WO2021057131A1

WO2021057131A1 - User ticket purchase behavior detection method and device

Info

Publication number: WO2021057131A1
Application number: PCT/CN2020/097581
Authority: WO
Inventors: 周荣旺; 杨程远; 张恒; 杨志雄
Original assignee: 支付宝(杭州)信息技术有限公司
Priority date: 2019-09-27
Filing date: 2020-06-23
Publication date: 2021-04-01
Also published as: CN110675228A; TWI740507B; TW202113694A; CN110675228B

Abstract

A user ticket purchase behavior detection method and device. The user ticket purchase behavior detection method comprises: collecting page access data of a user on a ticket purchase page (102); determining access abnormality degree of the user on the ticket purchase page by analyzing the page access data (104); inputting the access abnormality degree into an access abnormality measurement function corresponding to a ticket purchase dimension to which the ticket purchase page belongs to perform access abnormality calculation (106); and under the condition that a calculated access abnormality measurement value of the ticket purchase dimension is smaller than a preset measurement threshold of the ticket purchase dimension, inputting the page access data into a ticket purchase behavior detection model to perform ticket purchase behavior detection, and obtaining an output ticket purchase behavior detection result of the user (108). By means of the user ticket purchase behavior detection method, the ticket purchase behavior detection model is adopted to detect a ticket purchase behavior of the user, false seat occupation conditions are effectively prevented and controlled, and the defect that a large amount of manpower and a large number of material resources are needed is overcome.

Description

Method and device for detecting ticket purchase behavior of user

Technical field

This application relates to the field of Internet information management technology, and in particular to a method for detecting user ticket purchase behavior. This application also relates to a user ticket purchase behavior detection device, a computing device, and a computer-readable storage medium.

Background technique

With the development of Internet technology, various services in life have opened network services. Users can get the services they need through the Internet, especially in the ticket purchase dimension, as long as the user adds the correct identity information and purchases on the ticket purchase service page. Ticket information, and pay the corresponding ticket purchase amount, you can get the ticket that needs to be purchased.

However, as the online ticketing service simplifies the ticket purchase needs of users, there are some abnormal users who use the online ticketing service to falsely occupy seats in order to make a profit. As a result, normal users have no tickets to buy when they need to buy tickets. Not only will it affect normal users, but it will also cause a backlog of tickets that are difficult to sell by ticketing agencies.

In order to avoid false occupancy of abnormal users, a user-visible verification mechanism will be introduced to the user's ticket purchase process, such as sliding verification or SMS verification to verify the user's ticket purchase behavior, but the verification mechanism is introduced for purchase. Ticket verification is also a huge expense for ticketing agencies, and manual supervision of the ticket purchase process is also required, which is a waste of material and manpower.

Summary of the invention

In view of this, an embodiment of the present application provides a method for detecting a user's ticket purchase behavior. This application also relates to a user ticket purchase behavior detection device, a computing device, and a computer-readable storage medium to solve related technical defects.

According to a first aspect of the embodiments of the present application, there is provided a method for detecting a user's ticket purchase behavior, including:

Collect user access data on the ticket purchase page;

By analyzing the page access data, determine the abnormality of the user's access to the ticket purchase page;

Input the access abnormality degree into the access abnormality measurement function corresponding to the ticket purchase dimension to which the ticket purchase page belongs to perform access abnormality calculation;

In the case that the calculated access anomaly measurement value of the ticket purchase dimension is less than the preset measurement threshold of the ticket purchase dimension, the page access data is input into the ticket purchase behavior detection model for ticket purchase behavior detection, and the output is obtained The detection result of the user's ticket purchase behavior.

Optionally, the step of analyzing the page access data to determine the abnormality of the user's access to the ticket purchase page includes:

Obtain the behavior chain of the user on the ticket purchase page by analyzing the page access data;

Extracting the ticket purchasing node visited by the user and the visit time at the ticket purchasing node in the behavior chain;

The access abnormality degree calculation is performed based on the ticket purchasing node and the access time, and the calculation result is used as the access abnormality degree.

Optionally, after the step of inputting the page access data into the ticket purchasing behavior detection model to perform ticket purchasing behavior detection, and obtaining the output of the user's ticket purchasing behavior detection result is executed, the method further includes:

In the case where the detection result of the ticket purchase behavior is abnormal, adding the user to the list of abnormal users, and using a honeypot mechanism to jump the ticket purchase page to the honeypot ticket purchase page;

Collecting page access data of the user on the honeypot ticket purchase page;

By analyzing the page access data of the user's ticket purchase page on the honeypot, determine the page vulnerability of the ticket purchase page;

Repair the ticket purchase page based on the page vulnerability.

Optionally, after the access anomaly degree is input into the access anomaly measurement function corresponding to the ticket purchase dimension to which the ticket purchase page belongs to perform the access anomaly calculation step, the page access data is input into the ticket purchase behavior The detection model performs ticket purchase behavior detection, and before the step of obtaining the output of the user's ticket purchase behavior detection result is executed, it also includes:

In the case that the calculated access abnormality measurement value is greater than or equal to the measurement threshold, jump the ticket purchase page to a verification page, and perform a second verification on the user's ticket purchase behavior;

In the case that the user fails the secondary verification, adding the user to the list of abnormal ticket purchase behaviors;

In the case that the user passes the secondary verification, the step of inputting the page access data into the ticket purchasing behavior detection model to perform ticket purchasing behavior detection is performed, and the output of the user's ticket purchasing behavior detection result is obtained.

Optionally, the ticket purchase behavior detection model is trained in the following manner:

Collect historical user access data on the historical page of the ticket purchase page and historical ticket purchase behavior results;

Adding behavior tags to the historical ticket purchase behavior results corresponding to the historical page access data, and using the historical ticket purchase behavior results to which the behavior tags are added and the corresponding historical page access data as training samples;

The training samples are input to a ticket buying behavior detection model constructed based on the association relationship between the historical page access data and the historical ticket buying behavior results, and the ticket buying behavior detection model is obtained.

Optionally, after the step of collecting user access data on the ticket purchase page is executed, the method further includes:

Determining the ticket purchase account of the user according to the page access data;

Detect the ticket purchase records in the ticket purchase account, and determine the number of tickets purchased by the user during the ticket purchase time;

In a case where the ticket purchase time is less than a preset time threshold and the number of tickets purchased is greater than the preset number threshold, the ticket purchase account is frozen.

Optionally, the preset measurement threshold of the ticket purchase dimension is determined in the following manner:

Obtaining historical abnormality measurement values of historical users in the ticket purchase dimension;

Calculate the average value of the historical access abnormality measurement value as the preset measurement threshold value of the ticket purchase dimension.

Optionally, the calculation of the access abnormality degree based on the ticket purchasing node and the access time, and using the calculation result as the access abnormality degree, includes:

Determining, according to the page access data, the number of first nodes of the ticket purchasing node clicked by the user, and determining the number of second nodes of the ticket purchasing node accessed by the user extracted from the behavior chain;

Calculate the ratio of the number of the first nodes to the number of the second nodes, and determine it as the node access probability of the user;

Determining, according to the page access data, the time when the user opens the ticket purchase page and the time when the user pays the ticket purchase amount;

Determining the total time for the user to purchase tickets and the total time for the user to visit the ticket purchasing node based on the time when the ticket purchase page is opened and the time when the user pays the amount of the ticket;

Calculate the ratio of the total time to the total access time, and determine it as the access time probability of the user;

The access node probability and the access time probability are multiplied, and the access abnormality degree is determined according to the product result.

Optionally, the collection of page access data of the user on the ticket purchase page includes:

By embedding a data collection package on the platform carrying the ticket purchase page, creating a data collection interface on the platform carrying the ticket purchase page;

Collect the page access data by calling the data collection interface.

Reading page click data, page access time data, and page jump data included in the page access data;

Determine the number of times the user clicks on the ticket purchase page according to the page click data, determine the user’s stay time on the ticket purchase page according to the page access time data, and determine according to the page jump data The number of jumps by the user on the ticket purchase page;

Calculate the product of the number of clicks and the preset click weighting factor, the product of the dwell time and the preset time weighting factor, and the number of jumps and the preset jump weighting factor The product of the two;

The product result is summed, and the ratio between the sum result and the preset access abnormality standard value is calculated as the access abnormality degree.

