Training method, system and related devices for abnormal traffic detection model

Abstract

The present invention discloses a training method, system and related devices for an abnormal traffic detection model, including: an advertising aggregation platform receives behavior logs sent by electronic devices and performs statistics on the behavior logs to obtain first statistical data. The advertising aggregation platform receives second statistical data sent by an upstream advertising platform, and the second statistical data is obtained by performing statistics on the behavior logs after the upstream advertising platform deletes suspicious behavior data in the behavior logs sent by the electronic devices. The advertising aggregation platform obtains training data based on the first statistical data and the second statistical data, and the training data includes the first statistical data and the difference between the first statistical data and the second statistical data corresponding to the same time period. The advertising aggregation platform obtains an abnormal traffic detection model based on the training data. By implementing this method, the advertising aggregation platform can train the abnormal traffic detection model, no longer relying on the experience of operators, reducing labor costs, and improving the accuracy of abnormal traffic detection.

Description

Technical Field

[0001] The present invention relates to the field of advertising, and in particular to a training method, system and related devices for an abnormal traffic detection model. Background Art

[0002] With the continuous development of information technology, the online advertising industry holds a promising future. Within the advertising business, advertising platforms serve as a bridge between traffic providers who provide advertising services and advertisers who require advertising. Among various advertising platforms, ad aggregation platforms are responsible for liaising with upstream advertising platforms and downstream traffic providers to ensure the smooth operation of advertising operations. As upstream advertising platforms crack down on traffic fraud, ad aggregation platforms, acting as intermediaries between upstream advertising platforms and traffic providers, need to proactively identify traffic fraud through abnormal traffic detection.

[0003] Currently, to detect abnormal traffic, ad aggregation platforms typically set thresholds for various ad metrics, such as average ad impressions per user and click-through rate (CTR), based on the historical experience of their operators. If an ad metric exceeds the threshold, it is considered abnormal traffic. Training models for this type of abnormal traffic detection relies heavily on operator experience, resulting in high costs and limited accuracy. Summary of the Invention

[0004] This application provides a training method, system, and related apparatus for an abnormal traffic detection model. By implementing embodiments of this application, an advertising aggregation platform can perform abnormal traffic detection based on the trained abnormal traffic detection model, eliminating reliance on operator experience. This reduces labor costs during abnormal traffic detection and improves the accuracy of abnormal traffic detection performed by the advertising aggregation platform.

[0005] In the first aspect, an embodiment of the present application provides a training method for an abnormal traffic detection model. In this method, an advertising aggregation platform receives a behavior log sent by an electronic device, and the behavior log includes behavioral data related to advertising behavior in an application. The advertising aggregation platform counts the behavioral data of the application in each time period to obtain first statistical data. The advertising aggregation platform receives second statistical data sent by an upstream advertising platform, and the second statistical data includes data obtained by counting the behavioral data of the application in each time period after the upstream advertising platform deletes suspicious behavior data in the behavior log sent by the electronic device. The advertising aggregation platform obtains training data based on the first statistical data and the second statistical data, and the training data includes the first statistical data and a first difference, and the first difference includes the difference between the first statistical data and the second statistical data corresponding to the same time period. The advertising aggregation platform uses the training data as input and the result that no abnormal traffic occurs in the application as output to train an abnormal traffic detection model.

[0006] Through the above method, the ad aggregation platform can obtain an abnormal traffic detection model. The ad aggregation platform can then use this abnormal traffic detection model to perform abnormal traffic detection, eliminating the reliance on operator experience. This reduces the labor cost of abnormal traffic detection and improves the accuracy of abnormal traffic detection performed by the ad aggregation platform.

[0007] In conjunction with the first aspect, in some embodiments, the advertising aggregation platform uses training data as input and the result that the application does not have abnormal traffic as output. After training to obtain an abnormal traffic detection model, the advertising aggregation platform can count the behavioral data of the first application in the first time period to obtain third statistical data. The advertising aggregation platform receives fourth statistical data sent by the upstream advertising platform. The fourth statistical data is obtained after the upstream advertising platform deletes the suspicious behavior data of the first application in the first time period. The advertising aggregation platform obtains input data based on the third statistical data and the fourth statistical data. The input data includes the third statistical data and the difference between the third statistical data and the fourth statistical data. The advertising aggregation platform inputs the input data into the abnormal traffic detection model. In response to the output result of the abnormal traffic detection model, the advertising aggregation platform determines whether the first application has abnormal traffic. The behavioral data of the first application in the first time period can reflect the status of the real-time advertising delivery activities of the first application.

[0008] Through the above method, the advertising aggregation platform can perform abnormal traffic detection based on the trained abnormal traffic detection model. The advertising aggregation platform can respond to the output of the abnormal traffic detection model and determine in real time whether the application has abnormal traffic.

[0009] In conjunction with the first aspect, in some embodiments, the advertising aggregation platform uses training data as input and outputs results showing no abnormal traffic in the application to train an abnormal traffic detection model. Specifically, the advertising aggregation platform can divide the training data into multiple training units according to different time periods. The advertising aggregation platform uses the training units as input and outputs results showing no abnormal traffic in the application to train multiple abnormal traffic detection models.

[0010] Since the advertising activities of applications vary in different time periods, it is understandable that the above method can enable the advertising aggregation platform to detect abnormal traffic more accurately.

