Communication Behavior Restoration Method, Device and Storage Medium for Communication Applications

Abstract

The present invention discloses a communication behavior restoration method, device and storage medium for a communication application. First, based on a large amount of network log data, the invention matches and calculates the sending type data and the receiving type data, and then integrates the matched sending type data and receiving type data to restore the real original communication behavior, greatly improving the reference value of the data. Finally, by calculating the confidence level of the combined result, the results with low confidence level are filtered out, ensuring the accuracy of the restoration result and reducing the probability of incorrect matching.

Description

Technical Field

[0001] The present invention relates to the technical field of data analysis, and in particular to a method, device, and storage medium for restoring communication behaviors of a communication application. Background Art

[0002] In recent years, communication application software has emerged in an endless stream. People use instant messaging software almost every day in their daily work and life. The network logs generated by it are of great significance for work such as analyzing the online behaviors of personnel and analyzing the communication situations with the outside world. The architecture designs, encryption methods, data characteristics, etc. of various software are not completely the same, and the data is complex and massive. Therefore, only the log records from the client to the server can be understood from the original encrypted network logs and other data, and the specific communication objects of users cannot be specifically understood, and the original communication behaviors cannot be known. For the above reasons, a reasonable method is needed to restore the communication situation from the recorded data such as network logs. Summary of the Invention

[0003] Object of the Invention: Aiming at the problems existing in the prior art, the present invention provides a method, device, and storage medium for restoring communication behaviors of a communication application, which can accurately restore communication behaviors from massive encrypted network logs and other recorded data.

[0004] Technical Solution: The method for restoring communication behaviors of the communication application described in the present invention includes:

[0005] Obtain the communication record data of the communication application, and divide it into sending type data and receiving type data;

[0006] Respectively split the sending type data and the receiving type data into several window data according to a preset time period window, and form a group of the window data belonging to the same communication application after splitting;

[0007] For each sending type window data in each group, find the receiving type window data belonging to the same time period window in the group and perform matching calculation. If the matching is successful, integrate the successful sending type window data and receiving type window data according to time into a communication record recording the communication between both parties;

[0008] Calculate the confidence level of the matching result according to each communication record;

[0009] Save the communication records with a confidence level greater than a preset threshold as the data after restoring the communication behaviors.

[0010] Further, the obtaining of the communication record data of the communication application and dividing it into sending type data and receiving type data specifically includes:

[0011] Obtain the communication record data of the communication application within a period of time;

[0012] Extract the communication application type, action type, data content size, time, and account of each record data from the communication record data as the identifier of a record data;

[0013] Divide the communication record data with the action type of sending into sending - type data, and divide the communication record data with the action type of receiving into receiving - type data.

[0014] Furthermore, the splitting of the sending - type data and the receiving - type data into several window data according to a preset time - period window specifically includes:

[0015] Set the preset time - period window as N minutes. Divide the sending - type data and the receiving - type data into one window data every N minutes respectively to obtain several window data, and mark the time - period identifier of the window data. Among them, if the time of a certain record data is less than M seconds away from the boundary of the time - period window, then copy this record data into two, and divide them into two window data located at the boundary of the time - period window respectively. M is a positive integer.

[0016] Furthermore, for each sending - type window data in each group, finding the receiving - type window data belonging to the same time - period window within the group and performing matching calculations specifically includes:

[0017] For each sending - type window data in each group, find the receiving - type window data belonging to the same time - period window within the group;

[0018] Obtain the difference between the size of the data sent in the sending - type window data and the size of the data received in the corresponding receiving - type window data. If the difference is within the preset threshold and the data time difference is within the preset time threshold, then it is determined that the match is successful. Specifically includes:

[0019] A. If the action types of two window data are sending text and receiving text respectively, the data time difference is within n seconds, and the difference in the size of the text data sent and received is between [pmin, pmax] bytes, then it is determined that the match is successful. pmin and pmax are the preset minimum and maximum text differences respectively, and n is the first time - difference threshold;

[0020] B. If the action types of two window data are sending pictures and receiving pictures respectively, the data time difference is within m seconds, and the difference in the size of the pictures sent and received does not exceed p bytes, then it is determined that the match is successful. p is the preset picture - difference threshold, and m is the second time - difference threshold;

[0021] C. If the action types of two pieces of window data are sending audio / video and receiving audio / video respectively, the time difference between the data is within s seconds, and the difference in the sizes of the sent and received audio / video does not exceed Max(S, R)*k%, it is determined that the match is successful, where S and R are the sizes of the sent and received audio / video respectively, k is the preset audio / video difference threshold, and s is the third time difference threshold.

