A service detection method, device, electronic device and storage medium

Abstract

Embodiments of the present invention provide a service detection method, apparatus, electronic device, and storage medium, relating to the field of network technology. The method includes: obtaining the number of service requests at risk for a target service within a first historical time period as a first actual number; calculating the number of service requests at risk for the target service within the first historical time period as a first predicted number based on the changing trend of the number of service requests at risk for the target service in other historical time periods before the first historical time period; if the first actual number is outside the predicted number interval, determining that the target service is abnormal within the first historical time period; wherein the center point of the predicted number interval is determined based on the first predicted number. In this way, the accuracy of service detection can be improved.

Description

Technical Field

[0001] The present invention relates to the field of network technology, and in particular to a service detection method, device, electronic equipment and storage medium. Background Art

[0002] With the advancement of network technology, network servers serving users can now offer multiple services. To maintain network security, network servers must determine whether each service is abnormal. For example, if an unauthorized user attacks a particular service, the number of service requests for that service may increase.

[0003] In the related art, for a certain service, when a significant change is detected in the number of service requests for the service, it indicates that the service may be attacked by illegal users, and the service can be determined to be abnormal. However, for a certain service, even if it is not attacked, some seasonal or periodic events can also cause a significant change in the number of service requests for the service. For example, when a new movie is released, the number of service requests for the movie search service will also increase in a short period of time, causing a significant change in the number of service requests for the service. At this time, since the related art only uses the number of service requests as the criterion for detecting whether a service is abnormal, it may be determined that the service is attacked by illegal users, that is, the service is determined to be abnormal, which accordingly leads to low accuracy in the service detection results. Summary of the Invention

[0004] The purpose of the embodiments of the present invention is to provide a service detection method, device, electronic device, and storage medium to improve the accuracy of service detection. The specific technical solution is as follows:

[0005] In a first aspect of the present invention, a service detection method is provided, the method comprising:

[0006] Obtaining the number of business requests with risks for the target business during the first historical time period as a first real number;

[0007] Calculating the number of risky business requests for the target business in the first historical time period as a first predicted number based on a change trend in the number of risky business requests for the target business in other historical time periods before the first historical time period;

[0008] If the first actual number is outside the predicted number interval, it is determined that the target business is abnormal within the first historical time period; wherein the center point of the predicted number interval is determined based on the first predicted number.

[0009] In some embodiments, calculating the number of risky business requests for the target business in the first historical time period as the first predicted number based on a change trend in the number of risky business requests for the target business in other historical time periods before the first historical time period includes:

[0010] Calculate, based on the year-on-year actual number corresponding to the first historical time period and / or the month-on-month actual number corresponding to the first historical time period, the number of business requests with risks for the target business in the first historical time period as a first predicted number;

[0011] The year-on-year actual number corresponding to the first historical time period represents: the number of business requests with risks for the target business in each year-on-year historical time period corresponding to the first historical time period; each year-on-year historical time period is located in another detection period before the detection period to which the first historical time period belongs, and has the same relative time sequence position as the first historical time period in the detection period to which it belongs;

[0012] The actual year-on-year number corresponding to the first historical time period represents: the number of business requests at risk for the target business in each year-on-year historical time period corresponding to the first historical time period; each year-on-year historical time period is located before the first historical time period and is adjacent to the first historical time period.

[0013] In some embodiments, the predicted number interval includes: a first predicted number interval and a second predicted number interval; the first predicted number includes: a first year-on-year predicted number and a first quarter-on-quarter predicted number;

[0014] The center point of the first predicted number interval represents the average level of the first year-on-year predicted number and each second year-on-year predicted number. The first year-on-year predicted number is the number of business requests at risk for the target business during the first historical time period, as predicted based on the actual year-on-year number corresponding to the first historical time period. Each second year-on-year predicted number is the number of business requests at risk for the target business during each year-on-year historical time period.

[0015] The center point of the second predicted number interval represents: an average level of the first month-on-month predicted number and each second month-on-month predicted number; the first month-on-month predicted number is: the number of business requests with risks for the target business in the first historical time period, as predicted based on the actual month-on-month number corresponding to the first historical time period; each second month-on-month predicted number is: the predicted number of business requests with risks for the target business in each month-on-month historical time period;

[0016] If the first actual number is outside the predicted number interval, determining that the target business is abnormal within the first historical time period includes:

[0017] If the first actual number is outside the first predicted number interval and outside the second predicted number interval, it is determined that the target business is abnormal within the first historical time period.

[0018] In some embodiments, the center point of the first prediction number interval is the mean of the first year-on-year prediction number and the second year-on-year prediction numbers, and the size of the first prediction number interval is: a first specified multiple of a first standard deviation; wherein the first standard deviation is the standard deviation of the first year-on-year prediction number and the second year-on-year prediction numbers;

[0019] And / or, the center point of the second prediction number interval is the mean of the first month-on-month prediction number and the second month-on-month prediction numbers, and the size of the second prediction number interval is: the second specified multiple of the second standard deviation; wherein, the second standard deviation is the standard deviation of the first month-on-month prediction number and the second month-on-month prediction numbers.

[0020] In some embodiments, calculating the number of risky business requests for the target business in the first historical time period based on the year-on-year actual number corresponding to the first historical time period and / or the month-on-month actual number corresponding to the first historical time period as the first predicted number includes:

[0021] Performing a forecast based on the first actual number and the actual year-on-year number corresponding to the first historical time period to obtain the first year-on-year forecast number and the second year-on-year forecast numbers;

[0022] Based on the first real number and the month-on-month real number corresponding to the first historical time period, a prediction is made to obtain the first month-on-month predicted number and the second month-on-month predicted numbers.

[0023] In some embodiments, calculating the number of risky business requests for the target business in the first historical time period as the first predicted number based on a change trend in the number of risky business requests for the target business in other historical time periods before the first historical time period includes:

[0024] The number of business requests that are at risk for the target business in other historical time periods before the first historical time period is input into a time series model for predicting the number of business requests, and the number of business requests that are at risk for the target business in the first historical time period is obtained as a first predicted number.

[0025] In some embodiments, before calculating the number of risky business requests for the target business in the first historical time period based on the year-on-year actual number corresponding to the first historical time period and / or the month-on-month actual number corresponding to the first historical time period as the first predicted number, the method further includes:

[0026] Determining whether the first real number satisfies any one of the preset screening conditions;

[0027] Among them, the preset screening conditions include: the first real number is within a first real number interval, the first real number is within a second real number interval, and the first real number is less than a preset threshold; the center point of the first real number interval is the mean of the year-on-year real number corresponding to the first historical time period, and the size of the first real number interval is: a third specified multiple of the third standard deviation; the third standard deviation is the standard deviation of the year-on-year real number corresponding to the first historical time period; the center point of the second real number interval is the mean of the month-on-month real number corresponding to the first historical time period, and the size of the second real number interval is: a fourth specified multiple of the fourth standard deviation; the fourth standard deviation is the standard deviation of the month-on-month real number corresponding to the first historical time period;

[0028] If not, execute the step of calculating the number of business requests at risk for the target business within the first historical time period based on the year-on-year actual number corresponding to the first historical time period and / or the quarter-on-quarter actual number corresponding to the first historical time period as the first predicted number.

[0029] In some embodiments, the method further comprises:

[0030] If the first true number is outside the predicted number interval, the first true number is displayed.

[0031] In a second aspect of the present invention, a service detection device is provided, comprising:

[0032] A first real number acquisition module is configured to acquire the number of business requests with risks for a target business within a first historical time period as a first real number;

[0033] a first predicted number acquisition module, configured to calculate the number of business requests at risk for the target business in the first historical time period as a first predicted number based on a changing trend of the number of business requests at risk for the target business in other historical time periods before the first historical time period;

[0034] An anomaly detection module is used to determine that the target business is abnormal within the first historical time period if the first actual number is outside the predicted number interval; wherein the center point of the predicted number interval is determined based on the first predicted number.

