Control Method, Device, Equipment and Storage Medium for Sliding Time Window

Abstract

An embodiment of the present invention provides a control method, device, equipment and storage medium for a sliding time window. The method includes: obtaining the generation time of first behavior data; determining the initial time of the sliding time window corresponding to the first behavior data according to the generation time of the first behavior data; determining at least one sliding time window corresponding to the first behavior data according to the initial time of the sliding time window and the sliding time window configuration parameters; the sliding time window is used to generate a behavior safety baseline corresponding to the first behavior data. The method of the embodiment of the present invention realizes the effective control of the sliding time window.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular, to a control method, device, equipment, and storage medium for a sliding time window. Background Art

[0002] In recent years, with the rapid development of Internet technology and the intelligence of network devices, network security has become the key to information protection, data storage, and use. Network user behavior has an important impact on network security, and various network problems caused by abnormal user behavior have become more prominent than ever.

[0003] In related technologies, abnormal behavior is detected through a behavior security baseline; among them, the behavior security baseline is usually obtained in units of time periods, that is, user behavior data is acquired and analyzed in units of time periods to generate a user behavior baseline; therefore, how to divide the real-time behavior data stream according to time periods to generate a user behavior baseline is an issue that needs urgent attention from those skilled in the art. Summary of the Invention

[0004] In view of the problems in the prior art, embodiments of the present invention provide a control method, device, equipment, and storage medium for a sliding time window.

[0005] Specifically, the embodiments of the present invention provide the following technical solutions:

[0006] In a first aspect, an embodiment of the present invention provides a control method for a sliding time window, including:

[0007] Obtain the generation time of the first behavior data;

[0008] According to the generation time of the first behavior data, determine the initial time of the sliding time window corresponding to the first behavior data;

[0009] According to the initial time of the sliding time window and the sliding time window configuration parameters, determine at least one sliding time window corresponding to the first behavior data; the sliding time window is used to generate a behavior security baseline corresponding to the first behavior data.

[0010] Further, the step of determining at least one sliding time window corresponding to the first behavior data according to the initial time of the sliding time window and the sliding time window configuration parameters includes:

[0011] According to the initial time of the sliding time window and the sliding time window configuration parameters, determine the start time and end time of each sliding time window;

[0012] According to the start time and end time of each sliding time window, determine each sliding time window.

[0013] Further, determining the start time and end time of each of the sliding time windows according to the initial time of the sliding time window and the sliding time window configuration parameters includes:

[0014] Step a: Determine a first time according to the initial time of the sliding time window and the time window length in the sliding time window configuration parameters;

[0015] Step b: When the initial time of the sliding time window is later than the first time, use the initial time of the sliding time window as the start time of the sliding time window, and determine the end time of the sliding time window according to the start time of the sliding time window and the time window length; and update the initial time of the sliding time window according to the sliding time window iteration step included in the sliding time window configuration parameters, and repeat step b until the initial time of the sliding time window is not later than the first time.

[0016] Further, for any one of the sliding time windows, determine whether the sliding time window is an active window;

[0017] If so, determine whether the second-row data relative to the sliding time window is delayed behavior data according to the generation time of the second-row data input currently and the end time of the sliding time window.

[0018] Further, check whether the sliding time window exists in the active window record information;

[0019] The method further includes:

[0020] If not, determine whether the second-row data relative to the sliding time window is delayed behavior data according to the generation time of the second-row data input currently and the end time of the sliding time window.

[0021] Further, if the sliding time window does not exist in the active window record information, register a first timer and determine the trigger time of the first timer, where the trigger time of the first timer is determined according to the end time of the sliding time window or the closing time of the sliding time window; and / or,

[0022] If the trigger time of the first timer and the end time of the sliding time window satisfy a first condition, update the state of the sliding time window to a ready state; and / or,

[0023] If the trigger time of the first timer and the end time of the sliding time window do not satisfy the first condition, and the trigger time of the first timer and the closing time of the sliding time window satisfy the second condition, then update the state of the sliding time window to the closed state; and / or,

[0024] If the trigger time of the first timer and the end time of the sliding time window do not satisfy the first condition, and the trigger time of the first timer and the closing time of the sliding time window do not satisfy the second condition, and the trigger time of the first timer and the timeout time of the sliding time window satisfy the third condition, then update the state of the sliding time window to the timeout state.

[0025] Further, according to the end time of each sliding time window and the sliding time window configuration parameters, determine the closing time and the timeout time of each sliding time window; the closing time is used to indicate when the sliding time window stops receiving input behavior data; the timeout time is used to indicate the closing time after the sliding time window times out.

[0026] Further, if the generation time of the second behavior data and the end time of the sliding time window satisfy the fourth condition, then the second behavior data is delay behavior data relative to the sliding time window.

[0027] Further, if the generation time of the second behavior data is earlier than the second time, then discard the second behavior data; the second time is determined based on the generation time of the second behavior data and the delay time of the sliding time window.

[0028] In a second aspect, an embodiment of the present invention further provides a control device for a sliding time window, including:

[0029] An acquisition module, configured to acquire the initial time of the first behavior data;

[0030] A determination module, configured to determine the start time of the sliding time window corresponding to the first behavior data according to the initial time of the first behavior data;

[0031] A control module, configured to determine at least one sliding time window corresponding to the first behavior data according to the initial time of the sliding time window and the sliding time window configuration parameters; the sliding time window is used to generate a behavior safety baseline corresponding to the first behavior data.

[0032] In a third aspect, an embodiment of the present invention further provides an electronic device, including a memory, a processor, and a computer program stored on the memory and executable on the processor. When the processor executes the program, the control method of the sliding time window as described in the first aspect is implemented.

[0033] In a fourth aspect, an embodiment of the present invention further provides a non-transitory computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the control method of the sliding time window as described in the first aspect is implemented.

