A conversation monitoring method and device

Abstract

This invention provides a session monitoring method and apparatus. The platform provides a user session window. The method includes: monitoring communication data in the user session window when a target user account logs into the platform; when abnormal data is detected in the communication data, determining the target business system used by the target user account when it logs into the platform; storing the business data generated by the target business system in response to the business request issued by the target user account into a database to be screened; and performing anomaly analysis on the data in the database to be screened. This invention enables order monitoring based on user sessions and effectively reduces the amount of data generated during monitoring, thereby improving the efficiency of subsequent screening.

Description

Technical Field

[0001] The present invention relates to the technical field of data monitoring, and in particular to a session monitoring method and device. Background Art

[0002] In actual applications, some users may use the platform to place illegal orders, which may affect the normal operation of the platform. However, the existing methods of monitoring orders require the platform to spend a lot of resources to monitor the entire process of the order; and a large amount of data will be generated during the monitoring process, which is also a very large workload for subsequent screening. Summary of the invention

[0003] In view of the above problems, a session monitoring method and device are proposed to overcome the above problems or at least partially solve the above problems, including:

[0004] A session monitoring method, wherein a platform provides a user session window; the method comprises:

[0005] When the target user account logs into the platform, the communication data of the user session window is monitored;

[0006] When abnormal data is detected in the communication data, the target business system used by the target user account to log into the platform is determined;

[0007] storing the business data generated by the target business system in response to the business request issued by the target user account in a database to be screened;

[0008] Perform anomaly analysis on the data in the database to be screened.

[0009] Optionally, monitoring the communication data of the user session window includes:

[0010] Identifying communication data input and / or output from a user session window;

[0011] When it is identified that the input or output communication data contains preset sensitive information, it is determined that abnormal data exists in the communication data.

[0012] Optionally, an abnormality analysis is performed on the data in the database to be screened, including:

[0013] Identify abnormal data and determine target abnormal type of the abnormal data;

[0014] Determine whether the data in the database to be screened matches the target anomaly type;

[0015] When the data in the database to be screened matches the target anomaly type, it is determined that an anomaly exists in the data in the database to be screened, and the target anomaly type is used as the anomaly type of the data in the database to be screened.

[0016] Optionally, after determining that the data in the database to be screened is abnormal, the method further includes:

[0017] Close the user session window;

[0018] And, generate and display warning prompt information.

[0019] Optionally, the method further comprises:

[0020] Extracting data input and / or output from the user session window at a preset time interval;

[0021] dividing the extracted data into at least two data packets of equal size;

[0022] At least one data packet is randomly extracted from at least two data packets of equal size as communication data.

[0023] Optionally, the method further comprises:

[0024] Identify other user accounts that communicate with the target user account;

[0025] Determine other business systems used by other user accounts currently logged into the platform;

[0026] The business data generated by other business systems in response to business requests issued by other user accounts are stored in the database to be screened.

[0027] Optionally, the communication data includes any one or more of the following:

[0028] Text data, picture data, video data, audio data.

[0029] A conversation monitoring device, the platform provides a user conversation window; the device includes:

[0030] A monitoring module is used to monitor the communication data of the user session window when the target user account logs into the platform;

[0031] A determination module is used to determine the target business system used by the target user account when logging into the platform when abnormal data is detected in the communication data;

[0032] A first storage module, used to store the business data generated by the target business system in response to the business request sent by the target user account into a database to be screened;

[0033] The analysis module is used to perform abnormal analysis on the data in the database to be screened.

[0034] A server includes a processor, a memory, and a computer program stored in the memory and capable of running on the processor. When the computer program is executed by the processor, the above session monitoring method is implemented.

[0035] A computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the above session monitoring method is implemented.

[0036] The embodiments of the present invention have the following advantages:

[0037] In the embodiment of the present invention, when the target user account logs into the platform, the communication data of the user session window is monitored; when abnormal data is detected in the communication data, the target business system used by the target user account when currently logging into the platform is determined; the business data generated by the target business system in response to the business request issued by the target user account is stored in the database to be screened; and the data in the database to be screened is analyzed for abnormalities. Through the embodiment of the present invention, it is possible to monitor orders based on conversations between users, and the data generated by monitoring can be effectively reduced, thereby improving the efficiency of subsequent screening. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] In order to more clearly illustrate the technical solution of the present invention, the accompanying drawings required for use in the description of the present invention will be briefly introduced below. Obviously, the accompanying drawings in the following description are only some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative labor.

