Method and apparatus for processing traffic data, and computer readable storage medium
By encoding traffic data into feature vectors and clustering them using a neural network model, the challenge of user identification and behavior analysis in massive traffic data is solved, achieving efficient and accurate user behavior identification and classification.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- TENCENT TECHNOLOGY (SHENZHEN) CO LTD
- Filing Date
- 2021-02-23
- Publication Date
- 2026-05-22
Smart Images
Figure CN113592522B_ABST
Abstract
Description
Technical Field
[0001] This disclosure relates to the field of artificial intelligence services, and more specifically to methods and apparatus for processing traffic data, and computer-readable storage media. Background Technology
[0002] With the rapid development of network technology, Web services have been widely used in network services. For some network services, the traffic data from the entire network may reach trillions.
[0003] Identifying / tracking objects (e.g., users or terminals initiating traffic) from massive amounts of traffic data is extremely difficult. For example, user traffic data is collected at the network layer, so users are often identified based on their IP addresses. However, the same user may use different IP addresses at different times, or the same IP address may be shared by multiple users; therefore, identifying users based on IP addresses is often unreliable. As another example, a user may also have various accounts (e.g., QQ number, WeChat account, video website membership account, etc.), so identifying users solely based on their account information is also unreliable.
[0004] Furthermore, identifying user behavior (e.g., user preferences, interests) from massive amounts of traffic data is extremely difficult. For example, a user may access the addresses of multiple network services, and the host (service address) and CGI (generic gateway interface) fields of different network services often have different formats and lengths. Moreover, for CGI, the CGI accessed by the user often contains numbers and resource IDs. This results in an excessively large feature space and too much noise in the traffic data, especially the CGI field data, making it very difficult to identify user behavior.
[0005] Therefore, there is a need to improve existing technologies to provide a method for automatically and efficiently identifying users and user behaviors from massive amounts of traffic data, and for classifying and displaying user behaviors. It should be noted that the information disclosed in the background section above is only for enhancing the understanding of the background of this disclosure, and therefore may include information that does not constitute prior art known to those skilled in the art. Summary of the Invention
[0006] Embodiments of this disclosure provide a method and apparatus for processing traffic data, and a computer-readable storage medium.
[0007] Embodiments of this disclosure provide a method for processing traffic data, comprising: acquiring traffic data for accessing network services; extracting object identification parameters from the values of fields related to object identification and extracting object access behavior parameters from the values of fields related to object access behavior based on the traffic data; determining an object identifier corresponding to the object access behavior parameters based on object login data and the object identification parameters; constructing an object access behavior sequence, the object access behavior sequence including the object identifier and object access behavior parameters corresponding to the object identifier and arranged in chronological order; and encoding the object access behavior sequence into an object access behavior feature vector.
[0008] Embodiments of this disclosure also provide an apparatus for processing object traffic data, including: a processor; and a memory, wherein the memory stores a computer-executable program that, when executed by the processor, performs the method described above.
[0009] Embodiments of this disclosure also provide a computer-readable storage medium having computer instructions stored thereon, which, when executed by a processor, implement the method described above.
[0010] According to another aspect of this disclosure, a computer program product or computer program is provided, comprising computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable medium and executes the computer instructions, causing the computer device to perform the methods provided in the foregoing aspects or various alternative implementations of the foregoing aspects.
[0011] Embodiments of this disclosure also provide an apparatus for processing traffic data. The apparatus for processing traffic data includes: a data acquisition module configured to: acquire traffic data related to accessing network services; an object identifier mapping module configured to: extract object identification parameters from the values of fields related to object identification based on the traffic data, and extract object access behavior parameters from the values of fields related to object access behavior; and determine an object identifier corresponding to the object access behavior parameters based on object login data and the object identification parameters.
[0012] For example, the device for processing traffic data further includes an embedding generation module configured to construct an object access behavior sequence, the object access behavior sequence including an object identifier and object access behavior parameters corresponding to the object identifier and arranged in chronological order; and to encode the object access behavior sequence into an object access behavior feature vector.
[0013] For example, the device for processing traffic data further includes a data mart module configured to cluster the object access behavior feature vector to generate cluster labels for the object access behavior; and to generate recommendation information or classification information associated with the object identifier based on the cluster labels.
[0014] For example, the device for processing traffic data also includes a data display module, configured to reduce the dimensionality of the object access behavior feature vector into a two-dimensional vector, and draw an object behavior display interface based on the two-dimensional vector, wherein similar object access behavior feature vectors are close in distance in the object behavior display interface.
[0015] This disclosure provides a method for processing network traffic. This method utilizes a neural network model (e.g., the word2vec model) to encode object access behavior into object access behavior feature vectors (e.g., embedding vectors). This disclosure reduces the workload of manually extracting and parsing traffic data, automatically encodes object access behavior into vectors, and has good generalization ability. This disclosure can be applied to services such as advertising recommendations to achieve object-level advertising recommendations.
[0016] The embodiments of this disclosure can cluster object access behavior feature vectors into category labels through unsupervised clustering, which has better generalization ability than directly using the values of each field of traffic data and can produce more robust prediction results. Attached Figure Description
[0017] To more clearly illustrate the technical solutions of the embodiments of this disclosure, the accompanying drawings used in the description of the embodiments will be briefly introduced below. The accompanying drawings in the following description are merely exemplary embodiments of this disclosure.
[0018] Figure 1 This is an example schematic diagram illustrating a scenario in which multiple objects access network services according to embodiments of the present disclosure.
[0019] Figure 2A This is a flowchart illustrating a method for processing traffic data according to an embodiment of the present disclosure.
[0020] Figure 2B This is a schematic diagram illustrating a traffic data according to an embodiment of the present disclosure.
[0021] Figure 2C This is a schematic diagram illustrating object login data and object identification parameters according to an embodiment of the present disclosure.
[0022] Figure 3 This is a schematic diagram illustrating the acquisition of object identification parameters and object access behavior parameters according to embodiments of the present disclosure.
[0023] Figure 4A This is a schematic diagram illustrating a word vector conversion model according to an embodiment of the present disclosure.
[0024] Figure 4B This is a schematic diagram illustrating the objective function according to an embodiment of the present disclosure.
[0025] Figure 4C The hierarchical normalization process according to an embodiment of this disclosure is illustrated.
[0026] Figure 5 An apparatus for processing traffic data according to an embodiment of the present disclosure is shown.
[0027] Figure 6 A schematic diagram of an electronic device according to an embodiment of the present disclosure is shown.