According to a second aspect of the embodiments of the present application, there is provided a user ticket purchase behavior detection device, including:

The collection module is configured to collect user access data on the ticket purchase page;

The determining module is configured to determine the abnormality of the user's access to the ticket purchase page by analyzing the page access data;

A calculation module configured to input the access anomaly degree into an access anomaly measurement function corresponding to the ticket purchase dimension to which the ticket purchase page belongs to perform access anomaly calculation;

The detection module is configured to input the page access data into the ticket purchase behavior detection model to purchase tickets when the calculated access anomaly measurement value of the ticket purchase dimension is less than the preset measurement threshold of the ticket purchase dimension. Behavior detection, to obtain the output detection result of the user's ticket purchase behavior.

Optionally, the determining module includes:

The parsing unit is configured to obtain the behavior chain of the user on the ticket purchase page by parsing the page access data;

An extracting unit configured to extract the ticket purchasing node visited by the user and the time of visit at the ticket purchasing node in the behavior chain;

The calculation unit is configured to perform an access abnormality calculation based on the ticket purchasing node and the access time, and use the calculation result as the access abnormality.

Optionally, the device for detecting user ticket purchase behavior further includes:

The jump module is configured to add the user to the list of abnormal users when the detection result of the ticket purchase behavior is abnormal, and use the honeypot mechanism to jump the ticket purchase page to the honeypot purchase ticket page;

A page access data collection module configured to collect page access data of the user on the honeypot ticket purchase page;

The page vulnerability determining module is configured to determine the page vulnerability of the ticket purchase page by analyzing the page access data of the user on the honeypot ticket purchase page;

The repair module is configured to repair the ticket purchase page based on the page vulnerability.

According to a third aspect of the embodiments of the present application, a computing device is provided, including:

Memory and processor;

The memory is used to store computer-executable instructions, and the processor is used to execute the computer-executable instructions:

Collect user access data on the ticket purchase page;

According to a fourth aspect of the embodiments of the present application, a computer-readable storage medium is provided, which stores computer-executable instructions that, when executed by a processor, implement any of the steps of the user ticket purchase behavior detection method.

The user's ticket purchase behavior detection method provided in this application collects the user's page access data on the ticket purchase page; analyzes the page access data to determine the abnormal degree of the user's access to the ticket purchase page; The access anomaly degree is input into the access anomaly measurement function corresponding to the ticket purchase dimension to which the ticket purchase page belongs to perform access anomaly calculation; the calculated access anomaly measurement value of the ticket purchase dimension is less than the preset measurement of the ticket purchase dimension In the case of a threshold value, the page access data is input into the ticket purchasing behavior detection model to perform ticket purchasing behavior detection, and the output of the user's ticket purchasing behavior detection result is obtained.

In the method for detecting user ticket purchase behavior provided by the present application, the degree of access abnormality is determined according to the page access data of the user on the ticket purchase page, which implements preliminary detection of the user's ticket purchase behavior, and measures the abnormal access When the value is less than the preset measurement threshold of the ticket purchase dimension, the ticket purchase behavior detection model is used to detect the user's ticket purchase behavior again, so that the user's ticket purchase behavior can be accurately determined. And when the user’s ticket purchase behavior is detected, it is carried out during the user’s ticket purchase process, so that the user’s ticket purchase behavior can be seamlessly detected, which greatly reduces the interference to the user’s ticket purchase process and optimizes Improve the user experience effect.

Description of the drawings

FIG. 1 is a flowchart of a method for detecting a user's ticket purchase behavior provided by an embodiment of the present application;

FIG. 2(a) is a schematic diagram of a process of collecting page access data in a method for detecting user ticket purchase behavior provided by an embodiment of the present application;

FIG. 2(b) is a schematic diagram of a process of collecting page access data in a method for detecting user ticket purchase behavior provided by an embodiment of the present application;

FIG. 3 is a schematic structural diagram of a behavior chain in a method for detecting a user's ticket purchase behavior provided by an embodiment of the present application;

FIG. 4 is a schematic diagram of a process of calculating an access abnormality measurement value in a method for detecting a user's ticket purchase behavior provided by an embodiment of the present application;

FIG. 5 is a process flow chart of a method for detecting a user's ticket purchase behavior provided by an embodiment of the present application;

FIG. 6 is a schematic structural diagram of a user ticket purchase behavior detection device provided by an embodiment of the present application;

Fig. 7 is a structural block diagram of a computing device provided by an embodiment of the present application.

detailed description

In the following description, many specific details are set forth in order to fully understand this application. However, this application can be implemented in many other ways different from those described herein, and those skilled in the art can make similar promotion without violating the connotation of this application. Therefore, this application is not limited by the specific implementation disclosed below.

The terms used in one or more embodiments of the present application are only for the purpose of describing specific embodiments, and are not intended to limit one or more embodiments of the present application. The singular forms of "a", "said" and "the" used in one or more embodiments of the present application and the appended claims are also intended to include plural forms, unless the context clearly indicates other meanings. It should also be understood that the term "and/or" used in one or more embodiments of the present application refers to and includes any or all possible combinations of one or more associated listed items.

It should be understood that although the terms first, second, etc. may be used to describe various information in one or more embodiments of the present application, the information should not be limited to these terms. These terms are only used to distinguish the same type of information from each other. For example, without departing from the scope of one or more embodiments of the present application, the first may also be referred to as the second, and similarly, the second may also be referred to as the first. Depending on the context, the word "if" as used herein can be interpreted as "when" or "when" or "in response to determination".

First, the terminology involved in one or more embodiments of the present invention will be explained.

Honeypot mechanism: In essence, it is a technology to deceive the attacker. By arranging some hosts, network services or information as bait, the attacker can be induced to attack them, so that the attack behavior can be captured and analyzed to understand The tools and methods used by the attacker to speculate the intention and motivation of the attack can allow the defender to clearly understand the security threats they are facing, and use technology and management methods to enhance the security protection capabilities of the actual system.

In this application, a method for detecting user ticket purchase behavior is provided. This application also relates to a user ticket purchase behavior detection device, a computing device, and a computer-readable storage medium. In the following embodiments, one by one Give a detailed description.

In the following, the method for detecting user ticket purchase behavior provided by the present application will be described with reference to FIG. 1, FIG. 2(a) and FIG. 2(b), FIG. 3 and FIG. 4. Fig. 1 shows a flow chart of a method for detecting a user's ticket purchase behavior according to an embodiment of the present application; Fig. 2(a) shows a method for detecting a user's ticket purchase behavior according to an embodiment of the present application A schematic diagram of the process of collecting page access data; Figure 2(b) shows a schematic diagram of the process of collecting page access data in a method for detecting user ticket purchase behavior according to an embodiment of the present application; Figure 3 shows a schematic diagram of the process of collecting page access data according to one embodiment of the present application. The embodiment provides a schematic structural diagram of a behavior chain in a method for detecting a user's ticket purchase behavior; FIG. 4 shows a schematic diagram of a process of calculating an access anomaly measurement value in a method for detecting a user's ticket purchase behavior according to an embodiment of the present application; FIG. 1 includes step 102 to step 108.

Step 102: Collect page access data of the user on the ticket purchase page.

The ticket purchase page in an embodiment of this application may be a ticket purchase page for air travel tickets, a ticket purchase page for competition tickets, a ticket purchase page for tourist attractions tickets, or a ticket purchase page for concert tickets, etc. Yes, the page access data may be the access data of the user accessing the ticket purchase page for selling air travel tickets, the access data of the user accessing the ticket purchase page for selling competition tickets, the access data of the user accessing the ticket purchase page for selling tourist attraction tickets, or The access data of the user to the ticket purchase page for selling concert tickets, etc.; wherein the access data may be data such as the number of clicks, the browsing time, and the number of tickets purchased by the user on the corresponding ticket purchase page.

For example, if a user purchases a train ticket from location A to location B on a webpage selling train tickets, it can be determined that the information of the ticket purchased by the user is from location A to location B, the user’s identity information, the time it takes for the user to purchase the ticket on webpage A, and the user The content browsed on the A webpage is all the user's page visit data on the A webpage.