[0039] Figure 1 is a flow chart of the steps of a session monitoring method according to an embodiment of the present invention;

[0040] Figure 2 is a flowchart of another method for monitoring a session according to an embodiment of the present invention;

[0041] Figure 3 It is a structural block diagram of a conversation monitoring device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0042] In order to make the above-mentioned purposes, features and advantages of the present invention more obvious and easy to understand, the present invention is further described in detail below in conjunction with the accompanying drawings and specific embodiments. Obviously, the described embodiments are part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0043] Reference Figure 1, showing a flow chart of steps of a session monitoring method according to an embodiment of the present invention, the platform provides a user session window;

[0044] Specifically, the following steps may be included:

[0045] Step 101: When the target user account logs into the platform, the communication data of the user session window is monitored;

[0046] As an example, the communication data may include any one or more of the following: text data, picture data, video data, and audio data.

[0047] When a user needs to use e-commerce services in a platform (such as an e-commerce platform), such as registration, vehicle registration, order inquiry, and personal consumption statistics, he or she can first log in to the platform using a pre-registered target user account.

[0048] After the target user account logs in to the platform, the platform can provide a user interface and a user session window in the user interface so that the user can communicate and exchange with other users or staff of the business system in the user session window.

[0049] When the target user account is detected to log in to the platform, in order to monitor the user's session content, the communication data of the user session window can be monitored, so as to determine whether the user may be preparing or has performed abnormal behavior based on the communication data, such as: generating false orders, making false records, etc.

[0050] Step 102: when abnormal data is detected in the communication data, determine the target business system used by the target user account when currently logging into the platform;

[0051] When it is identified through monitoring the communication data that the user may have performed abnormal behavior, it can be said that abnormal data is monitored in the communication data; at this time, the data subsequently generated by the target user account can be collected for subsequent screening.

[0052] Specifically, the target business system used by the target user account when logging into the platform may be determined first; of course, the target e-commerce business used by the target user account may also be determined.

[0053] Step 103: storing the business data generated by the target business system in response to the business request sent by the target user account into a database to be screened;

[0054] When the target user account uses the target business system, it will send a business request to the target business system; and when the target business system receives the business request, it will return the corresponding business data to the platform.

[0055] Since anomalies have been identified in the communication data of the target user account, it can be considered that there may be anomalies in the target user account's subsequent use of the target e-commerce business in the target business system, or that abnormal behavior has been performed; therefore, the above business data can be collected and stored in a database to be screened that is pre-set in the platform, so that subsequent analysis can be performed directly based on the data in the database to be screened.

[0056] In addition, the target business system may also generate log data when generating business data; then, the log data may be stored together with the business data in the database to be screened.

[0057] Step 104: Perform an abnormality analysis on the data in the database to be screened.

[0058] After obtaining the business data to be screened and storing it in the database to be screened, the data in the database to be screened may be analyzed to determine whether there are any abnormalities in the orders generated by the target user account.

[0059] In the embodiment of the present invention, when the target user account logs into the platform, the communication data of the user session window is monitored; when abnormal data is detected in the communication data, the target business system used by the target user account when currently logging into the platform is determined; the business data generated by the target business system in response to the business request issued by the target user account is stored in the database to be screened; and the data in the database to be screened is analyzed for abnormalities. Through the embodiment of the present invention, it is possible to monitor orders based on conversations between users, and the data generated by monitoring can be effectively reduced, thereby improving the efficiency of subsequent screening.

[0060] Reference Figure 2 , shows a flow chart of another session monitoring method according to an embodiment of the present invention, including the following steps:

[0061] Step 201: When the target user account logs into the platform, the communication data input and / or output in the user session window is identified;

[0062] After the target user account logs in to the platform, the platform can provide a user interface and a user session window in the user interface so that the user can communicate and exchange with other users or staff of the business system in the user session window.

[0063] When it is detected that the target user account has logged into the platform, the communication data currently input and / or output in the user session window may be intercepted first, and then the intercepted communication data may be identified.

[0064] For example, it is possible to recognize text in text data, or to recognize image data, or to recognize images and sounds in video data, or to recognize text corresponding to audio data, and so on.

[0065] In one embodiment of the present invention, the communication data may be obtained by the following steps:

[0066] Extracting data input and / or output from a user session window at a preset time interval; dividing the extracted data into at least two data packets of equal size; and randomly extracting at least one data packet from the at least two data packets of equal size as communication data.