[0034] In a fifth aspect, an embodiment of the present invention further provides a computer program product, including a computer program. When the computer program is executed by a processor, the control method of the sliding time window as described in the first aspect is implemented.

[0035] For the control method, device, equipment, and storage medium of the sliding time window provided by the embodiments of the present invention, the start time of the sliding time window corresponding to the first behavior data is determined by the generation time of the first behavior data; at least one sliding time window corresponding to the first behavior data is determined according to the start time of the sliding time window and the sliding time window configuration parameters; that is, the sliding time window corresponding to the behavior data is accurately determined through the generation time of the first behavior data and the sliding time window configuration parameters; further, after the sliding time window corresponding to the behavior data is determined, the dynamic change characteristics of the data corresponding to each sliding time window can be accurately analyzed, which also makes the generated behavior security baseline contain richer and more accurate user behavior characteristics, and then the abnormal behavior can be accurately and effectively detected according to the generated behavior security baseline; at the same time, the accurate determination of the sliding time window corresponding to the behavior data also avoids the time accumulation effect of the behavior data and reduces the complexity of behavior data analysis and processing. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] In order to more clearly illustrate the technical solutions in the present invention or the prior art, the following will briefly introduce the drawings required for the description of the embodiments or the prior art. Obviously, the drawings in the following description are some embodiments of the present invention. For those of ordinary skill in the art, other drawings can be obtained based on these drawings without creative efforts.

[0037] Figure 1 is one of the flow diagrams of the control method of the sliding time window provided by the embodiments of the present invention;

[0038] Figure 2 is the second flow diagram of the control method of the sliding time window provided by the embodiments of the present invention;

[0039] Figure 3It is the third flowchart of the control method for the sliding time window provided by the embodiments of the present invention;

[0040] Figure 4 It is the fourth flowchart of the control method for the sliding time window provided by the embodiments of the present invention;

[0041] Figure 5 It is the fifth flowchart of the control method for the sliding time window provided by the embodiments of the present invention;

[0042] Figure 6 It is the sixth flowchart of the control method for the sliding time window provided by the embodiments of the present invention;

[0043] Figure 7 It is the seventh flowchart of the control method for the sliding time window provided by the embodiments of the present invention;

[0044] Figure 8 It is the structural schematic diagram of the control device for the sliding time window provided by the embodiments of the present invention;

[0045] Figure 9 It is the structural schematic diagram of the electronic device provided by the embodiments of the present invention. Detailed implementation manners

[0046] To make the objectives, technical solutions and advantages of the present invention clearer, the technical solutions in the present invention will be clearly and completely described below with reference to the accompanying drawings in the present invention. Apparently, the described embodiments are some, but not all, of the embodiments of the present invention. All other embodiments obtained by those of ordinary skill in the art without making creative efforts based on the embodiments in the present invention belong to the scope of protection of the present invention.

[0047] The method of the embodiments of the present invention realizes the effective control of the sliding time window.

[0048] In the related art, the detection of abnormal behaviors is performed through the behavior safety baseline; among them, the behavior safety baseline is usually obtained in units of time periods, that is, the user behavior data is obtained and analyzed in units of time periods to generate the user behavior baseline; therefore, how to divide the real-time behavior data stream according to time periods to generate the user behavior baseline is an issue that those skilled in the art need to pay urgent attention to.

[0049] The control method of the sliding time window in the embodiment of the present invention determines the start time of the sliding time window corresponding to the first behavior data according to the generation time of the first behavior data; determines at least one sliding time window corresponding to the first behavior data according to the start time of the sliding time window and the sliding time window configuration parameters; that is, accurately determines the sliding time window corresponding to the behavior data through the generation time of the first behavior data and the sliding time window configuration parameters; further, after the sliding time window corresponding to the behavior data is determined, the dynamic change characteristics of the data corresponding to each sliding time window can be accurately analyzed, which also makes the generated behavior security baseline contain richer and more accurate user behavior characteristics, and then the abnormal behavior can be accurately and effectively detected according to the generated behavior security baseline; at the same time, the accurate determination of the sliding time window corresponding to the behavior data also avoids the time accumulation effect of the behavior data and reduces the complexity of behavior data analysis and processing.

[0050] The following combines Figures 1-9 Specific embodiments are used to elaborate on the technical solution of the present invention in detail. These specific embodiments can be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments.

[0051] Figure 1 It is a schematic flowchart of an embodiment of the control method of the sliding time window provided by the embodiment of the present invention. As Figure 1 shown, the method provided in this embodiment includes:

[0052] Step 101, obtain the generation time of the first behavior data;

[0053] Specifically, the behavior security baseline is usually obtained in units of time periods, that is, the user behavior data is obtained and analyzed in units of time periods to generate the user behavior baseline. Therefore, in order to detect abnormal behaviors, the first step is to obtain the user behavior data and the generation time of the behavior data, and then the behavior security baseline can be generated and abnormal behaviors can be detected based on the obtained user behavior data and the generation time of the behavior data. Optionally, the obtained behavior data includes real-time behavior data streams.

[0054] Step 102, determine the initial time of the sliding time window corresponding to the first behavior data according to the generation time of the first behavior data;

[0055] Specifically, the behavioral safety baseline is usually obtained on a time period basis. Therefore, it is necessary to divide the real-time behavioral data stream according to time periods to generate the user behavior baseline. Optionally, the behavioral data can be divided by time periods in the way of a sliding time window. Among them, the sliding time window can frame the time series according to the specified time length, so as to calculate the statistical indicators within the frame. It is equivalent to a time slider with a specified length sliding on the time series, and the data within the time slider can be fed back every time the time slider slides by one unit. Correspondingly, it is necessary to determine the sliding time windows corresponding to the behavioral data, that is, to which time windows the behavioral data needs to be divided, so as to complete the analysis of the data within the corresponding time windows and then generate the behavioral safety baseline. Further, to determine the sliding time windows corresponding to the behavioral data, it is necessary to first determine the initial time of the sliding time window.