[0028] Figure 7 A schematic diagram of the architecture of an exemplary computing device according to an embodiment of the present disclosure is shown.
[0029] Figure 8 A schematic diagram of a storage medium according to an embodiment of the present disclosure is shown. Detailed Implementation
[0030] To make the objectives, technical solutions, and advantages of this disclosure more apparent, exemplary embodiments according to this disclosure will now be described in detail with reference to the accompanying drawings. Obviously, the described embodiments are merely some embodiments of this disclosure, and not all embodiments of this disclosure. It should be understood that this disclosure is not limited to the exemplary embodiments described herein.
[0031] In this specification and accompanying drawings, steps and elements that are substantially the same or similar are indicated by the same or similar reference numerals, and repeated descriptions of these steps and elements are omitted. Furthermore, in the description of this disclosure, the terms "first," "second," etc., are used only to distinguish descriptions and should not be construed as indicating or implying relative importance or order.
[0032] To facilitate the description of this disclosure, the following concepts related to this disclosure are introduced.
[0033] The word vector conversion models (e.g., word2vec models) involved in the embodiments of this disclosure can be based on artificial intelligence (AI). Artificial intelligence is a theory, method, technology, and application system that uses digital computers or machines controlled by digital computers to simulate, extend, and expand human intelligence, perceive the environment, acquire knowledge, and use that knowledge to obtain optimal results. In other words, artificial intelligence is a comprehensive technology of computer science that attempts to understand the essence of intelligence and produce a new kind of intelligent machine that can react in a way similar to human intelligence. For example, the word vector conversion model of this disclosure can read and understand traffic data in a manner similar to humans, and discover specific access behaviors of objects (e.g., users). By studying the design principles and implementation methods of various intelligent machines, artificial intelligence enables the word vector conversion model of this disclosure to have the function of identifying objects and their access behaviors from traffic data.
[0034] Artificial intelligence technology encompasses a wide range of fields, including both hardware and software technologies. Among these, AI software technologies primarily include computer vision, natural language processing, and machine learning / deep learning.
[0035] Optionally, the word vector conversion model in this disclosure employs Natural Language Processing (NLP) technology. NLP is an important field in computer science and artificial intelligence, encompassing various theories and methods for effective communication between humans and computers using natural language. NLP is a science integrating linguistics, computer science, and mathematics. Therefore, based on NLP technology, the word vector conversion model of this disclosure can analyze massive amounts of traffic data to obtain features of object access behavior (e.g., user access behavior).
[0036] Optionally, the natural language processing techniques employed in the embodiments of this disclosure can also be based on machine learning (ML) and deep learning. Machine learning is a multidisciplinary field involving probability theory, statistics, approximation theory, convex analysis, algorithm complexity theory, and many other disciplines. Natural language processing technology utilizes machine learning to study how computers can simulate or implement human language learning behavior. It acquires new knowledge or skills by analyzing existing, classified text data and reorganizes existing knowledge structures to continuously improve its performance. Machine learning and deep learning typically include techniques such as artificial neural networks, belief networks, reinforcement learning, transfer learning, and inductive learning.
[0037] Optionally, the word vector conversion models used in embodiments of this disclosure as described below can all be artificial intelligence models, especially artificial intelligence-based neural network models. Typically, artificial intelligence-based neural network models are implemented as acyclic graphs, where neurons are arranged in different layers. Generally, a neural network model includes an input layer and an output layer, separated by at least one hidden layer. The hidden layer transforms the input received by the input layer into a representation useful for generating the output in the output layer. Network nodes are fully connected to nodes in adjacent layers via edges, and there are no edges between nodes within each layer. Data received at nodes in the input layer of the neural network is propagated to nodes in the output layer via any of the hidden layers, activation layers, pooling layers, convolutional layers, etc. The input and output of the neural network model can take various forms, and this disclosure does not limit this.
[0038] The solutions provided in the embodiments of this disclosure involve technologies such as artificial intelligence, natural language processing, and machine learning, which are specifically illustrated through the following embodiments.
[0039] The word vector conversion model of this disclosure can be integrated into an electronic device, such as a terminal or a server. For example, the word vector conversion model can be integrated into a terminal. The terminal can be a mobile phone, tablet computer, laptop computer, desktop computer, personal computer (PC), smart speaker, or smartwatch, but is not limited to these. In this case, the terminal acts as a traffic data analysis node to process and analyze the traffic data flowing through the terminal in a hierarchical manner.
[0040] For example, the word vector conversion model of the embodiments of this disclosure can be integrated into a server. The server can be a standalone physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, content delivery networks (CDNs), and big data and artificial intelligence platforms. The terminal and the server can be connected directly or indirectly through wired or wireless communication, and this disclosure does not impose any limitations.
[0041] It is understood that the apparatus for reasoning using the word vector conversion model of the embodiments of this disclosure can be a terminal, a server, or a system composed of a terminal and a server.
[0042] It is understood that the training method of the word vector conversion model in the embodiments of this disclosure can be executed on a terminal, on a server, or jointly by a terminal and a server.
[0043] The word vector conversion model provided in this disclosure can also relate to artificial intelligence cloud services in the field of cloud technology. Cloud technology refers to a hosting technology that unifies hardware, software, network, and other resources within a wide area network (WAN) or local area network (LAN) to achieve data computation, storage, processing, and sharing. Cloud technology is a general term for network technology, information technology, integration technology, management platform technology, and application technology applied based on the cloud computing business model. It can form resource pools, be used on demand, and is flexible and convenient. Cloud computing technology will become an important support. The backend services of technical network systems require a large amount of computing and storage resources, such as video websites, image websites, and many portal websites. With the rapid development and application of the internet industry, every item may have its own identification mark in the future, all of which need to be transmitted to the backend system for logical processing. Data of different levels will be processed separately, and various industry data will all require strong system support, which can only be achieved through cloud computing.
[0044] Artificial intelligence cloud services are generally referred to as AIaaS (AI as a Service). This is currently a mainstream service model for artificial intelligence platforms. Specifically, AIaaS platforms break down several common AI services and provide them as independent or packaged services in the cloud. This service model is similar to opening an AI-themed marketplace: all developers can access and use one or more AI services provided by the platform through application programming interfaces (APIs). Some experienced developers can also use the AI frameworks and AI infrastructure provided by the platform to deploy and maintain developer-specific cloud AI services.