[0067] In practical applications, if all communication data are to be identified, a large amount of resources will be consumed; therefore, a preset time interval may be set, and then the data of the input user session window and / or the data of the output user session window may be extracted according to the preset time interval.

[0068] Furthermore, the extracted data may be divided into a plurality of data packets of equal size, for example, it may be divided into two data packets of equal size; and then, a data packet is randomly extracted therefrom as communication data for subsequent identification.

[0069] Step 202: When it is identified that the input or output communication data contains preset sensitive information, it is determined that there is abnormal data in the communication data;

[0070] As an example, the preset sensitive information may refer to preset text sensitive information, or preset sensitive pictures, or preset sensitive videos, or preset sensitive sounds.

[0071] In practical applications, the acquired text data can be identified to determine whether the text data includes pre-set text sensitive information. If so, it can be determined that abnormal data exists in the communication data.

[0072] The acquired image data may also be identified to determine whether the image data matches a preset sensitive image, and when the image data matches, it may be determined that abnormal data exists in the communication data.

[0073] The acquired video data may also be identified to determine whether the video data matches a preset sensitive video, and when the video data matches, it may be determined that abnormal data exists in the communication data.

[0074] In addition, the acquired audio data may also be identified to determine whether the audio data matches a preset sensitive sound, and when a match is found, it may be determined that abnormal data exists in the communication data.

[0075] Step 203: when abnormal data is detected in the communication data, determine the target business system used by the target user account when currently logging into the platform;

[0076] When it is identified through monitoring the communication data that the user may have performed abnormal behavior, it can be said that abnormal data is monitored in the communication data; at this time, the data subsequently generated by the target user account can be collected for subsequent screening.

[0077] Specifically, the target business system used by the target user account when logging into the platform may be determined first; of course, the target e-commerce business used by the target user account may also be determined.

[0078] Step 204: storing the business data generated by the target business system in response to the business request sent by the target user account into a database to be screened;

[0079] Since anomalies have been identified in the communication data of the target user account, it can be considered that there may be anomalies in the target user account's subsequent use of the target e-commerce business in the target business system, or that abnormal behavior has been performed; therefore, the business data generated by the target business system in response to the business request issued by the target user account can be collected and stored in the database to be screened pre-set in the platform, so that subsequent analysis can be performed directly based on the data in the database to be screened.

[0080] In one embodiment of the present invention, other data may also be stored in the database to be screened by the following steps:

[0081] Determine other user accounts that communicate with the target user account; determine other business systems used by other user accounts when they are currently logged into the platform; and store business data generated by other business systems in response to business requests issued by other user accounts into a database to be screened.

[0082] A conversation is generally conducted by at least two parties, and when one party is about to or has performed an abnormal behavior, the other party may also perform an abnormal behavior; at this time, the data of the other party can also be stored in the database to be screened.

[0083] Specifically, other user accounts communicating with the target user account may be determined first; the other user accounts may include multiple accounts.

[0084] Then, other business systems used by the other user accounts when currently logging into the platform may be determined; it should be noted that other business systems may also refer to target business systems, which is not limited in this embodiment of the present invention.

[0085] When other user accounts use other business systems, they will send corresponding business requests to other business systems; when other business systems receive the business requests, they will return corresponding business data to the platform. At this time, the platform can also store the business data in the database to be screened, so that other user accounts that have had conversations with the target user account can be monitored at the same time in the future.

[0086] Step 205: Identify the abnormal data and determine the target abnormal type of the abnormal data;

[0087] When it is necessary to perform anomaly analysis on the data in the database to be screened, the abnormal data in the communication data can be identified first to determine the target anomaly type corresponding to the abnormal data, such as false behavior, abnormal quantity behavior, etc.

[0088] Step 206: determine whether the data in the database to be screened matches the target anomaly type;

[0089] When determining the type of abnormal data, the stored data may be simultaneously obtained from the database to be screened, and it may be determined whether the data in the database to be screened matches the target abnormal type of the abnormal data in the communication data.

[0090] For example, when the target anomaly type is abnormal quantity behavior and after analyzing the data in the database to be screened, it is found that a large number of orders have been placed in a short period of time and the number of orders is higher than the previous average number of orders of the target user account, it can be determined that the data in the database to be screened matches the target anomaly type of the abnormal data in the communication data, and the embodiments of the present invention do not limit this.

[0091] Step 207: When the data in the database to be screened matches the target abnormality type, it is determined that the data in the database to be screened has an abnormality, and the target abnormality type is used as the abnormality type of the data in the database to be screened.

