Business anomaly detection method, device, equipment and medium based on image recognition

Abstract

The present application relates to the field of image detection technology, and provides a method, apparatus, device, and medium for detecting business anomalies based on image recognition, wherein the method comprises: obtaining the link address of a target business in a target application based on crawler technology; if the business anomaly detection condition of the target business is met, obtaining at least two page images of the target business from a folder corresponding to the link address of the target business, wherein the page image is a page screenshot obtained by the target device based on the link address and the image configuration information of the target device; performing feature clustering on the at least two page images based on the image configuration information of the target device to obtain a cluster feature set corresponding to the at least two page images; obtaining an abnormal value of the target business based on the abnormal features in the cluster feature set; and determining that the target business is an abnormal business if the abnormal value is greater than or equal to a preset threshold. The adoption of the present application improves the efficiency of abnormal business identification and is conducive to improving the stability of the business.

Description

Technical Field

[0001] The present application relates to the field of image detection technology, and mainly to a method, device, equipment and medium for detecting business anomalies based on image recognition. Background Art

[0002] As the popularity of computer network technology continues to increase, application scenarios continue to enrich, and network scale continues to expand, while network development brings about an information explosion, it will also face some new challenges, especially in the detection of some abnormal services.

[0003] Currently, there are a variety of methods for detecting abnormal traffic, such as data monitoring, log monitoring, and automated interface operation. However, these methods all introduce a certain delay in detecting abnormal issues. For example, data monitoring may take an hour to show a significant drop in data, resulting in monitoring system alerts being slower than user feedback. Therefore, improving the efficiency of abnormal traffic detection remains a technical challenge for those skilled in the art. Summary of the Invention

[0004] The embodiments of the present application provide a business anomaly detection method, apparatus, device, and medium based on image recognition, which can perform business anomaly detection based on a target device obtaining a page screenshot of a target business, thereby improving the efficiency of abnormal business identification and facilitating improving business stability.

[0005] In a first aspect, an embodiment of the present application provides a method for detecting business anomalies based on image recognition, wherein:

[0006] Obtain the link address of the target business in the target application based on crawler technology

[0007] If the business anomaly detection condition of the target business is met, obtaining at least two page images of the target business from a folder corresponding to the link address of the target business, where the page images are page screenshots obtained by the target device based on the link address and the image configuration information of the target device;

[0008] performing feature clustering on the at least two page images based on the image configuration information of the target device to obtain a cluster feature set corresponding to the at least two page images;

[0009] Obtaining an abnormal value of the target business based on the abnormal features in the cluster feature set;

[0010] If the abnormal value is greater than or equal to a preset threshold, the target business is determined to be an abnormal business.

[0011] In a second aspect, an embodiment of the present application provides a service anomaly detection device based on image recognition, wherein:

[0012] A link acquisition unit, used to acquire the link address of the target business in the target application based on crawler technology;

[0013] an image acquisition unit, configured to acquire at least two page images of the target business from a folder corresponding to the link address of the target business if a business anomaly detection condition of the target business is met, wherein the page images are page screenshots acquired by the target device based on the link address and the image configuration information of the target device;

[0014] a feature acquisition unit, configured to perform feature clustering on the page images based on the image configuration information of the target device, and obtain a cluster feature set corresponding to the at least two page images;

[0015] an anomaly obtaining unit, configured to obtain an anomaly value of the target business based on the anomaly feature in the cluster feature set;

[0016] The abnormality determination unit is configured to determine that the target service is an abnormal service if the abnormal value is greater than or equal to a preset threshold.

[0017] In a third aspect, an embodiment of the present application provides a computer device comprising a processor, a memory, a communication interface, and a computer program, wherein the computer program is stored in the memory, the computer program is configured to be executed by the processor, and the computer program includes instructions for some or all of the steps described in the first aspect.

[0018] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, wherein the computer program enables a computer to execute to implement some or all of the steps described in the first aspect.

[0019] Implementing the embodiments of this application will have the following beneficial effects:

[0020] After employing the aforementioned image recognition-based service anomaly detection method, apparatus, device, and medium, the link address of each service in the target application is first obtained using crawler technology. If the service anomaly detection conditions for the target service in the target application are met, at least two page images of the target service are obtained from the folder corresponding to the link address of the target service. Feature clustering is then performed on the at least two page images based on the image configuration information of the target device to obtain a cluster feature set corresponding to the at least two page images. An anomaly value for the target service is then obtained based on the anomaly features in the cluster feature set. If the anomaly value is greater than or equal to a preset threshold, the target service is determined to be an anomaly. The page image is a screenshot of the page obtained by the target device based on the link address and the image configuration information of the target device. In this manner, based on the page screenshot obtained from the target device, whether the target service's display page is abnormal is determined, thereby determining whether the target service is abnormal. If there are more than one page screenshot of the target service, a comprehensive determination of whether the service under test is abnormal can be made, improving the efficiency of anomaly identification and facilitating improved service stability. If there are multiple target devices, image errors for individual devices can be reduced. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0022] in:

[0023] Figure 1 A flowchart of a method for detecting business anomalies based on image recognition provided in an embodiment of the present application;

[0024] Figure 2 A schematic diagram of the structure of a business anomaly detection device based on image recognition provided in an embodiment of the present application;

[0025] Figure 3 A schematic diagram of the structure of a computer device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0026] In order to enable those skilled in the art to better understand the present invention, the following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative work are within the scope of protection of this application.