[0045] Figure 1 This is an example schematic diagram illustrating a scenario 100 in which multiple users access network services according to an embodiment of the present disclosure.
[0046] Currently, multiple cloud services are hosted on the same cloud service operation and analysis platform. Some large-scale network service providers can offer services such as... Figure 1 The cloud network service operation and analysis platform shown provides services such as email, video, music, shopping, photo storage and processing, and chat.
[0047] For high-traffic network platforms, the amount of traffic data collected is often enormous, making manual extraction and parsing of this massive amount of data virtually impossible. Traffic data (e.g., HTTP packets) includes multiple fields, some of which may be irrelevant to object identification (e.g., user identification) and object access behavior (e.g., user access behavior) analysis. Furthermore, a single traffic data point may possess an excessive feature space, leading to significant parsing difficulties.
[0048] The following example uses a user as the object for illustration; however, those skilled in the art should understand that objects that can be identified based on traffic data include, but are not limited to, users, as well as any other objects that may be identified based on traffic data (e.g., user terminal devices, applications that initiate traffic, etc.).
[0049] For example, the same user may use different devices to access network services, such as Figure 1 As shown, the user may use devices such as mobile terminals, laptops, and tablets to access different network services. These devices often have different device identifiers and different IP addresses. Cloud network service operation and analysis platforms can only obtain the IP address of the initiating access device from traffic data (e.g., HTTP packets). Therefore, cloud network service operation and analysis platforms often identify this traffic data as different users accessing network services, thus making subsequent user access behavior analysis difficult.
[0050] For example, multiple users may use the same device to access network services. Such devices may be public devices, such as computers in an internet cafe. In this case, the same IP address is shared by multiple users. Therefore, cloud network service operation and analysis platforms often identify traffic data initiated by different users as the same user accessing network services, thus creating difficulties for subsequent user access behavior analysis.
[0051] For example, a single user may have various accounts (e.g., QQ number, WeChat account, video website membership account, etc.). This user may use different accounts to access different network services provided on the same cloud network service operation and analysis platform. Therefore, identifying a user solely based on their account is unreliable.
[0052] Therefore, existing technologies need to be improved to provide a method for automatically and efficiently identifying objects and their behaviors from massive amounts of traffic data, and for classifying and displaying these behaviors.
[0053] Based on this, this disclosure provides a method for processing traffic data. This method utilizes a neural network model (e.g., a word2vec model) to encode object access behavior into object access behavior feature vectors (e.g., embedding vectors). This significantly reduces the amount of data required to identify objects and analyze their behavior from traffic data. Embodiments of this disclosure can reduce the workload of manually extracting and parsing traffic data, automatically encode object access behavior into vectors, and have good generalization capabilities. Embodiments of this disclosure can be applied to services such as advertising recommendations to achieve object-level advertising recommendations.
[0054] The embodiments of this disclosure can cluster object access behavior feature vectors into category labels through unsupervised clustering, which has better generalization ability than directly using the values of each field of traffic data and can produce more robust prediction results.
[0055] Figure 2A This is a flowchart illustrating a method 200 for processing traffic data according to an embodiment of the present disclosure. Figure 2B This is a schematic diagram illustrating a traffic data according to an embodiment of the present disclosure. Figure 2C This is a schematic diagram illustrating object login data and object identification parameters according to an embodiment of the present disclosure.
[0056] See Figure 2A In step S201, traffic data for accessing network services is obtained.
[0057] like Figure 2B As shown, a user sends an access request (e.g., a network request based on Hypertext Transfer Protocol (HTTP) or Hypertext Transfer Protocol over Secure Socket Layer (HTTPS)) to the cloud network service operation and analysis platform to access the network service. The cloud network service operation and analysis platform then collects a single traffic data point. For high-traffic network platforms, this often results in the collection of massive amounts of traffic data. This network data originates from the entire network and is therefore referred to as traffic data.
[0058] In step S202, based on the traffic data, object identification parameters are extracted from the values of fields related to object identification, and object access behavior parameters are extracted from the values of fields related to object access behavior.
[0059] by Figure 2BTaking the HTTP access request shown as an example, an HTTP access request includes multiple fields: request header fields, CGI (Common Gateway Interface) fields, GET parameter fields, POST parameter fields, request method fields, UA (User Agent) fields, referer fields, cookie fields, DATE fields, Client-IP (client IP address) fields, etc. Those skilled in the art should understand that... Figure 2B The fields shown are merely examples, and HTTP access requests may include more or fewer fields, which is not a limitation of this disclosure.
[0060] Fields related to object identification help identify the identity of an object (such as a user). Among the aforementioned fields, those related to object identification include, for example, the Client-IP field, the UA field, and the DATE field. Assuming the Client-IP field has a value of 1.0.1, the UA field has a value of Mozilla / 4.0, and the DATE field has a value of Wed, 03 Feb 2021 02:39:19 GMT, then the cloud network service operation and analysis platform can determine that at 02:39:19 Beijing time on February 3, 2021, an object requested access to the network service with an IP address of 1.0.1, and that the object was using a browser version of Mozilla / 4.0. Those skilled in the art should understand that the Client-IP field, UA field, and DATE field are merely examples, and the fields related to object identification may include more or fewer fields; this disclosure does not impose any limitations on this.
[0061] Fields related to object access behavior help identify the behavior of an object. Among the fields mentioned above, those related to object access behavior include, for example, the Host field, the CGI field, and the referer field.
[0062] For example, the URL (Uniform Resource Locator) in an HTTP access request is composed of HOST and CGI. Figure 2B The URL shown is http: / / www.test.com / cgi-bin / hello.py. The value of the Public Gateway Interface (CGI) field is / cgi-bin / hello.py, and the value of the HOST field (hereinafter referred to as the site field) is http: / / www.test.com. The referer field includes a URL indicating that the object accesses the currently requested page from the page represented by that URL.
[0063] Assuming the Host field has the value http: / / www.test.com, the CGI field has the value / cgi-bin / hello.py, and the referer field has the value http: / / localhost:8088 / user / register.html, the cloud network service operation and analysis platform can determine that an object is attempting to access http: / / www.test.com from the link http: / / localhost:8088 / user / register.html and expects the server to execute the hello.py script located in the server's cgi-bin folder. Those skilled in the art should understand that the Host, CGI, and referer fields are merely examples, and the fields related to object access behavior may include more or fewer fields; this disclosure does not impose any limitations on this.
