Method and device for determining flow determination scheme, electronic device and storage medium

Abstract

The present application provides a method and device for determining a flow determination scheme, an electronic device, and a storage medium, wherein the method includes: obtaining the target flow generated when a target service is triggered, wherein the target service is the advertising service generated by the advertising provider when providing advertisements, and the target flow is the flow consumed by running the target service; extracting multiple reference features corresponding to the execution of the target service according to multiple preset time units, wherein the reference features are used to characterize the number of target services executed within multiple preset time units; determining the importance value of the reference features using a target model; determining the target features according to the importance value, and obtaining an updated flow determination scheme, wherein the target features are a subset of the reference features. Through the present application, the problem of insufficient abnormal flow determination existing in the related art is solved.

Description

Technical Field

[0001] The present application relates to the field of data processing, and in particular to a method and device for determining a flow determination scheme, an electronic device, and a storage medium. Background Art

[0002] Advertising is one of the main revenue sources of the Internet industry. As short videos, social media, and mobile Internet become more and more developed, advertisers are beginning to move towards the Internet and their pace is irreversible. At the same time, abnormal traffic and data fraud are chronic diseases in the digital marketing industry. With the trend of traffic conversion and data assetization, problems such as advertising anomalies, false traffic, advertising fraud, user data abuse, and privacy information leakage often occur, resulting in waste of social resources and property losses, and posing new challenges to the advertising industry. In order to protect the interests of advertisers, the advertising industry needs third-party data service providers to ensure the authenticity of brand advertising and create a highly transparent advertising environment for brands and consumers.

[0003] The relevant technologies are mainly based on the abnormal traffic business rules summarized in the field of digital advertising, such as obviously abnormal high-speed, continuous or repeated request traffic, or excessive exposure or clicks of the same user on the same ad space in multiple time windows as the judgment of abnormal traffic business. Another type of technology is to set up an anti-crawler mechanism, which detects exposure / clicks from robots and crawlers disguised as legitimate users, and determines it as abnormal traffic. However, the rules for abnormal advertising traffic analyzed and judged manually are relatively simple and crude, and the existing commonly used abnormal traffic business rules are easily detected by abnormal traffic, that is, when many cheating software are upgraded, abnormal traffic will not be detected or judged.

[0004] Therefore, there is a problem in the related art that abnormal flow determination is insufficient. Summary of the invention

[0005] The present application provides a method and device for determining a flow determination scheme for abnormal flow, an electronic device and a storage medium, so as to at least solve the problem of insufficient abnormal flow determination in the related art.

[0006] According to one aspect of an embodiment of the present application, a method for determining a traffic determination scheme is provided, the method comprising: obtaining a target traffic generated when a target service is triggered, wherein the target service is an advertising service generated by an advertising provider when providing advertisements, and the target traffic is the traffic consumed by running the target service; extracting a plurality of reference features corresponding to the execution of the target service based on a plurality of preset time units, wherein the reference features are used to characterize the number of target services executed within a plurality of preset time units; determining an importance value of the reference features using a target model; determining the target features based on the importance values, and obtaining an updated traffic determination scheme, wherein the target features are a subset of the reference features.

[0007] According to another aspect of an embodiment of the present application, a device for determining a traffic determination scheme is also provided, and the device includes: a first acquisition unit, used to acquire a target traffic generated when a target service is triggered, wherein the target service is an advertising service generated by an advertising provider when providing advertisements, and the target traffic is the traffic consumed by running the target service; an extraction unit, used to extract a plurality of reference features corresponding to the execution of the target service according to a plurality of preset time units, wherein the reference features are used to characterize the number of target services executed within a plurality of preset time units; a determination unit, used to determine an importance value of the reference feature using a target model; and an obtaining unit, used to determine the target feature according to the importance value, and obtain an updated traffic determination scheme, wherein the target feature is a subset of the reference feature.

[0008] Optionally, the obtaining unit includes: a first obtaining module, used to obtain historical analysis data corresponding to the business scenario according to the business scenario of the target business, wherein the historical analysis data is data associated with the target business judged by the business personnel; a sorting module, used to sort the importance values ​​according to the historical analysis data to obtain a sorting result;

[0009] The screening module is used to screen out target features from reference features using the sorting results.

[0010] Optionally, the obtaining unit includes: a second obtaining module, for generating a corresponding first rule by using the target feature, adding the first rule to the flow determination database, and obtaining an updated flow determination scheme;

[0011] or,

[0012] The third module is used to modify the determination condition threshold set in the initial flow determination scheme by using the target feature, generate the corresponding second rule according to the modified determination condition threshold, add the second rule to the flow determination database, and obtain the updated flow determination scheme.

