target operator is greater than or equal to or less than, the value corresponding to the feature threshold is determined as the deduplication threshold used to calculate the target deduplication traffic.

Specifically, assuming that the feature threshold corresponding to the target operator is x, how to determine the deduplication threshold required to calculate the target deduplication traffic according to the target operator and the feature threshold can be divided into the following cases:

1) The target operator is ">" "=" "<=", and the deduplication threshold is "x + 1". The logic for this is because: if the deduplication value is within the time window within the time period to be counted If it is greater than or equal to "x + 1", then the current target deduplication traffic must hit the rule "> x"; the rule "= x" must not hit; the rule "<= x" must also Missed

2) The target operator is "> =" "<", and the deduplication threshold is "x". The reason for this is because if the deduplication value in the time window within the time period to be counted is greater than or equal to " x ", then the current target deduplication traffic must hit the"> = x "rule; the" <x "rule must not hit.

In one embodiment, after the server determines the deduplication threshold required to calculate the target deduplication traffic, it can obtain deduplication values equal to the deduplication threshold in the deduplication traffic data for each target time window that can be obtained. , Each fetch will return a fetch result, the fetch result is a set of deduplication values. Exemplarily, the server determines that the deduplication threshold required to calculate the target deduplication traffic is 11, and in step 103, the corresponding deduplication traffic data records obtained in multiple target time windows are as follows:

a device D-2018-05-04T10: 08: 00 □ [] [] means there is no air, no traffic

b device D-2018-05-04T10: 07: 00 □ []

c device D-2018-05-04T10: 06: 00 □ []

d equipment D-2018-05-04T10: 05: 00 □ []

e device D-2018-05-04T10: 04: 00 □ []

f device D-2018-05-04T10: 03: 00 □ []

g device D-2018-05-04T10: 02: 00 □ [(U101,1)]

h Device D-2018-05-04T10: 01: 00 □ [(U1,1), (U2,1) ... (U10,1)] 10 users were recorded

i. Device D-2018-0.5-04T10: 00: 00 □ [(U1,1), (U2,1) ... (U11,1)] 11 users were recorded

j Device D-2018-05-04T9: 59: 00 □ [(U1,1), (U2,1) ... (U100,1)] 100 users have been recorded

In this case, the server can only try to take 11 (that is, the feature threshold) deduplication values under each target time window. Then for the 10 minute target time window of aj, take 11 deduplication values. The result, that is, the set of deduplication values corresponding to each time target time window is:

a Device D-2018-05-04T10: 08: 00 □ There is no duplicate value in the window, and an empty set is returned.

b Device D-2018-05-04T10: 07: 00

c device D-2018-05-04T10: 06: 00

d equipment D-2018-05-04T10: 05: 00

e device D-2018-05-04T10: 04: 00

f device D-2018-05-04T10: 03: 00

g device D-2018-05-04T10: 02: 00 □ a total of deduplication values, after all return to get the deduplication value set [(U101, 1)]

h device D-2018-05-04T10: 01: 00 □ A total of 10 deduplication values. After returning all, we get the deduplication value set [(U1,1), (U2,1) ... (U10,1)]

i. Device D-2018-0.5-04T10: 00: 00 □ Just 11 deduplication values, all returned to get the deduplication value set [(U1,1), (U2,1) ... (U11,1)]

jDevice D-2018-05-04T9: 59: 00 □ Take the first 11 deduplication values and get the deduplication value set after returning [(U1,1), (U2,1) ... (U11,1)]

105. The server determines whether the deduplication traffic hits a preset traffic rule according to the number of deduplication values in the corresponding deduplication value set corresponding to each target time window. If the deduplication traffic hits a preset traffic rule, it outputs a prompt message.

In one embodiment, the server may parse the deduplication value set corresponding to each target time window, obtain a target deduplication value set that is not an empty set from each deduplication value set, and traverse each target deduplication value set. The number of deduplication values. If the number matches the preset traffic rule, a prompt message is output to notify the user that there is an abnormality in the deduplication traffic.

In the embodiment of the present application, the server may determine a deduplication threshold required to calculate the target deduplication traffic according to a preset traffic rule, and obtain a quantity equal to the deduplication traffic data of each target time window in multiple target time windows. The threshold deduplication value is obtained to obtain the set of deduplication values corresponding to each target time window, and then based on the number of deduplication values in the set of deduplication values corresponding to each target time window, it is determined whether the target deduplication traffic hits the preset. Traffic rule. If it hits, it will output a prompt message. By adopting the present application, the number of deduplication values in the target time window can be reduced, the calculation efficiency can be improved, and the user can be prompted more effectively to perform risk control.

