Data detection method, device, computer equipment and storage medium

Abstract

The present application discloses a data detection method, device, computer equipment and storage medium, the method comprising: obtaining a log parameter set obtained by analyzing log data recording the execution status of N objects for L operations; the log parameter set contains the execution parameters of N objects for each operation; the log parameter set is divided into M log parameter subsets according to M data spaces; any one of the M log parameter subsets is represented as the mth log parameter subset located in the mth data space; the abnormal execution offset parameters of N objects for each operation in the mth data space are generated according to the mth log parameter subset; according to the abnormal execution offset parameters of N objects for each operation in the mth data space, the execution detection results of N objects for each operation in the mth data space are predicted. By adopting the present application, the accuracy of the execution detection results of the detected objects for the operation can be improved.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a data detection method, apparatus, computer equipment and storage medium. Background Art

[0002] Log auditing is very important for a system with a large user group. Through log auditing, users' abnormal operation behaviors can be discovered in time, and users with abnormal operation behaviors can be managed and controlled to protect system security or system information security.

[0003] In existing applications, a frequency threshold is usually set. If the number of times a user performs a certain operation (such as user operation) within a certain period of time is greater than the frequency threshold, it can be considered that the user's behavior of performing this operation within the period of time is abnormal, and then the user is determined to be an abnormal user. However, in the prior art, the method of detecting the user's abnormal operation behavior by setting a frequency threshold, if the malicious user knows the frequency threshold in advance, the malicious user can easily circumvent the abnormal operation behavior by knowing the frequency threshold, so that the abnormal operation behavior of the malicious user cannot be detected, resulting in system insecurity. Summary of the invention

[0004] The present application provides a data detection method, apparatus, computer device and storage medium, which can improve the accuracy of the execution detection results of the detected object for the operation, thereby improving the security of the system.

[0005] On one hand, the present application provides a data detection method, the method comprising:

[0006] Get a log parameter set; the log parameter set is obtained by analyzing and processing log data, and the log data is used to record the execution status of N objects for L operations respectively; the log parameter set contains the execution parameters of N objects for each operation respectively;

[0007] The log parameter set is divided according to M data spaces to obtain M log parameter subsets; any one of the M log parameter subsets is represented as the mth log parameter subset, and the mth log parameter subset is located in the mth data space; the mth log parameter subset contains the execution parameters of N objects for each operation in the mth data space; m and M are both positive integers and m is less than or equal to M;

[0008] Generate N objects according to the mth log parameter subset to execute offset parameters for each operation exception in the mth data space;

[0009] According to the abnormal execution offset parameters of each operation of the N objects in the m-th data space, the execution detection results of each operation of the N objects in the m-th data space are predicted.

[0010] On one hand, the present application provides a data detection device, which includes:

[0011] The acquisition module is used to acquire a log parameter set; the log parameter set is obtained by analyzing and processing log data, and the log data is used to record the execution status of N objects for L operations respectively; the log parameter set contains the execution parameters of the N objects for each operation respectively;

[0012] A partitioning module is used to partition the log parameter set according to M data spaces to obtain M log parameter subsets; any one of the M log parameter subsets is represented as the mth log parameter subset, and the mth log parameter subset is located in the mth data space; the mth log parameter subset contains execution parameters of N objects for each operation in the mth data space; m and M are both positive integers and m is less than or equal to M;

[0013] A generation module, used for generating abnormal execution offset parameters of N objects for each operation in the mth data space according to the mth log parameter subset;

[0014] The prediction module is used to predict the execution detection results of each operation of the N objects in the mth data space according to the abnormal execution offset parameters of each operation of the N objects in the mth data space.

[0015] Optionally, the partitioning module partitions the log parameter set according to the M data spaces to obtain the M log parameter subsets, including:

[0016] Get redundant operations among L operations;

[0017] Filter the execution parameters of the N types of objects in the log parameter set for redundant operations to obtain a filtered parameter set;

[0018] The filter parameter set is divided according to the M data spaces to obtain M log parameter subsets.

[0019] Optionally, any two operations among the L operations are represented as a c1th operation and a c2th operation, where c1 and c2 are both positive integers less than or equal to L, and c1 is not equal to c2;

[0020] The partitioning module obtains the redundant operations in L operations, including:

[0021] Extracting execution parameters of N objects for the c1th operation and execution parameters of N objects for the c2th operation from the log parameter set;

[0022] Calculate the correlation coefficient between the c1th operation and the c2th operation according to the execution parameters of the N objects for the c1th operation and the execution parameters of the N objects for the c2th operation;

[0023] If the correlation coefficient is greater than the coefficient threshold, redundant operations are determined from the c1-th operation and the c2-th operation.

[0024] Optionally, the partitioning module obtains the redundant operations in the L operations in a manner including:

[0025] According to the execution parameters of L operations in N objects in the log parameter set, the operation information entropy corresponding to each operation is calculated;

[0026] The operations whose corresponding operation information entropy among the L operations is less than the information entropy threshold are determined as redundant operations.

[0027] Optionally, any one of the N objects is represented as a target object; any one of the L operations is represented as a target operation; an execution parameter of the target object included in the mth log parameter subset is the first number of times the target object executes the target operation within a target period of a target natural day;

[0028] The generation module generates N objects according to the mth log parameter subset, and executes offset parameters for each operation exception in the mth data space, including:

[0029] Extract the second number of times the target object performs the target operation within the target period of the historical natural day from the mth log parameter subset, and generate an independent execution offset parameter for the target operation of the target object within the target period of the target natural day according to the second number and the first number; the historical natural day is before the target natural day;

[0030] Extract the third number of times the target operation is performed by the target group within the target time period of the target natural day from the mth log parameter subset, and generate a group execution offset parameter for the target operation by the target object within the target time period of the target natural day according to the third number and the first number; the object group includes objects of the same object type as the target object among the N objects;

[0031] An independent execution offset parameter and a group execution offset parameter of the target object for the target operation are determined as abnormal execution offset parameters of the target object for the target operation.

[0032] Optionally, the generating module generates, according to the second number and the first number, a method for generating an independent execution offset parameter for a target operation of a target object within a target period of a target natural day, including:

[0033] Calculate the first mean and the first standard deviation between the second number and the first number;

[0034] An independent execution offset parameter of the target object for the target operation is determined according to the first mean and the first standard deviation.

[0035] Optionally, the generation module generates, based on the third number and the first number, a method for executing the offset parameter for the target object within the target time period of the target natural day and for the target operation group, including:

[0036] Calculate the second mean and second standard deviation between the third number and the first number;

[0037] A group execution offset parameter of the target object for the target operation is determined according to the second mean and the second standard deviation.

[0038] Optionally, the prediction module predicts the execution detection results of each operation of the N objects in the mth data space according to the abnormal execution offset parameters of each operation of the N objects in the mth data space, including:

[0039] The first random forest model is called to perform parameter calculation on the group execution offset parameters of the N objects for the L types of operations, and the group execution detection results of the target objects for the target operations within the target time period of the target natural day are obtained;

[0040] The second random forest model is called to perform parameter measurement on the independent execution offset parameters of the N objects for the L operations respectively, and the independent execution detection result of the target object for the target operation within the target time period of the target nature is obtained;

[0041] The execution detection result corresponding to the first number of target objects is determined according to the independent execution detection result and the group execution detection result.

[0042] Optionally, the independent execution detection result is an independent abnormal operation result or an independent normal operation result, and the group execution detection result is a group abnormal operation result or a group normal operation result; if the independent execution detection result is an independent normal operation result, and the group execution detection result is a group normal operation result, then the execution detection result corresponding to the first number is a normal execution result, otherwise, the execution detection result corresponding to the first number is an abnormal execution result.

[0043] Optionally, the M types of data spaces include the data space indicated by the working time period of working days, the data space indicated by the non-working time period of working days, the data space indicated by the working time period of non-working days, and the data space indicated by the non-working time period of non-working days; the N objects in the log parameter set have execution parameters for each operation, which are the number of times the N objects perform each operation in each time period of a natural day, and the natural day includes working days and non-working days; an execution parameter in the mth log parameter subset corresponds to an abnormal execution offset parameter and an execution detection result.

[0044] Optionally, the above device is also used for:

[0045] Get additional detection strategies;

[0046] Determine the additional detection results of each operation of the N objects in the mth data space according to the additional detection strategy and the mth log parameter subset;

[0047] According to the additional detection results and the execution detection results of the N objects for each operation in the m-th data space, the target detection results of the N objects for each operation in the m-th data space are determined.

[0048] In one aspect, the present application provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and when the computer program is executed by the processor, the processor executes a method in one aspect of the present application.

[0049] In one aspect, the present application provides a computer-readable storage medium storing a computer program. The computer program includes program instructions. When the program instructions are executed by a processor, the processor executes the method in the above aspect.

[0050] According to one aspect of the present application, a computer program product or a computer program is provided, the computer program product or the computer program comprising computer instructions, the computer instructions being stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the computer device executes the method provided in various optional modes such as the above-mentioned one aspect.

[0051] The present application obtains a log parameter set; the log parameter set is obtained by analyzing and processing log data, and the log data is used to record the execution status of N objects for L operations respectively; the log parameter set contains the execution parameters of N objects for each operation respectively; the log parameter set is divided according to M data spaces to obtain M log parameter subsets; any one of the M log parameter subsets is represented as the mth log parameter subset, and the mth log parameter subset is located in the mth data space; the mth log parameter subset contains the execution parameters of N objects for each operation respectively in the mth data space; m and M are both positive integers and m is less than or equal to M; according to the mth log parameter subset, the abnormal execution offset parameters of N objects for each operation respectively in the mth data space are generated; according to the abnormal execution offset parameters of N objects for each operation respectively in the mth data space, the execution detection results of N objects for each operation respectively in the mth data space are predicted. It can be seen that the method proposed in the present application can divide the log parameter set in the data space so that the execution parameters of different data spaces will not affect each other. In addition, the present application can also map the execution parameters of the object for the operation to the corresponding abnormal execution offset parameters before detection, which can doubly improve the accuracy of the execution detection results of the detection object for the operation. BRIEF DESCRIPTION OF THE DRAWINGS

[0052] In order to more clearly illustrate the technical solutions in the present application or the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0053] Figure 1 It is a structural diagram of a network architecture provided by an embodiment of the present application;

[0054] Figure 2 This is a schematic diagram of a data detection scenario provided by this application;

[0055] Figure 3 It is a flow chart of a data detection method provided by the present application;

[0056] Figure 4 This is a schematic diagram of the interface of log data provided by this application;

[0057] Figure 5 It is a tabular diagram of a log parameter set provided by this application;

[0058] Figure 6 It is a page schematic diagram of a risk control system provided by this application;

[0059] Figure 7 It is a flowchart of an expert experience test provided by this application;

[0060] Figure 8 It is a page schematic diagram of a risk control system provided by this application;

[0061] Fig. 9 It is a schematic diagram of a framework of a detection system provided by the present application;

[0062] Fig.10 This is a schematic diagram of a data detection scenario provided by this application;

[0063] Fig.11 It is a flowchart of a method for calculating abnormal execution offset parameters provided by the present application;

[0064] Fig.12 This is a schematic diagram of a data detection scenario provided by this application;

[0065] Fig.13 This is a schematic diagram of a data detection scenario provided by this application;

[0066] Fig.14 It is a verification diagram of a data detection provided by this application;

[0067] Fig.15 It is a structural schematic diagram of a data detection device provided by the present application;

[0068] Fig.16 It is a structural schematic diagram of a computer device provided by this application. DETAILED DESCRIPTION

[0069] The following will be combined with the drawings in this application to clearly and completely describe the technical solutions in this application. Obviously, the described embodiments are only part of the embodiments of this application, not all of them. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0070] This application involves artificial intelligence related technologies. Among them, artificial intelligence (AI) is the theory, method, technology and application system that uses digital computers or machines controlled by digital computers to simulate, extend and expand human intelligence, perceive the environment, acquire knowledge and use knowledge to obtain the best results. In other words, artificial intelligence is a comprehensive technology in computer science that attempts to understand the essence of intelligence and produce a new intelligent machine that can respond in a similar way to human intelligence. Artificial intelligence is to study the design principles and implementation methods of various intelligent machines so that machines have the functions of perception, reasoning and decision-making.

