Application classification method and apparatus, electronic device, and computer-readable storage medium

By constructing and processing the call feature matrix between applications, and utilizing clustering and classification techniques, the problem of low efficiency and low accuracy in enterprise application system classification is solved, realizing automated and objective application classification and improving the accuracy and interpretability of classification.

CN116467613BActive Publication Date: 2025-11-04INDUSTRIAL AND COMMERCIAL BANK OF CHINA
View PDF 2 Cites 0 Cited by

Patent Information

Application Number
CN202310313091.3
Authority / Receiving Office
CN · China
Patent Type
Patents(China)
Current Assignee / Owner
Filing Date
2023-03-28
Publication Date
2025-11-04
Estimated Expiration
2043-03-28

AI Technical Summary

Technical Problem

In existing technologies, enterprises rely on personal experience when classifying new application systems, resulting in low work efficiency, low accuracy of classification results, subjective cognitive bias, unclear classification standards, and an inability to accurately reflect the importance of application systems.

Method used

A first call feature matrix associated with already graded applications and a second call feature matrix associated with applications to be graded are constructed. Through clustering and classification, based on the potential connections between call relationships between applications, an automated and objective rating of applications to be graded is achieved.

Benefits of technology

Through data analysis and feature mining, objective classification and grading of applications were achieved, improving the accuracy and interpretability of grading, freeing up manpower, avoiding subjective bias and multiple rounds of review, and improving work efficiency.

✦ Generated by Eureka AI based on patent content.

Smart Images

  • Figure CN116467613B_ABST
    Figure CN116467613B_ABST
Patent Text Reader

Abstract

The application discloses a kind of application hierarchical method and device, electronic equipment and computer readable storage medium, can be applied to big data technical field, information security technical field, also can be used in financial technology field.The application hierarchical method includes: constructing and multiple first call characteristic matrix associated with multiple hierarchical applications, and constructing second call characteristic matrix associated with application to be classified;Based on the clustering result of clustering processing to multiple first call characteristic matrix, multiple hierarchical applications are classified, and at least one reference application set is output;Second call characteristic matrix is classified using the clustering result, and the target reference application set to which the application to be classified belongs is determined;According to the first application level corresponding to target hierarchical application in target reference application set, the second application level of the application to be classified is determined.
Need to check novelty before this filing date? Find Prior Art

Description

TECHNICAL FIELD

[0001] The present disclosure relates to the technical field of big data, the technical field of information security, and the technical field of finance, and particularly relates to an application grading method and device, equipment, medium and program product. BACKGROUND

[0002] With the continuous improvement of enterprise fine management, enterprise internal information systems implement different requirements and controls by dividing different application levels, and realize the rational use of resources.

[0003] In the process of implementing the present disclosure, the inventors found that at least the following problems exist in the related art: For newly added application systems, application level division often relies on personal experience, which is low in work efficiency and wastes a lot of human resources, and on the other hand, due to subjective cognitive bias in qualitative classification, the grading standard is not clear, resulting in low accuracy of the grading result and low reference value, and the different importance of the application system cannot be accurately reflected. SUMMARY

[0004] In view of the above problems, the present disclosure provides an application grading method, device, equipment, medium and program product.

[0005] One aspect of the present disclosure provides an application grading method, comprising:

[0006] constructing a plurality of first call feature matrices associated with a plurality of already graded applications, and constructing a second call feature matrix associated with a to-be-graded application, the first call feature matrix being used to represent a first call relationship between the plurality of already graded applications, and the second call feature matrix being used to represent a second call relationship between the to-be-graded application and the plurality of already graded applications;

[0007] classifying the plurality of already graded applications based on a clustering result of clustering processing on the plurality of first call feature matrices, and outputting at least one reference application set;

[0008] performing reclassification processing on the second call feature matrix using the clustering result, and determining a target reference application set to which the to-be-graded application belongs;

[0009] determining a second application level of the to-be-graded application according to a first application level of a target already graded application in the target reference application set.

[0010] According to an embodiment of the present disclosure, the constructing a plurality of first call feature matrices associated with a plurality of already graded applications comprises:

[0011] reading application level data of the plurality of already graded applications and first call relationship data representing a call relationship between the plurality of already graded applications from a database;

[0012] Based on the application level data and the first call relationship data, a plurality of first call feature matrices associated with the plurality of classified applications is constructed.

[0013] According to an embodiment of the present disclosure, wherein the constructing the second call feature matrix associated with the application to be classified comprises:

[0014] The application level data of the plurality of classified applications and the second call relationship data representing the call relationship between the application to be classified and the plurality of classified applications are read from the database.

[0015] Based on the application level data and the second call relationship data, a second call feature matrix associated with the application to be classified is constructed.

[0016] According to an embodiment of the present disclosure, wherein,

[0017] The numerical value of the element in the first call feature matrix is used to represent the number of each level application called by the classified application and the number of each level application called.

[0018] The numerical value of the element in the second call feature matrix is used to represent the number of each level application called by the application to be classified and the number of each level application called.

[0019] According to an embodiment of the present disclosure, wherein the clustering processing of the plurality of first call feature matrices comprises:

[0020] According to the total number of levels corresponding to the application levels of the plurality of classified applications, the total number of predetermined clusters required for performing the clustering processing is determined.

[0021] According to the application levels of the plurality of classified applications and the total number of clusters, the plurality of first call feature matrices is subjected to initial classification to determine at least one initial data set.

[0022] The average value of at least one first call feature matrix associated with at least one classified application in each initial data set is calculated, and at least one initial cluster center required for performing the clustering processing is output.