Here, taking the ticket purchase page as an air ticket purchase page as an example, the method for detecting the user's ticket purchase behavior is described. Based on this, in order to avoid this problem when the user purchases air tickets through the ticket purchase page, The user is an abnormal user who falsely occupies a seat and needs to conduct real-time detection of the user’s ticket purchase behavior. In this process, the user sets the verification interface during the purchase of air tickets to prevent the user from falsely occupying the seat through the software. It can enable users with real needs to buy air tickets. It can be seen that the user’s ticket purchase behavior is detected during the user’s ticket purchase process, so that the user can purchase the required air ticket. In this process, the user’s ticket is effectively verified. Ticket purchase behavior plays a very important role.

The user’s ticket purchase behavior detection method provided in this application is designed to enable users to save the verification process of ticket purchase behavior during the process of purchasing air tickets, and also to prevent and control false seat occupations. The page access data of the airline ticket page is analyzed to obtain the user’s access anomaly degree on the airline ticket purchase page. By entering the access anomaly degree into the access anomaly measurement function to calculate the access to the airport, it can be preliminarily determined that the user is purchasing the airline ticket Whether the process belongs to normal ticket purchase behavior, in the case that the user belongs to normal ticket purchase behavior, the ticket purchase behavior detection model is used to further detect the user's ticket purchase behavior, so that the user's purchase behavior can be accurately determined State, and then realize the traceless detection of the user's purchase of air tickets, verify the user's purchase of air tickets without disturbing the user's purchase of air tickets, and avoid false seat occupations that lead to unsalable air tickets When this happens, it saves time for the user to purchase air tickets, and saves manpower and material resources for the seller of air tickets.

In one or more implementation manners of this embodiment, the page access data of the user on the ticket purchase page is collected, and the specific implementation manner is as follows:

Collect the page access data by calling the data collection interface.

Specifically, in order to obtain sufficiently accurate page access data of the user, by embedding a data collection package on the platform carrying the ticket purchase page, and mounting the data collection package to the platform, the user’s page access can be automatically collected Data, the data collection package can be in SDK (Software Development Kit) format or JS (JavaScript) code fragments. When the user purchases the ticket through the ticket purchase page, the platform will automatically call the data The collection interface is to collect the user's page access data through the collection function corresponding to the embedded data collection package.

In specific implementation, after embedding the data collection package into the platform of the ticket purchase page, the data collection package needs to be decompressed to obtain the code fragments in the data collection package, and then load the code fragments to the ticket purchase page The corresponding development terminal can automatically collect page access data on the ticket purchase page.

In practical applications, Figure 2(a) is a schematic diagram of the ticket purchase page for a user to purchase a ticket. It can be determined that when a user purchases a ticket, he needs to add the information of the ticket purchaser first. When the user fills in the ticket purchase information, The ticket purchase page will obtain the user's page access data on the ticket purchase page according to the code corresponding to the data collection interface running in the background. The code corresponding to the page access data collected through the data collection interface is shown in Figure 2(b), according to Figure 2. (b) As shown in the content, it can be determined that the user is at the coordinates (1182, 273) on the ticket purchase page, time: 4068, and starts to input the certificate number, which is 1, 8....

By embedding the data collection package on the platform of the ticket purchase page, the ticket purchase page can automatically collect the user's page access data on the ticket purchase page in real time, which improves the detection of the user's ticket purchase behavior s efficiency.

On the basis of the above-mentioned collection of the page access data, further, in one or more implementations of this embodiment, the user’s ticket purchasing account may be preliminarily detected, and there is an abnormality in the ticket purchasing account. In this case, the ticket purchase account can be frozen, and the specific implementation method is as follows:

Specifically, the page access data is used to determine the ticket purchase account that the user logs in on the ticket purchase page, detect the ticket purchase record in the ticket purchase account, and determine the number of tickets purchased by the user during each ticket purchase time. , By judging whether the ticket purchase time is less than the time threshold, and the number of tickets purchased is greater than the number threshold, so as to determine whether the ticket purchase behavior of the user is an abnormal behavior.

If the user’s ticket purchase time is less than the time threshold, and the number of tickets purchased is greater than the number threshold, it means that the user may have purchased tickets in an abnormal manner, such as a large-scale ticket occupancy through software. At this time, the user can be determined The ticket purchasing account of may be an account used by abnormal users to occupy tickets. The ticket purchasing account can be frozen. The freezing of the ticket purchasing account specifically refers to prohibiting the ticket purchasing account from purchasing tickets again, and reminding the user to freeze time.

Based on this, only when the user's ticket purchase time is less than the time threshold, and the number of tickets purchased is greater than the number threshold, and the two comparison processes are satisfied at the same time, it can be explained that the user's ticket purchase account is abnormal, and other things In all cases, it can be said that the user's ticket purchase account is normal.

In actual application, take ticket purchasing account A to purchase 5 plane tickets through webpage B as an example to describe whether there is any abnormal behavior in the ticket purchasing account. Among them, the ticket purchasing account A is the user through the ticket sales page of webpage B. User A, User B, User C, User D, and User E purchased 5 air tickets from city A to city B, which took 30 seconds. The time threshold set by web page B is 5 minutes, and the number threshold is 3 For an airplane ticket, it is determined by comparison that the ticket-purchasing account A is an abnormal ticket purchase behavior, and it can be preliminarily determined that the ticket-purchasing account A is suspected of occupying a seat, and then the ticket-purchasing account A is frozen and no further ticket purchases are allowed.

By detecting the ticket purchase records in the user's ticket purchase account, it can be determined whether there has been any abnormal ticket purchase in the user's ticket purchase account. The account is frozen to prevent users from continuing to use the ticket-purchasing account for abnormal ticket purchases, so that the interests of the ticket seller are effectively protected.

In addition, after the ticket purchase account is frozen, if the user has objections, the ticket purchase account can be unfrozen by negotiating with the manual customer service, but the premise is that the user needs to provide valid proof, such as providing purchase Only when a copy of the ticket holder's ID or face recognition is performed on the user to confirm that the user has no problems can the ticket purchase account be unfrozen.

Step 104: Determine the abnormality of the user's access to the ticket purchase page by analyzing the page access data.

Specifically, according to the page access data collected above, and further, by analyzing the page access data, it is determined that the user's access abnormality on the ticket purchase page is, and the access abnormality specifically refers to the user In the process of purchasing tickets on the ticket purchasing page, the abnormal access probability occurs. For example, the time to buy a ticket is about 300 seconds under normal circumstances, but the user actually spends 30 seconds to buy the ticket. The degree of abnormal access is 1-(30/300)*100%=90%.

In one or more implementation manners of this embodiment, the abnormality of the user's access may be determined in the following manner:

Specifically, on the basis of the page access data collected above, the page access data is further analyzed to obtain the behavior chain of the user on the ticket purchase page, and the behavior chain specifically refers to the user A link composed of behaviors generated during the ticket purchase process on the ticket purchase page. The behavior chain contains data such as the user's access path and the user's access time, and then extracts the user's access in the behavior chain. The ticket purchase node of the ticket purchase page and the visit time of the user at the ticket purchase node are calculated based on the ticket purchase node and the visit time, and the user's visit abnormality degree is determined according to the calculation result .

Based on this, the ticket purchasing node is a node that the user needs to pass through in the process of purchasing a ticket on the ticket purchasing page, that is, the user's activity point. First, predict the ticket purchase nodes that the user needs to pass through during the ticket purchase process to obtain the user's predicted ticket purchase sequence, and then determine the ticket purchase node that the user has visited according to the user's page access data, determine the user's actual ticket purchase sequence, and finally The actual ticket purchase sequence adjusts the predicted ticket purchase sequence, deletes the ticket purchase nodes that the user is unlikely to appear in the predicted ticket purchase sequence, and obtains the behavior chain.

Refer to Figure 3 for a structural diagram of the behavior chain, where the quadrilateral represents the user's stay time (visit time) at the activity point (ticket purchasing node), and the circle represents the activity point visited by the user. See Figure 3 to see that the user is at activity point 1. The stay time is 15s, the user stays at activity point 2 for 20s, and the user stays at activity point 3 for 25s..., and so on, determine the ticket purchase node and visit time that the user visits on the ticket purchase page .