[0011] In combination with the first aspect, in some embodiments, the first statistical data and the second statistical data both include one or more of the following: number of ad requests, number of ad fills, number of ad impressions, number of ad clicks, daily active users (DAU), ad click-through rate (CTR), number of independent Internet Protocol (IP) IPs, and average number of ad plays per person.

[0012] In conjunction with the first aspect, in some embodiments, the advertising aggregation platform uses training data as input and outputs results showing no abnormal traffic in the application to train an abnormal traffic detection model. Specifically, the advertising aggregation platform can divide the training data into multiple training units according to different time periods. The advertising aggregation platform uses the training units as input and outputs results showing no abnormal traffic in the application to train multiple abnormal traffic detection models.

[0013] In conjunction with the first aspect, in some embodiments, the advertising behavior includes an electronic device sending an advertisement request, an electronic device receiving an advertisement, or a user browsing or clicking an advertisement in an application. The behavior data includes an application identifier, a behavior identifier, an electronic device identifier, and time information.

[0014] In conjunction with the first aspect, in some implementations, the second statistical data further includes: advertising revenue of the application in various time periods obtained by the upstream advertising platform. The training data further includes advertising revenue of the application in various time periods.

[0015] In combination with the first aspect, in some embodiments, the advertising aggregation platform determines whether the first application has abnormal traffic in response to the output result of the abnormal traffic detection model. If the first application has abnormal traffic, the advertising aggregation platform sends a first notification message to the server corresponding to the first application, and the first notification message is used to inform the first application that there is abnormal traffic, and / or, if the first application does not have abnormal traffic, the advertising aggregation platform sends a first notification message to the server corresponding to the first application, and the first notification message is used to inform the first application that there is no abnormal traffic.

[0016] Through the above method, the advertising aggregation platform can send a notification message to the server corresponding to the application after detecting abnormal traffic, so as to remind the operation personnel to pay attention to the advertising delivery of the application.

[0017] In a second aspect, an embodiment of the present application provides an electronic device, which includes a memory and a processor, wherein the memory is used to store a computer program, and the processor is used to call the computer program so that the electronic device executes any possible implementation method as in the first aspect.

[0018] In a third aspect, an embodiment of the present application provides a computer program product comprising instructions, which, when run on an electronic device, enables the electronic device to execute any possible implementation method as in the first aspect.

[0019] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium comprising instructions, which, when executed on an electronic device, enables the electronic device to execute any possible implementation method as in the first aspect. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] In order to illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for describing the embodiments or the prior art.

[0021] Figure 1 is a schematic structural diagram of a communication system 10 provided in an embodiment of the present application;

[0022] Figure 2 1 is a schematic diagram of the structure of the advertising aggregation platform 100 provided in an embodiment of the present application;

[0023] Figure 3 This is a flow chart of the training method of the abnormal traffic detection model provided in an embodiment of the present application. DETAILED DESCRIPTION

[0024] The following is a clear and detailed description of the technical solutions in the embodiments of the present application in conjunction with the accompanying drawings. In the description of the embodiments of the present application, unless otherwise specified, " / " means or, for example, A / B can mean A or B; "and / or" in the text is only a description of the association relationship between related objects, indicating that there can be three relationships, for example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone. In addition, in the description of the embodiments of the present application, "multiple" means two or more than two.

[0025] In the following, the terms "first" and "second" are used for descriptive purposes only and should not be understood to imply or suggest relative importance or implicitly indicate the number of the technical features indicated. Therefore, the features defined as "first" and "second" may explicitly or implicitly include one or more of the features. In the description of the embodiments of this application, unless otherwise specified, "plurality" means two or more.

[0026] The following is a detailed introduction to the training method, system and related devices of the above-mentioned abnormal traffic detection model.

[0027] First, a structural diagram of the communication system 10 provided in an embodiment of the present application is introduced.

[0028] refer to Figure 1 , Figure 1 FIG. 1 shows a communication system 10 provided in an embodiment of the present application. Figure 1 As shown, the normal operation of the advertising business requires the cooperation of the advertiser's corresponding electronic equipment, the user's electronic equipment, the upstream advertising platform, and the advertising aggregation platform.

[0029] Advertisers are companies or individuals with advertising needs. Electronic devices corresponding to advertisers can be used for communicating between advertisers and upstream advertising platforms. Communication system 10 may include one or more electronic devices corresponding to advertisers.

[0030] User-side electronic devices can be mobile phones, tablets, laptops, wearable devices, and other electronic devices. These electronic devices can run applications under traffic hosts that include advertising space. These applications include applications, applets, web pages, and so on. Communication system 10 can include one or more user-side electronic devices.

[0031] An advertising platform is an intermediary that connects advertisers and traffic providers. One implementation of an advertising platform is a server. Advertising platforms include upstream advertising platforms and advertising aggregation platforms. Upstream advertising platforms can connect with advertisers and advertising aggregation platforms, respectively, while advertising aggregation platforms can connect with upstream advertising platforms and traffic providers, respectively. Communication system 10 may include one or more upstream advertising platforms.

[0032] Exemplarily, the process of advertising delivery is as follows: an advertiser with advertising delivery needs sends an advertising delivery request to the upstream advertising platform through the electronic device corresponding to the advertiser, and the advertising delivery request includes the advertisement that the advertiser wants to display. The upstream advertising platform receives and stores advertising delivery requests from multiple advertisers. The upstream advertising platform generates an upstream advertising platform software development kit (SDK). Traffic owners who have reached a cooperation with the upstream advertising platform can obtain the upstream advertising platform SDK and build the upstream advertising platform SDK into the traffic owner's application. When running the application under the traffic owner, the electronic device on the user side can request advertisements from the upstream advertising platform through the upstream advertising platform SDK, and display the advertisements returned by the upstream advertising platform in the ad space of the traffic owner's application.

