Method and device for detecting network access volume

Abstract

The embodiment of the present application provides a method and device for detecting network access volume, including: obtaining a real-time data stream, and determining a current traffic sequence of the real-time data stream, the data stream includes information generated based on network access to generate an order, the traffic sequence is used to characterize a sequence of order quantities, a forgetting operation is performed on a historical traffic sequence in a preset abnormality detection RRCF model according to the real-time data stream, a new operation is performed on the RRCF model after the forgetting operation based on the current traffic sequence, and the RRCF model after the new operation is obtained, the historical traffic sequence is determined based on the historical data stream, the difference information between the preset RRCF model and the RRCF model after the new operation is determined, and a detection result is determined based on the difference information, wherein the detection result characterizes whether the network access volume is abnormal, reduces the difficulty of analysis, improves the accuracy and reliability of detection, and achieves the technical effect of saving resources and costs.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of Internet technology, and in particular, to a method and device for detecting network access volume. Background Art

[0002] With the development of Internet technology, we have entered the era of e-commerce Internet. Various shopping marketing methods and promotion methods have emerged in an endless stream. When setting up promotional activities, platforms or merchants may sell some items at ultra-low prices due to setting errors, thereby causing huge losses. In order to avoid losses, many platforms or merchants have adopted the method of detecting the number of visits.

[0003] In the prior art, the method of detecting the number of visits is usually implemented through experience summary. For example, historical visits are counted, and a visit threshold is determined based on the historical visits and the predicted number of visits that may be generated by price reduction. The real-time visit volume is detected, and it is determined whether the visit volume is abnormal based on the detected real-time visit volume and the visit threshold.

[0004] However, through the above method, due to the influence of the pageview threshold, it is difficult to accurately distinguish whether the pageview is normal or abnormal. Therefore, there may be a problem of low accuracy in detecting the pageview. Summary of the invention

[0005] The embodiments of the present application provide a method and device for detecting network access volume, so as to solve the problem of low accuracy in detecting access volume.

[0006] In a first aspect, an embodiment of the present application provides a method for detecting network access volume, including:

[0007] Acquire a real-time data stream and determine a current flow sequence of the real-time data stream, wherein the data stream includes information generated by generating an order based on network access, and the flow sequence is used to characterize a sequence of order quantities;

[0008] Performing a forgetting operation on a historical traffic sequence in a preset anomaly detection RRCF model according to the real-time data stream, and performing a new adding operation on the RRCF model after the forgetting operation based on the current traffic sequence to obtain the RRCF model after the new adding operation, wherein the historical traffic sequence is determined based on the historical data stream;

[0009] Determine the difference information between the preset RRCF model and the RRCF model after the newly added operation, and determine the detection result according to the difference information, wherein the detection result represents whether the network access volume is abnormal.

[0010] In some embodiments, determining the current traffic sequence of the real-time data stream includes:

[0011] Constructing an initial traffic sequence within a first number of time sliding windows according to the real-time data stream;

[0012] Based on the distribution information of the initial traffic sequence, traffic attribute information of the initial traffic sequence within a second number of time sliding windows is determined, wherein the traffic attribute information includes the current traffic sequence, and the first number is greater than the second number.

[0013] In some embodiments, after constructing the initial traffic sequence in the first number of time sliding windows according to the real-time data stream, the method further includes:

[0014] The initial flow sequence is subjected to an additional migration conversion process according to the preset adjustment flow.

[0015] In some embodiments, a forgetting operation is performed on a historical traffic sequence in a preset anomaly detection RRCF model according to the real-time data stream, including:

[0016] Determine the data stream number of the current data stream relative to all data streams according to the current data stream, the historical data stream, and the node information of the preset RRCF model, wherein the node information includes the quantity information of the traffic sequence in the preset RRCF model;

[0017] A forgetting operation is performed on the historical traffic sequence in the preset RRCF model according to the data stream sequence number.

[0018] In some embodiments, performing a forgetting operation on the historical traffic sequence in the preset RRCF model according to the data stream sequence number includes:

[0019] Determining, according to the data stream sequence number and the node information, that the current traffic sequence corresponds to the traffic sequence number in the preset RRCF model;

[0020] A forgetting operation is performed on the historical traffic sequence corresponding to the traffic sequence number in the preset RRCF model.

[0021] In some embodiments, performing a new operation on the RRCF model after the forgetting operation based on the current traffic sequence to obtain the RRCF model after the new operation includes:

[0022] At the position corresponding to the traffic sequence number in the RRCF model after the forgetting operation, a new addition operation of inserting the current traffic sequence is performed to obtain the RRCF model after the new addition operation.

[0023] In some embodiments, the traffic attribute information further includes a traffic index, which is used to characterize the magnitude of the increase or decrease in traffic when the initial traffic sequence is converted to the current traffic sequence; determining the detection result according to the difference information includes:

[0024] If the traffic index indicates that the traffic is increasing, the increase in traffic is greater than a preset first threshold, and the difference information is greater than a preset difference threshold, then it is determined that the network access flow is abnormal;

[0025] If the traffic index indicates that the traffic is increasing and the increase in traffic is less than a preset first threshold, then the network access volume is determined to be normal; or, if the traffic index indicates that the traffic is decreasing, then the network access volume is determined to be normal.

[0026] In some embodiments, if the network access flow is abnormal, an abnormal prompt message is generated and output.

[0027] In a second aspect, an embodiment of the present application provides a device for detecting network access volume, including:

[0028] An acquisition unit, used to acquire a real-time data stream, wherein the data stream includes information generated based on network access to generate an order;

[0029] A first determining unit is used to determine a current flow sequence of the real-time data stream, wherein the flow sequence is used to characterize a sequence of order quantities;

[0030] A forgetting unit, configured to perform a forgetting operation on a historical traffic sequence in a preset anomaly detection RRCF model according to the real-time data stream, wherein the historical traffic sequence is determined based on the historical data stream;

[0031] A new adding unit, configured to perform a new adding operation on the RRCF model after the forgetting operation based on the current traffic sequence, so as to obtain the RRCF model after the new adding operation;

[0032] A second determining unit, configured to determine difference information between the preset RRCF model and the RRCF model after the new addition operation;

[0033] The third determining unit is used to determine a detection result according to the difference information, wherein the detection result represents whether the network access volume is abnormal.