[0027] The terms "first," "second," and the like in the specification and claims of this application and the accompanying drawings are used to distinguish between different objects, not to describe a particular order. Furthermore, the terms "including," "having," and any variations thereof, are intended to cover non-exclusive inclusions. For example, a process, method, system, product, or apparatus comprising a series of steps or elements is not limited to the listed steps or elements but may optionally include steps or elements not listed, or may optionally include other steps or elements inherent to the process, method, product, or apparatus.

[0028] References herein to "embodiments" mean that a particular feature, structure, or characteristic described in connection with the embodiments may be included in at least one embodiment of the present application. The appearance of this phrase in various places in the specification does not necessarily refer to the same embodiment, nor does it constitute an independent or alternative embodiment that is mutually exclusive of other embodiments. It is understood, both explicitly and implicitly, by those skilled in the art that the embodiments described herein may be combined with other embodiments.

[0029] The network architecture used in the embodiment of the present application includes a server and an electronic device. The embodiment of the present application does not limit the number of electronic devices and servers, and the server can provide services for multiple electronic devices at the same time. The server can be a standalone server or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, content delivery networks (CDNs), and big data and artificial intelligence platforms. The server can also be implemented by a server cluster consisting of multiple servers.

[0030] An electronic device may be a personal computer (PC), a laptop, or a smartphone, and may also be an all-in-one PC, a PDA, a tablet (pad), a smart TV player, a vehicle-mounted terminal, or a portable device. For PC-side electronic devices, such as all-in-one PCs, the operating system may include, but is not limited to, Linux, Unix, Windows systems (such as Windows XP, Windows 7), and Mac OS X (Apple's operating system). For mobile-side electronic devices, such as smartphones, the operating system may include, but is not limited to, Android, iOS (Apple's operating system), and Windows.

[0031] The electronic device can install and run applications, and the server can be the server corresponding to the application installed on the electronic device, providing application services for the application. The application can be a standalone integrated application software, a small program embedded in another application, or a system on a web page, etc., without limitation here.

[0032] The present application provides a method for detecting business anomalies based on image recognition, which can be performed by a device for detecting business anomalies based on image recognition. This device can be implemented in software and / or hardware and is generally integrated into electronic devices or servers. It can detect business anomalies based on a screenshot of a target business page captured by the target device, thereby improving the efficiency of identifying abnormal business and facilitating the stability of the business.

[0033] Please refer to Figure 1 , Figure 1 This is a flowchart of a business anomaly detection method based on image recognition provided by this application. Taking the application of this method on a server as an example, it includes the following steps S101 to S105, where:

[0034] S101. Obtain the link address of the target business in the target application based on crawler technology.

[0035] This application does not limit the target application, and it can be any application whose business is to be detected for abnormality. The target application includes at least one business, and the following example is used as an example to illustrate. This application does not limit the target business and the number of target businesses, and it can be any transaction business of an item. The number of target businesses can be one or more. The link address of the target business is used to access the display page corresponding to the target business. In other words, any networked electronic device can open the display page corresponding to the target business based on the link address.

[0036] This application does not limit the content of the display page corresponding to the target business. If the target business is a transaction business, the display page can be the details page of the product corresponding to the transaction business. If the target business is a game business, the display page can be a page corresponding to the game scene. If the target business is a communication business, the display page can be a chat page between the communicating parties.

[0037] Crawler technology, also known as a web crawler, web spider, web robot, or web chaser, is a program or script that automatically captures network information according to certain rules. It can be understood that crawler technology is used to crawl the content of each web page in the target application to obtain the link addresses of all services supported by the target application. The link addresses of each service can then be numbered and stored. The target device can open the display page corresponding to the target service based on the link address of the target service. A screenshot of the display page can then be obtained and stored in the folder corresponding to the link address of the target service. If the execution conditions of the target service are met, a screenshot of the display page of the target service can be obtained from the folder corresponding to the link address of the target service. This allows the determination of whether the target service is an abnormal service based on whether the screenshot contains any abnormalities.

[0038] In one possible example, the link address can be encrypted to obtain a link address number. This number is then stored as the encrypted number. In this way, the target device can first decrypt the encrypted link address to obtain the link address. It can then use the link address to open the target service's display page, thereby preventing the target service from being accessed by unauthorized devices and improving application security.

[0039] This application does not limit the encryption method and decryption method of the link address. The encryption algorithm used in the encryption method may include a Secure Hash Algorithm (SHA), such as SHA-1, SHA-224, SHA-256, SHA-384, and SHA-512. Alternatively, it may include a Message-Digest Algorithm (MD5), an algorithm based on a Hash-based Message Authentication Code (HMAC), an algorithm based on the American Standard Code for Information Interchange (ASCII), ISO-8859-1, GB2312, GBK, UTF (Unicode Transformation Format)-8, UTF-16, base64, etc.