[0013] Optionally, the preset time unit is a preset time window, and the extraction unit includes: a first determination module, used to determine multiple preset time windows, wherein the preset time windows include: a date time window, an hour time window, a minute time window, and a second time window; a first acquisition module, used to obtain the number of device accounts executing the target business within each preset time window; and a first setting module, used to set the number of device accounts as a reference feature.

[0014] Optionally, the device also includes: a second acquisition unit, which is used to obtain the maximum value of the number of device accounts, the minimum value of the number of device accounts, the mean value of the number of device accounts, and the variance value of the number of device accounts in each preset time window after obtaining the number of device accounts executing the target business in each preset time window; and a first setting unit, which is used to set the maximum value of the number of device accounts, the minimum value of the number of device accounts, the mean value of the number of device accounts, and the variance value of the number of device accounts in each preset time window as reference features.

[0015] Optionally, the preset time unit is a preset time period, and the extraction unit includes: a second determination module, used to determine multiple preset time periods, wherein the preset time periods include: a date time period, an hour time period, a minute time period, and a second time period; a second acquisition module, used to obtain the number of device accounts that execute the target business within each preset time period; and a second setting module, used to set the number of device accounts as a reference feature.

[0016] Optionally, the device also includes: a third acquisition unit, which is used to obtain the maximum value of the number of device accounts, the minimum value of the number of device accounts, the mean value of the number of device accounts, and the variance value of the number of device accounts in each preset time period after obtaining the number of device accounts that execute the target business in each preset time period; and a second setting unit, which is used to set the maximum value of the number of device accounts, the minimum value of the number of device accounts, the mean value of the number of device accounts, and the variance value of the number of device accounts in each preset time period as reference features.

[0017] According to another aspect of the embodiments of the present application, there is also provided an electronic device, including a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other via the communication bus; wherein the memory is used to store a computer program; and the processor is used to execute the method steps in any of the above embodiments by running the computer program stored in the memory.

[0018] According to another aspect of the embodiments of the present application, a computer-readable storage medium is provided, in which a computer program is stored, wherein the computer program is configured to execute the method steps in any of the above embodiments when executed.

[0019] The present application can be applied to the field of data capabilities for data mining. In the embodiment of the present application, by obtaining the target traffic generated when the target business is triggered, wherein the target business is the advertising business generated by the advertising provider when providing advertisements, and the target traffic is the traffic consumed by running the target business; according to multiple preset time units, extract multiple reference features corresponding to the execution of the target business, wherein the reference feature is used to characterize the number of target businesses executed within multiple preset time units; use the target model to determine the importance value of the reference feature; determine the target feature according to the importance value, and obtain an updated traffic determination scheme, wherein the target feature is a subset of the reference feature. Since the embodiment of the present application uses the number of target businesses executed within multiple preset time units, inputs it into the target model, obtains the importance of the reference feature corresponding to each preset time unit, and then uses the importance to screen out some target features to update the existing traffic determination scheme, obtain an updated traffic determination scheme, and use the updated traffic determination scheme as the final abnormal traffic determination rule, thereby realizing the supplement of the existing advertising abnormal traffic rules, making the existing traffic determination scheme more abundant in the rules for determining abnormal traffic, improving the accuracy of abnormal traffic determination, and thus solving the problem of insufficient abnormal traffic determination in the related art. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the invention and, together with the description, serve to explain the principles of the invention.

[0021] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0022] Figure 1 is a schematic diagram of a hardware environment of a method for determining an optional flow determination solution according to an embodiment of the present invention;

[0023] Figure 2 It is a flow chart of a method for determining an optional flow determination solution according to an embodiment of the present application;

[0024] Figure 3 It is a schematic diagram of an interface for forming a new flow determination rule for a target feature according to an embodiment of the present application;

[0025] Figure 4 It is a partial schematic diagram of the number of records included in different preset time units provided according to an embodiment of the present application;

[0026] Figure 5 It is a structural block diagram of a determination device of an optional flow determination solution according to an embodiment of the present application;

[0027] Figure 6 It is a structural block diagram of an optional electronic device according to an embodiment of the present application. DETAILED DESCRIPTION

[0028] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present application.