[0034] In some embodiments, the first determining unit includes:

[0035] A construction subunit, configured to construct an initial flow sequence within a first number of time sliding windows according to the real-time data stream;

[0036] The first determination subunit is used to determine the flow attribute information of the initial flow sequence within a second number of time sliding windows based on the distribution information of the initial flow sequence, wherein the flow attribute information includes the current flow sequence, and the first number is greater than the second number.

[0037] In some embodiments, the first determining unit includes:

[0038] The adding subunit is used to perform an additional migration conversion process on the initial flow sequence according to a preset adjustment flow.

[0039] In some embodiments, the forgetting unit comprises:

[0040] A second determination subunit is used to determine the data flow number of the current data flow relative to all data flows according to the current data flow, the historical data flow, and the node information of the preset RRCF model, wherein the node information includes the quantity information of the traffic sequence in the preset RRCF model;

[0041] The forgetting subunit is used to perform a forgetting operation on the historical traffic sequence in the preset RRCF model according to the data stream sequence number.

[0042] In some embodiments, the forgetting subunit comprises:

[0043] A determination module, configured to determine, based on the data stream sequence number and the node information, that the current traffic sequence corresponds to the traffic sequence number in the preset RRCF model;

[0044] The forgetting module is used to perform a forgetting operation on the historical traffic sequence corresponding to the traffic sequence number in the preset RRCF model.

[0045] In some embodiments, the newly added unit is used to perform a new addition operation of inserting the current traffic sequence at a position corresponding to the traffic sequence number in the RRCF model after the forgetting operation to obtain the RRCF model after the new addition operation.

[0046] In some embodiments, the traffic attribute information also includes a traffic index, and the traffic index is used to characterize the magnitude of the increase or decrease in traffic when the initial traffic sequence is converted to the current traffic sequence; the third determination unit is used to determine that the network access flow is abnormal if the traffic index characterizes that the traffic is increasing, the magnitude of the increase in traffic is greater than a preset first threshold, and the difference information is greater than a preset difference threshold; if the traffic index characterizes that the traffic is increasing, and the magnitude of the increase in traffic is less than the preset first threshold, then determine that the network access volume is normal; or, if the traffic index characterizes that the traffic is decreasing, then determine that the network access volume is normal.

[0047] In some embodiments, it also includes:

[0048] A generating unit, configured to generate an abnormal prompt message if the network access flow is abnormal;

[0049] An output unit is used to output the abnormal prompt message.

[0050] In a third aspect, an embodiment of the present application provides an electronic device, including: a memory, a processor;

[0051] Memory; Memory for storing instructions executable by the processor;

[0052] The processor is configured to execute the method as described in the first aspect.

[0053] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores computer-executable instructions, and when the computer-executable instructions are executed by a processor, they are used to implement the method described in the first aspect.

[0054] In a fifth aspect, an embodiment of the present application provides a computer program product, including a computer program, which implements the method described in the first aspect when executed by a processor.

[0055] The network access volume detection method and device provided in the embodiment of the present application include: obtaining a real-time data stream, and determining a current traffic sequence of the real-time data stream, wherein the data stream includes information generated based on network access to generate an order, and the traffic sequence is used to characterize the sequence of order quantities, and a historical traffic sequence in a preset abnormality detection RRCF model is forgotten according to the real-time data stream, and a new operation is performed on the RRCF model after the forgotten operation based on the current traffic sequence to obtain the RRCF model after the new operation, wherein the historical traffic sequence is determined based on the historical data stream, and the difference information between the preset RRCF model and the RRCF model after the new operation is determined, and a detection result is determined according to the difference information, wherein the detection result characterizes whether the network access volume is abnormal, by performing a forget operation on the historical traffic sequence in the preset RRCF model according to the real-time data stream. A forgetting operation (which can be understood as a deletion operation and can be implemented by a forgetting module in a preset RRCF model) is performed, and based on the current traffic sequence, a new adding operation (which can be understood as an insertion operation and can be implemented by a new adding module in a preset RRCF model) is performed on the RRCF model after the forgetting operation (i.e., the RRCF model after the deletion operation) to obtain the RRCF model after the new adding operation, and whether the network access volume is abnormal is determined by the preset RRCF model and the RRCF model after the new adding operation. On the one hand, through the above-mentioned introduced features, the problem of low detection accuracy and reliability caused by the method based on the above-mentioned first related technology can be avoided, and the problem of high cost and low accuracy caused by the method based on the above-mentioned second related technology can also be avoided, which reduces the difficulty of analysis, improves the accuracy and reliability of detection, and achieves the technical effect of saving resources and costs. BRIEF DESCRIPTION OF THE DRAWINGS

[0056] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present disclosure and, together with the description, serve to explain the principles of the present disclosure.

[0057] Figure 1 A schematic diagram of an application scenario of the method for detecting network access volume according to an embodiment of the present application;

[0058] Figure 2 A flowchart of a method for detecting network access volume according to an embodiment of the present application;

[0059] Figure 3 A flowchart of a method for detecting network access volume according to another embodiment of the present application;

[0060] Figure 4 A schematic diagram of a time sliding window of an embodiment of the present application;

[0061] Figure 5A schematic diagram of the structural changes of the RRCF model of an embodiment of the present application;

[0062] Figure 6 A schematic diagram of a network access volume detection device according to an embodiment of the present application;

[0063] Figure 7 A schematic diagram of a network access volume detection device according to another embodiment of the present application;

[0064] Figure 8 A block diagram of an electronic device for detecting network access volume according to an embodiment of the present application.