[0040] S102: If the business anomaly detection condition of the target business is met, at least two page images of the target business are obtained from a folder corresponding to the link address of the target business.

[0041] This application does not limit the business anomaly detection conditions for the target business. The detection order of reaching the target business can be determined based on the detection order of each business to determine whether the business anomaly detection conditions of the target business are met. In other words, if the detection order of the target business is reached, it is determined that the business anomaly detection conditions of the target business are met. Or it can be determined based on the execution time of the target business whether the business anomaly detection conditions of the target business are met. In other words, if the current time is the execution time of the target business, it is determined that the business anomaly detection conditions of the target business are met. Or it can be determined based on whether the business anomaly detection conditions of the target business are met based on whether abnormal problems reported by users are received. In other words, if abnormal problems reported by users are received, it is determined that the business anomaly detection conditions of the target business are met.

[0042] In the embodiment of the present application, the number of target devices can be greater than or equal to 1. If the number of target devices is greater than 1, the target devices can be selected from electronic devices of different manufacturers, sizes, systems, etc. In this way, whether the target business is abnormal can be determined based on whether the page images obtained by screenshots of different electronic devices contain abnormalities, which is conducive to improving the comprehensiveness of detection.

[0043] The image configuration information is used to indicate the method of image acquisition, and may include setting parameters such as the numerical value of the image zoom ratio, the size of the image sliding speed, and the interval duration of image acquisition. It can be understood that different target devices use different image configuration information to acquire page images, which can improve the effectiveness of image acquisition. It should be noted that the target device can open the display page of the target business based on the link address of the target business, and then obtain a page screenshot of the display page based on the image configuration information, that is, the page image of the target business. In this way, the user is simulated to open the target business, and the user is simulated to operate the business exhibition page to obtain different page images, thereby improving the efficiency and accuracy of page anomaly identification.

[0044] In a possible example, after step S101 and before step S102, the following steps may also be included: counting the number of device types that use the target service, and the device types and number of idle devices; selecting a target device from the idle devices based on the number of device types used, and the device types and number of idle devices; obtaining historical feedback corresponding to the target device; and determining image configuration information of the target device based on the historical feedback.

[0045] An idle device refers to an electronic device that currently has no tasks or can perform detection tasks. Historical feedback can include feedback submitted by an electronic device corresponding to the target device's device type when using the target service, or feedback submitted by an electronic device corresponding to the target device's device type when using other services. Historical feedback can include questions or suggestions raised regarding the issue.

[0046] As can be understood, by counting the number of used devices of various types, as well as the types and numbers of idle devices, target devices are selected from the idle devices. This allows different numbers of target devices to be assigned to different device types, simulating scenarios in actual production processes and improving the effectiveness of target device selection. Determining the image configuration information for the target device type based on historical feedback further improves the effectiveness of image acquisition.

[0047] In an embodiment of the present application, the number of page images may be greater than or equal to 2. The page image may be a screenshot of a page obtained by the target device based on the image configuration information of the target device. If the number of target devices is 1, the target device may obtain at least two page images. The two page images may have different screenshot times, or different screenshot locations, or different zoom sizes, etc., which are not limited here. For example, a screenshot is obtained as a page image every 20 seconds, a screenshot is obtained as a page image by sliding the page every 20 seconds, the page of the target business is zoomed to obtain page images of different sizes, etc. If the number of target devices is greater than 1, each target device may obtain at least one page image. In this way, anomaly recognition can be performed through each page image, and anomaly recognition can also be performed through all page images to improve the accuracy of anomaly recognition.

[0048] S103 : Perform feature clustering on at least two page images based on the image configuration information of the target device to obtain a cluster feature set corresponding to the at least two page images.

[0049] In an embodiment of the present application, the cluster feature set corresponding to at least two page images includes similar features among the features of each page image. The cluster feature set can be obtained by a clustering algorithm. The present application does not limit the algorithm for feature clustering, and may include but is not limited to the k-means clustering algorithm (k-means) or the fuzzy C-means clustering algorithm (fuzzyc-means, FCM), the density-based clustering of applications with noise (Density-Based Spatial Clustering of Applications with Noise, DBSCAN), the mean shift clustering algorithm, etc.

[0050] In a possible example, step S103 may include the following steps A1 to A3, wherein:

[0051] A1. Classify at least two page images based on image configuration information of a target device to obtain at least two types of page image sets.

[0052] This application does not limit the classification method for page images, and classification can be based on at least one type, such as time, location, and zoom ratio. In one possible example, the number of target devices is greater than one, and step A1 may include the following steps: obtaining the screenshot time of each page image based on the image configuration information of the target device; and classifying at least two page images based on the screenshot time to obtain at least two types of page image sets, where the screenshot time of each page image set is the same.

[0053] The screenshot time is the time when the target device captured the page image. It can be understood that by treating page images captured at the same moment as a class of page images and extracting image features from the page images within that class, it is possible to determine whether there are any abnormal images among the page images captured by different target devices at any moment, which is beneficial for improving the accuracy of data analysis.

