System detection method and apparatus

Abstract

The embodiment of the present specification provides a system detection method and device, wherein the system detection method comprises: determining a historical user behavior sequence associated with a target system and a reference user behavior sequence corresponding to the historical user behavior sequence; comparing the historical user behavior sequence and the reference user behavior sequence, and determining behavior sequence distribution information corresponding to the historical user behavior sequence according to a comparison result; performing abnormal detection on a to-be-detected user behavior sequence associated with the target system based on the behavior sequence distribution information and the reference user behavior sequence; and determining running state information of the target system according to an abnormal detection result. The real-time to-be-detected user behavior is detected according to the behavior sequence distribution information and the reference user behavior sequence, so as to determine the running state information of the target system. By judging whether the user behavior sequence is blocked, the abnormal detection of the system with complex operation is completed, the missed detection and misjudgment are reduced, and the detection accuracy is improved.

Description

Technical Field

[0001] This specification relates to the field of data analysis technology, and in particular to system detection methods. One or more embodiments of this specification also relate to system detection apparatus, a computing device, and a computer-readable storage medium. Background Technology

[0002] With the rapid development of internet technology, more and more users are engaging in various social activities online, such as online chatting, online gaming, advertising, and investing in internet finance platforms. To ensure normal internet access and improve user experience, project teams constantly monitor the stability of their systems to minimize the risk of poor user experience due to platform malfunctions or vulnerabilities. Currently, project teams typically collect a large amount of front-end event tracking data to detect system anomalies. However, when event tracking is missed or thresholds are set improperly, it can still lead to the inability to proactively detect system anomalies. Therefore, accurately and promptly identifying system anomalies and vulnerabilities to improve user experience is a pressing issue that needs to be addressed. Summary of the Invention

[0003] In view of this, embodiments of this specification provide a system detection method for detecting whether a user's behavior is abnormal based on a user's behavior sequence, thereby determining whether a system malfunctions. One or more embodiments of this specification also relate to a system detection device, a computing device, a computer-readable storage medium, and a computer program, to address technical deficiencies in the prior art.

[0004] According to a first aspect of the embodiments of this specification, a system detection method is provided, comprising:

[0005] Determine the historical user behavior sequence associated with the target system and the baseline user behavior sequence corresponding to the historical user behavior sequence, wherein the baseline user behavior sequence is obtained by removing cyclic behavior sequences from the historical user behavior sequence;

[0006] Compare the historical user behavior sequence with the baseline user behavior sequence, and determine the behavior sequence distribution information corresponding to the historical user behavior sequence based on the comparison result;

[0007] Based on the behavior sequence distribution information and the baseline user behavior sequence, anomaly detection is performed on the user behavior sequence to be detected associated with the target system;

[0008] The operating status information of the target system is determined based on the anomaly detection results.

[0009] According to a second aspect of the embodiments of this specification, a system detection method is provided, comprising:

[0010] Obtain the historical user behavior sequence associated with the target system, and generate a directed user behavior graph based on the historical user behavior sequence;

[0011] Based on the connection information corresponding to each behavior node in the directed graph of user behavior, cyclic behavior nodes are determined and the cyclic behavior nodes are removed.

[0012] The updated directed graph of user behavior is obtained based on the processing results;

[0013] A baseline user behavior sequence corresponding to the historical user behavior sequence is generated based on the updated directed graph of user behavior.

[0014] According to a third aspect of the embodiments of this specification, a system detection method is provided, comprising:

[0015] Obtain the historical user behavior sequence associated with the target system, and generate a directed user behavior graph based on the historical user behavior sequence;

[0016] Based on the connection information corresponding to each behavior node in the directed graph of user behavior, cyclic behavior nodes are determined and removed. An updated directed graph of user behavior is obtained based on the processing result.

[0017] Based on the updated directed graph of user behavior, a baseline user behavior sequence corresponding to the historical user behavior sequence is generated.

[0018] Compare the historical user behavior sequence with the baseline user behavior sequence, and determine the behavior sequence distribution information corresponding to the historical user behavior sequence based on the comparison result;

[0019] Based on the behavior sequence distribution information and the baseline user behavior sequence, anomaly detection is performed on the user behavior sequence to be detected associated with the target system, and the operating status information of the target system is determined based on the anomaly detection results.

[0020] According to a fourth aspect of the embodiments of this specification, a system detection apparatus is provided, comprising:

[0021] The first determining module is configured to determine a historical user behavior sequence associated with the target system and a baseline user behavior sequence corresponding to the historical user behavior sequence, wherein the baseline user behavior sequence is obtained by removing cyclic behavior sequences from the historical user behavior sequence.

[0022] The comparison module is configured to compare the historical user behavior sequence with the baseline user behavior sequence, and determine the behavior sequence distribution information corresponding to the historical user behavior sequence based on the comparison result;

[0023] The detection module is configured to perform anomaly detection on the user behavior sequence to be detected associated with the target system based on the behavior sequence distribution information and the baseline user behavior sequence;

[0024] The second determining module is configured to determine the operating status information of the target system based on the anomaly detection results.

[0025] According to a fifth aspect of the embodiments of this specification, a system detection apparatus is provided, comprising:

[0026] The first generation module is configured to acquire historical user behavior sequences associated with the target system and generate a directed user behavior graph based on the historical user behavior sequences.

[0027] The elimination module is configured to determine the cyclic behavior nodes based on the connection information corresponding to each behavior node in the directed graph of user behavior, and to eliminate the cyclic behavior nodes.

[0028] The module is configured to obtain an updated directed graph of user behavior based on the processing results;

[0029] The second generation module is configured to generate a baseline user behavior sequence corresponding to the historical user behavior sequence based on the updated directed user behavior graph.

[0030] According to a sixth aspect of the embodiments of this specification, a system detection apparatus is provided, comprising:

[0031] The first generation module is configured to acquire historical user behavior sequences associated with the target system and generate a directed user behavior graph based on the historical user behavior sequences.

[0032] The acquisition module is configured to determine the cyclic behavior nodes based on the connection information corresponding to each behavior node in the directed graph of user behavior, remove the cyclic behavior nodes, and obtain the updated directed graph of user behavior based on the processing result.

[0033] The second generation module is configured to generate a baseline user behavior sequence corresponding to the historical user behavior sequence based on the updated user behavior directed graph.

[0034] The comparison module is configured to compare the historical user behavior sequence with the baseline user behavior sequence, and determine the behavior sequence distribution information corresponding to the historical user behavior sequence based on the comparison result;

[0035] The detection module is configured to perform anomaly detection on the user behavior sequence to be detected associated with the target system based on the behavior sequence distribution information and the baseline user behavior sequence, and determine the operating status information of the target system based on the anomaly detection results.

[0036] According to a seventh aspect of an embodiment of this specification, a computing device is provided, including a memory, a processor, and computer instructions stored in the memory and executable on the processor, wherein the processor executes the computer instructions to implement the steps of the system detection method.

[0037] According to an eighth aspect of the embodiments of this specification, a computer-readable storage medium is provided that stores computer instructions, which, when executed by a processor, implement the steps of the system detection method.

[0038] According to a ninth aspect of the embodiments of this specification, a computer program is provided, wherein when the computer program is executed in a computer, it causes the computer to perform the steps of the above-described system detection method.

[0039] The system detection method provided in this specification determines a historical user behavior sequence associated with a target system and a baseline user behavior sequence corresponding to the historical user behavior sequence, wherein the baseline user behavior sequence is obtained by removing cyclic behavior sequences from the historical user behavior sequence; compares the historical user behavior sequence and the baseline user behavior sequence, and determines the behavior sequence distribution information corresponding to the historical user behavior sequence based on the comparison result; performs anomaly detection on the user behavior sequence to be detected associated with the target system based on the behavior sequence distribution information and the baseline user behavior sequence; and determines the operating status information of the target system based on the anomaly detection result.

[0040] One embodiment of this specification implements the acquisition of a baseline user behavior sequence based on historical user behavior sequences. By comparing the historical user behavior sequences and the baseline user behavior sequences, the behavior sequence distribution information is determined. This allows for anomaly detection of real-time received user behavior based on the behavior sequence distribution information and the baseline user behavior sequences, thereby determining the operational status of the target system. By determining whether the user behavior sequence is blocked or abnormal, the detection of complex systems can be completed, reducing missed and false detections, improving detection accuracy, and enabling timely repair of abnormal systems to ensure a normal user experience. Attached Figure Description

[0041] Figure 1 This is a schematic diagram illustrating a system detection method provided in one embodiment of this specification.

[0042] Figure 2This is a flowchart of a system detection method provided in one embodiment of this specification;

[0043] Figure 3 This is a schematic diagram of a directed graph of user behavior provided in one embodiment of the system detection method described in this specification.

[0044] Figure 4 This is a flowchart illustrating the processing procedure of a system detection method provided in one embodiment of this specification;

[0045] Figure 5 This is a flowchart of another system detection method provided in one embodiment of this specification;

[0046] Figure 6 This is a flowchart of another system detection method provided in one embodiment of this specification;

[0047] Figure 7 This is a schematic diagram of the structure of a system detection device provided in one embodiment of this specification;

[0048] Figure 8 This is a schematic diagram of the structure of another system detection device provided in one embodiment of this specification;

[0049] Figure 9 This is a schematic diagram of another system detection device provided in one embodiment of this specification;

[0050] Figure 10 This is a structural block diagram of a computing device provided in one embodiment of this specification. Detailed Implementation

[0051] Many specific details are set forth in the following description to provide a full understanding of this specification. However, this specification can be implemented in many other ways than those described herein, and those skilled in the art can make similar extensions without departing from the spirit of this specification. Therefore, this specification is not limited to the specific implementations disclosed below.

[0052] The terminology used in one or more embodiments of this specification is for the purpose of describing particular embodiments only and is not intended to be limiting of the one or more embodiments of this specification. The singular forms “a,” “described,” and “the” as used in one or more embodiments of this specification and the appended claims are also intended to include the plural forms unless the context clearly indicates otherwise. It should also be understood that the term “and / or” as used in one or more embodiments of this specification refers to any or all possible combinations including one or more of the associated listed items.

[0053] It should be understood that although the terms first, second, etc., may be used to describe various information in one or more embodiments of this specification, such information should not be limited to these terms. These terms are only used to distinguish information of the same type from one another. For example, first may also be referred to as second without departing from the scope of one or more embodiments of this specification, and similarly, second may also be referred to as first. Depending on the context, the word "if" as used herein may be interpreted as "when," "when," or "in response to a determination."

[0054] First, the terms and concepts used in one or more embodiments of this specification will be explained.

[0055] User behavior sequence: A sequence of user actions on the client, such as clicking a button, visiting a page, or browsing an exposure item.

[0056] Front-end event tracking data: Event tracking, also known as event tracking, is a technology and implementation process for capturing, processing, and sending data related to specific user behaviors or project processes. User behavior can be obtained by linking event tracking data.