[0033] Due to the large number of upstream advertising platforms, it is difficult for traffic owners to choose a suitable upstream advertising platform. Therefore, in order to maximize their profits, at present, most traffic owners send advertising display requests to the advertising aggregation platform through the electronic device on the user side. The advertising display request is used to request the advertising aggregation platform to select a suitable upstream advertising platform for the traffic owner. The advertising aggregation platform collects and determines one or more upstream advertising platforms from the many upstream advertising platforms, and encapsulates the upstream advertising platform SDKs provided by the multiple upstream advertising platforms to obtain the advertising aggregation platform SDK. Traffic owners who have reached a cooperation with the advertising aggregation platform can obtain the advertising aggregation platform SDK and embed the advertising aggregation platform SDK into the traffic owner's application. When running the traffic owner's application, the user's electronic device can request advertisements from the advertising aggregation platform through the advertising aggregation platform SDK, and display the advertisements returned by the advertising aggregation platform in the ad space of the traffic owner's application. The advertisements returned by the advertising aggregation platform are advertisements provided by the multiple upstream advertising platforms, thereby realizing advertising delivery.

[0034] In an embodiment of the present application, the electronic device on the user side can report behavior logs to the advertising aggregation platform and the upstream advertising platform through the advertising aggregation platform SDK and the upstream advertising platform SDK in the advertising aggregation platform SDK respectively.

[0035] In an embodiment of the present application, the advertising aggregation platform can obtain the behavior logs reported by the electronic device on the user side and perform statistics on the reported behavior logs to obtain a first statistical data set. The advertising aggregation platform can obtain a second statistical data set provided by the upstream advertising platform. The advertising aggregation platform can obtain a model training data set based on the first statistical data set and the second statistical data set. The model training data set includes the data in the first statistical data set and the difference between the data in the first statistical data set and the data in the second statistical data set corresponding to the same time period. The difference indicates the normal offset range of the data in the first statistical data set. The advertising aggregation platform can train an abnormal traffic detection model based on the model training data set.

[0036] The subsequent method embodiments of this application will provide a detailed introduction to the process of the advertising aggregation platform executing the above steps.

[0037] In an embodiment of the present application, the upstream advertising platform may also obtain the behavior log reported by the user's electronic device and process the reported behavior log to obtain a second statistical data set. Specifically, the upstream advertising platform may delete the suspicious behavior data in the reported behavior log and perform statistics on the reported behavior log after deleting the suspicious behavior data to obtain the second statistical data set.

[0038] While the online advertising industry is booming, the lucrative profits from ad placements have also tempted some traffic owners to engage in traffic fraud, resulting in poor advertising effectiveness and inflated advertising bids, causing significant financial losses for advertisers. As upstream advertising platforms crack down on traffic fraud, ad aggregation platforms, acting as intermediaries between upstream advertising platforms and traffic owners, need to proactively identify traffic fraud through abnormal traffic detection. Furthermore, small and micro-sized traffic owners, lacking ad placement experience, are prone to wasting traffic when accessing ads. This can lead to upstream advertising platforms misjudging them as engaging in traffic fraud, impacting the normal operation of their apps. Therefore, to protect the interests of both advertisers and traffic owners, it is essential for ad aggregation platforms to conduct abnormal traffic detection. Furthermore, given the high volatility and unpredictability of network traffic, ad aggregation platforms can proactively monitor traffic allocation when an app's user base surges, prompting operators to adjust their traffic allocation to maximize ad monetization.

[0039] This application provides a training method, system and related devices for abnormal traffic detection model. In this method,

[0040] The advertising aggregation platform can obtain the behavior logs reported by the electronic devices on the user side and perform statistics on the reported behavior logs to obtain a first statistical data set. The advertising aggregation platform can obtain a second statistical data set provided by the upstream advertising platform. The second statistical data is obtained by performing statistics on the reported behavior logs after the upstream advertising platform deletes the suspicious behavior data in the behavior logs reported by the above electronic devices. The advertising aggregation platform can obtain a model training data set based on the first statistical data set and the second statistical data set. The model training data set includes the data in the first statistical data set and the difference between the data in the first statistical data set and the data in the second statistical data set corresponding to the same time period. The difference indicates the normal offset range of the data in the first statistical data set. The advertising aggregation platform can use the model training data set as input and the result of no abnormal traffic in the application as output to train an abnormal traffic detection model.

[0041] In some embodiments, the first application is an application under the first traffic master. The advertising aggregation platform can obtain the behavior log reported by the electronic device on the user side, and perform statistics on the reported behavior log to obtain a third statistical data set. The advertising aggregation platform can obtain a fourth statistical data set sent by the upstream advertising platform. The fourth statistical data set is obtained by performing statistics on the reported behavior log after the upstream advertising platform deletes the suspicious behavior data in the behavior log reported by the above-mentioned electronic device. The advertising aggregation platform can obtain a real-time statistical data set of the first application based on the third statistical data set and the fourth statistical data set. Afterwards, the advertising aggregation platform can input the real-time statistical data set of the first application into the abnormal traffic detection model. In response to the output result of the abnormal traffic detection model, the advertising aggregation platform can determine whether the first application has abnormal traffic.