Referring to FIG. 2, FIG. 2 is a schematic flowchart of another deduplication flow prompting method provided by an embodiment of the present application. As shown in the figure, the deduplication flow prompting method may include:

201. In the case of receiving a message, the server determines whether the traffic corresponding to the message is a target deduplication traffic that matches a preset traffic rule.

In one embodiment, after receiving the message, the server may parse the message to obtain field point information of the message, and determine whether the traffic corresponding to the message is a target matching a preset traffic rule according to the field point information. Remove heavy traffic.

For example, the user can configure the deduplication traffic in advance through the traffic rule configuration page shown in Figure 3. The purpose of the configuration is to determine the type of deduplication traffic to implement the traffic rule, and to execute the traffic rule. Statistics duration and so on. It can be seen that the specific content configured through the traffic rule configuration page shown in FIG. 3 (that is, the preset traffic rule) may include: a traffic rule of different users with the same device number that is greater than 10 in 10 minutes, and 10 The statistic duration is minutes.

In this case, the server receives a transaction message with the following contents:

{

"Event timestamp": "2018-05-04T10: 08: 34", // business occurrence time

"Event id": "001", // transaction success status code 001 indicates success 002 indicates failure

"User name": "U1", // user name may be U1U2U3

"Ip": "D", // ip or device number address, such as device D mentioned above

.... // Other fields

}

The server parses each field point of the message. From the field point "user name" of the message, it can be determined that this traffic focuses on different numbers of users (that is, deduplication values). It is a target that matches the preset traffic rule. To de-duplicate traffic, traffic rules must be enforced.

202. If the server determines that the traffic corresponding to the packet is the target deduplication traffic that matches the preset traffic rule, then determines multiple target time windows for calculating the target deduplication traffic according to the preset traffic rule and the current system time. .

203. The server obtains deduplication traffic data corresponding to multiple target time windows, and the deduplication traffic data is used to record deduplication values of historical deduplication traffic.

204. The server parses the preset traffic rule, determines a target operator and a feature threshold corresponding to the target operator, and determines, based on the preset value rule, a match for the target operator and the feature threshold for calculating the target deduplication traffic. Re-threshold, and obtain a number of de-duplication values equal to the de-duplication threshold from the de-duplication traffic data of each target time window in multiple target time windows, and obtain a set of de-duplication values corresponding to each target time window.

For specific implementations of steps 202-204, reference may be made to the description of steps 102-104 in the foregoing embodiment, and details are not described herein again.

205. The server parses each deduplication value set corresponding to each target time window, obtains a target deduplication value set that is not an empty set from each deduplication value set, and traverses the number of deduplication values in each target deduplication value set. .

206. In the case where the target operator is greater than or greater than or equal to, if the server determines that the quantity in any target deduplication value set is greater than or equal to the deduplication threshold, it determines that the target deduplication traffic hits a preset traffic rule, and outputs a prompt information.

207. In the case where the target operator is equal to, less than or equal to, or less than, if the server determines that the quantity in any target deduplication value set is greater than or equal to the deduplication threshold, determining that the target deduplication traffic does not hit a preset traffic rule, And output a prompt message.

For example, if the configured traffic rule is "the number of successful transactions in different accounts with the same device number is greater than 10 in the past 10 minutes", it can be determined that the target operator is ">" and the deduplication threshold is "11". The server executes step 204 to obtain The corresponding set of deduplication values for each target time window is:

a Device D-2018-05-04T10: 08: 00 □ There is no duplicate value in the window, and an empty set is returned.

b Device D-2018-05-04T10: 07: 00

c device D-2018-05-04T10: 06: 00

d equipment D-2018-05-04T10: 05: 00

e device D-2018-05-04T10: 04: 00

f device D-2018-05-04T10: 03: 00

g device D-2018-05-04T10: 02: 00 □ a total of deduplication values, after all return to get the deduplication value set [(U101, 1)]

h device D-2018-05-04T10: 01: 00 □ A total of 10 deduplication values. After returning all, we get the deduplication value set [(U1,1), (U2,1) ... (U10,1)]

i. Device D-2018-0.5-04T10: 00: 00 □ Just 11 deduplication values, all returned to get the deduplication value set [(U1,1), (U2,1) ... (U11,1)]

jDevice D-2018-05-04T9: 59: 00 □ Take the first 11 deduplication values and get the deduplication value set after returning [(U1,1), (U2,1) ... (U11,1)]

