Internet behavior data monitoring method, device, equipment and storage medium

Abstract

The present invention relates to the field of data processing, and discloses an Internet behavior data monitoring method, device, equipment and storage medium, which are used to improve the accuracy of Internet behavior data monitoring. The method includes: obtaining page configuration data of a target web page, and determining page interaction data according to the page configuration data; parsing the page interaction data to obtain behavior indicator data, and extracting features from the behavior indicator data to obtain a feature behavior data set; inputting the feature behavior data set into a feature classification model to classify behavior features, and obtaining a behavior feature classification result; performing behavior anomaly detection on the behavior indicator data according to the behavior feature classification result to obtain anomaly detection results; determining anomaly indicator data according to the anomaly detection results, and searching for page anomaly statistical nodes according to the anomaly indicator data; generating behavior data monitoring results according to the page anomaly statistical nodes and page configuration data.

Description

Technical Field

[0001] The present invention relates to the field of data processing, and in particular to a method, device, equipment and storage medium for monitoring Internet behavior data. Background Art

[0002] In common Internet website service products, it is necessary to reasonably collect terminal (statistician) users' interactive behaviors on the website to continuously improve the website user interactive experience, such as collecting and analyzing users' visits to specific website pages, clicking on a certain function button on the website, etc. for further analysis and interpretation.

[0003] At present, Internet technology generally uses Javascript to record user interaction information when users interact. The recorded content generally includes: information about the page where the interaction occurs, the object of interaction, the time of interaction, etc., and sends this part of information to the website server for collection and aggregation at an appropriate time, and finally extracts and analyzes this part of data according to needs. However, the existing solutions have low accuracy in monitoring and analyzing Internet behavior data. Summary of the invention

[0004] The present invention provides an Internet behavior data monitoring method, device, equipment and storage medium, which are used to improve the accuracy of Internet behavior data monitoring.

[0005] A first aspect of the present invention provides an Internet behavior data monitoring method, which includes: obtaining page configuration data of a target web page, and determining page interaction data of a target user based on the page configuration data; parsing the page interaction data to obtain behavior indicator data of the target user, and performing feature extraction on the behavior indicator data to obtain a feature behavior data set; inputting the feature behavior data set into a preset feature classification model to perform behavior feature classification to obtain a behavior feature classification result; performing behavior anomaly detection on the behavior indicator data based on the behavior feature classification result to obtain an anomaly detection result; determining anomaly indicator data based on the anomaly detection result, and searching for a page anomaly statistical node corresponding to the target user based on the anomaly indicator data; and generating a behavior data monitoring result corresponding to the target user based on the page anomaly statistical node and the page configuration data.

[0006] Optionally, in a first implementation method of the first aspect of the present invention, the page interaction data is parsed to obtain behavior indicator data of the target user, and features are extracted from the behavior indicator data to obtain a characteristic behavior data set, including: performing configuration feature analysis on the page interaction data to obtain target configuration features; generating behavior indicator data of the target user based on the target configuration features and the page interaction data; removing noise from the behavior indicator data to obtain standard indicator data; and extracting features from the standard indicator data according to preset feature nodes to obtain a characteristic behavior data set.

[0007] Optionally, in a second implementation method of the first aspect of the present invention, the step of inputting the characteristic behavior data set into a preset feature classification model to perform behavior feature classification to obtain a behavior feature classification result includes: inputting the characteristic behavior data set into a preset feature classification model; clustering the characteristic behavior data set through the feature classification model to obtain a plurality of characteristic data clusters; obtaining cluster centers based on the plurality of characteristic data clusters, and generating a behavior feature classification result corresponding to the characteristic indicator data based on the cluster centers.

[0008] Optionally, in a third implementation method of the first aspect of the present invention, the behavior indicator data is subjected to behavior anomaly detection according to the behavior feature classification result to obtain an anomaly detection result, including: extracting a cluster center and multiple data points in the behavior feature classification result; respectively calculating distance parameters between the multiple data points and the cluster center to obtain a target distance parameter corresponding to each data point; generating a target mean according to the target distance parameter corresponding to each data point; determining whether the target distance parameter is greater than the target mean; if so, determining that the anomaly detection result is that the behavior indicator data is anomaly; if not, determining that the anomaly detection result is that the behavior indicator data is not anomaly.

[0009] Optionally, in a fourth implementation method of the first aspect of the present invention, determining the abnormal indicator data according to the abnormal detection result, and searching for the page abnormality statistical node corresponding to the target user according to the abnormal indicator data, includes: if the abnormal detection result is that the behavior indicator data is abnormal, searching for the abnormal data point corresponding to the target distance parameter; obtaining the indicator data corresponding to the abnormal data point to obtain the abnormal indicator data; matching the abnormal node corresponding to the target user according to the abnormal indicator data, and using the abnormal node as the page abnormality statistical node.

[0010] Optionally, in a fifth implementation method of the first aspect of the present invention, generating a behavior data monitoring result corresponding to the target user based on the page exception statistics node and the page configuration data includes: determining behavior exception information based on the page exception statistics node and the page configuration data; determining a monitoring exception type of the target user based on the page exception statistics node; and generating a behavior data monitoring result based on the behavior exception information and the monitoring exception type.

[0011] Optionally, in a sixth implementation manner of the first aspect of the present invention, the Internet behavior data monitoring method also includes: extracting suspected abnormal points and centroids corresponding to the behavior indicator data, and calculating a first distance from the suspected abnormal point to the centroid, and calculating the difference between the first distance and the distance mean; calculating a second distance from the data point of the suspected abnormal point to the centroid, and calculating a preset multiple value corresponding to the second distance to obtain a characteristic value; comparing the difference with the characteristic value, if the difference is greater than the characteristic value, determining that the behavior indicator data is abnormal, and outputting the abnormal data coordinates; and generating a page abnormality statistical node according to the abnormal data coordinates.