[0056] Step 103: Determine at least one sliding time window corresponding to the first behavioral data according to the initial time of the sliding time window and the sliding time window configuration parameters; the sliding time window is used to generate the behavioral safety baseline corresponding to the first behavioral data.

[0057] Specifically, as shown in Table 1, the sliding time window configuration parameters include the specific configuration information of the sliding time window. According to the initial time of the sliding time window and the sliding time window configuration parameters shown in Table 1, the start time and end time of each sliding time window can be accurately determined, that is, the sliding time windows corresponding to the behavioral data can be accurately determined. Further, after the sliding time windows corresponding to the behavioral data are determined, the dynamic change characteristics of the data corresponding to each sliding time window can be accurately determined, which also makes the behavioral safety baseline contain richer and more accurate user behavior characteristics. Then, abnormal behavior can be accurately and effectively detected according to the behavioral safety baseline. At the same time, after the sliding time windows corresponding to the behavioral data are determined, the time accumulation effect of the behavioral data is also avoided, and the complexity of behavioral data analysis and processing is reduced.

[0058] Exemplarily, as Figure 2 shown, after obtaining the behavioral data, after determining the sliding time window corresponding to the behavioral data according to the generation time of the behavioral data and the configuration parameters, and then passing the information of the sliding time window and the behavioral data to the lower-level processing unit for processing, the behavioral safety baseline can be generated.

[0059] For example, the generation time of behavioral data A is 6:30, the start time of the sliding time window is 6:00, the length of the sliding time window in the configuration parameters is 5 hours, and the iteration step size is 1 hour. Then, the sliding time windows corresponding to behavioral data A are: sliding time window one from 6:00 to 11:00, sliding time window two from 5:00 to 10:00, sliding time window three from 4:00 to 9:00, sliding time window four from 3:00 to 8:00, and sliding time window five from 2:00 to 7:00.

[0060] Assume that the behavioral safety baseline is generated based on the behavioral data of 24 hours a day. Then, when directly analyzing 24-hour data, due to the large amount of data within 24 hours, the difficulty and complexity of data analysis and processing are too high. After determining the sliding time window corresponding to the behavioral data, if the window length of the sliding time window is 5 hours, then the data from 2:00 to 7:00, 3:00 to 8:00, 4:00 to 9:00, and so on can be analyzed and processed respectively. Eventually, the analysis and processing of 24-hour data can be achieved, that is, the data analysis and processing within the 5-hour sliding time window length. Compared with the 24-hour data analysis and processing, the time accumulation of behavioral data is avoided, and the complexity of behavioral data analysis and processing is reduced. At the same time, after determining the sliding time window corresponding to the behavioral data, the dynamic change characteristics of the data within each sliding time window can also be accurately obtained, that is, the dynamic change characteristics of the data from 2:00 to 7:00 compared with the data from 3:00 to 8:00 can be obtained and analyzed, making the behavioral safety baseline contain richer and more accurate user behavior characteristics. Furthermore, based on the behavioral safety baseline, abnormal behavior can be accurately and effectively detected.

[0061] The method of the above embodiment determines the initial time of the sliding time window corresponding to the first behavioral data through the generation time of the first behavioral data; determines at least one sliding time window corresponding to the first behavioral data according to the initial time of the sliding time window and the sliding time window configuration parameters; that is, through the generation time of the first behavioral data and the sliding time window configuration parameters, the sliding time window corresponding to the behavioral data is accurately determined. Further, after the sliding time window corresponding to the behavioral data is determined, the dynamic change characteristics of the data corresponding to each sliding time window can be accurately analyzed, which also makes the generated behavioral safety baseline contain richer and more accurate user behavior characteristics. Furthermore, based on the generated behavioral safety baseline, abnormal behavior can be accurately and effectively detected. At the same time, the accurate determination of the sliding time window corresponding to the behavioral data also avoids the time accumulation effect of the behavioral data and reduces the complexity of behavioral data analysis and processing.

[0062] Optionally, the initial time of the sliding time window corresponding to the first behavioral data is determined according to the generation time of the first behavioral data and the time window length in the sliding time window configuration parameters.

[0063] Specifically, the sliding time window configuration parameters include the specific configuration information of the sliding time window. Optionally, the configuration parameters include some or all of the parameters shown in Table 1. Optionally, the initial time of the sliding time window corresponding to the behavior data can be obtained in the following way: the initial time of the time window = the generation time of the behavior data - (the generation time of the behavior data + the length of the sliding time window) % the length of the sliding time window; that is, according to the generation time of the behavior data and the time window length in the sliding time window configuration parameters, the initial time of the sliding time window corresponding to the behavior data can be accurately determined.

[0064] It should be noted that in other embodiments, the initial time of the time window can also be generated in other ways based on the generation time of the behavior data, and the embodiments of the present invention do not limit this.

[0065] Table 1

[0066]

[0067]

[0068] For example, the generation time of behavior data A is 6:30; the length of the sliding time window is 5 hours, then the sliding time window corresponding to behavior data A can be sliding time window one from 2:00 to 7:00, sliding time window two from 3:00 to 8:00, sliding time window three from 4:00 to 9:00, sliding time window four from 5:00 to 10:00, and sliding time window five from 6:00 to 11:00, that is, behavior data A needs to be analyzed and processed within sliding time window one to sliding time window 5.

[0069] In one embodiment, determining at least one sliding time window corresponding to the first behavior data according to the initial time of the sliding time window and the sliding time window configuration parameters includes:

[0070] Determining the start time and end time of each sliding time window according to the initial time of the sliding time window and the sliding time window configuration parameters;

[0071] Determining each sliding time window according to the start time and end time of each sliding time window.