[0065] The above drawings show clear embodiments of the present disclosure, which will be described in more detail below. These drawings and text descriptions are not intended to limit the scope of the present disclosure in any way, but to illustrate the concepts of the present disclosure to those skilled in the art by referring to specific embodiments. DETAILED DESCRIPTION

[0066] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present disclosure. Instead, they are merely examples of devices and methods consistent with some aspects of the present disclosure as detailed in the appended claims.

[0067] The nouns involved in the embodiments of the present application are explained as follows:

[0068] Network: It is composed of several nodes and links connecting these nodes, representing many objects and their mutual connections.

[0069] Time sliding window: refers to the time period during which events or things can be processed or responded to.

[0070] Normal network access volume: It is a relative concept to normal network access volume, which means that the network access volume conforms to the normal number of network accesses, that is, the number of times the network is accessed under normal circumstances.

[0071] Abnormal network access volume: It is a relative concept to abnormal network access volume. It means that the network access volume does not conform to the normal number of network accesses, that is, the network access volume is greater or less than the number of network accesses under normal circumstances.

[0072] See also Figure 1 , Figure 1 A schematic diagram of an application scenario of the method for detecting network access volume according to an embodiment of the present application.

[0073] like Figure 1As shown, any user 101 can access the network platform provided by the server 103 based on his terminal device 102 .

[0074] Among them, the terminal device 102 can be a mobile terminal, such as a mobile phone (or "cellular" phone) and a computer with a mobile terminal, for example, it can be a portable, pocket-sized, handheld, computer-built-in or vehicle-mounted mobile device, which exchanges language and / or data with the wireless access network; the terminal device can also be a personal communication service (Personal Communication Service, PCS) phone, a cordless phone, a session initiation protocol (Session Initiation Protocol, SIP) phone, a wireless local loop (Wireless Local Loop, WLL) station, a personal digital assistant (Personal Digital Assistant, PDA), a tablet computer, a wireless modem (modem), a handheld device (handset), a laptop computer (laptop computer), a machine type communication (Machine Type Communication, MTC) terminal and other devices; the terminal device can also be called a system, a subscriber unit (Subscriber Unit), a subscriber station (Subscriber Station), a mobile station (Mobile Station), a mobile station (Mobile), a remote station (Remote Station), a remote terminal (Remote Terminal), an access terminal (Access Terminal), a user terminal (User Terminal), a user agent (User Agent), User Device or User Equipment, etc., are not limited here.

[0075] In such Figure 1 In the application scenario shown, the terminal device 102 is demonstrated by way of example through a mobile phone 1021 and a laptop computer 1022 .

[0076] For example, Figure 1 As shown, different applications (Application, APP) can be downloaded in the mobile phone 1021, such as Figure 1 Application A and Application B are shown in .

[0077] The user 101 can initiate an instruction to open the application to the mobile phone 1021 by touching the screen or speaking.

[0078] For example, mobile phone 1021 can be provided with a sound collector and an analysis processor. Mobile phone 1021 can collect the user 101's "open application A" (or "open application B", etc.) through the sound collector, and perform semantic analysis and other operations on "open application A" (or "open application B", etc.) through the analysis processor, thereby completing the launch of application A (or application B, etc.).

[0079] With the advent of the e-commerce Internet era, users can perform operations such as shopping, reading, and route planning through application-based applications.

[0080] For example, if application A is an application that allows browsing, selecting and purchasing items, user 101 can browse, select and purchase items through application A.

[0081] Generally speaking, platforms or merchants can promote items through online promotional activities. However, due to errors in price setting by platforms or merchants, or other factors, "red price risk events" may occur, that is, the price of items is far lower than the cost price. In order to prevent the occurrence of "red price risk events" and ensure the positive development of e-commerce Internet, the method usually used is the visit volume detection method.

[0082] In the related art, there are two commonly used methods for detecting the amount of visits: one is to detect the amount of visits based on a threshold, and the other is to detect the amount of visits based on a model.

[0083] Among them, the first method for detecting the volume of visits (i.e., detecting the volume of visits based on a threshold) includes: predicting the volume of visits that may be generated due to price reduction, obtaining the volume of visits within the most recent week, and calculating the volume of visits threshold based on the predicted volume of visits and the volume of visits within the most recent week. The volume of visits threshold can be understood as the maximum value of a normal volume of visits. The real-time volume of visits is detected to obtain a detection result. Specifically, it can be determined whether the detected volume of visits is greater than the volume of visits threshold. If so, the detection result is determined to be an abnormal volume of visits. If not, the detection result is determined to be a normal volume of visits.

[0084] However, when using this method for detecting the amount of visits, the reliability of the detection result depends on the threshold value of the amount of visits. If the threshold value of the amount of visits is more accurate, the accuracy of the detection result is also correspondingly higher. If the threshold value of the amount of visits deviates greatly, the accuracy of the detection result is also correspondingly lower. Therefore, when using this method for detecting the amount of visits, there may be problems with low detection accuracy and reliability.

[0085] The second method for detecting visit volume (i.e., detecting visit volume based on a model) includes: obtaining visit volume generated by price reduction from historical data, manually marking the visit volume, and generating a visit volume anomaly recognition model based on the marked visit volume training, obtaining the current visit volume, inputting the current visit volume into the visit volume anomaly recognition model, and outputting a recognition result. The recognition result can be realized in a digital way. If the recognition result is 0, it means that the current visit volume is normal. Otherwise, if the recognition result is 1, it means that the current visit volume is abnormal.

[0086] However, the method of detecting the number of visits requires a manual labeling process, which results in high labor costs and the recognition results are easily affected by human subjective factors. In general, the training of the model requires a large amount of data. Therefore, there may be problems of high analysis costs and high resource consumption.

[0087] In order to solve at least one of the above problems, the inventors of the present application have obtained the inventive concept of the present application through creative work: performing a forgetting operation on the preset RRCF model according to the real-time streaming data, and then performing a new adding operation, and determining the detection result based on the difference information between the preset RRCF model (i.e., the RRCF model before the forgetting operation and the new adding operation) and the RRCF model after performing each operation (including the forgetting operation and the new adding operation).

