Difference calculation method and system for network behavior characteristics

Abstract

The invention provides a difference calculation method and system for network behavior characteristics and relates to the technical field of network data processing. The method comprises the following steps of continuously obtaining characteristic information of network behaviors of a user; storing characteristic information within a time period which is closest to the current moment into a first database; pulling the characteristic information within a fixed time period and carrying out aggregation calculation according to different dimensions, and accumulating a result and a statistical value of a last time period node to obtain a statistical value of a current time period node and storing the statistical value into a second database; and after receiving a query request, reading the statistical values of the two time period nodes in the second database according to a time window and subtracting to obtain a difference, and merging the difference and the read characteristic information of the first database to obtain a characteristic index that needs to be queried. Through adoption of the method, indexes of various dimensions can be counted flexibly, quickly and accurately, and the requirements for on-line real-time calculation of a high amount of concurrent scenes can be almost met.

Description

technical field [0001] The invention relates to the technical field of network data processing, in particular to a method for calculating the difference of network behavior characteristics and a system for calculating the difference of network behavior characteristics. Background technique [0002] In the risk control system, in order to evaluate the risk, it is often necessary to collect statistics on the characteristics of user behavior, calculate the characteristic indicators of user behavior, and use this to evaluate the risk. When performing statistics on user behavior characteristics, it is usually necessary to calculate the number of occurrences of a certain dimension of user network behavior in a specific period of time in the past, the correlation relationship, the change trend, etc. connected protocol) login times, the number of user accounts associated with a certain device ID (DeviceID, device unique identifier) ​​in the past 3 days, etc., are used as an importan...

AI Technical Summary

Problems solved by technology

[0007] In the process of applying the above scheme, the inventor found that there are two problems in the first scheme. One is that if each field needs to be indexed, it will have a great impact on the writing performance. There are many possibilities for inputting, and it is impossible to exhaustively enumerate when creating a database table. The cost of adding new fields after building a table is also very high, so the flexibility when calculating user behavior characteristics is poor.

Even if the fields are determined, statistics are performed in the database according to the query conditions each time the calculation is performed. In the case of a relatively large amount of data, the performance will reach the second level, which cannot meet the real-time requirements.

The problem with the second solution is that when encountering abnormal network behaviors such as fraud and cheating, one of the characteristics of the network behavior is high concurrency and a large amount of data. Large and often timed out, if the number of data is limited, the calculation will be inaccurate

The third method also has problems. It will be time-consuming when the lookback window is extremely long or the amount of data is extremely large, and it cannot meet the requirements of online real-time performance.

Images