[0057] DGA (Directed Acyclic Graph): A directed graph is a graph that cannot be traced back to a vertex by traversing several edges.

[0058] Word embedding: Embedding is a method of representing an object using a numerical vector. This object can be a word, an item, a movie, etc. An item can be represented by a vector because the distance between this vector and the vectors of other items reflects the similarity between those items.

[0059] Currently, the project team collects a large amount of front-end event tracking data daily. However, this data is primarily used for single-point tracking within the front-end system, relying on collected information or anomaly thresholds to determine system functionality. This coarse-grained anomaly detection lacks sufficient consideration of the context of user actions. If event tracking is missed, thresholds are improperly set, or unforeseen system anomalies occur, the system will still fail to proactively detect these anomalies. Existing solutions for analyzing user action sequence anomalies utilize sequence pattern extraction methods. However, these methods are suitable for application systems with clear operation patterns but are unsuitable for systems with complex operation patterns and numerous repetitive jumps. This negatively impacts the user experience and causes unnecessary losses for the project team.

[0060] Based on this, this specification provides a system detection method for detecting the system based on user operation behavior sequences. The method analyzes historical front-end user operation sequences using algorithms and detects in real time whether the current user operation sequence is blocked or abnormal. When an abnormality occurs in the user operation sequence, it indicates a system fault, enabling timely alarm feedback for system repair and improving user experience. This specification also relates to a system detection device, a computing device, a computer-readable storage medium, and a computer program, which will be described in detail in the following embodiments.

[0061] Figure 1 This is a schematic diagram illustrating a system detection method according to an embodiment of this specification. The system terminal of the project team can be understood as a terminal used by the project team to perform anomaly detection on the system. The terminal can be a computer, server, or other terminal device. The system terminal accesses front-end user behavior data, such as historical user behavior sequences. By removing elements from the historical user behavior sequences, a baseline user behavior sequence is obtained. Behavior sequence distribution information is obtained by comparing the historical user behavior sequence with the baseline user behavior sequence. Then, based on the behavior sequence distribution information and the baseline user behavior sequence, anomaly detection is performed on the current user behavior sequence. The system analyzes and captures user behavior anomalies caused by system anomalies. By checking whether the current user behavior sequence meets expectations, if it does not, the user behavior sequence is considered abnormal, i.e., the system has an anomaly. At this time, an alarm is promptly triggered, and the system is repaired, thereby improving the user experience. It should be noted that the user behavior data or user behavior sequences involved in this application are all information and data authorized by the user or fully authorized by all parties. The user behavior data includes, but is not limited to, user data and user historical behavior. User data includes, but is not limited to, data used for analysis, data stored, and data displayed. Furthermore, the collection, use, and processing of the relevant data must comply with the relevant laws, regulations, and standards of the relevant countries and regions, and corresponding operation entry points are provided for users to choose to authorize or refuse.

[0062] Figure 2 A flowchart of a system detection method according to an embodiment of this specification is shown, including steps 202 to 208.

[0063] Step 202: Determine the historical user behavior sequence associated with the target system and the baseline user behavior sequence corresponding to the historical user behavior sequence, wherein the baseline user behavior sequence is obtained by removing cyclic behavior sequences from the historical user behavior sequence.

[0064] The target system can be understood as the system to be tested by the project team, the historical user behavior sequence can be understood as a sequence of behaviors generated by users using the system, and the baseline user behavior sequence can be understood as a sequence obtained by analyzing the historical user behavior sequence to measure whether user behavior is abnormal, or it can be understood as the normal behavior sequence of using the system.

[0065] In practical applications, the project team's system will have corresponding anomaly detection rules. By accessing front-end data, it obtains front-end user behavior data, i.e., historical user behavior sequences. Front-end data may also include other auxiliary data, such as customer group information, device information, and platform information. Through data mining and analysis of historical user behavior sequences, a corresponding baseline user behavior sequence can be obtained. Specifically, this involves removing cyclical behavior sequences from the historical user behavior sequences to obtain the baseline sequence. Cyclic behavior sequences can be understood as actions such as users repeatedly going back or repeatedly jumping between pages, resulting in recurring behavior. Subsequently, based on the baseline user behavior sequence, the current user behavior sequence can be analyzed and detected in real time to determine if any anomalies have occurred. When an anomaly is detected, it indicates a fault in the target system, which is then promptly reported to the fault repair system to ensure normal user access.

[0066] Because user behavior during operation is not clean, actions such as backing up and repeatedly jumping between pages may occur, resulting in looping or cyclical behavior sequences. Cyclic behavior sequences are not conducive to anomaly analysis of user behavior sequences; therefore, they need to be removed before generating a baseline behavior sequence. Specifically, determining the historical user behavior sequences associated with the target system and the corresponding baseline user behavior sequences includes: obtaining the historical user behavior sequences associated with the target system; determining cyclic user behaviors based on the execution information of each historical user behavior in the historical user behavior sequences; performing cyclic removal processing on the cyclic user behaviors; and obtaining the baseline user behavior sequence corresponding to the historical user behavior sequences based on the processing results.

[0067] Historical user behavior can be understood as the operations a user has performed in the past. For example, the system retrieves previously performed user actions and generates a historical user behavior sequence; the user actions in this sequence constitute the historical user behavior. The execution information of historical user behavior can be understood as the execution order of historical user actions within the historical user behavior sequence. For example, if the historical user behavior sequence is {ABC}, then the execution information for historical user behavior A can be "A to B", the execution information for historical user behavior B can be "A to B, B to C", and the execution information for historical user behavior C can be understood as "B to C". Therefore, based on the execution information of historical user behavior, the previous and next actions of each historical user behavior can be determined. Thus, based on the execution information of each historical user behavior, it can be determined whether there is a cyclical behavior in the current user behavior sequence, i.e., a closed loop of behavior. If cyclical behavior is not eliminated, resulting in cyclical behavior in the baseline user behavior, then during anomaly detection of the user behavior sequence, the fault problem of user behavior entering a loop due to system failure cannot be detected. Therefore, cyclical behavior needs to be eliminated.

[0068] In one embodiment of this specification, a historical user behavior sequence associated with the target system is obtained. The execution information of each historical user behavior in the historical user behavior sequence determines the cyclical user behavior. For example, the execution information of historical user behavior A is "AB", the execution information of historical user behavior B is "AB, BC, BD", and the execution information of historical user behavior C is "BC, CE, CA". Based on the above execution information, it can be determined that a cycle occurs between historical user behaviors A, B, and C. The cyclical user behavior is determined to be historical user behaviors A, B, and C. Cyclic elimination processing needs to be performed on historical user behaviors A, B, and C. The baseline user behavior sequence is obtained based on the processing result.

[0069] In practical applications, the process of eliminating cyclical user behaviors does not involve deleting all cyclical user behaviors from the historical user behavior sequence. Instead, it involves removing a specific execution order between the cyclical user behaviors, causing the loop to break. This method preserves the historical user behaviors corresponding to the cyclical behaviors while ensuring that there are no cyclical behaviors in the historical behavior sequence.

[0070] In practice, to more clearly identify cyclic user behaviors in historical user behavior sequences, historical user behaviors can be converted into a corresponding directed user behavior graph. Cyclic behavior nodes can then be determined from this graph. Specifically, determining cyclic user behaviors based on the execution information of each historical user behavior in the historical user behavior sequence includes: generating a directed user behavior graph based on the execution information of each historical user behavior in the historical user behavior sequence; obtaining the connection information corresponding to each behavior node in the directed user behavior graph; and determining cyclic behavior nodes and sequential behavior nodes based on the node connection relationships in each connection information.

[0071] In this context, a directed graph of user behavior can be understood as a directed graph generated based on historical user behavior sequences, such as... Figure 3 As shown, Figure 3 This is a schematic diagram of a directed graph of user behavior provided in one embodiment of this specification. Figure 3 In A, there are historical user behaviors A, B, ... G. Each historical user behavior corresponds to a behavior node. Based on the directed graph of user behaviors, the connection information between each historical user behavior can be determined, thus making it easier to identify cyclic behavior nodes and sequential behavior nodes.

[0072] In practical applications, when a historical user behavior sequence contains loops (i.e., cycles), the cyclic behavior nodes can be identified in the directed graph of user behavior corresponding to the historical user behavior sequence. The remaining behavior nodes in the directed graph are then called sequential behavior nodes. Figure 3 In A, if behavior nodes A, B, and C are determined to be cyclic behavior nodes, then behavior nodes D, E, F, and G are sequential behavior nodes.

[0073] After identifying cyclical and sequential behavior nodes through the directed graph of user behavior, cyclical user behavior can be eliminated to prevent loops in the historical user behavior sequence, thus improving the accuracy of subsequent anomaly detection. Specifically, the cyclical elimination process involves updating the node connection weights between the cyclical and sequential behavior nodes, and eliminating the node connections between the cyclical behavior nodes. An updated directed graph of user behavior is then obtained based on the updated graph, and a benchmark user behavior sequence corresponding to the historical user behavior sequence is generated from this updated graph.

[0074] In this context, the node connection weights between cyclic and sequential behavior nodes can be understood as the relationship between them. In practical applications, the node connection weights in complex networks are edge weights, which represent the strength of the relationship between the nodes at both ends of an edge. In unweighted networks, the relationship between the nodes represented by each edge is the same. However, in real-world networks, the edge weights between any two nodes vary depending on the application scenario.

[0075] In practice, to prevent changes in edge weights caused by removing edges connecting two behavior nodes that create a cycle, the edge weights connecting the cyclic behavior node and the sequential behavior node need to be updated. This ensures that the total sum of edge weights in the entire directed graph of user behavior remains unchanged after the cycle removal process. See [link / reference] Figure 3 C. Delete the node connection between user behavior point B and user behavior point C, and update the node connection weights between user behavior point B and user behavior point D, and between user behavior point C and user behavior point E. This allows the corresponding node connection weights to be allocated to other node connection relationships after the node connection between user behavior point B and user behavior point C is deleted.

[0076] In practical applications, after generating a directed graph of user behavior based on historical user behavior sequences, the presence of cycles within the directed graph indicates the existence of directed loops, i.e., loops formed by connecting cyclic behavior nodes. For example... Figure 3 In graph A, user behavior points A, B, and C form a directed cycle. At this point, a cyclic elimination process needs to be performed on the directed graph of user behaviors. Specifically, the cyclic elimination process includes: forming target behavior nodes based on the cyclic behavior nodes; calculating and updating the node connection weights between the target behavior nodes and the sequential behavior nodes based on the node connection weights corresponding to each node connection relationship in the target behavior nodes; determining the node connection relationships to be deleted based on the node connection weights corresponding to each node connection relationship in the target behavior nodes, and eliminating the node connection relationships to be deleted.