[0071] Artificial intelligence technology is a comprehensive discipline that covers a wide range of fields, including both hardware-level and software-level technologies. The basic technologies of artificial intelligence generally include sensors, dedicated artificial intelligence chips, cloud computing, distributed storage, big data processing technology, operation / interaction systems, mechatronics and other technologies. Artificial intelligence software technology mainly includes computer vision technology, speech processing technology, natural language processing technology, and machine learning / deep learning.

[0072] This application mainly involves machine learning in artificial intelligence. Among them, machine learning (ML) is a multi-field interdisciplinary subject, involving probability theory, statistics, approximation theory, convex analysis, algorithm complexity theory and other disciplines, specializing in how computers simulate or implement human learning behavior to acquire new knowledge or skills, and reorganize existing knowledge structures to continuously improve their performance. Machine learning is the core of artificial intelligence and the fundamental way to make computers intelligent. Its applications are spread across all fields of artificial intelligence. Machine learning and deep learning usually include artificial neural networks, belief networks, reinforcement learning, transfer learning, inductive learning, and learning by teaching.

[0073] The machine learning involved in this application mainly refers to the detection of abnormal user operation behaviors through the random forest model of unsupervised learning. For details, please refer to the following Figure 3 Description in the corresponding embodiment.

[0074] The present application also involves blockchain-related technologies. Among them, blockchain is a new application model of computer technologies such as distributed data storage, point-to-point transmission, consensus mechanism, encryption algorithm, etc. Blockchain is essentially a decentralized database, a string of data blocks generated by cryptographic methods, each of which contains a batch of network transaction information, which is used to verify the validity of its information (anti-counterfeiting) and generate the next block. Blockchain can include the underlying blockchain platform, the platform product service layer, and the application service layer. The blockchain includes a series of blocks that are connected to each other in the order of generation. Once a new block is added to the blockchain, it will not be removed. The block records the record data submitted by the nodes in the blockchain system. In this application, the log data related to data detection can be uploaded to the chain, and the detected users with abnormal operation behavior can be archived to the blockchain to ensure the immutability of the uploaded data.

[0075] The present application also involves cloud technology, which refers to a hosting technology that unifies hardware, software, network and other resources within a wide area network or a local area network to achieve data computing, storage, processing and sharing.

[0076] Cloud technology is a general term for network technology, information technology, integration technology, management platform technology, application technology, etc. based on the cloud computing business model. It can form a resource pool, which can be used on demand and is flexible and convenient. Cloud computing technology will become an important support. The backend services of the technical network system require a large amount of computing and storage resources, such as video websites, image websites and more portal websites. With the rapid development and application of the Internet industry, in the future, each item may have its own identification mark, which needs to be transmitted to the backend system for logical processing. Data of different levels will be processed separately. All kinds of industry data need strong system backing support, which can only be achieved through cloud computing.

[0077] The cloud technology involved in this application mainly refers to the ability to obtain relevant log data of users through the "cloud", and to implement distributed auditing of the relevant log data through the "cloud", such as auditing the log data through a distributed system to audit the user's abnormal operation behavior.

[0078] See also Figure 1 , Figure 1 Schematic diagram of a network architecture provided by an embodiment of the present application. Figure 1 As shown, the network architecture may include a server 200 and a terminal device cluster, and the terminal device cluster may include one or more terminal devices, and the number of terminal devices is not limited here. Figure 1 As shown, the multiple terminal devices may specifically include a terminal device 100a, a terminal device 101a, a terminal device 102a, ..., a terminal device 103a; Figure 1 As shown, the terminal device 100a, the terminal device 101a, the terminal device 102a, ..., the terminal device 103a can all be connected to the server 200 through a network, so that each terminal device can exchange data with the server 200 through the network connection.

[0079] like Figure 1 The server 200 shown can be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN, and big data and artificial intelligence platforms. The terminal device can be a smart terminal such as a smart phone, a tablet computer, a laptop, a desktop computer, a smart TV, and a car terminal.

[0080] Please also see Figure 2 , Figure 2 It is a schematic diagram of a data detection scenario provided by the present application. The above-mentioned terminal devices (including terminal device 100a, terminal device 101a, terminal device 102a, ..., terminal device 103a) can all access the enterprise system (such as accessing through the client of the enterprise system). When the user accesses the enterprise system through the terminal device, the user can perform relevant user operations in the enterprise system. The server 200 can be the background server of the enterprise system. When the user performs relevant user operations in the enterprise system through the terminal device, the server 200 can generate relevant log data of the user performing the user operation, and the log data can contain relevant situations of the user performing the user operation.

[0081] Furthermore, the server 200 can parse the log data to obtain a log parameter set, which may include execution parameters for L operations of N objects in various time periods of a natural day, and the execution parameters may be the number of times the N objects perform the L operations in various time periods of a natural day. Among them, the N objects may be N users of an enterprise system, and the N users may have corresponding user accounts in the enterprise system. The users may perform corresponding user operations through their user accounts in the enterprise system, and the L operations may be several user operations that the users may perform. Among them, N and L are both positive integers, and the values ​​of N and L may be determined according to the actual application scenario. For a specific explanation of the log parameter set, please refer to the following Figure 3 Corresponding to the relevant description in the embodiment.

[0082] Therefore, the server 200 can detect the log parameter set to detect abnormal operation behaviors of N objects for L operations (such as the behavior of a certain object performing a certain operation within a certain period of time on a natural day is abnormal).

[0083] Optionally, the process of the server 200 detecting the log parameter set may be: first, the server 200 may divide the log parameter set through multiple data spaces to obtain log parameter subsets under each data space. Here, the multiple data spaces may include a data space indicated by non-working time on a working day, a data space indicated by working time on a working day, a data space indicated by non-working time on a non-working day, and a data space indicated by working time on a non-working day.

[0084] Therefore, by dividing the log parameter set, server 200 can obtain log parameter subset 1 under the data space indicated by the non-working time of working days, log parameter subset 2 under the data space indicated by the working time of working days, log parameter subset 3 under the data space indicated by the non-working time of non-working days, and log parameter subset 4 under the data space indicated by the working time of non-working days. Log parameter subset 1, log parameter subset 2, log parameter subset 3 and log parameter subset 4 constitute the log parameter set.

[0085] Therefore, the server 200 can calculate the abnormal execution offset parameters of N objects for L types of operations through the log parameter subset 1, and then the abnormal operation behavior of the user in the data space indicated by the non-working time of the working day can be detected through the abnormal execution offset parameters (which can be understood as detecting the abnormal execution parameters in the log parameter subset 1, corresponding to the execution detection result 1). The server 200 can calculate the abnormal execution offset parameters of N objects for L types of operations through the log parameter subset 2, and then the abnormal operation behavior of the user in the data space indicated by the working time of the working day can be detected through the abnormal execution offset parameters (which can be understood as detecting the abnormal execution parameters in the log parameter subset 2, corresponding to the execution detection result 2). The server 200 can calculate the abnormal execution offset parameters of N objects for L types of operations through the log parameter subset 3, and then the abnormal operation behavior of the user in the data space indicated by the non-working time of the non-working day can be detected through the abnormal execution offset parameters (which can be understood as detecting the abnormal execution parameters in the log parameter subset 3, corresponding to the execution detection result 3). The server 200 can calculate the abnormal execution offset parameters of N objects for L types of operations through the log parameter subset 4, and then detect the abnormal operation behavior of the user in the data space indicated by the working time of non-working days through the abnormal execution offset parameters (which can be understood as detecting the abnormal execution parameters in the log parameter subset 4, corresponding to the execution detection result 4). The process of the server 200 calculating the abnormal execution offset parameters through the log parameter subset and the process of predicting the execution detection result through the abnormal execution offset parameters can be referred to as follows Figure 3 Corresponding to the relevant description in the embodiment.

[0086] In the present application, by dividing several execution parameters into different data spaces for detection, the mutual influence (usually negative influence) between the execution parameters in different data spaces can be reduced, and by converting the execution parameters into abnormal execution offset parameters, the data dispersion can also be improved. Several data with greater dispersion are easier to detect anomalies (that is, detect abnormal data, that is, abnormal execution parameters). Therefore, this doubly improves the accuracy of the final detected execution detection results, thereby improving the accuracy of detecting abnormal user operation behaviors.

[0087] See also Figure 3 , Figure 3 It is a flow chart of a data detection method provided by the present application. The execution subject in the embodiment of the present application can be a computer device or a computer device cluster composed of multiple computer devices. The computer device can be a server or a terminal device. Therefore, the execution subject in the embodiment of the present application can be a server, a terminal device, or a server and a terminal device. Here, the execution subject in the embodiment of the present application is a server as an example for explanation.

[0088] like Figure 3 As shown, the method may include:

[0089] Step S101, obtaining a log parameter set; the log parameter set is obtained by analyzing and processing log data, the log data is used to record the execution status of N objects for L operations respectively; the log parameter set contains the execution parameters of the N objects for each operation respectively.

[0090] Optionally, the log parameter set is obtained by analyzing and processing log data, wherein the log data is used to record the execution status of N objects for L operations respectively, such as the execution status may include information such as the execution time, execution method, execution result and execution location of the object for the operation.

[0091] Among them, N objects can be all objects that need to be detected, such as N objects can include all employees of an enterprise (i.e., users), one object can be a user, N is a positive integer, and the specific value of N is determined according to the actual application scenario. L operations can be all operations that need to be detected, such as L operations can include all operations that can be performed by an object, and an operation can be understood as an action. The specific value of L can be determined according to the actual application scenario, and one operation is a user operation.