[0042] By implementing this method, the advertising aggregation platform can train an abnormal traffic detection model and perform abnormal traffic detection based on the abnormal traffic detection model, no longer relying on the experience of operators, reducing the labor cost in the abnormal traffic detection process, and improving the accuracy of abnormal traffic detection by the advertising aggregation platform.

[0043] Figure 2 A schematic structural diagram of the advertising aggregation platform 100 provided in an embodiment of the present application is shown.

[0044] like Figure 2 As shown, the advertising aggregation platform 100 may include: a network device processor 101, a memory 102, a communication interface 103, a transmitter (TX) 105, a receiver (RX) 106, a coupler 107 and an antenna 108. These components may be connected via a bus 104 or other means. Figure 2 Take bus connection as an example.

[0045] The communication interface 103 can be used for the advertising aggregation platform 100 to communicate with other communication devices, such as upstream advertising platforms, user-side electronic devices, etc. Specifically, the communication interface 103 can be a 3G communication interface, a Long Term Evolution (LTE) (4G) communication interface, a 5G communication interface, a WLAN communication interface, a WAN communication interface, etc. The advertising aggregation platform 100 is not limited to a wireless communication interface. It can also be configured with a wired communication interface 103 to support wired communication.

[0046] In the embodiment of the present application, the advertising aggregation platform 100 may receive an advertisement display request sent by the user's electronic device via the receiver 106. In addition, the receiver 106 may also be used for the advertising aggregation platform 100 to receive behavior logs uploaded by the user's electronic device.

[0047] In some embodiments of the present application, the transmitter 105 and the receiver 106 can be regarded as a wireless modem. The transmitter 105 can be used to transmit and process the signal output by the processor 101. The receiver 106 can be used to receive the signal. In the advertising aggregation platform 100, the number of transmitters 105 and receivers 106 can be one or more. The antenna 108 can be used to convert electromagnetic energy in the transmission line into electromagnetic waves in free space, or to convert electromagnetic waves in free space into electromagnetic energy in the transmission line. The coupler 107 can be used to divide the mobile communication signal into multiple paths and distribute it to multiple receivers 106. It can be understood that the antenna 108 of the advertising aggregation platform 100 can be implemented as a large-scale antenna array.

[0048] Memory 102 is coupled to processor 101 and is configured to store various software programs and / or multiple sets of instructions. Specifically, memory 102 may include high-speed random access memory and may also include non-volatile memory, such as one or more disk storage devices, flash memory devices, or other non-volatile solid-state storage devices.

[0049] The memory 102 may store an operating system (hereinafter referred to as system), such as an embedded operating system such as uCOS, VxWorks, or RTLinux. The memory 102 may also store a network communication program that can be used to communicate with one or more upstream advertising platforms and one or more user-side electronic devices.

[0050] In an embodiment of the present application, the memory 102 may store data such as advertisements that advertisers wish to display, behavior logs reported by electronic devices on the user side, a first statistical data set, a second statistical data set, and a model training data set.

[0051] In an embodiment of the present application, the processor 101 can be used to read and execute computer-readable instructions. Specifically, the processor 101 can be used to call a program stored in the memory 102, such as the implementation program of the training method of the abnormal traffic detection model provided in the embodiment of the present application on the advertising aggregation platform 100 side, and execute the instructions contained in the program. Specifically, the processor 101 can process the behavior log reported by the electronic device on the user side to obtain a first statistical data set. For the traffic statistics records with the same application identifier and time period identifier in the first statistical data set and the second statistical data set, the processor 101 can calculate the difference between each data item and add the difference to the first statistical data set. The processor 101 can obtain a model training data set based on the supplemented first statistical data set, and obtain an abnormal traffic detection model based on the training of the model training data set.

[0052] In some embodiments, processor 101 may process the behavior log reported by the user's electronic device to obtain real-time traffic statistics for the first application, and input the real-time traffic statistics for the first application into an abnormal traffic detection model. Based on the model output, processor 101 may determine whether the first application has abnormal traffic.

[0053] Need to explain, Figure 2 The advertising aggregation platform 100 shown is only one implementation of the embodiment of the present application. In actual applications, the advertising aggregation platform 100 may also include more or fewer components, which is not limited here.

[0054] Figure 3 The flowchart of the training method of the abnormal traffic detection model provided in the embodiment of the present application is exemplified.

[0055] like Figure 3 As shown, the method may include steps S101 to S107. Steps S101 to S107 are performed by the advertising aggregation platform 100, wherein:

[0056] S101: Obtaining a behavior log reported by an electronic device on the user side.

[0057] A user's electronic device may have applications installed under a traffic provider. Applications include applications, mini-programs, web pages, and so on. When a user's electronic device runs an application under a traffic provider, each time it detects an activity related to advertising, it generates a behavior record and stores it in a behavior log. In some embodiments, a behavior log may also be referred to as a user behavior track, traffic log, or similar. Each activity record in a behavior log includes the following data items: application identifier, behavior identifier, electronic device identifier, and time information. These activities related to advertising may include ad request, ad filling, ad display, and ad click. An ad request is when a user's electronic device sends an ad request to the ad aggregation platform 100 via the ad aggregation platform SDK. An ad filling is when a user's electronic device receives an ad from the ad aggregation platform 100 via the ad aggregation platform SDK. An ad display is when a user's electronic device detects a user browsing an ad displayed by an application under a traffic provider. An ad click is when a user's electronic device detects a user clicking an ad displayed by an application under a traffic provider. This time information can be used to indicate the moment when an activity related to advertising was performed.