[0077] The target behavior node can be understood as a new node generated based on the cyclic behavior node, see [link / reference]. Figure 3In B, node X is the target behavior node, which is composed of user behavior nodes A, B, and C. Then, the edge weights between the target behavior node X and user behavior nodes D and E need to be updated. The specific update logic can be as follows: Assume that there is a user behavior node u in the target behavior node X, and let the edge weight pointing to user behavior node u be in[u]. Then, for each edge (u, i, w) starting from user behavior node u, where the triple indicates that the edge weight from u to i is w, the edge connecting (new, i, w) in the new graph is created, where new is the newly added artificial node. For each edge (i, u, w) entering u, the edge (i, new, w-in[u]) is created in the new graph.

[0078] For example, see Figure 3 B. Assuming that in the target behavior node X, the weight of each edge between behavior nodes is 1, then the weight sum of the target behavior node X is 3. Furthermore, the weight of the edge from user behavior B to user behavior D is 1, and the weight of the edge from user behavior C to user behavior E is 1. After deleting the weight of the edge from user behavior B to user behavior C, according to the above update logic, the weight of the edge from user behavior B to user behavior C can be updated to the weight of the edge from user behavior B to user behavior D and / or the weight of the edge from user behavior C to user behavior E. In one case, the updated result is that the weight of the edge from user behavior B to user behavior D is 2, and the weight of the edge from user behavior C to user behavior E is 1, thus keeping the weight sum of the entire directed graph of user behavior unchanged.

[0079] In practical applications, the target behavior node may contain multiple cyclical node connections. According to the processing logic, this cycle needs to be broken, therefore one of the node connections needs to be deleted. The deletion logic can be set to select the node connection with the smallest edge weight for deletion. Therefore, based on the node connection weights corresponding to each node connection, the node connection with the smallest weight to be deleted needs to be determined; that is, find the edge with the smallest weight and delete that edge. In specific implementation, the directed graph of user behavior may contain multiple directed cycles. Therefore, the process of repeatedly eliminating directed cycles can be repeated until no directed cycles remain in the directed graph of user behavior.

[0080] Accordingly, the updated directed graph of user behavior is obtained based on the update results, including: generating the updated directed graph of user behavior based on the update and deletion results. After updating the node connection weights between the target behavior node and the sequential behavior node in the directed graph of user behavior, and deleting the connection relationships of the nodes to be deleted in the target behavior node, the updated directed graph of user behavior can be obtained based on the update and deletion results. See also Figure 3 In the Figure 3After performing cyclic elimination on the directed graph of user behavior B, the result is as follows: Figure 3 The updated directed graph of user behavior in C is used to obtain the baseline user behavior sequence corresponding to the historical user behavior sequence.

[0081] In summary, by removing directed cycles from the directed graph of user behavior and updating the edge weights of some edges in the directed graph of user behavior, the final updated directed graph of user behavior becomes a minimal tree graph, thus obtaining a more accurate baseline user behavior sequence.

[0082] In practical applications, the historical user behavior sequences obtained directly through data cleaning and concatenation are complex and redundant. To reduce the complexity of determining the baseline user behavior sequence based on the historical user behavior sequence, the historical user behavior sequence can be preprocessed before determining the baseline user behavior sequence. Specifically, this includes: identifying duplicate user behaviors in the historical user behavior sequence and deduplicating the duplicate user behaviors; and obtaining the deduplicated historical user behavior sequence based on the processing results.

[0083] Duplicate user behavior can be understood as actions that users repeatedly perform, such as repeatedly clicking the refresh button or repeatedly visiting the same page. To improve the efficiency of determining the baseline user behavior sequence, duplicate behaviors in the historical user behavior sequence need to be removed. For example, if the historical user behavior sequence is [abcccd], then historical user behavior c can be identified as a duplicate user behavior. Therefore, duplicate historical user behavior c can be deduplicated, resulting in the deduplicated historical user behavior sequence [abcd]. Furthermore, to check the rationality of repeated visits, duplicate visit information for a node can be recorded and saved, i.e., the distribution information of duplicate behaviors. For example, 50% of users will repeatedly click node c 1-5 times, and 20% will repeatedly click node c 5-10 times, which can be saved as "c: 0-1: 0.3, 1-5: 0.5, 5-10: 0.2".

[0084] In practical applications, some nodes may appear repeatedly, but they originate from different pages. Therefore, deduplication also includes extracting unique combinations, retaining all jump combinations. For example, if the historical user behavior sequence is [abcadbca], retaining only [abcd] would result in the loss of jump information. Node 'b' appears multiple times, but the first jump is from node 'a', and the second from node 'd'. Therefore, both 'b' nodes need to be retained. The last three nodes, 'bca', are considered duplicates because 'bc' and 'ca' have already appeared. The final deduplicated historical user behavior sequence is [abcadb].

[0085] Accordingly, determining the baseline user behavior sequence corresponding to the historical user behavior sequence includes: determining the baseline user behavior sequence corresponding to the deduplicated historical user behavior sequence.

[0086] After deduplicating the historical user behavior sequence, we obtain the deduplicated historical user behavior sequence. Therefore, when determining the baseline user behavior sequence, we can use the deduplicated historical user behavior sequence to determine the baseline user behavior sequence.

[0087] Furthermore, in order to determine whether each user behavior is a duplicate behavior, it is necessary to determine it based on the node access information corresponding to each user behavior. Specifically, the duplicate user behaviors in the historical user behavior sequence are determined, and the duplicate user behaviors are deduplicated, including: obtaining the node access information corresponding to each user behavior in the historical user behavior sequence; determining the duplicate user behaviors based on the node access information; and removing the duplicate user behaviors.

[0088] The node access information corresponding to each user behavior can be understood as the jump information of each user behavior, such as the historical user behavior sequence [abcadbca]. The node access information of the first b point can be "ab, bc", and the node access information of the first c point can be "bc, ca". Based on the node access information corresponding to each user behavior, the preceding and following behaviors of each user behavior can be determined. When the jump information of the same behavior node is the same, such as the jump information of the second c behavior node is "bc" and the jump information of the first c behavior node is also "bc", then the second c behavior node can be determined as a duplicate user behavior, and the duplicate user behavior can be deleted.

[0089] In summary, deduplication of historical user behavior sequences can reduce complex and redundant repetitive behavior sequences, which is beneficial for determining the baseline user behavior sequence.

[0090] Step 204: Compare the historical user behavior sequence with the baseline user behavior sequence, and determine the behavior sequence distribution information corresponding to the historical user behavior sequence based on the comparison result.

[0091] Specifically, after determining the historical user behavior sequence and the baseline user behavior sequence, the historical user behavior sequence and the baseline user behavior sequence can be compared. That is, the historical user behavior sequence is matched with the baseline user behavior sequence to obtain the historical behavior sequence distribution information. The behavior sequence distribution information can be understood as the sequence distribution pattern, which can be understood as the matching degree of the baseline user behavior sequence relative to the historical user behavior sequence. Subsequently, anomaly detection can be performed on the received user behavior sequence based on the sequence distribution pattern. If the sequence distribution pattern of the user behavior sequence differs too much from the historical sequence distribution pattern, it indicates that the user behavior sequence is abnormal.

[0092] In practical applications, matching can be performed using two modes: n-gram-based and longest common subsequence (lcs)-based. Specifically, the historical user behavior sequence is compared with the baseline user behavior sequence, and the behavior sequence distribution information corresponding to the historical user behavior sequence is determined based on the comparison result. This includes: comparing the historical user behavior sequence with the baseline user behavior sequence; determining the overlapping user behaviors between the historical user behavior sequence and the baseline user behavior sequence based on the comparison result; and calculating the behavior sequence distribution information corresponding to the historical user behavior sequence based on the overlapping user behaviors.

[0093] Overlapping user behavior can be understood as overlapping user behaviors determined by either n-tuples or the longest common subsequence. Based on overlapping user behavior, the distribution information of the behavior sequence corresponding to the historical user behavior sequence can be calculated.

[0094] It should be noted that n-gram pattern matching is primarily a sequence pattern method oriented towards n-tuple recall. The basic idea is to evaluate the matching degree between historical user behavior sequences and baseline user behavior sequences by statistically analyzing the overlapping basic operations (n-gram user behaviors) between them. In one embodiment of this specification, this method is used to calculate the sequence distribution information corresponding to historical user behavior sequences. Specifically, the n-gram pattern-based calculation of behavior sequence distribution information can be determined using the following formula:

[0095]

[0096] Where n represents the size of an n-tuple, i.e., the number of user behaviors in an n-tuple. RS represents all baseline user behavior sequences, and S represents a specific baseline user behavior sequence. n Represents a specific n-tuple in a sequence of actions; Count(gram) n ) represents the number of n-tuple sequences in a given baseline user behavior sequence.match (gram n The number of identical n-tuple sequences between the user sequence to be detected and a certain baseline user behavior sequence is represented by ).

[0097] Pattern matching based on LCS mainly involves calculating the longest common sequence between the matched historical user behavior sequence and the baseline user behavior sequence. The distribution information of the behavior sequence corresponding to the historical user behavior sequence is obtained through the longest common sequence. Specifically, the distribution information of the behavior sequence calculated based on LCS can be determined by the following formula:

[0098]

[0099] Where X represents a baseline user behavior sequence, m represents the length of X, Y represents the user behavior sequence to be detected, n represents the length of Y, LCS(X,Y) is the length of the longest common subsequence of sequences X and Y, and R lcs P represents the ratio of the length of the longest common subsequence to the length of sequence X. lcs F represents the ratio of the length of the longest common subsequence to the length of sequence Y. lcs β represents the sequence distribution pattern between sequences X and Y, and β is a harmonic parameter, β = P lcs / R lcs .

[0100] After calculating the behavior sequence distribution information using the above method, anomaly detection can be performed on the user behavior sequence based on the behavior sequence distribution information and the baseline user behavior sequence. This allows for accurate detection of whether anomalies have occurred in the user behavior sequence, and timely repair of the target system in the event of anomalies, ensuring a normal user experience.

[0101] Step 206: Based on the behavior sequence distribution information and the baseline user behavior sequence, perform anomaly detection on the user behavior sequence to be detected associated with the target system.

[0102] After determining the behavior sequence distribution information and the baseline user behavior sequence, anomaly detection can be performed on the user behavior sequence to be detected. The user behavior sequence to be detected can be understood as the user behavior sequence generated during the user's use of the target system, that is, the user behavior sequence transmitted in real time. Unsupervised detection is then performed on the baseline user behavior sequence and behavior sequence distribution information obtained by the algorithm.

[0103] Specifically, to ensure the reliability of anomaly detection and prevent missed or false detections, anomaly detection can be performed based on a single user behavior sequence or multiple user behavior sequences. Specifically, based on the behavior sequence distribution information and the baseline user behavior sequence, anomaly detection is performed on the user behavior sequence to be detected associated with the target system, including: performing anomaly detection on the user behavior sequence to be detected associated with the target system based on the behavior sequence distribution information and the baseline user behavior sequence; and obtaining a first anomaly detection result and / or a second anomaly detection result.