[0092] As shown in Table 1 below, the above L operations include but are not limited to:

[0093] Added delete Revise Query Upload download Audit Control Lifting controls freeze Unfreeze Clearance Interception Darken Add White …

[0094] Table 1

[0095] It can be seen from Table 1 above that the L types of operations may include but are not limited to adding operations, deleting operations, modifying operations, querying operations, uploading operations, downloading operations, reviewing operations, controlling operations, releasing controlling operations, freezing operations, releasing freezing operations, clearing operations, intercepting operations, blackening operations, whitening operations, etc.

[0096] The above L operations need to be performed on object objects, as shown in Table 2 below. The object objects include but are not limited to:

[0097] Personal name Balance Email telephone number ID number Amount Marital status Payment Account gender Currency Social media accounts Home address Country of Citizenship trade IP (address) Geolocation data Internal id Transaction Notes Bank card number Personal due diligence details Business order number Cash flow Card binding information Device association

[0098] Table 2

[0099] It can be seen from Table 2 above that the object objects for performing the L operations include but are not limited to the object object of the above-mentioned personal name, the object object of the balance, the object object of the email, the object object of the telephone number, the object object of the ID number, ..., the object object associated with the device, etc.

[0100] Each of the above operations is performed through a corresponding interface. An interface can be used to support an object (any object among N objects) to perform an operation. For example, an interface can be an interface for an object to modify its own personal name. It can be understood that the definition of an interface includes two parts: the operation type and the object. Only when the two parts are the same will it correspond to one interface. If there is at least one part that is different, it corresponds to different interfaces. For example, the operation of modifying a personal name (i.e., the object) (i.e., the operation type of modification) corresponds to one interface, the operation of modifying gender corresponds to another interface, and the operation of adding gender corresponds to another interface.

[0101] Optionally, the operations described above (such as operations of combining the contents in Table 1 and Table 2 one by one) can be referred to as sub-operations, and the L operations in the present application can be L operations obtained by aggregating several sub-operations.

[0102] For example, one of the L operations may be modifying personal information, and personal information may include personal name, telephone number, gender, nationality, marital status and home address. Therefore, modifying personal name, telephone number, gender, nationality, marital status and home address all belong to modifying personal information. Here, modifying personal name, telephone number, gender, nationality, marital status and home address each belongs to a sub-operation, which (i.e., the 6 sub-operations of modifying personal name, telephone number, gender, nationality, marital status and home address) are aggregated into one of the L operations.

[0103] Therefore, it can be understood that any one of the L operations that need to be detected in this application can include one sub-operation or multiple sub-operations that are aggregated, and one interface corresponds to one sub-operation. Therefore, any one of the L operations can correspond to one interface (such as an interface that executes one sub-operation) or to multiple aggregated interfaces (such as multiple interfaces that execute multiple aggregated sub-operations). Among them, the way in which this application aggregates sub-operations (such as which specific sub-operations need to be aggregated into one operation) is determined according to the actual application scenario and is not limited to this. As follows:

[0104] This application defines each interface, and then monitors the access behavior of the object (i.e., user) to the interface (i.e., executing the corresponding operation through the interface), so as to obtain the above-mentioned log data generated by the user after executing the corresponding operation through the corresponding interface. The log data can contain the relevant execution status after the user executes the corresponding operation through the interface. Among them, N objects can execute L operations in the business system of the enterprise to which they belong (the business system can be accessed through the client of the enterprise).

[0105] Among them, due to the diversity of application systems, the format of log data is diverse (such as different interfaces are called by different application systems, and the formats of log data generated by different interfaces called by different application systems will also be different). Therefore, the present application can extract and subsequently process the text domain of log data through the text processing method of regular expressions (that is, through the pattern method), which can improve the flexibility of parsing log data. By adopting the text processing method of regular expressions to parse and extract the above-obtained log data, the pre-defined (such as defined by regular expressions) operations that need to be detected (can also be understood as the defined interfaces that need to be detected, such as the interfaces corresponding to the above L types of operations) can be parsed to obtain log data related to the operations, which can be referred to as log data to be processed.

[0106] Among them, when the server parses the log data through regular expressions to obtain the log data to be processed, the log data can be analyzed by using the 5W1H analysis method (six why analysis method) to achieve accurate identification and distinction of the operation behaviors of each interface. Among them, the 5W1H analysis method is used to parse the log data, that is, the operation behavior of the interface is disassembled from six aspects: cause (Why), object (What), place (Where), time (When), personnel (Who), and method (How) to obtain the above-mentioned log data to be processed. The log data to be processed includes the relevant data obtained by parsing the log data using regular expressions and the 5W1H analysis method.

[0107] The above-mentioned log data to be processed contains operation behavior data related to each sub-operation. Furthermore, each sub-operation can be aggregated, and the above-mentioned L types of operations can be obtained. For example, the L types of operations can include operations of sensitive operation behavior types (which can include multiple aggregated sub-operations), operations of job function types (which can include multiple aggregated sub-operations), and operations of operation time types (which can include multiple aggregated sub-operations), etc.

[0108] Among them, one of the L types of operations obtained by aggregating each sub-operation through the log data to be processed can be understood as a feature of the object. The naming method of this feature can be the naming method of "username - time". Among them, the username is the name of the object, and the time can be the time when the object performs a certain operation. The granularity of this time includes seconds, minutes, hours, days, months, and years. For example, "Lele - 2021 / 06 / 06 / 19 / 20 / 20" represents the operation behavior of the object with the username "Lele" at 19:20:20 on June 6, 2021.

[0109] Furthermore, through the above-mentioned feature naming for the L types of operations, the execution parameters of N objects for each operation (that is, each operation among the L types of operations, and the operations described below are all operations among the L types of operations) can be obtained. The execution parameter can be the number of times each object performs each operation in each period of a natural day (such as 0 times, 1 time, 2 times,...). Among them, the length of each period of a natural day can be determined according to the actual application scenario. For example, a period of a natural day can be 1 hour, and at this time, a natural day contains 24 periods. Another example is that a period of a natural day can be 4 hours, and at this time, a natural day contains 6 periods. Among them, the log data within one year (specifically how long can also be determined according to the actual application scenario, and there is no limit to this) can be audited. Therefore, this natural day can include 365 days within one year starting from the current time, that is, 365 natural days.

[0110] Furthermore, a log parameter set can be formed by the number of times N objects perform each operation in each period of a natural day. An execution parameter in this log parameter set is the number of times an object performs an operation in a period of a natural day. If a certain user does not perform a certain operation in a certain period of a certain natural day, then an execution parameter of this user in the log parameter set is that the number of times of performing this operation in this period of this natural day is 0.

[0111] For example, if a time period z2 of natural day z1 is the hour from 11:00 to 12:00, N objects include object z3, and L operations include operation z4, then an execution parameter in the log parameter set can be the number of times object z3 executes operation z4 in time period z2 of natural day z1, where if at least one of the object, natural day, time period and operation is different, different execution parameters will correspond to them.

[0112] It should be noted that, before collecting relevant data of an object (such as the N objects mentioned above, i.e., N users) (such as user data such as the log data and log parameter sets mentioned above) and during the process of collecting relevant data of an object (i.e., a user), this application can display a prompt interface or pop-up window, and the prompt interface or pop-up window is used to prompt the user that its relevant data is currently being collected, so that this application only starts to execute the relevant steps of obtaining user-related data after obtaining the user's confirmation operation on the prompt interface or pop-up window, otherwise (i.e., when the user's confirmation operation on the prompt interface or pop-up window is not obtained), the relevant steps of obtaining user-related data are terminated, i.e., the user's relevant data is not obtained. In other words, all user data (i.e., data of N objects) collected by this application are collected with the user's consent and authorization, and the collection, use and processing of relevant user data need to comply with relevant laws, regulations and standards of relevant countries and regions.

[0113] See also Figure 4 , Figure 4 This is a schematic diagram of the interface of log data provided by this application. Figure 4 As shown, an enterprise can provide a risk control system to perform risk detection on its business system. The page of log security audit can be a page in the client corresponding to the enterprise's risk control system (wherein, the risk control system and the business system can be a client or different clients). The bottom-level log data (such as the log data of the above-mentioned N objects for L operations) is displayed under the navigation bar of "bottom-level log data monitoring" in the page of log security audit. The log data can include but is not limited to a curve chart of the change in the system log time series data volume, a curve chart of the year-on-year volatility of the system log data volume, and a curve chart of the system access traffic trend. The log data can also include but is not limited to the top (maximum) interface access volume, the top personal access volume, and the access volume of newly added personal users, wherein the top interface access volume includes the access volume corresponding to the interfaces with the largest access volume (such as the total number of accesses), the top personal access volume includes the access volume corresponding to the users with the largest access volume (i.e., the total number of accesses to all interfaces), and the access volume of newly added personal users (i.e., the total number of accesses to all interfaces by newly registered users in the recent period).

[0114] Step S102, divide the log parameter set according to M data spaces to obtain M log parameter subsets; any one of the M log parameter subsets is represented as the mth log parameter subset, and the mth log parameter subset is located in the mth data space; the mth log parameter subset contains N objects in the mth data space and the execution parameters of each operation respectively; m and M are both positive integers and m is less than or equal to M.

[0115] Optionally, the M data spaces in the present application may be divided according to working days, non-working days, working hours (i.e., working periods) and non-working hours (i.e., non-working periods). Therefore, the M data spaces may include a data space indicated by a working period of a working day, a data space indicated by a non-working period of a working day, a data space indicated by a working period of a non-working day, and a data space indicated by a non-working period of a non-working day, for a total of 4 data spaces, i.e., M is equal to 4. Among them, the M types of data spaces may also be determined according to actual application scenarios, and there is no limitation on this.

[0116] Among them, the above-mentioned working days and non-working days (such as working days and non-working days within a year) can be national statutory working days (such as Monday to Friday) and non-working days (such as weekends or statutory holidays), and the working hours and non-working hours of each day (such as each natural day within a year) can be determined according to the regulations of the enterprise. Among them, if the enterprise does not stipulate working hours and non-working hours within a natural day, the working hours and non-working hours in the natural day can be determined according to the access frequency of each time period in the natural day (such as the total number of accesses to all interfaces within the corresponding time period, and one user performing an operation once through an interface is counted as one access). If the access frequency within a time period is greater than or equal to the access frequency threshold, then the time period is considered to be a working time period. On the contrary, if the access frequency within a time period is less than the access frequency threshold, then the time period is considered to be a non-working time period.

[0117] Optionally, after obtaining the above L types of operations, the server may also obtain redundant operations in the L types of operations, wherein there are two ways of obtaining redundant operations, as described below.

[0118] The first way to obtain redundant operations: the server can determine the correlation between each operation in the L operations, and retain one operation from the multiple operations with greater correlation, that is, all operations except the retained one operation in the multiple operations are regarded as redundant operations. Specifically, any two operations in the L operations can be represented as the c1th operation and the c2th operation, where c1 and c2 are positive integers less than or equal to L, and c1 is not equal to c2. In other words, the c1th operation and the c2th operation are any two operations in the L operations, but the c1th operation and the c2th operation are not the same operation.