[0029] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0030] According to one aspect of an embodiment of the present application, a method for determining a flow determination scheme is provided. Optionally, in this embodiment, the method for determining a flow determination scheme can be applied to Figure 1 In the hardware environment shown in the figure. Figure 1 As shown, the terminal 102 may include a memory 104, a processor 106, and a display 108 (optional component). The terminal 102 may be connected to a server 112 via a network 110 for communication. The server 112 may be used to provide services (such as application services, etc.) for the terminal or a client installed on the terminal. A database 114 may be set on the server 112 or independently of the server 112 to provide data storage services for the server 112. In addition, a processing engine 116 may be running in the server 112, and the processing engine 116 may be used to execute the steps executed by the server 112.

[0031] Optionally, the terminal 102 may be, but is not limited to, a terminal that can calculate data, such as a mobile terminal (e.g., a mobile phone, a tablet computer), a laptop, a PC (Personal Computer), etc. The above network may include, but is not limited to, a wireless network or a wired network. The wireless network includes: Bluetooth, WIFI (Wireless Fidelity) and other networks that implement wireless communication. The above wired network may include, but is not limited to: a wide area network, a metropolitan area network, and a local area network. The above server 112 may include, but is not limited to, any hardware device that can perform calculations.

[0032] In addition, in this embodiment, the method for determining the flow determination scheme can also be applied to, but not limited to, an independent processing device with a relatively powerful processing capability without data interaction. For example, the processing device can be, but not limited to, a terminal device with a relatively powerful processing capability, that is, each operation in the method for determining the flow determination scheme can be integrated into an independent processing device. The above is only an example, and this embodiment does not make any limitation to this.

[0033] Optionally, in this embodiment, the method for determining the flow determination scheme may be executed by the server 112, or by the terminal 102, or by both the server 112 and the terminal 102. The method for determining the flow determination scheme of the embodiment of the present application may be executed by the terminal 102 or by a client installed thereon.

[0034] Take running on the server as an example, Figure 2 is a flow chart of a method for determining an optional flow determination solution according to an embodiment of the present application, such as Figure 2 As shown, the process of the method may include the following steps:

[0035] Step S201, obtaining target traffic generated when a target service is triggered, wherein the target service is an advertising service generated when an advertisement provider provides advertisements, and the target traffic is the traffic consumed by running the target service.

[0036] Optionally, in an embodiment of the present application, the scenario is to determine the traffic generated when various short videos, social media, etc. appear in the advertising field. Therefore, the embodiment of the present application uses a server to obtain the target traffic generated by a target business when it is triggered. It can be understood that the target business here can be the advertising provider's business of placing any advertisement, such as xxx advertising business. Then, when running the advertising business, a certain amount of data traffic is required to support it, so when the target business is triggered, a target traffic will be generated, and the target traffic is exactly the traffic required to run the target business.

[0037] In addition, the target traffic contains normal traffic samples and abnormal traffic samples. The abnormal traffic samples can be derived from the seed blacklist and existing business rules, and the normal traffic samples can be randomly sampled from the data excluding known abnormal traffic. The ratio of normal and abnormal traffic samples can be 2:1.

[0038] Step S202: extracting a plurality of reference features corresponding to the execution of the target service according to a plurality of preset time units, wherein the reference features are used to characterize the number of the target service executed within the plurality of preset time units.

[0039] Optionally, the embodiment of the present application sets multiple preset time units in advance, and uses the multiple preset time units to extract multiple reference features corresponding to the above-mentioned target business, wherein the reference feature is the number of times (or quantities) corresponding to when the target business is triggered (or executed). It can be understood that the preset time unit can be any unit time, and its value can be obtained based on the historical experience of the business personnel, such as 30 days, 18 hours, etc. The embodiment of the present application does not specifically limit the value of the preset time unit.

[0040] Step S203: Determine the importance value of the reference feature using the target model.

[0041] Optionally, the importance of the reference features is obtained through the target model to obtain an importance value. For example, the random forest algorithm can output the importance of each extracted reference feature after the data training is completed.

[0042] Step S204, determining the target feature according to the importance value, and obtaining an updated flow determination scheme, wherein the target feature is a subset of the reference feature.

[0043] Optionally, the importance value (ie, degree of importance) of each reference feature is used to screen out target features, wherein the target features are a subset of the reference features. For example, there are 200 reference features, and the target features are 100 of them selected from the reference features.

[0044] Then, the target feature is used as a new feature to be added to the existing flow determination scheme to obtain an updated flow determination scheme. It can be understood that the flow determination scheme is used to determine abnormal flow, so the updated flow determination scheme also has the function of abnormal flow determination.