[0035] In some embodiments, the first predicted number acquisition module includes:

[0036] A first prediction submodule is configured to calculate, as a first predicted number, the number of business requests with risks for the target business in the first historical time period based on the actual year-on-year number corresponding to the first historical time period and / or the actual month-on-month number corresponding to the first historical time period;

[0037] The year-on-year actual number corresponding to the first historical time period represents: the number of business requests with risks for the target business in each year-on-year historical time period corresponding to the first historical time period; each year-on-year historical time period is located in another detection period before the detection period to which the first historical time period belongs, and has the same relative time sequence position as the first historical time period in the detection period to which it belongs;

[0038] The actual year-on-year number corresponding to the first historical time period represents: the number of business requests at risk for the target business in each year-on-year historical time period corresponding to the first historical time period; each year-on-year historical time period is located before the first historical time period and is adjacent to the first historical time period.

[0039] In some embodiments, the predicted number interval includes: a first predicted number interval and a second predicted number interval; the first predicted number includes: a first year-on-year predicted number and a first quarter-on-quarter predicted number;

[0040] The center point of the first predicted number interval represents the average level of the first year-on-year predicted number and each second year-on-year predicted number. The first year-on-year predicted number is the number of business requests at risk for the target business during the first historical time period, as predicted based on the actual year-on-year number corresponding to the first historical time period. Each second year-on-year predicted number is the number of business requests at risk for the target business during each year-on-year historical time period.

[0041] The center point of the second predicted number interval represents: an average level of the first month-on-month predicted number and each second month-on-month predicted number; the first month-on-month predicted number is: the number of business requests with risks for the target business in the first historical time period, as predicted based on the actual month-on-month number corresponding to the first historical time period; each second month-on-month predicted number is: the predicted number of business requests with risks for the target business in each month-on-month historical time period;

[0042] The anomaly detection module is specifically configured to determine that the target business is abnormal within the first historical time period if the first actual number is outside the first predicted number interval and outside the second predicted number interval.

[0043] In some embodiments, the center point of the first prediction number interval is the mean of the first year-on-year prediction number and the second year-on-year prediction numbers, and the size of the first prediction number interval is: a first specified multiple of a first standard deviation; wherein the first standard deviation is the standard deviation of the first year-on-year prediction number and the second year-on-year prediction numbers;

[0044] And / or, the center point of the second prediction number interval is the mean of the first month-on-month prediction number and the second month-on-month prediction numbers, and the size of the second prediction number interval is: the second specified multiple of the second standard deviation; wherein, the second standard deviation is the standard deviation of the first month-on-month prediction number and the second month-on-month prediction numbers.

[0045] In some embodiments, the first prediction submodule includes:

[0046] a first prediction unit, configured to perform a prediction based on the first actual number and the actual year-on-year number corresponding to the first historical time period, to obtain the first year-on-year predicted number and the second year-on-year predicted numbers;

[0047] The second prediction unit is used to make a prediction based on the first real number and the month-on-month real number corresponding to the first historical time period to obtain the first month-on-month predicted number and the second month-on-month predicted numbers.

[0048] In some embodiments, the first predicted number acquisition module is specifically configured to:

[0049] The number of business requests that are at risk for the target business in other historical time periods before the first historical time period is input into a time series model for predicting the number of business requests, and the number of business requests that are at risk for the target business in the first historical time period is obtained as a first predicted number.

[0050] In some embodiments, the apparatus further comprises:

[0051] a screening module configured to determine whether the first actual number satisfies any one of preset screening conditions before calculating the number of business requests at risk for the target business within the first historical time period based on the year-on-year actual number corresponding to the first historical time period and / or the month-on-month actual number corresponding to the first historical time period as the first predicted number;

[0052] Among them, the preset screening conditions include: the first real number is within a first real number interval, the first real number is within a second real number interval, and the first real number is less than a preset threshold; the center point of the first real number interval is the mean of the year-on-year real number corresponding to the first historical time period, and the size of the first real number interval is: a third specified multiple of the third standard deviation; the third standard deviation is the standard deviation of the year-on-year real number corresponding to the first historical time period; the center point of the second real number interval is the mean of the month-on-month real number corresponding to the first historical time period, and the size of the second real number interval is: a fourth specified multiple of the fourth standard deviation; the fourth standard deviation is the standard deviation of the month-on-month real number corresponding to the first historical time period;

[0053] If not, the first prediction submodule is triggered.

[0054] In some embodiments, the apparatus further comprises:

[0055] A display module is configured to display the first true number if the first true number is outside the predicted number interval.

[0056] In a third aspect of the present invention, an electronic device is provided, comprising a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other via the communication bus;

[0057] Memory for storing computer programs;

[0058] The processor is configured to implement any of the above-mentioned service detection methods when executing the program stored in the memory.

[0059] In another aspect of the present invention, a computer-readable storage medium is provided, wherein a computer program is stored in the computer-readable storage medium. When the computer program is executed by a processor, any of the above-mentioned service detection methods is implemented.

[0060] In another aspect of the present invention, a computer program product comprising instructions is provided. When the computer program product is run on a computer, the computer is enabled to execute any of the above-mentioned service detection methods.

[0061] An embodiment of the present invention provides a business detection method, which includes: obtaining the number of business requests that are at risk for a target business in a first historical time period as a first real number; based on the changing trend of the number of business requests that are at risk for the target business in other historical time periods before the first historical time period, calculating the number of business requests that are at risk for the target business in the first historical time period as a first predicted number; if the first real number is outside the predicted number interval, determining that the target business is abnormal in the first historical time period; wherein the center point of the predicted number interval is determined based on the first predicted number.

[0062] Based on the above processing, the first predicted number is derived based on the changing trend of the number of risky business requests for the target business in other historical time periods prior to the first historical time period. The center point of the predicted number interval is determined based on the first predicted number. Therefore, the predicted number interval reflects the reasonable range of the number of risky business requests for the target business within the first historical time period under normal changing trends. If the first actual number falls outside the predicted number interval, it indicates that the number of risky business requests for the target business in the first historical time period does not conform to the normal changing trend. In other words, there was a malicious attack against the target business in the first historical time period. Therefore, it can be determined that the target business was abnormal in the first historical time period. Compared to related technologies, the present application detects based on the number of risky business requests. The number of risky business requests is more indicative of whether the business is abnormal than the total number of business requests. In addition, because the changing trend of the number of risky business requests for the target business in other historical time periods prior to the first historical time period is taken into account, inaccurate detection results due to seasonal or periodic events can be avoided when the target business is not under attack. This improves the accuracy of business detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0063] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for describing the embodiments or the prior art.

[0064] Figure 1 A flow chart of a service detection method provided by an embodiment of the present invention;

[0065] Figure 2 A flowchart of another service detection method provided by an embodiment of the present invention;

[0066] Figure 3 A flowchart of another service detection method provided by an embodiment of the present invention;

[0067] Figure 4 A flowchart of a detection based on a first predicted number interval and a second predicted number interval provided by an embodiment of the present invention;

[0068] Figure 5 A flowchart of another service detection method provided by an embodiment of the present invention;

[0069] Figure 6 An effect diagram showing the detection results provided by an embodiment of the present invention;

[0070] Figure 7 A system block diagram of a service detection method provided by an embodiment of the present invention;

[0071] Figure 8 A schematic structural diagram of a service detection device provided by an embodiment of the present invention;

[0072] Figure 9 A schematic structural diagram of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0073] The technical solutions in the embodiments of the present invention will be described below with reference to the accompanying drawings in the embodiments of the present invention.

[0074] With the advancement of network technology, network servers providing services to users can now offer multiple services. For example, a forum server might need to provide user registration, login, and search services. To maintain network security, a network server can collect statistics on service requests received for each service and determine whether any of these services are abnormal. For example, when an unauthorized user attacks a service, the number of service requests for that service increases within a short period of time, indicating that the service is abnormal. These unauthorized user attacks can also be referred to as black market attacks.