[0022] Further, calculating the confidence level of the matching result according to each communication record specifically includes:

[0023] Obtaining the number of communications between both parties in each communication record, and whether they are friends;

[0024] Calculating the confidence level of the matching result according to the number of communications between both parties and whether they are friends.

[0025] Further, calculating the confidence level of the matching result according to the number of communications between both parties and whether they are friends specifically includes:

[0026] Calculating the confidence level of the matching result according to the number of communications between both parties and whether they are friends according to the following formula:

[0027] Confidence level = countMin*weightMin + weightMax*countMax + isFriend*weightFriend

[0028] countMin = Min(a2b, b2a)

[0029] countMax = Max(a2b, b2a)

[0030] In the formula, a2b represents the number of messages sent from one party a to the other party b, b2a represents the number of messages sent from b to a, weightMin, weightMax, and weightFriend respectively represent the corresponding weights, and isFriend represents whether they are friends, with a value of 0 or 1, where 0 represents not friends and 1 represents friends.

[0031] The communication behavior restoration device of the communication application described in the present invention includes a processor and a computer program stored in a memory and executable on the processor. When the processor executes the program, the above method is implemented.

[0032] The storage medium containing computer-executable instructions described in the present invention, where the computer-executable instructions are used to execute the above method when executed by a computer processor.

[0033] Beneficial effects: Compared with the prior art, the significant advantages of the present invention are as follows: First, based on a large amount of network log data, the present invention matches and calculates the sent data and received data, and then integrates the matched sent data and received data to restore the real original communication behavior, greatly improving the reference value of the data. Finally, by calculating the confidence level of the combined result, the results with low confidence levels are filtered out, ensuring the accuracy of the restoration result and reducing the probability of incorrect matching. Brief Description of the Drawings

[0034] Figure 1 is a schematic flowchart of the communication behavior restoration method of the communication application provided by the present invention;

[0035] Figure 2 is an example diagram of the matching calculation in the present invention;

[0036] Figure 3 is a structural diagram of the communication behavior restoration device of the communication application provided by the present invention. Detailed Embodiments

[0037] The following will clearly and completely describe the technical solutions in the embodiments of the present invention with reference to the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only a part of the embodiments of the present invention, rather than all the embodiments. All other embodiments obtained by those of ordinary skill in the art based on the embodiments of the present invention without creative efforts shall fall within the protection scope of the present invention.

[0038] Embodiment 1

[0039] The following will provide a detailed description of the communication behavior restoration method of the communication application provided by the embodiments of the present invention. As Figure 1 shown, the method of this embodiment includes the following steps:

[0040] S1. Obtain the communication record data of the communication application and divide it into sent data and received data.

[0041] Among them, communication applications include, but are not limited to, instant messaging software such as WeChat, QQ, Douyin, etc. The communication record data is encrypted or unencrypted network logs and other communication record data generated when users communicate using communication applications. The obtained communication record data is complex and massive, and may also include data from multiple applications. To facilitate subsequent processing, the communication record data for a period of time can be obtained first. After the processing is completed, the communication record data for another period of time can be obtained until the processing is completed. The communication record data is generally c2s data, which is the record data between the application and the server. To facilitate subsequent processing, the communication application type, action type, data content size, time, and account of each record data can be extracted from the communication record data as the identifier of a record data. According to the identifier and the specific data content, a c2s detail list can be generated. Among them, the identifier can also be extracted when it is used later, but this method will slow down the data processing speed and is not recommended. After obtaining the communication record data, by extracting the action type of the communication record data, the communication record data with the action type of sending is classified as sending-type data, and the communication record data with the action type of receiving is classified as receiving-type data. The sending action types include sending text, sending pictures, sending audio and video, etc., and the receiving action types are similar.

[0042] S2. Split the sending-type data and the receiving-type data into several window data respectively according to a preset time period window, and form a group of window data belonging to the same communication application after splitting.

[0043] Among them, set the preset time period window to N minutes. Split the sending-type data and the receiving-type data into one window data every N minutes respectively to obtain several window data, and mark the time period identifier of the window data. The time period identifier can be 1, 2, 3... in numbers, or A, B, C... in letters, or a combination of letters and numbers, etc. Finally, the window data can be distinguished. When splitting, if the time of a certain record data is less than M seconds away from the time period window boundary, copy this record data into two and divide them into two window data located at the time period window boundary respectively. M is a positive integer, aiming to prevent data with similar times from being unable to participate in the matching calculation because they are assigned to different windows.