Discard each deduplicated value set (that is, the empty set) for which no value is obtained, and only obtain the target deduplicated value set whose number of deduplicated values is greater than 0. The target deduplicated value set and its corresponding target time are recorded as follows:

g device D-2018-05-04T10: 02: 00 [(U101, 1)]

h Device D-2018-05-04T10: 01: 00 [(U1,1), (U2,1) ... (U10,1)]

i-device D-2018-05-04T10: 00: 00 [(U1,1), (U2,1) ... (U11,1)]

jEquipment D-2018-05-04T9: 59: 00 [(U1,1), (U2,1) ... (U11,1)]

Further, by traversing the number of deduplication values in the target deduplication value set from g to j, and determining that the number of deduplication values in the target deduplication value set corresponding to i and j is equal to 11, it can be determined that this deduplication traffic hit " The preset traffic rule is that the number of successful transactions of different accounts with the same device number is greater than 10 times in the past 10 minutes.

For another example, the target deduplication value set records corresponding to the gj target time windows are the same as above. In this case, if the target operator is adjusted to "equal to", the deduplication threshold is set to 11, that is, the preset traffic rule is adjusted to "same device." The number of successful transactions in different accounts is equal to 10 in the past 10 minutes. " In this case, the server traverses the number of deduplication values in the target deduplication value set from g to j, and determines that the number of deduplication values in the target deduplication value set corresponding to i and j is greater than or equal to 11, then it can be determined Heavy traffic does not hit the preset traffic rule that "the number of successful transactions in different accounts with the same device number is equal to 10 in the past 10 minutes".

For another example, the target deduplication value set records corresponding to the gj target time windows are the same as above. In this case, if the target operator is adjusted to "less than or equal to", the deduplication threshold is set to 11, that is, the preset traffic rule is adjusted to "same The number of successful transactions in different accounts with device numbers was less than or equal to 10 in the past 10 minutes. " In this case, the server traverses the number of deduplication values in the target deduplication value set from g to j, and determines that the number of deduplication values in the target deduplication value set corresponding to i and j is greater than or equal to 11, then it can be determined Heavy traffic does not hit the preset traffic rule of "the number of successful transactions in different accounts with the same device number is less than or equal to 10 times in the past 10 minutes".

For another example, the target deduplication value set records corresponding to the target time windows of gj are the same as above. In this case, if the target operator is adjusted to "greater than or equal to", the deduplication threshold is set to 10, that is, the preset traffic rule is adjusted to "same The number of successful transactions in different accounts of the device number is greater than or equal to 10 times in the past 10 minutes. " In this case, the server traverses the number of deduplication values in the target deduplication value set from g to j, and determines that the number of deduplication values in the target deduplication value set corresponding to h, i, and j is greater than or equal to 10. This deduplication traffic hits the preset traffic rule of “the number of successful transactions in different accounts with the same device number is greater than or equal to 10 in the past 10 minutes”.

For another example, the target deduplication value set records corresponding to the gj target time windows are the same as above. In this case, if the target operator is adjusted to "less than", the deduplication threshold is set to 10, that is, the preset traffic rule is adjusted to "same device." The number of successful transactions in different accounts was less than 10 in the past 10 minutes. " In this case, the server traverses the number of deduplication values in the target deduplication value set from g to j, and determines that the number of deduplication values in the target deduplication value set corresponding to h, i, and j is greater than or equal to 10. This deduplication flow does not hit the preset flow rule that "the number of successful transactions in different accounts with the same device number is less than 10 in the past 10 minutes".

In one embodiment, if the server determines that the number of deduplication values for each target deduplication set is less than the deduplication threshold, the deduplication values under each target deduplication set are merged, and the target operator is greater than If the number of merged deduplication values is greater than or equal to the deduplication threshold, it is determined that the target deduplication traffic hits a preset traffic rule. In the case where the target operator is equal to, less than or equal to, or less than, if the number of combined deduplication values is greater than or equal to the deduplication threshold, it is determined that the target deduplication traffic does not hit a preset traffic rule.

For example, the preset traffic rule becomes: the number of successful transactions of different accounts with the same device number is greater than 100 in the past 10 minutes, it can be determined that the target operator is greater than, the deduplication threshold is 101, and the target deduplication determined in step 205 is performed. The value set and the corresponding target time are recorded as follows:

g device D-2018-05-04T10: 02: 00 [(U101, 1)]

h Device D-2018-05-04T10: 01: 00 [(U1,1), (U2,1) ... (U10,1)]

i-device D-2018-05-04T10: 00: 00 [(U1,1), (U2,1) ... (U11,1)]

j Device D-2018-05-04T9: 59: 00 [(U1,1), (U2,1) ... (U100,1)]

At this time, the server traverses the deduplication values under each target deduplication value set of gj are less than 101, and can merge the deduplication values under each target deduplication value set. Here, there is a total of 101 U1 to U101 that need to be merged. Value, that is, it is determined that the number of merged deduplication values 101 is equal to the deduplication threshold 101, then it is determined that the target deduplication traffic hits the preset traffic rule of "the number of successful transactions in the same account with different account number is greater than 100 in the past 10 minutes" .