[0104] The first anomaly detection result can be understood as the result obtained by detecting anomalies in a single user behavior sequence to be detected, while the second anomaly detection result can be understood as the result obtained by detecting anomalies in multiple user behavior sequences to be detected within a time window. By simultaneously performing single-user sequence anomaly detection and multi-sequence distribution anomaly detection, the system can fully explore user behavior anomalies caused by system problems that may occur in complex applications, avoiding missed or false detections and improving the reliability of the system.

[0105] In practical applications, after performing anomaly detection on the user behavior sequence to be detected using two methods, a first anomaly detection result and / or a second anomaly detection result can be obtained. Accordingly, determining the operational status information of the target system based on the anomaly detection results includes: determining the operational status information of the target system based on the first anomaly detection result and / or the second anomaly detection result.

[0106] The operational status information can be understood as the system's operational information, reflecting whether any anomalies have been detected. If the first anomaly detection result is abnormal, the operational status information will be in an abnormal state, requiring the system to be stopped and an alert to the developers to be sent. This allows the developers to promptly fix the system fault and ensures that users can continue to use the services provided by the system. Therefore, the operational status information of the target system can be determined based on the results of the first and / or second anomaly detections.

[0107] In practice, single-sequence anomaly detection and multi-sequence anomaly detection can be performed simultaneously, or one of these anomaly detection methods can be selected. Specifically, single-sequence anomaly detection includes: encoding the baseline user behavior sequence and the target system-associated user behavior sequence to be detected; obtaining the baseline user behavior text vector corresponding to the baseline user behavior sequence and the target user behavior text vector corresponding to the target user behavior sequence based on the processing results; calculating the text difference value corresponding to the target user behavior sequence based on the baseline user behavior text vector and the target user behavior text vector; and determining the text detection information of the target system based on the text difference value.

[0108] The single-sequence anomaly detection method includes encoding and clustering. Encoding involves encoding the baseline user behavior sequence and the target system's associated user behavior sequence to obtain baseline and target user behavior text vectors. Clustering involves clustering based on the baseline user behavior text vectors to obtain baseline behavior category classifications. Subsequently, text difference values ​​corresponding to the target user behavior sequence are calculated based on the baseline behavior category classifications. These text difference values ​​determine the target system's text detection information. This text detection information can be understood as the detection information of the target system determined based on the detection results after the single-sequence anomaly detection method detects the target user behavior sequence. When the text difference value exceeds a preset text difference threshold, the text detection information can be considered an anomaly, indicating that an anomaly has occurred in the target system.

[0109] In practical applications, encoding processing includes word embedding, where the user behavior sequence is treated as a sentence, with each user behavior represented as a word. The baseline user behavior sequence and the user behavior sequence to be detected are treated as a set, and word2vec is trained using CBOW. Then, SIF (Smooth Inverse Frequency) weighted mode is used to obtain the sequence encoding. Clustering processing includes sequence graph clustering based on word embedding, using Louvain and AGC methods. The Louvain algorithm primarily optimizes the modularity on the graph; graph clustering is complete when this value reaches its maximum. The AGC algorithm is an adaptive graph convolution method that understands GNNs (Graph Neural Networks) from the perspective of graph signal processing spectral theory, enhancing clustering results and utilizing higher-order graph convolution to select the global clustering structure. By encoding the baseline user behavior sequence and the user behavior sequence to be detected associated with the target system, baseline user behavior text vectors and user behavior text vectors to be detected can be obtained. Subsequent clustering processing can be performed based on the baseline user behavior text vectors to obtain the baseline behavior category classification. The cosine distance between the user behavior vector to be detected and the center point vectors of each benchmark behavior category is calculated, and the text difference value corresponding to the user behavior sequence to be detected is obtained based on the calculation result.

[0110] In practice, the text difference value can be understood as the cosine distance between the user behavior sequence to be detected and the benchmark user behavior sequence of its cluster center. If the text difference value is greater than the preset threshold, it is determined that the user behavior sequence to be detected is abnormal. Then, the target system's operating status information can be determined to be abnormal based on the first abnormality detection result.

[0111] Correspondingly, another method for detecting anomaly distributions in multiple sequences involves aggregation and matching analysis of multiple user behavior sequences to be detected within a time window to determine their distribution anomalies within the historical time frame. Specifically, this includes: comparing the user behavior sequences to be detected associated with the target system with the baseline user behavior sequences; determining the distribution information of the user behavior sequences to be detected based on the comparison results; and calculating the distribution difference between the distribution information of the historical user behavior sequences and the distribution information of the user behavior sequences to be detected.

[0112] In order to compare with historical behavior sequence distribution information, it is necessary to first match and compare the behavior sequence to be detected with the benchmark user behavior sequence to obtain the behavior sequence distribution information corresponding to the user behavior sequence to be detected, and then calculate the distribution difference value by using the behavior sequence distribution information corresponding to historical user behavior sequences and the behavior sequence distribution information to be detected.

[0113] In specific implementation, it is determined whether the distribution difference value is greater than a threshold. If it is, an anomaly has occurred. Accordingly, the operating status information of the target system is determined based on the anomaly detection result, including: determining the operating status information of the target system based on the distribution difference value. That is, whether the distribution difference value is greater than a preset distribution difference threshold. If it is, the second anomaly detection result is that the distribution difference value is abnormal, indicating that the system has an anomaly, and the determined operating status information of the target system is an abnormal operating state.

[0114] Furthermore, the system can be assessed for anomalies based on the distribution of repeated accesses in historical user behavior sequences. Specifically, this includes: identifying repeated user behaviors in the historical user behavior sequence and repeated user behaviors to be detected in the user behavior sequence to be detected; determining historical repeated behavior distribution information corresponding to the historical user behavior sequence based on the repeated user behaviors, and determining the distribution information of repeated user behaviors to be detected corresponding to the repeated user behaviors to be detected based on the repeated user behaviors to be detected; calculating a repeatability difference value based on the historical repeated behavior distribution information and the repeated behavior distribution information to be detected; and determining the repeatability detection information of the target system based on the repeatability difference value.

[0115] In this context, repeated user behavior in historical user behavior sequences can be understood as repeated clicks by users. For example, if the historical user behavior sequence is [abcccd], then the repeated user behavior is user behavior point c. Based on the repeated user behavior, the distribution information of repeated behavior at user behavior point c can be recorded and saved. For example, 50% of users will repeatedly click node c 1-5 times, and 20% will repeatedly click node c 5-10 times, which is saved as "c: 0-1: 0.3, 1-5: 0.5, 5-10: 0.2". Based on the user behavior to be detected in the user behavior sequence to be detected, the distribution information of repeated behavior to be detected corresponding to the user behavior sequence to be detected is determined. For example, 80% of users will repeatedly click node c 1-5 times, and 20% will repeatedly click node c 5-10 times, which is saved as "c: 1-5: 0.8, 5-10: 0.2". After comparing the distribution information of repeated behaviors in historical user behavior sequences with the distribution information of repeated behaviors in the user behavior sequence to be detected, the repetition difference value can be calculated. In the example above, the percentage of users who clicked node c 1 to 5 times increased from 50% to 80%, and the repetition difference value was 0.3. If the preset repetition difference threshold is 0.1, it indicates that the user behavior sequence to be detected is abnormal, and the repetition detection information of the target system is determined to be abnormal, indicating that the target system is abnormal at this time.

[0116] In practical implementation, text difference values, distribution difference values, and repetition difference values ​​can be obtained through the three anomaly detection methods mentioned above. These three difference values ​​can then be used to determine whether an anomaly has occurred in the target system. In summary, by using single-sequence anomaly detection and multi-sequence anomaly distribution detection to detect user behavior sequences from multiple dimensions, comprehensive detection can be performed from multiple angles, reducing missed and false detections. This improves the accuracy of anomaly detection, fully uncovers potential system problems leading to abnormal user behavior, and ensures a normal user experience.

[0117] Step 208: Determine the operating status information of the target system based on the anomaly detection results.

[0118] The process involves performing anomaly detection on the user behavior sequence described above to obtain anomaly detection results. Based on these results, it can be determined whether the system is experiencing any abnormalities. When the anomaly detection result for the user behavior sequence is abnormal, it indicates that the anomaly is caused by a system malfunction, meaning the target system's operational status is abnormal. Therefore, this anomaly information needs to be reported to the developers for them to fix the system anomaly.

[0119] In practical applications, when single-sequence anomaly detection and multi-sequence anomaly distribution detection are performed respectively, text difference values, distribution difference values ​​and repetition difference values ​​are obtained. At this time, the operating status information of the target system is determined based on the text difference values, distribution difference values ​​and repetition difference values.

[0120] In a specific embodiment of this specification, when the text difference value, distribution difference value, and repetition difference value are all normal, the operating status information of the target system is normal operating status information. When any one of the text difference value, distribution difference value, or repetition difference value is abnormal, the operating status information of the target system is abnormal operating status information. The abnormal operating status information is fed back to the developers, who then repair the faults in the target system to ensure the normal user experience.

[0121] This specification provides a system detection method that involves determining a historical user behavior sequence associated with a target system and a corresponding baseline user behavior sequence. The baseline user behavior sequence is obtained by removing cyclical behavior sequences from the historical user behavior sequence. The method compares the historical user behavior sequence and the baseline user behavior sequence, and determines the behavior sequence distribution information corresponding to the historical user behavior sequence based on the comparison result. Based on the behavior sequence distribution information and the baseline user behavior sequence, anomaly detection is performed on the user behavior sequence to be detected associated with the target system. The method then determines the operating status information of the target system based on the anomaly detection results. By removing and deduplicating complex and redundant historical user behavior sequences, a more accurate baseline user behavior sequence can be obtained, thereby improving the accuracy of subsequent anomaly detection results. By determining whether the user behavior sequence is blocked or abnormal, the method can complete the detection of complex systems, reducing missed and false detections, improving detection accuracy, and enabling timely repair of abnormal systems to ensure a normal user experience.

[0122] The following is in conjunction with the appendix Figure 4 Taking the system detection method provided in this specification as an example in the application of browser system detection, the system detection method will be further explained. Among other things, Figure 4 A flowchart of the processing procedure of a system detection method provided in one embodiment of this specification is shown, with specific steps including steps 402 to 420.

[0123] Step 402: Obtain the historical user behavior sequence associated with the browser system.

[0124] In one alternative approach, the historical user behavior sequence of the user using the browser is obtained. The historical user behavior sequence includes the user's behavior sequence of operating the browser to access information, such as clicking buttons, accessing pages, refreshing pages, etc.

[0125] Step 404: Identify duplicate user behaviors in the historical user behavior sequence, perform deduplication on the duplicate user behaviors, and obtain the deduplicated historical user behavior sequence based on the processing result.