[0023] After the plurality of first call feature matrices contained in the at least one initial data set is subjected to multiple iteration clustering based on the at least one initial cluster center, a clustering result is output.

[0024] According to an embodiment of the present disclosure, wherein the clustering result comprises at least one target data set and at least one target cluster center associated with the at least one target data set, and each target data set comprises at least one first call feature matrix associated with at least one classified application.

[0025] The second call feature matrix is classified by using the clustering result, and a target reference application set to which the application to be classified belongs is determined.

[0026] Similarities between the second call feature matrix and at least one target cluster center are respectively calculated to obtain at least one target similarity value.

[0027] The target reference application set to which the application to be classified belongs is determined according to the at least one target similarity value.

[0028] According to an embodiment of the present disclosure, wherein the similarities between the second call feature matrix and at least one target cluster center are respectively calculated to obtain at least one target similarity value includes:

[0029] At least one Euclidean distance between the second call feature matrix and at least one target cluster center is respectively calculated.

[0030] The at least one target similarity value is determined according to the at least one Euclidean distance.

[0031] Another aspect of the present disclosure provides an application classification device, comprising a construction module, a clustering module, a classification module, and a determination module.

[0032] The construction module is configured to construct a plurality of first call feature matrices associated with a plurality of classified applications, and construct a second call feature matrix associated with an application to be classified, the first call feature matrix being used to represent a first call relationship between the plurality of classified applications, and the second call feature matrix being used to represent a second call relationship between the application to be classified and the plurality of classified applications.

[0033] The clustering module is configured to classify the plurality of classified applications based on a clustering result of clustering the plurality of first call feature matrices, and output at least one reference application set.

[0034] The classification module is configured to classify the second call feature matrix by using the clustering result, and determine a target reference application set to which the application to be classified belongs.

[0035] The determination module is configured to determine a second application level of the application to be classified according to a first application level of a target classified application corresponding to the target reference application set.

[0036] According to an embodiment of the present disclosure, wherein the construction module comprises a first reading unit and a first construction unit.

[0037] The first reading unit is configured to read, from a database, application level data of a plurality of hierarchical applications and first call relationship data representing a call relationship between the plurality of hierarchical applications.

[0038] According to an embodiment of the present disclosure, the construction module comprises a second reading unit and a second construction unit.

[0039] The second reading unit is configured to read, from a database, application level data of a plurality of hierarchical applications and second call relationship data representing a call relationship between the plurality of hierarchical applications and the application to be classified.

[0040] According to an embodiment of the present disclosure, the numerical value of an element in the first call feature matrix represents the number of applications of each level called by the hierarchical applications and the number of applications of each level called by the hierarchical applications, and the numerical value of an element in the second call feature matrix represents the number of applications of each level called by the application to be classified and the number of applications of each level called by the application to be classified.

[0041] According to an embodiment of the present disclosure, the clustering module comprises a first determination unit, a primary classification unit, a first calculation unit, and an iteration unit.

[0042] The first determination unit is configured to determine a total number of clusters to be predetermined for performing the clustering processing according to a total number of levels corresponding to the application levels of the plurality of hierarchical applications. The primary classification unit is configured to perform primary classification on the plurality of first call feature matrices according to the application levels of the plurality of hierarchical applications and the total number of clusters to determine at least one initial data set. The first calculation unit is configured to calculate an average value of at least one first call feature matrix associated with at least one hierarchical application in each initial data set and output at least one initial cluster center to be predetermined for performing the clustering processing. The iteration unit is configured to output a clustering result after performing multiple iteration clustering on the plurality of first call feature matrices contained in the at least one initial data set based on the at least one initial cluster center.

[0043] According to an embodiment of the present disclosure, the clustering result comprises at least one target data set and at least one target cluster center associated with the at least one target data set, and each target data set comprises at least one first call feature matrix associated with at least one hierarchical application.

[0044] The classification module comprises a second calculation unit and a second determination unit.

[0045] The second computing unit is configured to calculate similarities between the second calling feature matrix and at least one target class cluster center respectively to obtain at least one target similarity value; and the second determining unit is configured to determine a target reference application set to which the application to be classified belongs according to the at least one target similarity value.

[0046] According to an embodiment of the present disclosure, the second computing unit comprises a computing subunit and a determining subunit.

[0047] The computing subunit is configured to calculate at least one Euclidean distance between the second calling feature matrix and at least one target class cluster center respectively; and the determining subunit is configured to determine at least one target similarity value according to the at least one Euclidean distance.

[0048] Another aspect of the present disclosure provides an electronic device, comprising: one or more processors; and a memory storing one or more programs, wherein the one or more programs, when executed by the one or more processors, cause the one or more processors to perform the application classification method.

[0049] Another aspect of the present disclosure also provides a computer-readable storage medium having stored thereon executable instructions that, when executed by a processor, cause the processor to perform the application classification method.

[0050] Another aspect of the present disclosure also provides a computer program product comprising a computer program that, when executed by a processor, implements the application classification method.