[0075] In related technologies, when a significant change in the number of service requests for a particular service is detected, it indicates that the service may be under attack by unauthorized users, and the service can be determined to be abnormal. However, even if a service is not under attack, seasonal or periodic events can also cause significant changes in the number of service requests for the service.

[0076] For example, to increase user numbers, website operators periodically launch a series of activities to attract new users, resulting in significant changes in the number of registration requests during the activity period. Another example is when a new movie is released, users search for it on the website, causing the number of search requests to increase within a short period of time.

[0077] Therefore, when detecting a service based on relevant technologies, the service may be judged to be abnormal when the number of service requests for the service changes significantly due to periodic or service-related events. Correspondingly, the accuracy of the service detection results will be low.

[0078] In order to solve the above problems, an embodiment of the present invention provides a service detection method. The method can be applied to electronic devices. For example, the electronic device can be a network server for services provided by an operator. The network server can communicate with the client network to provide the required services to users. Accordingly, when a user needs to request a certain service, a service request for the service can be sent to the network server through the client. After receiving the service request sent by the client, the network server can provide the corresponding service to the user. For each service, the network server can obtain the number of service requests for the service within a time period, and can determine the number of service requests that are at risk. Then, it can also be processed based on the service detection method provided by the embodiment of the present invention to determine whether the service is abnormal within the time period. Alternatively, the electronic device can also be a device other than a network server, and the electronic device can communicate with the network server to obtain the service request received by the above-mentioned network server, and process it based on the service detection method provided by the embodiment of the invention to determine whether the service is abnormal.

[0079] See also Figure 1 , Figure 1 A flowchart of a service detection method provided in an embodiment of the present invention may include the following steps:

[0080] S101: Obtain the number of business requests with risks for a target business in a first historical time period as a first real number.

[0081] S102: Calculate the number of risky business requests for the target business in the first historical time period as a first predicted number based on a change trend of the number of risky business requests for the target business in other historical time periods before the first historical time period.

[0082] S103: If the first actual number is outside the predicted number range, it is determined that the target business is abnormal in the first historical time period.

[0083] The center point of the predicted number interval is determined based on the first predicted number.

[0084] Based on the above processing, the first predicted number is derived based on the changing trend of the number of risky business requests for the target business in other historical time periods prior to the first historical time period. The center point of the predicted number interval is determined based on the first predicted number. Therefore, the predicted number interval reflects the reasonable range of the number of risky business requests for the target business within the first historical time period under normal changing trends. If the first actual number falls outside the predicted number interval, it indicates that the number of risky business requests for the target business in the first historical time period does not conform to the normal changing trend. In other words, there was a malicious attack against the target business in the first historical time period. Therefore, it can be determined that the target business was abnormal in the first historical time period. Compared to related technologies, the present application detects based on the number of risky business requests. The number of risky business requests is more indicative of whether the business is abnormal than the total number of business requests. In addition, because the changing trend of the number of risky business requests for the target business in other historical time periods prior to the first historical time period is taken into account, inaccurate detection results due to seasonal or periodic events can be avoided when the target business is not under attack. This improves the accuracy of business detection.

[0085] With respect to step S101 , the target service may be any service among all services provided by the electronic device.

[0086] The electronic device can detect services based on preset detection cycles and detection time periods. A detection cycle includes at least one detection time period. For example, the detection cycle can be 1 day (24 hours), that is, from 0 o'clock to 24 o'clock, and the detection time period can be 1 hour, that is, a detection cycle includes 24 detection time periods. Accordingly, when the end time of a detection time period is reached, for each service, the electronic device can detect the service based on the number of service requests for the service within the detection time period to determine whether the service is abnormal within the detection time period.

[0087] The first historical time period may be any detection time period before the current moment.

[0088] For example, the first historical time period can be a detection time period ending at the current time. Based on this, it is possible to detect the status of the service within each detection time period after the end of the detection time period, thereby achieving real-time detection of the service and improving the timeliness of detection. For example, if the current time is 6:00 and the detection time period is 1 hour, then the first historical time period can be from 5:00 to the current time (6:00).

[0089] After receiving a service request from a user for a specific service, the information contained in the service request can be obtained, including the service line, end dimension, and timestamp. The service line indicates the type of service to which the service request belongs, for example, a registration service, a login service, or a search service; the end dimension indicates the type of client sending the service request, for example, a PC (Personal Computer) or a mobile terminal; and the timestamp can be the time the user sends the service request or the time the electronic device receives the service request.

[0090] In this application, a service request for a particular service may also be referred to as traffic for that service. Upon receiving any service request, an electronic device can determine whether the service request poses a risk, that is, determine the risk type of the service request. For example, risk types may include high-risk traffic types, medium-risk traffic types, and low-risk traffic types. For any received service request, information carried in the service request can be obtained, such as the phone number, the client's IP (Internet Protocol) address, and the client's device model. Accordingly, the electronic device can detect the service request based on pre-set risk detection rules. For example, for a phone number, the electronic device can determine whether it is a real number or a virtual number; for a client's IP address, the electronic device can determine whether the IP address belongs to an overseas region or a domestic region; and for a client's device model, the electronic device can determine whether the client's device model carried in the service request is a commonly used device model corresponding to the phone number. For each of the above detection rules, a risk assessment value for that detection rule can be determined based on the detection results, thereby obtaining a total risk assessment value for the service request. Furthermore, the risk assessment value range to which the risk assessment value belongs is determined to determine the risk type of the service request.

[0091] For example, if the risk types include high-risk traffic type, medium-risk traffic type, and low-risk traffic type, then the risky service requests may include service requests of high-risk traffic type and medium-risk traffic type.

[0092] The electronic device can record basic information about each received business request posing a risk. For example, the basic information about a business request can include: business line, end dimension, timestamp, and risk type. Accordingly, the electronic device can obtain the number of business requests posing a risk for the target business within the first historical time period as the first actual number.

[0093] With respect to step S102 and step S103 , other historical time periods before the first historical time period include at least one detection time period.

[0094] In this application, the number of business requests for the target business that are at risk in other historical time periods before the first historical time period may also be referred to as a first reference number. The electronic device may calculate the number of business requests for the target business that are at risk in the first historical time period (i.e., a first predicted number) based on the changing trend of the first reference number. This will be described in detail in subsequent embodiments.

[0095] In some embodiments, the electronic device may determine the number of risky business requests for the target business in other historical time periods used to calculate the first predicted number based on a preset detection cycle and detection time period. Figure 2 , Figure 2 A flowchart of another service detection method provided by an embodiment of the present invention, Figure 1 On this basis, step S102 includes:

[0096] S1021: Based on the actual year-on-year number corresponding to the first historical time period and / or the actual month-on-month number corresponding to the first historical time period, calculate the number of business requests with risks for the target business in the first historical time period as a first predicted number.

[0097] Among them, the year-on-year actual number corresponding to the first historical time period represents: the number of business requests with risks for the target business in each year-on-year historical time period corresponding to the first historical time period; each year-on-year historical time period is located in other detection cycles before the detection cycle to which the first historical time period belongs, and has the same relative time position as the first historical time period in the detection cycle to which it belongs.

[0098] The actual year-on-year number corresponding to the first historical time period indicates the number of business requests with risks for the target business in each year-on-year historical time period corresponding to the first historical time period; each year-on-year historical time period is located before the first historical time period and is adjacent to the first historical time period.

[0099] The first historical time period and the corresponding year-on-year historical time period are in different detection cycles and have the same relative time sequence position in their respective detection cycles. The number (T1) of year-on-year historical time periods corresponding to the first historical time period is greater than or equal to 1.

[0100] For example, the detection period to which each year-on-year historical time period belongs is adjacent to the detection period to which the first historical time period belongs. For example, the duration of the detection period is 1 day (24 hours), that is, from 0 o'clock to 24 o'clock, the duration of the detection period is 1 hour, and T1 is 2. If the first historical time period is from 3 o'clock to 4 o'clock on July 20, then the year-on-year historical time periods corresponding to the first historical time period include: from 3 o'clock to 4 o'clock on July 19 and from 3 o'clock to 4 o'clock on July 18. The year-on-year actual number corresponding to the first historical time period includes: the number of business requests for target business that are at risk from 3 o'clock to 4 o'clock on July 19, and the number of business requests for target business that are at risk from 3 o'clock to 4 o'clock on July 18.