[0054] A2. Obtain a set of regional image features of each page image set.

[0055] In an embodiment of the present application, the regional image feature set of the page image set may include grayscale features, color features, texture features, shape features, etc., or color block features corresponding to shape features and color features, etc., which are not limited here.

[0056] A3. Perform feature clustering on the regional image feature set to obtain a cluster feature set corresponding to at least two page images.

[0057] It can be understood that in steps A1 to A3, feature clustering is performed based on the regional image feature set of the classified page image set, which can improve the effectiveness of feature set classification.

[0058] In a possible example, step A3 may include the following steps A31 to A34:

[0059] A31. Determine the reference cluster center of the regional image feature set.

[0060] A32. Calculate the similarity between the regional image feature set and the reference cluster center.

[0061] A33. If the similarity is less than the minimum similarity, the regional image feature set is clustered based on the reference cluster center to obtain a cluster feature set corresponding to at least two page images.

[0062] A34. If the similarity is greater than or equal to the minimum similarity, re-determine the reference cluster center of the regional image feature set and execute step A32.

[0063] In the embodiments of the present application, the reference cluster center can be a repeated regional image feature set in the regional image feature set, or the center point of the image corresponding to the regional image feature set, etc., and is not limited here. The present application also does not limit the number of reference cluster centers, which can be an integer greater than 1.

[0064] The similarity between the regional image feature set and the reference cluster center is used to describe the degree of similarity between the overall image features corresponding to the regional image feature set and the regional image features corresponding to the reference cluster center. Classification statistics can be performed based on each regional image feature in the regional image feature set to obtain the overall image features corresponding to the regional image feature set. This is then compared with the regional image features corresponding to the reference cluster center to obtain the similarity between the regional image feature set and the reference cluster center.

[0065] This application does not impose any restrictions on the minimum similarity, which can be a preset fixed value, such as 0.6. Alternatively, it can be determined based on the number of reference cluster centers. For example, if the number of reference cluster centers is 3, the minimum similarity can be 0.8. If the number of reference cluster centers is 2, the minimum similarity can be 0.6.

[0066] It can be understood that in steps A31 to A34, the reference cluster center of the regional image feature set is first randomly determined, and then the similarity between the regional image feature set and the reference cluster center is calculated. If the similarity is less than the minimum similarity, it means that the reference cluster center can be the center of some regional image features, and thus the regional image feature set can be feature clustered based on the reference cluster center. If the similarity is greater than or equal to the minimum similarity, it means that the center of the cluster features in the regional image feature set is not the reference cluster center, and another reference cluster center needs to be determined. In this way, by repeatedly trying to determine the most similar cluster center, the accuracy of obtaining cluster features can be improved.

[0067] S104: Obtain an abnormal value of the target business based on the abnormal features in the cluster feature set.

[0068] In an embodiment of the present application, the abnormal value of the target business is used to describe the abnormal situation of the target business. The present application does not limit the method for obtaining the abnormal value of the target business by the abnormal features in the cluster feature set. The abnormal value of the target business can be determined by the mismatched features between the preset feature set of the preset image and the cluster feature set. The more mismatched features, the greater the abnormal value. The preset image can be a preset display image or an alternative image. Among them, the preset display image refers to the image originally set at the preset position. The alternative image refers to the image displayed when the business is abnormal, such as a buffered image or a default image.

[0069] The outlier value can also be determined based on the size of the color block area of ​​the abnormal color block in the cluster feature set. It can be understood that the larger the proportion of the color block area corresponding to the same color block, the greater the probability that the color block area is an abnormal color block. For example, if a certain area contains more than 95% white blocks, the color blocks in this area are considered abnormal. The larger the proportion of the image corresponding to the abnormal color block, the larger the outlier value.

[0070] Outliers may also be analyzed based on artificial intelligence, for example, by using a network model obtained by machine learning on a preset display image and an abnormal image to identify at least two feature sets and obtain an outlier value of the image.

[0071] In a possible example, the number of cluster feature sets is greater than 1, and step S104 may include the following steps B1 and B2, wherein:

[0072] B1. Determine the abnormal sub-value of the target business based on the abnormal features in each cluster feature set.

[0073] In an embodiment of the present application, the abnormality sub-value of the target service is used to describe the degree of abnormality of the target service as reflected by a single cluster feature set. In one possible example, the abnormal features in the cluster feature set include abnormal color blocks. Step B1 may include the following steps: generating a reference image based on the cluster feature set; dividing the reference image into color blocks to obtain the area ratio of each color block; selecting abnormal color blocks from the reference image based on the area ratio; obtaining a matching value between the abnormal color block and a preset image; and determining the abnormality sub-value of the target service based on the matching value.

[0074] The reference image is an image generated based on a feature set, and satisfies both overlapping and different features in the feature set. The selection of abnormal color blocks can be based on the relationship between the area ratio and a threshold value, i.e., when the area ratio is greater than the threshold value, the block is determined to be an abnormal color block. As described above, the preset image may include a preset display image or an alternative image. It should be noted that the content to be displayed in the preset image and the image corresponding to the abnormal color block should be the same.