[0119] Therefore, the server can extract all execution parameters of N objects for the c1th operation and all execution parameters of N objects for the c2th operation from the log parameter set, and then the server can calculate the Pearson correlation coefficient between all execution parameters of N objects for the c1th operation and all execution parameters of N objects for the c2th operation. The Pearson correlation coefficient is the correlation coefficient between the c1th operation and the c2th operation. If the correlation coefficient is greater than the coefficient threshold (which can be set according to the actual application scenario), it indicates that the correlation between the c1th operation and the c2th operation is relatively large, and executing the c1th operation is likely to execute the c2th operation, or executing the c2th operation is likely to execute the c1th operation. In this case, redundant operations can be selected from the c1th operation and the c2th operation, that is, the c1th operation or the c2th operation can be used as redundant operations, and only one of the c1th operation and the c2th operation is retained.

[0120] For example, any one of the c1th operation and the c2th operation can be used as a redundant operation, or the filtering priority between the L operations can be preset and the operation with a higher filtering priority between the c1th operation and the c2th operation can be used as a redundant operation.

[0121] As shown in the following formula (1), the Pearson correlation coefficient ρ(X, Y) between the c1-th operation and the c2-th operation can be:

[0122]

[0123] Where X represents the sequence of all execution parameters of N objects for the c1th operation, Y represents the sequence of all execution parameters of N objects for the c2th operation, cov(X,Y) represents the covariance between X and Y, σX represents the standard deviation of X, and σY represents the standard deviation of Y.

[0124] The second way to obtain redundant operations: The server can calculate the information entropy of the execution parameters of L operations for N objects in the log parameter set. One operation corresponds to one information entropy, and the information entropy corresponding to one operation is calculated by N objects for the execution parameters of the operation. The information entropy corresponding to each operation can be called the operation information entropy corresponding to each operation, and then the operations whose corresponding operation information entropy among the L operations is less than the information entropy threshold (which can be determined according to the actual application scenario) can be regarded as redundant operations.

[0125] As shown in the following formula (2), the operation information entropy H(V) corresponding to an operation (which can be any one of the L operations, such as operation C) can be:

[0126]

[0127] Where V represents all execution parameters of N objects for operation C, v i represents the i-th execution parameter, where i ranges from 1 to I, and I is equal to the total number of all execution parameters of N objects for operation C. i ) indicates the execution parameter v i The probability of occurrence of N objects in all execution parameters of operation C (which can be the execution parameter v i The ratio of N objects to all execution parameters of operation C), b is the base of logarithm log, b can be 2, e (natural constant) or 10. If b is equal to 2, the unit of operation information entropy can be bit; if b is equal to e, the unit of operation information entropy can be nat; if b is equal to 10, the unit of operation information entropy can be hart.

[0128] Through the above description, the redundant operations among the L operations can be determined, and then when the server divides the log parameter set, it can be divided after filtering out all the execution parameters of the N objects in the log parameter set for the redundant operations. Specifically, the result after filtering out all the execution parameters of the N objects in the log parameter set for the redundant operations can be called a filtered parameter set, and the filtered parameter set includes the execution parameters in the log parameter set except the execution parameters of the N objects for the redundant operations.

[0129] Therefore, the filter parameter set can be divided by the time periods corresponding to the above-mentioned M data spaces and the execution parameters in the log parameter set, that is, the execution parameters contained in the filter parameter set are divided into the corresponding data spaces according to the corresponding time periods. For example, if an execution parameter in the filter parameter set is the execution parameter 1 of object 1 performing operation 1 (which can be any one of the L operations) in time period 1 of natural day 1, and the natural day 1 is a working day, and time period 1 of natural day 1 is a working time period, then the execution parameter 1 can be divided into the data space indicated by the working time period of the working day.

[0130] For example, an execution parameter in the filtering parameter set is execution parameter 2 of object 2 executing operation 2 within time period 2 of natural day 2, and natural day 2 is a non-working day and time period 2 of natural day 2 is a working time period, then the execution parameter 2 can be divided into the data space indicated by the working time period of the non-working day.

[0131] By dividing the filter parameter set in the log parameter set according to the principle described above, M log parameter subsets can be obtained. One data space can have one log parameter subset among the M log parameter subsets, that is, one data space corresponds to one log parameter subset. The execution parameters divided into a data space constitute the log parameter subset under the data space. One log parameter subset contains N objects and several execution parameters for each operation.

[0132] By adopting the method provided in the present application, the redundant operations in L operations (including the redundant operations obtained by the correlation coefficient and the redundant operations obtained by the operation information entropy) are first removed, that is, the execution parameters corresponding to the redundant operations in the log parameter set are removed, so that when predicting the execution parameters of each operation, there will not be much additional influence between the execution parameters of operations with too large correlation (that is, the correlation coefficient is too large), and the execution parameters of operations with low importance (that is, low operation information entropy) will not have a large impact on the execution parameters of other operations with high importance (that is, high operation information entropy), thereby realizing feature dimensionality reduction (that is, reducing the number of operations), which can not only improve the subsequent prediction accuracy of the execution detection results, but also improve the prediction efficiency of the execution detection results.

[0133] See also Figure 5 , Figure 5 This is a table diagram of a log parameter set provided by this application. Figure 5 As shown, here, N objects including user 1, user 2 and user 3 are used as an example for explanation. The log parameter set can include the total number of times that user 1, user 2 and user 3 respectively perform various operations (including operations of accessing 404, accessing user basic information, initiating POST request (a kind of web page request) and obtaining the fund flow of an account, etc.), and the total number can be more finely divided into the number of times that N objects respectively perform each operation in each time period of each natural day (i.e., several execution parameters in the log parameter set described above). Furthermore, the log parameter set can also indicate the object groups (i.e., groups) to which each object (such as user 1, user 2 and user 3) belongs. Here, the object group to which user 1 belongs is a group composed of several users of the legal department, the object group to which user 2 belongs is a group composed of several users of the risk control department, and the object group to which user 3 belongs is a group composed of several users of the service department.

[0134] See also Figure 6 , Figure 6It is a page schematic diagram of a risk control system provided by the present application. The page of the risk control system can display the user's behavior log, relevant data of the user's behavior analysis, and the audit results of the user. Among them, the log data of the above-mentioned N objects for L operations may include the user's behavior log. At this time, the behavior log may include the time when the user performs the operation (i.e., the operation time), the operation description, and the URL when the operation is performed (a link initiated by Http (Hypertext Transfer Protocol)). The relevant data of the behavior analysis may include a graph of the changes in the number of visits to the enterprise's business system in the last 90 days (or other days). The audit result of the user may be the target detection result or the execution detection result detected in the following step S104.

[0135] Step S103: Generate N objects according to the mth log parameter subset and execute offset parameters for each abnormal operation in the mth data space.

[0136] Optionally, any one of the above M log parameter subsets can be represented as the mth log parameter subset, the mth log parameter subset is located in the mth data space, the mth data space can also be any one of the M data spaces, and m is a positive integer less than or equal to M.

[0137] Therefore, the server can generate abnormal execution offset parameters for each operation of N objects in the mth data space according to the mth log parameter subset. One execution parameter in the mth log parameter subset corresponds to one abnormal execution offset parameter. One execution parameter corresponds to one operation. The abnormal execution offset parameter corresponding to one execution parameter is the abnormal execution offset parameter for the operation corresponding to the execution parameter. The abnormal execution offset parameter represents the degree of deviation of the object in executing the corresponding operation in the corresponding period of the corresponding natural day.

[0138] Optionally, an abnormal execution offset parameter corresponding to an execution parameter may include two types at the same time, one is an independent execution offset parameter, and the other is a group execution offset parameter. Among them, the independent execution offset parameter represents the deviation between the behavior of the object performing the corresponding operation in the corresponding period of the current natural day and the behavior of the object performing the operation in the same period of the historical natural day (which can be called personal behavior deviation). The larger the independent execution offset parameter, the larger the deviation, and vice versa, the smaller the independent execution offset parameter, the smaller the deviation. Similarly, the group execution offset parameter represents the deviation between the behavior of the object performing the corresponding operation in the corresponding period of the current natural day and the behavior of the group performing the operation in the same period of the natural day (which can be called group behavior deviation). The group may include objects among N objects that belong to the same object type as the object to which the execution parameter belongs. The larger the group execution offset parameter, the larger the deviation, and the smaller the group execution offset parameter, the smaller the deviation.

[0139] For example, the mth log parameter subset may include execution parameter 1 of object 1 performing operation 1 within time period 1 of natural day 1, and the execution parameter 1 corresponds to abnormal execution offset parameter 1, and the abnormal execution offset parameter 1 includes independent execution offset parameter 1 and group execution offset parameter 1. Therefore, the independent execution offset parameter 1 represents the behavior deviation between the behavior of object 1 performing operation 1 within time period 1 of natural day 1 and the behavior of the object performing operation 1 within time period 1 of the historical natural day of the natural day; the group execution offset parameter 1 represents the behavior deviation between the behavior of object 1 performing operation 1 within time period 1 of natural day 1 and the behavior of the group to which object 1 belongs performing operation 1 within time period 1 of natural day 1.

[0140] The specific process of generating N objects and executing the offset parameters for each operation exception in the mth data space can be found in the following Fig.11 Corresponding to the relevant description in the embodiment.

[0141] Step S104 , predicting the execution detection results of the N objects for each operation in the m th data space according to the abnormal execution offset parameters of the N objects for each operation in the m th data space.

[0142] Optionally, the server can use the abnormal execution offset parameters corresponding to the above-calculated execution parameters as a mapping to predict the execution detection results of each operation of N objects in the mth data space, and one execution parameter in the mth log parameter subset corresponds to one execution detection result. Since an object has multiple execution parameters for one operation (such as execution parameters for different / same time periods on different / same natural days), an object has multiple execution detection results for one operation.

[0143] The execution detection result is used to indicate whether the corresponding execution parameter is abnormal. If the execution parameter is abnormal, it indicates that the behavior of the object to perform the corresponding operation within the time period indicated by the execution parameter is abnormal. Conversely, if the execution parameter is normal, it indicates that the behavior of the object to perform the corresponding operation within the time period indicated by the execution parameter is normal.

[0144] Optionally, the server can obtain a random forest model for predicting independent execution offset parameters, and the random forest model can be referred to as a second random forest model. The server can also obtain a random forest model for predicting group execution offset parameters, and the random forest model can be referred to as a first random forest model. It can be understood that the random forest model uses a random forest algorithm (Random Forest, RF), which uses an unsupervised learning method. The random forest model can perform data measurement on the data distribution between several input data to detect isolated points in several data (i.e., isolated data, which can be referred to as outliers). The isolated data is data that is not distributed in the same range as most of the data. Among them, the first random forest model and the second random forest model can adjust the model parameters according to the actual application scenario.