[0101] The year-on-year historical time period corresponding to the first historical time period is located before the first historical time period and is adjacent to the first historical time period. The number (T2) of year-on-year historical time periods corresponding to the first historical time period is greater than or equal to 1.

[0102] For example, the detection cycle is 1 day (24 hours), that is, from 0:00 to 24:00, the detection time period is 1 hour, and T2 is 3. If the first historical time period is from 2:00 to 3:00 on July 20, then the corresponding year-on-year historical time periods include: from 1:00 to 2:00 on July 20, from 0:00 to 1:00 on July 20, and from 23:00 to 24:00 on July 19. The actual year-on-year numbers corresponding to the first historical time period include: the number of business requests with risks for the target business from 1:00 to 2:00 on July 20, the number of business requests with risks for the target business from 0:00 to 1:00 on July 20, and the number of business requests with risks for the target business from 23:00 to 24:00 on July 19.

[0103] In one implementation method, the number of business requests with risks for the target business in the first historical time period can be calculated based on the first real number and the year-on-year real number corresponding to the first historical time period to obtain a first predicted number. At this time, the first predicted number can be the first year-on-year predicted number mentioned later, and the center point of the predicted number interval can be the first year-on-year predicted number.

[0104] Alternatively, the number of business requests at risk for the target business in the first historical time period can be calculated based on the first real number and the month-on-month real number corresponding to the first historical time period to obtain a first predicted number. At this time, the first predicted number can be the first month-on-month predicted number mentioned later, and the center point of the predicted number interval can be the first month-on-month predicted number.

[0105] Alternatively, the number of business requests with risks for the target business in the first historical time period may be calculated based on the first real number and the year-on-year real number corresponding to the first historical time period to obtain a first year-on-year forecast number, and the number of business requests with risks for the target business in the first historical time period may be calculated based on the first real number and the month-on-month real number corresponding to the first historical time period to obtain a first month-on-month forecast number. Furthermore, the first year-on-year forecast number and the first month-on-month forecast number are combined to obtain a first forecast number. For example, the first forecast number includes the first year-on-year forecast number and the first month-on-month forecast number. Alternatively, the first forecast number is obtained by performing a calculation based on the first year-on-year forecast number and the first month-on-month forecast number. For example, the first forecast number may be the average of the first year-on-year forecast number and the first month-on-month forecast number.

[0106] When the first predicted number includes a first year-on-year predicted number and a first quarter-on-quarter predicted number, the center point of the predicted number interval is determined based on the first year-on-year predicted number and the first quarter-on-quarter predicted number. The specific process of determining the center point of the predicted number interval will be introduced in detail in subsequent embodiments.

[0107] If the first actual number is outside the predicted number range, it indicates that the risky business requests for the target business in the first historical time period do not conform to the normal change trend, that is, there are malicious attacks against the target business in the first historical time period. Furthermore, it can be determined that the target business is abnormal in the first historical time period.

[0108] In some embodiments, the predicted number interval includes: a first predicted number interval and a second predicted number interval; the first predicted number includes: a first year-on-year predicted number and a first quarter-on-quarter predicted number.

[0109] The center point of the first predicted number interval represents: the average level of the first year-on-year predicted number and each second year-on-year predicted number; the first year-on-year predicted number is: the number of business requests with risks for the target business in the first historical time period obtained by prediction based on the actual year-on-year number corresponding to the first historical time period; each second year-on-year predicted number is: the number of business requests with risks for the target business in each year-on-year historical time period obtained by prediction.

[0110] The center point of the second predicted number interval represents: the average level of the first quarter-on-quarter predicted number and each second quarter-on-quarter predicted number; the first quarter-on-quarter predicted number is: the number of business requests with risks for the target business in the first historical time period obtained by prediction based on the quarter-on-quarter actual number corresponding to the first historical time period; each second quarter-on-quarter predicted number is: the number of business requests with risks for the target business in each quarter-on-quarter historical time period obtained by prediction.

[0111] Correspondingly, such as Figure 3 As shown, Figure 3 A flowchart of another service detection method provided by an embodiment of the present invention is provided. Figure 2 On this basis, step S103 includes:

[0112] S1031: If the first actual number is outside the first predicted number interval and outside the second predicted number interval, it is determined that the target business is abnormal in the first historical time period.

[0113] In one implementation, the electronic device can obtain a fitting curve corresponding to each year-on-year actual number corresponding to the first historical time period, and determine a function corresponding to the fitting curve, and calculate the number of business requests that are at risk for the target business in the first historical time period based on the function (i.e., the first year-on-year predicted number).

[0114] Alternatively, the electronic device may calculate the average of the actual year-on-year numbers corresponding to the first historical time period, and use the average as the first year-on-year predicted number.

[0115] Alternatively, the electronic device may obtain the first year-on-year predicted number based on the time series model. The specific process of performing the prediction based on the time series model will be described in detail in subsequent embodiments.

[0116] Correspondingly, the electronic device can obtain the fitting curve corresponding to the actual number of each month-on-month increase corresponding to the first historical time period, and determine the function corresponding to the fitting curve, and calculate the number of business requests at risk for the target business in the first historical time period based on the function (i.e., the first month-on-month predicted number).

[0117] Alternatively, the electronic device may calculate an average of the actual month-on-month numbers corresponding to the first historical time period, and use the average as the first month-on-month predicted number.

[0118] Alternatively, the electronic device may obtain the first month-on-month predicted number based on a time series model. The specific process of performing the prediction based on the time series model will be described in detail in subsequent embodiments.

[0119] The number of the second year-on-year forecast numbers is consistent with the number of year-on-year historical time periods corresponding to the first historical time period (T1).

[0120] For example, the first historical time period is from 3:00 to 4:00 on July 20, and the year-on-year historical time periods corresponding to the first historical time period include: from 3:00 to 4:00 on July 19 and from 3:00 to 4:00 on July 18. The first year-on-year forecast number represents the calculated number of business requests that are at risk for the target business from 3:00 to 4:00 on July 20; the second year-on-year forecast number includes: the calculated number of business requests that are at risk for the target business from 3:00 to 4:00 on July 19, and the calculated number of business requests that are at risk for the target business from 3:00 to 4:00 on July 18.

[0121] Correspondingly, the number of the second month-on-month forecast number is consistent with the number of month-on-month historical time periods corresponding to the first historical time period (T2).

[0122] For example, the first historical time period is from 2:00 to 3:00 on July 20, and the month-on-month historical time periods corresponding to the first historical time period include: from 1:00 to 2:00 on July 20, from 0:00 to 1:00 on July 20, and from 23:00 to 24:00 on July 19. The first month-on-month forecast number represents the calculated number of business requests that are at risk for the target business from 2:00 to 3:00 on July 20; the second month-on-month forecast number includes: the calculated number of business requests that are at risk for the target business from 1:00 to 2:00 on July 20, the calculated number of business requests that are at risk for the target business from 0:00 to 1:00 on July 20, and the calculated number of business requests that are at risk for the target business from 23:00 to 24:00 on July 19.

[0123] In step S1031, if the first actual number falls outside the first predicted number range, it indicates that the number of business requests with risk for the target business during the first historical time period does not conform to a normal year-on-year trend. If the first actual number falls outside the second predicted number range, it indicates that the number of business requests with risk for the target business during the first historical time period does not conform to a normal month-on-month trend.

[0124] Therefore, if the first actual number falls outside the first predicted range and the second predicted range, it indicates that the first actual number does not conform to a normal year-on-year or month-on-month trend. This also indicates that there was a malicious attack against the target business during the first historical time period, and therefore, the target business can be determined to be abnormal during the first historical time period.