Based on the above extraction of the ticket purchasing node visited by the user and the access time of the ticket purchasing node, further, in one or more implementations of this embodiment, the first method of calculating the degree of abnormal access is The implementation is as follows:

Specifically, the number of first nodes of the ticket purchasing node clicked by the user is determined according to the page access data, and the first node number is the number of ticket purchasing nodes clicked by the user, and at the same time it is determined that the behavior chain is extracted The number of the second node of the node visited by the user, the number of the second node is the number of ticket-purchasing nodes that the user has visited, and the ratio of the number of the first node to the number of the second node is calculated to determine the The access node probability of the user, the access node probability specifically refers to the ratio of the number of ticket purchasing nodes opened and visited by the user to the total number of ticket purchasing nodes clicked by the user, that is, the access node probability;

Determine the time when the user enters the ticket purchase page according to the page access data, and the time when the user pays the ticket purchase amount for the ticket purchase, and the time when the ticket purchase amount is paid minus the time to enter the ticket The time of the ticket purchase page is determined as the total time spent by the user during this ticket purchase process. At the same time, the user's visit time at each ticket purchase node during this ticket purchase process is summed, Determine the total visit time of the user, and based on this, calculate the ratio of the total time to the total visit time as the visit time probability of the user visiting the ticket purchase page;

Based on the access node probability and the access time probability obtained by the above calculation, by calculating the product of the access node probability and the access time probability, the product result is used as the access abnormality degree.

During specific implementation, the access node probability is specifically used to describe the probability that the user accesses the ticket purchasing node on the ticket purchasing page, and the access time probability is specifically used to describe the user’s access to the ticket purchasing page. The probability that the time spent visiting the ticket purchasing node is abnormal.

By combining the time dimension and the behavior dimension to calculate the abnormality of the user's access to the ticket purchase page, it is possible to more accurately determine whether the user is an abnormal user, and the abnormality of the access can reflect the use of The ticket purchase behavior of the user.

Based on the above extraction of the ticket purchasing node visited by the user and the access time of the ticket purchasing node, further, in one or more implementations of this embodiment, the second type of access abnormality is calculated The implementation is as follows:

Specifically, according to the collected page access data, further, read the page click data, the page access time data, and the page jump data included in the page access data, wherein the page Click data specifically refers to the number of times the user clicks on the ticket purchase page, the page access time data specifically refers to the total time the user visits the ticket purchase page, and the page jump data specifically refers to the user's The number of jumps to the sub-pages contained in the ticket purchase page during the ticket purchase process on the ticket page

Determine the number of times the user clicks on the ticket purchase page according to the page click data, determine the user’s stay time on the ticket purchase page according to the page access time data, and determine according to the page jump data The number of times the user has jumped on the ticket purchase page; and the weight coefficients corresponding to page click data, page access time data, and page jump data are preset in the ticket purchase page;

Based on this, the product of the number of clicks and the click weight coefficient corresponding to the page click data dimension is calculated, and the calculation result is used as the first calculation result, and the first calculation result is used to indicate the click data on the page The weight value of the dimension; calculate the product of the dwell time and the time weight coefficient corresponding to the page access time data dimension, and use the calculation result as the second calculation result, and the second calculation result is used to indicate the The weight value of the page access time data dimension; calculate the product of the number of jumps and the jump weight coefficient corresponding to the page jump data dimension, and use the calculation result as the third calculation result, the third calculation result Used to indicate the weight value of the page jump dimension;

Then, by summing the first calculation result, the second calculation result, and the third calculation result, the sum result is divided by the access abnormality standard value, and the result is used as the access abnormality degree The access abnormality standard value can be obtained by collecting data of a large number of historical users in different dimensions, determining the weight values in different dimensions according to the above calculation process, and calculating the average value of the sum of the weight values of a large number of historical users after summing the weight values. As the access abnormal standard value, the access abnormal standard value in actual applications can be set according to actual application scenarios, and this application does not make any limitation here.

In order to be able to predict the user’s ticket purchase behavior more accurately in the follow-up, by reading the page click data, page access time data and page jump data contained in the page access data, and respectively according to the page click data, The page access time data and the page jump data calculate the weight value to calculate the abnormality of the user’s access. In the subsequent process of detecting the user’s ticket purchase behavior, the user’s behavior can be determined more accurately. Ticket purchase behavior.

Step 106: Input the access anomaly degree into the access anomaly measurement function corresponding to the ticket purchase dimension to which the ticket purchase page belongs to perform access anomaly calculation.

Specifically, on the basis of the above determination of the abnormality of the user's access to the ticket purchase page, further, the access abnormality measurement function corresponding to the ticket purchase dimension to which the ticket purchase page belongs is determined, and the ticket purchase dimension is specifically Refers to the ticket purchase scenarios of different types of ticket purchases. For example, if a user purchases a train ticket on the train ticket purchase page, the visit anomaly measurement function in the train ticket purchase dimension will be determined; based on this, the visit anomaly degree is input To the access abnormality measurement function corresponding to the ticket purchase dimension to which the ticket purchase page belongs, calculate the access abnormality degree of the user according to the access abnormality measurement function, and determine the access abnormality measurement value.

In specific implementation, the access abnormality measurement function corresponding to the ticket purchase dimension may be the MAX function, the MIN function, or the AVG function; the maximum value of the access abnormality measurement value can be calculated by the MAX function, and the MIN function can be used Calculate the minimum value of the access abnormality measurement value or calculate the average value of the access abnormality measurement value through the AVG function; the access abnormality measurement function corresponding to the ticket purchase dimension can be set according to actual application scenarios. This application There are no restrictions here.

For example, an airplane to C place sold n tickets, and n is the value corresponding to the seat ticket. In order to avoid the occurrence of false seat occupation, the airline needs to calculate the purchase of each ticket corresponding to the purchase user. Ticket behavior, by collecting the ticket purchase data of each ticket purchase user, determine the visit anomaly degree of each ticket user, and input the visit anomaly degree of each user into the access anomaly measurement function Hn=AVG corresponding to the plane ticket purchase dimension _0<n<m (P1, P2, Pn...Pm); where Hn represents the access abnormality measurement value of each user, P1, P2, Pn...Pm represents the access abnormality degree of each user, and the AVG function is used to calculate the user's The average value of access anomaly measurement values, see Figure 4, which shows a schematic diagram of the process of calculating access anomaly measurement values. The access anomaly measurement function Hn is used to calculate the access anomaly measurement values H1, H2, ... Hn of each user, and then according to the subsequent The processing process determines whether each user has false seat occupation.

On the basis of the aforementioned access anomaly measurement value calculated through the access anomaly measurement function corresponding to the ticket purchase dimension, further, in one or more implementations of this embodiment, the calculated access anomaly The measurement value is compared with the preset measurement threshold. In the case that the calculated access abnormality measurement value is greater than or equal to the measurement threshold, the user needs to be verified twice. The specific implementation is as follows:

Specifically, the calculated access abnormality measurement value is compared with a preset measurement threshold, and if the calculated access abnormality measurement value is greater than or equal to the measurement threshold, the ticket purchase of the user is explained There is an abnormal behavior, and the user needs to be verified twice. The second verification specifically refers to requesting the user to verify by jumping to the second verification page. The verification method can be the input of the verification code and the second verification process. Need to be done manually by the user;

Based on this, in the case that the user fails the secondary verification, it is explained that the user’s current ticket purchase behavior may be falsely occupying a seat, then the user is added to the list of abnormal ticket purchase behaviors The list of abnormal ticket purchase behaviors refers to the list created by users who have not passed the verification in the case of the first verification; in the case of the second verification of the user, it indicates that the user's ticket purchase behavior is normal, and the follow-up Step 108 is enough.

In addition, when the calculated access abnormality measurement value is greater than the measurement threshold, the user can be directly added to the list of abnormal ticket purchase behaviors, and the calculated access abnormality value will be added to the list of abnormal ticket purchase behaviors. When the abnormal measurement value is equal to the measurement threshold, the user is verified for a second time, and the user's ticket purchase behavior is further verified by levels, so that the verification process becomes faster.

For example, Airline A verifies the ticket purchase behaviors of users X and Y to avoid false seat occupations. By collecting the ticket purchase data of users X and Y, it is determined that user X’s access abnormality measurement value is 7. Y’s access abnormality measurement value is 9, where the measurement threshold value is 8. According to the comparison, it is determined that the user X’s access abnormality measurement value is less than the measurement threshold. It can be determined that user X’s ticket purchase behavior is initially judged to be normal, and subsequent ticket purchase behavior verification is performed. Yes, the access abnormality measurement value of user Y is greater than the measurement threshold, and user Y needs to be verified twice. By jumping to the preset secondary verification interface, user Y is verified. If user Y passes the verification, it is explained User Y’s current ticket purchase behavior is preliminarily judged to be normal, and the subsequent ticket purchase behavior verification can be performed. In the case that user Y fails the verification, it means that user Y’s current ticket purchase behavior is preliminarily judged to be abnormal, and the user Y is added to the list of abnormal ticket purchase behaviors.