[0064] Therefore, the cloud network service operation and analysis platform extracts the values of fields related to object identification from the traffic data as object identification parameters, and extracts the values of fields related to object access behavior as object access behavior parameters, thereby reducing the amount of data to be analyzed in the traffic data.
[0065] Optionally, to further reduce the amount of traffic data analyzed, the traffic data can be filtered. For example, a cloud network service operation and analysis platform can filter the traffic data based on the importance of the site field values. Then, a portion of the filtered traffic data is sampled according to predetermined rules, and the values of fields related to object access behavior are extracted from the sampled traffic data as object access behavior parameters. The predetermined rules, for example, are random sampling, which can increase the robustness of the selected traffic data.
[0066] Optionally, to further reduce the amount of data analyzed in traffic analysis, further processing can be performed on multiple object access behavior parameters. For example, normalizing the values of CGI fields, etc. This will be discussed later. Figure 3 The method for reducing the amount of traffic data involved in extracting the values of fields related to object identification and the values of fields related to object access behavior will not be elaborated further in this disclosure.
[0067] In step S203, based on the object login data and the object identification parameters, the object identifier corresponding to the object access behavior parameters is determined.
[0068] by Figure 2CFor example, object login data includes at least one of the following: object login log, object login Internet Protocol address, object login object account, object login device identifier, and object login time. Those skilled in the art should understand that the above data is merely an example, and object login data may include more or less data; this disclosure does not impose any limitations on this.
[0069] For example, an object identifier can be used to uniquely identify an object. Determining the object identifier corresponding to the object access behavior parameter based on the object login data and the object identification parameters further includes: determining the object identifier corresponding to the object access behavior parameter based on the constraints imposed by the object login data on the object identification parameters.
[0070] The following is for reference Figure 2C Briefly describe an example of determining the object identifier corresponding to an object access behavior parameter by using object login data and object identification parameters.
[0071] like Figure 2C As shown, assume there are two related object logs (e.g., user logs) on the server. The first object log is related to user X and indicates: login time is Wed, 03 Feb, 2021 01:39:19 GMT; login duration is 2 hours; login IP address is 1.0.1; login account is Xiaoxi; login device is mobile phone 230. Therefore, it can be determined that the first object log has the following constraints on object identification parameters (e.g., assuming object identification parameters only include Client-IP, UA, and DATE): the time of initiating this traffic data must be between Wed, 03 Feb, 2021 01:39:19 GMT and Wed, 03 Feb, 2021 03:39:19 GMT; and the login IP address is 1.0.1.
[0072] The second object log entry is related to user Y and indicates: login time is Mon, 01 Feb 2021 02:39:19 GMT; login duration is 2 hours; login IP address is 1.0.1; login account is Dahai; login device is mobile phone 230. Therefore, it can be determined that the second object log entry imposes the following constraints on the object identification parameters (e.g., assuming the object identification parameters only include Client-IP, UA, and DATE): the time of initiating this traffic data must be between Mon, 01 Feb 2021 02:39:19 GMT and Mon, 01 Feb 2021 04:39:19 GMT; and the login IP address is 1.0.1.
[0073] Based on the object identification parameters (e.g., Client-IP is 1.0.1, UA is Mozilla / 4.0, DATE: Wed, 03 Feb 2021 02:39:19 GMT), it can be determined that the object identification parameters of this traffic data correspond to the first object log. That is, this traffic data corresponds to the object identifier of object X.
[0074] Furthermore, various methods can be used to determine the object identifier corresponding to the object access behavior parameters based on object login data and the object identification parameters. For example, a neural network model can be used to determine the object identifier based on object login data and object identification parameters. In some embodiments, the user account / user account-associated object ID can also be directly used as the object identifier to reduce computational costs.
[0075] In step S204, an object access behavior sequence is constructed, which includes an object identifier and object access behavior parameters corresponding to the object identifier and arranged in chronological order.
[0076] The sequence of object access behavior is in the following format: [object identifier, object access behavior parameter-1, object access behavior parameter-2, object access behavior parameter-3...], where the object access behavior parameters are arranged in time.
[0077] See Table 1 below, which shows some examples of the constructed object access behavior sequences.
[0078]
[0079] In the example in Table 1, the object access behavior parameter is the normalized value of the CGI field. Those skilled in the art will understand that the object access behavior parameter may have other forms or values, and this disclosure does not limit it.
[0080] Although Table 1 only shows the object access behavior parameters extracted from four traffic data points, those skilled in the art should understand that this disclosure does not limit the amount of traffic data. For example, traffic data of user X over the past month can be concatenated to form the object access behavior sequence described above.
[0081] In step S205, the object access behavior sequence is encoded into an object access behavior feature vector.
[0082] For example, step S205 further includes using a word vector transformation model (e.g., the word2vec model) to encode each object access behavior parameter in the object access behavior sequence into a word vector; and obtaining an object access behavior feature vector based at least in part on the word vector corresponding to each object access behavior parameter. The word2vec model is a neural network algorithm for text vectorization in the field of natural language processing. Compared to the earlier bag-of-words model, the word2vec model has unique advantages in terms of model dimensionality, preservation of contextual word order, and maintenance of semantic contextual relationships.
[0083] Optionally, the object access behavior feature vector can be a concatenation of word vectors corresponding to each object access behavior parameter. The object access behavior feature vector can also be a sentence vector obtained by further computation based on word vectors using neural network models such as CNN (Convolutional Neural Networks), Sentence2Vec, and encoder-decoder. This disclosure does not impose any limitations on this.
[0084] Optionally, the cloud network service operation and analysis platform can cluster the object access behavior feature vectors to generate cluster labels for object access behavior; and based on the cluster labels, generate recommendation information or classification information associated with the object identifier. For example, the cloud network service operation and analysis platform can use clustering methods such as k-means to cluster the above-mentioned object access behavior feature vectors into cluster labels, so that similar features can be aggregated together and provided to downstream services (e.g., targeted advertising, personalized recommendations, etc.), or provided to other services in the cloud network service operation and analysis platform (e.g., user behavior anomaly detection).
[0085] For example, suppose user X uses multiple services within the cloud network service operation and analysis platform, such as watching online videos using their user account ("Xiaoxi"), and listening to music, shopping, and chatting using their user account ("Xiaocao"). By leveraging clustering tags based on user browsing behavior, the cloud network service operation and analysis platform can determine that user X likes trend-related content. Therefore, it can try pushing trend-related videos to the user account "Xiaoxi" and trendy new products to the user account "Xiaocao".