[0045] In an embodiment of the present application, by obtaining the target traffic generated when the target service is triggered, wherein the target service is the advertising service generated by the advertising provider when providing advertisements, and the target traffic is the traffic consumed by running the target service; according to multiple preset time units, multiple reference features corresponding to the execution of the target service are extracted, wherein the reference features are used to characterize the number of target services executed within multiple preset time units; the importance value of the reference features is determined by using the target model; the target features are determined according to the importance value, and an updated traffic determination scheme is obtained, wherein the target features are a subset of the reference features. Since the embodiment of the present application uses the number of target services executed within multiple preset time units, inputs it into the target model, obtains the importance of the reference features corresponding to each preset time unit, and then uses the importance to screen out some target features to update the existing traffic determination scheme (i.e., rules), obtain an updated traffic determination scheme, and use the updated traffic determination scheme as the final abnormal traffic determination rule, thereby realizing the supplement of the existing advertising abnormal traffic rules, making the existing traffic determination scheme more abundant in the rules for determining abnormal traffic, improving the accuracy of abnormal traffic determination, and thus solving the problem of insufficient abnormal traffic determination in the related art.

[0046] As an optional embodiment, determining the target feature according to the importance value includes:

[0047] According to the business scenario of the target business, historical analysis data corresponding to the business scenario is obtained, wherein the historical analysis data is data associated with the target business judged by the business personnel;

[0048] According to the historical analysis data, the importance values ​​are sorted to obtain the sorting results;

[0049] The sorting results are used to filter out target features from reference features.

[0050] Optionally, an embodiment of the present application can obtain the business scenario in which the target business is currently located, and then obtain the daily historical analysis data of the business personnel in the business scenario. This allows the business personnel to sort the multiple importance values ​​obtained from large to small or from small to large according to their own business experience to obtain a sorting result.

[0051] For example, five reference features are obtained, namely, the number of times each target business appears on the ad playback device within 30 days a, the number of times it appears within 50 hours b, the number of times it appears within 600 minutes c, the number of times it appears within 1000 seconds d, and the average number of times it appears within 30 days e. Then the target model can sort the above five reference features to obtain eabcd.

[0052] Then, referring to the historical analysis data of the business personnel, for each feature from the above eabcd, the distribution is detected in normal and abnormal traffic samples, for example, three features eab are selected as target features.

[0053] As an optional embodiment, the target feature is determined according to the importance value, and the updated flow determination scheme includes:

[0054] Using the target feature, generating a corresponding first rule, adding the first rule to the flow determination database, and obtaining an updated flow determination solution;

[0055] or,

[0056] The target feature is used to modify the determination condition threshold set in the initial flow determination scheme. According to the modified determination condition threshold, a corresponding second rule is generated, and the second rule is added to the flow determination database to obtain an updated flow determination scheme.

[0057] Alternatively, if Figure 3 , business personnel can directly use the obtained target features as new rules, add them directly to the existing traffic determination database, and then obtain the expanded traffic determination solution.

[0058] In addition, the target feature can also be used to modify the initial (i.e., existing) judgment condition threshold set in the flow determination scheme. For example, the judgment condition threshold set in the initial flow determination scheme is that the number of occurrences of the target business being executed within 7 days is greater than or equal to 50, and later it is changed to that the number of occurrences of the target business being executed within 7 days is greater than or equal to 80. At this time, the number of occurrences of the target business being executed within 7 days is greater than or equal to 80 as a new rule added to the flow determination database to obtain an updated flow determination scheme. The embodiment of the present application does not limit the specific numerical setting of the judgment condition threshold, which can be flexibly changed according to actual conditions.

[0059] As an optional embodiment, the preset time unit is a preset time window, and according to the multiple preset time units, the multiple reference features corresponding to the execution of the target business are extracted, including:

[0060] Determine a plurality of preset time windows, wherein the preset time windows include: a date time window, an hour time window, a minute time window, and a second time window;

[0061] The number of device accounts executing target business in each preset time window is obtained; and the number of device accounts is set as a reference feature.

[0062] After obtaining the number of device accounts executing the target service in each preset time window, obtaining a maximum value of the number of device accounts, a minimum value of the number of device accounts, a mean value of the number of device accounts, and a variance value of the number of device accounts in each preset time window;

[0063] The maximum value of the number of device accounts, the minimum value of the number of device accounts, the mean value of the number of device accounts, and the variance value of the number of device accounts in each preset time window are set as reference features.

[0064] Optionally, in an embodiment of the present application, multiple preset time windows can be set in advance, such as a date time window, an hour time window, a minute time window, and a second time window, where the time window is a sliding step value. If the preset time window is a date time window, and the number of records within any 30 days is required, then dates such as January 15 to February 15 can be referred to as the required date time window.

[0065] Then, the number of device accounts executing the target business in each preset time window is obtained, and then the number of device accounts is set as a reference feature.