[0125] Based on the above processing, the number of service requests in the first historical time period is predicted based on the actual year-on-year number corresponding to the first historical time period, which can take into account the impact of periodic factors on service detection results. The number of service requests in the first historical time period is predicted based on the actual month-on-month number corresponding to the first historical time period, which can take into account the impact of service relevance factors on service detection results. In turn, the accuracy of service detection can be improved.

[0126] In some embodiments, the electronic device can determine the center points of the first prediction number interval and the second prediction number interval in various ways. Specifically, the electronic device can determine the center points of the first prediction number interval and the second prediction number interval by referring to any of the following ways.

[0127] Method 1:

[0128] The electronic device may pre-set weights for the first year-on-year predicted number and each second year-on-year predicted number, and calculate the weighted sum of the first year-on-year predicted number and each second year-on-year predicted number as the center point of the first predicted number interval. Alternatively, the electronic device may determine the median of the first year-on-year predicted number and each second year-on-year predicted number as the center point of the first predicted number interval.

[0129] Similarly, the electronic device can pre-set weights for the first quarter-over-quarter forecast number and each second quarter-over-quarter forecast number, and calculate the weighted sum of the first quarter-over-quarter forecast number and each second quarter-over-quarter forecast number as the center point of the second forecast number interval. Alternatively, the electronic device can determine the median of the first year-over-year forecast number and each second year-over-year forecast number as the center point of the second forecast number interval.

[0130] Method 2:

[0131] The center point of the first forecast number interval is the mean of the first year-on-year forecast number and each second year-on-year forecast number, and the size of the first forecast number interval is: a first specified multiple of the first standard deviation, where the first standard deviation is the standard deviation of the first year-on-year forecast number and each second year-on-year forecast number.

[0132] And / or, the center point of the second prediction number interval is the mean of the first quarter-on-quarter prediction number and each second quarter-on-quarter prediction number, and the size of the second prediction number interval is: a second specified multiple of the second standard deviation, where the second standard deviation is the standard deviation of the first quarter-on-quarter prediction number and each second quarter-on-quarter prediction number.

[0133] The electronic device may calculate an average value (μ1) of the first year-on-year predicted number and each second year-on-year predicted number as a center point of the first predicted number interval.

[0134] In addition, the size of the first prediction number interval can be determined based on the n-sigma criterion. That is, the standard deviation (σ1) of the first year-on-year prediction number and each second year-on-year prediction number (i.e., the first standard deviation in this application) is calculated, and the size of the first prediction number interval is determined based on the product of the first specified multiple and the standard deviation. The first prediction number interval can be expressed as: [μ1-n1×σ1,μ1+n1×σ1]. Wherein, n1 represents half of the first specified multiple. For example, n1 can be 2 or 3.

[0135] Similarly, the electronic device may calculate the mean value (μ2) of the first month-on-month predicted number and each second month-on-month predicted number as the center point of the first predicted number interval.

[0136] In addition, the size of the second prediction number interval can be determined based on the n-sigma criterion, that is, the standard deviation (σ2) of the first and second ring-shaped prediction numbers (i.e., the second standard deviation in this application) is calculated, and the size of the second prediction number interval is determined based on the product of the second specified multiple and the standard deviation. The second prediction number interval can be expressed as: [μ2-n2×σ2,μ2+n2×σ2]. Wherein, n2 represents half of the second specified multiple. For example, n2 can be 2 or 3.

[0137] Based on the above processing, a first predicted number interval and a second predicted number interval can be determined based on the n-sigma criterion. Subsequently, whether the target business is abnormal within the first historical time period is determined based on the first predicted number interval and the second predicted number interval. This can filter out the first real number with small changes, improve detection accuracy, and reduce false positives.

[0138] like Figure 4 As shown, Figure 4 A flowchart of a detection based on a first predicted number interval and a second predicted number interval is provided in an embodiment of the present invention.

[0139] Step S401: Start.

[0140] Step S402: Select and obtain target data.

[0141] That is, obtain the number of business requests with risks for the target business in the first historical time period (ie, the first real number), the year-on-year real number corresponding to the first historical time period, and the quarter-on-quarter real number corresponding to the first historical time period.

[0142] Step S403: first prediction number interval.

[0143] That is, based on the first real number and the year-on-year real number corresponding to the first historical time period, the first year-on-year predicted number and each second year-on-year predicted number are obtained, and then the first predicted number interval is obtained.

[0144] Step S404: second prediction number interval.

[0145] That is, based on the first real number and the month-on-month real number corresponding to the first historical time period, the first month-on-month predicted number and each second month-on-month predicted number are obtained, and then the second predicted number interval is obtained.

[0146] Step S405: Combination.

[0147] That is, it is determined whether the first actual number is outside the first predicted number interval and outside the second predicted number interval.

[0148] If so, it is determined that the target business is abnormal in the first historical time period; if not, it is determined that the target business is normal in the first historical time period.

[0149] Step S406: Output the result.

[0150] That is, a detection result indicating whether the target service is abnormal within the first historical time period is output.

[0151] In some embodiments, step S102 includes:

[0152] The number of business requests that are at risk for the target business in other historical time periods before the first historical time period is input into a time series model for predicting the number of business requests, and the number of business requests that are at risk for the target business in the first historical time period is obtained as a first predicted number.

[0153] In one implementation, the electronic device can input the first reference number and the first real number into a time series model for predicting the number of business requests, and obtain the predicted value of business requests that are at risk for the target business in the first historical time period (i.e., the first predicted number), as well as the predicted value of business requests that are at risk for the target business in other historical time periods before the first historical time period.

[0154] For example, the time series model used to predict the number of service requests may be an EWMA (Exponentially Weighted Moving Average) model or an ARIMA (Autoregressive Integrated Moving Average) model.

[0155] In this way, the first prediction number can be obtained through the time series model, which can improve the accuracy of detection.

[0156] In some embodiments, step S1021 includes:

[0157] Step 1: Based on the first real number and the year-on-year real number corresponding to the first historical time period, a forecast is made to obtain a first year-on-year forecast number and each second year-on-year forecast number.

[0158] Step 2: Based on the first real number and the month-on-month real number corresponding to the first historical time period, a forecast is made to obtain a first month-on-month forecast number and each second month-on-month forecast number.

[0159] In one implementation, the electronic device can input the year-on-year actual number corresponding to the first historical time period and the first actual number into a time series model (i.e., a first time series model) for predicting the number of business requests, and obtain the number of business requests for which there is risk for the target business in the first historical time period as the first year-on-year predicted number, and the number of business requests for which there is risk for the target business in each year-on-year historical time period as the second year-on-year predicted number.

[0160] Correspondingly, the month-on-month actual number corresponding to the first historical time period of the electronic device and the first actual number are input into the time series model (i.e., the second time series model) used to predict the number of business requests, and the number of business requests for target business risks in the first historical time period is obtained as the first month-on-month prediction number, and the number of business requests for target business risks in each month-on-month historical time period is obtained as the second month-on-month prediction number.

[0161] For example, the first time series model may be an EWMA model or an ARIMA model. The second time series model may also be an EWMA model or an ARIMA model.

[0162] The electronic device can input the year-on-year real number corresponding to the first historical time period and the first real number into the EWMA model, and set the weight parameters α1 (attenuation factor) and span1 (span) in the EWMA model, compare the time distance between the year-on-year historical time period to which each year-on-year real number belongs and the first historical time period, and adjust the weight of each year-on-year real number.

[0163] Accordingly, the year-on-year real numbers corresponding to the first historical time period and the first real numbers can be input into the EWMA model, and the weight parameters α2 (attenuation factor) and span2 (span) in the EWMA model can be set. The time distance between the year-on-year historical time period to which each year-on-year real number belongs and the first historical time period can be compared, and the weight of each year-on-year real number can be adjusted.