[0086] For example, if user X's traffic data has been at a moderate to low frequency for a long period of time, but the cloud network service operation and analysis platform suddenly discovers that multiple accounts belonging to user X have recently initiated access requests at a high frequency, the cloud network service operation and analysis platform may determine that user X's behavior is abnormal (i.e., generate classification information indicating abnormal user behavior), indicating a risk of account theft, etc.
[0087] This disclosure does not impose any restrictions on the method of using object access behavior feature vectors or the method of clustering object access behavior feature vectors, as long as they can meet the needs of specific business operations.
[0088] For example, the cloud network service operation and analysis platform can also reduce the object access behavior feature vector to a two-dimensional vector, and draw an object behavior display interface based on the two-dimensional vector, wherein similar object access behavior feature vectors are close in distance in the object behavior display interface.
[0089] For example, t-SNE (t-Distributed Stochastic Neighbor Embedding) can be used to reduce the dimensionality of object access behavior feature vectors and visualize them. t-SNE is a non-linear dimensionality reduction technique that can be used to visualize high-dimensional data. Compared to commonly used dimensionality reduction techniques such as PCA, t-SNE can better preserve non-linear characteristics, and after mapping to a lower-dimensional space, it can better maintain the semantic properties of the original object access behavior feature vectors. This disclosure does not restrict the dimensionality reduction method for object access behavior feature vectors, as long as it meets the visualization requirements.
[0090] Therefore, the method for processing network traffic provided by the embodiments of this disclosure can utilize neural network models (e.g., word2vec models) to encode object access behavior into object access behavior feature vectors (e.g., embedding vectors). This significantly reduces the amount of data required to identify objects and analyze their behavior from traffic data. The embodiments of this disclosure can reduce the workload of manually extracting and parsing traffic data, automatically encode object access behavior into vectors, and have good generalization ability. The embodiments of this disclosure can be applied to services such as advertising recommendations to achieve user-level advertising recommendations.
[0091] The embodiments of this disclosure can cluster object access behavior feature vectors into category labels through unsupervised clustering, which has better generalization ability than directly using the values of each field of traffic data and can produce more robust prediction results.
[0092] Figure 3 This is a schematic diagram illustrating the acquisition of object identification parameters and object access behavior parameters according to embodiments of the present disclosure.
[0093] For cloud platforms with volumes in the trillions, collecting (especially in real-time) the entire network's traffic data would put enormous pressure on cloud storage devices. Therefore, cloud network service operation and analysis platforms need to sample the traffic accessed by objects.
[0094] For example, step S202 above further includes: filtering the traffic data based on the importance of the values of the site fields of the traffic data; sampling a portion of the traffic data from the filtered traffic data according to a predetermined rule; and extracting object access behavior parameters from the values of fields related to object access behavior based on the sampled portion of traffic data.
[0095] For example, in practical use, the importance of site field values can be set according to the priority of the business being focused on. For instance, businesses with high user traffic are often more important than those with low user traffic. Similarly, businesses involving monetary transactions are often more important than those not involving monetary transactions. The embodiments of this disclosure can determine the importance of site field values based on various factors, and this disclosure does not impose any limitations.
[0096] For example, the predetermined rule could be to randomly sample 1% of the traffic data. The random sampling ratio can be determined based on the amount of data that the storage platform can handle, and this disclosure does not impose any limitations on it.
[0097] Figure 3 Although only the values of the site field and the CGI field are collected to extract object access behavior parameters, those skilled in the art should understand that the values of other fields (e.g., access time, client IP, etc.) can also be collected, and this disclosure does not impose any restrictions on this.
[0098] Continue to refer to Figure 3 When the field related to object access behavior includes a public gateway interface field, the above-mentioned extraction of object access behavior parameters from the values of the fields related to object access behavior further includes: extracting the value corresponding to the public gateway interface field from the traffic data, and performing at least one of the following replacement operations on the value corresponding to the public gateway interface field: for each integer string in the value of the public gateway interface field, replacing the integer string with a constant string corresponding to the integer string, wherein different integer strings correspond to different constant strings; and / or for strings in the value of the public gateway interface field whose string length is greater than a preset length, replacing the string with a constant string used to indicate that the string length is greater than the preset length; and using the value corresponding to the public gateway interface field after the replacement operation as the object access behavior parameter.
[0099] refer to Figure 3 In the example, the information in the public gateway interface fields is often highly relevant to what the object is interested in. However, as... Figure 3As shown, because the values of public gateway interface fields accessed by objects often contain numeric or resource identifiers, the feature space of these fields is excessively large. Therefore, cloud platforms can perform simple preprocessing on the values of these public gateway interface fields.
[0100] Figure 3 The preprocessing methods shown include two approaches. Approach 1: Replace integer strings (e.g., / index / 123 / 456) in the public gateway interface field value with constant strings (e.g., / index / NUM / NUM). Approach 2: Process strings in the public gateway interface field value where the segment length exceeds a preset length (e.g., 16 letters / digits) (e.g., 5d41402abc4b2a76b9719d911 in / index / 5d41402abc4b2a76b9719d911) into constant strings indicating that the string length exceeds the preset length (e.g., / index / STR, where STR indicates that the character at that position exceeds the preset length). This processing results in fewer object access behavior parameters being collected and produces more robust training results during subsequent model training. Further details will follow. Figures 4A to 4C The methods for training the word vector transformation model will not be elaborated upon here. The two methods described above are merely examples, and this disclosure does not impose any limitations on them.
[0101] pass Figure 3 The processing of object access behavior parameters further reduces the amount of traffic data analyzed and increases the robustness of the selected traffic data. Compared to directly using the values of various fields in the traffic data to identify object behavior, the embodiments of this disclosure have better generalization ability and can produce more robust prediction results.
[0102] Figure 4A This is a schematic diagram illustrating a word vector conversion model according to an embodiment of the present disclosure. Figure 4B This is a schematic diagram illustrating the objective function according to an embodiment of the present disclosure. Figure 4C The hierarchical normalization process according to an embodiment of this disclosure is illustrated.
[0103] like Figure 4A As shown, the word vector conversion model includes an input layer, a hidden layer, and an output layer.
[0104] The input layer is configured to: sequentially convert each object access behavior parameter in the object access behavior sequence into an input vector of a first dimension, and then sequentially input the input vector into the hidden layer. The hidden layer is configured to: convert the input vector into a hidden layer vector of a second dimension, and then input the hidden layer vector into the output layer, where the second dimension is smaller than the first dimension. The output layer is configured to: normalize the hidden layer vector to obtain an output vector, and then use the output vector as the word vector corresponding to the object access behavior parameter.