[0051] According to embodiments of this disclosure, by constructing a feature matrix representing the call relationships between applications and processing the data of the feature matrix, automated and objective rating of applications to be graded is achieved, freeing up manpower and improving upgrade efficiency. Simultaneously, by clustering the feature matrix, already graded applications are reclassified, and by categorizing, the application to be graded is grouped into the cluster of already graded applications most similar to its call characteristics. The application level of the application to be graded is determined based on the application levels of already graded applications within that cluster. Thus, through data analysis and feature mining, based on the potential connections between the call characteristics of applications, objective classification and grading of applications are achieved, improving the interpretability of application grading. This helps enterprises to manage information systems in a standardized and scientific manner, avoiding inaccurate application grading due to personal subjective cognitive biases. The grading is more objective and accurate, and it also avoids multiple rounds of review due to differing opinions among parties regarding manual grading results, further improving work efficiency. According to the embodiments of this disclosure, the above processing method takes into account the problem that the historical classification results of classified applications may not be accurate as the application calling relationship changes continuously. By using clustering processing to reclassify multiple classified applications, the classification results of classified applications can be corrected and updated, which can avoid historical classification errors. At the same time, it also provides an accurate reference data basis for the subsequent classification processing of applications to be classified, further improving the objectivity, accuracy and referenceability of the final classification results. Attached Figure Description

[0052] The foregoing contents, as well as other objects, features, and advantages of this disclosure, will become clearer from the following description of embodiments with reference to the accompanying drawings, in which:

[0053] Figure 1 The illustration schematically depicts application scenarios of the application classification method, apparatus, device, medium, and program product according to embodiments of the present disclosure;

[0054] Figure 2 A flowchart illustrating an application hierarchical method according to an embodiment of the present disclosure is shown schematically;

[0055] Figure 3 The diagram illustrates an example of a call relationship shown by a first call feature matrix and a second call feature matrix according to an embodiment of the present disclosure.

[0056] Figure 4 This diagram schematically illustrates an example of inter-application call pointers according to embodiments of the present disclosure;

[0057] Figure 5 A flowchart illustrating an application grading method according to another embodiment of this disclosure is shown schematically;

[0058] Figure 6A structural block diagram of an application classification device according to an embodiment of the present disclosure is schematically shown;

[0059] Figure 7 A block diagram of an electronic device adapted to implement an application classification method according to an embodiment of the present disclosure is schematically shown. DETAILED DESCRIPTION

[0060] Hereinafter, embodiments of the present disclosure will be described with reference to the accompanying drawings. It should be understood, however, that the description which follows is merely exemplary and is not intended to limit the scope of the present disclosure. In the following detailed description of the embodiments of the present disclosure, numerous specific details are set forth in order to provide a thorough understanding of the present disclosure. However, it would be apparent to one skilled in the art that the various embodiments of the present disclosure can be practiced without these specific details. In other instances, well-known structures and functions have not been described in detail in order to avoid obscuring aspects of the present disclosure.

[0061] The terms used herein are merely used to describe specific embodiments and are not intended to limit the present disclosure. The terms "include" and "have" and the like used herein indicate the presence of the described features, steps, operations, and / or components but do not preclude the presence or addition of one or more other features, steps, operations, or components.

[0062] All terms used herein, including technical and scientific terms, have the same meanings as those generally understood by those skilled in the art unless otherwise defined. It should be noted that the terms used herein should be interpreted as having meanings consistent with the context of the present description, and should not be interpreted in an idealized or excessively formal manner.

[0063] In the case of using expressions similar to "a plurality of A, B, and C, etc.", in general, it should be interpreted according to the meaning of the expression as generally understood by those skilled in the art (for example, "a system having a plurality of A, B, and C" should include, but is not limited to, a system having A alone, a system having B alone, a system having C alone, a system having A and B, a system having A and C, a system having B and C, and / or a system having A, B, C, etc.).

[0064] In the embodiments of the present disclosure, the collection, updating, analysis, processing, use, transmission, provision, disclosure, storage, etc. of the data involved (for example, including but not limited to user personal information) comply with the relevant legal regulations, are used for legal purposes, and do not violate public order and good customs. In particular, necessary measures are taken for user personal information to prevent illegal access to user personal information data, and to maintain user personal information security, network security, and national security.

[0065] In the embodiments of the present disclosure, the authorization or consent of the user is obtained before the user's personal information is acquired or collected.

[0066] It should be noted that the application classification method and device of the embodiments of the present disclosure can be applied to the field of big data technology, and can also be applied to the field of financial technology, and can also be applied to any field other than the field of big data technology and the field of finance. The embodiments of the present disclosure do not limit the application field of the application classification method and device.

[0067] The embodiments of the present disclosure provide an application classification method, comprising:

[0068] A plurality of first call feature matrices associated with a plurality of classified applications are constructed, and a second call feature matrix associated with a to-be-classified application is constructed. The first call feature matrix is used to represent a first call relationship between the plurality of classified applications, and the second call feature matrix is used to represent a second call relationship between the to-be-classified application and the plurality of classified applications. Based on a clustering result of clustering processing on the plurality of first call feature matrices, the plurality of classified applications are classified, and at least one reference application set is output. The second call feature matrix is classified based on the clustering result, and a target reference application set to which the to-be-classified application belongs is determined. The second application level of the to-be-classified application is determined according to the first application level corresponding to the target classified application in the target reference application set.

[0069] Figure 1 An application scenario diagram of the application classification method, device, equipment, medium and program product according to the embodiments of the present disclosure is schematically shown.

[0070] As shown in Figure 1 According to the application scenario 100 of the embodiment, the first terminal device 101, the second terminal device 102, the third terminal device 103, the network 104 and the server 105 can be included. The network 104 is a medium for providing a communication link between the first terminal device 101, the second terminal device 102, the third terminal device 103 and the server 105. The network 104 can include various connection types, such as wired, wireless communication links or optical fiber cables, etc.

