A differential computing method and system for network behavior characteristics

Abstract

The invention provides a method for calculating the difference of network behavior characteristics, and relates to the technical field of network data processing. The method includes: continuously acquiring characteristic information of user network behavior; storing characteristic information within a time period nearest to the current moment in the first database; timing a time period to pull characteristic information and aggregate calculation according to different dimensions, and combining the results with The statistical value of the node in the previous time period is accumulated to obtain the statistical value of the node in the current time period and stored in the second database; after receiving the query request, the statistical value of the two time period nodes in the second database is read according to the time window and stored in the second database. The difference is obtained by subtraction, and the difference is combined with the read characteristic information of the first database to obtain the characteristic index to be queried. Using this method can not only flexibly, quickly and accurately count indicators of various dimensions, but also almost meet the requirements of online real-time computing in high-volume concurrent scenarios.

Description

technical field [0001] The invention relates to the technical field of network data processing, in particular to a method for calculating the difference of network behavior characteristics and a system for calculating the difference of network behavior characteristics. Background technique [0002] In the risk control system, in order to evaluate the risk, it is often necessary to collect statistics on the characteristics of user behavior, calculate the characteristic indicators of user behavior, and use this to evaluate the risk. When performing statistics on user behavior characteristics, it is usually necessary to calculate the number of occurrences of a certain dimension of user network behavior in a specific period of time in the past, the correlation relationship, the change trend, etc. connected protocol) login times, the number of user accounts associated with a certain device ID (DeviceID, device unique identifier) ​​in the past 3 days, etc., are used as an importan...

AI Technical Summary

Problems solved by technology

[0007] In the process of applying the above scheme, the inventor found that there are two problems in the first scheme. One is that if each field needs to be indexed, it will have a great impact on the writing performance. There are many possibilities for inputting, and it is impossible to exhaustively enumerate when creating a database table. The cost of adding new fields after building a table is also very high, so the flexibility when calculating user behavior characteristics is poor.

Even if the fields are determined, statistics are performed in the database according to the query conditions each time the calculation is performed. In the case of a relatively large amount of data, the performance will reach the second level, which cannot meet the real-time requirements.

The problem with the second solution is that when encountering abnormal network behaviors such as fraud and cheating, one of the characteristics of the network behavior is high concurrency and a large amount of data. Large and often timed out, if the number of data is limited, the calculation will be inaccurate

The third method also has problems. It will be time-consuming when the lookback window is extremely long or the amount of data is extremely large, and it cannot meet the requirements of online real-time performance.

Images