[0012] The second aspect of the present invention provides an Internet behavior data monitoring device, which includes: an acquisition module, which is used to acquire page configuration data of a target web page, and determine page interaction data of a target user based on the page configuration data; a parsing module, which is used to parse the page interaction data to obtain behavior indicator data of the target user, and perform feature extraction on the behavior indicator data to obtain a feature behavior data set; a classification module, which is used to input the feature behavior data set into a preset feature classification model to perform behavior feature classification to obtain a behavior feature classification result; a detection module, which is used to perform behavior anomaly detection on the behavior indicator data based on the behavior feature classification result to obtain an anomaly detection result; a search module, which is used to determine anomaly indicator data based on the anomaly detection result, and search for a page anomaly statistical node corresponding to the target user based on the anomaly indicator data; and a generation module, which is used to generate a behavior data monitoring result corresponding to the target user based on the page anomaly statistical node and the page configuration data.

[0013] Optionally, in a first implementation method of the second aspect of the present invention, the parsing module is specifically used to: perform configuration feature analysis on the page interaction data to obtain target configuration features; generate behavior indicator data of the target user based on the target configuration features and the page interaction data; remove noise from the behavior indicator data to obtain standard indicator data; perform feature extraction on the standard indicator data according to preset feature nodes to obtain a feature behavior data set.

[0014] Optionally, in a second implementation method of the second aspect of the present invention, the classification module is specifically used to: input the characteristic behavior data set into a preset feature classification model; cluster the characteristic behavior data set through the feature classification model to obtain multiple feature data clusters; obtain cluster centers based on the multiple feature data clusters, and generate behavior feature classification results corresponding to the feature indicator data based on the cluster centers.

[0015] Optionally, in a third implementation method of the second aspect of the present invention, the detection module is specifically used to: extract the cluster center and multiple data points in the behavior feature classification result; respectively calculate the distance parameters between the multiple data points and the cluster center to obtain the target distance parameter corresponding to each data point; generate a target mean according to the target distance parameter corresponding to each data point; determine whether the target distance parameter is greater than the target mean; if so, determine that the anomaly detection result is that the behavior indicator data is anomaly; if not, determine that the anomaly detection result is that the behavior indicator data is not anomaly.

[0016] Optionally, in a fourth implementation method of the second aspect of the present invention, the search module is specifically used to: if the abnormality detection result is that there is an abnormality in the behavior indicator data, search for the abnormal data point corresponding to the target distance parameter; obtain the indicator data corresponding to the abnormal data point to obtain the abnormal indicator data; match the abnormal node corresponding to the target user according to the abnormal indicator data, and use the abnormal node as the page abnormality statistical node.

[0017] Optionally, in a fifth implementation method of the second aspect of the present invention, the generation module is specifically used to: determine behavior abnormality information based on the page abnormality statistical node and the page configuration data; determine the monitoring abnormality type of the target user based on the page abnormality statistical node; and generate behavior data monitoring results based on the behavior abnormality information and the monitoring abnormality type.

[0018] Optionally, in a sixth implementation method of the second aspect of the present invention, the Internet behavior data monitoring device also includes: a processing module, used to extract suspected abnormal points and centroids corresponding to the behavior indicator data, and calculate a first distance from the suspected abnormal point to the centroid, and calculate the difference between the first distance and the distance mean; calculate the second distance from the data point of the suspected abnormal point to the centroid, and calculate a preset multiple value corresponding to the second distance to obtain a characteristic value; compare the difference with the characteristic value, if the difference is greater than the characteristic value, determine that the behavior indicator data is abnormal, and output the abnormal data coordinates; generate a page abnormality statistical node according to the abnormal data coordinates.

[0019] The third aspect of the present invention provides an Internet behavior data monitoring device, comprising: a memory and at least one processor, wherein the memory stores instructions; the at least one processor calls the instructions in the memory so that the Internet behavior data monitoring device executes the above-mentioned Internet behavior data monitoring method.

[0020] A fourth aspect of the present invention provides a computer-readable storage medium, in which instructions are stored, which, when executed on a computer, enable the computer to execute the above-mentioned Internet behavior data monitoring method.

[0021] In the technical solution provided by the present invention, the page configuration data of the target web page is obtained, and the page interaction data is determined according to the page configuration data; the page interaction data is parsed to obtain behavior indicator data, and features are extracted from the behavior indicator data to obtain a feature behavior data set; the feature behavior data set is input into a feature classification model to classify behavior features to obtain a behavior feature classification result; behavior anomaly detection is performed on the behavior indicator data according to the behavior feature classification result to obtain an anomaly detection result; anomaly indicator data is determined according to the anomaly detection result, and page anomaly statistical nodes are searched according to the anomaly indicator data; behavior data monitoring results are generated according to the page anomaly statistical nodes and page configuration data. The present invention realizes autonomy through a behavior statistics management process, reduces the later investment of roles such as technical personnel, shortens the behavior statistics configuration process, improves R&D efficiency, reduces R&D costs, realizes direct use of published websites to present behavior statistics result data, reduces the threshold for business personnel to understand and use behavior data, and thus improves the accuracy of Internet behavior data monitoring. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] Figure 1 A schematic diagram of an embodiment of a method for monitoring Internet behavior data in an embodiment of the present invention;

[0023] Figure 2 A schematic diagram of another embodiment of the method for monitoring Internet behavior data in an embodiment of the present invention;

[0024] Figure 3 A schematic diagram of an embodiment of an Internet behavior data monitoring device in an embodiment of the present invention;