In one embodiment, when the server determines that the target deduplication traffic hits a preset traffic rule, it can output prompt information. After the operation and maintenance personnel sees the prompt information, it can process it in time to achieve risk control of deduplication traffic. .

In one embodiment, after the server determines that the target deduplication traffic hits a preset traffic rule, it can also obtain account information corresponding to the target deduplication traffic and add identification information to the account information, where the identification information is used to identify the The target account corresponding to the account information has historical abnormal behavior. Further, the server may distribute the account information after adding the identification information to other servers, prompting other server target accounts for historical abnormal behavior. In this way, any other server that receives the account information can send an early warning notification when it detects that the target account is logged in, notifying the target account of historical abnormal behavior, and further improving risk control. The account information may include a device number, a user ID, an IP address, a login account, and the like, and the identification information may be a mark symbol.

The identification information may further include a history time when the target deduplication traffic hits a preset traffic rule, and a preset traffic rule. In this case, after receiving the account information after adding the identification information, other servers may store the account information in the memory. When another server detects that the target account corresponding to the account information is logged in, it may obtain pre-stored account information and output an early warning notification based on the account information. The early warning notification includes the historical time when the target deduplication traffic hits a preset traffic rule. And preset traffic rules. In this way, after receiving the warning notification, the operation and maintenance personnel can view the specific historical abnormal behavior of the target account, and then perform subsequent operations. For example, the specific historical abnormal behavior of the target account may be that the target account hits a preset rule at a certain point in time.

In the embodiment of the present application, if the target operator is greater than or greater than or equal to, if it is determined that the quantity in any target deduplication value set is greater than or equal to the deduplication threshold, it is determined that the target deduplication traffic hits a preset traffic Rules, and output prompt information; or, if the target operator is equal to, less than or equal to, or less than, if it is determined that the number of any target deduplication value set is greater than or equal to the deduplication threshold, determine whether the target deduplication traffic is not Hit the preset traffic rule and output a prompt message. By adopting this application, the number of deduplication values in the target time window can be reduced, the calculation efficiency can be improved, and it is helpful to prompt the user to perform risk control more efficiently.

An embodiment of the present application further provides a deduplication traffic prompting device, which is configured to execute a module of the method described in FIG. 1 or FIG. 2. Specifically, referring to FIG. 4, it is a schematic block diagram of a deduplication traffic prompting device provided by an embodiment of the present application. The device for prompting deduplication traffic in this embodiment includes a determining module 40, a determining module 41, an obtaining module 42, and an output module 43.

A judging module 40, configured to judge, if a message is received, whether the traffic corresponding to the message is a target deduplication traffic that matches a preset traffic rule;

The determining module 41, if the determining module determines that the traffic corresponding to the packet is a target deduplication traffic that matches a preset traffic rule, then determines the method for calculating the traffic according to the preset traffic rule and the current system time. Multiple target time windows for target deduplication traffic;

An obtaining module 42 is configured to obtain respective deduplication traffic data corresponding to the multiple target time windows, where the deduplication traffic data is used to record deduplication values of historical deduplication traffic;

The obtaining module 42 is further configured to determine a deduplication threshold for calculating the target deduplication traffic according to the preset traffic rule, and the deduplication in each of the multiple time windows. Obtaining a number of deduplication values equal to the deduplication threshold in the traffic data, and obtaining a set of deduplication values corresponding to each time window;

The determining module 40 is further configured to determine whether the target deduplication traffic hits the preset traffic rule according to the number of deduplication values in the deduplication value set corresponding to each target time window;

An output module 43 is configured to output a prompt message if the determination module determines that the target deduplication traffic hits the preset traffic rule.

In one embodiment, the determining module 41 is specifically configured to: parse the preset traffic rule to determine a target operator and a characteristic threshold corresponding to the target operator; and determine a value corresponding to the target operator based on the preset value rule. The target operator and the feature threshold match the deduplication threshold used to calculate the target deduplication traffic.

In an embodiment, the target operator includes at least one of greater than, equal to, less than or equal to, greater than or equal to, and less than, and the determining module 41 is specifically configured to identify the target operator, and If it is greater than, equal to, or less than or equal to, the value after the feature threshold is increased by 1 is determined as the deduplication threshold used to calculate the target deduplication traffic; when the target operator is greater than or equal to or less than Next, a value corresponding to the characteristic threshold is determined as a deduplication threshold used to calculate the target deduplication traffic.