[0075] It can be understood that in this example, abnormal color blocks are first selected based on the area ratios of different color blocks in the reference image generated by the clustered feature set. Then, the abnormal sub-value of the target service is determined based on the matching value between the abnormal color block and the preset image, which helps to improve the accuracy of determining abnormal values.

[0076] B2. Perform weighted calculation on the abnormal sub-values ​​based on the preset weights corresponding to each cluster feature set to obtain the abnormal value of the target business.

[0077] This application does not limit the size of the preset weight. It can be determined based on the type of classification. For example, if the classification is based on location, it can be determined based on the type of page element corresponding to the location. For another example, if the classification is based on time, it can be determined based on the performance pressure corresponding to the time on the server.

[0078] It can be understood that in step B1 and step B2, weighted calculation of the abnormal sub-values ​​of the target business determined by each cluster feature set using the preset weight corresponding to the cluster feature set can improve the accuracy of obtaining the abnormal value of the target business.

[0079] S105: If the abnormal value is greater than or equal to the preset threshold, the target service is determined to be an abnormal service.

[0080] This application does not impose any restrictions on the preset threshold value, and it can be determined based on the number of page images, the number of clustered feature sets, etc. It is understood that if the abnormal value of the target business is greater than or equal to the preset threshold value, the target business is determined to be abnormal business. Otherwise, it can be directly determined as normal business, or detection can continue, etc., which is not limited here.

[0081] exist Figure 1 In the illustrated method, the link address of each service in the target application is first obtained using crawler technology. If the service anomaly detection conditions for the target service in the target application are met, at least two page images of the target service are obtained from the folder corresponding to the link address of the target service. Feature clustering is then performed on the at least two page images based on the image configuration information of the target device to obtain a cluster feature set corresponding to the at least two page images. An anomaly value for the target service is then obtained based on the anomaly features in the cluster feature set. If the anomaly value is greater than or equal to a preset threshold, the target service is determined to be an anomaly. The page image is a page screenshot obtained by the target device based on the link address and the image configuration information of the target device. In this way, based on the page screenshot obtained by the target device, whether the display page of the target service is abnormal is determined, thereby determining whether the target service is abnormal. If there are more than one page screenshot of the target service, a comprehensive judgment can be made on whether the service under test is abnormal, improving the efficiency of anomaly identification and facilitating improved service stability. If there are multiple target devices, image errors for individual devices can be reduced.

[0082] In a possible example, after step S104, the following steps may also be included: obtaining business information of the target business based on the link address; determining the notification interface corresponding to the target business based on the business information; and sending a business abnormality prompt to the staff corresponding to the target business based on the notification interface.

[0083] Before storing the link address, crawler technology can also be used to obtain and store business information of the target business, such as products, merchants, campaign numbers, and personalized information. Business information can also include a notification interface for communicating with the staff of the target business. The staff of the target business can be the person who handles the call when an exception occurs, or the customer service staff of the target business.

[0084] This application does not limit the method for determining the notification interface. If the business information includes a notification interface, the notification interface is directly selected from the business information. Otherwise, the notification interface corresponding to the target business is searched based on the identification information corresponding to the target business (for example, the merchant's ID, product ID, activity number, etc.), or the notification interface corresponding to each piece of business information is determined based on preset interface rules.

[0085] It is understood that when an exception is determined for a target business, a notification interface corresponding to the target business can be determined based on the business information. This notification interface can then be used to send a business exception notification to the staff of the target business. This allows the staff of the target business to be notified to handle the exception regardless of whether the staff of the target business has changed, thereby improving the efficiency and effectiveness of exception handling.

[0086] It should be noted that if the number of page images of the target business in the folder corresponding to the link address of the target business is 1, the page image can be matched with a preset image, or the area ratio of each color block in the page image can be identified. If the matching value between the page image and the preset image is less than a threshold, or the area ratio is greater than a threshold, the target business is determined to be an abnormal business.

[0087] The above describes in detail the method of the embodiment of the present application, and the following provides an apparatus of the embodiment of the present application.

[0088] and Figure 1 The embodiment shown is consistent, please refer to Figure 2 , Figure 2 This is a schematic diagram of the structure of a business anomaly detection device based on image recognition proposed in this application. Figure 2 As shown, the above-mentioned business anomaly detection device 200 based on image recognition includes:

[0089] The link acquisition unit 201 is used to acquire the link address of the target business in the target application based on the crawler technology

[0090] The image acquisition unit 202 is configured to acquire at least two page images of the target business from a folder corresponding to the link address of the target business if a business anomaly detection condition of the target business is met, wherein the page images are page screenshots acquired by the target device based on the link address and the image configuration information of the target device;

[0091] The feature acquisition unit 203 is configured to perform feature clustering on the page images based on the image configuration information of the target device to obtain a cluster feature set corresponding to the at least two page images;

[0092] The anomaly acquisition unit 204 is configured to acquire an anomaly value of the target business based on the anomaly feature in the cluster feature set;

[0093] The abnormality determination unit 205 is configured to determine that the target service is an abnormal service if the abnormal value is greater than or equal to a preset threshold.