[0145] Therefore, the server can input the group execution offset parameters of N objects for L types of operations (i.e., all group execution offset parameters corresponding to each execution parameter in the mth log parameter subset) into the above-mentioned first random forest model, so as to call the first random forest model to perform parameter measurement on the group execution offset parameters of N objects for L types of operations, and then detect the group execution detection results of N objects for each operation, and one execution parameter in the mth log parameter subset corresponds to one group execution detection result. Among them, the group execution detection result can be a group abnormal operation result or a group normal operation result. If the first random forest model detects that a certain group execution offset parameter is an isolated point (i.e., an isolated group execution offset parameter), then the group execution detection result corresponding to the execution parameter corresponding to the group execution offset parameter is the group abnormal operation result; and if the first random forest model detects that a certain group execution offset parameter is not an isolated point, then the group execution detection result corresponding to the execution parameter corresponding to the group execution offset parameter is the group normal detection result.

[0146] Similarly, the server can input the independent execution offset parameters of N objects for L types of operations (i.e., all independent execution offset parameters corresponding to each execution parameter in the mth log parameter subset) into the above-mentioned second random forest model to call the second random forest model to perform parameter measurement on the independent execution offset parameters of N objects for L types of operations, and then detect the independent execution detection results of N objects for each operation, and one execution parameter in the mth log parameter subset corresponds to one independent execution detection result. Among them, the independent execution detection result can be an independent abnormal operation result or an independent normal operation result. If the first random forest model detects that a certain independent execution offset parameter is an isolated point (i.e., an isolated independent execution offset parameter), then the independent execution detection result corresponding to the execution parameter corresponding to the independent execution offset parameter is the independent abnormal operation result; and if the first random forest model detects that a certain independent execution offset parameter is not an isolated point, then the independent execution detection result corresponding to the execution parameter corresponding to the independent execution offset parameter is the independent normal detection result.

[0147] Furthermore, the execution detection results corresponding to each execution parameter can be determined based on the independent execution detection results and group execution detection results corresponding to the above-mentioned execution parameters. Optionally, if the independent execution detection result corresponding to a certain execution parameter is an independent normal operation result, and the group execution detection result corresponding to the execution parameter is a group normal operation result, then it can be considered that the execution detection result corresponding to the execution parameter is a normal execution result, and the normal execution result indicates that the execution parameter is normal, and further indicates that the behavior of the object performing the corresponding operation in the time period indicated by the execution parameter is normal; otherwise, the execution detection result corresponding to the execution parameter is an abnormal execution result, and the abnormal execution result indicates that the execution parameter is abnormal, and further indicates that the behavior of the object performing the corresponding operation in the time period indicated by the execution parameter is abnormal.

[0148] Optional, the above is only an example, and the specific method of determining the corresponding execution detection result through independent execution detection results and group execution detection results can be determined according to the actual application scenario. For example, when the independent execution detection result is an independent normal operation result or the group execution detection result is a group normal operation result (that is, at least one is normal), the corresponding execution detection result can be considered to be a normal execution result, otherwise, it is an abnormal execution result.

[0149] For example, any one of the N objects can be represented as a target object, and any one of the L operations can be represented as a target operation. An execution parameter of the target object included in the mth log parameter subset can be the number of times the target object executes the target operation within the target time period of the target natural day. This number can be called the first number.

[0150] Therefore, the above-mentioned first random forest model can be used to obtain the group execution detection results of the target operation of the target object within the target time period of the target natural day (i.e. the group execution detection results corresponding to the first number), and the above-mentioned second random forest model can be used to obtain the independent execution detection results of the target operation of the target object within the target time period of the target natural day (i.e. the independent execution detection results corresponding to the first number).

[0151] Furthermore, the execution detection result corresponding to the first number can be determined by the independent execution detection result corresponding to the first number and the group execution detection result corresponding to the first number. If the independent execution detection result corresponding to the first number is an independent normal operation result, and the group execution detection result corresponding to the first number is a group normal operation result, then it can be determined that the execution detection result corresponding to the first number is a normal execution result, otherwise, the execution detection result corresponding to the first number is an abnormal execution result.

[0152] Furthermore, the execution parameters of the above-mentioned corresponding execution detection results which are abnormal execution results can be integrated and given to relevant technical personnel (such as sent to the terminal of the relevant technical personnel) for reference and review, so that the technical personnel can quickly locate which object, in which time period of which natural day, has abnormal behavior for which operation based on the execution parameters of the corresponding execution detection results which are abnormal execution results.

[0153] Optionally, after obtaining the execution detection results corresponding to the above-mentioned execution parameters, the relevant technical personnel may not be informed that the corresponding execution detection results are execution parameters of abnormal execution results. Instead, the execution detection results may be combined with additional detection results detected by additional detection strategies to obtain the final target detection results. An execution parameter in the mth log parameter set corresponds to a target detection result, which may be an abnormal detection result or a normal detection result. Then, the server may integrate the execution parameters of the corresponding target detection results that are abnormal detection results and provide them to the relevant technical personnel for reference and review, so that the technical personnel can quickly locate which object, in which natural day, in which time period and for which operation the behavior is abnormal according to the execution parameters of the corresponding target detection results that are abnormal detection results. Please refer to the following description.

[0154] Specifically, the server can obtain the additional detection strategy, and can detect each execution parameter in the mth log parameter subset according to the additional detection strategy, such as detecting whether each execution parameter in the mth log parameter subset hits the additional detection strategy, and then the additional detection results for each operation of N objects in the mth data space can be obtained. The additional detection result for an operation is the additional detection result corresponding to the execution parameter corresponding to the operation. One execution parameter corresponds to one additional detection result. If an execution parameter hits the additional detection strategy (i.e., meets the conditions indicated by the additional detection strategy), the additional detection result corresponding to the execution parameter is an abnormal detection result. If an execution parameter does not hit the additional detection strategy (i.e., does not meet the conditions indicated by the additional detection strategy), the additional detection result corresponding to the execution parameter is a normal detection result.

[0155] Furthermore, the server can determine the target detection results of the N objects for each operation in the mth data space based on the additional detection results and execution detection results of the N objects for each operation in the mth data space: Optionally, if the additional detection result corresponding to an execution parameter is a normal detection result, and the execution detection result corresponding to the execution parameter is a normal execution result, then the target detection result corresponding to the execution parameter can be considered to be a normal detection result; otherwise, the target detection result corresponding to the execution parameter is considered to be an abnormal detection result.

[0156] Among them, the above-mentioned additional detection strategy is a pre-set condition for indicating that the execution parameter is abnormal. The additional detection strategy can be set by relevant technical experts based on experience. The additional detection strategy can be set according to the actual application scenario, and there is no restriction on this. Therefore, it can be understood that since the above-mentioned execution detection results are obtained through machine learning prediction (such as prediction by the first random forest model and the second random forest model), the additional detection results are obtained through expert experience. Therefore, by combining the execution detection results obtained by machine learning and the additional detection results obtained by expert experience, the final target detection results can be made more accurate and reasonable, and the abnormal behavior of the object that is finally located to perform the corresponding operation is also more accurate.

[0157] For example, the mth log parameter subset may include execution parameter 1 of object 1 performing operation 1 in time period 1 of natural day 1. If the target detection result corresponding to the execution parameter 1 is an abnormal detection result, it indicates that the behavior of object 1 performing operation 1 in time period 1 of natural day 1 is detected to be abnormal. The execution parameter (or other data related to the execution parameter) may be given to relevant technical personnel for review.

[0158] See also Figure 7 , Figure 7This is a flow chart of an expert experience test provided by this application. Figure 7 As shown, first, s1: the analysis framework may include predefined relevant data that needs to be detected by additional detection strategies, such as the relevant data may include the level of the number of visits (i.e., the number of times the operation is performed) of each object group for various operations, such as high, medium or low levels. s2: the analysis result may be to find out the behavior of the user that deviates greatly from the individual and the group (the behavior may be indicated by the corresponding execution parameter, such as the behavior may be the number of times the corresponding operation is performed in the corresponding period of the natural day indicated by the execution parameter), and the behavior of the user that deviates greatly from the individual and the group may be the behavior indicated by the execution parameter whose corresponding independent execution offset parameter and group execution offset parameter are both relatively large (such as greater than the corresponding threshold). s3: Establishing a logic tree is to establish the above-mentioned additional detection strategy, which may include a strategy for objects of a certain group of objects to perform specific operations under specific conditions, such as the additional detection strategy may include: 1. The object of the legal department queried the basic information of more than x1 (the specific value is determined according to the actual application scenario) users within 1 hour; 2. The object of the legal department queried the basic information of more than x2 (the specific value is determined according to the actual application scenario) users in a single day; 3. The object of the legal department queried the basic information of more than x3 (the specific value is determined according to the actual application scenario) normal users (users with no control, complaints or blacklist records) within 1 hour; 4. The object of the legal department queried the basic information of more than x4 (the specific value is determined according to the actual application scenario) normal users in a single day; 5. The risk control department queried the fund flow information of more than x5 (the specific value is determined according to the actual application scenario) normal users within 1 hour, and the flow interval is greater than 1 month, etc. s4: The validation hypothesis rule can be to test the rationality of the additional detection strategy set above through the execution parameters of the existing related objects. If it is reasonable (for example, the additional detection strategy can be hit for most abnormal operation behaviors), the additional detection strategy can be put into formal use.

[0159] By adopting the above method, the server can detect the subset of log parameters in each data space to detect abnormal operation behaviors of N objects in each data space. By adopting this application, the abnormal operation behaviors of objects can be accurately and quickly located, thereby serving as a warning to relevant technical personnel, providing a reference for relevant technical personnel to analyze abnormal operations, and improving system information security.

[0160] See also Figure 8 , Figure 8 This is a page diagram of a risk control system provided by this application. Figure 8As shown, the function column of "Statistical Report" on the page of the risk control system may include the detection results of abnormal operation behaviors of the object for operation, and the detection results may include the number of hits, the number of exclusions, the number of people to be confirmed, and the cumulative number of pushes.

[0161] Among them, the server can detect the log parameter set within a year every day through the above process. The log parameter set of one day has the execution parameters newly added on that day compared with the log parameter set of the previous day. Optionally, it can be understood that when the log parameter set is divided by the data space every day, the execution parameters that have been divided on the previous day can be divided again, but only the execution parameters newly added in the new day can be divided to obtain M log parameter subsets of the new day. The number of hits refers to the total number of objects with abnormal target detection results detected on the day and the objects that are still considered abnormal after manual review. The number of excluded people refers to the total number of objects without abnormal target detection results. The number of people to be confirmed refers to the total number of objects with abnormal target detection results but have not been manually reviewed. The cumulative number of pushes refers to the cumulative number of people who push abnormalities, which refers to the total number of hits per day up to now. The page of the risk control system can also include the daily work order volume, and a work order can refer to an abnormal execution parameter detected.

[0162] See also Fig. 9 , Fig. 9 Schematic diagram of a detection system provided by this application. Fig. 9 As shown, firstly, data processing can be performed (including data cleaning, regular extraction (such as data parsing through the above regular expressions), splicing (such as classifying the data, such as obtaining execution parameters belonging to the same object through log data integration), etc.) to obtain the above log parameter set.