[0105] like Figure 4A As shown, optionally, during the process from the input layer to the hidden layer, the input layer converts each object access behavior parameter into a one-hot vector. Only one bit is allowed to be 1 in a one-hot vector. Therefore, in this case, the first dimension is the sum of the number of object identifiers and the number of object access behavior parameters.
[0106] Hereafter, the input vector will be denoted as x. t , which represents the input vector corresponding to the object access behavior parameter with index t in the object access behavior sequence.
[0107] Let W be the weight matrix from the input layer to the hidden layer, with dimensions N×d, where d is the second dimension, which is smaller than the first dimension. The second dimension is adjustable and depends on the precision of the object behavior features that the word vector conversion model aims to extract. Based on this, the hidden layer vector can be denoted as h, and its calculation formula is: h = W T x t W T This is the transpose of the weight matrix of the hidden layer.
[0108] The output layer is configured to use softmax to normalize the hidden layer vectors to obtain the output vector. The output vector is denoted as y, where y = Softmax(U... T h), where softmax is the normalization function, U T This is the transpose of the weight matrix of the output layer.
[0109] Alternatively, the object access behavior feature p(S) obtained based on the output vector can be represented as: At this point, the object access behavior feature p(S) is composed of multiple output vectors combined sequentially. Here, N is the value of the first dimension, w1 represents the object identifier, w2, ... w T This represents the parameters for each object access behavior in the sequence of object access behaviors.
[0110] Next refer to Figure 4B Describe the training process of the word vector conversion model.
[0111] For example, the method 200 for processing traffic data according to an embodiment of the present disclosure further includes: training the word vector conversion model before encoding each object access behavior parameter in the object access behavior sequence into a word vector using a word vector conversion model.
[0112] The training of the word vector conversion model includes: the input layer converts each object access behavior parameter in the object access behavior sequence into a one-hot encoded vector as an input vector, and inputs the input vector sequentially into the hidden layer; using the hidden layer and the output layer, an output vector is obtained; based on the output vector, the value corresponding to the objective function is calculated; based on the value corresponding to the objective function, the parameters of the neurons in the hidden layer are adjusted to maximize the value corresponding to the objective function.
[0113] Figure 4B The diagram illustrates a first objective function, a second objective function, and a third objective function. The objective function of the word vector conversion model is one of the first, second, and third objective functions. Alternatively, the objective function of the word vector conversion model can be a weighted sum of the first, second, and third objective functions.
[0114] The first objective function indicates the similarity between the predicted object access behavior value based on the object identifier and each object access behavior parameter in the object access behavior sequence. In other words, training the word vector conversion model is the process of maximizing the similarity between the predicted object access behavior value based on the object identifier and each object access behavior parameter in the object access behavior sequence.
[0115] For example, the first objective function L1 is Where N is the value of the first dimension, w1 represents the object identifier, w2, ... w T These represent the parameters for each object access behavior in the sequence of object access behaviors. This represents the probability of the (j-1)th object access behavior parameter occurring when the object identifier is w1.
[0116] The second objective function indicates the similarity between the predicted object access behavior value based on the current object access behavior parameters and multiple object access behavior parameters before and after the current object access behavior. That is, training the word vector conversion model is the process of maximizing the similarity between the predicted object access behavior value based on the current object access behavior parameters and multiple object access behavior parameters before and after the current object access behavior.
[0117] For example, the second objective function L2 is Where N is the value of the first dimension, wt w is the parameter for the current object access behavior. t+p For the p-th current object access behavior parameter before the current object access behavior parameter, p(w t+p |w t ) is the parameter w based on the current object access behavior. t Predicted, current object access behavior parameter w t The predicted value of the access behavior of the p-th current object was compared with w. t+p The similarity between them.
[0118] The third objective function indicates the similarity between the predicted value of the current object access behavior, which is based on multiple object access behavior parameters before and after the current object access behavior, and the current object access behavior parameters themselves. In other words, training the word vector conversion model is the process of maximizing the similarity between the predicted value of the current object access behavior, which is based on multiple object access behavior parameters before and after the current object access behavior, and the current object access behavior parameters themselves.
[0119] For example, the third objective function L3 is Where N is the value of the first dimension, w t w is the parameter for the current object access behavior. t+p For the p-th current object access behavior parameter before the current object access behavior parameter, p(w t+p |w t ) is based on the access behavior parameter w of the current object. t The previous p-th object access behavior parameter w t+p The predicted value of the current object access behavior and w t The similarity between them.
[0120] In solving the objective function described above, the softmax function needs to be calculated. Since solving the softmax function is very expensive, hierarchical normalization and negative sampling are used to process the calculation of the output vector (i.e., the object access behavior prediction value mentioned above) during the training of the word vector conversion model, in order to reduce the computational cost of the output vector.
[0121] Hierarchical normalization (e.g., hierarchical softmax) uses a Huffman tree to compute the output vector. The leaf nodes of the tree represent parameters for all possible object access behaviors, while the non-leaf nodes are logistic regression binary classifiers (e.g., ...). Figure 4C In the model (θ1 to θ4), the parameters of each logistic regression classifier are different. This allows for rapid classification of object access behavior parameters, thereby reducing the computational cost of the softmax function.
[0122] Similarly, the softmax function also needs to be calculated when inferring the output vector. Hierarchical normalization can also be used to calculate the output vector. That is, in the process of inferring the output vector using the word vector conversion model, hierarchical normalization is used to process the calculation of the output vector.
[0123] Furthermore, negative sampling can be used to aid in the training of the word vector transformation model. The higher the predicted probability of a positive example by the word vector transformation model, the better (i.e., the closer the predicted value is to the true value, the better). For example, for the sequence [X, / index / Cgi_Download.py, / index_5 / NUM / NUM, / index_6 / STR], the closer the first object behavior parameter predicted based on the object identifier X is to / index / Cgi_Download.py (i.e., / index / Cgi_Download.py is a positive example), the better. Assuming that the object cannot access / STR / Cgi_baby (i.e., / STR / Cgi_baby is a negative example), the greater the difference between the word vector corresponding to the first object behavior parameter predicted based on the object identifier X and the word vector corresponding to / STR / Cgi_baby, the better.