[0164] Based on the above processing, the EWMA model can be used to determine the number of service requests for the target business within the first historical time period, each corresponding year-on-year historical time period, and each corresponding month-on-month historical time period. By setting parameters in the EWMA model and increasing the weight of detection time periods closer to the first historical time period, it is possible to capture sudden changes in risky service requests within a short period of time, thereby improving detection accuracy.

[0165] In some embodiments, as Figure 5 As shown, Figure 5 A flowchart of another service detection method provided by an embodiment of the present invention is provided. Figure 2 On the basis of, before step S1021, the method further includes:

[0166] S104: Determine whether the first real number meets any one of the preset screening conditions; if not, execute step S1021.

[0167] The preset screening conditions include: the first real number is within a first real number interval, the first real number is within a second real number interval, and the first real number is less than a preset threshold.

[0168] The center point of the first true number interval is the mean of the year-on-year true numbers corresponding to the first historical time period, and the size of the first true number interval is: the third specified multiple of the third standard deviation; the third standard deviation is the standard deviation of the year-on-year true numbers corresponding to the first historical time period.

[0169] The center point of the second true number interval is the mean of the month-on-month true number corresponding to the first historical time period, and the size of the second true number interval is: the fourth specified multiple of the fourth standard deviation; the fourth standard deviation is the standard deviation of the month-on-month true number corresponding to the first historical time period.

[0170] The method of obtaining the first real number interval based on the first real number and each year-on-year real number is consistent with the method of obtaining the first predicted number interval based on the first year-on-year predicted number and each second year-on-year predicted number.

[0171] Correspondingly, the method of obtaining the second real number interval based on the first real number and each month-on-month real number is also consistent with the method of obtaining the first forecast number interval based on the first year-on-year forecast number and each second year-on-year forecast number.

[0172] The first real number is within the first real number interval, indicating that the business requests with risks for the target business in the first historical time period are in line with the normal year-on-year change trend. Therefore, it can be determined that the target business is normal in the first historical time period.

[0173] Similarly, the first real number is within the second real number range, indicating that the business requests with risks for the target business in the first historical time period are in line with the normal month-on-month change trend. Therefore, it can be determined that the target business is normal in the first historical time period.

[0174] The preset threshold is set by technical personnel based on business needs. Because risky business requests are often generated during an illegal attack, if the first true number is less than the preset threshold, it indicates that the magnitude of the first true number is small, indicating that the target business was operating normally during the first historical time period.

[0175] If the first real number does not meet any of the preset screening conditions, it indicates that further detection of the target business is required based on the above steps S102-S103.

[0176] Based on the above processing, the first real number of target business requests in different detection time periods can be preliminarily screened based on the year-on-year real number corresponding to the first historical time period and the month-on-month real number corresponding to the first historical time period. Furthermore, it is possible to screen out small-scale risky business requests. If the first real number conforms to a normal year-on-year or month-on-month change trend, or if the first real number is relatively small, there is no need to calculate the number of risky business requests for the target business in the first historical time period. This can reduce the amount of computation and lower the computational cost.

[0177] In some embodiments, the method further comprises:

[0178] If the first true number is outside the predicted number interval, the first true number is displayed.

[0179] The first actual number is outside the predicted number range, indicating that the target service is abnormal within the first historical time period. Furthermore, the electronic device displays the first actual number, or alternatively, displays both the first actual number and the first predicted number. For example, the electronic device may display the first actual number of the target service within the first historical time period via a visual chart, or may send the first actual number of the target service within the first historical time period to maintenance personnel via email, alarm, or other means.

[0180] Based on this process, when anomalies are detected in the target business during the first historical period, a visual alert is generated, allowing relevant technical personnel to better analyze the anomaly and its cause. Subsequently, relevant prevention and control strategies can be optimized to improve the risk prevention and control system.

[0181] like Figure 6 As shown, Figure 6 This is an effect diagram showing the detection results provided by an embodiment of the present invention.

[0182] Figure 6In the figure, the horizontal axis represents detection time, and the vertical axis represents the number of service requests. The undotted lines represent the number of service requests at risk for the target service during different detection time periods. The dotted lines represent the first predicted number calculated based on steps S101-S102 at the end of each detection time period. Dots indicate that the target service was abnormal during that detection time period.

[0183] like Figure 7 As shown, Figure 7 A system block diagram of a service detection method provided by an embodiment of the present invention.

[0184] Step S701: Record in the traffic database.

[0185] That is, the electronic device may record the service requests of each service within a historical time period in the traffic database.

[0186] Step S702: Obtain high-risk traffic information for the current period.

[0187] That is, it is possible to perform hourly calculations on the data in the traffic database to obtain the number of service requests received during the current detection period (ie, the first real number in this application), as well as basic information of each service request.

[0188] Step S703: Write high-risk flow table A.

[0189] That is, the basic information of the business requests with the risk type of high-risk traffic during the current period is written into the high-risk traffic table A. The high-risk traffic table A can record the basic information of the business requests with risks, such as business line, end dimension, timestamp, and risk type.

[0190] Step S704: Obtain year-on-year data.

[0191] That is, obtain the actual year-on-year number corresponding to the current detection time period.

[0192] Step S705: Obtain month-on-month data.

[0193] That is, obtain the actual year-on-year number corresponding to the current detection time period.

[0194] The above steps S701-S705 may represent the process of acquiring and storing data.

[0195] Step S706: Filter unnecessary predicted traffic.

[0196] That is, it is determined whether the first real number satisfies any one of the preset screening conditions in this application. The preset screening conditions include: the first real number is within a first real number interval, the first real number is within a second real number interval, and the first real number is less than a preset threshold.

[0197] If the first real number meets any of the preset screening conditions, it means that the target business is normal within the current detection time period;

[0198] If the first real number does not meet any of the preset screening conditions, it means that the target service may be abnormal in the current detection time period, and the electronic device can execute step S707 to determine whether the target service is abnormal in the current detection time period.

[0199] Step S707: Input the EWMA model.

[0200] Step S708: Obtain the latest T prediction values.

[0201] That is, the first real number and the year-on-year real number corresponding to the current detection time period are input into the EWMA model to obtain the number of business requests that are at risk for the target business in the current detection time period as the first year-on-year prediction number, and the number of business requests that are at risk for the target business in each year-on-year historical time period as the second year-on-year prediction number.

[0202] The first real number and the month-on-month real number corresponding to the current detection time period are input into the EWMA model to obtain the number of business requests that are at risk for the target business in the current detection time period as the first month-on-month forecast number, and the number of business requests that are at risk for the target business in each month-on-month historical time period as the second month-on-month forecast number.

[0203] The above steps S706-S708 may represent the process of training and prediction based on the EWMA model.

[0204] Step S709: Determine whether it exceeds the nσ range.

[0205] That is, based on the n-sigma criterion, the above-mentioned first year-on-year forecast number and the second year-on-year forecast number are processed to obtain the first forecast number interval; based on the n-sigma criterion, the above-mentioned first quarter-on-quarter forecast number and the second quarter-on-quarter forecast number are processed to obtain the second forecast number interval.

[0206] Determine whether the first actual number is outside the first predicted number interval and outside the second predicted number interval. If so, execute step S710; if not, execute step S711.

[0207] Step S710: Determine abnormal points.

[0208] That is, it is determined that the target service is abnormal within the current detection time period, and step S712 is executed.

[0209] Step S711: End.

[0210] That is, the target service is normal during the current detection period.

[0211] Step S712: Write high-risk abnormal flow table B.

[0212] That is, the basic information of the business request corresponding to the first real number is written into the high-risk abnormal traffic table B.

[0213] Step S713: Alarm.

[0214] That is, the first real number is displayed.

[0215] The above steps S709-S713 may represent a process of determining whether the target service is abnormal.