Before the ticket buying behavior detection model is used to detect the ticket buying behavior, the user can be preliminarily judged whether the user's ticket buying behavior is normal by verifying the user according to the user's abnormal access measurement value. The preliminary judgment process can eliminate users with abnormal ticket purchase behaviors, avoiding the secondary verification of users who already have abnormal ticket purchase behaviors in the subsequent ticket purchase behavior detection process, which not only saves the user's ticket purchase behavior. The detection time of behavior detection also saves the cost incurred by the seller in the verification process.

Step 108: When the calculated access abnormality measurement value of the ticket purchase dimension is less than the preset measurement threshold value of the ticket purchase dimension, input the page access data into the ticket purchase behavior detection model to perform ticket purchase behavior detection. Obtain the output detection result of the user's ticket purchase behavior.

Specifically, based on the above-mentioned access anomaly calculation using the access anomaly measurement function corresponding to the ticket purchase dimension, further, the user’s access anomaly measurement value is determined according to the access anomaly measurement function, and the location abnormality The measurement value is compared with the measurement threshold. When the calculated access abnormality measurement value of the ticket purchase dimension is less than the preset measurement threshold of the ticket purchase dimension, it is indicated that the user’s ticket purchase behavior is preliminarily determined When the preliminary judgment result is passed, the page access data is input to the ticket purchase behavior detection model to further detect the user's ticket purchase behavior, and the ticket purchase behavior detection model outputs the user The ticket purchase behavior detection result of the ticket purchase behavior includes the user's normal ticket purchase, the user's abnormal ticket purchase, and the user's abnormal ticket purchase;

Among them, the user’s normal ticket purchase specifically refers to the user’s normal purchase of the required ticket through the ticket purchase page, and the user’s abnormal ticket purchase specifically refers to the situation where the user normally purchases the ticket through the ticket purchase page and the abnormal purchase occurs. Ticket behavior, such as buying tickets too fast, may cause users to purchase tickets abnormally. In the case of abnormal ticket purchases, the user can be verified twice. If the verification is passed, it will not affect the user's ticket purchase, and the user is abnormal Ticket purchase specifically refers to the fact that the user falsely occupies a seat through abnormal means through the ticket purchase page.

Based on the comparison of the access abnormality measurement value of the ticket purchase dimension obtained by the above calculation with the measurement threshold value preset in the ticket purchase dimension, further, in one or more implementation manners of this embodiment, the The preset measurement threshold of the ticket purchase dimension is determined as follows:

Specifically, before comparing the access anomaly measurement values, it is necessary to determine the measurement thresholds of the ticket purchase dimensions. Different ticket purchase dimensions correspond to different measurement thresholds. For the specific preset process, please refer to the following content. The large number of historical users of the ticket purchase page collects the historical access abnormality measurement values of the large number of historical users in the ticket purchase dimension to which the ticket purchase page belongs, and averages the historical access abnormality measurement values of a large number of historical users as The preset measurement threshold of the ticket purchase dimension.

In addition, the measurement threshold can also be preset through the feedback anonymous inquiry method. The feedback anonymous inquiry method is the expert survey method, which specifically refers to a platform that hosts the ticket purchase page to form a special prediction agency , Including a number of experts and ticket purchase predictors, according to the prescribed procedures, back-to-back consulting experts on the opinions and judgments of the ticket users, and then proceed to determine the measurement threshold method.

Based on the detection of the user's ticket purchase behavior through the ticket purchase behavior detection model described above, further, in one or more implementation manners of this embodiment, the ticket purchase behavior detection model is trained in the following manner :

Specifically, the ticket purchase behavior detection model is a supervised learning model. Based on this, the historical page access data and historical ticket purchase behavior results of historical users on the ticket purchase page are collected, and the historical page access data corresponds to Add a behavior tag to the historical ticket purchase behavior result, and use the historical ticket purchase behavior result with the behavior tag added and the corresponding historical page access data as a training sample. The training sample contains the historical page access data of each historical user and its corresponding The result of historical ticket purchase behavior, the training sample is input to the ticket purchase behavior detection model constructed based on the association relationship between the historical page access data and the result of the historical ticket purchase behavior for training, and the ticket purchase behavior can be obtained Check the model.

By adopting a supervised ticket purchase behavior detection model to detect the user's ticket purchase behavior, the accuracy of the detection of the user's ticket purchase behavior is ensured, the occurrence of false seat occupations is reduced, and the occurrence of false seat occupation is effectively reduced. Loss of the seller.

On the basis of the above-mentioned obtaining the ticket purchasing behavior detection result output by the ticket purchasing behavior detection model, further, in one or more implementations of this embodiment, when the ticket purchasing behavior detection result is abnormal , The fact that the user has false seat occupation indicates that there are page loopholes in the ticket purchase page that need to be repaired. The specific process for determining the page loopholes is as follows:

Collecting page access data of the user on the honeypot ticket purchase page;

Repair the ticket purchase page based on the page vulnerability.

Specifically, in the case that the ticket purchasing behavior detection result output by the ticket purchasing behavior detection model is abnormal, indicating that the user has a false seat occupation, the user is added to the list of abnormal users, and the non-normal user The normal user list specifically refers to the list determined by the platform hosting the ticket purchase page as an abnormal user to join, and users who are added to the abnormal user list are not allowed to purchase through the ticket purchase page within a set time If the ticket purchase behavior of the user is abnormal, it means that the ticket purchase page has page loopholes, which are used by the user, and the page loopholes need to be repaired. The honeypot mechanism is used to fix the page loopholes. The ticket purchase page jumps to the honeypot ticket purchase page, collects the user's page access data on the honeypot ticket purchase page, and analyzes the page access data to determine how the user hacks the ticket purchase page and how the user bypasses it. The method of using the prevention and control mechanism of the ticket purchase page is used to determine the page vulnerabilities of the ticket purchase page, and the page vulnerabilities used by the user are repaired to improve the prevention and control ability of the ticket purchase page.

In specific implementation, the user may exploit the page vulnerability by cracking certain parts of the ticket purchase page. In this case, the cracked place can be further encrypted to prevent subsequent access. The user cracks, thereby avoiding the occurrence of false seat occupation.

In practical applications, the above-mentioned airline A's detection of user Y's ticket purchase behavior through the ticket purchase behavior detection model is still used as an example to describe the process of fixing page vulnerabilities. Among them, the ticket purchase behavior is output from the ticket purchase behavior detection model. The detection result confirms that user Y’s ticket purchase behavior is abnormal, then user Y is added to the list of abnormal users set by Airline A, and user Y is not allowed to make purchases through Airline A’s ticket purchase page within 3 years. Tickets, and jump the ticket purchase page of Airline A to the honeypot ticket purchase page, collect the user's page access data on the honeypot ticket purchase page, and further determine the page loopholes in the Airline A ticket purchase page, through the page loopholes Carry out repairs to prevent other users from taking advantage of page loopholes to cause A airline to incur economic losses.

In addition, it is also possible to obtain more data of the user, such as the user’s social data, based on the page access data of the user’s ticket purchase page on the honeypot, and determine whether the user is performing abnormally with this. The ticket selling behavior of the means can be reported to the user based on the collected user data, so as to prevent the user from using abnormal means to cause more losses to the ticket seller.

By introducing a honeypot mechanism to collect the page access data of the user on the honeypot ticket purchase page, the page vulnerability of the ticket purchase page can be effectively determined. In the case of determining the page vulnerability, the The page vulnerabilities are repaired to avoid more losses.

The user's ticket purchase behavior detection method provided by the present application analyzes the user's page access data on the ticket purchase page to determine the degree of access abnormality, and realizes the preliminary detection of the user's ticket purchase behavior. In the case that the access abnormality measurement value is less than the measurement threshold value preset in the ticket purchase dimension, the ticket purchase behavior detection model is used to detect the user's ticket purchase behavior again, so that the user can be accurately determined The ticket purchase behavior of the user is detected during the user's ticket purchase process, so that the user's ticket purchase behavior is seamlessly detected, which greatly reduces the user's ticket purchase behavior. The interference of the process optimizes the user’s experience. At the same time, the honeypot mechanism is introduced to prevent and control users who have abnormal ticket purchase behaviors, which can effectively reduce the economic loss of the ticket seller, and can prevent the existence of the ticket purchase page. The vulnerabilities were repaired to prevent other users with abnormal ticket purchase behaviors from using page vulnerabilities to falsely occupy seats.