[0126] In one alternative approach, the jump information for each user behavior is determined in the historical user behavior sequence, all jump combinations are retained, duplicate user behaviors are identified, and duplicate user behaviors are deleted to obtain a deduplicated historical user behavior sequence.

[0127] Step 406: Generate a directed graph of user behavior based on the execution information of each historical user behavior in the deduplicated historical user behavior sequence.

[0128] In one alternative approach, a directed graph of user behavior is generated based on the execution information of each historical user behavior in the deduplicated user behavior sequence, i.e., the information of jumping to the next node.

[0129] Step 408: Obtain the connection information corresponding to each behavior node in the directed graph of user behavior, and determine the cyclic behavior nodes and sequential behavior nodes based on the node connection relationship in each connection information.

[0130] In one optional approach, the connection information corresponding to each behavior node in the directed graph of user behavior is determined. This connection information includes the node connection relationships for each behavior node (i.e., the next connected node) and the node connection weights for each behavior node (i.e., the edge weights between two behavior nodes). Based on the node connection relationships of each behavior node, cyclic behavior nodes and sequential behavior nodes are determined.

[0131] Step 410: Update the node connection weights between cyclic behavior nodes and sequential behavior nodes, and remove the node connection relationships between cyclic behavior nodes.

[0132] In one alternative approach, cyclic behavior nodes are grouped into target behavior nodes. Based on the edge weight of each connecting edge in the target behavior node, the edge weights of the connecting edges between the target behavior node and the sequential behavior nodes are calculated and updated. The connecting edge with the smallest edge weight in the target behavior node is identified as the connection to be deleted, and this connection is removed.

[0133] Step 412: Obtain the updated directed graph of user behavior based on the update results, and generate the baseline user behavior sequence corresponding to the historical user behavior sequence based on the updated directed graph of user behavior.

[0134] In one alternative approach, the directed graph of user behavior is cyclically purged to obtain an updated directed graph of user behavior, and a baseline user behavior sequence is generated based on the updated directed graph of user behavior.

[0135] Step 414: Compare the historical user behavior sequence with the baseline user behavior sequence, and determine the overlapping user behaviors between the historical user behavior sequence and the baseline user behavior sequence based on the comparison results.

[0136] Step 416: Calculate the distribution information of the behavior sequence corresponding to the historical user behavior sequence based on the overlapping user behavior.

[0137] In one alternative approach, behavioral sequence distribution information is calculated based on overlapping user behaviors using an n-gram pattern or an lcs pattern.

[0138] Step 418: Perform anomaly detection on the user behavior sequence to be detected associated with the target system based on the behavior sequence distribution information and the benchmark user behavior sequence.

[0139] In one alternative approach, by encoding the baseline user behavior sequence and the target system's associated user behavior sequence, baseline user behavior text vectors and target user behavior text vectors can be obtained. Subsequently, clustering can be performed based on the baseline user behavior text vectors to obtain baseline behavior category classifications. Then, cosine distances are calculated between the target user behavior vector and the centroid vectors of each baseline behavior category. The text difference values ​​corresponding to the target user behavior sequence are determined based on the calculation results, and the anomaly detection results are determined using these text difference values.

[0140] In another alternative approach, the distribution information of the user behavior sequence to be detected is obtained by comparing the user behavior sequence to be detected with the baseline user behavior sequence. The distribution difference value is calculated based on the historical behavior sequence distribution information and the distribution information of the user behavior sequence to be detected, and the anomaly detection result is determined by the distribution difference value.

[0141] In another alternative approach, the distribution information of historical repeated behaviors in the historical user behavior sequence is determined, and the distribution information of repeated behaviors to be detected in the user behavior sequence to be detected is determined. By comparing the distribution information of historical repeated behaviors and the distribution information of repeated behaviors to be detected, the repetition difference value is obtained, and the anomaly detection result is determined by the repetition difference value.

[0142] Step 420: Determine the operating status information of the target system based on the anomaly detection results.

[0143] In one alternative approach, if the anomaly detection result indicates that the user behavior sequence to be detected is abnormal, the operating status information of the target system is determined to be in an abnormal operating state.

[0144] This specification provides a system detection method that obtains a baseline user behavior sequence based on historical user behavior sequences. By comparing the historical user behavior sequences and the baseline user behavior sequences, the distribution information of the behavior sequences is determined. This allows for anomaly detection of real-time received user behavior data, based on the behavior sequence distribution information and the baseline user behavior sequences, thereby determining the operational status of the target system. By determining whether the user behavior sequence is blocked or abnormal, the method can detect complex systems, reducing missed and false detections, improving detection accuracy, and enabling timely repair of abnormal systems to ensure a normal user experience.

[0145] Figure 5 A flowchart of another system detection method provided according to an embodiment of this specification is shown, including steps 502 to 508.

[0146] Step 502: Obtain the historical user behavior sequence associated with the target system, and generate a directed user behavior graph based on the historical user behavior sequence.

[0147] Step 504: Determine the cyclic behavior nodes based on the connection information corresponding to each behavior node in the directed graph of user behavior, and remove the cyclic behavior nodes.

[0148] Step 506: Obtain the updated directed graph of user behavior based on the processing results.

[0149] Step 508: Generate a baseline user behavior sequence corresponding to the historical user behavior sequence based on the updated directed user behavior graph.

[0150] Optionally, step 504 further includes: generating a directed graph of user behavior based on the execution information of each historical user behavior in the historical user behavior sequence; obtaining the connection information corresponding to each behavior node in the directed graph of user behavior; and determining cyclic behavior nodes and sequential behavior nodes based on the node connection relationships in each connection information.

[0151] Optionally, step 504 further includes: updating the node connection weights between the cyclic behavior nodes and the sequential behavior nodes, and removing the node connection relationships between the cyclic behavior nodes; obtaining an updated directed graph of user behavior based on the update result, and generating a baseline user behavior sequence corresponding to the historical user behavior sequence based on the updated directed graph of user behavior.

[0152] Optionally, step 504 further includes: forming target behavior nodes based on the cyclic behavior nodes; calculating and updating the node connection weights between the target behavior nodes and the sequential behavior nodes based on the node connection weights corresponding to each node connection relationship in the target behavior nodes; determining the node connection relationships to be deleted based on the node connection weights corresponding to each node connection relationship in the target behavior nodes, and removing the node connection relationships to be deleted; correspondingly, obtaining the updated directed graph of user behavior based on the update results includes: generating the updated directed graph of user behavior based on the update results and the removal results.

[0153] Optionally, the method further includes: determining duplicate user behaviors in the historical user behavior sequence and performing deduplication processing on the duplicate user behaviors; obtaining a deduplicated historical user behavior sequence based on the processing result; and correspondingly, determining a baseline user behavior sequence corresponding to the historical user behavior sequence, including: determining a baseline user behavior sequence corresponding to the deduplicated historical user behavior sequence.

[0154] This specification provides a system detection method, comprising: acquiring historical user behavior sequences associated with a target system, and generating a directed user behavior graph based on the historical user behavior sequences; determining cyclic behavior nodes based on the connection information corresponding to each behavior node in the directed user behavior graph, and removing the cyclic behavior nodes; obtaining an updated directed user behavior graph based on the processing result; and generating a baseline user behavior sequence corresponding to the historical user behavior sequences based on the updated directed user behavior graph. Generating a directed user behavior graph from historical user behavior sequences can remove cyclic user behaviors from the historical user behavior sequences, reducing a large number of loops caused by operations such as back navigation and page flipping / jumping, and deduplicating repeated user behaviors. This allows for the generation of a more accurate baseline user behavior pattern based on the updated directed user behavior graph, thereby facilitating subsequent anomaly detection of the user behavior sequence to be detected based on the baseline user behavior pattern and improving the anomaly detection accuracy.

[0155] The above is an illustrative scheme of a system detection method according to this embodiment. It should be noted that the technical solution of this system detection method belongs to the same concept as the technical solution of the system detection method described above. For details not described in detail in the technical solution of the system detection method, please refer to the description of the technical solution of the system detection method described above.

[0156] Figure 6 A flowchart of another system detection method provided according to an embodiment of this specification is shown, including steps 602 to 610.

[0157] Step 602: Obtain the historical user behavior sequence associated with the target system, and generate a directed user behavior graph based on the historical user behavior sequence.

[0158] Step 604: Determine the cyclic behavior nodes based on the connection information corresponding to each behavior node in the directed graph of user behavior, remove the cyclic behavior nodes, and obtain the updated directed graph of user behavior based on the processing result.

[0159] Step 606: Generate a baseline user behavior sequence corresponding to the historical user behavior sequence based on the updated directed graph of user behavior.

[0160] Step 608: Compare the historical user behavior sequence with the baseline user behavior sequence, and determine the behavior sequence distribution information corresponding to the historical user behavior sequence based on the comparison result.

[0161] Step 610: Based on the behavior sequence distribution information and the baseline user behavior sequence, perform anomaly detection on the user behavior sequence to be detected associated with the target system, and determine the operating status information of the target system based on the anomaly detection results.

[0162] Optionally, step 604 further includes: determining duplicate user behaviors in the historical user behavior sequence and performing deduplication processing on the duplicate user behaviors; obtaining the deduplicated historical user behavior sequence based on the processing result; correspondingly, determining the baseline user behavior sequence corresponding to the historical user behavior sequence, including: determining the baseline user behavior sequence corresponding to the deduplicated historical user behavior sequence.

[0163] Optionally, step 604 further includes: obtaining node access information corresponding to each user behavior in the historical user behavior sequence; determining duplicate user behaviors based on each node access information; and removing the duplicate user behaviors.

[0164] Optionally, step 606 further includes: obtaining a historical user behavior sequence associated with the target system; determining cyclic user behavior based on the execution information of each historical user behavior in the historical user behavior sequence; performing cyclic elimination processing on the cyclic user behavior, and obtaining a baseline user behavior sequence corresponding to the historical user behavior sequence based on the processing result.

[0165] Optionally, step 606 further includes: generating a directed graph of user behavior based on the execution information of each historical user behavior in the historical user behavior sequence; obtaining the connection information corresponding to each behavior node in the directed graph of user behavior; and determining cyclic behavior nodes and sequential behavior nodes based on the node connection relationships in each connection information.

[0166] Optionally, step 606 further includes: updating the node connection weights between the cyclic behavior nodes and the sequential behavior nodes, and removing the node connection relationships between the cyclic behavior nodes; obtaining an updated directed graph of user behavior based on the update result, and generating a baseline user behavior sequence corresponding to the historical user behavior sequence based on the updated directed graph of user behavior.

[0167] Optionally, step 606 further includes: forming target behavior nodes based on the cyclic behavior nodes; calculating and updating the node connection weights between the target behavior nodes and the sequential behavior nodes based on the node connection weights corresponding to each node connection relationship in the target behavior nodes; determining the node connection relationships to be deleted based on the node connection weights corresponding to each node connection relationship in the target behavior nodes, and removing the node connection relationships to be deleted; correspondingly, obtaining the updated directed graph of user behavior based on the update results includes: generating the updated directed graph of user behavior based on the update results and the removal results.