[0094] In a possible example, the feature acquisition unit 203 is specifically used to classify the at least two page images based on the image configuration information of the target device to obtain at least two types of page image sets; obtain a regional image feature set of each of the page image sets; and perform feature clustering on the regional image feature set to obtain a cluster feature set corresponding to the at least two page images.

[0095] In a possible example, the number of target devices is greater than 1, and the feature acquisition unit 203 is specifically used to obtain the screenshot time of each of the page images based on the image configuration information of the target device; classify the at least two page images based on the screenshot time to obtain at least two types of page image sets, and the screenshot time of each of the page image sets is the same.

[0096] In a possible example, the feature acquisition unit 203 is specifically used to determine the reference cluster center of the regional image feature set; calculate the similarity between the regional image feature set and the reference cluster center; if the similarity is less than the minimum similarity, perform feature clustering on the regional image feature set based on the reference cluster center to obtain the cluster feature set corresponding to the at least two page images; or if the similarity is greater than or equal to the minimum similarity, re-determine the reference cluster center of the regional image feature set and execute the step of calculating the similarity between the regional image feature set and the reference cluster center.

[0097] In a possible example, the number of the cluster feature sets is greater than 1, and the anomaly acquisition unit 204 is specifically used to determine the anomaly sub-value of the target business based on the anomaly features in each of the cluster feature sets; and perform weighted calculation on the anomaly sub-value based on the preset weight corresponding to each of the cluster feature sets to obtain the anomaly value of the target business.

[0098] In a possible example, the abnormal features in the cluster feature set include abnormal color blocks, and the abnormal acquisition unit 204 is specifically used to generate a reference image based on the cluster feature set; divide the reference image into color blocks to obtain the area ratio of each color block; select the abnormal color block from the reference image based on the area ratio; obtain the matching value between the abnormal color block and the preset image; and determine the abnormal sub-value of the target business based on the matching value.

[0099] In one possible example, the abnormal features in the cluster feature set include abnormal color blocks, and the image recognition-based business anomaly detection device 200 further includes an information acquisition unit 206, an interface determination unit 207, and a notification unit 207. The information acquisition unit 207 is configured to acquire business information of the target business based on the link address; the interface determination unit 207 is configured to determine a notification interface corresponding to the target business based on the business information; and the notification unit 208 is configured to send a business anomaly notification of the target business to a staff member corresponding to the target business based on the notification interface.

[0100] The detailed execution process of each unit in the image recognition-based service anomaly detection device 200 can be found in the execution steps in the aforementioned method embodiment, which will not be repeated here.

[0101] and Figure 1 For details, please refer to Figure 3 , Figure 3 This is a schematic diagram of the structure of a computer device provided in an embodiment of the present application. Figure 3 As shown, the computer device 300 includes a processor 310 , a memory 320 , and a communication interface 330 . The processor 310 , the memory 320 , and the communication interface 330 are interconnected via a bus 350 . Figure 2 The related functions implemented by the image acquisition unit 202, the information acquisition unit 206 and the notification unit 208 can be implemented through the communication interface 330. Figure 2 The related functions implemented by the link acquisition unit 201 , the feature acquisition unit 203 , the anomaly acquisition unit 204 , the anomaly determination unit 205 and the interface determination unit 207 may be implemented by the processor 310 .

[0102] The memory 320 stores a computer program 340, which is configured to be executed by the processor 310. The computer program 340 includes instructions for performing the following steps:

[0103] Obtain the link address of the target business in the target application based on crawler technology

[0104] If the business anomaly detection condition of the target business is met, obtaining at least two page images of the target business from a folder corresponding to the link address of the target business, where the page images are page screenshots obtained by the target device based on the link address and the image configuration information of the target device;

[0105] performing feature clustering on the at least two page images based on the image configuration information of the target device to obtain a cluster feature set corresponding to the at least two page images;

[0106] Obtaining an abnormal value of the target business based on the abnormal features in the cluster feature set;

[0107] If the abnormal value is greater than or equal to a preset threshold, the target business is determined to be an abnormal business.

[0108] In one possible example, in the aspect of performing feature clustering on the at least two page images based on the image configuration information of the target device to obtain the feature clustering, the computer program 340 specifically includes instructions for executing the following steps:

[0109] classifying the at least two page images based on the image configuration information of the target device to obtain at least two types of page image sets;

[0110] Obtaining a regional image feature set of each of the page image sets;

[0111] Perform feature clustering on the regional image feature set to obtain a cluster feature set corresponding to the at least two page images.

[0112] In one possible example, the number of the target devices is greater than one. In terms of classifying the at least two page images based on the image configuration information of the target devices to obtain at least two types of page image sets, the computer program 340 specifically includes instructions for performing the following steps:

[0113] Acquiring a screenshot time of each of the page images based on the image configuration information of the target device;

[0114] The at least two page images are classified based on the screenshot time to obtain at least two types of page image sets, and the screenshot time of each of the page image sets is the same.