[0058] The advertising aggregation platform 100 can obtain the behavior log reported by the user's electronic device through the SDK of the advertising aggregation platform 100. In some embodiments, the user's electronic device can actively report the behavior log through the SDK of the advertising aggregation platform 100. In some embodiments, the advertising aggregation platform 100 can send a request to the user's electronic device through the SDK of the advertising aggregation platform 100 at certain time intervals and receive the behavior log returned by the user's electronic device. The embodiment of the present application does not limit the method by which the advertising aggregation platform 100 obtains the behavior log reported by the user's electronic device.

[0059] The advertising aggregation platform 100 may cooperate with one or more traffic providers. For any application under a traffic provider, the advertising aggregation platform 100 may obtain one or more behavior logs reported by one or more user-side electronic devices.

[0060] S102: Process the reported behavior log to obtain a first statistical data set.

[0061] The first statistical data set includes statistical data sets for multiple applications, and the statistical data set for any application includes multiple traffic statistical records for the application, and the traffic statistical records reflect the advertising traffic status of the application in different time periods. A traffic statistical record includes an application identifier, a time period identifier, and one or more of the following statistical data items: number of ad requests, number of ad fills, number of ad impressions, number of ad clicks, number of daily active users (DAU), ad click-through rate (CTR), number of independent internet protocols (IPs), and average number of ad plays per person.

[0062] In some embodiments, a traffic statistics record includes an application identifier, a time period identifier, as well as DAU, CTR, number of independent IPs, and average number of ad plays per person.

[0063] In some embodiments, the traffic statistics record reflects the advertising traffic status of the application within a one-hour period.

[0064] Regarding the process of the advertising aggregation platform 100 processing the reported behavior logs to obtain the first statistical data set, for example, the process of the advertising aggregation platform generating the first traffic statistics record corresponding to the first time period in the statistical data set of the first application is taken as an example: since the number of ad requests, the number of ad fills, the number of ad impressions, and the number of ad clicks correspond to the number of ad request behaviors, ad fill behaviors, ad display behaviors, and ad click behaviors, respectively, the advertising aggregation platform can extract from the reported behavior logs all log records with the application identifier being the first application and the time when the behavior related to advertising delivery is performed within the first time period. The advertising aggregation platform can traverse all the above log records and determine the number of log records with the behavior identifier being the ad request behavior identifier as the number of ad requests, the number of log records with the behavior identifier being the ad fill behavior identifier as the number of ad fills, the number of log records with the behavior identifier being the ad display behavior identifier as the number of ad impressions, and the number of log records with the behavior identifier being the ad click behavior identifier as the number of ad clicks. Since the DAU of the first traffic statistics record is the number of electronic devices that ran the first application during the first time period, the advertising aggregation platform can obtain the DAU of the first traffic statistics record based on the electronic device identifier in each extracted log record. In addition, the CTR value of the first traffic statistics record is the ratio of the number of ad clicks in the first traffic statistics record to the number of ad impressions in the first traffic statistics record. The value of the number of independent IP addresses in the first traffic statistics record is the number of independent IP addresses of electronic devices that accessed the first application during the first time period. The value of the average number of ad plays per person in the first traffic statistics record is the ratio of the number of ad impressions in the first traffic statistics record to the daily average user (DAU) in the first traffic statistics record.

[0065] Since the advertising aggregation platform 100 can cooperate with many traffic owners, the number of electronic devices on the user side is extremely large, and any electronic device on the user side can report multiple behavior logs. Therefore, the number of behavior logs that the advertising aggregation platform 100 can obtain is massive. In order to reduce the data scale, in some embodiments, before collecting statistics on the reported behavior logs, the advertising aggregation platform 100 can first filter the reported behavior logs and delete obviously invalid and illegal data in the reported behavior logs.

[0066] In some embodiments, after the advertisement aggregation platform 100 obtains the first statistical data set, the advertisement aggregation platform 100 may save the first statistical data set to a data warehouse tool (Hive) and an inspection task module of the advertisement aggregation platform 100 .

[0067] S103: Obtain a second statistical data set provided by an upstream advertising platform.

[0068] As an independent advertising platform, the upstream advertising platform can also obtain the behavior logs reported by the user's electronic device and process the reported behavior logs to obtain the second statistical data set. The advertising aggregation platform can obtain the second statistical data set through the SDK provided by the upstream advertising platform.

[0069] The process by which the upstream advertising platform obtains the second statistical data set is as follows: Since the upstream advertising platform directly contacts advertisers, in order to protect the interests of advertisers, the upstream advertising platform can first perform a more rigorous cleanup of suspicious behavior data on the reported behavior logs and delete the suspicious behavior data in the reported behavior logs. Suspicious behavior data is data that the upstream advertising platform suspects is generated due to abnormal traffic. Afterwards, the upstream advertising platform can perform statistics on the reported behavior logs after invalid data cleaning to obtain a second statistical data set. The process by which the upstream advertising platform performs statistics on the reported behavior logs can refer to the process by which the above-mentioned advertising aggregation platform performs statistics on the reported behavior logs. Since the second statistical data set is obtained by the upstream advertising platform performing statistics on the reported behavior logs after the suspicious behavior data are cleaned, for traffic statistical records with the same application identifier and time period identifier, there will be certain differences in the data of each data item in the first statistical data set and the second statistical data set.