[0071] The user can use multiple of the first terminal device 101, the second terminal device 102 and the third terminal device 103 to interact with the server 105 through the network 104 to receive or send messages, etc. Various communication client applications can be installed on the first terminal device 101, the second terminal device 102 and the third terminal device 103, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social platform software, etc. (only as examples).

[0072] The first terminal device 101, the second terminal device 102 and the third terminal device 103 can be various electronic devices with display screens and supporting web browsing, including but not limited to smart phones, tablet computers, laptop computers and desktop computers, etc.

[0073] The server 105 can be a server providing various services, for example, a background management server (only for example) providing support for a website browsed by a user using the first terminal device 101, the second terminal device 102, and the third terminal device 103. The background management server can perform analysis and the like on received user requests and the like, and feed back the processing result (for example, a webpage, information, or data, or the like obtained or generated according to the user request) to the terminal device.

[0074] In the application scenario of the embodiments of the present disclosure, the user can initiate a request for obtaining application classification of a to-be-classified application to the server 105 through the first terminal device 101, the second terminal device 102, and the third terminal device 103. In response to the user request, the server 105 can perform the application classification method of the embodiments of the present disclosure, construct a plurality of first calling feature matrices associated with a plurality of classified applications, and construct a second calling feature matrix associated with the to-be-classified application. Based on processing of the plurality of first calling feature matrices and the second calling feature matrix, a target reference application set to which the to-be-classified application belongs is determined, the application level of the to-be-classified application is determined according to the application level of the target classified application in the target reference application set, the application classification result is output, and the user is displayed through the first terminal device 101, the second terminal device 102, and the third terminal device 103.

[0075] It should be noted that the application classification method provided by the embodiments of the present disclosure can generally be executed by the server 105. Accordingly, the application classification apparatus provided by the embodiments of the present disclosure can generally be arranged in the server 105. The application classification method provided by the embodiments of the present disclosure can also be executed by a server or a server cluster different from the server 105 and capable of communicating with the first terminal device 101, the second terminal device 102, the third terminal device 103, and / or the server 105. Accordingly, the application classification apparatus provided by the embodiments of the present disclosure can also be arranged in a server or a server cluster different from the server 105 and capable of communicating with the first terminal device 101, the second terminal device 102, the third terminal device 103, and / or the server 105.

[0076] It should be understood that Figure 1 The number of terminal devices, networks, and servers in the above-mentioned scenario is only illustrative. According to the needs of implementation, there can be any number of terminal devices, networks, and servers.

[0077] The following will be based on Figure 1 the scenario described above, and the application classification method of the embodiments of the present disclosure will be described in detail. Figure 2-6

[0078] Figure 2 ​A flowchart of an application classification method according to an embodiment of the present disclosure is shown schematically.

[0079] As shown in Figure 2 The application classification method of this embodiment includes operations S201-S204.

[0080] In operation S201, a plurality of first call feature matrices associated with a plurality of classified applications are constructed, and a second call feature matrix associated with a to-be-classified application is constructed.

[0081] In operation S202, based on a clustering result of clustering processing of the plurality of first call feature matrices, the plurality of classified applications are classified, and at least one reference application set is output.

[0082] In operation S203, the second call feature matrix is classified using the clustering result to determine a target reference application set to which the to-be-classified application belongs.

[0083] In operation S204, a second application level of the to-be-classified application is determined according to a first application level of a target classified application in the target reference application set.

[0084] According to an embodiment of the present disclosure, in operation S201, the first call feature matrix and the second call feature matrix can be constructed based on application level data of the plurality of classified applications and inter-application call relationship data. The inter-application call relationship data may, for example, include first call relationship data representing a call relationship between the plurality of classified applications, and second call relationship data representing a call relationship between the to-be-classified application and the plurality of classified applications. The first call feature matrix is used to represent the first call relationship between the plurality of classified applications, and the second call feature matrix is used to represent the second call relationship between the to-be-classified application and the plurality of classified applications.

[0085] According to an embodiment of the present disclosure, after the first call feature matrix and the second call feature matrix are constructed, in operation S202, the plurality of classified applications are classified by clustering processing of the plurality of first call feature matrices. Here, considering that the historical classification results of the classified applications are not necessarily accurate due to the continuous changes in application call relationships, the plurality of classified applications are reclassified by clustering processing, so that the classification results of the classified applications can be corrected and updated.

[0086] According to an embodiment of the present disclosure, the clustering result can include a plurality of data clusters, each data cluster corresponding to a reference application set. In operation S203, the second call feature matrix is classified using the clustering result, for example, the second call feature matrix can be classified into the most similar cluster, to determine a target reference application set to which the to-be-classified application belongs.

[0087] According to an embodiment of the present disclosure, the target hierarchical application in the target reference application set can be all hierarchical applications contained in the target reference application set, or one or more hierarchical applications selected from the target reference application set as the target hierarchical application.

[0088] In the case where the target hierarchical application is all hierarchical applications in the target reference application set, or in the case where the target hierarchical application is one or more hierarchical applications selected from the target reference application set, in operation S204, the second application level of the application to be classified is determined according to the first application level corresponding to the target hierarchical application in the target reference application set, for example, the application level with the highest proportion in the plurality of hierarchical applications can be determined as the application level of the application to be classified.

[0089] In the case where the target hierarchical application is one hierarchical application selected from the target reference application set, the application level of the target hierarchical application can be directly used as the application level of the target hierarchical application.