In one embodiment, the judging module 40 is specifically configured to: parse the deduplication value sets corresponding to the respective target time windows, and obtain a target deduplication value that is not an empty set from each of the deduplication value sets. Set, and iterate over the number of deduplication values in each of the target deduplication value sets; if the target operator is greater than or greater than or equal to, if the number in any target deduplication value set is greater than or Is equal to the deduplication threshold, it is determined that the target deduplication traffic hits the preset traffic rule; if the target operator is equal to, less than, or less than, if any of the target deduplication values in the set If the number is greater than or equal to the deduplication threshold, it is determined that the target deduplication traffic does not hit the preset traffic rule.

In one embodiment, the apparatus further includes: a merging module 44, wherein:

A merging module 44 for merging the deduplication values in each of the target deduplication sets if the number of deduplications in each of the target deduplication sets is less than the deduplication threshold;

The judging module 40 is further configured to determine the target deduplication traffic if the number of the deduplication values after merging is greater than or equal to the deduplication threshold when the target operator is greater than or greater than or equal to Hit the preset traffic rule;

The judging module 40 is further configured to determine, when the target operator is equal to, less than or equal to, or less than the number of the deduplication values after the merge is greater than or equal to the deduplication threshold, determining the target deduplication value. Heavy traffic does not hit the preset traffic rule.

In one embodiment, the judging module 40 is specifically configured to: parse the message to obtain field point information of the message; and determine whether the traffic corresponding to the message is the same as the pre-planned traffic according to the field point information. Set the target to match the traffic rules to deduplicate the traffic.

In one embodiment, the determining module 41 is specifically configured to: analyze the preset traffic rule to determine a statistical duration for counting the target deduplication traffic and a time granularity corresponding to the statistical duration; according to the statistical duration and Determining a statistical time period for counting the target deduplication traffic at the current system time; and determining multiple target time windows for counting the target deduplication traffic that match the time granularity within the statistical time period .

It should be noted that the functions of the functional modules of the deduplication traffic prompting device described in the embodiments of the present application may be specifically implemented according to the method in the method embodiment described in FIG. 1 or FIG. 2. Or the related description of the method embodiment in FIG. 2 is not repeated here.

Please refer to FIG. 5, which is a schematic block diagram of a server according to an embodiment of the present application. As shown in FIG. 5, the server includes a processor 501, a memory 502, and a network interface 503. The processor 501, the memory 502, and the network interface 503 may be connected through a bus or in other manners. In FIG. 5 shown in the embodiment of the present application, connection through a bus is taken as an example. The network interface 503 is controlled by the processor to send and receive messages, and the memory 502 is used to store a computer program. The computer program includes program instructions, and the processor 501 is configured to execute the program instructions stored in the memory 502. Wherein, the processor 501 is configured to call the program instruction to execute: if a message is received, determine whether the traffic corresponding to the message is a target deduplication traffic that matches a preset traffic rule; if it is determined that The traffic corresponding to the message is a target deduplication traffic that matches a preset traffic rule, and a plurality of target time windows for calculating the target deduplication traffic are determined according to the preset traffic rule and the current system time; Acquiring respective deduplication traffic data corresponding to the multiple target time windows, where the deduplication traffic data is used to record deduplication values of historical deduplication traffic; and determined to be used to calculate the target according to the preset traffic rule A deduplication threshold of deduplication traffic, and obtaining a deduplication value equal to the deduplication threshold from the deduplication traffic data of each target time window in the multiple target time windows, to obtain each target time The set of deduplication values corresponding to each window; and according to the number of deduplication values in the set of deduplication values corresponding to each of the target time windows, it is determined that the target deduplication traffic is Hit the preset flow rule, if hit, the system outputs.

It should be understood that, in the embodiment of the present application, the processor 501 may be a Central Processing Unit (CPU), and the processor 501 may also be another general-purpose processor or a digital signal processor (Digital Signal Processor, DSP). ), Application Specific Integrated Circuit (ASIC), Field-Programmable Gate Array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or the processor may be any conventional processor or the like.

The memory 502 may include a read-only memory and a random access memory, and provide instructions and data to the processor 501. A part of the memory 502 may further include a non-volatile random access memory. For example, the memory 502 may also store information of a device type.

In specific implementation, the processor 501, the memory 502, and the network interface 503 described in the embodiment of the present application may execute the implementation manner described in the method embodiment shown in FIG. 1 or FIG. 2 provided by the embodiment of the present application, and may also execute The implementation manner of the deduplication traffic prompting device described in the embodiment of the present application is not repeated here.