[0163] Next is feature engineering, which can include feature analysis, feature combination, and time series features, among which sub-operations can be understood as features. Feature analysis can be to analyze the number of visits of each object to various sub-operations. Feature combination can be to classify several sub-operations to obtain the above-mentioned L operations. Time series features can refer to the sum of the number of executions of the object for L operations at different times of different natural days, and obtain the total number of executions of the object for L operations at different time periods of different natural days (i.e., execution parameters).

[0164] Then comes model construction. In this application, the first random forest model and the second random forest model can be obtained by designing the steps of model training, model evaluation (such as application testing of the model), parameter optimization (such as optimizing model parameters) and model release (putting the model into formal use).

[0165] Through the above description, the relevant data required by the detection module can be obtained, including the machine learning model (including the first random forest model for the group and the second random forest model for the individual) and the expert experience module (including the construction of additional detection strategies such as rule 1, rule 2 and rule 3), and the detection module can be used to detect the log parameter set. Service applications related to the detection results of the log parameter set can include manual investigation, anomaly analysis, email warning, continuous monitoring, work order management, and service interface (such as interface maintenance) and other related applications.

[0166] See also Fig.10 , Fig.10 This is a schematic diagram of a data detection scenario provided by this application. Fig.10 As shown, first, the log parameter set can be detected by the anomaly mining engine. The way in which the anomaly mining engine detects the log parameter set is the way in which the log parameter set is detected by the first random forest model and the second random forest model. Then, the log parameter set can be detected by the expert experience module. The way in which the log parameter set is detected by the expert experience module is the way in which the log parameter set is detected by the attachment detection module. Then, manual review can be performed to obtain the final test result (such as abnormal user operation behavior confirmed by the anomaly mining engine, expert experience module and manual review), and then the test result is sent to the mailbox of the relevant technical personnel for email warning confirmation. Finally, case collection is performed. Case collection can refer to archiving the detected abnormal user operation behavior (such as the behavior of performing a certain operation).

[0167] Among them, the expert experience rules (ie, attachment detection strategies) established in the expert experience module can be obtained through in-depth analysis of abnormal data (such as abnormal execution parameters) in the detection results of the abnormality mining engine.

[0168] The present application obtains a log parameter set; the log parameter set is obtained by analyzing and processing log data, and the log data is used to record the execution status of N objects for L operations respectively; the log parameter set contains the execution parameters of N objects for each operation respectively; the log parameter set is divided according to M data spaces to obtain M log parameter subsets; any one of the M log parameter subsets is represented as the mth log parameter subset, and the mth log parameter subset is located in the mth data space; the mth log parameter subset contains the execution parameters of N objects for each operation respectively in the mth data space; m and M are both positive integers and m is less than or equal to M; according to the mth log parameter subset, the abnormal execution offset parameters of N objects for each operation respectively in the mth data space are generated; according to the abnormal execution offset parameters of N objects for each operation respectively in the mth data space, the execution detection results of N objects for each operation respectively in the mth data space are predicted. It can be seen that the method proposed in the present application can divide the log parameter set in the data space so that the execution parameters of different data spaces will not affect each other. In addition, the present application can also map the execution parameters of the object for the operation to the corresponding abnormal execution offset parameters before detection, which can doubly improve the accuracy of the execution detection results of the detection object for the operation.

[0169] See also Fig.11 , Fig.11 is a flowchart of a method for calculating abnormal execution offset parameters provided by the present application. The execution subject in the embodiment of the present application can be the same as the above Figure 3 The execution subject in the corresponding embodiment is the same, such as a server. The content described in the embodiment of the present application can be the same as the above Fig.11 The contents described in the corresponding embodiments are combined. Fig.11 As shown, the method may include:

[0170] Step S201, extract the second number of times the target object performs the target operation within the target time period of the historical natural day from the mth log parameter subset, and generate an independent execution offset parameter for the target operation of the target object within the target time period of the target natural day based on the second number and the first number; the historical natural day is before the target natural day.

[0171] Optionally, the embodiment of the present application takes the generation of abnormal execution offset parameters corresponding to the first number of the above-mentioned target object as an example for explanation. It can be known that the principles of generating abnormal execution offset parameters corresponding to each execution parameter in the mth log parameter subset are the same.

[0172] The server can extract the number of times the target object performs the target operation within the target period of the historical natural day from the mth log parameter subset. This number can be called the second number, which also belongs to the execution parameter in the mth log parameter subset. The number of historical natural days can be determined according to the actual application scenario. For example, the historical natural day can be 30 days, 60 days, or 90 days before the target natural day. There is no restriction on this. The target object can correspond to one second number in one historical natural day, so there can be multiple second numbers. Among them, the target period can be a certain hour in a day, such as the period from 11:00 to 12:00.

[0173] Then, the server may generate an independent execution offset parameter for the target object within the target time period of the target natural day and for the target operation according to the first number and the second number. The independent execution offset parameter may be recorded as P D , as shown in the following formula (3), the independent execution offset parameter P D for:

[0174]

[0175] Among them, x represents the first number, x l represents a sequence consisting of several second-order numbers, σx l Represents x l The standard deviation of (which can be called the first standard deviation), x l，mean It represents the mean of all the second-order numbers (i.e. the average value, which can be called the first mean).

[0176] Step S202, extracting the third number of times the object group performs the target operation within the target time period of the target natural day from the mth log parameter subset, and generating a group execution offset parameter for the target operation within the target time period of the target natural day based on the third number and the first number; the object group includes objects of the same object type as the target object among the N objects.

[0177] Optionally, the server can extract the number of times the object group performs the target operation within the target time period of the target natural day from the log parameter subset. This number can be called the third number, which also belongs to the execution parameter in the mth log parameter subset. The object group can include several objects of the same object type as the target object among the N objects. One object in the object group can correspond to one third number, so there can be multiple third numbers. Optionally, if the number of objects contained in one or several object groups is too small, the object group can be merged with other object groups to obtain the merged object group and then calculate the group execution offset parameter.

[0178] Among them, objects belonging to the same object type as the target object can be determined according to the actual application scenario. For example, objects among N objects that belong to the same department as the target object can be considered as objects belonging to the same object type as the target object. For another example, objects among N objects that belong to the same team as the target object can be considered as objects belonging to the same object type as the target object. There is no restriction on this.

[0179] Then, the server can generate a group execution offset parameter for the target object within the target time period of the target natural day and for the target operation according to the first number and the third number. The group execution offset parameter can be recorded as P q , as shown in the following formula (4), the group performs the offset parameter P q for:

[0180]

[0181] Among them, x represents the first number, x q represents a sequence consisting of several third-order numbers, σx q Represents x q The standard deviation of (which can be called the second standard deviation), x q，mean It represents the mean of all third-order numbers (i.e. the average value, which can be called the second mean).

[0182] Step S203: determine the independent execution offset parameter and the group execution offset parameter of the target object for the target operation as the abnormal execution offset parameter of the target object for the target operation.

[0183] Optionally, the independent execution offset parameters and group execution offset parameters of the target object for the target operation within the target time period of the target natural day (i.e., the independent execution offset parameters and group execution offset parameters corresponding to the first number) calculated above can be used as the abnormal execution offset parameters of the target object for the target operation within the target time period of the target natural day (i.e., the abnormal execution offset parameters corresponding to the first number).

[0184] See also Fig.12 , Fig.12 This is a schematic diagram of a data detection scenario provided by this application. Fig.12As shown, the N objects may include object A, object B, object C and object D, and the various time periods of a natural day may include time 1, time 2, time 3, time 4, time 5, time 6 and time 7. Therefore, if you want to evaluate the operating behavior of user B at time 5 (i.e., time period 5) of a natural day, you can evaluate the individual behavior of user B horizontally (by calculating the above-mentioned independent execution offset parameter evaluation), and you can evaluate the collective behavior of user B vertically (by calculating the above-mentioned group execution offset parameter evaluation). Therefore, by evaluating the user's operating behavior horizontally and vertically, the evaluation accuracy can be higher.

[0185] The present application detects the execution behavior of the object for the operation by combining the individual baseline (characterized by the independent execution offset parameter) and the group baseline (characterized by the group execution offset parameter), and its accuracy can be higher.

[0186] See also Fig.13 , Fig.13 This is a schematic diagram of a data detection scenario provided by the present application. The present application can first input log data, and then pre-process the log data (such as cleaning, regular extraction, etc.) to obtain the above-mentioned log data to be processed, and process the log data to be processed through feature engineering (such as feature integration) to obtain the above-mentioned log parameter set.

[0187] Next, the present application can divide the log parameter set to obtain log parameter subset 1 under the data space of working days and non-working hours, log parameter subset 2 under the data space of working days and working hours, log parameter subset 3 under the data space of non-working days and non-working hours, and log parameter subset 4 under the data space of non-working days and working hours.

[0188] The server can calculate the group execution offset parameters and independent execution offset parameters corresponding to each execution parameter through each log parameter subset (including log parameter subset 1, log parameter subset 2, log parameter subset 3 and log parameter subset 4), and then can use the first random forest model to perform parameter measurement on the group execution offset parameters corresponding to each log parameter subset to obtain the group detection result (i.e. the above-mentioned group execution detection result), and can use the second random forest model to perform parameter measurement on the independent execution offset parameters corresponding to each log parameter subset to obtain the individual detection result (i.e. the above-mentioned independent execution detection result). By combining the group detection results and individual detection results corresponding to each log parameter subset, the output results corresponding to each log parameter subset (such as the execution detection results of each execution parameter in the log parameter subset) can be obtained. Finally, the total output result (such as the execution detection results of each execution parameter in the log parameter set) can be obtained by integrating the output results corresponding to each log parameter subset.

[0189] See also Fig.14 , Fig.14 This is a verification diagram of a data detection provided by this application. Fig.14 As shown, the raw data here can refer to the execution parameters in the log parameter subset. Optionally, the data can be reduced to a two-dimensional plane by t-sne (a technology that combines dimensionality reduction and visualization) or PCA (a data analysis method). Here Fig.14 The results in the figure are reduced using t-sne.

[0190] The raw data here can refer to the execution parameters in the log parameter set, the personal characteristics can refer to all independent execution offset parameters, and the group characteristics can refer to all group execution offset parameters. Fig.14 It can be clearly seen from the dimensionality reduction results that the original data is relatively concentrated, while the independent execution offset parameters and the group execution offset parameters are relatively scattered. Since the more scattered the data, the greater the data distinction, therefore, by converting the execution parameters into abnormal execution offset parameters (including independent execution offset parameters and group execution offset parameters) and inputting them into the random forest model (including the first random forest model and the second random forest model) for prediction, the prediction results can be more accurate.