[0168] Optionally, step 608 further includes: comparing the historical user behavior sequence and the benchmark user behavior sequence; determining the overlapping user behaviors between the historical user behavior sequence and the benchmark user behavior sequence based on the comparison result; and calculating the behavior sequence distribution information corresponding to the historical user behavior sequence based on the overlapping user behaviors.

[0169] Optionally, step 610 further includes: encoding the baseline user behavior sequence and the user behavior sequence to be detected associated with the target system; obtaining the baseline user behavior text vector corresponding to the baseline user behavior sequence and the user behavior text vector to be detected corresponding to the user behavior sequence to be detected based on the processing result; calculating the text difference value corresponding to the user behavior sequence to be detected based on the baseline user behavior text vector and the user behavior text vector to be detected; and determining the text detection information of the target system based on the text difference value.

[0170] Optionally, step 610 further includes: comparing the user behavior sequence to be detected associated with the target system with the baseline user behavior sequence, and determining the distribution information of the user behavior sequence to be detected corresponding to the user behavior sequence to be detected based on the comparison result; calculating the distribution difference value between the distribution information of the behavior sequence corresponding to the historical user behavior sequence and the distribution information of the user behavior sequence to be detected; and accordingly, determining the operating status information of the target system based on the anomaly detection result, including: determining the operating status information of the target system based on the distribution difference value.

[0171] Optionally, the method further includes: determining duplicate user behaviors in the historical user behavior sequence and duplicate user behaviors to be detected in the user behavior sequence to be detected; determining historical duplicate behavior distribution information corresponding to the historical user behavior sequence based on the duplicate user behaviors, and determining duplicate behavior distribution information corresponding to the duplicate user behaviors to be detected based on the duplicate user behaviors to be detected; calculating a duplicate difference value based on the historical duplicate behavior distribution information and the duplicate behavior distribution information to be detected; and determining duplicate detection information of the target system based on the duplicate difference value.

[0172] This specification provides a system detection method, comprising: acquiring historical user behavior sequences associated with a target system; generating a directed user behavior graph based on the historical user behavior sequences; determining cyclic behavior nodes based on the connection information corresponding to each behavior node in the directed user behavior graph, and removing the cyclic behavior nodes, obtaining an updated directed user behavior graph based on the processing result; generating a baseline user behavior sequence corresponding to the historical user behavior sequences based on the updated directed user behavior graph; comparing the historical user behavior sequences and the baseline user behavior sequences, and determining the behavior sequence distribution information corresponding to the historical user behavior sequences based on the comparison result; performing anomaly detection on the user behavior sequences to be detected associated with the target system based on the behavior sequence distribution information and the baseline user behavior sequences, and determining the operating status information of the target system based on the anomaly detection result. This method achieves the acquisition of a baseline user behavior sequence corresponding to the historical user behavior sequences, and by comparing the historical user behavior sequences and the baseline user behavior sequences, determining the behavior sequence distribution information. This allows for anomaly detection of real-time received user behavior sequences to be detected based on the behavior sequence distribution information and the baseline user behavior sequences, thereby determining the operating status information of the target system. By judging whether the user behavior sequence is blocked or abnormal, the detection of complex systems can be completed, reducing the occurrence of missed detections and false detections, improving the detection accuracy, and enabling timely repair of abnormal systems to ensure the normal user experience.

[0173] The above is an illustrative scheme of a system detection method according to this embodiment. It should be noted that the technical solution of this system detection method belongs to the same concept as the technical solution of the system detection method described above. For details not described in detail in the technical solution of the system detection method, please refer to the description of the technical solution of the system detection method described above.

[0174] Corresponding to the above method embodiments, this specification also provides embodiments of a system detection device. Figure 7 A schematic diagram of a system detection device according to an embodiment of this specification is shown. Figure 7 As shown, the device includes:

[0175] The first determining module 702 is configured to determine a historical user behavior sequence associated with the target system and a baseline user behavior sequence corresponding to the historical user behavior sequence, wherein the baseline user behavior sequence is obtained by removing cyclic behavior sequences from the historical user behavior sequence.

[0176] The comparison module 704 is configured to compare the historical user behavior sequence with the baseline user behavior sequence, and determine the behavior sequence distribution information corresponding to the historical user behavior sequence based on the comparison result.

[0177] The detection module 706 is configured to perform anomaly detection on the user behavior sequence to be detected associated with the target system based on the behavior sequence distribution information and the baseline user behavior sequence;

[0178] The second determining module 708 is configured to determine the operating status information of the target system based on the anomaly detection results.

[0179] Optionally, the first determining module 702 is further configured to: acquire a historical user behavior sequence associated with the target system; determine a cyclic user behavior based on the execution information of each historical user behavior in the historical user behavior sequence; perform a cyclic elimination process on the cyclic user behavior, and obtain a baseline user behavior sequence corresponding to the historical user behavior sequence based on the processing result.

[0180] Optionally, the first determining module 702 is further configured to: generate a directed graph of user behavior based on the execution information of each historical user behavior in the historical user behavior sequence; obtain the connection information corresponding to each behavior node in the directed graph of user behavior; and determine cyclic behavior nodes and sequential behavior nodes based on the node connection relationship in each connection information.

[0181] Optionally, the first determining module 702 is further configured to: update the node connection weights between the cyclic behavior nodes and the sequential behavior nodes, and remove the node connection relationships between the cyclic behavior nodes; obtain an updated directed graph of user behavior based on the update result, and generate a baseline user behavior sequence corresponding to the historical user behavior sequence based on the updated directed graph of user behavior.

[0182] Optionally, the first determining module 702 is further configured to: form target behavior nodes based on the cyclic behavior nodes; calculate and update the node connection weights between the target behavior nodes and the sequential behavior nodes based on the node connection weights corresponding to each node connection relationship in the target behavior nodes; determine the node connection relationships to be deleted based on the node connection weights corresponding to each node connection relationship in the target behavior nodes, and perform removal processing on the node connection relationships to be deleted; correspondingly, obtain the updated user behavior directed graph based on the update results, including: generating the updated user behavior directed graph based on the update results and removal results.

[0183] Optionally, the device further includes a deduplication module, configured to: determine duplicate user behaviors in the historical user behavior sequence and perform deduplication processing on the duplicate user behaviors; obtain a deduplicated historical user behavior sequence based on the processing result; and correspondingly, determine a baseline user behavior sequence corresponding to the historical user behavior sequence, including: determining a baseline user behavior sequence corresponding to the deduplicated historical user behavior sequence.

[0184] Optionally, the deduplication module is further configured to: obtain node access information corresponding to each user behavior in the historical user behavior sequence; determine duplicate user behaviors based on each node access information; and remove the duplicate user behaviors.

[0185] Optionally, the comparison module 704 is further configured to: compare the historical user behavior sequence and the benchmark user behavior sequence; determine the overlapping user behaviors between the historical user behavior sequence and the benchmark user behavior sequence based on the comparison result; and calculate the behavior sequence distribution information corresponding to the historical user behavior sequence based on the overlapping user behaviors.

[0186] Optionally, the detection module 706 is further configured to: encode the baseline user behavior sequence and the user behavior sequence to be detected associated with the target system; obtain the baseline user behavior text vector corresponding to the baseline user behavior sequence and the user behavior text vector to be detected corresponding to the user behavior sequence to be detected based on the processing result; calculate the text difference value corresponding to the user behavior sequence to be detected based on the baseline user behavior text vector and the user behavior text vector to be detected; and determine the text detection information of the target system based on the text difference value.

[0187] Optionally, the detection module 706 is further configured to: compare the user behavior sequence to be detected associated with the target system with the baseline user behavior sequence, and determine the distribution information of the user behavior sequence to be detected corresponding to the user behavior sequence to be detected based on the comparison result; calculate the distribution difference value between the distribution information of the behavior sequence corresponding to the historical user behavior sequence and the distribution information of the user behavior sequence to be detected; and accordingly, determine the operating status information of the target system based on the anomaly detection result, including: determining the operating status information of the target system based on the distribution difference value.

[0188] Optionally, the device further includes a duplicate detection module, configured to: determine duplicate user behaviors in the historical user behavior sequence and duplicate user behaviors to be detected in the user behavior sequence to be detected; determine historical duplicate behavior distribution information corresponding to the historical user behavior sequence based on the duplicate user behaviors, and determine duplicate behavior distribution information corresponding to the duplicate user behaviors to be detected based on the duplicate user behaviors to be detected; calculate a duplicate difference value based on the historical duplicate behavior distribution information and the duplicate behavior distribution information to be detected; and determine duplicate detection information of the target system based on the duplicate difference value.

[0189] This specification provides a system detection device, comprising: a first determining module configured to determine a historical user behavior sequence associated with a target system and a baseline user behavior sequence corresponding to the historical user behavior sequence, wherein the baseline user behavior sequence is obtained by removing cyclic behavior sequences from the historical user behavior sequence; a comparison module configured to compare the historical user behavior sequence and the baseline user behavior sequence, and determine behavior sequence distribution information corresponding to the historical user behavior sequence based on the comparison result; a detection module configured to perform anomaly detection on the user behavior sequence to be detected associated with the target system based on the behavior sequence distribution information and the baseline user behavior sequence; and a second determining module configured to determine the operating status information of the target system based on the anomaly detection result. This device achieves the goal of obtaining a baseline user behavior sequence corresponding to a historical user behavior sequence based on the historical user behavior sequence, determining the behavior sequence distribution information by comparing the historical user behavior sequence and the baseline user behavior sequence, and thus performing anomaly detection on the real-time received user behavior to be detected based on the behavior sequence distribution information and the baseline user behavior sequence, thereby determining the operating status information of the target system. By judging whether the user behavior sequence is blocked or abnormal, the detection of complex systems can be completed, reducing the occurrence of missed detections and false detections, improving the detection accuracy, and enabling timely repair of abnormal systems to ensure the normal user experience.

[0190] The above is a schematic scheme of a system testing device according to this embodiment. It should be noted that the technical solution of this system testing device and the technical solution of the above-described system testing method belong to the same concept. For details not described in detail in the technical solution of the system testing device, please refer to the description of the technical solution of the above-described system testing method.

[0191] Corresponding to the above method embodiments, this specification also provides embodiments of a system detection device. Figure 8 A schematic diagram of a system detection device according to an embodiment of this specification is shown. Figure 8 As shown, the device includes:

[0192] The first generation module 802 is configured to acquire historical user behavior sequences associated with the target system and generate a directed user behavior graph based on the historical user behavior sequences.

[0193] The elimination module 804 is configured to determine the cyclic behavior node based on the connection information corresponding to each behavior node in the directed graph of user behavior, and to eliminate the cyclic behavior node.

[0194] Module 806 is configured to obtain an updated directed graph of user behavior based on the processing results.