[0072] Specifically, the sliding time window is determined by the start time and end time of the sliding time window. Therefore, it is necessary to determine the start time and end time of the sliding time window to perform subsequent data analysis and generate the behavior safety baseline. As shown in Table 1, the sliding time window configuration parameters include the specific configuration information of the sliding time window. According to the initial time of the sliding time window and the sliding time window configuration parameters shown in Table 1, the start time and end time of each sliding time window can be accurately determined. Further, the sliding time windows corresponding to the behavior data can be accurately determined.

[0073] For the method of the above embodiments, based on the initial time of the sliding time window and the sliding time window configuration parameters including the specific configuration information of the window, the start time and end time of each sliding time window can be accurately determined, and thus the respective sliding time windows corresponding to the behavior data can be accurately determined; further, based on the determined sliding time windows, the data within the corresponding time windows can be analyzed and processed, and finally a behavior safety baseline can be generated.

[0074] Optionally, determining the start time and end time of each sliding time window according to the initial time of the sliding time window and the sliding time window configuration parameters includes:

[0075] Step a: Determine a first time according to the initial time of the sliding time window and the time window length in the sliding time window configuration parameters;

[0076] Step b: When the initial time of the sliding time window is later than the first time, use the initial time of the sliding time window as the start time of the sliding time window, and determine the end time of the sliding time window according to the start time of the sliding time window and the time window length; and update the initial time of the sliding time window according to the sliding time window iteration step included in the sliding time window configuration parameters, and repeat step b until the initial time of the sliding time window is not later than the first time.

[0077] Specifically, determine a first time according to the initial time of the sliding time window and the time window length in the sliding time window configuration parameters; optionally, the first time = data generation time - sliding time window length;

[0078] When the initial time of the sliding time window is later than the first time, use the initial time of the sliding time window as the start time of the sliding time window, and determine the end time of the sliding time window according to the start time of the sliding time window and the time window length; and update the initial time of the sliding time window according to the sliding time window iteration step included in the sliding time window configuration parameter, and repeat step b until the initial time of the sliding time window is not later than the first time; Optionally, when the initial time of the sliding time window is later than the first time, use the initial time of the sliding time window as the start time of the sliding time window, and the end time of the sliding time window = the end time of the sliding time window + the sliding time window length - 1; Optionally, after determining the end time of the sliding time window, it is necessary to update the initial time of the sliding time window, that is, the initial time of the sliding time window can be updated by the initial time of the sliding time window = the initial time of the sliding time window - the sliding time window iteration step; After updating the initial time of the sliding time window, it is necessary to determine again whether the updated initial time of the sliding time window is later than the first time, and decide whether to continue to determine the subsequent sliding time window according to the judgment result.

[0079] For example, the initial time of the sliding time window is A1. When A1 is later than the first time, use the initial time A1 of the sliding time window as the start time A1 of the sliding time window, determine the end time B1 of the sliding time window, and according to the start time A1 of the moving time window and the end time B1 of the sliding time window, the sliding time window A1B1 is determined; further, update the initial time A1 of the sliding time window to the initial time A2 of the sliding time window. When A2 is later than the first time, use the initial time A2 of the sliding time window as the start time A2 of the sliding time window, determine the end time B2 of the sliding time window, and according to the start time A2 of the moving time window and the end time B2 of the sliding time window, the sliding time window A2B2 is determined; further, update the initial time A2 of the sliding time window to the initial time A3 of the sliding time window. If A3 is earlier than the first time, stop calculating the sliding time window.

[0080] The method of the above embodiment determines whether to stop calculating the sliding time window or continue to calculate the sliding time window according to whether the initial time of the sliding time window is later than the first time; and through the update of the initial time of the sliding time window, the update of the end time of each sliding time window is realized, that is, each sliding time window is accurately calculated; furthermore, according to the determined sliding time window, the data within the corresponding time window can be analyzed and processed and finally a behavior safety baseline can be generated.

[0081] In one embodiment, the control method of the sliding time window further includes:

[0082] Based on the end time of each sliding time window and the sliding time window configuration parameters, determine the closing time and timeout of each sliding time window; the closing time is used to indicate when the sliding time window stops receiving input behavior data; the timeout is used to indicate the closing time after the sliding time window times out.

[0083] Specifically, when determining the start time and end time of the sliding time window, based on the end time of each sliding time window and the sliding time window configuration parameters, determine the closing time and timeout of each sliding time window; wherein, the closing time is used to indicate when the sliding time window stops receiving input behavior data, optionally, the closing time of the sliding time window = the end time of the sliding time window + the sliding time window time delay; the timeout is used to indicate the closing time after the sliding time window times out, optionally, the timeout of the sliding time window = the closing time + the closing time of the sliding time window + the sliding time window length.

[0084] Exemplarily, as Figure 3 shown, determine the start time of the sliding time window according to the generation time of the behavior data; when the start time of the sliding time window is later than the first time, determine the end time, closing time and timeout of the sliding time window, and thus the sliding time window is determined, and then add the determined sliding time window to the time window sequence and update the start time of the sliding time window.

[0085] The method of the above embodiment, by determining the closing time and timeout of each sliding time window according to the end time of each sliding time window and the sliding time window configuration parameters; wherein, the closing time is used to indicate when the sliding time window stops receiving input behavior data; the timeout is used to indicate the closing time after the sliding time window times out; solves the problem of insufficient data integrity and accuracy caused by data delay, ensures the integrity and accuracy of the data within the sliding time window, and thus improves the accuracy and integrity of the behavior safety baseline.

[0086] In one embodiment, the method for controlling the sliding time window further includes:

[0087] For any sliding time window, determine whether the sliding time window is an active window;

[0088] If so, determine whether the second behavior data is delayed behavior data relative to the sliding time window according to the generation time of the currently input second behavior data and the end time of the sliding time window.

