Traffic detection method and system based on interaction strategy, storage medium and electronic equipment

Abstract

The invention discloses a traffic detection method and system based on an interaction strategy, a storage medium and electronic equipment, and the detection method comprises the steps: a preprocessing step: obtaining return log information of touring contacts of all users, and preprocessing a traffic log of the return log information; a feature acquisition step: extracting a single-dimensional data feature from the preprocessed traffic log and receiving a multi-dimensional data feature; a flow test step: obtaining a flow prediction result through a trained isolated forest model according to the single-dimensional data features and the multi-dimensional data features; and a comparison step: comparing and identifying the traffic prediction result with the abnormal traffic identified by adopting the initialization rule to obtain the abnormal traffic. According to the weak supervision advertisement anti-fraud method based on the interaction strategy, in the abnormal traffic detection process, the cost brought by rule changes can be effectively reduced, and the interpretability and the recognition performance of an abnormal traffic model are improved.

Description

technical field

[0001] The invention belongs to the field of flow detection based on interaction strategy, and in particular relates to flow detection, system, storage medium and electronic equipment based on interaction strategy. Background technique

[0002] With the development of Internet finance in recent years, various types of terminal products emerge in an endless stream, and the marketing and advertising business continues to develop. Driven by their interests, a large number of fraudsters forge information, maliciously register a large number of false accounts, gang packaging, etc., and fraudulent techniques are becoming more and more common. The smarter it is, the lower the cost. Advertisement traffic is often faced with mass attacks from illegal production. This attack penetrates into every link of the business link, such as exposure, clicks, false conversions, malicious conversions, etc., posing a huge threat to the sound development of the advertising business ...

Examples

Embodiment 1

[0052] Please refer to figure 1 , figure 1 is a flow chart of the traffic detection method based on the interaction strategy. Such as figure 1 As shown, the traffic detection method based on interaction strategy of the present invention includes:

[0053] Preprocessing step S1: Obtain the returned log information of each user's tour contact point, and perform preprocessing on the traffic log of the returned log information;

[0054] Feature acquisition step S2: extracting single-dimensional data features and receiving multi-dimensional data features from the preprocessed traffic log;

[0055] Traffic testing step S3: Obtain a traffic prediction result through the trained isolation forest model according to the single-dimensional data feature and the multi-dimensional data feature;

[0056] Comparing step S4: comparing and identifying the traffic prediction result with the abnormal traffic identified by the initialization rule to obtain the abnormal traffic;

[0057] Sorti...

Embodiment 2

[0078] Please refer to Figure 6 , Figure 6 It is a schematic structural diagram of the traffic detection system based on the interaction strategy of the present invention.

[0079] Such as Figure 6 A flow detection system based on an interaction policy of the present invention is shown, which includes:

[0080] A preprocessing module, the preprocessing module obtains the return log information of each user's tour contact point, and performs preprocessing on the traffic log of the return log information;

[0081] A feature acquisition module, the feature acquisition module extracts single-dimensional data features and receives multi-dimensional data features from the preprocessed traffic logs;

[0082] A flow test module, the flow test module obtains a flow prediction result through a trained isolated forest model according to the single-dimensional data feature and the multi-dimensional data feature;

[0083] A comparison module, the comparison module compares the traff...

Embodiment 3

[0087] combine Figure 7 As shown, this embodiment discloses a specific implementation manner of an electronic device. The electronic device may include a processor 81 and a memory 82 storing computer program instructions.

[0088] Specifically, the processor 81 may include a central processing unit (CPU), or an Application Specific Integrated Circuit (ASIC for short), or may be configured to implement one or more integrated circuits in the embodiments of the present application.

[0089]Among them, the memory 82 may include mass storage for data or instructions. For example without limitation, the memory 82 may include a hard disk drive (Hard Disk Drive, referred to as HDD), a floppy disk drive, a solid state drive (SolidState Drive, referred to as SSD), flash memory, optical disk, magneto-optical disk, magnetic tape or universal serial bus (Universal Serial Bus, referred to as USB) drive or a combination of two or more of the above. Storage 82 may comprise removable or no...

technical field

[0001] The invention belongs to the field of flow detection based on interaction strategy, and in particular relates to flow detection, system, storage medium and electronic equipment based on interaction strategy. Background technique

[0002] With the development of Internet finance in recent years, various types of terminal products emerge in an endless stream, and the marketing and advertising business continues to develop. Driven by their interests, a large number of fraudsters forge information, maliciously register a large number of false accounts, gang packaging, etc., and fraudulent techniques are becoming more and more common. The smarter it is, the lower the cost. Advertisement traffic is often faced with mass attacks from illegal production. This attack penetrates into every link of the business link, such as exposure, clicks, false conversions, malicious conversions, etc., posing a huge threat to the sound development of the advertising business ...

Examples

Embodiment 1

[0052] Please refer to figure 1 , figure 1 is a flow chart of the traffic detection method based on the interaction strategy. Such as figure 1 As shown, the traffic detection method based on interaction strategy of the present invention includes:

[0053] Preprocessing step S1: Obtain the returned log information of each user's tour contact point, and perform preprocessing on the traffic log of the returned log information;

[0054] Feature acquisition step S2: extracting single-dimensional data features and receiving multi-dimensional data features from the preprocessed traffic log;

[0055] Traffic testing step S3: Obtain a traffic prediction result through the trained isolation forest model according to the single-dimensional data feature and the multi-dimensional data feature;

[0056] Comparing step S4: comparing and identifying the traffic prediction result with the abnormal traffic identified by the initialization rule to obtain the abnormal traffic;

[0057] Sorti...

Embodiment 2

[0078] Please refer to Figure 6 , Figure 6 It is a schematic structural diagram of the traffic detection system based on the interaction strategy of the present invention.

[0079] Such as Figure 6 A flow detection system based on an interaction policy of the present invention is shown, which includes:

[0080] A preprocessing module, the preprocessing module obtains the return log information of each user's tour contact point, and performs preprocessing on the traffic log of the return log information;

[0081] A feature acquisition module, the feature acquisition module extracts single-dimensional data features and receives multi-dimensional data features from the preprocessed traffic logs;

[0082] A flow test module, the flow test module obtains a flow prediction result through a trained isolated forest model according to the single-dimensional data feature and the multi-dimensional data feature;

[0083] A comparison module, the comparison module compares the traff...

Embodiment 3

[0087] combine Figure 7 As shown, this embodiment discloses a specific implementation manner of an electronic device. The electronic device may include a processor 81 and a memory 82 storing computer program instructions.

[0088] Specifically, the processor 81 may include a central processing unit (CPU), or an Application Specific Integrated Circuit (ASIC for short), or may be configured to implement one or more integrated circuits in the embodiments of the present application.

[0089]Among them, the memory 82 may include mass storage for data or instructions. For example without limitation, the memory 82 may include a hard disk drive (Hard Disk Drive, referred to as HDD), a floppy disk drive, a solid state drive (SolidState Drive, referred to as SSD), flash memory, optical disk, magneto-optical disk, magnetic tape or universal serial bus (Universal Serial Bus, referred to as USB) drive or a combination of two or more of the above. Storage 82 may comprise removable or no...

Images