[0216] The embodiment of the present invention also provides a service detection device, see Figure 8 , Figure 8 A schematic diagram of the structure of a service detection device provided in an embodiment of the present invention, the device comprising:

[0217] A first real number acquisition module 801 is configured to acquire the number of business requests with risks for a target business within a first historical time period as a first real number;

[0218] A first predicted number acquisition module 802 is configured to calculate the number of risky business requests for the target business in the first historical time period as a first predicted number based on a changing trend of the number of risky business requests for the target business in other historical time periods before the first historical time period;

[0219] The anomaly detection module 803 is used to determine that the target business is abnormal in the first historical time period if the first actual number is outside the predicted number interval; wherein the center point of the predicted number interval is determined based on the first predicted number.

[0220] In some embodiments, the first predicted number acquisition module 802 includes:

[0221] A first prediction submodule is configured to calculate, as a first predicted number, the number of business requests with risks for the target business in the first historical time period based on the actual year-on-year number corresponding to the first historical time period and / or the actual month-on-month number corresponding to the first historical time period;

[0222] The year-on-year actual number corresponding to the first historical time period represents: the number of business requests with risks for the target business in each year-on-year historical time period corresponding to the first historical time period; each year-on-year historical time period is located in another detection period before the detection period to which the first historical time period belongs, and has the same relative time sequence position as the first historical time period in the detection period to which it belongs;

[0223] The actual year-on-year number corresponding to the first historical time period represents: the number of business requests at risk for the target business in each year-on-year historical time period corresponding to the first historical time period; each year-on-year historical time period is located before the first historical time period and is adjacent to the first historical time period.

[0224] In some embodiments, the predicted number interval includes: a first predicted number interval and a second predicted number interval; the first predicted number includes: a first year-on-year predicted number and a first quarter-on-quarter predicted number;

[0225] The center point of the first predicted number interval represents the average level of the first year-on-year predicted number and each second year-on-year predicted number. The first year-on-year predicted number is the number of business requests at risk for the target business during the first historical time period, as predicted based on the actual year-on-year number corresponding to the first historical time period. Each second year-on-year predicted number is the number of business requests at risk for the target business during each year-on-year historical time period.

[0226] The center point of the second predicted number interval represents: an average level of the first month-on-month predicted number and each second month-on-month predicted number; the first month-on-month predicted number is: the number of business requests with risks for the target business in the first historical time period, as predicted based on the actual month-on-month number corresponding to the first historical time period; each second month-on-month predicted number is: the predicted number of business requests with risks for the target business in each month-on-month historical time period;

[0227] The anomaly detection module 803 is specifically configured to determine that the target business is abnormal within the first historical time period if the first actual number is outside the first predicted number interval and outside the second predicted number interval.

[0228] In some embodiments, the center point of the first prediction number interval is the mean of the first year-on-year prediction number and the second year-on-year prediction numbers, and the size of the first prediction number interval is: a first specified multiple of a first standard deviation; wherein the first standard deviation is the standard deviation of the first year-on-year prediction number and the second year-on-year prediction numbers;

[0229] And / or, the center point of the second prediction number interval is the mean of the first month-on-month prediction number and the second month-on-month prediction numbers, and the size of the second prediction number interval is: the second specified multiple of the second standard deviation; wherein, the second standard deviation is the standard deviation of the first month-on-month prediction number and the second month-on-month prediction numbers.

[0230] In some embodiments, the first prediction submodule includes:

[0231] a first prediction unit, configured to perform a prediction based on the first actual number and the actual year-on-year number corresponding to the first historical time period, to obtain the first year-on-year predicted number and the second year-on-year predicted numbers;

[0232] The second prediction unit is used to make a prediction based on the first real number and the month-on-month real number corresponding to the first historical time period to obtain the first month-on-month predicted number and the second month-on-month predicted numbers.

[0233] In some embodiments, the first predicted number acquisition module 802 is specifically configured to:

[0234] The number of business requests that are at risk for the target business in other historical time periods before the first historical time period is input into a time series model for predicting the number of business requests, and the number of business requests that are at risk for the target business in the first historical time period is obtained as a first predicted number.

[0235] In some embodiments, the apparatus further comprises:

[0236] a screening module configured to determine whether the first actual number satisfies any one of preset screening conditions before calculating the number of business requests at risk for the target business within the first historical time period based on the year-on-year actual number corresponding to the first historical time period and / or the month-on-month actual number corresponding to the first historical time period as the first predicted number;

[0237] Among them, the preset screening conditions include: the first real number is within a first real number interval, the first real number is within a second real number interval, and the first real number is less than a preset threshold; the center point of the first real number interval is the mean of the year-on-year real number corresponding to the first historical time period, and the size of the first real number interval is: a third specified multiple of the third standard deviation; the third standard deviation is the standard deviation of the year-on-year real number corresponding to the first historical time period; the center point of the second real number interval is the mean of the month-on-month real number corresponding to the first historical time period, and the size of the second real number interval is: a fourth specified multiple of the fourth standard deviation; the fourth standard deviation is the standard deviation of the month-on-month real number corresponding to the first historical time period;

[0238] If not, the first prediction submodule is triggered.

[0239] In some embodiments, the apparatus further comprises:

[0240] A display module is configured to display the first true number if the first true number is outside the predicted number interval.

[0241] The embodiment of the present invention further provides an electronic device, such as Figure 9 As shown, it includes a processor 901, a communication interface 902, a memory 903 and a communication bus 904, wherein the processor 901, the communication interface 902, and the memory 903 communicate with each other through the communication bus 904.

[0242] Memory 903, used for storing computer programs;

[0243] The processor 901 is configured to implement any of the above-mentioned service detection methods when executing the program stored in the memory 903 .

[0244] The communication bus mentioned in the terminal can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus. This communication bus can be divided into an address bus, a data bus, a control bus, etc. For ease of illustration, only one thick line is used in the figure, but this does not mean that there is only one bus or only one type of bus.

[0245] The communication interface is used for communication between the above terminal and other devices.

[0246] The memory may include random access memory (RAM) or non-volatile memory, such as at least one disk storage. Alternatively, the memory may be at least one storage device located away from the processor.

[0247] The above-mentioned processor can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, and discrete hardware components.

[0248] In another embodiment of the present invention, a computer-readable storage medium is provided, wherein a computer program is stored in the computer-readable storage medium. When the computer program is executed by a processor, the service detection method described in any one of the above embodiments is implemented.

[0249] In another embodiment of the present invention, a computer program product including instructions is provided. When the computer program product is run on a computer, the computer is enabled to execute the service detection method described in any one of the above embodiments.

[0250] In the above embodiments, all or part of the embodiments can be implemented by software, hardware, firmware, or any combination thereof. When implemented using software, all or part of the embodiments can be implemented in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of the present invention are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via a wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) method. The computer-readable storage medium can be any available medium that can be accessed by a computer or a data storage device such as a server or data center that includes one or more available media. The available medium can be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state drive (SSD)).

[0251] It should be noted that, in this document, relational terms such as first and second, etc., are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply the existence of any such actual relationship or order between these entities or operations. Moreover, the terms "comprises," "comprising," or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article, or device comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or elements inherent to such process, method, article, or device. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of other identical elements in the process, method, article, or device comprising the element.

[0252] Each embodiment in this specification is described in a related manner. Similar portions between the various embodiments can be referenced to each other. Each embodiment focuses on the differences between the other embodiments. In particular, the device, electronic device, computer-readable storage medium, and computer program product embodiments are generally similar to the method embodiments, so their descriptions are relatively simple. For related portions, reference can be made to the descriptions of the method embodiments.

[0253] The above description is only a preferred embodiment of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the present invention are included in the scope of protection of the present invention.