[0089] Specifically, during the process of determining the sliding time window corresponding to the behavior data, new behavior data may be continuously input. Therefore, it is necessary to determine whether to put the newly input behavior data into the sliding time window for analysis and processing. Optionally, traverse all sliding time windows to determine whether the status of each time window is active, where the window status being active indicates that the data within the time period corresponding to the time window is being analyzed and processed. That is, when the window status is active, it is necessary to determine whether to put the newly input behavior data into the active window for corresponding analysis and processing; correspondingly, according to the generation time of the currently newly input behavior data and the end time of the sliding time window, it can be determined whether the second behavior data is delayed behavior data relative to the sliding time window.

[0090] Optionally, determining whether the second behavior data is delayed behavior data relative to each sliding time window includes:

[0091] If the generation time of the second behavior data and the end time of the sliding time window satisfy the fourth condition, then the second behavior data is delayed behavior data relative to the sliding time window.

[0092] Specifically, it can be determined whether the currently newly input second behavior data is delayed behavior data relative to the sliding time window by confirming whether the generation time of the currently newly input second behavior data and the end time of the sliding time window satisfy the fourth condition; optionally, the fourth condition is the end time of the sliding time window + M, for example, M is 1; if the generation time of the currently newly input second behavior data is not earlier than the end time of the sliding time window + 1, then it is determined that the currently newly input behavior data is delayed data relative to the active time window.

[0093] The method of the above embodiment, by determining whether the newly input behavior data is delayed data of the active window, that is, determining whether to put the newly input behavior data into the active sliding time window for analysis and processing; that is, by timely putting the newly input behavior data into the corresponding active sliding time window for calculation, it ensures the integrity and accuracy of the data within the sliding time window, and thus improves the accuracy and integrity of the behavior safety baseline.

[0094] In one embodiment, determining whether the sliding time window is an active window includes:

[0095] Search for the sliding time window in the active window record information;

[0096] The method further includes:

[0097] If not, then determine whether the second behavior data is delayed behavior data relative to the sliding time window according to the generation time of the currently input second behavior data and the end time of the sliding time window.

[0098] Specifically, in the process of determining the sliding time window corresponding to the behavior data, new behavior data may be continuously input. Therefore, it is necessary to determine whether to put the newly input behavior data into the sliding time window for analysis and processing. Optionally, traverse all the sliding time windows to determine whether the status of each time window is active, that is, to determine whether each time window exists in the active window record information. If it exists in the active window record information, the status of the corresponding window is active; otherwise, it is inactive.

[0099] Furthermore, if the time window does not exist in the active window record information, the current sliding time window is saved to the time window record table, and based on the generation time of the newly input behavior data and the end time of the sliding time window, it is determined whether the newly input behavior data is delayed behavior data relative to the sliding time window. Among them, to determine whether the behavior data is delayed behavior data relative to the sliding time window, there are corresponding embodiments in the present invention for detailed description, and no repeated description will be made here.

[0100] In one embodiment, the method for controlling the sliding time window further includes:

[0101] If the sliding time window does not exist in the active window record information, register the first timer and determine the trigger time of the first timer, where the trigger time of the first timer is determined according to the end time of the sliding time window or the closing time of the sliding time window; and / or,

[0102] If the trigger time of the first timer and the end time of the sliding time window meet the first condition, update the status of the sliding time window to the ready state; and / or,

[0103] If the trigger time of the first timer and the end time of the sliding time window do not meet the first condition, and the trigger time of the first timer and the closing time of the sliding time window meet the second condition, update the status of the sliding time window to the closed state; and / or,

[0104] If the trigger time of the first timer and the end time of the sliding time window do not meet the first condition, the trigger time of the first timer and the closing time of the sliding time window do not meet the second condition, and the trigger time of the first timer and the timeout time of the sliding time window meet the third condition, update the status of the sliding time window to the timeout state.

[0105] Specifically, the behavioral safety baseline is usually obtained in units of time periods, that is, the data within the corresponding time window can be analyzed and processed according to the determined sliding time window to generate the behavioral safety baseline; therefore, in order to accurately analyze and process the data corresponding to the sliding time window, it is necessary to update the state of the sliding time window in a timely and accurate manner.

[0106] Optionally, if the sliding time window does not exist in the active window record information, register the first timer; if the generation time of the newly input behavioral data is not earlier than the fourth condition, the trigger time of the first timer is the closing time of the sliding time window; if the generation time of the newly input behavioral data is earlier than the fourth condition, the trigger time of the first timer is the end time of the sliding time window + N, for example, N is 1; where the fourth condition is the end time of the sliding time window + M, for example, M is 1, that is, the trigger time of the first timer is determined according to the end time of the sliding time window or the closing time of the sliding time window; when the generation time of the newly input behavioral data is not earlier than the fourth condition, the registered timer value is <the end time of the sliding time window + N, time window>, and when the generation time of the newly input behavioral data is not earlier than the fourth condition, the registered timer value is <the closing time of the sliding time window, time window>.

[0107] When the trigger time of the first timer and the end time of the sliding time window meet the first condition, update the state of the sliding time window to the ready state, where the first condition is: the trigger time of the first timer = the end time of the sliding time window + N, for example, N is 1.

[0108] If the trigger time of the first timer and the end time of the sliding time window do not meet the first condition, and the trigger time of the first timer and the closing time of the sliding time window meet the second condition, update the state of the sliding time window to the closed state. Optionally, when the trigger time of the first timer and the end time of the sliding time window do not meet the first condition, and the trigger time of the first timer is equal to the closing time of the sliding time window, update the state of the sliding time window to the closed state; where the first condition is: the trigger time of the first timer = the end time of the sliding time window + N, for example, N is 1.