[0044] S3. For each sending-type window data in each group, find the receiving-type window data belonging to the same time period window in the group and perform matching calculation. If the matching is successful, integrate the successful sending-type window data and receiving-type window data according to the time into a communication record recording the communication between both parties.

[0045] Among them, the method of matching calculation specifically includes:

[0046] S31. For each sending-type window data in each group, find the receiving-type window data belonging to the same time period window in the group;

[0047] S32. Obtain the difference between the size of the data sent in the sending class window data and the size of the data received in the corresponding receiving class window data. If the difference is within the preset threshold and the data times differ within the preset time threshold, it is determined that the match is successful. As Figure 2 shown, specifically, the matching calculation sets different thresholds according to different data types sent. Specifically, the matching calculation can be performed in the following manner according to the identifier of the recorded data:

[0048] A. If the action types of the two window data are SEND_TEXT and RECV_TEXT respectively, the data times differ within n seconds, and the difference in the size of the text data sent and received is between [pmin, pmax] bytes, it is determined that the match is successful. pmin and pmax are the preset minimum and maximum text difference values respectively, and n is the first time difference threshold;

[0049] B. If the action types of the two window data are SEND_IMAGE and RECV_IMAGE respectively, the data times differ within m seconds, and the difference in the size of the images sent and received does not exceed p bytes, it is determined that the match is successful. p is the preset image difference threshold, and m is the second time difference threshold;

[0050] C. If the action types of the two window data are SEND_AUDIO_VIDEO and RECV_AUDIO_VIDEO respectively, the data times differ within s seconds, and the difference in the size of the audio-video sent and received does not exceed Max(S, R)*k%, it is determined that the match is successful. S and R are the sizes of the audio-video sent and received respectively, and k is the preset audio-video difference threshold, and s is the third time difference threshold.

[0051] It can be understood that if the data type is other types, the above similar scheme can also be implemented.

[0052] The c2s detailed list data of the sending class window data and the receiving class window are integrated to form a communication record for both parties to communicate, that is, the p2p type detailed list. Taking the communication line record data of a single text sending as an example, its data processing process is as follows: Assume that the two record data (c2s detailed list) generated by a single text sending communication behavior are CDR1 and CDR2:

[0053] CDR1: account = account a, time = January 1, 2022, 9:01:01, action type = SEND_TEXT, data content size = 120, communication application type = APP1, other non-essential fields omitted;

[0054] CDR2: account = account b, time = January 1, 2022, 9:01:02, action type = RECV_TEXT, data content size = 140, communication application type = APP1, other non-essential fields omitted;

[0055] CDR1 and CDR2 are integrated into the detailed list CDR3:

[0056] CDR3: Sender account = account a, Receiver account = account b, Time = January 1, 2022, 9:01:01, Action type = SEND_TEXT, Data packet size = 120, Application type = APP1, Other non-essential fields are omitted.

[0057] S4. Calculate the confidence level of the matching result based on each communication record.

[0058] Among them, the confidence level calculation method includes:

[0059] S41. Obtain the number of communications between both parties in each communication record, and whether they are friends; among them, sending data (text, image, audio, video, etc.) by one party once is counted as one communication time;

[0060] S42. Calculate the confidence level of the matching result based on the number of communications between both parties and whether they are friends. The specific formula is:

[0061] Confidence level = countMin * weightMin + weightMax * countMax + isFriend * weightFriend

[0062] countMin = Min(a2b, b2a)

[0063] countMax = Max(a2b, b2a)

[0064] In the formula, a2b represents the number of messages sent from party a to party b, b2a represents the number of messages sent from b to a, weightMin, weightMax, and weightFriend respectively represent the corresponding weights, and isFriend represents whether they are friends. The value is 0 or 1. 0 represents not friends, and 1 represents friends. Usually, the non-friend relationship only indicates that the friend relationship between the two accounts is not maintained in the system, and it cannot guarantee that there is indeed no friend relationship between the accounts.

[0065] S5. Save the communication records with a confidence level greater than the preset threshold as the data after restoring the communication behavior.

[0066] Among them, the threshold and the weights of weightMin, weightMax, and weightFriend are obtained through actual dialing tests. After the actual dialing tests, the weight configurations of each item can be further optimized according to the results, the final confidence level threshold can be modified, and the proportion of mis-matched detailed list numbers can be adjusted.

[0067] Embodiment 2

[0068] Figure 3 It is a schematic structural diagram of a device provided by an embodiment of the present invention. The embodiment of the present invention provides services for the implementation of the communication behavior restoration method of the above-mentioned first embodiment of the present invention. Figure 3 It shows a block diagram of an exemplary device 12 suitable for implementing the embodiments of the present invention. Figure 3 The shown device 12 is merely an example and should not impose any limitation on the functions and usage scope of the embodiments of the present invention.