In the following, with reference to FIG. 5, the application of the user ticket buying behavior detection method provided in this application for detecting the passenger's ticket buying behavior in an airline is taken as an example to further illustrate the user ticket buying behavior detection method. Wherein, FIG. 5 shows a processing flow chart of a method for detecting a user's ticket purchase behavior provided by an embodiment of the present application, and the specific steps include step 502 to step 528.

Step 502: Collect the page access data of the passenger P on the plane ticket purchase page.

Specifically, passenger P needs to purchase a plane ticket on the plane ticket purchase page;

Based on this, the passenger P performs the ticket purchase operation on the ticket purchase page to generate page access data. In order to prevent the occurrence of false seat occupation, the platform carrying the ticket purchase page will detect the ticket purchase behavior of each passenger by collecting passengers P's page access data is used to detect passenger P's ticket purchase behavior.

Step 504: Obtain the behavior chain of passenger P on the plane ticket purchase page by analyzing the page access data.

Specifically, passenger P needs to go through a series of ticket purchase procedures to purchase air tickets on the air ticket purchase page;

Based on this, according to the operation data of the passenger P on the plane ticket purchase page, the behavior chain of the passenger P on the plane ticket purchase page is determined.

Step 506: Extract the ticket purchase node visited by the passenger P in the behavior chain and the visit time at the ticket purchase node.

Specifically, through the above-determined behavior chain, the ticket purchase nodes visited by the passenger P on the plane ticket purchase page in the behavior chain are further extracted, as well as the visit time for each ticket purchase node.

Step 508: Calculate the abnormality degree of the passenger P's visit to the plane ticket purchase page based on the ticket purchase node and the visit time.

Specifically, according to the ticket purchasing node and access time extracted in the behavior chain, the probability of passenger P's visiting node at the ticket purchasing node and the probability of passenger P's visiting time at the ticket purchasing node are calculated;

Based on this, the product of the access node probability and the access time probability is calculated as the abnormality degree of the passenger P's access to the plane ticket purchase page.

Step 510: Input the visit anomaly degree into the visit anomaly measurement function corresponding to the ticket purchase page for calculation, and obtain the visit anomaly measurement value of the passenger P.

Specifically, the access anomaly measurement function corresponding to the ticket purchase page is the calculation average function. By inputting the access anomaly degree of the passenger P on the ticket purchase page as a variable to the access anomaly measurement function, the calculation result is used to determine the value of the passenger P Access anomaly measurement value.

Step 512: Determine whether the access abnormality measurement value is less than the measurement threshold; if not, go to step 514; if yes, go to step 520.

Specifically, according to the visit anomaly measurement value of the passenger P calculated by the above-mentioned visit anomaly measurement function, it is then judged whether the visit anomaly measurement value is less than the measurement threshold preset on the plane ticket purchase page.

Step 514: Perform a second verification on the passenger P.

Specifically, it is determined that the abnormality measurement value of passenger P is greater than or equal to the measurement threshold preset on the ticket purchase page, indicating that passenger P may have false seat occupation;

Based on this, the passenger P is verified for the second time by jumping the plane ticket purchase page to the second verification page.

Step 516: Determine whether the passenger P has passed the secondary verification; if not, go to step 518; if yes, go to step 520.

Step 518: Add passenger P to the list of abnormal passengers.

Specifically, in the case that the passenger P fails the second verification, it indicates that the passenger P may have an abnormal ticket purchase behavior, the passenger P is added to the abnormal passenger list, and the passenger P is restricted from buying air tickets on the air ticket purchase page.

Step 520: Input the page access data of the passenger P into the ticket purchase behavior detection model.

Specifically, if it is preliminarily determined that passenger P's ticket purchase behavior is a normal behavior, then the page access data of passenger P is input into the ticket purchase behavior detection model, and the passenger P's ticket purchase behavior is further detected.

Step 522: Obtain the ticket purchasing behavior detection result output by the ticket purchasing behavior detection model.

Step 524: When the result of the ticket purchase behavior is abnormal, the passenger P is added to the abnormal passenger list, and the ticket purchase page is jumped to the honeypot ticket purchase page.

Specifically, in the case where the detection result of the ticket purchase behavior is abnormal, it indicates that the ticket purchase behavior of the passenger P is abnormal, and there may be a situation of false seat occupation;

Based on this, passenger P is added to the list of abnormal passengers, and passenger P is restricted from buying air tickets on the ticket purchase page. At the same time, the honeypot mechanism is used to redirect the ticket purchase page of passenger P to the honeypot ticket purchase page. .

Step 526: Collect the page access data of the passenger P's ticket purchase page on the honeypot, and determine the page vulnerability of the plane ticket purchase page according to the page access data.

Specifically, collect page access data of passenger P on the honeypot ticket purchase page, and analyze the page access data of the honeypot ticket purchase page to determine the page vulnerability used by passenger P;

Based on this, the page vulnerabilities of the airline ticket purchase page are determined according to the page vulnerabilities used by the passenger P.

Step 528: Repair the airplane ticket purchase page based on the page vulnerability.

The user's ticket purchase behavior detection method provided in this application analyzes the passenger's page access data on the plane ticket purchase page to determine the degree of passenger abnormality, realizes the preliminary detection of the passenger's ticket purchase behavior, and measures the abnormality of the visit When the value is less than the measurement threshold, the ticket purchase behavior detection model is used to detect the passenger's ticket purchase behavior again, so that the passenger's ticket purchase behavior can be accurately determined, and the passenger's ticket purchase behavior is detected when the passenger's ticket purchase behavior is detected. During the ticket purchase process, the passenger’s ticket purchase behavior is seamlessly detected, which greatly reduces the interference to the passenger’s ticket purchase process and optimizes the passenger’s experience. At the same time, the honeypot mechanism is introduced to prevent abnormal purchases. The prevention and control of passengers with ticket behavior can effectively reduce the economic losses of the ticket seller who sells air tickets, and can repair the loopholes in the ticket purchase page to prevent other passengers with abnormal ticket purchase behavior from reusing the loopholes in the page False seat occupation occurred.

Corresponding to the foregoing method embodiments, this application also provides an embodiment of a user ticket purchase behavior detection device. FIG. 6 shows a schematic structural diagram of a user ticket purchase behavior detection device provided by an embodiment of the present application. As shown in Figure 6, the device includes:

The collection module 602 is configured to collect page access data of the user on the ticket purchase page;

The determining module 604 is configured to determine the abnormality of the user's access to the ticket purchase page by analyzing the page access data;

The calculation module 606 is configured to input the access anomaly degree into an access anomaly measurement function corresponding to the ticket purchase dimension to which the ticket purchase page belongs to perform access anomaly calculation;

The detection module 608 is configured to input the page access data into the ticket purchase behavior detection model when the calculated access abnormality measurement value of the ticket purchase dimension is less than the preset measurement threshold value of the ticket purchase dimension. Ticket behavior detection, to obtain the output of the user's ticket purchase behavior detection result.

In an optional embodiment, the determining module 604 includes:

In an optional embodiment, the device for detecting user ticket purchase behavior further includes:

The secondary verification module is configured to jump the ticket purchase page to the verification page in the case that the calculated access abnormality measurement value is greater than or equal to the measurement threshold, and perform the ticket purchase behavior of the user Secondary verification

If the user fails the second verification, run the adding module;

The adding module is configured to add the user to a list of abnormal ticket purchase behaviors;

In the case that the user passes the second verification, the detection module 608 is operated.

In an optional embodiment, the ticket purchase behavior detection model is trained through the following units:

The historical data collection unit is configured to collect historical user access data on the historical page of the ticket purchase page and historical ticket purchase behavior results;

The tag adding unit is configured to add behavior tags to the historical ticket purchase behavior results corresponding to the historical page access data, and use the historical ticket purchase behavior results to which the behavior tags are added and the corresponding historical page access data as training samples;

The training ticket purchase behavior detection model unit is configured to input the training samples into a ticket purchase behavior detection model constructed based on the association relationship between the historical page access data and the historical ticket purchase behavior results for training, to obtain the purchase behavior Ticket behavior detection model.