[0109] If the trigger time of the first timer and the end time of the sliding time window do not satisfy the first condition, and the trigger time of the first timer and the closing time of the sliding time window do not satisfy the second condition, and the trigger time of the first timer and the timeout time of the sliding time window satisfy the third condition, then update the status of the sliding time window to the timeout status; optionally, when the trigger time of the first timer and the end time of the sliding time window do not satisfy the first condition, and the trigger time of the first timer and the closing time of the sliding time window do not satisfy the second condition, and the trigger time of the first timer is equal to the timeout time of the sliding time window, update the status of the sliding time window to the timeout status; where the first condition is: the trigger time of the first timer = the end time of the sliding time window + N, for example, N is 1; the second condition is that the trigger time of the first timer is equal to the closing time of the sliding time window.

[0110] Exemplarily, as Figure 4 shown, traverse all time windows in the time window sequence, and determine whether the corresponding time window is active by querying the active time window record table; if the time window exists in the active time window record table, then determine whether the generation time of the newly input behavior data and the end time of the sliding time window satisfy the fourth condition. If the fourth condition is satisfied, the newly input behavior data is delayed behavior data relative to the sliding time window, and then pass the parameter <current time window, behavior data, "delayed behavior data"> to the lower-level processing unit, otherwise, pass the parameter <current time window, behavior data> to the lower-level processing unit. If the time window does not exist in the active time window record table, register the first timer, and determine whether the newly input behavior data is delayed behavior data relative to the sliding time window according to the generation time of the newly input behavior data and the end time of the sliding time window.

[0111] As Figure 5As shown, the state of the sliding time window is updated based on the trigger time of the first timer. If the trigger time of the first timer and the end time of the sliding time window meet the first condition, the state of the sliding time window is updated to the ready state, and a time timer is registered with a timer value of <the closing time of the time window, time window>. The parameter <the current time window, "ready window"> is passed to the lower-level calculator. If the trigger time of the first timer and the end time of the sliding time window do not meet the first condition, and the trigger time of the first timer and the closing time of the sliding time window meet the second condition, the state of the sliding time window is updated to the closed state, and a time timer is registered with a timer value of <the timeout time of the time window, time window>. The current time window is deleted from the active time window record table, and the current time window is saved to the closed time window record table. The parameter <the current time window, "closed window"> is passed to the lower-level calculator. If the trigger time of the first timer and the end time of the sliding time window do not meet the first condition, and the trigger time of the first timer and the closing time of the sliding time window do not meet the second condition, whether the trigger time of the first timer and the timeout time of the sliding time window meet the third condition. If the third condition is met, the state of the sliding time window is updated to the timeout state; and the current time window is deleted from the closed time window record table closedTimeWindowMap, and the parameter <the current time window, "timeout window"> is passed to the lower-level calculator; otherwise, the time timer trigger calculation process is stopped. Among them, the first condition is: the trigger time of the first timer = the end time of the sliding time window + N, for example, N is 1; the second condition is that the trigger time of the first time timer is equal to the closing time of the sliding time window.

[0112] The method of the above embodiment judges the relationship between the trigger time of the first timer and the sliding time window to accurately update the state of the sliding time window; by updating the state of the sliding time window, that is, accurately setting the window state to the ready state, the closed state or the timeout state, it avoids the leakage analysis and redundant analysis of the data in the corresponding sliding time window, ensures the integrity and accuracy of the data in the sliding time window, and thus improves the accuracy and integrity of the behavior safety baseline.

[0113] In one embodiment, if the generation time of the second behavior data is earlier than the second time, the second behavior data is discarded; the second time is determined based on the generation time of the second behavior data and the delay time of the sliding time window.

[0114] Specifically, in the process of determining the sliding time window corresponding to the behavior data, new behavior data may be continuously input. Therefore, it is necessary to determine whether to put the newly input behavior data into the sliding time window for analysis and processing. If the generation time of the newly input behavior data is earlier than the second time, the second behavior data is discarded. The second time is determined based on the generation time of the second behavior data and the time delay of the sliding time window. Wherein, the second time = the generation time of the newly input behavior data - the time delay of the sliding time window.

[0115] Exemplarily, such as Figure 6 As shown, obtain the generation time of the newly input behavior data and the second time, and determine whether the newly input behavior data is timeout data. If it is timeout data, stop calculating the sliding window based on the current newly input behavior data. Otherwise, determine the corresponding sliding time window according to the input behavior data. Then update the state of the sliding time window. While ensuring the integrity and accuracy of the data in the sliding time window, pass the behavior data and the sliding time window to the lower-level processing unit to generate an accurate behavior safety baseline. Optionally, to determine whether the newly input behavior data is timeout data, exemplarily such as Figure 7 As shown, by judging whether the current time is earlier than the generation time of the newly input behavior data, if so, update the current time and the second time. Otherwise, if the generation time of the second behavior data is earlier than the second time, discard the newly input behavior data, that is, stop calculating the sliding time window based on the newly input behavior data.

[0116] The method of the above embodiment can accurately determine whether to discard the newly input behavior data or put the newly input behavior data into the corresponding sliding time window for analysis and processing by judging the relationship between the generation time of the newly input behavior data and the second time, ensuring the integrity and accuracy of the data in the sliding time window, and thus improving the accuracy and integrity of the behavior safety baseline.

[0117] Next, the control device for the sliding time window provided by the present invention is described. The control device for the sliding time window described below can be mutually corresponding and referred to the control method for the sliding time window described above.

[0118] Figure 8 It is a schematic structural diagram of the control device for the sliding time window provided by the present invention. The control device for the sliding time window provided in this embodiment includes:

[0119] An obtaining module 710, configured to obtain the generation time of the first behavior data;

[0120] A determining module 720, configured to determine the initial time of the sliding time window corresponding to the first behavior data according to the generation time of the first behavior data;

[0121] A control module 730, configured to determine at least one sliding time window corresponding to the first-row data according to the initial time of the sliding time window and the sliding time window configuration parameters; the sliding time window is used to generate a behavioral safety baseline corresponding to the first-row data.