[0088] The technical solution of the present application and how the technical solution of the present application solves the above-mentioned technical problems are described in detail below with specific embodiments. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments. The embodiments of the present application will be described below in conjunction with the accompanying drawings.

[0089] See also Figure 2 , Figure 2 A flowchart of a method for detecting network access volume according to an embodiment of the present application is shown.

[0090] like Figure 2 As shown, the method includes:

[0091] S201: Acquire a real-time data stream and determine a current flow sequence of the real-time data stream.

[0092] The data flow includes information generated by generating orders based on network access, and the traffic sequence is used to characterize the sequence of order quantities.

[0093] Exemplarily, the executor of this embodiment may be a network access volume detection device (hereinafter referred to as the detection device), which may be a server (such as a local server or a cloud server), a terminal device, a processor, a chip, etc., which is not limited in this embodiment.

[0094] Specifically, when the network access volume detection method of this embodiment is applied to Figure 1 In the application scenario shown in FIG. 1 , the execution subject (i.e., the detection device) of this embodiment can be as follows: Figure 1 The server shown in .

[0095] Among them, the understanding of data flow is as follows:

[0096] Combined with Figure 1 In the application scenario shown, the user can browse, select, and place an order for the selected items through application A, and the detection device can obtain the user's relevant information (such as account number, location, etc.) based on the user's order operation, and can generate order-related information such as quantity, model, etc.

[0097] Therefore, in this embodiment, the data flow may include a message generated based on the order generated by network access, and may specifically include: user-related information, order-related information, network quality-related information, and so on.

[0098] Among them, the understanding of traffic sequence is as follows:

[0099] In combination with the above examples, the data stream may include order-related information, such as the quantity of orders, etc. Accordingly, the traffic sequence can be understood as a sequence of order quantities. For example, the detection device determines the number of orders in each time window with a preset time window. Since time has a certain continuity and a sequence of order quantities, the order quantities in multiple time windows can be generated into a sequence of order quantities based on the sequence of time.

[0100] It should be understood that the "real-time" in the "real-time data stream" in this embodiment is used to distinguish it from the "historical data stream" and "all data streams" in the following text, and should not be understood as a limitation on the content of the data stream.

[0101] Similarly, the "current" in "current traffic sequence" is used to distinguish it from the "historical traffic sequence" in the following text, and should not be understood as a limitation on the content of the traffic sequence.

[0102] S202: Perform a forgetting operation on the historical traffic sequence in the preset anomaly detection RRCF model according to the real-time data stream, and perform a new operation on the RRCF model after the forgetting operation based on the current traffic sequence to obtain the RRCF model after the new operation.

[0103] Among them, the historical traffic sequence is determined based on the historical data flow.

[0104] In order to deepen the understanding of the solution of this embodiment, the anomaly detection (Robust Random Cut Forest, RRCF) model is first described as an example.

[0105] The RRCF model is an unsupervised online learning model. The RRCF model may include: a model construction (Mktree) module, a forget (Forget) module, an insert module, and an anomaly assessment module (Codisp), etc.

[0106] The model construction is used to input a sample set to construct each individual model and initialize the individual model.

[0107] The forget module is used to delete relevant information in a single model.

[0108] A new module is added to insert related information into a single model.

[0109] S203: Determine the difference information between the preset RRCF model and the RRCF model after the new operation, and determine the detection result according to the difference information.

[0110] The detection result indicates whether the network access volume is abnormal.

[0111] In this embodiment, the following is introduced: a forgetting operation (which can be understood as a deletion operation and can be implemented by a forgetting module in the preset RRCF model) is performed on the historical traffic sequence in the preset RRCF model according to the real-time data flow, and a adding operation (which can be understood as an insertion operation and can be implemented by a adding module in the preset RRCF model) is performed on the RRCF model after the forgetting operation (i.e., the RRCF model after the deletion operation) based on the current traffic sequence to obtain the RRCF model after the adding operation, and whether the network access volume is abnormal is determined by the preset RRCF model and the RRCF model after the adding operation. On the one hand, through the above-mentioned introduced features, the problem of low detection accuracy and reliability caused by the method based on the above-mentioned first related technology can be avoided, and the problem of high cost and low accuracy caused by the method based on the above-mentioned second related technology can also be avoided, which reduces the difficulty of analysis, improves the accuracy and reliability of detection, and achieves the technical effect of saving resources and costs.

[0112] See also Figure 3 , Figure 3 This is a flowchart of a method for detecting network access volume according to another embodiment of the present application.

[0113] like Figure 3 As shown, the method includes:

[0114] S301: Acquire real-time data stream.

[0115] The data flow includes information generated by generating orders based on network access.

[0116] For example, for the description of S301, reference may be made to part of the description of S201, which will not be repeated here.

[0117] S302: constructing an initial traffic sequence within a first number of time sliding windows according to the real-time data stream.

[0118] Among them, the flow sequence is used to characterize the sequence of order quantities.

[0119] For example, for the description of the traffic sequence, please refer to the partial description in S201, which will not be repeated here.

[0120] For example, Figure 4 As shown, the detection device can construct an initial traffic sequence of a first number of (2n-1) time sliding windows, where n is a positive integer greater than 1.

[0121] Among them, t_0 can be understood as the time when the first time sliding window starts, t_1 can be understood as the time when the first time sliding window ends, and so on, which are not listed here one by one.

[0122] In such Figure 4 In the schematic diagram of the time sliding window shown, n can be the number of time sliding windows, and t can be the time of the time sliding window, that is, the time of a time sliding window is t. If the unit of t is minutes, the total time of the first number T=t*(2n-1).

[0123] For example, if n=4, t=5 minutes, the total time T of the first quantity is 35 minutes.