[0090] According to an embodiment of the present disclosure, by constructing a feature matrix representing the calling relationship between applications, and through data processing of the feature matrix, automatic and objective rating of the application to be classified is realized, which liberates manpower and improves the upgrading efficiency. At the same time, through clustering processing of the feature matrix, the hierarchical application is reclassified, and through the classification processing, the application to be classified is classified into a hierarchical application cluster with the most similar calling features, and the application level of the application to be classified is determined according to the application level of the hierarchical application in the application cluster. In this way, through data analysis and feature mining, based on the potential relationship between the calling features between applications, the objective classification and grading of the application is realized, the explainability of the application grading is improved, the standardized and scientific management of the information system by the enterprise is facilitated, the inaccuracy of the application grading caused by personal subjective cognitive bias is avoided, the grading is more objective and accurate, and multiple rounds of review caused by different opinions on the artificial grading results are also avoided, and the work efficiency is further improved.

[0091] According to an embodiment of the present disclosure, the above processing method takes into account the problem that the historical grading results of the hierarchical application are not necessarily accurate as the application calling relationship changes, and through clustering processing, the plurality of hierarchical applications are reclassified, so that the grading results of the hierarchical application can be updated and corrected, the historical grading error can be avoided, and at the same time, accurate reference data basis is provided for subsequent grading processing of the application to be classified, further improving the objectivity, accuracy and referenceability of the final grading result.

[0092] According to embodiments of this disclosure, the values ​​of the elements in the first call feature matrix can be used to characterize: the number of applications of each level called by the hierarchical application and the number of applications of each level called; the values ​​of the elements in the second call feature matrix can be used to characterize: the number of applications of each level called by the application to be hierarchically classified and the number of applications of each level called.

[0093] Figure 3 The diagram schematically illustrates example calls based on a first call feature matrix and a second call feature matrix according to embodiments of the present disclosure. The data in Table 1 synchronously illustrates the call relationships shown according to… Figure 3 The example shown illustrates the call relationships between the first and second call feature matrices.

[0094] Table 1

[0095]

[0096] like Figure 3 As shown in Table 3, the first or second call feature matrix takes the following form:

[0097]

[0098] The first or second call feature matrix has multiple rows, each corresponding to a different application level. The first or second call feature matrix consists of two columns, with the first column containing elements x... i1 The numerical value represents the number of applications at each level that have been invoked (either tiered or pending tiering); the element x in the second column... i2 The value represents the number of applications at each level invoked by the tiered application (or the application to be tiered). For example, x 11 A value of 5 indicates that the tiered application (or application awaiting tiering) has been called by 5 first-level applications; x 12 A value of 6 indicates that the tiered application (or application awaiting tiering) has called 6 first-level applications; x 31 A value of 2 indicates that the tiered application (or the application to be tiered) is called by two tier 3 applications; x 22 The value of 6 indicates that the tiered application (or the application to be tiered) has called 6 secondary applications.

[0099] According to the embodiments of this disclosure, the constructed first call feature matrix and second call feature matrix not only include inter-application call pointing information, but also include application level information and application quantity information of the calling or called application. They fully reflect the inter-application call relationship from multiple dimensions. Based on this type of feature matrix, the resulting application classification and grading results are more objective and accurate.

[0100] According to an embodiment of the present disclosure, the plurality of first call feature matrices associated with the plurality of ranked applications and the second call feature matrix associated with the to-be-ranked application can be constructed based on application rank data (as shown in Table 2 below) and inter-application call relationship data (as shown in Table 3 below) of the plurality of ranked applications, and the construction can be performed by using the following method.

[0101] The application rank data of the plurality of ranked applications, the first call relationship data representing the call relationship between the plurality of ranked applications, and the second call relationship data representing the call relationship between the to-be-ranked application and the plurality of ranked applications are read from the database.

[0102] Table 2

[0103] Application system name Application level Application system X 1st / 2nd / 3rd / 4th / 5th

[0104] The application rank data of the ranked applications is shown in Table 2 above, and the information in the table includes the application system name and the application rank (for example, in the table, the application system is divided into 5 ranks, i.e., ranks 1 to 5).

[0105] The first call relationship data representing the call relationship between the plurality of ranked applications (1-4) and the second call relationship data representing the call relationship between the to-be-ranked application N and the plurality of ranked applications can be stored in a data table, such as Table 3 (based on an application interface call registration table).

[0106] Table 3

[0107] Called party name Caller name Application system 2 Application system 1 Application system 3 Application system 2 Application system N Application system 2 Application system 4 Application system N

[0108] Figure 4 An example diagram of inter-application call direction is schematically shown according to an embodiment of the present disclosure. Figure 4 The indicated inter-application call direction is based on the data in Table 3, and the arrow direction indicates the call direction.

[0109] After reading the application rank data of the plurality of ranked applications and the inter-application call relationship data, the plurality of first call feature matrices associated with the plurality of ranked applications can be constructed based on the application rank data and the first call relationship data, and the second call feature matrix associated with the to-be-ranked application can be constructed based on the application rank data and the second call relationship data.

[0110] According to an embodiment of the present disclosure, after the plurality of first call feature matrices are constructed, the reclassification of the plurality of ranked applications is implemented by clustering processing on the plurality of first call feature matrices. The clustering processing can use various clustering algorithms, such as k-means, k-means++, bi-kmeans, DBSCAN, etc.

[0111] The clustering processing is described below by taking the K-Means algorithm as an example.