[0122] Optionally, the control module 730 is specifically configured to: determine the start time and end time of each sliding time window according to the initial time of the sliding time window and the sliding time window configuration parameters;

[0123] Determine each sliding time window according to the start time and end time of each sliding time window.

[0124] Optionally, the control module 730 is specifically configured to:

[0125] Step a: Determine a first time according to the initial time of the sliding time window and the time window length in the sliding time window configuration parameters;

[0126] Step b: When the initial time of the sliding time window is later than the first time, use the initial time of the sliding time window as the start time of the sliding time window, and determine the end time of the sliding time window according to the start time of the sliding time window and the time window length; and update the initial time of the sliding time window according to the sliding time window iteration step included in the sliding time window configuration parameters, and repeat step b until the initial time of the sliding time window is not later than the first time.

[0127] Optionally, the determining module 720 is specifically configured to: determine the initial time of the sliding time window corresponding to the first-row data according to the generation time of the first-row data and the time window length in the sliding time window configuration parameters.

[0128] Optionally, the control module 730 is further configured to: determine the closing time and timeout time of each sliding time window according to the end time of each sliding time window and the sliding time window configuration parameters; the closing time is used to indicate when the sliding time window stops receiving input behavioral data; the timeout time is used to indicate the closing time after the sliding time window times out.

[0129] Optionally, the control module 730 is further configured to: for any sliding time window, determine whether the sliding time window is an active window;

[0130] If so, determine whether the second-row data is delayed behavioral data relative to the sliding time window according to the generation time of the currently input second-row data and the end time of the sliding time window.

[0131] Optionally, the control module 730 is further configured to: check whether there is a sliding time window in the active window record information;

[0132] If not, determine whether the second-line data is delayed behavior data relative to the sliding time window according to the generation time of the second-line data currently input and the end time of the sliding time window.

[0133] Optionally, the control module 730 is further configured to: if there is no sliding time window in the active window record information, register a first timer and determine the trigger time of the first timer, where the trigger time of the first timer is determined according to the end time of the sliding time window or the closing time of the sliding time window; and / or,

[0134] If the trigger time of the first timer and the end time of the sliding time window satisfy a first condition, update the status of the sliding time window to the ready state; and / or, if the trigger time of the first timer and the end time of the sliding time window do not satisfy the first condition, and the trigger time of the first timer and the closing time of the sliding time window satisfy a second condition, update the status of the sliding time window to the closed state; and / or, if the trigger time of the first timer and the end time of the sliding time window do not satisfy the first condition, and the trigger time of the first timer and the closing time of the sliding time window do not satisfy the second condition, and the trigger time of the first timer and the timeout time of the sliding time window satisfy a third condition, update the status of the sliding time window to the timeout state.

[0135] Optionally, the control module 730 is further configured to:

[0136] If the generation time of the second-line data and the end time of the sliding time window satisfy a fourth condition, determine that the second-line data is delayed behavior data relative to the sliding time window.

[0137] Optionally, the control module 730 is further configured to: if the generation time of the second-line data is earlier than a second time, discard the second-line data; the second time is determined based on the generation time of the second-line data and the delay time of the sliding time window.

[0138] The device according to the embodiment of the present invention is used to execute the method in any of the foregoing method embodiments, and its implementation principle and technical effect are similar, and will not be described in detail here.

[0139] Figure 9The figure illustrates a schematic diagram of the physical structure of an electronic device, which may include: a processor 810, a communications interface 820, a memory 830, and a communication bus 840. Among them, the processor 810, the communications interface 820, and the memory 830 communicate with each other through the communication bus 840. The processor 810 can call the logical instructions in the memory 830 to execute the control method of the sliding time window. The method includes: obtaining the generation time of the first behavior data; determining the initial time of the sliding time window corresponding to the first behavior data according to the generation time of the first behavior data; determining at least one sliding time window corresponding to the first behavior data according to the initial time of the sliding time window and the sliding time window configuration parameters; the sliding time window is used to generate the behavior security baseline corresponding to the first behavior data.

[0140] In addition, when the logical instructions in the above-mentioned memory 830 are implemented in the form of software function units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on such an understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or a part of this technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for causing a computer device (which may be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The foregoing storage medium includes: various media such as USB flash drives, mobile hard disks, read-only memories (ROM, Read-Only Memory), random access memories (RAM, Random Access Memory), magnetic disks, or optical discs that can store program codes.

[0141] On the other hand, the present invention also provides a computer program product. The computer program product includes a computer program stored on a non-transitory computer-readable storage medium. The computer program includes program instructions. When the program instructions are executed by a computer, the computer can execute the control method of the sliding time window provided by the above-mentioned various methods. The method includes: obtaining the generation time of the first behavior data; determining the initial time of the sliding time window corresponding to the first behavior data according to the generation time of the first behavior data; determining at least one sliding time window corresponding to the first behavior data according to the initial time of the sliding time window and the sliding time window configuration parameters; the sliding time window is used to generate the behavior security baseline corresponding to the first behavior data.

[0142] In another aspect, the present invention also provides a non-transitory computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, it is configured to execute the control method of the sliding time window provided above. The method includes: obtaining the generation time of the first behavior data; determining the initial time of the sliding time window corresponding to the first behavior data according to the generation time of the first behavior data; determining at least one sliding time window corresponding to the first behavior data according to the initial time of the sliding time window and the sliding time window configuration parameters; the sliding time window is used to generate a behavior safety baseline corresponding to the first behavior data.

[0143] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed to multiple network units. Some or all of the modules can be selected according to actual needs to achieve the purpose of the solution of this embodiment. Those of ordinary skill in the art can understand and implement it without creative efforts.