In another embodiment of the present application, a computer-readable storage medium is provided. The computer-readable storage medium stores a computer program, where the computer program includes program instructions, and the program instructions are implemented when executed by a processor: When a message is received, determine whether the traffic corresponding to the message is the target deduplication traffic that matches the preset traffic rule; if it is determined that the traffic corresponding to the message is the destination that matches the preset traffic rule Heavy traffic, determining a plurality of target time windows for calculating the target deduplication traffic according to the preset traffic rule and the current system time; obtaining respective deduplication traffic data corresponding to the multiple target time windows, The deduplication traffic data is used to record the deduplication value of historical deduplication traffic; a deduplication threshold value used to calculate the target deduplication traffic is determined according to the preset traffic rule, and within the multiple target time windows Obtaining a deduplication value equal to the deduplication threshold in the deduplication traffic data of each target time window in each of the target time windows, to obtain each of the target time windows A corresponding deduplication value set; determining whether the target deduplication traffic hits the preset traffic rule according to the number of deduplication values in the deduplication value set corresponding to each target time window, and if it hits, then Output a prompt message.

The computer-readable storage medium may be an internal storage unit of the server according to any of the foregoing embodiments, such as a hard disk or a memory of the server. The computer-readable storage medium may also be an external storage device of the server, such as a plug-in hard disk, a Smart Media Card (SMC), and a Secure Digital (SD) card provided on the server. , Flash card (Flash card) and so on. Further, the computer-readable storage medium may further include both an internal storage unit of the server and an external storage device. The computer-readable storage medium is used to store the computer program and other programs and data required by the server. The computer-readable storage medium may also be used to temporarily store data that has been or will be output.

Those of ordinary skill in the art can understand that all or part of the processes in the method of the foregoing embodiment can be implemented by using a computer program to instruct related hardware. The program can be stored in a computer-readable storage medium. When executed, the processes of the embodiments of the methods described above may be included. The storage medium may be a magnetic disk, an optical disk, a read-only memory (Read-Only Memory, ROM), or a random access memory (Random, Access Memory, RAM).

The above disclosure is only a part of the embodiments of this application, and of course, the scope of rights of this application cannot be limited by this. Those skilled in the art can understand all or part of the processes of implementing the above embodiments and make according to the claims of this application. The equivalent changes still fall within the scope of the invention.

Claims (20)

1. A method for prompting deduplication traffic, which comprises:

   If a message is received, determining whether the traffic corresponding to the message is a target deduplication traffic that matches a preset traffic rule;

   If it is determined that the traffic corresponding to the packet is a target deduplication traffic that matches a preset traffic rule, a plurality of targets for calculating the target deduplication traffic are determined according to the preset traffic rule and the current system time. Time window

   Obtaining respective deduplication traffic data corresponding to the multiple target time windows, where the deduplication traffic data is used to record deduplication values of historical deduplication traffic;

   Determining a deduplication threshold value for calculating the target deduplication traffic according to the preset traffic rule, and obtaining a quantity equal to the deduplication traffic data in each of the target time windows in the multiple target time windows The deduplication value of the deduplication threshold, to obtain the deduplication value set corresponding to each target time window;

   Determining whether the target deduplication traffic hits the preset traffic rule according to the number of deduplication values in the deduplication value set corresponding to each target time window, and if it hits, outputting a prompt message.
2. The method according to claim 1, wherein the determining a deduplication threshold for calculating the target deduplication traffic according to the preset traffic rule comprises:

   Parse the preset traffic rule to determine a target operator and a feature threshold corresponding to the target operator;

   Based on a preset value selection rule, a deduplication threshold value that matches the target operator and the feature threshold and is used to calculate the target deduplication traffic is determined.
3. The method according to claim 2, wherein the target operator comprises at least one of greater than, equal to, less than or equal to, greater than or equal to, and less than, and the determining is based on the preset value rule, The target operator and the feature threshold matching the deduplication threshold used to calculate the target deduplication traffic include:

   Identifying the target operator, and in a case where the target operator is greater than, equal to, or less than or equal to, determining a value after the feature threshold is increased by 1 as a deduplication threshold used to calculate the target deduplication traffic;

   When the target operator is greater than or equal to or less than, a value corresponding to the feature threshold is determined as a deduplication threshold used to calculate the target deduplication traffic.
4. The method according to claim 2 or 3, wherein, according to the number of deduplication values in the deduplication value set corresponding to each of the target time windows, determining whether the target deduplication traffic hits all Describe the default traffic rules, including:

   Parse the deduplication value set corresponding to each target time window, obtain a target deduplication value set that is not an empty set from each of the deduplication value sets, and traverse each of the target deduplication value sets Number of deduplication values;