[0191] See also Fig.15 , Fig.15 : is a structural diagram of a data detection device provided by the present application. The data detection device may be a computer program (including program code) running in a computer device. For example, the data detection device is an application software. The data detection device may be used to execute the corresponding steps in the method provided in the embodiment of the present application. Fig.15 As shown, the data detection device 1 may include: an acquisition module 11, a division module 12, a generation module 13 and a prediction module 14;

[0192] The acquisition module 11 is used to acquire a log parameter set; the log parameter set is obtained by analyzing and processing log data, and the log data is used to record the execution status of N objects for L operations respectively; the log parameter set includes the execution parameters of the N objects for each operation respectively;

[0193] The partitioning module 12 is used to partition the log parameter set according to M data spaces to obtain M log parameter subsets; any one of the M log parameter subsets is represented as the mth log parameter subset, and the mth log parameter subset is located in the mth data space; the mth log parameter subset includes execution parameters of N objects in the mth data space for each operation; m and M are both positive integers and m is less than or equal to M;

[0194] A generating module 13 is used to generate abnormal execution offset parameters of N objects for each operation in the mth data space according to the mth log parameter subset;

[0195] The prediction module 14 is used to predict the execution detection results of the N objects for each operation in the mth data space according to the abnormal execution offset parameters of the N objects for each operation in the mth data space.

[0196] Optionally, the division module 12 divides the log parameter set according to the M data spaces to obtain M log parameter subsets, including:

[0197] Get redundant operations among L operations;

[0198] Filter the execution parameters of the N types of objects in the log parameter set for redundant operations to obtain a filtered parameter set;

[0199] The filter parameter set is divided according to the M data spaces to obtain M log parameter subsets.

[0200] Optionally, any two operations among the L operations are represented as a c1th operation and a c2th operation, where c1 and c2 are both positive integers less than or equal to L, and c1 is not equal to c2;

[0201] The division module 12 obtains the redundant operations in the L operations in the following manner:

[0202] Extracting execution parameters of N objects for the c1th operation and execution parameters of N objects for the c2th operation from the log parameter set;

[0203] Calculate the correlation coefficient between the c1th operation and the c2th operation according to the execution parameters of the N objects for the c1th operation and the execution parameters of the N objects for the c2th operation;

[0204] If the correlation coefficient is greater than the coefficient threshold, redundant operations are determined from the c1-th operation and the c2-th operation.

[0205] Optionally, the division module 12 obtains the redundant operations in the L operations in a manner including:

[0206] According to the execution parameters of L operations in N objects in the log parameter set, the operation information entropy corresponding to each operation is calculated;

[0207] The operations whose corresponding operation information entropy among the L operations is less than the information entropy threshold are determined as redundant operations.

[0208] Optionally, any one of the N objects is represented as a target object; any one of the L operations is represented as a target operation; an execution parameter of the target object included in the mth log parameter subset is the first number of times the target object executes the target operation within a target period of a target natural day;

[0209] The generation module 13 generates N objects according to the mth log parameter subset, and executes offset parameters for each abnormal operation in the mth data space respectively, including:

[0210] Extract the second number of times the target object performs the target operation within the target period of the historical natural day from the mth log parameter subset, and generate an independent execution offset parameter for the target operation of the target object within the target period of the target natural day according to the second number and the first number; the historical natural day is before the target natural day;

[0211] Extract the third number of times the target operation is performed by the target group within the target time period of the target natural day from the mth log parameter subset, and generate a group execution offset parameter for the target operation by the target object within the target time period of the target natural day according to the third number and the first number; the object group includes objects of the same object type as the target object among the N objects;

[0212] An independent execution offset parameter and a group execution offset parameter of the target object for the target operation are determined as abnormal execution offset parameters of the target object for the target operation.

[0213] Optionally, the generating module 13 generates, according to the second number and the first number, a method for independently executing offset parameters for a target operation of a target object within a target period of a target natural day, including:

[0214] Calculate the first mean and the first standard deviation between the second number and the first number;

[0215] An independent execution offset parameter of the target object for the target operation is determined according to the first mean and the first standard deviation.

[0216] Optionally, the generating module 13 generates a method for executing the offset parameter for the target object within the target time period of the target natural day and for the target operation group according to the third number and the first number, including:

[0217] Calculate the second mean and second standard deviation between the third number and the first number;

[0218] A group execution offset parameter of the target object for the target operation is determined according to the second mean and the second standard deviation.

[0219] Optionally, the prediction module 14 predicts the execution detection results of each operation of the N objects in the mth data space according to the abnormal execution offset parameters of each operation of the N objects in the mth data space, including:

[0220] The first random forest model is called to perform parameter calculation on the group execution offset parameters of the N objects for the L types of operations, and the group execution detection results of the target objects for the target operations within the target time period of the target natural day are obtained;

[0221] The second random forest model is called to perform parameter measurement on the independent execution offset parameters of the N objects for the L operations respectively, and the independent execution detection result of the target object for the target operation within the target time period of the target nature is obtained;

[0222] The execution detection result corresponding to the first number of target objects is determined according to the independent execution detection result and the group execution detection result.

[0223] Optionally, the independent execution detection result is an independent abnormal operation result or an independent normal operation result, and the group execution detection result is a group abnormal operation result or a group normal operation result; if the independent execution detection result is an independent normal operation result, and the group execution detection result is a group normal operation result, then the execution detection result corresponding to the first number is a normal execution result, otherwise, the execution detection result corresponding to the first number is an abnormal execution result.

[0224] Optionally, the M types of data spaces include the data space indicated by the working time period of working days, the data space indicated by the non-working time period of working days, the data space indicated by the working time period of non-working days, and the data space indicated by the non-working time period of non-working days; the N objects in the log parameter set have execution parameters for each operation, which are the number of times the N objects perform each operation in each time period of a natural day, and the natural day includes working days and non-working days; an execution parameter in the mth log parameter subset corresponds to an abnormal execution offset parameter and an execution detection result.

[0225] Optionally, the device 1 is also used for:

[0226] Get additional detection strategies;

[0227] Determine the additional detection results of each operation of the N objects in the mth data space according to the additional detection strategy and the mth log parameter subset;

[0228] According to the additional detection results and the execution detection results of the N objects for each operation in the m-th data space, the target detection results of the N objects for each operation in the m-th data space are determined.

[0229] According to one embodiment of the present application, Figure 3 The steps involved in the data detection method shown can be represented by Fig.15 The data detection device 1 shown in the figure is executed by each module. For example, Figure 3 The step S101 shown in FIG. 1 can be performed by Fig.15 The acquisition module 11 in is executed, Figure 3 The step S102 shown in FIG. 1 can be performed by Fig.15 The partitioning module 12 is used for execution; Figure 3 The step S103 shown in FIG. 1 can be performed by Fig.15 The generation module 13 in is executed, Figure 3 The step S104 shown in FIG. 1 can be performed by Fig.15 The prediction module 14 is used to execute.

[0230] The present application obtains a log parameter set; the log parameter set is obtained by analyzing and processing log data, and the log data is used to record the execution status of N objects for L operations respectively; the log parameter set contains the execution parameters of N objects for each operation respectively; the log parameter set is divided according to M data spaces to obtain M log parameter subsets; any one of the M log parameter subsets is represented as the mth log parameter subset, and the mth log parameter subset is located in the mth data space; the mth log parameter subset contains the execution parameters of N objects for each operation respectively in the mth data space; m and M are both positive integers and m is less than or equal to M; according to the mth log parameter subset, the abnormal execution offset parameters of N objects for each operation respectively in the mth data space are generated; according to the abnormal execution offset parameters of N objects for each operation respectively in the mth data space, the execution detection results of N objects for each operation respectively in the mth data space are predicted. It can be seen that the device proposed in the present application can divide the log parameter set in the data space so that the execution parameters of different data spaces will not affect each other. In addition, the present application can also map the execution parameters of the object for the operation to the corresponding abnormal execution offset parameters before detection, which can doubly improve the accuracy of the execution detection results of the detection object for the operation.

[0231] According to one embodiment of the present application, Fig.15Each module in the data detection device 1 shown can be respectively or all merged into one or several units to constitute, or some (some) units therein can also be split into multiple smaller sub-units in function, can realize the same operation, and does not affect the realization of the technical effect of the embodiment of the application. The above-mentioned modules are divided based on logical functions, and in practical applications, the function of a module can also be realized by multiple units, or the function of multiple modules is realized by one unit. In other embodiments of the application, the data detection device 1 can also include other units, and in practical applications, these functions can also be assisted by other units to realize, and can be realized by the collaboration of multiple units.

[0232] According to one embodiment of the present application, the program can be executed by running on a general-purpose computer device such as a computer including a central processing unit (CPU), a random access memory medium (RAM), a read-only memory medium (ROM), and other processing elements and storage elements. Figure 3 A computer program (including program code) for each step involved in the corresponding method shown in Fig.15 The data detection device 1 shown in the figure is used to implement the data detection method of the embodiment of the present application. The above computer program can be recorded on a computer-readable recording medium, for example, and loaded into the above computing device through the computer-readable recording medium and run therein.

[0233] See also Fig.16 , Fig.16 Schematic diagram of the structure of a computer device provided by this application. Fig.16 As shown, the computer device 1000 may include: a processor 1001, a network interface 1004 and a memory 1005. In addition, the computer device 1000 may also include: a user interface 1003, and at least one communication bus 1002. The communication bus 1002 is used to realize the connection and communication between these components. The user interface 1003 may include a display screen (Display), a keyboard (Keyboard), and the user interface 1003 may optionally include a standard wired interface and a wireless interface. The network interface 1004 may optionally include a standard wired interface and a wireless interface (such as a WI-FI interface). The memory 1005 may be a high-speed RAM memory, or a non-volatile memory (non-volatile memory), such as at least one disk storage. The memory 1005 may optionally be at least one storage device located away from the aforementioned processor 1001. As Fig.16 As shown, the memory 1005 as a computer storage medium may include an operating system, a network communication module, a user interface module, and a device control application program.

[0234] exist Fig.16 In the computer device 1000 shown, the network interface 1004 can provide a network communication function; the user interface 1003 is mainly used to provide an input interface for the user; and the processor 1001 can be used to call the device control application stored in the memory 1005 to achieve:

[0235] Get a log parameter set; the log parameter set is obtained by analyzing and processing log data, and the log data is used to record the execution status of N objects for L operations respectively; the log parameter set contains the execution parameters of N objects for each operation respectively;

[0236] The log parameter set is divided according to M data spaces to obtain M log parameter subsets; any one of the M log parameter subsets is represented as the mth log parameter subset, and the mth log parameter subset is located in the mth data space; the mth log parameter subset contains the execution parameters of N objects for each operation in the mth data space; m and M are both positive integers and m is less than or equal to M;

[0237] Generate N objects according to the mth log parameter subset to execute offset parameters for each operation exception in the mth data space;

[0238] According to the abnormal execution offset parameters of each operation of the N objects in the m-th data space, the execution detection results of each operation of the N objects in the m-th data space are predicted.

[0239] It should be understood that the computer device 1000 described in the embodiment of the present application can execute the above Figure 3 The description of the above data detection method in the corresponding embodiment can also be performed Fig.15 The description of the data detection device 1 in the corresponding embodiment will not be repeated here. In addition, the description of the beneficial effects of the same method will not be repeated here either.