[0069] As Figure 3 shown, the device 12 is presented in the form of a general-purpose computing device. The components of the device 12 may include but are not limited to: one or more processors or processing units 16, a system memory 28, and a bus 18 connecting different system components including the system memory 28 and the processing unit 16.

[0070] The bus 18 represents one or more of several types of bus structures, including a memory bus or a memory controller, a peripheral bus, a graphics acceleration port, a processor, or a local bus using any bus structure in a variety of bus structures. For example, these architectures include but are not limited to Industry Standard Architecture (ISA) bus, Micro Channel Architecture (MAC) bus, Enhanced ISA bus, Video Electronics Standards Association (VESA) local bus, and Peripheral Component Interconnect (PCI) bus.

[0071] The device 12 typically includes a variety of computer system-readable media. These media can be any available media accessible by the device 12, including volatile and non-volatile media, removable and non-removable media.

[0072] The system memory 28 may include computer system-readable media in the form of volatile memory, such as random access memory (RAM) 30 and / or cache memory 32. The device 12 may further include other removable / non-removable, volatile / non-volatile computer system storage media. By way of example only, a storage system 34 may be used for reading and writing non-removable, non-volatile magnetic media ( Figure 3 not shown, commonly referred to as a "hard disk drive"). Although Figure 3 not shown in, a disk drive for reading and writing removable non-volatile disks (such as "floppy disks") and an optical disk drive for reading and writing removable non-volatile optical disks (such as CD-ROM, DVD-ROM, or other optical media) may be provided. In these cases, each drive may be connected to the bus 18 through one or more data media interfaces. The memory 28 may include at least one program product having a set (e.g., at least one) of program modules configured to perform the functions of the embodiments of the present invention.

[0073] A program / utility 40 having a set (at least one) of program modules 42 can be stored, for example, in the memory 28. Such program modules 42 include, but are not limited to, an operating system, one or more application programs, other program modules, and program data. Each or some combination of these examples may include the implementation of a network environment. The program modules 42 generally execute the functions and / or methods in the embodiments described in the present invention.

[0074] The device 12 can also communicate with one or more external devices 14 (such as a keyboard, a pointing device, a display 24, etc.), and can also communicate with one or more devices that enable a user to interact with the device 12, and / or communicate with any device that enables the device 12 to communicate with one or more other computing devices (such as a network card, a modem, etc.). Such communication can be carried out through the input / output (I / O) interface 22. Moreover, the device 12 can also communicate with one or more networks (such as a local area network (LAN), a wide area network (WAN), and / or a public network, such as the Internet) through the network adapter 20. As Figure 3 shown, the network adapter 20 communicates with other modules of the device 12 through the bus 18. It should be understood that although not shown in the figure, other hardware and / or software modules can be used in combination with the device 12, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems, etc.

[0075] The processing unit 16 executes various functional applications and data processing by running the programs stored in the system memory 28, such as implementing the communication behavior restoration method of the communication application provided in the first embodiment of the present invention.

[0076] Embodiment Three

[0077] The embodiment of the present invention provides a storage medium containing computer-executable instructions, and the computer-executable instructions are used to execute the method of the first embodiment when executed by a computer processor.

[0078] The computer storage medium of the embodiments of the present invention may adopt any combination of one or more computer-readable media. The computer-readable medium may be a computer-readable signal medium or a computer-readable storage medium. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination of the above. More specific examples (non-exhaustive list) of the computer-readable storage medium include: an electrical connection having one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In this document, the computer-readable storage medium may be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction execution system, apparatus, or device.

[0079] The computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, which carries the computer-readable program code. Such a propagated data signal may take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. The computer-readable signal medium may also be any computer-readable medium other than the computer-readable storage medium, which can send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, apparatus, or device.

[0080] The program code contained on the computer-readable medium may be transmitted by any appropriate medium, including but not limited to wireless, wire, optical fiber cable, RF, etc., or any suitable combination of the above.

[0081] The computer program code for performing the operations of the present invention may be written in one or more programming languages or combinations thereof. The programming languages include object-oriented programming languages such as Java, Smalltalk, C++, and also include conventional procedural programming languages such as the "C" language or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, executed as an independent software package, partially on the user's computer and partially on a remote computer, or entirely on the remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any type of network including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (for example, by using an Internet service provider to connect through the Internet).