[0195] The second generation module 808 is configured to generate a baseline user behavior sequence corresponding to the historical user behavior sequence based on the updated directed user behavior graph.

[0196] Optionally, the elimination module 804 is further configured to: generate a directed graph of user behavior based on the execution information of each historical user behavior in the historical user behavior sequence; obtain the connection information corresponding to each behavior node in the directed graph of user behavior; and determine cyclic behavior nodes and sequential behavior nodes based on the node connection relationship in each connection information.

[0197] Optionally, the elimination module 804 is further configured to: update the node connection weights between the cyclic behavior nodes and the sequential behavior nodes, and eliminate the node connection relationships between the cyclic behavior nodes; obtain an updated directed graph of user behavior based on the update result, and generate a baseline user behavior sequence corresponding to the historical user behavior sequence based on the updated directed graph of user behavior.

[0198] Optionally, the elimination module 804 is further configured to: form target behavior nodes based on the cyclic behavior nodes; calculate and update the node connection weights between the target behavior nodes and the sequential behavior nodes based on the node connection weights corresponding to each node connection relationship in the target behavior nodes; determine the node connection relationships to be deleted based on the node connection weights corresponding to each node connection relationship in the target behavior nodes, and perform elimination processing on the node connection relationships to be deleted; correspondingly, obtain the updated user behavior directed graph based on the update results, including: generating the updated user behavior directed graph based on the update results and elimination results.

[0199] Optionally, the device further includes a deduplication module, configured to: determine duplicate user behaviors in the historical user behavior sequence and perform deduplication processing on the duplicate user behaviors; obtain a deduplicated historical user behavior sequence based on the processing result; and correspondingly, determine a baseline user behavior sequence corresponding to the historical user behavior sequence, including: determining a baseline user behavior sequence corresponding to the deduplicated historical user behavior sequence.

[0200] This specification provides a system detection device comprising: a first generation module configured to acquire historical user behavior sequences associated with a target system and generate a directed user behavior graph based on the historical user behavior sequences; a removal module configured to determine cyclic behavior nodes based on the connection information corresponding to each behavior node in the directed user behavior graph and remove the cyclic behavior nodes; an acquisition module configured to obtain an updated directed user behavior graph based on the processing results; and a second generation module configured to generate a baseline user behavior sequence corresponding to the historical user behavior sequences based on the updated directed user behavior graph. Generating a directed user behavior graph from historical user behavior sequences can remove cyclic user behaviors from the historical user behavior sequences, reducing a large number of loops caused by operations such as backing up and page flipping / jumping, and deduplicating repeated user behaviors. This allows for the generation of a more accurate baseline user behavior pattern based on the updated directed user behavior graph, thereby facilitating subsequent anomaly detection of the user behavior sequence to be detected based on the baseline user behavior pattern and improving the anomaly detection accuracy.

[0201] The above is a schematic scheme of a system testing device according to this embodiment. It should be noted that the technical solution of this system testing device and the technical solution of the above-described system testing method belong to the same concept. For details not described in detail in the technical solution of the system testing device, please refer to the description of the technical solution of the above-described system testing method.

[0202] Corresponding to the above method embodiments, this specification also provides embodiments of a system detection device. Figure 9A schematic diagram of a system detection device according to an embodiment of this specification is shown. Figure 9 As shown, the device includes:

[0203] The first generation module 902 is configured to acquire a historical user behavior sequence associated with the target system and generate a directed user behavior graph based on the historical user behavior sequence.

[0204] The module 904 is configured to determine the cyclic behavior nodes based on the connection information corresponding to each behavior node in the directed graph of user behavior, remove the cyclic behavior nodes, and obtain the updated directed graph of user behavior based on the processing result.

[0205] The second generation module 906 is configured to generate a baseline user behavior sequence corresponding to the historical user behavior sequence based on the updated user behavior directed graph.

[0206] The comparison module 908 is configured to compare the historical user behavior sequence with the baseline user behavior sequence, and determine the behavior sequence distribution information corresponding to the historical user behavior sequence based on the comparison result.

[0207] The detection module 910 is configured to perform anomaly detection on the user behavior sequence to be detected associated with the target system based on the behavior sequence distribution information and the baseline user behavior sequence, and determine the operating status information of the target system based on the anomaly detection results.

[0208] Optionally, the obtaining module 904 is further configured to: determine duplicate user behaviors in the historical user behavior sequence and perform deduplication processing on the duplicate user behaviors; obtain the deduplicated historical user behavior sequence based on the processing result; correspondingly, determine the baseline user behavior sequence corresponding to the historical user behavior sequence, including: determining the baseline user behavior sequence corresponding to the deduplicated historical user behavior sequence.

[0209] Optionally, the obtaining module 904 is further configured to: obtain node access information corresponding to each user behavior in the historical user behavior sequence; determine duplicate user behaviors based on each node access information, and remove the duplicate user behaviors.

[0210] Optionally, the second generation module 906 is further configured to: obtain a historical user behavior sequence associated with the target system; determine a cyclic user behavior based on the execution information of each historical user behavior in the historical user behavior sequence; perform a cyclic elimination process on the cyclic user behavior, and obtain a baseline user behavior sequence corresponding to the historical user behavior sequence based on the processing result.

[0211] Optionally, the second generation module 906 is further configured to: generate a directed graph of user behavior based on the execution information of each historical user behavior in the historical user behavior sequence; obtain the connection information corresponding to each behavior node in the directed graph of user behavior; and determine cyclic behavior nodes and sequential behavior nodes based on the node connection relationship in each connection information.

[0212] Optionally, the second generation module 906 is further configured to: update the node connection weights between the cyclic behavior nodes and the sequential behavior nodes, and remove the node connection relationships between the cyclic behavior nodes; obtain an updated directed graph of user behavior based on the update result, and generate a baseline user behavior sequence corresponding to the historical user behavior sequence based on the updated directed graph of user behavior.

[0213] Optionally, the second generation module 906 is further configured to: form target behavior nodes based on the cyclic behavior nodes; calculate and update the node connection weights between the target behavior nodes and the sequential behavior nodes based on the node connection weights corresponding to each node connection relationship in the target behavior nodes; determine the node connection relationships to be deleted based on the node connection weights corresponding to each node connection relationship in the target behavior nodes, and perform removal processing on the node connection relationships to be deleted; correspondingly, obtain the updated user behavior directed graph based on the update results, including: generating the updated user behavior directed graph based on the update results and removal results.

[0214] Optionally, the comparison module 908 is further configured to: compare the historical user behavior sequence and the benchmark user behavior sequence; determine the overlapping user behaviors between the historical user behavior sequence and the benchmark user behavior sequence based on the comparison result; and calculate the behavior sequence distribution information corresponding to the historical user behavior sequence based on the overlapping user behaviors.

[0215] Optionally, the detection module 910 is further configured to: encode the baseline user behavior sequence and the user behavior sequence to be detected associated with the target system; obtain the baseline user behavior text vector corresponding to the baseline user behavior sequence and the user behavior text vector to be detected corresponding to the user behavior sequence to be detected based on the processing result; calculate the text difference value corresponding to the user behavior sequence to be detected based on the baseline user behavior text vector and the user behavior text vector to be detected; and determine the text detection information of the target system based on the text difference value.

[0216] Optionally, the detection module 910 is further configured to: compare the user behavior sequence to be detected associated with the target system with the baseline user behavior sequence, and determine the distribution information of the user behavior sequence to be detected corresponding to the user behavior sequence to be detected based on the comparison result; calculate the distribution difference value between the distribution information of the behavior sequence corresponding to the historical user behavior sequence and the distribution information of the user behavior sequence to be detected; and accordingly, determine the operating status information of the target system based on the anomaly detection result, including: determining the operating status information of the target system based on the distribution difference value.

[0217] Optionally, the device further includes a duplicate detection module, configured to: determine duplicate user behaviors in the historical user behavior sequence and duplicate user behaviors to be detected in the user behavior sequence to be detected; determine historical duplicate behavior distribution information corresponding to the historical user behavior sequence based on the duplicate user behaviors, and determine duplicate behavior distribution information corresponding to the duplicate user behaviors to be detected based on the duplicate user behaviors to be detected; calculate a duplicate difference value based on the historical duplicate behavior distribution information and the duplicate behavior distribution information to be detected; and determine duplicate detection information of the target system based on the duplicate difference value.

[0218] This specification provides a system detection method comprising: a first generation module configured to acquire historical user behavior sequences associated with a target system and generate a directed user behavior graph based on the historical user behavior sequences; an acquisition module configured to determine cyclic behavior nodes based on the connection information corresponding to each behavior node in the directed user behavior graph, remove the cyclic behavior nodes, and obtain an updated directed user behavior graph based on the processing result; a second generation module configured to generate a baseline user behavior sequence corresponding to the historical user behavior sequences based on the updated directed user behavior graph; a comparison module configured to compare the historical user behavior sequences and the baseline user behavior sequences, and determine the behavior sequence distribution information corresponding to the historical user behavior sequences based on the comparison result; and a detection module configured to perform anomaly detection on the user behavior sequences to be detected associated with the target system based on the behavior sequence distribution information and the baseline user behavior sequences, and determine the operating status information of the target system based on the anomaly detection result. This system achieves the acquisition of a baseline user behavior sequence based on historical user behavior sequences. By comparing the historical and baseline user behavior sequences, the distribution information of the behavior sequences is determined. This allows for anomaly detection of real-time received user behavior, based on the behavior sequence distribution and the baseline user behavior sequence, thereby determining the operational status of the target system. By determining whether the user behavior sequence is blocked or abnormal, the system can detect complex systems, reducing false positives and missed detections, improving detection accuracy, and enabling timely repair of abnormal systems to ensure a normal user experience.

[0219] The above is a schematic scheme of a system testing device according to this embodiment. It should be noted that the technical solution of this system testing device and the technical solution of the above-described system testing method belong to the same concept. For details not described in detail in the technical solution of the system testing device, please refer to the description of the technical solution of the above-described system testing method.

[0220] Figure 10 A structural block diagram of a computing device 1000 according to an embodiment of this specification is shown. The components of the computing device 1000 include, but are not limited to, a memory 1010 and a processor 1020. The processor 1020 is connected to the memory 1010 via a bus 1030, and a database 1050 is used to store data.

[0221] The computing device 1000 also includes an access device 1040, which enables the computing device 1000 to communicate via one or more networks 1060. Examples of these networks include a Public Switched Telephone Network (PSTN), a Local Area Network (LAN), a Wide Area Network (WAN), a Personal Area Network (PAN), or a combination of communication networks such as the Internet. The access device 1040 may include one or more of any type of wired or wireless network interface (e.g., a Network Interface Card (NIC)), such as an IEEE 802.11 Wireless Local Area Network (WLAN) interface, a Wi-MAX interface, an Ethernet interface, a Universal Serial Bus (USB) interface, a cellular network interface, a Bluetooth interface, a Near Field Communication (NFC) interface, and so on.