[0025] Figure 4 It is a schematic diagram of another embodiment of the Internet behavior data monitoring device in an embodiment of the present invention;

[0026] Figure 5 Schematic diagram of an embodiment of an Internet behavior data monitoring device in an embodiment of the present invention. DETAILED DESCRIPTION

[0027] Embodiments of the present invention provide an Internet behavior data monitoring method, device, equipment and storage medium for improving the accuracy of Internet behavior data monitoring. The terms "first", "second", "third", "fourth", etc. (if any) in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments described herein can be implemented in an order other than that illustrated or described herein. In addition, the terms "including" or "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0028] For ease of understanding, the specific process of the embodiment of the present invention is described below. Figure 1 , an embodiment of the Internet behavior data monitoring method in an embodiment of the present invention includes:

[0029] 101. Obtain page configuration data of a target webpage, and determine page interaction data of a target user according to the page configuration data;

[0030] It is understandable that the execution subject of the present invention may be an Internet behavior data monitoring device, or a terminal or a server, which is not limited here. The embodiment of the present invention is described by taking a server as the execution subject as an example.

[0031] Specifically, the page configuration data of the target web page is obtained, and the page configuration data is verified according to the preset configuration data, and the page configuration data is sent to the matching terminal, so that the matching terminal determines the page interaction data of the target user according to the page configuration data, obtains the page interaction data of the matching terminal, and collects the target page display data according to the preset page display data corresponding to the page interaction data, and determines the page interaction data of the target user, which helps to quickly and accurately determine the page interaction data and improves the efficiency of page interaction data analysis.

[0032] 102. Analyze the page interaction data to obtain the behavior indicator data of the target user, and extract features from the behavior indicator data to obtain a feature behavior data set;

[0033] Specifically, the server parses the page interaction data according to the data parsing rules to obtain initial data. If there is a difference between the initial data and the stored historical data, the variable data is preprocessed to obtain a preprocessing result. Based on the preprocessing result, the page interaction data is independently parsed through the model layer to obtain the behavior indicator data of the target user, and features are extracted from the behavior indicator data to obtain a feature behavior data set, thereby achieving complete decoupling of data and interactive pages and improving the reuse rate of the parsing design.

[0034] 103. Input the characteristic behavior data set into a preset characteristic classification model to classify the behavior characteristics, and obtain the behavior characteristic classification result;

[0035] Specifically, based on the association relationship between users within each characteristic behavior data set in the classified characteristic behavior data sets and the unclassified characteristic behavior data sets, and the group characteristics of each characteristic behavior data set, the group vector of each characteristic behavior data set and the first probability of determining each unclassified characteristic behavior data set as a characteristic behavior data set of a predetermined type are determined, and the first probability of determining each classified characteristic behavior data set as a characteristic behavior data set of the predetermined type is set to a fixed value, based on the association relationship between users between each characteristic behavior data set in the classified characteristic behavior data sets and the unclassified characteristic behavior data sets, the determined group vector of each characteristic behavior data set, and the first probability of determining each characteristic behavior data set as a characteristic behavior data set of the predetermined type, the second probability of determining each unclassified characteristic behavior data set as a characteristic behavior data set of the predetermined type is determined, and according to the second probability of the unclassified characteristic behavior data set, a behavior feature classification result is obtained.

[0036] 104. Performing behavior anomaly detection on the behavior indicator data according to the behavior feature classification result to obtain anomaly detection results;

[0037] Specifically, the indicator data in the current environment is first obtained through the anomaly detection model in the server, and then the indicator data is analyzed and processed to determine whether there is abnormal behavior in the current environment. When the analysis result obtained is that abnormal behavior exists, an anomaly detection result is generated, and at the same time, the server sends the abnormal behavior signal and / or the indicator data when the abnormal behavior occurs to the client, so that the client can take corresponding measures according to the abnormal behavior signal and / or indicator data. It can be seen that based on the real-time collection of indicator data by the server, and the real-time analysis of the collected indicator data, the abnormal behavior signal and / or the indicator data when the abnormal behavior occurs are sent to the client when and only when there is abnormal behavior. There is no need to send the abnormal behavior signal and / or indicator data to the client in real time, which can effectively save network resources.

[0038] 105. Determine abnormal index data according to the abnormal detection result, and search for the page abnormality statistics node corresponding to the target user according to the abnormal index data;

[0039] Specifically, the pending statistical value of the abnormal indicator is read at a first moment, and the target statistical value of the abnormal indicator is read at a second moment. The time difference between the second moment and the first moment is an integer multiple of the abnormal indicator data update period. The pending statistical value and the target statistical value are the numerical values ​​of the data statistics. The packet capture tool is used to count the actual value corresponding to the abnormal indicator in the time period from the third moment to the fourth moment, wherein the time difference between the fourth moment and the third moment is equal to the time difference between the second moment and the first moment. The actual value corresponding to the abnormal indicator is compared with the difference between the pending statistical value and the target statistical value of the data statistics, and the page abnormality statistical node corresponding to the target user is searched according to the abnormal indicator data.

[0040] 106. Generate behavior data monitoring results corresponding to the target user based on the page exception statistics node and the page configuration data.

[0041] Specifically, the server obtains a behavior data monitoring list of page abnormality statistical nodes whose statistical duration exceeds a preset duration, and extracts the big data behavior features of the behavior data monitoring list, and then tracks and identifies each statistical behavior node in the big data behavior features to obtain a tracking and identification result, and then generates a page configuration data behavior monitoring result corresponding to the patient user of the page abnormality statistical node based on the tracking and identification result, and pushes the page configuration data behavior monitoring result to the terminal corresponding to the page abnormality statistical node for monitoring information prompts, and generates a behavior data monitoring result corresponding to the target user.