[0070] In some embodiments, since the real-time revenue from advertising is determined by negotiation between the upstream advertising platform and the advertiser, the traffic owner is not aware of it. Therefore, the first statistical data set lacks data related to the real-time revenue from advertising. In some embodiments, when the upstream advertising platform generates the second statistical data set, it will write the data related to the real-time revenue from advertising into the second statistical data set. In response to the ad display request sent by the traffic owner, the advertising aggregation platform 100 can collect and determine one or more upstream advertising platforms from among the numerous upstream advertising platforms for the traffic owner. The advertising aggregation platform 100 can obtain the second statistical data set provided by the one or more upstream advertising platforms.

[0071] S104: Obtain a model training data set based on the first statistical data set and the second statistical data set.

[0072] The model training dataset includes statistical data sets of multiple applications, and the statistical data set of any application includes multiple model training records of the application.

[0073] There is a one-to-one correspondence between the model training records in the model training data set and the traffic statistics records in the first statistical data set. Any model training record includes an application identifier, a time period identifier, and one or more of the following data items: number of ad requests, difference in number of ad requests, number of ad fills, difference in number of ad fills, number of ad impressions, difference in number of ad impressions, number of ad clicks, difference in number of ad clicks, DAU, difference in DAU, CTR, difference in CTR, number of independent IPs, difference in number of independent IPs, average number of ad plays per person, and difference in average number of ad plays per person. Among them:

[0074] The data in the application identifier, time period identifier, number of ad requests, number of ad fills, number of ad displays, number of ad clicks, DAU, CTR, number of independent IPs, and average number of ad plays per person in any model training record are the same as the data in the traffic statistics record in the first statistical data set corresponding to the model training record.

[0075] The data in any model training record, including the difference in the number of ad requests, the difference in the number of ad fills, the difference in the number of ad impressions, the difference in the number of ad clicks, the difference in DAU, the difference in CTR, the difference in the number of unique IPs, and the difference in the number of ad plays per capita, is the difference data for each data item in the traffic statistics records with the same application identifier, electronic device identifier, and time period identifier in the first statistical data set and the second statistical data set. For example, for the difference in the number of ad requests: the advertising aggregation platform 100 can calculate the difference in the number of ad requests in the traffic statistics records with the same application identifier and time period identifier in the first statistical data set and the second statistical data set.

[0076] In some embodiments, any model training record includes an application identifier, a time period identifier, as well as DAU, CTR, number of independent IPs, and average number of ad plays per person.

[0077] Since the upstream advertising platform will clean up the suspicious traffic data in the reported behavior logs, the data in the second statistical data set generated by the upstream advertising platform may be different from the data in the first statistical data set generated by the aggregated advertising platform. Since the suspicious traffic data may be caused by improper user operation or abnormal traffic. For example, the suspicious behavior data generated by improper user operation can be multiple behavior records generated by the user repeatedly clicking on the advertisement displayed by the same application on the same electronic device within a second time period, and the second time period can be a shorter time period. For any application, under normal traffic conditions, suspicious traffic data is generally generated by improper user operation, and at this time the values ​​of the above-mentioned multiple difference data items are generally small and relatively stable. In the case of abnormal traffic, suspicious traffic data is mainly generated by abnormal traffic, and at this time the values ​​of the above-mentioned multiple difference data items may fluctuate greatly. Therefore, using the above-mentioned multiple difference data items to train the abnormal traffic detection model helps to improve the detection accuracy of the abnormal traffic detection model.

[0078] In some embodiments, if the second statistical data set includes data related to real-time advertising revenue, when obtaining the model training data set based on the first and second statistical data sets, the advertising aggregation platform 100 may supplement the model training data set with data related to actual advertising revenue from the second statistical data set. Specifically, the advertising aggregation platform 100 may add a data item to all model training records, which is used to record data related to real-time advertising revenue. The data related to real-time advertising revenue may be advertising revenue within the time period corresponding to the traffic statistics record.

[0079] In some embodiments, the advertising aggregation platform 100 may not execute the above steps S103 and S104, but directly obtain the difference between the traffic statistical records with the same application identifier, electronic device identifier, and time period identifier in the first statistical data set and the second statistical data set for each data item, and obtain the model training data set based on the first statistical data set and the above difference data.

[0080] S105: Based on the model training data set, an abnormal traffic detection model is trained.

[0081] The advertisement aggregation platform 100 may train an abnormal traffic detection model based on the model training data set.

[0082] In some embodiments, because the effectiveness of advertising is affected by multiple factors, the data in the first and second statistical data sets exhibit large fluctuations over a short period of time. Therefore, to balance model quality and investment costs, before training the abnormal traffic detection model based on the model training data set, the advertising aggregation platform 100 can extract data from the model training data set. Specifically, the advertising aggregation platform 100 can extract all data within time period T1 from the model training data set. In some embodiments, time period T1 can be from 30 days ago to the current time.

[0083] In some embodiments, before training the abnormal traffic detection model based on the model training data set, the advertising aggregation platform 100 can filter out invalid data in the model training data set. For example, the advertising aggregation platform 100 can delete all data corresponding to applications with less than 200 daily active users (DAU) and less than 500 ad impressions in the past 30 days. In some embodiments, the advertising aggregation platform 100 can delete all data corresponding to applications with a non-zero number of ad requests and zero ad impressions in the past 30 days, as well as all data corresponding to applications with a non-zero number of ad impressions and zero ad clicks in the past 30 days.