[0124] Since the number of positive examples is small, it is easy to ensure that the predicted probability of each positive example is as high as possible. However, the number of negative examples is particularly large, so the idea behind negative sampling is to randomly select some negative examples according to a certain negative sampling strategy, and then ensure that the predicted probability of these selected negative examples is as low as possible.
[0125] There are various negative sampling strategies, such as uniform negative sampling, word frequency sampling, etc. Optionally, the negative sampling strategy used in the embodiments of this disclosure is uniform negative sampling. This disclosure does not limit the negative sampling strategy, as long as it meets the requirements.
[0126] Therefore, the neural network models (e.g., word2vec models) provided by the embodiments of this disclosure have fast training convergence speed and good prediction results.
[0127] Figure 5 An apparatus 500 for processing traffic data according to an embodiment of the present disclosure is shown. The apparatus 500 for processing traffic data includes: a data acquisition module 501, an object identifier mapping module 502, an embedding generation module 503, a data mart module 504, and a data display module 505.
[0128] The data acquisition module 501 is configured to acquire traffic data for accessing network services.
[0129] The object identifier mapping module 502 is configured to extract object identification parameters from the values of fields related to object identification based on the traffic data, and extract object access behavior parameters from the values of fields related to object access behavior; and determine the object identifier corresponding to the object access behavior parameters based on the object login data and the object identification parameters.
[0130] The embedding generation module 503 is configured to construct an object access behavior sequence, the object access behavior sequence including an object identifier and object access behavior parameters corresponding to the object identifier and arranged in chronological order; and to encode the object access behavior sequence into an object access behavior feature vector.
[0131] Data mart module 504 is configured to cluster the object access behavior feature vector to generate cluster labels for the object access behavior; and based on the cluster labels, generate recommendation information or classification information associated with the object identifier.
[0132] The data display module 505 is configured to reduce the object access behavior feature vector to a two-dimensional vector and draw an object behavior display interface based on the two-dimensional vector, wherein similar object access behavior feature vectors are close in distance in the object behavior display interface.
[0133] Therefore, the apparatus for processing network traffic provided in the embodiments of this disclosure can utilize neural network models (e.g., word2vec models) to encode object access behavior into object access behavior feature vectors (e.g., embedding vectors). This significantly reduces the amount of data required to identify objects and analyze their behavior from traffic data. The embodiments of this disclosure can reduce the workload of manually extracting and parsing traffic data, automatically encode object access behavior into vectors, and have good generalization ability. The embodiments of this disclosure can be applied to services such as advertising recommendations to achieve object-level advertising recommendations.
[0134] like Figure 6 As shown, the terminal and server described above can both be an electronic device 2000 (also referred to as: device 2000). The electronic device 2000 may include one or more processors 2010 and one or more memories 2020. The memories 2020 store computer-readable code, which, when executed by the one or more processors 2010, can perform the various methods described above.
[0135] The processor in this embodiment can be an integrated circuit chip with signal processing capabilities. The processor can be a general-purpose processor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), an off-the-shelf programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. It can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of this application. The general-purpose processor can be a microprocessor or any conventional processor, and can be based on an x86 architecture or an ARM architecture.
[0136] In general, the various exemplary embodiments of this disclosure can be implemented in hardware or dedicated circuitry, software, firmware, logic, or any combination thereof. Some aspects can be implemented in hardware, while others can be implemented in firmware or software that can be executed by a controller, microprocessor, or other computing device. When aspects of embodiments of this disclosure are illustrated or described as block diagrams, flowcharts, or using some other graphical representation, it will be understood that the blocks, apparatuses, systems, techniques, or methods described herein can be implemented as non-limiting examples in hardware, software, firmware, dedicated circuitry or logic, general-purpose hardware or controllers or other computing devices, or some combination thereof.
[0137] For example, the method or apparatus according to embodiments of this disclosure can also be used by means of Figure 7 The architecture of the computing device 3000 shown is used for implementation. For example... Figure 7 As shown, the computing device 3000 may include a bus 3010, one or more CPUs 3020, a read-only memory (ROM) 3030, a random access memory (RAM) 3040, a communication port 3050 connected to a network, an input / output component 3060, a hard disk 3070, etc. The storage devices in the computing device 3000, such as the ROM 3030 or the hard disk 3070, may store various data or files used in the processing and / or communication of the method for determining the driving risk of a vehicle provided in this disclosure, as well as program instructions executed by the CPU. The computing device 3000 may also include a user interface 3080. Of course, Figure 7 The architecture shown is merely exemplary and can be omitted as needed when implementing different devices. Figure 7 One or more components in the computing device shown.
[0138] According to another aspect of this disclosure, a computer-readable storage medium is also provided. Figure 8 A schematic diagram 4000 of a storage medium according to the present disclosure is shown.
[0139] like Figure 8As shown, the computer storage medium 4020 stores computer-readable instructions 4010. When the computer-readable instructions 4010 are executed by a processor, various methods according to embodiments of the present disclosure described with reference to the above figures can be performed. The computer-readable storage medium in the embodiments of the present disclosure may be volatile memory or non-volatile memory, or may include both volatile and non-volatile memory. Non-volatile memory may be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), or flash memory. Volatile memory may be random access memory (RAM), which is used as an external cache. By way of example, but not limitation, many forms of RAM are available, such as static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDRSDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous linked dynamic random access memory (SLDRAM), and direct memory bus random access memory (DR RAM). It should be noted that the memory used in the methods described herein is intended to include, but is not limited to, these and any other suitable types of memory.
[0140] Embodiments of this disclosure also provide a computer program product or computer program including computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform various methods according to embodiments of this disclosure.
[0141] It should be noted that the flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this disclosure. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.
[0142] In general, the various exemplary embodiments of this disclosure can be implemented in hardware or dedicated circuitry, software, firmware, logic, or any combination thereof. Some aspects can be implemented in hardware, while others can be implemented in firmware or software that can be executed by a controller, microprocessor, or other computing device. When aspects of embodiments of this disclosure are illustrated or described as block diagrams, flowcharts, or using some other graphical representation, it will be understood that the blocks, apparatuses, systems, techniques, or methods described herein can be implemented as non-limiting examples in hardware, software, firmware, dedicated circuitry or logic, general-purpose hardware or controllers or other computing devices, or some combination thereof.
[0143] The exemplary embodiments of this disclosure described in detail above are merely illustrative and not restrictive. Those skilled in the art will understand that various modifications and combinations can be made to these embodiments or their features without departing from the principles and spirit of this disclosure, and such modifications should fall within the scope of this disclosure.