[0042] In an embodiment of the present invention, page configuration data of a target web page is obtained, and page interaction data is determined based on the page configuration data; the page interaction data is parsed to obtain behavior indicator data, and features are extracted from the behavior indicator data to obtain a feature behavior data set; the feature behavior data set is input into a feature classification model to classify behavior features to obtain a behavior feature classification result; behavior anomaly detection is performed on the behavior indicator data based on the behavior feature classification result to obtain an anomaly detection result; anomaly indicator data is determined based on the anomaly detection result, and page anomaly statistical nodes are searched based on the anomaly indicator data; behavior data monitoring results are generated based on the page anomaly statistical nodes and page configuration data. The present invention achieves autonomy through a behavior statistics management process, reduces the later investment of roles such as technical personnel, shortens the behavior statistics configuration process, improves R&D efficiency, reduces R&D costs, and realizes direct use of published websites to present behavior statistics result data, reduces the threshold for business personnel to understand and use behavior data, and thereby improves the accuracy of Internet behavior data monitoring.

[0043] See also Figure 2Another embodiment of the Internet behavior data monitoring method in the embodiment of the present invention includes:

[0044] 201. Obtain page configuration data of a target webpage, and determine page interaction data of a target user according to the page configuration data;

[0045] 202. Analyze the page interaction data to obtain behavior indicator data of the target user, and extract features from the behavior indicator data to obtain a feature behavior data set;

[0046] Specifically, the configuration feature analysis is performed on the page interaction data to obtain the target configuration feature; the behavior indicator data of the target user is generated based on the target configuration feature and the page interaction data; the noise is removed from the behavior indicator data to obtain the standard indicator data; the feature extraction is performed on the standard indicator data according to the preset feature nodes to obtain the feature behavior data set.

[0047] Among them, first obtain the page interaction data of different verification time periods, and then generate the current verification result based on the page interaction data. It can be determined whether the behavior security index of the server meets the set conditions through the current verification result. By performing multiple analysis and processing on the page interaction data recognized by the server, it can effectively filter the identification data that may interfere with the verification, and can generate the current verification result in real time and accurately according to the optimized page interaction data, generate the behavior indicator data of the target user, remove the noise of the behavior indicator data, obtain the standard indicator data, extract the features of the standard indicator data according to the preset feature nodes, and obtain the feature behavior data set, which effectively reduces the impact of the external environment on the current verification result. Among them, when removing noise, the server analyzes the behavior indicator data to extract the frequency value of the harmonic noise interference contained therein, resamples the behavior indicator data with a sampling frequency that is a positive integer multiple of the fundamental frequency of the harmonic noise interference, and uses the ratio of the fundamental frequency to the sampling frequency to downsample the high-frequency components of the resampled behavior indicator data in the time domain, so that the harmonic noise interference components contained in each downsampled sub-band are constant values, and the baseline shift method is used to remove the harmonic noise interference, which can improve the accuracy of data processing.

[0048] 203. Inputting the characteristic behavior data set into a preset characteristic classification model;

[0049] 204. Clustering the feature behavior data set through a feature classification model to obtain multiple feature data clusters;

[0050] 205. Obtain a cluster center according to the multiple feature data clusters, and generate a behavior feature classification result corresponding to the feature indicator data according to the cluster center;

[0051] Specifically, the server inputs the characteristic behavior data set into a preset characteristic classification model, and clusters the characteristic behavior data set through the characteristic classification model, wherein the server compares and judges n clustering information sets, performs dynamic clustering processing on clusters with obvious structural changes within a time period, obtains multiple characteristic data clusters, obtains cluster centers based on the multiple characteristic data clusters, and generates behavioral characteristic classification results corresponding to the characteristic indicator data based on the cluster centers, wherein it should be noted that when the present application generates characteristic classification results based on cluster centers, the server obtains cluster centers based on multiple characteristic data clusters, calculates the density of all data objects in the data set, and calculates the average density of the data set based on the density of the obtained data objects, calculates the minimum density distance value of each data object in the data set, sorts the minimum density distance values ​​of the data objects in the data set in descending order, and selects the data objects corresponding to the first K minimum density distance values ​​and having a density greater than the average density as the initial cluster centers according to the determined number of clusters K, and uses the K-means clustering method to cluster the data set according to the initial cluster centers obtained above until the clustering results are output, thereby reducing computational complexity, improving classification accuracy, having high stability, and improving rapid convergence.

[0052] 206. Performing behavior anomaly detection on the behavior indicator data according to the behavior feature classification result to obtain anomaly detection results;

[0053] Specifically, extract the cluster center and multiple data points in the behavior feature classification result; calculate the distance parameters of the multiple data points and the cluster center respectively to obtain the target distance parameter corresponding to each data point; generate the target mean according to the target distance parameter corresponding to each data point; determine whether the target distance parameter is greater than the target mean; if so, determine that the anomaly detection result is that the behavior indicator data has anomalies; if not, determine that the anomaly detection result is that the behavior indicator data does not have anomalies.