[0066] After obtaining the number of device accounts of the target business, the maximum number of device accounts, the minimum number of device accounts, the mean number of device accounts, and the variance value of the number of device accounts in each preset time window can be calculated, and then these maximum value, minimum value, mean value, and variance values ​​can be used as the above-mentioned reference features.

[0067] As an optional embodiment, the preset time unit is a preset time period, and according to the multiple preset time units, the multiple reference features corresponding to the execution of the target business are extracted, including:

[0068] Determine a plurality of preset time periods, wherein the preset time periods include: a date time period, an hour time period, a minute time period, and a second time period;

[0069] The number of device accounts executing target business in each preset time period is obtained; and the number of device accounts is set as a reference feature.

[0070] After obtaining the number of device accounts executing the target service in each preset time period, obtaining the maximum number of device accounts, the minimum number of device accounts, the mean value of the number of device accounts, and the variance value of the number of device accounts in each preset time period;

[0071] The maximum value of the number of device accounts, the minimum value of the number of device accounts, the mean value of the number of device accounts, and the variance value of the number of device accounts in each preset time period are set as reference features.

[0072] Optionally, in an embodiment of the present application, multiple preset time periods can be set in advance, such as a date time period, an hour time period, a minute time period, and a second time period, where the time period is a fixed duration value. If the preset time period is a date time period, and the number of records within any 30 days is required, then dates such as January and February can be referred to as the required date time period.

[0073] Then, the number of device accounts executing the target business in each preset time period is obtained, and then the number of device accounts is set as a reference feature.

[0074] After obtaining the number of device accounts of the target business, the maximum number of device accounts, the minimum number of device accounts, the mean number of device accounts, and the variance value of the number of device accounts in each preset time period can also be calculated. Figure 4 , and then use these maximum, minimum, mean and variance values ​​as the above reference features. Among them, Figure 4 Where id refers to the device account, date refers to date, hour refers to hour, minute refers to minute, and second refers to second.

[0075] It should be noted that, for the aforementioned method embodiments, for the sake of simplicity, they are all expressed as a series of action combinations, but those skilled in the art should be aware that the present application is not limited by the described order of actions, because according to the present application, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily required by the present application.

[0076] Through the description of the above implementation methods, those skilled in the art can clearly understand that the method according to the above embodiment can be implemented by means of software plus a necessary general hardware platform, and of course it can also be implemented by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present application, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM (Read-Only Memory) / RAM (Random Access Memory), a magnetic disk, or an optical disk), and includes a number of instructions for a terminal device (which can be a mobile phone, a computer, a server, or a network device, etc.) to execute the methods of each embodiment of the present application.

[0077] According to another aspect of an embodiment of the present application, a flow determination scheme determination device for implementing the above-mentioned flow determination scheme determination method is also provided. Figure 5is a structural block diagram of a determination device for an optional flow determination solution according to an embodiment of the present application, such as Figure 5 As shown, the device may include: a first acquisition unit 501, used to acquire the target traffic generated when the target service is triggered, wherein the target service is the advertising service generated by the advertising provider when providing advertisements, and the target traffic is the traffic consumed by running the target service; an extraction unit 502, connected to the first acquisition unit 501, used to extract a plurality of reference features corresponding to the execution of the target service according to a plurality of preset time units, wherein the reference features are used to characterize the number of target services executed within a plurality of preset time units; a determination unit 503, connected to the extraction unit 502, used to determine the importance value of the reference feature using a target model; an acquisition unit 504, connected to the determination unit 503, used to determine the target feature according to the importance value, and obtain an updated traffic determination scheme, wherein the target feature is a subset of the reference feature.

[0078] It should be noted that the first acquisition unit 501 in this embodiment can be used to execute the above step S201, the extraction unit 502 in this embodiment can be used to execute the above step S202, the determination unit 503 in this embodiment can be used to execute the above step S203, and the obtaining unit 504 in this embodiment can be used to execute the above step S204.

[0079] Through the above module, the number of target businesses executed within multiple preset time units is input into the target model to obtain the importance of the reference features corresponding to each preset time unit, and then the importance is used to screen out some target features to update the existing traffic determination scheme, and an updated traffic determination scheme is obtained. The updated traffic determination scheme is used as the final abnormal traffic determination rule, thereby supplementing the existing advertising abnormal traffic rules, making the existing traffic determination scheme more abundant in determining abnormal traffic rules, improving the accuracy of abnormal traffic judgment, and thus solving the problem of insufficient abnormal traffic judgment in related technologies.