[0112] The K-Means algorithm is an unsupervised clustering algorithm, where K represents the number of categories and Means represents the mean value. It is an algorithm that clusters data points by mean value. The K-Means algorithm divides similar data by a pre-set K value and initial center points of each category, and iteratively optimizes the clustering result by the mean value after division to obtain the optimal clustering result. In the K-Means algorithm, the Euclidean distance is mainly used to measure the similarity between data, that is, the smaller the Euclidean distance between data, the higher the data similarity.

[0113] Embodiments of the present disclosure construct a feature vector of each application system according to the inter-application call relationship in the business link, divide the enterprise internal application systems into a plurality of application clusters with similar call features using the K-Means clustering algorithm, and finally output the clustering result and the center point of each application cluster. The K-Means algorithm needs to determine the number of clusters and the initial cluster center in advance.

[0114] Specifically, the clustering processing of the plurality of first call feature matrices comprises:

[0115] Operation 11, determining the cluster number K value. According to the total level number corresponding to the application level of the plurality of classified applications, the total number of clusters to be predetermined for performing clustering processing is determined. The K value can be determined according to the number of levels corresponding to the classified applications. For example, the enterprise divides the application systems into 5 levels, so K=5 is determined.

[0116] Operation 12, determining the application initial cluster center.

[0117] According to the application level of the plurality of classified applications and the total number of clusters, the plurality of first call feature matrices are subjected to initial classification to determine at least one initial data set, and the average value of at least one first call feature matrix associated with at least one classified application in each initial data set is calculated, and at least one initial cluster center to be predetermined for performing clustering processing is output.

[0118] For example, according to the application level of the classified applications and the total number of clusters (5 clusters), the classified applications are divided into 5 application clusters, such as application A being classified as a 1-level application, application B being classified as a 1-level application, application C being classified as a 2-level application, application D being classified as a 3-level application, and so on. Application A and application B belonging to the 1-level application are divided into the same application cluster, application C belonging to the 2-level application is divided into the same application cluster, and application D belonging to the 3-level application is divided into the same application cluster.

[0119] and the center point of each cluster is calculated as the initial cluster center C k , and the calculation method is as follows formula (1).

[0120]

[0121] The calculation method is to take the arithmetic mean of each element in the application matrix vector in the cluster, see formula (2) below.

[0122]

[0123] where x ij represents the numerical value of each element in the matrix vector, and n represents the number of applications in the application cluster k.

[0124] Operation 13, based on at least one initial class cluster center, after multiple iterations of clustering on the plurality of first call feature matrices contained in at least one initial data set, output the clustering result.

[0125] Specifically, the Euclidean distance of each application to each center point can be calculated, and the application system is reclassified according to the nearest distance.

[0126] For example, the Euclidean distance d(X, C k ) of application X to the center point C k of application cluster k is calculated as follows formula (3)

[0127]

[0128] According to the secondary clustering result, the center point of each application cluster is recalculated, the new center point of the k clusters is compared with the original center point, when the center point no longer changes and the application belongs to the application cluster no longer changes, the iteration is ended, and the final clustering result and the center point C k of each application cluster are output, otherwise the above operation 13 is repeated.

[0129] According to the embodiments of the present disclosure, the reclassification of the plurality of classified applications is realized through the clustering process, so that the classification result of the classified applications can be corrected and updated, and the historical classification error can be avoided. Since the classified applications have been labeled with original application level information, the K-Means clustering algorithm has a strong advantage in determining the number of class clusters and the initial class cluster center. The relatively accurate number of class clusters and the initial class cluster center can accelerate the convergence of the algorithm, reduce the process of subsequent iteration calculation, and improve the calculation speed.

[0130] According to the embodiments of the present disclosure, the clustering result includes at least one target data set and at least one target class cluster center associated with the at least one target data set, and each target data set includes at least one first call feature matrix associated with at least one classified application.

[0131] The second call feature matrix is classified using the clustering result to determine the target reference application set to which the application to be classified belongs, including: The second call feature matrix is classified using the clustering result to determine the target reference application set to which the application to be classified belongs, including:

[0132] Operation 21: Calculate the similarity between the second call feature matrix and at least one target cluster center to obtain at least one target similarity value.

[0133] First, calculate at least one Euclidean distance between the second call feature matrix and at least one target cluster center; then, determine at least one target similarity value based on the at least one Euclidean distance.

[0134] Calculate the Euclidean distance d(S, C) from the application S to be classified to the center point of each application cluster. k As shown in equation (4)

[0135]

[0136] Operation 22: Determine the target reference application set to which the application to be classified belongs based on at least one target similarity value. For example, the application cluster containing the closest center point is taken as the application cluster to which the application to be classified belongs.

[0137] Figure 5 A flowchart illustrating an application hierarchical method according to another embodiment of the present disclosure is shown.

[0138] According to the application classification method of this disclosure, firstly, a feature vector of each application system is constructed based on the inter-application call relationship in the business chain. Then, the K-Means clustering algorithm is used to divide the enterprise's internal application systems into several application clusters with similar call characteristics. Next, by calculating the Euclidean distance between the application to be classified and the center point of each application cluster, the application cluster with the shortest distance is selected as the cluster to which the application to be classified belongs, and the application level with the highest proportion in that application cluster is taken as the application level of the application to be classified. Specifically, as follows... Figure 5 Operations S501-S508 are performed in the middle.

[0139] like Figure 5 As shown, in operation S501, application level data of multiple graded applications (refer to Table 2 in the previous embodiment) and application call relationship data (refer to Table 3 in the previous embodiment) are collected. A call feature matrix of graded applications is constructed, and a call feature matrix of applications to be graded is constructed. The specific construction method is described in the previous embodiment regarding the construction of the first call feature matrix and the second call feature matrix, and will not be repeated here.