[0115] In one possible example, in the aspect of performing feature clustering on the regional image feature set to obtain the cluster feature set corresponding to the at least two page images, the computer program 340 specifically includes instructions for executing the following steps:

[0116] Determining a reference cluster center of the regional image feature set;

[0117] Calculating the similarity between the regional image feature set and the reference cluster center;

[0118] If the similarity is less than the minimum similarity, performing feature clustering on the regional image feature set based on the reference cluster center to obtain a cluster feature set corresponding to the at least two page images; or

[0119] If the similarity is greater than or equal to the minimum similarity, the reference cluster center of the regional image feature set is re-determined, and the step of calculating the similarity between the regional image feature set and the reference cluster center is performed.

[0120] In a possible example, the number of the cluster feature sets is greater than 1. In terms of obtaining an abnormal value of the target business based on abnormal features in the cluster feature sets, the computer program 340 specifically includes instructions for executing the following steps:

[0121] Determining an abnormal sub-value of the target business based on the abnormal features in each of the cluster feature sets;

[0122] The abnormal sub-values ​​are weightedly calculated based on the preset weights corresponding to the cluster feature sets to obtain the abnormal value of the target business.

[0123] In one possible example, the abnormal features in the cluster feature set include abnormal color blocks. In determining the abnormal sub-value of the target business based on the abnormal features in each cluster feature set, the computer program 340 specifically includes instructions for performing the following steps:

[0124] generating a reference image based on the cluster feature set;

[0125] Dividing the reference image into color blocks to obtain the area proportion of each color block;

[0126] Selecting the abnormal color block from the reference image based on the area ratio;

[0127] Obtaining a matching value between the abnormal color block and a preset image;

[0128] An abnormal sub-value of the target business is determined based on the matching value.

[0129] In a possible example, after determining that the target service is abnormal service, the computer program 340 further includes instructions for executing the following steps:

[0130] Acquire business information of the target business based on the link address;

[0131] Determining a notification interface corresponding to the target service based on the service information;

[0132] Based on the notification interface, a business abnormality prompt of the target business is sent to the staff corresponding to the target business.

[0133] An embodiment of the present application also provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, which enables a computer to execute to implement part or all of the steps of any method recorded in the method embodiment, and the computer includes an electronic device or a server.

[0134] The present application also provides a computer program product comprising a non-transitory computer-readable storage medium storing a computer program, wherein the computer program is operable to cause a computer to execute some or all of the steps of any method described in the method embodiments. The computer program product may be a software installation package, and the computer may comprise an electronic device or a server.

[0135] In the above embodiment, the computer-readable storage medium may primarily include a program storage area and a data storage area. The program storage area may store an operating system, at least one application required for a function, and the like; the data storage area may store data generated based on the use of the blockchain node. For example, the blockchain may store the link address and notification interface of the target business, etc., without limitation herein.

[0136] The blockchain referred to in the embodiments of this application is a new application model of computer technologies such as distributed data storage, peer-to-peer transmission, consensus mechanisms, and encryption algorithms. Blockchain is essentially a decentralized database, a series of data blocks generated using cryptographic methods. Each data block contains information about a batch of network transactions, which is used to verify the validity of the information (anti-counterfeiting) and generate the next block. Blockchain can include the blockchain underlying platform, the platform product service layer, and the application service layer.

[0137] It should be noted that for the aforementioned method embodiments, for the sake of simplicity, they are all expressed as a series of action combinations, but those skilled in the art should be aware that this application is not limited by the order of the actions described, because according to this application, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in this specification are all preferred embodiments, and the actions and modes involved are not necessarily required by this application.

[0138] In the above embodiments, the description of each embodiment has its own focus. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0139] In the several embodiments provided in this application, it should be understood that the disclosed devices can be implemented in other ways. For example, the device embodiments described above are merely illustrative. For example, the division of units is only a logical function division. In actual implementation, there may be other division methods, such as at least one unit or component can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, and the indirect coupling or communication connection of devices or units can be electrical or other forms.

[0140] Units described as separate components may or may not be physically separate, and components shown as units may or may not be physical units, that is, they may be located in one place or distributed across at least one network element. Some or all of these units may be selected to achieve the objectives of this embodiment based on actual needs.

[0141] In addition, the functional units in the various embodiments of the present application may be integrated into a single processing unit, or each unit may exist physically separately, or two or more units may be integrated into a single unit. The aforementioned integrated units may be implemented in the form of hardware or in the form of software program mode.

[0142] If the integrated unit is implemented in the form of a software program model and sold or used as an independent product, it can be stored in a computer-readable memory. According to this understanding, the technical solution of the present application, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, which is stored in a memory and includes a number of instructions for enabling a computer (which can be a personal computer, server or network device, etc.) to execute all or part of the steps of the various embodiments of the present application. The aforementioned memory includes: U disk, read-only memory (ROM), random access memory (RAM), mobile hard disk, magnetic disk or optical disk, and other media that can store program codes.