[0054] Among them, the Euclidean distance between any two points in the cluster center is solved, the average distance from each point to other points is calculated, the first cluster initial center is determined, the dense cluster center set is determined, and the next cluster initial point is determined until all the required number of initial cluster points are selected. The fuzzy clustering method based on the minimum distance maximization criterion to optimize the initial center according to the present invention can consider the spatial distribution characteristics of the object compared to the standard FCM method, and has better clustering effect and robustness, and has higher efficiency. Among them, the target distance parameters corresponding to the data points of M categories are obtained, the target distance parameters corresponding to each data point are extracted, the iMMFA model is constructed, and the iMMFA model is set The initial value of each parameter is obtained according to the Gibbs sampling rule. After a warm-up process of I0 iterations, the sampling values ​​of each parameter of T0 times are saved respectively to determine the final FA model, the final TSB-DPM model and the final LVSVM classifier, thereby forming the final iMMFA model, obtaining the data point target distance parameter of the test target, performing feature extraction on the data point target distance parameter of the test target, determining the target type to which the test target belongs according to the clustering label of the test latent variable, and judging whether the target distance parameter is greater than the target mean; if so, determining that the anomaly detection result is that the behavior indicator data has anomalies; if not, determining that the anomaly detection result is that the behavior indicator data does not have anomalies.

[0055] 207. Determine abnormal index data according to the abnormal detection result, and search for a page abnormality statistics node corresponding to the target user according to the abnormal index data;

[0056] Specifically, if the anomaly detection result is that the behavior indicator data is abnormal, then find the abnormal data point corresponding to the target distance parameter; obtain the indicator data corresponding to the abnormal data point to obtain the abnormal indicator data; match the abnormal node corresponding to the target user according to the abnormal indicator data, and use the abnormal node as the page abnormality statistics node.

[0057] Optionally, by obtaining the original time series data and the position of the abnormal data point, the average of the nearest k non-abnormal data points is used to initialize the abnormal data point, i.e., preliminarily repair it, and similar subsequence data are clustered into the same cluster. Similar repaired subsequence data are found, and the similar subsequence data in the time series data is used as a kind of global information. Finally, the weighted cumulative value of the average provided by multiple similar subsequence data is used as the value of the repaired abnormal data point, and the abnormal node corresponding to the target user is matched according to the abnormal indicator data, and the abnormal node is used as the page abnormality statistical node.

[0058] 208. Generate behavior data monitoring results corresponding to the target user according to the page abnormality statistics node and the page configuration data.

[0059] Specifically, the behavior abnormality information is determined according to the page abnormality statistical node and the page configuration data; the monitoring abnormality type of the target user is determined according to the page abnormality statistical node; and the behavior data monitoring result is generated according to the behavior abnormality information and the monitoring abnormality type.

[0060] Among them, the server compares the page configuration data of the application with multiple alarm thresholds, determines the abnormal monitoring data in the page configuration data according to the comparison results, obtains the abnormal monitoring type corresponding to the abnormal monitoring data, aggregates the abnormal monitoring type and the abnormal monitoring data, generates the current abnormal monitoring report of the application, and generates the behavior data monitoring results according to the behavior abnormality information and the monitoring abnormality type.

[0061] Optionally, extract the suspected abnormal points and centroids corresponding to the behavior indicator data, and calculate the first distance from the suspected abnormal point to the centroid, and calculate the difference between the first distance and the distance mean; calculate the second distance from the data point of the suspected abnormal point to the centroid, and calculate the preset multiple value corresponding to the second distance to obtain the eigenvalue; compare the difference and the eigenvalue, if the difference is greater than the eigenvalue, determine that the behavior indicator data is abnormal, and output the abnormal data coordinates; generate a page abnormality statistics node according to the abnormal data coordinates.

[0062] Among them, classify and regress each suspected abnormal point and each centroid, output each suspected abnormal point rectangular frame and each centroid rectangular frame, set the number of suspected abnormal points to be clustered to k, the cluster center is the centroid of each suspected abnormal point rectangular frame, the data point to be clustered is the centroid of each centroid, arrange each suspected abnormal point in ascending order according to the area of ​​its rectangular frame, calculate the mass of each suspected abnormal point cluster center in sequence, and calculate the mass of each data point to be clustered; calculate the gravitational force between each data point to be clustered and each cluster center for initial clustering to obtain k initial clusters, perform abnormal point detection on each centroid in the k initial clusters, re-cluster the abnormal points, calculate the difference corresponding to the first distance and the distance mean, calculate the second distance from the data point of the suspected abnormal point to the centroid, and calculate the preset multiple value corresponding to the second distance to obtain the eigenvalue, compare the difference and the eigenvalue, if the difference is greater than the eigenvalue, it is determined that the behavior indicator data is abnormal, and the abnormal data coordinates are output; generate a page abnormality statistics node according to the abnormal data coordinates.

[0063] In an embodiment of the present invention, page configuration data of a target web page is obtained, and page interaction data is determined based on the page configuration data; the page interaction data is parsed to obtain behavior indicator data, and features are extracted from the behavior indicator data to obtain a feature behavior data set; the feature behavior data set is input into a feature classification model to classify behavior features to obtain a behavior feature classification result; behavior anomaly detection is performed on the behavior indicator data based on the behavior feature classification result to obtain an anomaly detection result; anomaly indicator data is determined based on the anomaly detection result, and page anomaly statistical nodes are searched based on the anomaly indicator data; behavior data monitoring results are generated based on the page anomaly statistical nodes and page configuration data. The present invention achieves autonomy through a behavior statistics management process, reduces the later investment of roles such as technical personnel, shortens the behavior statistics configuration process, improves R&D efficiency, reduces R&D costs, and realizes direct use of published websites to present behavior statistics result data, reduces the threshold for business personnel to understand and use behavior data, and thereby improves the accuracy of Internet behavior data monitoring.