[0140] In operations S502-S505, the K-Means algorithm is used to cluster multiple graded applications by calling the feature matrix. Based on the clustering results, the multiple graded applications are classified, and at least one set of reference applications and at least one cluster center are output.

[0141] The K-Means algorithm needs to determine the number of clusters and the initial cluster center in advance. Specifically, in operation S502, the application clusters are divided according to the existing application level system, and the initial cluster centers of the application clusters are calculated. In operations S503-S505, iterative calculation is performed, and the application clusters are re-divided and the cluster centers are re-calculated until the values of the cluster centers do not change, and the final classification result and the cluster center are output. The method of performing clustering processing can refer to the method of clustering processing the plurality of first call feature matrices in the foregoing embodiments, which will not be described here.

[0142] In operations S506-S507, according to the clustering result (including at least one application cluster and at least one cluster center associated with the at least one application cluster), the application to be classified is classified by using the clustering result, and the target application cluster to which the application to be classified belongs is determined.

[0143] Specifically, in operation S506, the Euclidean distance of the application to be classified to each cluster center is calculated, and in operation S507, it is classified into the target application cluster with the shortest distance. The specific processing method can refer to the operation of classifying the second call feature matrix by using the clustering result in the foregoing embodiments, which will not be described here.

[0144] In operation S508, the application level with the highest number ratio in the target application cluster is counted, and is taken as the application level of the application to be classified.

[0145] Based on the above application classification method, the present disclosure also provides an application classification device. The following will be combined Figure 6 with the description of the device.

[0146] Figure 6 The structure block diagram of the application classification device according to the embodiment of the present disclosure is schematically shown.

[0147] As Figure 6 shown, the application classification device 600 of the embodiment includes a construction module 601, a clustering module 602, a classification module 603, and a determination module 604.

[0148] The construction module 601 is configured to construct a plurality of first call feature matrices associated with a plurality of classified applications, and construct a second call feature matrix associated with an application to be classified, the first call feature matrix being used to represent the first call relationship between the plurality of classified applications, and the second call feature matrix being used to represent the second call relationship between the application to be classified and the plurality of classified applications.

[0149] The clustering module 602 is configured to classify the plurality of classified applications based on the clustering result of clustering processing the plurality of first call feature matrices, and output at least one reference application set.

[0150] The categorizing module 603 is configured to perform categorization processing on the second call feature matrix by using the clustering result, and determine a target reference application set to which the application to be classified belongs.

[0151] The determining module 604 is configured to determine a second application level of the application to be classified according to a first application level of a target classified application in the target reference application set.

[0152] According to an embodiment of the present disclosure, the constructing module 601 comprises a first reading unit and a first constructing unit.

[0153] The first reading unit is configured to read, from a database, application level data of a plurality of classified applications and first call relationship data representing a call relationship between the plurality of classified applications; and the first constructing unit is configured to construct a plurality of first call feature matrices associated with the plurality of classified applications based on the application level data and the first call relationship data.

[0154] According to an embodiment of the present disclosure, the constructing module 601 comprises a second reading unit and a second constructing unit.

[0155] The second reading unit is configured to read, from a database, application level data of a plurality of classified applications and second call relationship data representing a call relationship between the application to be classified and the plurality of classified applications; and the second constructing unit is configured to construct a second call feature matrix associated with the application to be classified based on the application level data and the second call relationship data.

[0156] According to an embodiment of the present disclosure, the value of an element in the first call feature matrix represents the number of each level application called by the classified application and the number of each level application called by the classified application; and the value of an element in the second call feature matrix represents the number of each level application called by the application to be classified and the number of each level application called by the application to be classified.

[0157] According to an embodiment of the present disclosure, the clustering module 602 comprises a first determining unit, a preliminary categorizing unit, a first calculating unit, and an iteration unit.

[0158] The first determining unit is configured to determine a total number of class clusters to be predetermined according to a total level number corresponding to the application levels of the plurality of classified applications; the initial classification unit is configured to perform initial classification on the plurality of first call feature matrices according to the application levels of the plurality of classified applications and the total number of class clusters, and determine at least one initial data set; the first calculating unit is configured to calculate an average value of at least one first call feature matrix associated with at least one classified application in each initial data set, and output at least one initial class cluster center to be predetermined for the clustering processing; and the iteration unit is configured to output a clustering result after performing multiple iteration clustering on the plurality of first call feature matrices contained in the at least one initial data set based on the at least one initial class cluster center.

[0159] According to an embodiment of the present disclosure, the clustering result includes at least one target data set and at least one target class cluster center associated with the at least one target data set, and each target data set includes at least one first call feature matrix associated with at least one classified application.

[0160] The classification module 603 includes a second calculating unit and a second determining unit.

[0161] The second calculating unit is configured to calculate a similarity between the second call feature matrix and the at least one target class cluster center respectively, and obtain at least one target similarity value; and the second determining unit is configured to determine a target reference application set to which the application to be classified belongs according to the at least one target similarity value.

[0162] According to an embodiment of the present disclosure, the second calculating unit includes a calculating subunit and a determining subunit.

[0163] The calculating subunit is configured to calculate at least one Euclidean distance between the second call feature matrix and the at least one target class cluster center respectively; and the determining subunit is configured to determine the at least one target similarity value according to the at least one Euclidean distance.