[0080] As an optional embodiment, the obtaining unit 504 includes: a first obtaining module, used to obtain historical analysis data corresponding to the business scenario according to the business scenario in which the target business is located, wherein the historical analysis data is data associated with the target business judged by business personnel; a sorting module, used to sort the importance values ​​according to the historical analysis data to obtain a sorting result; and a screening module, used to use the sorting result to screen out the target feature from the reference feature.

[0081] As an optional embodiment, the obtaining unit 504 includes: a second obtaining module, which is used to generate a corresponding first rule by using the target feature, add the first rule to the flow determination database, and obtain an updated flow determination solution;

[0082] or,

[0083] The third module is used to modify the determination condition threshold set in the initial flow determination scheme by using the target feature, generate the corresponding second rule according to the modified determination condition threshold, add the second rule to the flow determination database, and obtain the updated flow determination scheme.

[0084] As an optional embodiment, the preset time unit is a preset time window, and the extraction unit 503 includes: a first determination module, used to determine multiple preset time windows, wherein the preset time windows include: a date time window, an hour time window, a minute time window, and a second time window; a first acquisition module, used to obtain the number of device accounts executing the target business within each preset time window; and a first setting module, used to set the number of device accounts as a reference feature.

[0085] As an optional embodiment, the device also includes: a second acquisition unit, which is used to obtain the maximum value of the number of device accounts, the minimum value of the number of device accounts, the mean value of the number of device accounts, and the variance value of the number of device accounts in each preset time window after obtaining the number of device accounts executing the target business in each preset time window; and a first setting unit, which is used to set the maximum value of the number of device accounts, the minimum value of the number of device accounts, the mean value of the number of device accounts, and the variance value of the number of device accounts in each preset time window as reference features.

[0086] As an optional embodiment, the preset time unit is a preset time period, and the extraction unit 503 includes: a second determination module, used to determine multiple preset time periods, wherein the preset time periods include: a date time period, an hour time period, a minute time period, and a second time period; a second acquisition module, used to obtain the number of device accounts that execute the target business within each preset time period; and a second setting module, used to set the number of device accounts as a reference feature.

[0087] As an optional embodiment, the device also includes: a third acquisition unit, which is used to obtain the maximum value of the number of device accounts, the minimum value of the number of device accounts, the mean value of the number of device accounts, and the variance value of the number of device accounts in each preset time period after obtaining the number of device accounts executing the target business in each preset time period; and a second setting unit, which is used to set the maximum value of the number of device accounts, the minimum value of the number of device accounts, the mean value of the number of device accounts, and the variance value of the number of device accounts in each preset time period as reference features.

[0088] It should be noted that the examples and application scenarios implemented by the above modules and corresponding steps are the same, but are not limited to the contents disclosed in the above embodiments. It should be noted that the above modules as part of the device can be run in Figure 1 In the hardware environment shown, it can be implemented by software or by hardware, wherein the hardware environment includes a network environment.

[0089] According to another aspect of an embodiment of the present application, there is also provided an electronic device for implementing the determination method of the above-mentioned traffic determination scheme. The electronic device may be a server, a terminal, or a combination thereof.

[0090] Figure 6 is a structural block diagram of an optional electronic device according to an embodiment of the present application, such as Figure 6 As shown, it includes a processor 601, a communication interface 602, a memory 603 and a communication bus 604, wherein the processor 601, the communication interface 602 and the memory 603 communicate with each other through the communication bus 604, wherein,

[0091] Memory 603, used for storing computer programs;

[0092] The processor 601 is used to implement the following steps when executing the computer program stored in the memory 603:

[0093] Obtaining target traffic generated when a target service is triggered, wherein the target service is an advertising service generated when an advertisement provider provides advertisements, and the target traffic is the traffic consumed by running the target service;

[0094] Extracting, according to a plurality of preset time units, a plurality of reference features corresponding to the execution of the target business, wherein the reference features are used to characterize the number of the target business executed within the plurality of preset time units;

[0095] Determine the importance value of the reference feature using the target model;

[0096] The target feature is determined according to the importance value, and an updated flow determination scheme is obtained, wherein the target feature is a subset of the reference feature.

[0097] Optionally, in this embodiment, the communication bus may be a PCI (Peripheral Component Interconnect) bus or an EISA (Extended Industry Standard Architecture) bus. The communication bus may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 6Only one thick line is used in the diagram, but this does not mean that there is only one bus or only one type of bus.

[0098] The communication interface is used for communication between the above electronic device and other devices.

[0099] The memory may include RAM, or may include non-volatile memory, such as at least one disk memory. Optionally, the memory may also be at least one storage device located away from the aforementioned processor.