[0082] Certainly, the computer-executable instructions in the storage medium provided by the embodiments of the present invention are not limited to the above method operations, and can also execute the related operations in the communication behavior restoration method of the communication application provided by any embodiment of the present invention.

Claims

1. A method for restoring communication behaviors of a communication application, characterized in that the method includes: Obtaining communication record data of the communication application and dividing it into sending - type data and receiving - type data; Respectively splitting the sending - type data and the receiving - type data into several window data according to a preset time - period window, and forming a group of window data belonging to the same communication application after splitting; For each sending - type window data in each group, searching for the receiving - type window data belonging to the same time - period window in the group and performing a matching calculation. If the matching is successful, then integrating the successfully - matched sending - type window data and receiving - type window data according to time into a communication record that records the communication between both parties; Calculating the confidence level of the matching result according to each communication record; Saving the communication records with a confidence level greater than a preset threshold as the data after restoring the communication behaviors; Among them, the step of, for each sending - type window data in each group, searching for the receiving - type window data belonging to the same time - period window in the group and performing a matching calculation specifically includes: For each sending - type window data in each group, searching for the receiving - type window data belonging to the same time - period window in the group; If the action types of two pieces of window data are respectively sending text and receiving text, the time difference between the data is within n seconds, and the difference in the size of the text data sent and received is within the interval [pmin, pmax] bytes, then it is determined that the matching is successful, where pmin and pmax are respectively the preset minimum text difference value and the maximum text difference value, and n is the first time - difference threshold; If the action types of two pieces of window data are respectively sending a picture and receiving a picture, the time difference between the data is within m seconds, and the difference in the size of the pictures sent and received does not exceed p bytes, then it is determined that the matching is successful, where p is the preset picture - difference threshold and m is the second time - difference threshold; If the action types of two pieces of window data are respectively sending audio - video and receiving audio - video, the time difference between the data is within s seconds, and the difference in the size of the audio - video sent and received does not exceed Max(S,R) * k%, then it is determined that the matching is successful, where S and R are respectively the sizes of the audio - video sent and received, and k is the preset audio - video - difference threshold, and s is the third time - difference threshold.

2. The method for restoring communication behaviors of a communication application according to claim 1, characterized in that: The step of obtaining communication record data of the communication application and dividing it into sending - type data and receiving - type data specifically includes: Obtaining communication record data of the communication application within a period of time; Extracting the communication application type, action type, data content size, time, and account of each record data from the communication record data as the identifier of a piece of record data; Dividing the record data with the action type of sending into sending - type data, and dividing the record data with the action type of receiving into receiving - type data.

3. The method for restoring communication behaviors of a communication application according to claim 1, characterized in that: The step of respectively splitting the sending - type data and the receiving - type data into several window data according to a preset time - period window specifically includes: Set the preset time period window to N minutes. Divide the sending type data and receiving type data into window data every N minutes respectively, obtaining a number of window data, and mark the time period identifier of the window data. Among them, if the time of a certain record data is less than M seconds away from the boundary of the time period window, then copy this record data into two pieces and divide them into two window data located at the boundary of the time period window respectively, where M is a positive integer.

4. The method for restoring communication behavior of a communication application according to claim 1, wherein: The calculating the confidence level of the matching result according to each communication record specifically includes: Obtaining the number of communications between both parties in each communication record, and whether they are in a friend relationship; Calculating the confidence level of the matching result according to the number of communications between both parties and whether they are in a friend relationship.

5. The method for restoring communication behavior of a communication application according to claim 4, wherein: The calculating the confidence level of the matching result according to the number of communications between both parties and whether they are in a friend relationship specifically includes: Calculating the confidence level of the matching result according to the number of communications between both parties and whether they are in a friend relationship according to the following formula: Confidence level = countMin * weightMin + weightMax * countMax + isFriend * weightFriend; countMin = Min(a2b, b2a); countMax = Max(a2b, b2a); In the formula, a2b represents the number of messages sent from party a to party b, b2a represents the number of messages sent from b to a, weightMin, weightMax, and weightFriend respectively represent the corresponding weights, and isFriend represents whether they are friends, with a value of 0 or 1, where 0 represents not friends and 1 represents a friend relationship.

6. A device for restoring communication behavior of a communication application, wherein: It includes a processor and a computer program stored on a memory and executable on the processor, characterized in that: when the processor executes the program, it implements the method described in any one of claims 1-5.

7. A storage medium containing computer-executable instructions, wherein, The computer-executable instructions are used to execute the method described in any one of claims 1-5 when executed by a computer processor.

Images