Claims
1. A method for processing traffic data, comprising: Obtain traffic data for accessing network services; Based on the traffic data, object identification parameters are extracted from the values of fields related to object identification, and object access behavior parameters are extracted from the values of fields related to object access behavior. The fields related to object identification include: Client-IP field, UA field, and DATE field, and the fields related to object access behavior include: Host field, CGI field, and referer field. Based on object login data and the object identification parameters, the object identifier corresponding to the object access behavior parameters is determined. The object login data includes object login logs, which include: login IP address, login time, and login duration. The determination of the object identifier corresponding to the object access behavior parameters based on the object login data and the object identification parameters further includes: determining the object identifier corresponding to the object access behavior parameters based on the constraints imposed by the object login data on the object identification parameters. Construct an object access behavior sequence, the object access behavior sequence including the object identifier and object access behavior parameters corresponding to the object identifier, arranged in chronological order; and The sequence of object access behaviors is encoded into an object access behavior feature vector.
2. The method as described in claim 1, wherein, The fields related to object access behavior include site fields. Extracting object identification parameters from the values of fields related to object identification based on the traffic data, and extracting object access behavior parameters from the values of fields related to object access behavior, further includes: The traffic data is filtered based on the importance of the site field values. A portion of the filtered traffic data is sampled according to predetermined rules; and Based on a sampled portion of traffic data, the object access behavior parameters are extracted from the values of fields related to object access behavior.
3. The method as described in any one of claims 1 or 2, wherein, The fields related to object access behavior include the public gateway interface field, and the extraction of object access behavior parameters from the values of the fields related to object access behavior further includes: Extract the value corresponding to the public gateway interface field from the traffic data, and perform at least one of the following replacement operations on the value corresponding to the public gateway interface field: For each integer string in the value of the public gateway interface field, replace the integer string with a constant string corresponding to the integer string, wherein different integer strings correspond to different constant strings; and / or For any string whose length in the value of the public gateway interface field is greater than a preset length, the string is replaced with a constant string indicating that the string length is greater than the preset length. The value of the public gateway interface field after the replacement operation is used as the object access behavior parameter.
4. The method of claim 1, wherein, Encoding the object access behavior sequence into an object access behavior feature vector further includes: Using a word vector transformation model, each object access behavior parameter in the object access behavior sequence is encoded into a word vector; and The object access behavior feature vector is obtained at least in part based on the word vector corresponding to each object access behavior parameter.
5. The method of claim 4, wherein, The word vector conversion model includes an input layer, a hidden layer, and an output layer, wherein, The input layer is configured to: sequentially convert each object access behavior parameter in the object access behavior sequence into an input vector of the first dimension, and sequentially input the input vector into the hidden layer; The hidden layer is configured to: convert the input vector into a hidden layer vector of a second dimension, and input the hidden layer vector into the output layer, wherein the second dimension is smaller than the first dimension; The output layer is configured to: normalize the hidden layer vector to obtain an output vector, and use the output vector as the word vector corresponding to the object access behavior parameter.
6. The method of claim 5, further comprising: The word vector conversion model is trained before encoding each object access behavior parameter in the object access behavior sequence into a word vector using the word vector conversion model; The training of the word vector conversion model further includes: The input layer converts each object access behavior parameter in the object access behavior sequence into a one-hot encoded vector as the input vector, and then inputs the input vectors sequentially into the hidden layer. The output vector is obtained using the hidden layer and the output layer; Based on the output vector, calculate the value of the objective function; Based on the value corresponding to the objective function, the parameters of the neurons in the hidden layer are adjusted to maximize the value corresponding to the objective function.
7. The method of claim 6, wherein, The objective function indicates a weighted sum of one or more of the first, second, and third objective functions, wherein, The first objective function indicates the similarity between the predicted value of object access behavior based on the object identifier and each object access behavior parameter in the object access behavior sequence; The second objective function indicates the similarity between the predicted object access behavior value based on the current object access behavior parameters and multiple object access behavior parameters before and after the current object access behavior; or The third objective function indicates the similarity between the predicted value of the current object access behavior, which is based on multiple object access behavior parameters before and after the current object access behavior, and the current object access behavior parameters.
8. The method of claim 7, wherein, First objective function for = Where N is the value of the first dimension. Represents an object identifier. These represent the parameters for each object access behavior in the sequence of object access behaviors. Indicates that the object identifier is In the case of , the probability of the (j-1)th object access behavior parameter occurring; Second objective function for Where N is the value of the first dimension. For the current object access behavior parameters, This is the p-th current object access behavior parameter preceding the current object access behavior parameter. Access behavior parameters based on the current object Predicted parameters for accessing the current object The predicted value of the access behavior of the p-th current object is compared with The similarity between them; Third objective function for Where N is the value of the first dimension. For the current object access behavior parameters, This is the p-th current object access behavior parameter preceding the current object access behavior parameter. For access behavior parameters based on the current object The previous p-th object access behavior parameter The predicted value of the current object access behavior and The similarity between them.
9. The method according to any one of claims 5-8, wherein, The hidden layer vector for ,in This represents the input vector corresponding to the object access behavior parameter at index t in the object access behavior sequence. This is the transpose of the weight matrix of the hidden layer; The output vector for ,in, For normalization function, This is the transpose of the weight matrix of the output layer.
10. The method according to any one of claims 6-8, wherein, The step of obtaining the output vector using the hidden layer and the output layer further includes: In the process of inferring the output vector using the aforementioned word vector transformation model, hierarchical normalization is used to process the calculation of the output vector; and During the training of the word vector conversion model, the calculation process of the output vector is carried out using hierarchical normalization and negative sampling.
11. The method according to any one of claims 1 to 8, further comprising: Cluster the object access behavior feature vectors to generate cluster labels for object access behavior; as well as Based on the clustering labels, recommendation information or classification information associated with the object identifier is generated.
12. The method according to any one of claims 1 to 8, further comprising: The object access behavior feature vector is reduced to a two-dimensional vector, and the object behavior display interface is drawn based on the two-dimensional vector. In the object behavior display interface, similar object access behavior feature vectors are close in distance.
13. An apparatus for processing object traffic data, comprising: processor; as well as A memory, wherein the memory stores a computer-executable program, which, when executed by the processor, performs the method of any one of claims 1-12.
14. A computer-readable storage medium having stored thereon computer instructions that, when executed by a processor, implement the method as claimed in any one of claims 1-12.