[0084] In some embodiments, before training the abnormal traffic detection model based on the model training dataset, the advertising aggregation platform 100 may perform data sampling. Specifically, the advertising aggregation platform 100 may classify applications based on the user volume of the application corresponding to the application identifier. The advertising aggregation platform 100 may randomly select several applications from each application class and aggregate the model training records corresponding to the selected applications to obtain a model training dataset. The number of randomly selected applications in each application class is determined by the proportion of the number of applications contained in that application class to the total number of applications.

[0085] Regarding the process of the advertising aggregation platform 100 training the abnormal traffic detection model based on the model training data set, specifically: the advertising aggregation platform 100 can use the model training data set as input and use the absence of abnormal traffic as output to train the abnormal traffic detection model.

[0086] In some embodiments, the advertising aggregation platform 100 can divide the data in the model training dataset into multiple units based on time and train a model for each unit separately to reduce the impact of uneven data distribution at different times of the day on the abnormal traffic detection model. For example, the advertising aggregation platform 100 can divide the samples used for model training into 12 units, each lasting 2 hours, based on different times of the day. The advertising aggregation platform 100 can train a model for each unit separately.

[0087] In some embodiments, the abnormal traffic detection model is a model designed based on a one-class support vector machine (One Class SVM) algorithm.

[0088] In some embodiments, the kernel of the abnormal traffic detection model is constructed using the Scikit-lean library in Python.

[0089] Because advertising delivery is highly time-sensitive, in some embodiments, the advertising aggregation platform 100 can periodically update the abnormal traffic detection model. Specifically, the advertising aggregation platform 100 trains the abnormal traffic detection model according to steps S101 to S104 every month to adapt to changes that may occur during the advertising delivery process.

[0090] S106: Obtain a real-time statistical data set of the first application.

[0091] The advertising aggregation platform 100 may obtain the behavior log reported by the user's electronic device and, based on the reported behavior log, obtain a third statistical data set. The third statistical data set includes one or more traffic statistics records whose application identifier is the first application identifier and whose time period identifier indicates a time period within time period T2. Time period T2 may be a preset time period. In some embodiments, time period T2 may be a time period from 24 hours ago to the current time.

[0092] The advertising aggregation platform 100 may obtain a fourth statistical data set provided by the upstream advertising platform. The fourth statistical data set is obtained by analyzing the reported behavior logs of the electronic devices after the upstream advertising platform deletes suspicious behavior data from the behavior logs. The fourth statistical data set includes one or more traffic statistics records whose application identifier is the first application identifier and whose time period identifier indicates a time within time period T2.

[0093] Afterwards, the advertising aggregation platform 100 can obtain a real-time statistical data set of the first application based on the third statistical data set and the fourth statistical data set. The real-time statistical data set of the first application includes one or more real-time statistical records of the first application, and any real-time statistical record of the first application includes an application identifier, a time period identifier, and one or more of the following data items: number of ad requests, difference in number of ad requests, number of ad fills, difference in number of ad fills, number of ad displays, difference in number of ad displays, number of ad clicks, difference in number of ad clicks, DAU, DAU difference, CTR, CTR difference, number of independent IPs, difference in number of independent IPs, average number of ad plays per person, and average number of ad plays per person. The process of the advertising aggregation platform 100 obtaining the real-time statistical record of the first application can refer to the description in the aforementioned step S104 and will not be repeated here.

[0094] S107: Input the real-time statistical data set of the first application into an abnormal traffic detection model, and determine whether the first application has abnormal traffic in response to an output result of the abnormal traffic detection model.

[0095] The advertising aggregation platform 100 may input the real-time statistical data set of the first application into a previously trained abnormal traffic detection model. In response to the output of the abnormal traffic detection model, the advertising aggregation platform 100 may determine whether the first application has abnormal traffic.

[0096] Since the upstream advertising platform can perform abnormal traffic detection and determine whether the application has abnormal traffic. In addition, the upstream advertising platform will strictly punish applications that are determined to have abnormal traffic, ban the application, and even affect the advertising of other applications under the traffic owner corresponding to the application, causing greater losses to the traffic owner. Therefore, in some embodiments, if it is determined that the first application has abnormal traffic, the advertising aggregation platform 100 can send an early warning message to the server corresponding to the first application. The early warning message can be used to remind the operator of the first application that abnormal traffic has occurred. In response to the early warning message, the operator of the first application can take corresponding measures to minimize the losses of the traffic owner.

[0097] Steps S101 to S107 provide a training method for an abnormal traffic detection model. In this method, the advertising aggregation platform can obtain the behavior logs reported by the electronic device on the user side and perform statistics on the reported behavior logs to obtain a first statistical data set. The advertising aggregation platform can obtain a second statistical data set provided by the upstream advertising platform. The second statistical data is obtained by performing statistics on the reported behavior logs after the upstream advertising platform deletes the suspicious behavior data in the behavior logs reported by the above-mentioned electronic device. The advertising aggregation platform can obtain a model training data set based on the first statistical data set and the second statistical data set. The model training data set includes the data in the first statistical data set and the difference between the data in the first statistical data set and the data in the second statistical data set corresponding to the same time period. The difference indicates the normal offset range of the data in the first statistical data set. The advertising aggregation platform can use the model training data set as input and the result of no abnormal traffic in the application as output to train an abnormal traffic detection model.