[0124] Accordingly, this step can be understood as follows: the initial traffic sequence is a traffic sequence consisting of four time sliding windows within 35 minutes, that is, a sequence consisting of the order quantities of the four time sliding windows.

[0125] S303: performing additional migration conversion processing on the initial traffic sequence according to the preset adjustment traffic.

[0126] The flow rate adjustment may be set by the detection device based on demand, historical records, and tests, etc., and this embodiment does not limit this.

[0127] For example, if the initial traffic sequence is Adjust the flow rate to c, and the sequence after migration conversion is Then the sequence after migration transformation is It can be expressed by formula 1:

[0128]

[0129] That is to say, in this embodiment, the initial flow sequence can be adjusted based on the flow c. The order volume in each time sliding window in is added by c, so as to obtain the sequence after migration transformation. Through migration and conversion processing, we can avoid the disadvantage of low comprehensiveness of detection due to the small order volume in some time sliding windows in the initial traffic sequence being ignored, thereby improving the technical effect of comprehensiveness and reliability of detection.

[0130] S304: Determine flow attribute information of the initial flow sequence within a second number of time sliding windows according to the distribution information of the initial flow sequence.

[0131] The traffic attribute information includes the current traffic sequence and the traffic index. The first number is greater than the second number. The traffic index is used to characterize the magnitude of the increase or decrease in traffic when the initial traffic sequence is converted to the current traffic sequence.

[0132] For example, in combination with the above example, if the first number is (2n-1), the second number may be n. That is, it can be understood as: converting the traffic sequence in the time sliding window of (2n-1) into the traffic sequence in the time sliding window of n.

[0133] For example, the distribution information of the initial traffic sequence can be processed by pan-Gaussianization, that is, by converting the sequence after migration transformation Perform pan-Gaussian processing, which can be specifically expressed by formula 2:

[0134]

[0135] in, is the pan-Gaussian processing function, x i For sequence The size of the i-th flow element in , where 0≤i<n.

[0136] Accordingly, based on Formula 2, we can combine Formula 3 to get the current traffic sequence: Formula 3:

[0137]

[0138] Accordingly, the flow index ρ can be obtained based on Formula 2 and Formula 4:

[0139]

[0140] It is worth noting that, in this embodiment, by converting the initial traffic sequence within the time sliding window of the first data volume into the traffic attributes within the time sliding window of the second volume (including the current traffic sequence and the traffic index), the amplitude of the traffic increase or decrease can be determined more accurately, so that the detection result can be determined relatively accurately based on the traffic index and the current traffic sequence, thereby improving the technical effect of the accuracy and reliability of the detection.

[0141] S305: Determine the data flow number of the current data flow relative to all data flows according to the current data flow, the historical data flows, and the node information of the preset RRCF model.

[0142] The node information includes the quantity information of the flow sequence in the preset RRCF model;

[0143] In combination with the above embodiments, it can be known that the RRCF model is a preset RRCF model, and will undergo a forgetting operation and a new adding operation respectively. In order to distinguish the RRCF models at different stages and facilitate reading and understanding, in this embodiment, the initial RRCF model, that is, the preset RRCF model is called the first RRCF model, the RRCF model that has undergone the forgetting operation is called the second RRCF model, and the RRCF model that has undergone the new adding operation is called the third RRCF model.

[0144] All data flows include historical data flows and current data flows. The data flow numbering can be understood as follows: each data flow is numbered in the first RRCF model. That is, different data flows can be distinguished according to the data flow numbering in the RRCF model.

[0145] In some embodiments, the first RRCF model can count and number each data stream. Specifically, the built-in counter function of Java (Int type data) can be used, and the node information of a single model (such as the number of leaf nodes of a single model, etc.) is used as the initial value of the counter. Each time a data stream is processed, the counter automatically increases by 1. When the maximum counting range is exceeded (that is, the positive maximum value is exceeded), the Java counter will start to return the negative maximum value of the Int type, and count in a cycle.

[0146] And the data stream number index can be determined by formula 5, formula 5:

[0147]

[0148] Among them, v is the value returned by the counter, and z is the node information of a single model (such as the number of leaf nodes of a single model, etc.).

[0149] S306: According to the data flow sequence number and the node information, determine whether the current traffic sequence corresponds to the traffic sequence number in the preset RRCF model.

[0150] For example, the current traffic sequence may correspond to the traffic sequence number idx in the preset RRCF model through Formula 6:

[0151] idx=index%z(0≤idx<z}

[0152] S307: Perform a forgetting operation on the historical traffic sequence corresponding to the traffic sequence number in the preset RRCF model.

[0153] That is, the historical traffic sequence corresponding to the traffic sequence number in the first RRCF model is deleted to obtain the second RRCF model.

[0154] It is worth noting that before performing the forgetting operation on the first RRCF model, the (random) Gaussian distribution model may be initialized based on preset parameters to obtain the first RRCF model.

[0155] Specifically, the first RRCF model model can be obtained by combining equations 7 to 9, where equation 7:

[0156]

[0157] Among them, Matrix is ​​a matrix data set (one of the preset parameters), randomG i，j Randomly generate data that conforms to the Gaussian distribution for the i-th row and j-th column, is a matrix data set with z rows and n columns.

[0158] Formula 8:

[0159]

[0160] Among them, RCTree is a dataset The single random cut tree model (i.e. single model) generated.

[0161] Formula 9:

[0162] model = RRCF{RCTree k |1≤k≤N}

[0163] Among them, the first RRCF model can be understood as a model composed of N single models.

[0164] In some embodiments, the forget operation can be expressed by Equation 9:

[0165] model = RRCF{Forget(idx) k |1≤k≤N}

[0166] Among them, Forget(idx) k Perform a forget operation on the historical traffic sequence of the kth RCTree with the traffic sequence number idx.

[0167] It is worth noting that, in this embodiment, by performing the forgetting operation based on the data stream sequence number, the content of the forgetting operation can be determined relatively quickly and accurately, thereby improving the accuracy and reliability of the forgetting operation.