[0064] The above describes the Internet behavior data monitoring method in the embodiment of the present invention. The following describes the Internet behavior data monitoring device in the embodiment of the present invention. Figure 3 , an embodiment of the Internet behavior data monitoring device in the embodiment of the present invention includes:

[0065] The acquisition module 301 is used to acquire page configuration data of a target webpage and determine page interaction data of a target user according to the page configuration data;

[0066] The parsing module 302 is used to parse the page interaction data to obtain the behavior indicator data of the target user, and perform feature extraction on the behavior indicator data to obtain a feature behavior data set;

[0067] A classification module 303 is used to input the characteristic behavior data set into a preset characteristic classification model to classify the behavior characteristics and obtain a behavior characteristic classification result;

[0068] A detection module 304 is used to perform behavior anomaly detection on the behavior indicator data according to the behavior feature classification result to obtain an anomaly detection result;

[0069] A search module 305 is used to determine abnormal index data according to the abnormal detection result, and search for a page abnormality statistical node corresponding to the target user according to the abnormal index data;

[0070] The generating module 306 is used to generate the behavior data monitoring result corresponding to the target user according to the page abnormality statistical node and the page configuration data.

[0071] In an embodiment of the present invention, page configuration data of a target web page is obtained, and page interaction data is determined based on the page configuration data; the page interaction data is parsed to obtain behavior indicator data, and features are extracted from the behavior indicator data to obtain a feature behavior data set; the feature behavior data set is input into a feature classification model to classify behavior features to obtain a behavior feature classification result; behavior anomaly detection is performed on the behavior indicator data based on the behavior feature classification result to obtain an anomaly detection result; anomaly indicator data is determined based on the anomaly detection result, and page anomaly statistical nodes are searched based on the anomaly indicator data; behavior data monitoring results are generated based on the page anomaly statistical nodes and page configuration data. The present invention achieves autonomy through a behavior statistics management process, reduces the later investment of roles such as technical personnel, shortens the behavior statistics configuration process, improves R&D efficiency, reduces R&D costs, and realizes direct use of published websites to present behavior statistics result data, reduces the threshold for business personnel to understand and use behavior data, and thereby improves the accuracy of Internet behavior data monitoring.

[0072] See also Figure 4 Another embodiment of the Internet behavior data monitoring device in the embodiment of the present invention includes:

[0073] The acquisition module 301 is used to acquire page configuration data of a target webpage and determine page interaction data of a target user according to the page configuration data;

[0074] The parsing module 302 is used to parse the page interaction data to obtain the behavior indicator data of the target user, and perform feature extraction on the behavior indicator data to obtain a feature behavior data set;

[0075] A classification module 303 is used to input the characteristic behavior data set into a preset characteristic classification model to classify the behavior characteristics and obtain a behavior characteristic classification result;

[0076] A detection module 304 is used to perform behavior anomaly detection on the behavior indicator data according to the behavior feature classification result to obtain an anomaly detection result;

[0077] A search module 305 is used to determine abnormal index data according to the abnormal detection result, and search for a page abnormality statistical node corresponding to the target user according to the abnormal index data;

[0078] The generating module 306 is used to generate the behavior data monitoring result corresponding to the target user according to the page abnormality statistical node and the page configuration data.

[0079] Optionally, the parsing module 302 is specifically used for:

[0080] Perform configuration feature analysis on the page interaction data to obtain target configuration features; generate behavior indicator data of the target user based on the target configuration features and the page interaction data; remove noise from the behavior indicator data to obtain standard indicator data; perform feature extraction on the standard indicator data according to preset feature nodes to obtain a feature behavior data set.

[0081] Optionally, the classification module 303 is specifically used for:

[0082] The characteristic behavior data set is input into a preset characteristic classification model; the characteristic behavior data set is clustered by the characteristic classification model to obtain a plurality of characteristic data clusters; a cluster center is obtained according to the plurality of characteristic data clusters, and a behavior characteristic classification result corresponding to the characteristic indicator data is generated according to the cluster center.

[0083] Optionally, the detection module 304 is specifically used for:

[0084] Extract the cluster center and multiple data points in the behavior feature classification result; calculate the distance parameters of the multiple data points and the cluster center respectively to obtain the target distance parameter corresponding to each data point; generate a target mean according to the target distance parameter corresponding to each data point; determine whether the target distance parameter is greater than the target mean; if so, determine that the anomaly detection result is that the behavior indicator data is anomaly; if not, determine that the anomaly detection result is that the behavior indicator data is not anomaly.

[0085] Optionally, the search module 305 is specifically used for:

[0086] If the anomaly detection result is that the behavior indicator data is abnormal, then find the abnormal data point corresponding to the target distance parameter; obtain the indicator data corresponding to the abnormal data point to obtain the abnormal indicator data; match the abnormal node corresponding to the target user according to the abnormal indicator data, and use the abnormal node as the page abnormality statistics node.

[0087] Optionally, the generating module 306 is specifically used for:

[0088] Determine behavior abnormality information according to the page abnormality statistical node and the page configuration data; determine the monitoring abnormality type of the target user according to the page abnormality statistical node; and generate behavior data monitoring results according to the behavior abnormality information and the monitoring abnormality type.

[0089] Optionally, the Internet behavior data monitoring device further includes:

[0090] Processing module 307 is used to extract the suspected abnormal point and the centroid corresponding to the behavior indicator data, and calculate the first distance from the suspected abnormal point to the centroid, and calculate the difference between the first distance and the distance mean; calculate the second distance from the data point of the suspected abnormal point to the centroid, and calculate the preset multiple value corresponding to the second distance to obtain the characteristic value; compare the difference with the characteristic value, if the difference is greater than the characteristic value, determine that the behavior indicator data is abnormal, and output the abnormal data coordinates; generate a page abnormality statistics node according to the abnormal data coordinates.