[0100] As an example, Figure 6 As shown, the memory 603 may include, but is not limited to, the first acquisition unit 501, the extraction unit 502, the determination unit 503, and the obtaining unit 504 in the device for determining the flow determination solution. In addition, other module units in the device for determining the flow determination solution may also be included but are not limited to, which will not be repeated in this example.

[0101] The above-mentioned processor can be a general-purpose processor, which can include but not be limited to: CPU (Central Processing Unit), NP (Network Processor), etc.; it can also be DSP (Digital Signal Processing), ASIC (Application Specific Integrated Circuit), FPGA (Field-Programmable Gate Array) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components.

[0102] In addition, the electronic device mentioned above further comprises: a display for displaying the determination result of the flow determination scheme.

[0103] Optionally, the specific examples in this embodiment may refer to the examples described in the above embodiments, and this embodiment will not be described in detail here.

[0104] It can be understood by those skilled in the art that Figure 6 The structure shown is for illustration only. The device for implementing the determination method of the above-mentioned traffic determination scheme may be a terminal device, which may be a smart phone (such as an Android phone, an iOS phone, etc.), a tablet computer, a PDA, a mobile Internet device (Mobile Internet Devices, MID), a PAD, and other terminal devices. Figure 6 It does not limit the structure of the above electronic device. For example, the terminal device may also include Figure 6More or fewer components (such as network interfaces, display devices, etc.) shown in, or having Figure 6 Different configurations shown.

[0105] A person of ordinary skill in the art can understand that all or part of the steps in the various methods of the above embodiments can be completed by instructing the hardware related to the terminal device through a program, and the program can be stored in a computer-readable storage medium, which can include: a flash drive, ROM, RAM, a magnetic disk or an optical disk, etc.

[0106] According to another aspect of the embodiment of the present application, a storage medium is also provided. Optionally, in this embodiment, the storage medium can be used to execute the program code of the method for determining the flow determination solution.

[0107] Optionally, in this embodiment, the storage medium may be located on at least one network device among a plurality of network devices in the network shown in the above embodiment.

[0108] Optionally, in this embodiment, the storage medium is configured to store program codes for executing the following steps:

[0109] Obtaining target traffic generated when a target service is triggered, wherein the target service is an advertising service generated when an advertisement provider provides advertisements, and the target traffic is the traffic consumed by running the target service;

[0110] Extracting, according to a plurality of preset time units, a plurality of reference features corresponding to the execution of the target business, wherein the reference features are used to characterize the number of the target business executed within the plurality of preset time units;

[0111] Determine the importance value of the reference feature using the target model;

[0112] The target feature is determined according to the importance value, and an updated flow determination scheme is obtained, wherein the target feature is a subset of the reference feature.

[0113] Optionally, the specific examples in this embodiment may refer to the examples described in the above embodiments, which will not be described in detail in this embodiment.

[0114] Optionally, in this embodiment, the storage medium may include, but is not limited to, various media that can store program codes, such as a USB flash drive, a ROM, a RAM, a mobile hard disk, a magnetic disk, or an optical disk.

[0115] According to another aspect of the embodiments of the present application, a computer program product or a computer program is also provided, which includes computer instructions stored in a computer-readable storage medium; a processor of a computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the computer device executes the steps of the determination method of the flow determination scheme in any of the above embodiments.

[0116] The serial numbers of the above-mentioned embodiments of the present application are for description only and do not represent the advantages or disadvantages of the embodiments.

[0117] If the integrated units in the above embodiments are implemented in the form of software functional units and sold or used as independent products, they can be stored in the above computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for one or more computer devices (which can be personal computers, servers or network devices, etc.) to execute all or part of the steps of the determination method of the flow determination scheme of each embodiment of the present application.

[0118] In the above embodiments of the present application, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, please refer to the relevant description of other embodiments.

[0119] In the several embodiments provided in the present application, it should be understood that the disclosed client can be implemented in other ways. Among them, the device embodiments described above are only schematic, for example, the division of units is only a logical function division, and there may be other division methods in actual implementation, for example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0120] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution provided in this embodiment.