[0092] When the data in the database to be screened matches the target anomaly type, it may indicate that the data in the database to be screened also has the same anomaly as the target anomaly type of the abnormal data in the communication data; at this time, the target anomaly type may be used as the anomaly type of the data in the database to be screened, for example: when the target anomaly type is abnormal quantity behavior, when the data in the database to be screened matches the abnormal quantity behavior, the abnormal quantity behavior is used as the anomaly type of the data in the database to be screened, and the embodiments of the present invention do not impose any restrictions on this.

[0093] In one embodiment of the present invention, after determining that the data in the database to be screened is abnormal, the method further includes:

[0094] Closing the user session window; and generating and displaying a warning prompt message.

[0095] In actual applications, if an abnormality is determined to exist, in order to prevent the target user account from further abnormal behavior, the user session window can be closed, so that the target user account cannot continue to communicate with other user accounts.

[0096] In addition, a warning message may be generated and displayed in the user interface provided by the platform.

[0097] In an embodiment of the present invention, when a target user account logs into a platform, the communication data input and / or outputted from the user session window is identified; when it is identified that the input or output communication data contains preset sensitive information, it is determined that there is abnormal data in the communication data; when abnormal data is detected in the communication data, the target business system used by the target user account when currently logging into the platform is determined; the business data generated by the target business system in response to the business request issued by the target user account is stored in a database to be screened; the abnormal data is identified, and the target abnormal type of the abnormal data is determined; it is determined whether the data in the database to be screened matches the target abnormal type; when the data in the database to be screened matches the target abnormal type, it is determined that there is an abnormality in the data in the database to be screened, and the target abnormal type is used as the abnormal type of the data in the database to be screened. Through the embodiment of the present invention, when there is sensitive information in the communication data, the business data associated with the user account is stored in the database to be screened for subsequent screening and analysis, which effectively reduces the data generated by monitoring and improves the efficiency of subsequent screening.

[0098] Reference Figure 3 , showing a schematic diagram of the structure of a session monitoring device according to an embodiment of the present invention, the platform provides a user session window;

[0099] Specifically, the following modules may be included:

[0100] The monitoring module 301 is used to monitor the communication data of the user session window when the target user account logs into the platform;

[0101] The determination module 302 is used to determine the target business system used by the target user account when logging into the platform when abnormal data is detected in the communication data;

[0102] The first storage module 303 is used to store the business data generated by the target business system in response to the business request sent by the target user account into the database to be screened;

[0103] The analysis module 304 is used to perform abnormal analysis on the data in the database to be screened.

[0104] In one embodiment of the present invention, the monitoring module 301 is used to identify the communication data input and / or output of the user session window; when it is identified that the input or output communication data contains preset sensitive information, it is determined that there is abnormal data in the communication data.

[0105] In one embodiment of the present invention, the analysis module 304 is used to identify abnormal data and determine the target abnormal type of the abnormal data; determine whether the data in the database to be screened matches the target abnormal type; when the data in the database to be screened matches the target abnormal type, determine that there is an abnormality in the data in the database to be screened, and use the target abnormal type as the abnormal type of the data in the database to be screened.

[0106] In one embodiment of the present invention, the device further comprises:

[0107] The closing module is used to close the user session window after determining that there is an abnormality in the data in the database to be screened; and to generate and display a warning prompt message.

[0108] In one embodiment of the present invention, the device further comprises:

[0109] The data generation module is used to extract the data input and / or output of the user session window at a preset time interval; divide the extracted data into at least two data packets of equal size; and randomly extract at least one data packet from the at least two data packets of equal size as communication data.

[0110] In one embodiment of the present invention, the device further comprises:

[0111] The second storage module is used to determine other user accounts that communicate with the target user account; determine other business systems used by other user accounts when they are currently logging into the platform; and store business data generated by other business systems in response to business requests issued by other user accounts into a database to be screened.

[0112] In one embodiment of the present invention, the communication data includes any one or more of the following:

[0113] Text data, picture data, video data, audio data.

[0114] In the embodiment of the present invention, when the target user account logs into the platform, the communication data of the user session window is monitored; when abnormal data is detected in the communication data, the target business system used by the target user account when currently logging into the platform is determined; the business data generated by the target business system in response to the business request issued by the target user account is stored in the database to be screened; and the data in the database to be screened is analyzed for abnormalities. Through the embodiment of the present invention, it is possible to monitor orders based on conversations between users, and the data generated by monitoring can be effectively reduced, thereby improving the efficiency of subsequent screening.