The ticket purchasing account determining module is configured to determine the ticket purchasing account of the user according to the page access data;

The ticket purchase record detection module is configured to detect the ticket purchase records in the ticket purchase account and determine the number of tickets purchased by the user during the ticket purchase time;

The module for freezing the ticket purchase account is configured to freeze the ticket purchase account when the ticket purchase time is less than a preset time threshold and the number of tickets purchased is greater than the preset number threshold.

In an optional embodiment, the preset measurement threshold of the ticket purchase dimension is determined by the following units:

The historical visit anomaly measurement value unit is configured to obtain the historical visit anomaly measurement value of the historical user in the ticket purchase dimension;

The calculating threshold value unit is configured to calculate an average value of the historical access abnormality measurement value as the preset measurement threshold value of the ticket purchase dimension.

In an optional embodiment, the calculation unit includes:

The first determining sub-module is configured to determine the number of the first node of the ticket purchase node clicked by the user according to the page access data, and determine the number of the ticket purchase node accessed by the user extracted from the behavior chain Number of second nodes;

The calculating access node probability sub-module is configured to calculate the ratio of the number of the first nodes to the number of the second nodes, and determine it as the access node probability of the user;

The second determining submodule is configured to determine the time when the user opens the ticket purchase page and the time when the user pays the ticket purchase amount according to the page access data;

The third determining sub-module is configured to determine the total time for the user to purchase a ticket based on the time when the ticket purchase page is opened and the time when the user pays for the ticket purchase amount, and the user visits the ticket purchase node Total visit time;

The access time probability calculation sub-module is configured to calculate the ratio of the total time to the total access time, and determine it as the access time probability of the user;

The access abnormality determination sub-module is configured to multiply the access node probability and the access time probability, and determine the access abnormality degree according to the product result.

In an optional embodiment, the collection module 602 includes:

The embedded data collection package unit is configured to create a data collection interface on the platform that carries the ticket purchase page by embedding the data collection package on the platform that carries the ticket purchase page;

The calling collection interface unit is configured to collect the page access data by calling the data collection interface.

In an optional embodiment, the determining module 604 includes:

The reading number unit is configured to read page click data, page access time data, and page jump data included in the page access data;

The determining unit is configured to determine, according to the page click data, the number of clicks the user clicks on the ticket purchase page, determine the user’s stay time on the ticket purchase page according to the page access time data, and according to all The page jump data determines the number of jumps of the user on the ticket purchase page;

The product calculating unit is configured to calculate the product of the number of clicks and a preset click weighting factor, the product of the dwell time and the preset time weighting factor, and the number of jumps and the preset time weighting factor. The product of the set jump weight coefficients;

The access abnormality determination unit is configured to sum the product result, and calculate the ratio of the sum result to a preset access abnormality standard value as the access abnormality degree.

The user's ticket purchase behavior detection device provided by the present application analyzes the user's page access data on the ticket purchase page to determine the degree of access abnormality, and realizes the preliminary detection of the user's ticket purchase behavior. In the case that the access abnormality measurement value is less than the measurement threshold value preset in the ticket purchase dimension, the ticket purchase behavior detection model is used to detect the user's ticket purchase behavior again, so that the user can be accurately determined The ticket purchase behavior of the user is detected during the user's ticket purchase process, so that the user's ticket purchase behavior is seamlessly detected, which greatly reduces the user's ticket purchase behavior. The interference of the process optimizes the user’s experience. At the same time, the honeypot mechanism is introduced to prevent and control users who have abnormal ticket purchase behaviors, which can effectively reduce the economic loss of the ticket seller, and can prevent the existence of the ticket purchase page. The vulnerabilities were repaired to prevent other users with abnormal ticket purchase behaviors from using page vulnerabilities to falsely occupy seats.

The foregoing is a schematic solution of a device for detecting a user's ticket purchase behavior in this embodiment. It should be noted that the technical solution of the user ticket purchase behavior detection device belongs to the same concept as the above technical solution of the user ticket purchase behavior detection device method. The details of the technical solution of the user ticket purchase behavior detection device that are not described in detail can be used. See the description of the technical solution of the above-mentioned user ticket purchase behavior detection device method.

Fig. 7 shows a structural block diagram of a computing device 700 provided according to an embodiment of the present application. The components of the computing device 700 include, but are not limited to, a memory 710 and a processor 720. The processor 720 and the memory 710 are connected through a bus 730, and the database 750 is used to store data.

The computing device 700 also includes an access device 740 that enables the computing device 700 to communicate via one or more networks 760. Examples of these networks include a public switched telephone network (PSTN), a local area network (LAN), a wide area network (WAN), a personal area network (PAN), or a combination of communication networks such as the Internet. The access device 740 may include one or more of any type of wired or wireless network interface (for example, a network interface card (NIC)), such as IEEE802.11 wireless local area network (WLAN) wireless interface, global interconnection for microwave access ( Wi-MAX) interface, Ethernet interface, universal serial bus (USB) interface, cellular network interface, Bluetooth interface, near field communication (NFC) interface, etc.

In an embodiment of the present application, the aforementioned components of the computing device 700 and other components not shown in FIG. 7 may also be connected to each other, for example, via a bus. It should be understood that the structural block diagram of the computing device shown in FIG. 7 is only for the purpose of example, and is not intended to limit the scope of the present application. Those skilled in the art can add or replace other components as needed.

The computing device 700 can be any type of stationary or mobile computing device, including a mobile computer or mobile computing device (for example, a tablet computer, a personal digital assistant, a laptop computer, a notebook computer, a netbook, etc.), a mobile phone (for example, a smart phone). ), wearable computing devices (for example, smart watches, smart glasses, etc.) or other types of mobile devices, or stationary computing devices such as desktop computers or PCs. The computing device 700 may also be a mobile or stationary server.

Wherein, the processor 720 is configured to execute the following computer executable instructions:

Collect user access data on the ticket purchase page;

An embodiment of the present application further provides a computer-readable storage medium, which stores computer instructions, which are used when executed by a processor:

Collect user access data on the ticket purchase page;

The foregoing is a schematic solution of a computer-readable storage medium of this embodiment. It should be noted that the technical solution of the storage medium belongs to the same concept as the technical solution of the user ticket purchase behavior detection device method described above. For details that are not described in detail in the technical solution of the storage medium, please refer to the above user ticket purchase behavior detection device. Description of the technical solution of the method.

The specific embodiments of the present application have been described above. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps described in the claims may be performed in a different order than in the embodiments and still achieve desired results. In addition, the processes depicted in the drawings do not necessarily require the specific order or sequential order shown in order to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

The computer instructions include computer program codes, and the computer program codes may be in the form of source code, object code, executable files, or some intermediate forms. The computer-readable medium may include: any entity or device capable of carrying the computer program code, recording medium, U disk, mobile hard disk, magnetic disk, optical disk, computer memory, read-only memory (ROM, Read-Only Memory) , Random Access Memory (RAM, Random Access Memory), electrical carrier signal, telecommunications signal, and software distribution media, etc. It should be noted that the content contained in the computer-readable medium can be appropriately added or deleted according to the requirements of the legislation and patent practice in the jurisdiction. For example, in some jurisdictions, according to the legislation and patent practice, the computer-readable medium Does not include electrical carrier signals and telecommunication signals.

It should be noted that for the foregoing method embodiments, for simplicity of description, they are all expressed as a series of action combinations, but those skilled in the art should know that this application is not limited by the described sequence of actions. Because according to this application, some steps can be performed in other order or at the same time. Secondly, those skilled in the art should also know that the embodiments described in the specification are all preferred embodiments, and the involved actions and modules are not necessarily all required by this application.

In the above-mentioned embodiments, the description of each embodiment has its own focus. For a part that is not described in detail in an embodiment, reference may be made to related descriptions of other embodiments.

The preferred embodiments of the application disclosed above are only used to help explain the application. The optional embodiment does not describe all the details in detail, nor does it limit the invention to only the described specific embodiments. Obviously, many modifications and changes can be made according to the content of this application. This application selects and specifically describes these embodiments in order to better explain the principles and practical applications of this application, so that those skilled in the art can understand and use this application well. This application is only limited by the claims and their full scope and equivalents.