[0098] In some embodiments, the first application is an application under a first traffic owner. The advertising aggregation platform may obtain behavior logs reported by the user's electronic device and process the reported behavior logs to obtain a real-time statistical data set for the first application. The advertising aggregation platform may input the real-time statistical data set for the first application into an abnormal traffic detection model. In response to the output of the abnormal traffic detection model, the advertising aggregation platform may determine whether the first application has abnormal traffic.

[0099] By implementing this method, the advertising aggregation platform can perform abnormal traffic detection based on the abnormal traffic detection model, no longer relying on the experience of operators, reducing the labor cost in the abnormal traffic detection process, and improving the accuracy of abnormal traffic detection performed by the advertising aggregation platform.

[0100] An embodiment of the present application also provides a computer-readable storage medium, which stores a computer program. When the computer program runs on an electronic device, the electronic device executes the relevant steps executed by the advertising aggregation platform 100 in the above embodiment to implement the training method of the abnormal traffic detection model in the above embodiment.

[0101] An embodiment of the present application also provides a computer program product. When the computer program product is run on an electronic device, the electronic device executes the relevant steps executed by the advertising aggregation platform 100 in the above embodiment to implement the training method of the abnormal traffic detection model in the above embodiment.

[0102] The computer-readable storage medium, computer program product, and device provided in the embodiments of the present application are all used to execute the training method for the abnormal traffic detection model provided above. Therefore, the beneficial effects that can be achieved can be referenced to the beneficial effects of the corresponding methods provided above and will not be repeated here.

[0103] As described above, the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the above embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the above embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present application.

Claims

1. A training method for an abnormal traffic detection model, characterized in that: The method comprises: The advertising aggregation platform receives a behavior log sent by the electronic device, wherein the behavior log includes behavior data related to advertising behavior in the application; The advertising aggregation platform collects behavioral data of the application in each time period to obtain first statistical data; The advertising aggregation platform receives second statistical data sent by the upstream advertising platform, the second statistical data including data obtained by counting the behavior data of the application in each time period after the upstream advertising platform deletes the suspicious behavior data in the behavior log sent by the electronic device; The advertising aggregation platform obtains training data based on the first statistical data and the second statistical data, the training data including the first statistical data and a first difference, the first difference including a difference between the first statistical data and the second statistical data corresponding to the same time period; The advertising aggregation platform uses the training data as input and the result that no abnormal traffic occurs in the application as output, and trains an abnormal traffic detection model.

2. The method according to claim 1, characterized in that The advertising aggregation platform uses the training data as input and outputs a result that the application does not have abnormal traffic. After training to obtain an abnormal traffic detection model, the method further includes: The advertising aggregation platform collects behavioral data of the first application in the first time period to obtain third statistical data; The advertising aggregation platform receives fourth statistical data sent by the upstream advertising platform, where the fourth statistical data is obtained after the upstream advertising platform deletes the suspicious behavior data of the first application within the first time period; The advertising aggregation platform obtains input data based on the third statistical data and the fourth statistical data, wherein the input data includes the third statistical data and a difference between the third statistical data and the fourth statistical data; The advertising aggregation platform inputs the input data into the abnormal traffic detection model; The advertising aggregation platform determines whether the first application has abnormal traffic in response to an output result of the abnormal traffic detection model.

3. The method according to claim 1, characterized in that The first statistical data and the second statistical data include one or more of the following: number of advertising requests, number of advertising fills, number of advertising displays, number of advertising clicks, daily active users (DAU), advertising click-through rate (CTR), number of independent Internet Protocol IPs, and average number of advertising plays per person.

4. The method according to claim 1, wherein The advertising aggregation platform uses the training data as input and the result that the application does not have abnormal traffic as output to train an abnormal traffic detection model, specifically including: The advertising aggregation platform divides the training data into a plurality of training units according to different time periods; The advertising aggregation platform uses the training units as input and the result that no abnormal traffic occurs in the application as output, and trains to obtain multiple abnormal traffic detection models.

5. The method according to claim 1, wherein The advertising behavior includes the electronic device sending an advertisement request, the electronic device receiving an advertisement, and the user browsing or clicking on an advertisement in the application; The behavior data includes an application identifier, a behavior identifier, an electronic device identifier, and time information.

6. The method according to claim 1, characterized in that The second statistical data also includes: advertising revenue of the application in each time period obtained by the upstream advertising platform; The training data also includes the advertising revenue of the application in each time period.

7. The method according to claim 2, characterized in that After the advertising aggregation platform determines whether the first application has abnormal traffic in response to the output result of the abnormal traffic detection model, the method further includes: If the first application has abnormal traffic, the advertising aggregation platform sends a first notification message to a server corresponding to the first application, where the first notification message is used to notify the first application of the abnormal traffic; and / or, If the first application does not have abnormal traffic, the advertising aggregation platform sends a first notification message to the server corresponding to the first application, where the first notification message is used to inform the first application that there is no abnormal traffic.

8. An electronic device, characterized in that: The electronic device includes a memory and a processor, the memory is used to store a computer program, and the processor is used to call the computer program, so that the electronic device executes the method according to any one of claims 1 to 7.

9. A computer program product comprising instructions, characterized in that When the computer program product is run on an electronic device, the electronic device is caused to execute the method according to any one of claims 1 to 7.

10. A computer-readable storage medium comprising instructions, characterized in that: When the instructions are executed on an electronic device, the electronic device is caused to execute the method according to any one of claims 1 to 7.

Images