[0121] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0122] The above is only a preferred implementation of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. A method for determining a flow determination scheme, characterized in that: The method comprises: Acquire target traffic generated when a target service is triggered, wherein the target service is an advertisement service generated when an advertisement provider provides advertisements, and the target traffic is traffic consumed by running the target service; Extracting, according to a plurality of preset time units, a plurality of reference features corresponding to the execution of the target service, wherein the reference features are used to characterize the number of the target service executed within the plurality of the preset time units; Determining the importance value of the reference feature using the target model; Determining the target feature according to the importance value to obtain an updated traffic determination scheme includes: using the target feature to generate a corresponding first rule, adding the first rule to the traffic determination database, and obtaining the updated traffic determination scheme; or using the target feature to modify the determination condition threshold set in the initial traffic determination scheme, generating a corresponding second rule according to the modified determination condition threshold, adding the second rule to the traffic determination database, and obtaining the updated traffic determination scheme, wherein the target feature is a subset of the reference feature, and determining the target feature according to the importance value includes: according to the business scenario of the target business, obtaining historical analysis data corresponding to the business scenario, wherein the historical analysis data is data associated with the target business judged by business personnel; sorting the importance values ​​according to the historical analysis data to obtain a sorting result; and using the sorting result to filter out the target feature from the reference feature.

2. The method according to claim 1, characterized in that The preset time unit is a preset time window, and the extracting of multiple reference features corresponding to the execution of the target business according to multiple preset time units includes: Determine a plurality of the preset time windows, wherein the preset time windows include: a date time window, an hour time window, a minute time window, and a second time window; Obtaining the number of device accounts executing the target service within each of the preset time windows; The number of the device account number is set as the reference characteristic.

3. The method according to claim 2, characterized in that After obtaining the number of device accounts executing the target service within each preset time window, the method further includes: Obtaining a maximum value of the number of the device accounts, a minimum value of the number of the device accounts, a mean value of the number of the device accounts, and a variance value of the number of the device accounts within each of the preset time windows; The maximum value of the number of the device accounts, the minimum value of the number of the device accounts, the mean value of the number of the device accounts, and the variance value of the number of the device accounts in each of the preset time windows are set as the reference features.

4. The method according to claim 1, characterized in that The preset time unit is a preset time period, and the extracting of multiple reference features corresponding to the execution of the target business according to multiple preset time units includes: Determine a plurality of preset time periods, wherein the preset time periods include: a date time period, an hour time period, a minute time period, and a second time period; Obtaining the number of device accounts executing the target service within each preset time period; The number of the device account number is set as the reference characteristic.

5. The method according to claim 4, characterized in that After obtaining the number of device accounts executing the target service within each preset time period, the method further includes: Obtaining a maximum value of the number of the device accounts, a minimum value of the number of the device accounts, a mean value of the number of the device accounts, and a variance value of the number of the device accounts within each of the preset time periods; The maximum value of the number of the device accounts, the minimum value of the number of the device accounts, the mean value of the number of the device accounts, and the variance value of the number of the device accounts in each of the preset time periods are set as the reference features.

6. A device for determining a flow determination scheme, characterized in that: The device comprises: A first acquisition unit is used to acquire a target flow generated when a target service is triggered, wherein the target service is an advertisement service correspondingly generated when an advertisement provider provides advertisements, and the target flow is the flow consumed by running the target service; An extraction unit, configured to extract, according to a plurality of preset time units, a plurality of reference features corresponding to the execution of the target service, wherein the reference features are used to characterize the number of the target service executed within the plurality of the preset time units; A determination unit, used to determine the importance value of the reference feature using a target model; An obtaining unit, configured to determine a target feature according to the importance value, and obtain an updated flow determination scheme, wherein the target feature is a subset of the reference feature; The obtaining unit includes: a first obtaining module, which is used to obtain historical analysis data corresponding to the business scenario according to the business scenario of the target business, wherein the historical analysis data is data associated with the target business judged by the business personnel; a sorting module, which is used to sort the importance values ​​according to the historical analysis data to obtain a sorting result; and a screening module, which is used to screen the target feature from the reference feature using the sorting result; The obtaining unit also includes: a second obtaining module, which is used to generate a corresponding first rule by using the target feature, and add the first rule to the flow determination database to obtain an updated flow determination scheme; or, a third obtaining module, which is used to modify the determination condition threshold set in the initial flow determination scheme by using the target feature, generate a corresponding second rule according to the modified determination condition threshold, and add the second rule to the flow determination database to obtain an updated flow determination scheme.

7. An electronic device comprising a processor, a communication interface, a memory and a communication bus, wherein: The processor, the communication interface and the memory communicate with each other via the communication bus, wherein: The memory is used to store computer programs; The processor is configured to execute the method according to any one of claims 1 to 5 by running the computer program stored in the memory.

8. A computer-readable storage medium, characterized in that: The storage medium stores a computer program, wherein the computer program is configured to execute the method according to any one of claims 1 to 5 when executed.

Images