   In a case where the target operator is greater than or greater than or equal to, if the number in any target deduplication value set is greater than or equal to the deduplication threshold, determining that the target deduplication traffic hits the preset Traffic rules

   In a case where the target operator is equal to, less than or equal to, or less than, if the number in any target deduplication value set is greater than or equal to the deduplication threshold, determining that the target deduplication traffic does not hit the destination The default traffic rules are described.
5. The method according to claim 4, wherein after traversing the number of deduplication values of each target deduplication set, the method further comprises:

   If the number of deduplication values of each target deduplication set is less than the deduplication threshold, combining the deduplication values of each of the target deduplication sets;

   In a case where the target operator is greater than or greater than or equal to, if the number of merged deduplication values is greater than or equal to the deduplication threshold, determining that the target deduplication traffic hits the preset traffic rule ;

   In a case where the target operator is equal to, less than or equal to, or less than, if the number of the deduplication values after being merged is greater than or equal to the deduplication threshold, it is determined that the target deduplication traffic does not hit the pre-deduplication flow. Set up traffic rules.
6. The method according to any one of claims 1 to 5, wherein the determining whether the traffic corresponding to the packet is a target deduplication traffic that matches a preset traffic rule, comprises:

   Parse the message to obtain field point information of the message;

   It is determined according to the field point information whether the traffic corresponding to the message is a target deduplication traffic that matches the preset traffic rule.
7. The method according to any one of claims 1-6, wherein the preset traffic rule further predefines a statistical duration for counting the target deduplication traffic, and the according to the preset traffic rule and the current The system time determines a plurality of target time windows for calculating the target deduplication traffic, including:

   Parse the preset traffic rule to determine a statistical duration for calculating the target deduplication traffic and a time granularity corresponding to the statistical duration;

   Determining a statistical time period for calculating the target deduplication traffic according to the statistical duration and the current system time;

   A plurality of target time windows for calculating the target deduplication traffic matching the time granularity are determined within the statistical time period.
8. A deduplication flow prompting device, comprising:

   A judging module, configured to judge, if a message is received, whether the traffic corresponding to the message is a target deduplication traffic that matches a preset traffic rule;

   A determining module, if the judging module determines that the traffic corresponding to the packet is a target deduplication traffic that matches a preset traffic rule, determining the target for calculating the target according to the preset traffic rule and the current system time Multiple target time windows for deduplication traffic;

   An obtaining module, configured to obtain respective deduplication traffic data corresponding to the multiple target time windows, where the deduplication traffic data is used to record deduplication values of historical deduplication traffic;

   The acquisition module is further configured to determine a deduplication threshold for calculating the target deduplication traffic according to the preset traffic rule, and the deduplication traffic in each of the multiple time windows. Obtaining a number of deduplication values equal to the deduplication threshold in the data, and obtaining a set of deduplication values corresponding to each time window;

   The judging module is further configured to determine whether the target deduplication traffic matches the preset traffic rule according to the number of deduplication values in the deduplication value set corresponding to each target time window;

   An output module is configured to output a prompt message if the determination module determines that the target deduplication traffic hits the preset traffic rule.
9. The device according to claim 8, wherein the determining module is specifically configured to: analyze the preset traffic rule to determine a target operator and a feature threshold corresponding to the target operator; The value rule determines a deduplication threshold that is used to calculate the target deduplication traffic that matches the target operator and the feature threshold.
10. The device according to claim 9, wherein the target operator comprises at least one of greater than, equal to, less than or equal to, greater than or equal to, and less than, and the determining module is specifically configured to identify the target operation If the target operator is greater than, equal to, or less than or equal to, the value after the characteristic threshold is increased by 1 is determined as the deduplication threshold used to calculate the target deduplication traffic; When the symbol is greater than or equal to or less than, the value corresponding to the characteristic threshold is determined as a deduplication threshold used to calculate the target deduplication traffic.
11. The device according to claim 9 or 10, wherein the judging module is specifically configured to: parse the deduplication value sets corresponding to the respective target time windows, and select from each of the deduplication value sets Obtain a target deduplication value set that is not the empty set, and traverse the number of deduplication values in each of the target deduplication value sets; in the case that the target operator is greater than or greater than or equal to, if any target is deduplicated If the number in the re-value set is greater than or equal to the de-duplication threshold, it is determined that the target de-duplication traffic hits the preset traffic rule; and when the target operator is equal to, less than or equal to, or less than, If the number in any target deduplication value set is greater than or equal to the deduplication threshold, it is determined that the target deduplication traffic does not hit the preset traffic rule.
12. The apparatus according to claim 11, further comprising: a merging module, wherein:

    The merging module is configured to merge the deduplication values under each of the target deduplication sets if the number of deduplication values for each of the target deduplication sets is less than the deduplication threshold;

    The judging module is further configured to determine the target deduplication if the number of the deduplication values after merging is greater than or equal to the deduplication threshold when the target operator is greater than or greater than or equal to The traffic hits the preset traffic rule;

    The judging module is further configured to determine the target if the number of deduplication values after merging is greater than or equal to the deduplication threshold when the target operator is equal to, less than or equal to, or less than The deduplication traffic does not hit the preset traffic rule.
13. The device according to any one of claims 8-12, wherein the judgment module is specifically configured to: parse the message to obtain field point information of the message; and judge according to the field point information Whether the traffic corresponding to the message is a target deduplication traffic that matches the preset traffic rule.
14. The device according to any one of claims 8-13, wherein the determination module is specifically configured to: analyze the preset traffic rule to determine a statistical duration for counting the target deduplication traffic and the statistics A time granularity corresponding to the statistical duration; determining a statistical time period for counting the target deduplication traffic according to the statistical duration and the current system time; and determining, within the statistical time period, a matching time granularity for the Count multiple target time windows of the target deduplication traffic.
15. A server includes a processor, a memory, and a network interface. The processor, the memory, and the network interface are connected to each other. The network interface is controlled by the processor and is used to send and receive messages. The memory is used to store a computer program, the computer program includes program instructions, and the processor is configured to call the program instructions to execute: when a message is received through the network interface, determining the Whether the traffic corresponding to the message is the target deduplication traffic that matches the preset traffic rule; if it is determined that the traffic corresponding to the message is the target deduplication traffic that matches the preset traffic rule, according to the preset traffic rule Determine multiple target time windows for calculating the target deduplication traffic with the current system time; obtain respective deduplication traffic data corresponding to the multiple target time windows, and the deduplication traffic data is used to record historical deduplication traffic A deduplication value of heavy traffic; a deduplication threshold used to calculate the target deduplication traffic is determined according to the preset traffic rule, and A number of deduplication values equal to the deduplication threshold is obtained from the deduplication traffic data of each target time window in the target time window, and a set of deduplication values corresponding to each target time window is obtained; according to each target, The number of deduplication values in the deduplication value set corresponding to each of the time windows determines whether the target deduplication traffic hits the preset traffic rule, and if it hits, a prompt message is output.
16. The server according to claim 15, wherein the preset flow configuration information includes recorded time accuracy, and the processor is further configured to obtain the recorded time accuracy from the preset flow configuration information. And determining a minimum time granularity window and a second small time granularity window according to the recorded time accuracy, the time granularity of the minimum time granularity window being smaller than the time granularity of the second small time granularity window; corresponding to the time when the service was generated The minimum time granularity window is determined as the minimum business time window, and the second small time granularity window corresponding to the service generation time is determined as the second small business time window; based on the minimum business time window and the second small business The time window determines a plurality of service time windows for recording the deduplication traffic.
17. The server according to claim 15 or 16, wherein the instruction information is used to instruct a traffic addition operation to be performed on the deduplicated traffic, and the processor is further configured to parse the instruction information. The instruction information is used to instruct whether to perform the traffic addition operation on the deduplicated traffic, to determine whether the deduplicated traffic is a duplicate traffic; if the deduplicated traffic is not the duplicate traffic, then Performing an increase operation on the number of times that the deduplication traffic occurs under each service time window; if the deduplication traffic is the repeated traffic, the deduplication under each service time window in the multiple service time windows is performed; The number of occurrences of heavy traffic remains unchanged.
18. The server according to claim 15 or 16, wherein the instruction information is used to instruct a traffic reduction operation to be performed on the deduplicated traffic, and the processor is further configured to parse the instruction information to determine the Whether the indication information is used to instruct the traffic deduction operation to be performed on the deduplicated traffic; if the indication information is used to instruct the traffic deduction operation to be performed on the deduplicated traffic, in the multiple service time windows Perform a reduction operation on the number of times that the deduplication traffic occurs.
19. The server according to any one of claims 15 to 18, wherein the preset traffic configuration information further includes a failure duration threshold, and the processor is further configured to enable a timing function for the multiple service time windows In the case where the current time length is greater than or equal to the failure duration threshold, deleting the recorded data of the deduplication traffic in the multiple time windows.
20. A computer-readable storage medium, characterized in that the computer-readable storage medium stores a computer program, the computer program includes program instructions, and when the program instructions are executed by a processor, the processor executes The method according to any one of claims 1-7 is required.

Images