[0144] Through the description of the above embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus a necessary general hardware platform, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solution, in essence, or the part that contributes to the prior art can be embodied in the form of a software product. The computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0145] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and are not intended to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that they can still modify the technical solutions described in the foregoing embodiments, or perform equivalent replacements for some of the technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A control method for a sliding time window, characterized in that Including: Obtain the generation time of the first row of data; Determine the initial time of the sliding time window corresponding to the first row of data according to the generation time of the first row of data; Determine at least one sliding time window corresponding to the first row of data according to the initial time of the sliding time window and the sliding time window configuration parameters; The sliding time window is used to generate a behavior safety baseline corresponding to the first row of data; The method further includes: For any one of the sliding time windows, determine whether the sliding time window is an active window; If so, determine whether the second row of data is delayed behavior data relative to the sliding time window according to the generation time of the currently input second row of data and the end time of the sliding time window; The method further includes: If the sliding time window does not exist in the active window record information, register a first timer and determine the trigger time of the first timer, where the trigger time of the first timer is determined according to the end time of the sliding time window or the closing time of the sliding time window; and / or, If the trigger time of the first timer and the end time of the sliding time window satisfy a first condition, update the status of the sliding time window to a ready state; and / or, If the trigger time of the first timer and the end time of the sliding time window do not satisfy the first condition, and the trigger time of the first timer and the closing time of the sliding time window satisfy a second condition, update the status of the sliding time window to a closed state; and / or, If the trigger time of the first timer and the end time of the sliding time window do not satisfy the first condition, and the trigger time of the first timer and the closing time of the sliding time window do not satisfy the second condition, and the trigger time of the first timer and the timeout time of the sliding time window satisfy a third condition, update the status of the sliding time window to a timeout state.

2. The control method of the sliding time window according to claim 1, wherein The determining at least one sliding time window corresponding to the first row of data according to the initial time of the sliding time window and the sliding time window configuration parameters includes: Determine the start time and end time of each of the sliding time windows according to the initial time of the sliding time window and the sliding time window configuration parameters; Determine each of the sliding time windows according to the start time and end time of each of the sliding time windows.

3. The control method of the sliding time window according to claim 2, wherein The determining the start time and end time of each of the sliding time windows according to the initial time of the sliding time window and the sliding time window configuration parameters includes: Step a: Determine a first time according to the initial time of the sliding time window and the time window length in the sliding time window configuration parameters; Step b: When the initial time of the sliding time window is later than the first time, use the initial time of the sliding time window as the start time of the sliding time window, and determine the end time of the sliding time window according to the start time of the sliding time window and the time window length; and update the initial time of the sliding time window according to the sliding time window iteration step included in the sliding time window configuration parameters, and repeat step b until the initial time of the sliding time window is not later than the first time; the sliding time window iteration step is used to indicate the time difference between adjacent time windows.

4. The control method of the sliding time window according to any one of claims 1-3, characterized in that The determining the initial time of the sliding time window corresponding to the first row of data according to the generation time of the first row of data includes: Determine the initial time of the sliding time window corresponding to the first row of data according to the generation time of the first row of data and the time window length in the sliding time window configuration parameters.

5. The control method of the sliding time window according to claim 3, wherein The method further includes: Determine the closing time and timeout time of each sliding time window according to the end time of each sliding time window and the sliding time window configuration parameters; the closing time is used to indicate when the sliding time window stops receiving input behavior data; the timeout time is used to indicate the closing time after the sliding time window times out.

6. The control method of the sliding time window according to claim 1, wherein The determining whether the sliding time window is an active window includes: Check whether the sliding time window exists in the active window record information. The method further includes: If not, determine whether the second row of data is delayed behavior data relative to the sliding time window according to the generation time of the currently input second row of data and the end time of the sliding time window.

7. The control method of the sliding time window according to claim 1, wherein The determining whether the second row of data is delayed behavior data relative to each sliding time window includes: If the generation time of the second row of data and the end time of the sliding time window satisfy the fourth condition, then the second row of data is delayed behavior data relative to the sliding time window.

8. The control method of the sliding time window according to claim 7, wherein The method further includes: If the generation time of the second row of data is earlier than the second time, discard the second row of data; the second time is determined based on the generation time of the second row of data and the delay time of the sliding time window.

9. A control device for a sliding time window, characterized in that, Includes: An acquisition module, configured to acquire the generation time of the first row of data; A determination module, configured to determine the initial time of the sliding time window corresponding to the first row of data according to the generation time of the first row of data; A control module, configured to determine at least one sliding time window corresponding to the first row of data according to the initial time of the sliding time window and the sliding time window configuration parameters; the sliding time window is used to generate a behavior safety baseline corresponding to the first row of data; The control module is further configured to: For any one of the sliding time windows, determine whether the sliding time window is an active window; If so, determine whether the second row of data is delayed behavior data relative to the sliding time window according to the generation time of the data in the second row currently input and the end time of the sliding time window; The control module is further configured to: If the sliding time window does not exist in the active window record information, register a first timer and determine the trigger time of the first timer, where the trigger time of the first timer is determined according to the end time of the sliding time window or the closing time of the sliding time window; and / or, If the trigger time of the first timer and the end time of the sliding time window meet the first condition, update the status of the sliding time window to the ready state; and / or, If the trigger time of the first timer and the end time of the sliding time window do not meet the first condition, and the trigger time of the first timer and the closing time of the sliding time window meet the second condition, update the status of the sliding time window to the closed state; and / or, If the trigger time of the first timer and the end time of the sliding time window do not meet the first condition, the trigger time of the first timer and the closing time of the sliding time window do not meet the second condition, and the trigger time of the first timer and the timeout time of the sliding time window meet the third condition, update the status of the sliding time window to the timeout state.

10. An electronic device, comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the control method of the sliding time window according to any one of claims 1 to 8.

11. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the control method of the sliding time window according to any one of claims 1 to 8.

12. A computer program product having executable instructions stored thereon, characterized in that, When the instruction is executed by the processor, it causes the processor to implement the control method of the sliding time window according to any one of claims 1 to 8.

Images