[0091] In an embodiment of the present invention, page configuration data of a target web page is obtained, and page interaction data is determined based on the page configuration data; the page interaction data is parsed to obtain behavior indicator data, and features are extracted from the behavior indicator data to obtain a feature behavior data set; the feature behavior data set is input into a feature classification model to classify behavior features to obtain a behavior feature classification result; behavior anomaly detection is performed on the behavior indicator data based on the behavior feature classification result to obtain an anomaly detection result; anomaly indicator data is determined based on the anomaly detection result, and page anomaly statistical nodes are searched based on the anomaly indicator data; behavior data monitoring results are generated based on the page anomaly statistical nodes and page configuration data. The present invention achieves autonomy through a behavior statistics management process, reduces the later investment of roles such as technical personnel, shortens the behavior statistics configuration process, improves R&D efficiency, reduces R&D costs, and realizes direct use of published websites to present behavior statistics result data, reduces the threshold for business personnel to understand and use behavior data, and thereby improves the accuracy of Internet behavior data monitoring.

[0092] above Figure 3 and Figure 4 The Internet behavior data monitoring device in the embodiment of the present invention is described in detail from the perspective of modular functional entities, and the Internet behavior data monitoring device in the embodiment of the present invention is described in detail from the perspective of hardware processing.

[0093] Figure 5: is a structural diagram of an Internet behavior data monitoring device provided by an embodiment of the present invention. The Internet behavior data monitoring device 500 may have relatively large differences due to different configurations or performances, and may include one or more processors (central processing units, CPU) 510 (for example, one or more processors) and a memory 520, and one or more storage media 530 (for example, one or more mass storage devices) storing application programs 533 or data 532. Among them, the memory 520 and the storage medium 530 can be short-term storage or permanent storage. The program stored in the storage medium 530 may include one or more modules (not shown in the figure), and each module may include a series of instruction operations in the Internet behavior data monitoring device 500. Furthermore, the processor 510 can be configured to communicate with the storage medium 530 to execute a series of instruction operations in the storage medium 530 on the Internet behavior data monitoring device 500.

[0094] The Internet behavior data monitoring device 500 may also include one or more power supplies 540, one or more wired or wireless network interfaces 550, one or more input and output interfaces 560, and / or one or more operating systems 531, such as Windows Serve, Mac OS X, Unix, Linux, FreeBSD, etc. It will be appreciated by those skilled in the art that Figure 5 The illustrated structure of the Internet behavior data monitoring device does not constitute a limitation on the Internet behavior data monitoring device, and may include more or fewer components than illustrated, or a combination of certain components, or a different arrangement of components.

[0095] The present invention also provides an Internet behavior data monitoring device, which includes a memory and a processor, wherein the memory stores computer-readable instructions, and when the computer-readable instructions are executed by the processor, the processor executes the steps of the Internet behavior data monitoring method in the above-mentioned embodiments.

[0096] The present invention also provides a computer-readable storage medium, which may be a non-volatile computer-readable storage medium or a volatile computer-readable storage medium. Instructions are stored in the computer-readable storage medium. When the instructions are executed on a computer, the computer executes the steps of the Internet behavior data monitoring method.

[0097] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0098] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention is essentially or the part that contributes to the prior art or the whole or part of the technical solution can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions to enable a computer device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM), random access memory (RAM), disk or optical disk and other media that can store program code.

[0099] As described above, the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit the same. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that the technical solutions described in the aforementioned embodiments may still be modified, or some of the technical features thereof may be replaced by equivalents. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for monitoring Internet behavior data, characterized in that: The Internet behavior data monitoring method comprises: Acquire page configuration data of a target webpage, and determine page interaction data of a target user according to the page configuration data; Parsing the page interaction data to obtain the behavior indicator data of the target user, and extracting features from the behavior indicator data to obtain a characteristic behavior data set; specifically comprising: performing configuration feature analysis on the page interaction data to obtain target configuration features; generating the behavior indicator data of the target user based on the target configuration features and the page interaction data; removing noise from the behavior indicator data to obtain standard indicator data; extracting features from the standard indicator data according to preset feature nodes to obtain a characteristic behavior data set; Inputting the characteristic behavior data set into a preset characteristic classification model to classify the behavior characteristics and obtain the behavior characteristic classification result; specifically comprising: inputting the characteristic behavior data set into a preset characteristic classification model; clustering the characteristic behavior data set through the characteristic classification model to obtain a plurality of characteristic data clusters; obtaining cluster centers according to the plurality of characteristic data clusters, and generating the behavior characteristic classification result corresponding to the characteristic behavior data set according to the cluster centers; According to the behavior feature classification result, the behavior indicator data is subjected to behavior anomaly detection to obtain an anomaly detection result; specifically comprising: extracting the cluster center and multiple data points in the behavior feature classification result; respectively calculating the distance parameters between the multiple data points and the cluster center to obtain the target distance parameter corresponding to each data point; generating a target mean value according to the target distance parameter corresponding to each data point; judging whether the target distance parameter is greater than the target mean value; if so, determining that the anomaly detection result is that the behavior indicator data has an anomaly; if not, determining that the anomaly detection result is that the behavior indicator data does not have an anomaly; determining the anomaly indicator data according to the anomaly detection result, and searching for the page anomaly statistical node corresponding to the target user according to the anomaly indicator data; specifically, by obtaining the original time series data and the position of the anomaly data point, the anomaly data point is initialized using the mean of the nearest k non-abnormal data points, similar subsequence data are clustered into the same cluster, similar repaired subsequence data are searched, and similar subsequence data in the time series data is used as a global information, and finally The weighted cumulative value of the mean of multiple similar subsequence data is used as the value of the repaired abnormal data point, the abnormal node corresponding to the target user is matched according to the abnormal indicator data, and the abnormal node is used as the page abnormality statistical node; wherein, if the abnormal detection result is that the behavior indicator data is abnormal, the abnormal data point corresponding to the target distance parameter is searched; the indicator data corresponding to the abnormal data point is obtained to obtain the abnormal indicator data; the abnormal node corresponding to the target user is matched according to the abnormal indicator data, and the abnormal node is used as the page abnormality statistical node; specifically, the suspected abnormal point and the centroid corresponding to the behavior indicator data are extracted, and the first distance from the suspected abnormal point to the centroid is calculated, and the difference between the first distance and the distance mean is calculated; the second distance from the data point of the suspected abnormal point to the centroid is calculated, and the preset multiple value corresponding to the second distance is calculated to obtain the characteristic value; the difference is compared with the characteristic value, and if the difference is greater than the characteristic value, the behavior indicator data is determined to be abnormal, and the abnormal data coordinates are output; the page abnormality statistical node is generated according to the abnormal data coordinates; Generate the behavior data monitoring result corresponding to the target user according to the page exception statistical node and the page configuration data; specifically include: determine the behavior exception information according to the page exception statistical node and the page configuration data; determine the monitoring exception type of the target user according to the page exception statistical node; generate the behavior data monitoring result according to the behavior exception information and the monitoring exception type.