[0168] Moreover, especially when the traffic sequence number is determined based on the data flow sequence number and the historical traffic sequence corresponding to the traffic sequence number is forgotten, the historical traffic sequence on which the forgetting operation is performed can be accurately located, thereby further improving the technical effect of the reliability and accuracy of the forgetting operation.

[0169] S308: Perform a new operation of inserting the current traffic sequence at the position corresponding to the traffic sequence number in the RRCF model after the forgetting operation to obtain the RRCF model after the new operation.

[0170] Combined with the above example, this step can be understood as: inserting the current traffic sequence into the position corresponding to the traffic sequence number in the second RRCF model to obtain the third RRCF model.

[0171] In some embodiments, the forget operation can be expressed by Equation 10:

[0172]

[0173] in, Perform the current flow sequence for the kth RCTree Added operation with traffic sequence number idx.

[0174] Similarly, in this embodiment, by determining the location for performing the new operation and inserting the current traffic sequence based on the determined location, the technical effect of the accuracy and reliability of the new operation can be improved.

[0175] S309: Determine the difference information between the preset RRCF model and the RRCF model after the new operation.

[0176] For example, see Figure 5 ,like Figure 5 The left figure is the first RRCF model (including structures a, b, and c), and the right figure is the third RRC model (the current traffic sequence is added to the first RRCF model, and X is used in the figure to represent the structure of the current traffic sequence). The difference information can be understood as Figure 5 The left picture and Figure 5 The right side of the figure shows the extent to which the structure of the RRCF model has changed.

[0177] S310: Determine the current traffic sequence based on the difference information The abnormal score.

[0178] In some embodiments, the anomaly score may be determined by Formula 11:

[0179]

[0180] Among them, Codisp(idx) k For difference information.

[0181] S311: Determine the detection result according to the anomaly score and the traffic index.

[0182] For example, if the traffic index indicates that the traffic is increasing, and the difference information is greater than a preset difference threshold, it is determined that the network access volume is abnormal.

[0183] The difference threshold may be set by the detection device based on demand, historical records, and experiments, etc., and is not limited in this embodiment.

[0184] If the traffic index indicates that the traffic is increasing, the increase in traffic is greater than a preset first threshold, and the difference information is greater than a preset difference threshold, it is determined that the network access volume is abnormal.

[0185] Similarly, the first threshold value can be set by the detection device based on demand, historical records, and experiments, etc., and this embodiment does not limit this.

[0186] If the traffic index indicates that the traffic is increasing, and the increase in the traffic is less than a preset first threshold, it is determined that the network access volume is normal.

[0187] If the traffic index indicates that the traffic is decreasing, it is determined that the network access volume is normal.

[0188] S312: If the detection result indicates that the network access volume is abnormal, an abnormal prompt message is generated and output.

[0189] In this embodiment, by determining the detection result more reliably and accurately based on the above method, and generating and outputting an abnormal prompt message when the detection result is an abnormal network access volume, an immediate warning can be achieved, thereby improving the technical effect of the security of platform operation.

[0190] See also Figure 6 , Figure 6 A schematic diagram of a network access volume detection device according to an embodiment of the present application.

[0191] like Figure 6 As shown, the network access volume detection device 600 includes:

[0192] The acquisition unit 601 is used to acquire a real-time data stream, wherein the data stream includes information generated by generating an order based on network access.

[0193] The first determining unit 602 is used to determine a current flow sequence of the real-time data stream, wherein the flow sequence is used to characterize a sequence of order quantities.

[0194] The forgetting unit 603 is used to perform a forgetting operation on the historical traffic sequence in the preset anomaly detection RRCF model according to the real-time data flow, wherein the historical traffic sequence is determined based on the historical data flow.

[0195] The adding unit 604 is used to perform a adding operation on the RRCF model after the forgetting operation based on the current traffic sequence to obtain the RRCF model after the adding operation.

[0196] The second determination unit 605 is used to determine the difference information between the preset RRCF model and the RRCF model after the new addition operation.

[0197] The third determining unit 606 is used to determine a detection result according to the difference information, wherein the detection result indicates whether the network access volume is abnormal.

[0198] See also Figure 7 , Figure 7 It is a schematic diagram of a network access volume detection device according to another embodiment of the present application.

[0199] like Figure 7 As shown, the network access volume detection device 700 includes:

[0200] The acquisition unit 701 is used to acquire a real-time data stream, wherein the data stream includes information generated by generating an order based on network access.

[0201] The first determining unit 702 is used to determine a current flow sequence of the real-time data stream, wherein the flow sequence is used to characterize a sequence of order quantities.

[0202] Combination Figure 7 It can be seen that, in some embodiments, the first determining unit 702 includes:

[0203] The construction subunit 7021 is used to construct an initial traffic sequence within a first number of time sliding windows according to the real-time data stream.

[0204] The adding subunit 7022 is used to perform an additional migration conversion process on the initial flow sequence of the preset adjustment flow pair.

[0205] The first determination subunit 7023 is used to determine the flow attribute information of the initial flow sequence within a second number of time sliding windows according to the distribution information of the initial flow sequence, wherein the flow attribute information includes the current flow sequence, and the first number is greater than the second number.

[0206] The forgetting unit 703 is used to perform a forgetting operation on the historical traffic sequence in the preset anomaly detection RRCF model according to the real-time data stream, wherein the historical traffic sequence is determined based on the historical data stream.

[0207] Combination Figure 7 It can be seen that, in some embodiments, the forgetting unit 703 includes:

[0208] The second determination subunit 7031 is used to determine the data flow number of the current data flow relative to all data flows based on the current data flow, historical data flows, and node information of a preset RRCF model, wherein the node information includes the quantity information of the traffic sequences in the preset RRCF model.

[0209] The forgetting subunit 7032 is used to perform a forgetting operation on the historical traffic sequence in the preset RRCF model according to the data stream sequence number.