Claims

1. A service detection method, characterized in that: The method comprises: Obtaining the number of business requests with risks for the target business during the first historical time period as a first real number; Calculating the number of risky business requests for the target business in the first historical time period as a first predicted number based on a change trend in the number of risky business requests for the target business in other historical time periods before the first historical time period; If the first actual number is outside the predicted number interval, determining that the target business is abnormal in the first historical time period; wherein the center point of the predicted number interval is determined based on the first predicted number; The calculating, based on a change trend of the number of risky business requests for the target business in other historical time periods before the first historical time period, the number of risky business requests for the target business in the first historical time period as a first predicted number, includes: Calculate, based on the year-on-year actual number corresponding to the first historical time period and / or the month-on-month actual number corresponding to the first historical time period, the number of business requests with risks for the target business in the first historical time period as a first predicted number; The year-on-year actual number corresponding to the first historical time period represents: the number of business requests with risks for the target business in each year-on-year historical time period corresponding to the first historical time period; each year-on-year historical time period is located in another detection period before the detection period to which the first historical time period belongs, and has the same relative time sequence position as the first historical time period in the detection period to which it belongs; The actual number of the month-on-month comparison corresponding to the first historical time period represents: the number of business requests with risks for the target business in each month-on-month historical time period corresponding to the first historical time period; each month-on-month historical time period is located before the first historical time period and is adjacent to the first historical time period; The predicted number interval includes: a first predicted number interval and a second predicted number interval; the first predicted number includes: a first year-on-year predicted number and a first quarter-on-quarter predicted number; The center point of the first predicted number interval represents the average level of the first year-on-year predicted number and each second year-on-year predicted number. The first year-on-year predicted number is the number of business requests at risk for the target business during the first historical time period, as predicted based on the actual year-on-year number corresponding to the first historical time period. Each second year-on-year predicted number is the number of business requests at risk for the target business during each year-on-year historical time period. The center point of the second predicted number interval represents: an average level of the first month-on-month predicted number and each second month-on-month predicted number; the first month-on-month predicted number is: the number of business requests with risks for the target business in the first historical time period, as predicted based on the actual month-on-month number corresponding to the first historical time period; each second month-on-month predicted number is: the predicted number of business requests with risks for the target business in each month-on-month historical time period; If the first actual number is outside the predicted number interval, determining that the target business is abnormal within the first historical time period includes: If the first actual number is outside the first predicted number interval and outside the second predicted number interval, it is determined that the target business is abnormal within the first historical time period.

2. The method according to claim 1, characterized in that The center point of the first forecast number interval is the mean of the first year-on-year forecast number and the second year-on-year forecast numbers, and the size of the first forecast number interval is: a first specified multiple of a first standard deviation; wherein the first standard deviation is the standard deviation of the first year-on-year forecast number and the second year-on-year forecast numbers; And / or, the center point of the second prediction number interval is the mean of the first month-on-month prediction number and the second month-on-month prediction numbers, and the size of the second prediction number interval is: the second specified multiple of the second standard deviation; wherein, the second standard deviation is the standard deviation of the first month-on-month prediction number and the second month-on-month prediction numbers.

3. The method according to claim 1, characterized in that The calculating, based on the year-on-year actual number corresponding to the first historical time period and / or the month-on-month actual number corresponding to the first historical time period, the number of business requests with risks for the target business in the first historical time period as the first predicted number includes: Performing a forecast based on the first actual number and the actual year-on-year number corresponding to the first historical time period to obtain the first year-on-year forecast number and the second year-on-year forecast numbers; Based on the first real number and the month-on-month real number corresponding to the first historical time period, a prediction is made to obtain the first month-on-month predicted number and the second month-on-month predicted numbers.

4. The method according to claim 3, characterized in that The performing of prediction based on the first real number and the real year-on-year number corresponding to the first historical time period to obtain the first year-on-year predicted number and the second year-on-year predicted numbers includes: Inputting the year-on-year actual number corresponding to the first historical time period and the first actual number into a time series model for predicting the number of business requests, obtaining the number of business requests with risks for the target business in the first historical time period as a first year-on-year predicted number, and the number of business requests with risks for the target business in each of the year-on-year historical time periods as a second year-on-year predicted number; The step of performing a prediction based on the first real number and the month-on-month real number corresponding to the first historical time period to obtain the first month-on-month predicted number and each of the second month-on-month predicted numbers includes: The actual month-on-month number corresponding to the first historical time period and the first actual number are input into a time series model for predicting the number of business requests, and the number of business requests that are at risk for the target business in the first historical time period is obtained as the first month-on-month predicted number, and the number of business requests that are at risk for the target business in each month-on-month historical time period is obtained as the second month-on-month predicted number.

5. The method according to claim 1, wherein Before calculating the number of risky business requests for the target business in the first historical time period based on the year-on-year actual number corresponding to the first historical time period and / or the month-on-month actual number corresponding to the first historical time period as the first predicted number, the method further includes: Determining whether the first real number satisfies any one of the preset screening conditions; Among them, the preset screening conditions include: the first real number is within a first real number interval, the first real number is within a second real number interval, and the first real number is less than a preset threshold; the center point of the first real number interval is the mean of the year-on-year real number corresponding to the first historical time period, and the size of the first real number interval is: a third specified multiple of the third standard deviation; the third standard deviation is the standard deviation of the year-on-year real number corresponding to the first historical time period; the center point of the second real number interval is the mean of the month-on-month real number corresponding to the first historical time period, and the size of the second real number interval is: a fourth specified multiple of the fourth standard deviation; the fourth standard deviation is the standard deviation of the month-on-month real number corresponding to the first historical time period; If not, execute the step of calculating the number of business requests at risk for the target business within the first historical time period based on the year-on-year actual number corresponding to the first historical time period and / or the quarter-on-quarter actual number corresponding to the first historical time period as the first predicted number.

6. The method according to claim 1, characterized in that The method further comprises: If the first true number is outside the predicted number interval, the first true number is displayed.

7. A service detection device, characterized in that: The device comprises: A first real number acquisition module is configured to acquire the number of business requests with risks for a target business within a first historical time period as a first real number; a first predicted number acquisition module, configured to calculate the number of business requests at risk for the target business in the first historical time period as a first predicted number based on a changing trend of the number of business requests at risk for the target business in other historical time periods before the first historical time period; an anomaly detection module, configured to determine that the target business is abnormal within the first historical time period if the first actual number is outside a predicted number interval; wherein the center point of the predicted number interval is determined based on the first predicted number; The first predicted number acquisition module includes: A first prediction submodule is configured to calculate, as a first predicted number, the number of business requests with risks for the target business in the first historical time period based on the actual year-on-year number corresponding to the first historical time period and / or the actual month-on-month number corresponding to the first historical time period; The year-on-year actual number corresponding to the first historical time period represents: the number of business requests with risks for the target business in each year-on-year historical time period corresponding to the first historical time period; each year-on-year historical time period is located in another detection period before the detection period to which the first historical time period belongs, and has the same relative time sequence position as the first historical time period in the detection period to which it belongs; The actual number of the month-on-month comparison corresponding to the first historical time period represents: the number of business requests with risks for the target business in each month-on-month historical time period corresponding to the first historical time period; each month-on-month historical time period is located before the first historical time period and is adjacent to the first historical time period; The predicted number interval includes: a first predicted number interval and a second predicted number interval; the first predicted number includes: a first year-on-year predicted number and a first quarter-on-quarter predicted number; The center point of the first predicted number interval represents the average level of the first year-on-year predicted number and each second year-on-year predicted number. The first year-on-year predicted number is the number of business requests at risk for the target business during the first historical time period, as predicted based on the actual year-on-year number corresponding to the first historical time period. Each second year-on-year predicted number is the number of business requests at risk for the target business during each year-on-year historical time period. The center point of the second predicted number interval represents: an average level of the first month-on-month predicted number and each second month-on-month predicted number; the first month-on-month predicted number is: the number of business requests with risks for the target business in the first historical time period, as predicted based on the actual month-on-month number corresponding to the first historical time period; each second month-on-month predicted number is: the predicted number of business requests with risks for the target business in each month-on-month historical time period; The anomaly detection module is specifically configured to determine that the target business is abnormal within the first historical time period if the first actual number is outside the first predicted number interval and outside the second predicted number interval.

8. An electronic device, characterized in that: It includes a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other via the communication bus; Memory for storing computer programs; A processor, configured to implement the method steps described in any one of claims 1 to 6 when executing a program stored in a memory.

9. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method steps of any one of claims 1 to 6 are implemented.

Images