[0115] An embodiment of the present invention further provides a server, including a processor, a memory, and a computer program stored in the memory and capable of running on the processor, and the computer program implements the above session monitoring method when executed by the processor.

[0116] An embodiment of the present invention further provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the above session monitoring method is implemented.

[0117] As for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0118] The various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referenced to each other.

[0119] Those skilled in the art will appreciate that the embodiments of the present invention may be provided as methods, devices, or computer program products. Therefore, the embodiments of the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the embodiments of the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.

[0120] The embodiments of the present invention are described with reference to the flowcharts and / or block diagrams of the methods, terminal devices (systems), and computer program products according to the embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of the processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing terminal device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing terminal device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0121] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing terminal device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce a manufactured product including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0122] These computer program instructions can also be loaded onto a computer or other programmable data processing terminal device so that a series of operating steps are executed on the computer or other programmable terminal device to produce a computer-implemented process, thereby providing instructions for executing on the computer or other programmable terminal device to implement the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0123] Although the preferred embodiments of the present invention have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the embodiments of the present invention.

[0124] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or terminal device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or terminal device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or terminal device including the elements.

[0125] The above is a detailed introduction to a session monitoring method and device provided. Specific examples are used in this article to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core idea; at the same time, for those skilled in the art, according to the idea of ​​the present invention, there will be changes in the specific implementation method and application scope. In summary, the content of this specification should not be understood as limiting the present invention.

Claims

1. A session monitoring method, characterized in that: The platform provides a user session window; the method includes: When the target user account logs into the platform, monitoring the communication data of the user session window; When abnormal data is detected in the communication data, determining the target business system used by the target user account when currently logging into the platform; storing the business data generated by the target business system in response to the business request issued by the target user account in a database to be screened; Performing abnormal analysis on the data in the database to be screened; The performing abnormal analysis on the data in the database to be screened includes: Identify the abnormal data and determine the target abnormal type of the abnormal data; Determining whether the data in the to-be-screened database matches the target anomaly type; When the data in the database to be screened matches the target abnormality type, it is determined that the data in the database to be screened has an abnormality, and the target abnormality type is used as the abnormality type of the data in the database to be screened.

2. The method according to claim 1, characterized in that The monitoring of the communication data of the user session window includes: Identifying communication data input and / or output from the user session window; When it is identified that the input or output communication data contains preset sensitive information, it is determined that abnormal data exists in the communication data.

3. The method according to claim 1, characterized in that After determining that the data in the to-be-screened database is abnormal, the method further includes: Close the user session window; And, generate and display warning prompt information.

4. The method according to claim 1, characterized in that: The method further comprises: Extracting data input and / or output from the user session window at a preset time interval; dividing the extracted data into at least two data packets of equal size; At least one data packet is randomly extracted from the at least two data packets of equal size as the communication data.

5. The method according to claim 1, characterized in that The method further comprises: Determining other user accounts that communicate with the target user account; Determine other business systems used by the other user accounts when currently logging into the platform; The business data generated by the other business system in response to the business request sent by the other user account is stored in the database to be screened.

6. The method according to any one of claims 1 to 5, characterized in that: The communication data includes any one or more of the following: Text data, picture data, video data, audio data.

7. A conversation monitoring device, characterized in that: The platform provides a user session window; the device includes: A monitoring module, used for monitoring the communication data of the user session window when the target user account logs into the platform; A determination module, configured to determine a target business system used by the target user account when currently logging into the platform when abnormal data is detected in the communication data; A first storage module, configured to store the business data generated by the target business system in response to the business request issued by the target user account into a database to be screened; An analysis module, used for performing abnormal analysis on the data in the database to be screened; Among them, the analysis module is specifically used to identify the abnormal data and determine the target abnormal type of the abnormal data; judge whether the data in the database to be screened matches the target abnormal type; when the data in the database to be screened matches the target abnormal type, it is determined that there is an abnormality in the data in the database to be screened, and the target abnormal type is used as the abnormal type of the data in the database to be screened.

8. A server, characterized in that: The method comprises a processor, a memory, and a computer program stored in the memory and capable of running on the processor, wherein the computer program implements the session monitoring method according to any one of claims 1 to 6 when executed by the processor.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the session monitoring method according to any one of claims 1 to 6 is implemented.

Images