[0210] In some embodiments, the forgetting subunit 7032 includes:

[0211] The determination module is used to determine, based on the data stream sequence number and node information, whether the current traffic sequence corresponds to the traffic sequence number in the preset RRCF model.

[0212] The forgetting module is used to perform a forgetting operation on the historical traffic sequence corresponding to the traffic sequence number in the preset RRCF model.

[0213] The adding unit 704 is used to perform a adding operation on the RRCF model after the forgetting operation based on the current traffic sequence to obtain the RRCF model after the adding operation.

[0214] In some embodiments, the adding unit 704 is used to perform a adding operation of inserting the current traffic sequence at a position corresponding to the traffic sequence number in the RRCF model after the forgetting operation to obtain the RRCF model after the adding operation.

[0215] The second determination unit 705 is used to determine the difference information between the preset RRCF model and the RRCF model after the new addition operation.

[0216] The third determining unit 706 is used to determine a detection result according to the difference information, wherein the detection result indicates whether the network access volume is abnormal.

[0217] In some embodiments, the traffic attribute information also includes a traffic index, which is used to characterize the magnitude of the increase or decrease in traffic when the initial traffic sequence is converted to the current traffic sequence; the third determination unit 706 is used to determine that the network access flow is abnormal if the traffic index characterizes that the traffic is increasing, the magnitude of the increase in traffic is greater than a preset first threshold, and the difference information is greater than a preset difference threshold; if the traffic index characterizes that the traffic is increasing, and the magnitude of the increase in traffic is less than the preset first threshold, then the network access volume is determined to be normal; or, if the traffic index characterizes that the traffic is decreasing, then the network access volume is determined to be normal.

[0218] The generating unit 707 is configured to generate an abnormality prompt message if the network access flow is abnormal.

[0219] The output unit 708 is used to output an abnormality prompt message.

[0220] According to an embodiment of the present application, the present application also provides an electronic device and a readable storage medium.

[0221] According to an embodiment of the present application, the present application also provides a computer program product, the program product includes: a computer program, the computer program is stored in a readable storage medium, at least one processor of an electronic device can read the computer program from the readable storage medium, and at least one processor executes the computer program so that the electronic device executes the solution provided by any of the above embodiments.

[0222] like Figure 8, is a block diagram of an electronic device according to a method for detecting network access according to an embodiment of the present application. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workbenches, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples, and are not intended to limit the implementation of the present application described and / or required herein.

[0223] like Figure 8 As shown, the electronic device includes: one or more processors 801, memory 802, and interfaces for connecting various components, including high-speed interfaces and low-speed interfaces. Various components are interconnected using different buses and can be installed on a common mainboard or installed in other ways as needed. The processor can process instructions executed in the electronic device, including instructions stored in or on the memory to display the graphical information of the GUI on an external input / output device (such as a display device coupled to the interface). In other embodiments, if necessary, multiple processors and / or multiple buses can be used together with multiple memories and multiple memories. Similarly, multiple electronic devices can be connected, and each device provides some necessary operations (for example, as a server array, a group of blade servers, or a multi-processor system). Figure 8 A processor 801 is taken as an example.

[0224] The memory 802 is a non-transient computer-readable storage medium provided in the present application. The memory stores instructions executable by at least one processor to enable the at least one processor to perform the network access volume detection method provided in the present application. The non-transient computer-readable storage medium of the present application stores computer instructions, which are used to enable a computer to perform the network access volume detection method provided in the present application.

[0225] The memory 802 is a non-transient computer-readable storage medium that can be used to store non-transient software programs, non-transient computer executable programs and modules, such as program instructions / modules corresponding to the network access volume detection method in the embodiment of the present application. The processor 801 executes various functional applications and data processing of the server by running the non-transient software programs, instructions and modules stored in the memory 802, that is, the network access volume detection method in the above method embodiment is implemented.

[0226] The memory 802 may include a program storage area and a data storage area, wherein the program storage area may store an operating system and an application required by at least one function; the data storage area may store data created by the use of an electronic device according to the method for detecting network access volume, etc. In addition, the memory 802 may include a high-speed random access memory, and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some embodiments, the memory 802 may optionally include a memory remotely arranged relative to the processor 801, and these remote memories may be connected to the electronic device of the method for detecting network access volume via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0227] The electronic device of the network access volume detection method may further include: an input device 803 and an output device 804. The processor 801, the memory 802, the input device 803 and the output device 804 may be connected via a bus or other means. Figure 8 The example of connecting through bus is taken in the following.

[0228] The input device 803 can receive input digital or character information, and generate key signal input related to user settings and function control of the electronic device of the network access detection method, such as a touch screen, a keypad, a mouse, a track pad, a touch pad, an indicator rod, one or more mouse buttons, a trackball, a joystick and other input devices. The output device 804 may include a display device, an auxiliary lighting device (e.g., an LED) and a tactile feedback device (e.g., a vibration motor), etc. The display device may include, but is not limited to, a liquid crystal display (LCD), a light emitting diode (LED) display and a plasma display. In some embodiments, the display device may be a touch screen.

[0229] Various implementations of the systems and techniques described herein can be realized in digital electronic circuit systems, integrated circuit systems, dedicated ASICs (application specific integrated circuits), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0230] These computer programs (also referred to as programs, software, software applications, or code) include machine instructions for programmable processors and can be implemented using high-level procedural and / or object-oriented programming languages, and / or assembly / machine languages. As used herein, the terms "machine-readable medium" and "computer-readable medium" refer to any computer program product, device, and / or means (e.g., disk, optical disk, memory, programmable logic device (PLD)) for providing machine instructions and / or data to a programmable processor, including a machine-readable medium that receives machine instructions as a machine-readable signal. The term "machine-readable signal" refers to any signal for providing machine instructions and / or data to a programmable processor.

[0231] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user can provide input to the computer. Other types of devices can also be used to provide interaction with the user; for example, the feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including acoustic input, voice input, or tactile input).