2. An Internet behavior data monitoring device, characterized in that: The Internet behavior data monitoring device comprises: An acquisition module, used to acquire page configuration data of a target web page, and determine page interaction data of a target user according to the page configuration data; A parsing module is used to parse the page interaction data to obtain the behavior indicator data of the target user, and perform feature extraction on the behavior indicator data to obtain a feature behavior data set; specifically comprising: performing configuration feature analysis on the page interaction data to obtain target configuration features; generating the behavior indicator data of the target user based on the target configuration features and the page interaction data; performing noise removal on the behavior indicator data to obtain standard indicator data; performing feature extraction on the standard indicator data according to preset feature nodes to obtain a feature behavior data set; A classification module is used to input the characteristic behavior data set into a preset characteristic classification model to classify the behavior characteristics and obtain the behavior characteristic classification result; specifically comprising: inputting the characteristic behavior data set into a preset characteristic classification model; clustering the characteristic behavior data set through the characteristic classification model to obtain a plurality of characteristic data clusters; obtaining a clustering center according to the plurality of characteristic data clusters, and generating a behavior characteristic classification result corresponding to the characteristic behavior data set according to the clustering center; A detection module is used to perform behavioral anomaly detection on the behavioral indicator data according to the behavioral feature classification result to obtain an anomaly detection result; specifically comprising: extracting a cluster center and multiple data points in the behavioral feature classification result; respectively calculating distance parameters between the multiple data points and the cluster center to obtain a target distance parameter corresponding to each data point; generating a target mean according to the target distance parameter corresponding to each data point; judging whether the target distance parameter is greater than the target mean; if so, determining that the anomaly detection result is that the behavioral indicator data is anomaly; if not, determining that the anomaly detection result is that the behavioral indicator data is not anomaly; A search module is used to determine the abnormal indicator data according to the abnormal detection result, and to search for the page abnormal statistical node corresponding to the target user according to the abnormal indicator data; specifically, by obtaining the original time series data and the abnormal data point position, the average of the nearest k non-abnormal data points is used to initialize the abnormal data point, and similar subsequence data are clustered into the same cluster, and similar repaired subsequence data are searched. The similar subsequence data in the time series data is used as a global information, and finally the weighted cumulative value of the average of multiple similar subsequence data is used as the value of the repaired abnormal data point, and the abnormal node corresponding to the target user is matched according to the abnormal indicator data, and the abnormal node is used as the page abnormal statistical node; wherein, if the abnormal detection result is that the behavior indicator data is abnormal, then the search module is used to find the abnormal node corresponding to the target user according to the abnormal indicator data, and the abnormal node is used as the page abnormal statistical node; wherein, if the abnormal detection result is that the behavior indicator data is abnormal, then the search module is used to find the abnormal node corresponding to the target user according to the abnormal indicator data, and the abnormal node is used as the page abnormal statistical node. Find the abnormal data point corresponding to the target distance parameter; obtain the indicator data corresponding to the abnormal data point to obtain the abnormal indicator data; match the abnormal node corresponding to the target user according to the abnormal indicator data, and use the abnormal node as the page abnormal statistical node; specifically, extract the suspected abnormal point and the centroid corresponding to the behavior indicator data, and calculate the first distance from the suspected abnormal point to the centroid, and calculate the difference between the first distance and the distance mean; calculate the second distance from the data point of the suspected abnormal point to the centroid, and calculate the preset multiple value corresponding to the second distance to obtain the characteristic value; compare the difference with the characteristic value, if the difference is greater than the characteristic value, determine that the behavior indicator data is abnormal, and output the abnormal data coordinates; generate the page abnormal statistical node according to the abnormal data coordinates; A generation module is used to generate a behavior data monitoring result corresponding to the target user according to the page exception statistical node and the page configuration data; specifically includes: determining behavior exception information according to the page exception statistical node and the page configuration data; determining the monitoring exception type of the target user according to the page exception statistical node; generating a behavior data monitoring result according to the behavior exception information and the monitoring exception type.

3. An Internet behavior data monitoring device, characterized in that: The Internet behavior data monitoring device comprises: a memory and at least one processor, wherein instructions are stored in the memory; The at least one processor calls the instructions in the memory so that the Internet behavior data monitoring device executes the Internet behavior data monitoring method as described in claim 1.

4. A computer-readable storage medium having instructions stored thereon, characterized in that: When the instructions are executed by the processor, the Internet behavior data monitoring method as described in claim 1 is implemented.

Images