[0143] The above is a detailed introduction to the embodiments of the present application. Specific examples are used herein to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method and core idea of ​​the present application. At the same time, for those skilled in the art, based on the ideas of the present application, there may be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as a limitation on the present application.

Claims

1. A business anomaly detection method based on image recognition, characterized in that: include: Obtain the link address of the target business in the target application based on crawler technology; Counting the number of devices of the target service type in use, and the type and number of idle devices; selecting a target device from the idle devices based on the number of devices of each type in use and the type and number of idle devices; obtaining historical feedback corresponding to the target device, and determining image configuration information of the target device based on the historical feedback; If the business anomaly detection condition of the target business is met, obtaining at least two page images of the target business from a folder corresponding to the link address of the target business, where the page images are page screenshots obtained by the target device based on the link address and the image configuration information of the target device; Performing feature clustering on the at least two page images based on the image configuration information of the target device to obtain cluster feature sets corresponding to the at least two page images; comprising: classifying the at least two page images based on the image configuration information of the target device to obtain at least two types of page image sets; obtaining a regional image feature set of each of the page image sets; performing feature clustering on the regional image feature set to obtain a cluster feature set corresponding to the at least two page images; Obtaining an abnormal value of the target business based on the abnormal features in the cluster feature set; If the abnormal value is greater than or equal to a preset threshold, the target business is determined to be an abnormal business.

2. The method according to claim 1, characterized in that The number of the target devices is greater than 1, and the classifying the at least two page images based on the image configuration information of the target devices to obtain at least two types of page image sets includes: Acquiring a screenshot time of each of the page images based on the image configuration information of the target device; The at least two page images are classified based on the screenshot time to obtain at least two types of page image sets, and the screenshot time of each of the page image sets is the same.

3. The method according to claim 1, characterized in that The performing feature clustering on the regional image feature set to obtain a cluster feature set corresponding to the at least two page images includes: Determining a reference cluster center of the regional image feature set; Calculating the similarity between the regional image feature set and the reference cluster center; If the similarity is less than the minimum similarity, performing feature clustering on the regional image feature set based on the reference cluster center to obtain a cluster feature set corresponding to the at least two page images; or If the similarity is greater than or equal to the minimum similarity, the reference cluster center of the regional image feature set is re-determined, and the step of calculating the similarity between the regional image feature set and the reference cluster center is performed.

4. The method according to any one of claims 1 to 3, characterized in that The number of the cluster feature sets is greater than 1, and obtaining the abnormal value of the target business based on the abnormal features in the cluster feature sets includes: Determining an abnormal sub-value of the target business based on the abnormal features in each of the cluster feature sets; The abnormal sub-values ​​are weightedly calculated based on the preset weights corresponding to the cluster feature sets to obtain the abnormal value of the target business.

5. The method according to claim 4, characterized in that The abnormal features in the cluster feature set include abnormal color blocks, and determining the abnormal sub-value of the target business based on the abnormal features in each cluster feature set includes: generating a reference image based on the cluster feature set; Dividing the reference image into color blocks to obtain the area proportion of each color block; Selecting the abnormal color block from the reference image based on the area ratio; Obtaining a matching value between the abnormal color block and a preset image; An abnormal sub-value of the target business is determined based on the matching value.

6. The method according to any one of claims 1 to 3, characterized in that After determining that the target service is an abnormal service, the method further includes: Acquire business information of the target business based on the link address; Determining a notification interface corresponding to the target service based on the service information; Based on the notification interface, a business abnormality prompt of the target business is sent to the staff corresponding to the target business.

7. A business anomaly detection device based on image recognition, characterized in that: include: A link acquisition unit, used to acquire the link address of the target business in the target application based on crawler technology; an image acquisition unit configured to count the number of devices of the target service type in use, as well as the type and number of idle devices; select a target device from the idle devices based on the number of devices of each type in use and the type and number of idle devices; obtain historical feedback corresponding to the target device, and determine image configuration information of the target device based on the historical feedback; and if a service anomaly detection condition of the target service is met, obtain at least two page images of the target service from a folder corresponding to a link address of the target service, the page images being screenshots of the page obtained by the target device based on the link address and the image configuration information of the target device; A feature acquisition unit is configured to perform feature clustering on the page images based on the image configuration information of the target device to obtain cluster feature sets corresponding to the at least two page images; the feature acquisition unit comprises: classifying the at least two page images based on the image configuration information of the target device to obtain at least two types of page image sets; obtaining a regional image feature set of each of the page image sets; and performing feature clustering on the regional image feature set to obtain a cluster feature set corresponding to the at least two page images; an anomaly obtaining unit, configured to obtain an anomaly value of the target business based on the anomaly feature in the cluster feature set; The abnormality determination unit is configured to determine that the target service is an abnormal service if the abnormal value is greater than or equal to a preset threshold.

8. A computer device, characterized in that: The method comprises a processor, a memory and a communication interface, wherein the memory stores a computer program, the computer program is configured to be executed by the processor, and the computer program includes instructions for executing the steps in any one of the methods of claims 1 to 6.

9. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a computer program, which enables a computer to execute the method according to any one of claims 1 to 6.

Images