[0232] The systems and techniques described herein may be implemented in a computing system that includes back-end components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes front-end components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such back-end components, middleware components, or front-end components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), and the Internet.

[0233] A computer system may include clients and servers. Clients and servers are generally remote from each other and usually interact through a communication network. The relationship of client and server is generated by computer programs running on respective computers and having a client-server relationship to each other.

[0234] Those skilled in the art will readily appreciate other embodiments of the present disclosure after considering the specification and practicing the invention disclosed herein. This application is intended to cover any variations, uses or adaptations of the present disclosure that follow the general principles of the present disclosure and include common knowledge or customary techniques in the art that are not disclosed in the present disclosure. The specification and examples are intended to be exemplary only, and the true scope and spirit of the present disclosure are indicated by the following claims.

[0235] It should be understood that the present disclosure is not limited to the exact structures that have been described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof. The scope of the present disclosure is limited only by the appended claims.

Claims

1. A method for detecting network access volume, include: Acquire a real-time data stream and determine a current flow sequence of the real-time data stream, wherein the data stream includes information generated by generating an order based on network access, and the flow sequence is used to characterize a sequence of order quantities; Performing a forgetting operation on a historical traffic sequence in a preset anomaly detection RRCF model according to the real-time data stream, and performing a new adding operation on the RRCF model after the forgetting operation based on the current traffic sequence to obtain the RRCF model after the new adding operation, wherein the historical traffic sequence is determined based on the historical data stream; Determine difference information between the preset RRCF model and the RRCF model after the newly added operation, and determine a detection result according to the difference information, wherein the detection result indicates whether the network access volume is abnormal; The determining of the detection result according to the difference information includes: If the traffic index indicates that the traffic is increasing, the increase in the traffic is greater than a preset first threshold, and the difference information is greater than a preset difference threshold, it is determined that the network access flow is abnormal; If the traffic index indicates that the traffic is increasing, and the increase in the traffic is less than a preset first threshold, then the network access volume is determined to be normal; or, if the traffic index indicates that the traffic is decreasing, then the network access volume is determined to be normal, wherein the traffic index is used to indicate the increase or decrease in the traffic when the initial traffic sequence is converted to the current traffic sequence.

2. The method according to claim 1, in, Determining a current flow sequence of the real-time data stream includes: Constructing an initial traffic sequence within a first number of time sliding windows according to the real-time data stream; Based on the distribution information of the initial traffic sequence, traffic attribute information of the initial traffic sequence within a second number of time sliding windows is determined, wherein the traffic attribute information includes the current traffic sequence, and the first number is greater than the second number.

3. The method according to claim 2, after constructing the initial traffic sequence in the first number of time sliding windows according to the real-time data stream, further include: The initial flow sequence is subjected to an additional migration conversion process according to the preset adjustment flow.

4. According to the method of any one of claims 1 to 3, a forgetting operation is performed on the historical traffic sequence in the preset anomaly detection RRCF model according to the real-time data stream, include: Determine the data stream number of the current data stream relative to all data streams according to the current data stream, the historical data stream, and the node information of the preset RRCF model, wherein the node information includes the quantity information of the traffic sequence in the preset RRCF model; A forgetting operation is performed on the historical traffic sequence in the preset RRCF model according to the data stream sequence number.

5. The method according to claim 4, in, Performing a forgetting operation on the historical traffic sequence in the preset RRCF model according to the data stream sequence number includes: Determining, according to the data stream sequence number and the node information, that the current traffic sequence corresponds to the traffic sequence number in the preset RRCF model; A forgetting operation is performed on the historical traffic sequence corresponding to the traffic sequence number in the preset RRCF model.

6. The method according to claim 5, in, Based on the current traffic sequence, a new operation is performed on the RRCF model after the forgetting operation to obtain the RRCF model after the new operation, including: At the position corresponding to the traffic sequence number in the RRCF model after the forgetting operation, a new addition operation of inserting the current traffic sequence is performed to obtain the RRCF model after the new addition operation.

7. The method according to any one of claims 1 to 3, further comprising: include: If the network access flow is abnormal, an abnormal prompt message is generated and output.

8. A device for detecting network access volume, include: An acquisition unit, used to acquire a real-time data stream, wherein the data stream includes information generated based on network access to generate an order; A first determining unit is used to determine a current flow sequence of the real-time data stream, wherein the flow sequence is used to characterize a sequence of order quantities; A forgetting unit, configured to perform a forgetting operation on a historical traffic sequence in a preset anomaly detection RRCF model according to the real-time data stream, wherein the historical traffic sequence is determined based on the historical data stream; A new adding unit, configured to perform a new adding operation on the RRCF model after the forgetting operation based on the current traffic sequence, so as to obtain the RRCF model after the new adding operation; A second determining unit, configured to determine difference information between the preset RRCF model and the RRCF model after the new addition operation; A third determining unit, configured to determine a detection result according to the difference information, wherein the detection result indicates whether the network access volume is abnormal; The third determination unit is specifically configured to determine that the network access flow is abnormal if the flow index indicates that the flow is increasing, the increase in the flow is greater than a preset first threshold, and the difference information is greater than a preset difference threshold; If the traffic index indicates that the traffic is increasing, and the increase in the traffic is less than a preset first threshold, then the network access volume is determined to be normal; or, if the traffic index indicates that the traffic is decreasing, then the network access volume is determined to be normal, wherein the traffic index is used to indicate the increase or decrease in the traffic when the initial traffic sequence is converted to the current traffic sequence.

9. An electronic device, include: Memory, processor; Memory; a memory for storing instructions executable by the processor; The processor is configured to execute the method as claimed in any one of claims 1 to 7.

10. A computer-readable storage medium, wherein the computer-readable storage medium stores computer-executable instructions, wherein the computer-executable instructions are used to implement the method according to any one of claims 1 to 7 when executed by a processor.

11. A computer program product comprising a computer program, which, when executed by a processor, implements the method according to any one of claims 1 to 7.

Images