Claims

A method for detecting user ticket purchase behavior, which is characterized in that it includes:

Collect user access data on the ticket purchase page;

By analyzing the page access data, determine the abnormality of the user's access to the ticket purchase page;

Input the access abnormality degree into the access abnormality measurement function corresponding to the ticket purchase dimension to which the ticket purchase page belongs to perform access abnormality calculation;

In the case that the calculated access anomaly measurement value of the ticket purchase dimension is less than the preset measurement threshold of the ticket purchase dimension, the page access data is input into the ticket purchase behavior detection model for ticket purchase behavior detection, and the output is obtained The detection result of the user's ticket purchase behavior.
The method for detecting a user's ticket purchase behavior according to claim 1, wherein the determining the abnormality of the user's access to the ticket purchase page by analyzing the page access data comprises:

Obtain the behavior chain of the user on the ticket purchase page by analyzing the page access data;

Extracting the ticket purchasing node visited by the user and the visit time at the ticket purchasing node in the behavior chain;

The access abnormality degree calculation is performed based on the ticket purchasing node and the access time, and the calculation result is used as the access abnormality degree.
The user ticket purchase behavior detection method according to claim 1, wherein the page access data is input into a ticket purchase behavior detection model for ticket purchase behavior detection, and the output of the user's ticket purchase behavior detection result is obtained After the steps are executed, it also includes:

In the case where the detection result of the ticket purchase behavior is abnormal, adding the user to the list of abnormal users, and using a honeypot mechanism to jump the ticket purchase page to the honeypot ticket purchase page;

Collecting page access data of the user on the honeypot ticket purchase page;

By analyzing the page access data of the user's ticket purchase page on the honeypot, determine the page vulnerability of the ticket purchase page;

Repair the ticket purchase page based on the page vulnerability.
The method for detecting a user's ticket purchase behavior according to claim 1, wherein the step of inputting the access anomaly degree into the access anomaly measurement function corresponding to the ticket purchase dimension to which the ticket purchase page belongs is performed to perform the access anomaly calculation step After that, before the step of inputting the page access data into the ticket buying behavior detection model to perform ticket buying behavior detection, and obtaining the output of the user's ticket buying behavior detection result, the step further includes:

In the case that the calculated access abnormality measurement value is greater than or equal to the measurement threshold, jump the ticket purchase page to a verification page, and perform a second verification on the user's ticket purchase behavior;

In the case that the user fails the secondary verification, adding the user to the list of abnormal ticket purchase behaviors;

In the case that the user passes the secondary verification, the step of inputting the page access data into the ticket purchasing behavior detection model to perform ticket purchasing behavior detection is performed, and the output of the user's ticket purchasing behavior detection result is obtained.
The method for detecting user ticket purchase behavior according to claim 1, wherein the ticket purchase behavior detection model is trained in the following manner:

Collect historical user access data on the historical page of the ticket purchase page and historical ticket purchase behavior results;

Adding behavior tags to the historical ticket purchase behavior results corresponding to the historical page access data, and using the historical ticket purchase behavior results to which the behavior tags are added and the corresponding historical page access data as training samples;

The training samples are input to a ticket buying behavior detection model constructed based on the association relationship between the historical page access data and the historical ticket buying behavior results, and the ticket buying behavior detection model is obtained.
The method for detecting a user's ticket purchase behavior according to claim 1, wherein after the step of collecting user's page access data on the ticket purchase page is executed, the method further comprises:

Determining the ticket purchase account of the user according to the page access data;

Detect the ticket purchase records in the ticket purchase account, and determine the number of tickets purchased by the user during the ticket purchase time;

In a case where the ticket purchase time is less than a preset time threshold and the number of tickets purchased is greater than the preset number threshold, the ticket purchase account is frozen.
The method for detecting a user's ticket purchase behavior according to claim 1, wherein the preset measurement threshold of the ticket purchase dimension is determined in the following manner:

Obtaining historical abnormality measurement values of historical users in the ticket purchase dimension;

Calculate the average value of the historical access abnormality measurement value as the preset measurement threshold value of the ticket purchase dimension.
The method for detecting a user's ticket purchase behavior according to claim 2, wherein the calculating an access abnormality degree based on the ticket purchasing node and the access time, and using the calculation result as the access abnormality degree, comprises:

Determining, according to the page access data, the number of first nodes of the ticket purchasing node clicked by the user, and determining the number of second nodes of the ticket purchasing node accessed by the user extracted from the behavior chain;

Calculate the ratio of the number of the first nodes to the number of the second nodes, and determine it as the node access probability of the user;

Determining, according to the page access data, the time when the user opens the ticket purchase page and the time when the user pays the ticket purchase amount;

Determining the total time for the user to purchase tickets and the total time for the user to visit the ticket purchasing node based on the time when the ticket purchase page is opened and the time when the user pays the amount of the ticket;

Calculate the ratio of the total time to the total access time, and determine it as the access time probability of the user;

The access node probability and the access time probability are multiplied, and the access abnormality degree is determined according to the product result.
The method for detecting a ticket purchase behavior of a user according to claim 1, wherein the collecting the page access data of the user on the ticket purchase page comprises:

By embedding a data collection package on the platform carrying the ticket purchase page, creating a data collection interface on the platform carrying the ticket purchase page;

Collect the page access data by calling the data collection interface.
The method for detecting a user's ticket purchase behavior according to claim 1, wherein the determining the abnormality of the user's access to the ticket purchase page by analyzing the page access data comprises:

Reading page click data, page access time data, and page jump data included in the page access data;

Determine the number of times the user clicks on the ticket purchase page according to the page click data, determine the user’s stay time on the ticket purchase page according to the page access time data, and determine according to the page jump data The number of jumps by the user on the ticket purchase page;

Calculate the product of the number of clicks and the preset click weighting factor, the product of the dwell time and the preset time weighting factor, and the number of jumps and the preset jump weighting factor The product of the two;

The product result is summed, and the ratio between the sum result and the preset access abnormality standard value is calculated as the access abnormality degree.
A user ticket purchase behavior detection device, which is characterized in that it comprises:

The collection module is configured to collect user access data on the ticket purchase page;

The determining module is configured to determine the abnormality of the user's access to the ticket purchase page by analyzing the page access data;

A calculation module configured to input the access anomaly degree into an access anomaly measurement function corresponding to the ticket purchase dimension to which the ticket purchase page belongs to perform access anomaly calculation;

The detection module is configured to input the page access data into the ticket purchase behavior detection model to purchase tickets when the calculated access anomaly measurement value of the ticket purchase dimension is less than the preset measurement threshold of the ticket purchase dimension. Behavior detection, to obtain the output detection result of the user's ticket purchase behavior.
The device for detecting user ticket purchase behavior according to claim 11, wherein the determining module comprises:

The parsing unit is configured to obtain the behavior chain of the user on the ticket purchase page by parsing the page access data;

An extracting unit configured to extract, from the behavior chain, the ticket purchasing node visited by the user and the visit time at the ticket purchasing node;

The calculation unit is configured to perform an access abnormality calculation based on the ticket purchasing node and the access time, and use the calculation result as the access abnormality.
The device for detecting a user's ticket purchase behavior according to claim 11, further comprising:

The jump module is configured to add the user to the list of abnormal users when the detection result of the ticket purchase behavior is abnormal, and use the honeypot mechanism to jump the ticket purchase page to the honeypot purchase ticket page;

A page access data collection module configured to collect page access data of the user on the honeypot ticket purchase page;

The page vulnerability determining module is configured to determine the page vulnerability of the ticket purchase page by analyzing the page access data of the user on the honeypot ticket purchase page;

The repair module is configured to repair the ticket purchase page based on the page vulnerability.
A computing device, characterized in that it comprises:

Memory and processor;

The memory is used to store computer-executable instructions, and the processor is used to execute the computer-executable instructions:

Collect user access data on the ticket purchase page;

By analyzing the page access data, determine the abnormality of the user's access to the ticket purchase page;

Input the access abnormality degree into the access abnormality measurement function corresponding to the ticket purchase dimension to which the ticket purchase page belongs to perform access abnormality calculation;

In the case that the calculated access anomaly measurement value of the ticket purchase dimension is less than the preset measurement threshold of the ticket purchase dimension, the page access data is input into the ticket purchase behavior detection model for ticket purchase behavior detection, and the output is obtained The detection result of the user's ticket purchase behavior.
A computer-readable storage medium storing computer instructions, characterized in that, when the instructions are executed by a processor, the steps of the method for detecting a user's ticket purchase behavior according to any one of claims 1 to 10 are realized.