[0222] In one embodiment of this specification, the above-described components of the computing device 1000 and Figure 10 Other components, not shown, can also be connected to each other, for example, via a bus. It should be understood that... Figure 10 The block diagram of the computing device shown is for illustrative purposes only and is not intended to limit the scope of this specification. Those skilled in the art can add or replace other components as needed.

[0223] The computing device 1000 can be any type of stationary or mobile computing device, including mobile computers or mobile computing devices (e.g., tablet computers, personal digital assistants, laptop computers, notebook computers, netbooks, etc.), mobile phones (e.g., smartphones), wearable computing devices (e.g., smartwatches, smart glasses, etc.) or other types of mobile devices, or stationary computing devices such as desktop computers or PCs. The computing device 1000 can also be a mobile or stationary server.

[0224] The processor 1020 executes the computer instructions to implement the steps of the system detection method.

[0225] The above is an illustrative scheme of a computing device according to this embodiment. It should be noted that the technical solution of this computing device and the technical solution of the system detection method described above belong to the same concept. For details not described in detail in the technical solution of the computing device, please refer to the description of the technical solution of the system detection method described above.

[0226] An embodiment of this specification also provides a computer-readable storage medium storing computer instructions that, when executed by a processor, implement the steps of the system detection method as described above.

[0227] The above is an illustrative scheme of a computer-readable storage medium according to this embodiment. It should be noted that the technical solution of this storage medium and the technical solution of the system detection method described above belong to the same concept. For details not described in detail in the technical solution of the storage medium, please refer to the description of the technical solution of the system detection method described above.

[0228] An embodiment of this specification also provides a computer program, wherein when the computer program is executed in a computer, it causes the computer to perform the steps of the above-described system detection method.

[0229] The above is an illustrative example of a computer program according to this embodiment. It should be noted that the technical solution of this computer program and the technical solution of the system detection method described above belong to the same concept. Details not described in detail in the computer program's technical solution can be found in the description of the technical solution of the system detection method described above.

[0230] The foregoing has described specific embodiments of this specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recited in the claims may be performed in a different order than that shown in the embodiments and may still achieve the desired result. Furthermore, the processes depicted in the drawings do not necessarily require the specific or sequential order shown to achieve the desired result. In some embodiments, multitasking and parallel processing are possible or may be advantageous.

[0231] The computer instructions include computer program code, which may be in the form of source code, object code, executable file, or some intermediate form. The computer-readable medium may include: any entity or device capable of carrying the computer program code, recording media, USB flash drive, portable hard drive, magnetic disk, optical disk, computer memory, read-only memory (ROM), random access memory (RAM), electrical carrier signals, telecommunication signals, and software distribution media, etc. It should be noted that the content included in the computer-readable medium may be appropriately added to or subtracted according to the requirements of legislation and patent practice in the jurisdiction. For example, in some jurisdictions, according to legislation and patent practice, computer-readable media may not include electrical carrier signals and telecommunication signals.

[0232] It should be noted that, for the sake of simplicity, the foregoing method embodiments are all described as a series of actions. However, those skilled in the art should understand that the embodiments in this specification are not limited to the described order of actions, because according to the embodiments in this specification, some steps can be performed in other orders or simultaneously. Furthermore, those skilled in the art should also understand that the embodiments described in this specification are all preferred embodiments, and the actions and modules involved are not necessarily essential to the embodiments in this specification.

[0233] In the above embodiments, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0234] The preferred embodiments disclosed above are merely illustrative of this specification. The optional embodiments do not exhaustively describe all details, nor do they limit the invention to the specific implementations described. Clearly, many modifications and variations can be made based on the embodiments described herein. These embodiments are selected and specifically described in this specification to better explain the principles and practical applications of the embodiments, thereby enabling those skilled in the art to better understand and utilize this specification. This specification is limited only by the claims and their full scope and equivalents.

Claims

1. A system detection method, comprising: Determine the historical user behavior sequence associated with the target system and the baseline user behavior sequence corresponding to the historical user behavior sequence, wherein the baseline user behavior sequence is obtained by performing a loop elimination process on the loop behavior sequence in the historical user behavior sequence, and the loop elimination process is to delete the execution order of the loop jumps associated between loop user behaviors; Compare the historical user behavior sequence with the baseline user behavior sequence, and determine the behavior sequence distribution information corresponding to the historical user behavior sequence based on the comparison result; The target system is associated with a sequence of user behaviors to be detected and a baseline sequence of user behaviors. Based on the comparison results, the distribution information of the user behaviors to be detected corresponding to the sequence of user behaviors to be detected is determined. Calculate the distribution difference between the distribution information of the behavior sequence corresponding to the historical user behavior sequence and the distribution information of the behavior sequence to be detected corresponding to the user behavior sequence to be detected; The operating status information of the target system is determined based on the distribution difference value.

2. The method as described in claim 1, wherein determining the historical user behavior sequence associated with the target system and the baseline user behavior sequence corresponding to the historical user behavior sequence comprises: Obtain the historical user behavior sequence associated with the target system; Based on the execution information of each historical user behavior in the historical user behavior sequence, the cyclical user behavior is determined; The cyclical user behavior is cyclically eliminated, and the baseline user behavior sequence corresponding to the historical user behavior sequence is obtained based on the processing result.

3. The method as described in claim 2, wherein determining cyclical user behavior based on the execution information of each historical user behavior in the historical user behavior sequence includes: Based on the execution information of each historical user behavior in the historical user behavior sequence, a directed graph of user behavior is generated; Obtain the connection information corresponding to each behavior node in the directed graph of user behavior; Based on the node connection relationships in each connection information, determine the cyclic behavior nodes and the sequential behavior nodes.

4. The method as described in claim 3, wherein the cyclical user behavior is subjected to cyclical elimination processing, and a baseline user behavior sequence corresponding to the historical user behavior sequence is obtained based on the processing result, comprising: The node connection weights between the cyclic behavior nodes and the sequential behavior nodes are updated, and the node connection relationships between the cyclic behavior nodes are removed. Based on the update results, an updated directed graph of user behavior is obtained, and a baseline user behavior sequence corresponding to the historical user behavior sequence is generated based on the updated directed graph of user behavior.

5. The method as described in claim 4, wherein updating the node connection weights between the cyclic behavior nodes and the sequential behavior nodes, and removing the node connection relationships between the cyclic behavior nodes, comprises: The target behavior node is formed based on the described cyclic behavior nodes; Based on the node connection weights corresponding to each node connection relationship in the target behavior node, calculate and update the node connection weights between the target behavior node and the sequential behavior node; Based on the node connection weight corresponding to each node connection relationship in the target behavior node, the node connection relationship to be deleted is determined, and the node connection relationship to be deleted is removed. Accordingly, the updated directed graph of user behavior is obtained based on the update results, including: Generate an updated directed graph of user behavior based on the update and removal results.

6. The method of claim 1, before determining the baseline user behavior sequence corresponding to the historical user behavior sequence, the method further includes: Identify duplicate user behaviors in the historical user behavior sequence and perform deduplication on the duplicate user behaviors; Based on the processing results, obtain the deduplicated historical user behavior sequence; Accordingly, determining the baseline user behavior sequence corresponding to the historical user behavior sequence includes: Determine the baseline user behavior sequence corresponding to the deduplicated historical user behavior sequence.

7. The method of claim 6, wherein determining duplicate user behaviors in the historical user behavior sequence and performing deduplication processing on the duplicate user behaviors includes: Obtain the node access information corresponding to each user behavior in the historical user behavior sequence; Duplicate user behaviors are identified based on the access information of each node, and these duplicate user behaviors are then removed.

8. The method as described in claim 1, wherein comparing the historical user behavior sequence with the baseline user behavior sequence, and determining the behavior sequence distribution information corresponding to the historical user behavior sequence based on the comparison result, includes: Compare the historical user behavior sequence with the baseline user behavior sequence; Based on the comparison results, the overlapping user behaviors between the historical user behavior sequence and the baseline user behavior sequence are determined. The distribution information of the behavior sequence corresponding to the historical user behavior sequence is calculated based on the overlapping user behaviors.

9. The method of claim 1, further comprising: The baseline user behavior sequence and the target system-associated user behavior sequence to be detected are encoded. Based on the processing results, the baseline user behavior text vector corresponding to the baseline user behavior sequence and the user behavior text vector to be detected corresponding to the user behavior sequence to be detected are obtained. Calculate the text difference value corresponding to the user behavior sequence to be detected based on the baseline user behavior text vector and the user behavior text vector to be detected. The text detection information of the target system is determined based on the text difference values.

10. The method of claim 1, further comprising: Identify duplicate user behaviors in the historical user behavior sequence, and duplicate user behaviors to be detected in the user behavior sequence to be detected; Based on the repeated user behavior, determine the historical repeated behavior distribution information corresponding to the historical user behavior sequence, and based on the repeated behavior to be detected, determine the repeated behavior distribution information corresponding to the repeated user behavior to be detected. Calculate the repetition difference value based on the historical repetitive behavior distribution information and the repetitive behavior distribution information to be detected; The repeatability information of the target system is determined based on the repeatability difference value.

11. A system detection method, comprising: Obtain the historical user behavior sequence associated with the target system, and generate a directed user behavior graph based on the historical user behavior sequence; Based on the connection information corresponding to each behavior node in the directed graph of user behavior, cyclic behavior nodes are determined and the cyclic behavior nodes are removed. The updated directed graph of user behavior is obtained based on the processing results; A baseline user behavior sequence corresponding to the historical user behavior sequence is generated based on the updated directed graph of user behavior.

12. A system detection method, comprising: Obtain the historical user behavior sequence associated with the target system, and generate a directed user behavior graph based on the historical user behavior sequence; Based on the connection information corresponding to each behavior node in the directed graph of user behavior, cyclic behavior nodes are determined and removed. An updated directed graph of user behavior is obtained based on the processing result. Based on the updated directed graph of user behavior, a baseline user behavior sequence corresponding to the historical user behavior sequence is generated. Compare the historical user behavior sequence with the baseline user behavior sequence, and determine the behavior sequence distribution information corresponding to the historical user behavior sequence based on the comparison result; The target system is associated with a sequence of user behaviors to be detected and a baseline sequence of user behaviors. Based on the comparison results, the distribution information of the user behaviors to be detected corresponding to the sequence of user behaviors to be detected is determined. Calculate the distribution difference between the distribution information of the behavior sequence corresponding to the historical user behavior sequence and the distribution information of the behavior sequence to be detected corresponding to the user behavior sequence to be detected; The operating status information of the target system is determined based on the distribution difference value.

13. A computing device comprising a memory, a processor, and computer instructions stored in the memory and executable on the processor, wherein the processor, when executing the computer instructions, performs the steps of the method according to any one of claims 1-12.

14. A computer-readable storage medium storing computer-executable instructions that, when executed by a processor, implement the steps of the method according to any one of claims 1-12.

Images