[0240] In addition, it should be pointed out here that: the present application also provides a computer-readable storage medium, and the computer-readable storage medium stores a computer program executed by the data detection device 1 mentioned above, and the computer program includes program instructions. When the processor executes the program instructions, it can execute the above-mentioned Figure 3 The description of the data detection method in the corresponding embodiment will not be repeated here. In addition, the description of the beneficial effects of adopting the same method will not be repeated. For technical details not disclosed in the computer storage medium embodiment involved in this application, please refer to the description of the method embodiment of this application.

[0241] As an example, the above program instructions may be deployed on a computer device for execution, or deployed on multiple computer devices located at one location for execution, or executed on multiple computer devices distributed at multiple locations and interconnected by a communication network. Multiple computer devices distributed at multiple locations and interconnected by a communication network may constitute a blockchain network.

[0242] The computer-readable storage medium may be the data detection device provided in any of the aforementioned embodiments or the internal storage unit of the computer device, such as the hard disk or memory of the computer device. The computer-readable storage medium may also be an external storage device of the computer device, such as a plug-in hard disk, a smart memory card (smart media card, SMC), a secure digital (secure digital, SD) card, a flash card (flash card), etc. equipped on the computer device. Further, the computer-readable storage medium may also include both the internal storage unit of the computer device and an external storage device. The computer-readable storage medium is used to store the computer program and other programs and data required by the computer device. The computer-readable storage medium may also be used to temporarily store data that has been output or is to be output.

[0243] The present application provides a computer program product or a computer program, the computer program product or the computer program includes computer instructions, the computer instructions are stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the computer device executes the above Figure 3 The description of the above data detection method in the corresponding embodiment will not be repeated here. In addition, the description of the beneficial effects of the same method will not be repeated. For technical details not disclosed in the computer-readable storage medium embodiment involved in this application, please refer to the description of the method embodiment of this application.

[0244] The terms "first", "second", etc. in the description, claims, and drawings of the embodiments of the present application are used to distinguish different objects, rather than to describe a specific order. In addition, the term "comprising" and any of their variations are intended to cover non-exclusive inclusions. For example, a process, method, device, product, or equipment that includes a series of steps or units is not limited to the listed steps or modules, but optionally includes steps or modules that are not listed, or optionally includes other step units inherent to these processes, methods, devices, products, or equipment.

[0245] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in terms of function in the above description. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0246] The method and related apparatus provided by the embodiment of the present application are described with reference to the method flow chart and / or structural diagram provided by the embodiment of the present application. Specifically, each process and / or box in the method flow chart and / or structural diagram, as well as the combination of the processes and / or boxes in the flow chart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the process in the process. Figure 1 A process or multiple processes and / or structures Figure 1 These computer program instructions can also be stored in a computer-readable memory that can guide a computer or other programmable data processing device to work in a specific way, so that the instructions stored in the computer-readable memory produce a product including an instruction device, which implements the functions specified in the process. Figure 1 A process or multiple processes and / or structures Figure 1 These computer program instructions can also be loaded onto a computer or other programmable data processing device, so that a series of operation steps are executed on the computer or other programmable device to produce a computer-implemented process, so that the instructions executed on the computer or other programmable device provide for implementing the process in the process. Figure 1 A flow or multiple flows and / or structures illustrate the steps of the functions specified in one block or multiple blocks.

[0247] The above disclosure is only the preferred embodiment of the present application, which certainly cannot be used to limit the scope of rights of the present application. Therefore, equivalent changes made according to the claims of the present application are still within the scope covered by the present application.

Claims

1. A data detection method, characterized in that: The method comprises: Obtain a log parameter set; the log parameter set is obtained by analyzing and processing log data, the log data is used to record the execution status of N objects for L operations respectively; the log parameter set includes execution parameters of the N objects for each operation respectively, and the execution parameters are the number of times the N objects execute each operation respectively in each time period of a natural day; The log parameter set is divided according to M data spaces to obtain M log parameter subsets; any one of the M log parameter subsets is represented as the mth log parameter subset, and the mth log parameter subset is located in the mth data space; the mth log parameter subset contains the execution parameters of the N objects in the mth data space for each operation respectively; m and M are both positive integers and m is less than or equal to M; any one of the N objects is a target object, and any one of the L operations is a target operation; an execution parameter of the target object contained in the mth log parameter subset is the first number of times the target object executes the target operation within a target time period of a target natural day; Generating abnormal execution offset parameters for each operation of the N objects in the mth data space according to the mth log parameter subset, including: extracting the second number of times the target object executes the target operation within the target time period of a historical natural day from the mth log parameter subset, and generating an independent execution offset parameter for the target operation of the target object within the target time period of the target natural day according to the second number and the first number; the historical natural day is before the target natural day; extracting the third number of times the object group executes the target operation within the target time period of the target natural day from the mth log parameter subset, and generating a group execution offset parameter for the target operation of the target object within the target time period of the target natural day according to the third number and the first number; the object group includes objects of the same object type as the target object among the N objects; determining the independent execution offset parameter and the group execution offset parameter of the target object for the target operation as the abnormal execution offset parameter of the target object for the target operation; According to the abnormal execution offset parameters of the N objects for each operation in the m-th data space, the execution detection results of the N objects for each operation in the m-th data space are predicted.

2. The method according to claim 1, characterized in that The log parameter set is divided according to the M data spaces to obtain M log parameter subsets, including: Obtaining redundant operations from the L operations; Filter the N objects in the log parameter set according to the execution parameters of the redundant operation to obtain a filtered parameter set; The filter parameter set is divided according to the M data spaces to obtain the M log parameter subsets.

3. The method according to claim 2, characterized in that Any two operations among the L operations are represented as the c1th operation and the c2th operation, where c1 and c2 are both positive integers less than or equal to L, and c1 is not equal to c2; The obtaining of redundant operations in the L operations includes: Extracting execution parameters of the N objects for the c1-th operation and execution parameters of the N objects for the c2-th operation from the log parameter set; Calculating a correlation coefficient between the c1th operation and the c2th operation according to the execution parameters of the N objects for the c1th operation and the execution parameters of the N objects for the c2th operation; If the correlation coefficient is greater than the coefficient threshold, the redundant operation is determined from the c1th operation and the c2th operation.

4. The method according to claim 2, characterized in that: The obtaining of redundant operations in the L operations includes: Calculate the operation information entropy corresponding to each operation according to the execution parameters of the L operations respectively for the N objects in the log parameter set; The operations whose corresponding operation information entropy among the L types of operations is less than the information entropy threshold are determined as the redundant operations.

5. The method according to claim 1, characterized in that The step of generating, according to the second number of times and the first number of times, an independent execution offset parameter for the target operation of the target object within the target time period of the target natural day includes: Calculate a first mean and a first standard deviation between the second number of times and the first number of times; An independent execution offset parameter of the target object for the target operation is determined according to the first mean and the first standard deviation.

6. The method according to claim 1, characterized in that The step of generating, according to the third number and the first number, a group execution offset parameter for the target object within the target time period of the target natural day and for the target operation comprises: Calculate a second mean and a second standard deviation between the third number and the first number; A group execution offset parameter of the target object for the target operation is determined according to the second mean and the second standard deviation.

7. The method according to claim 1, characterized in that The predicting, according to the abnormal execution offset parameters of the N objects for the L operations, the execution detection results of the N objects for the L operations respectively, includes: Calling the first random forest model to perform parameter calculation on the group execution offset parameters of the N objects for the L types of operations respectively, and obtaining the group execution detection result of the target object for the target operation within the target time period of the target natural day; Calling the second random forest model to perform parameter measurement on the independent execution offset parameters of the N objects for the L operations respectively, and obtaining the independent execution detection result of the target object for the target operation within the target time period of the target nature; Determine the execution detection result corresponding to the first number of times of the target object according to the independent execution detection result and the group execution detection result.

8. The method according to claim 7, characterized in that The independent execution detection result is an independent abnormal operation result or an independent normal operation result, and the group execution detection result is a group abnormal operation result or a group normal operation result; If the independent execution detection result is the independent normal operation result, and the group execution detection result is the group normal operation result, then the execution detection result corresponding to the first number of times is a normal execution result; otherwise, the execution detection result corresponding to the first number of times is an abnormal execution result.

9. The method according to claim 1, characterized in that: The M data spaces include the data space indicated by the working hours of working days, the data space indicated by the non-working hours of working days, the data space indicated by the working hours of non-working days, and the data space indicated by the non-working hours of non-working days; the natural days include working days and non-working days; an execution parameter in the mth log parameter subset corresponds to an abnormal execution offset parameter and an execution detection result.

10. The method according to claim 1, characterized in that The method further comprises: Get additional detection strategies; Determine, according to the additional detection strategy and the mth log parameter subset, additional detection results of the N objects for each operation in the mth data space; According to the additional detection results and the execution detection results of the N objects for each operation in the m-th data space, target detection results of the N objects for each operation in the m-th data space are determined.

11. A data detection device, characterized in that: The device comprises: an acquisition module, used to acquire a log parameter set; the log parameter set is obtained by analyzing and processing log data, the log data is used to record the execution status of N objects for L operations respectively; the log parameter set includes execution parameters of the N objects for each operation respectively, and the execution parameters are the number of times the N objects execute each operation respectively in each time period of a natural day; A partitioning module, used for partitioning the log parameter set according to M data spaces to obtain M log parameter subsets; any one of the M log parameter subsets is represented as an m-th log parameter subset, and the m-th log parameter subset is located in the m-th data space; the m-th log parameter subset contains execution parameters of the N objects in the m-th data space for each operation respectively; m and M are both positive integers and m is less than or equal to M; any one of the N objects is a target object, and any one of the L operations is a target operation; an execution parameter of the target object contained in the m-th log parameter subset is the first number of times the target object performs the target operation within a target time period of a target natural day; A generation module, for generating abnormal execution offset parameters for each operation of the N objects in the mth data space according to the mth log parameter subset, including: extracting the second number of times the target object executes the target operation within the target time period of a historical natural day from the mth log parameter subset, and generating an independent execution offset parameter for the target operation of the target object within the target time period of the target natural day according to the second number and the first number; the historical natural day is before the target natural day; extracting the third number of times the object group executes the target operation within the target time period of the target natural day from the mth log parameter subset, and generating a group execution offset parameter for the target operation of the target object within the target time period of the target natural day according to the third number and the first number; the object group includes objects of the same object type as the target object among the N objects; determining the independent execution offset parameter and the group execution offset parameter of the target object for the target operation as the abnormal execution offset parameter of the target object for the target operation; A prediction module is used to predict the execution detection results of the N objects for each operation in the mth data space according to the abnormal execution offset parameters of the N objects for each operation in the mth data space.

12. A computer program product, comprising a computer program / instruction, which, when executed by a processor, implements the steps of the method according to any one of claims 1 to 10.

13. A computer device, characterized in that: The invention comprises a memory and a processor, wherein the memory stores a computer program, and when the computer program is executed by the processor, the processor executes the steps of the method according to any one of claims 1 to 10.

14. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and the computer program is suitable for being loaded by a processor and executing the method according to any one of claims 1 to 10.

Images