[0164] According to an embodiment of the present disclosure, any of the modules 601, 602, 603, 604 can be combined in one module, or any of the modules can be split into multiple modules. Alternatively, at least part of the functions of one or more of the modules can be combined with at least part of the functions of other modules, and implemented in one module. According to an embodiment of the present disclosure, any of the modules 601, 602, 603, 604 can be implemented at least in part as a hardware circuit, such as a field-programmable gate array (FPGA), a programmable logic array (PLA), a system on chip, a system on board, a system on package, an application-specific integrated circuit (ASIC), or any other reasonable manner of integrating or packaging a circuit, etc., or implemented in hardware or firmware, or implemented in any one of software, hardware and firmware or in a proper combination of any of them. Alternatively, any of the modules 601, 602, 603, 604 can be implemented at least in part as computer program modules, which, when executed, can perform the corresponding functions.

[0165] Figure 7 A block diagram of an electronic device suitable for implementing the application classification method according to an embodiment of the present disclosure is schematically shown.

[0166] As shown in Figure 7 , the electronic device 700 according to an embodiment of the present disclosure includes a processor 701, which can perform various appropriate actions and processes according to programs stored in a read-only memory (ROM) 702 or loaded from a storage portion 708 into a random access memory (RAM) 703. The processor 701 can include, for example, a general-purpose microprocessor (such as a CPU), an instruction set processor, and / or a related chipset, and / or a special-purpose microprocessor (such as an application-specific integrated circuit (ASIC)), etc. The processor 701 can also include an on-board memory for cache use. The processor 701 can include a single processing unit or multiple processing units for performing different actions of the method processes according to embodiments of the present disclosure.

[0167] In the RAM 703, various programs and data required for the operation of the electronic device 700 are stored. The processor 701, the ROM 702, and the RAM 703 are connected to each other via the bus 704. The processor 701 performs various operations of the method flow according to the embodiments of the present disclosure by executing the programs in the ROM 702 and / or the RAM 703. It should be noted that the programs can also be stored in one or more memories other than the ROM 702 and the RAM 703. The processor 701 can also perform various operations of the method flow according to the embodiments of the present disclosure by executing the programs stored in the one or more memories.

[0168] According to embodiments of the present disclosure, the electronic device 700 can further include an input / output (I / O) interface 705, which is also connected to the bus 704. The electronic device 700 can further include one or more of the following components connected to the input / output (I / O) interface 705: an input part 706 including a keyboard, a mouse, and the like; an output part 707 including a display such as a cathode ray tube (CRT), a liquid crystal display (LCD), and the like, and a speaker, and the like; a storage part 708 including a hard disk, and the like; and a communication part 709 including a network interface card such as a LAN card, a modem, and the like. The communication part 709 performs communication processing via a network such as the Internet. A drive 710 is also connected to the input / output (I / O) interface 705 as necessary. A removable medium 711 such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, and the like is mounted on the drive 710 as necessary, so that a computer program read therefrom is installed in the storage part 708 as necessary.

[0169] The present disclosure also provides a computer readable storage medium, which can be included in the device / apparatus / system described in the above embodiments; or can exist separately without being assembled into the device / apparatus / system. The above computer readable storage medium carries one or more programs, when the one or more programs are executed, the method according to the embodiments of the present disclosure is implemented.

[0170] According to embodiments of this disclosure, the computer-readable storage medium may be a non-volatile computer-readable storage medium, such as, but not limited to: portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof. In this disclosure, the computer-readable storage medium may be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. For example, according to embodiments of this disclosure, the computer-readable storage medium may include ROM 702 and / or RAM 703 and / or one or more memories other than ROM 702 and RAM 703 described above.

[0171] Embodiments of this disclosure also include a computer program product comprising a computer program containing program code for performing the methods shown in the flowchart. When the computer program product is run on a computer system, the program code is used to enable the computer system to implement the application hierarchy method provided in the embodiments of this disclosure.

[0172] When the computer program is executed by the processor 701, it performs the functions defined in the system / apparatus of this disclosure embodiments. According to embodiments of this disclosure, the systems, apparatuses, modules, units, etc., described above can be implemented by computer program modules.

[0173] In one embodiment, the computer program may rely on a tangible storage medium such as an optical storage device or a magnetic storage device. In another embodiment, the computer program may also be transmitted and distributed in the form of signals over a network medium, and may be downloaded and installed via the communication section 709, and / or installed from a removable medium 711. The program code contained in the computer program can be transmitted using any suitable network medium, including but not limited to: wireless, wired, etc., or any suitable combination thereof.

[0174] In such an embodiment, the computer program can be downloaded and installed from a network via the communication section 709, and / or installed from the removable medium 711. When the computer program is executed by the processor 701, it performs the functions defined in the system of this disclosure embodiment. According to embodiments of this disclosure, the systems, devices, apparatuses, modules, units, etc., described above can be implemented by computer program modules.

[0175] According to embodiments of this disclosure, program code for executing the computer programs provided in embodiments of this disclosure can be written in any combination of one or more programming languages. Specifically, these computational programs can be implemented using high-level procedural and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages ​​include, but are not limited to, languages ​​such as Java, C++, Python, "C", or similar programming languages. The program code can execute entirely on the user's computing device, partially on the user's device, partially on a remote computing device, or entirely on a remote computing device or server. In cases involving remote computing devices, the remote computing device can be connected to the user's computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0176] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this disclosure. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram or flowchart, and combinations of blocks in a block diagram or flowchart, may be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0177] Those skilled in the art will understand that the features described in the various embodiments and / or claims of this disclosure can be combined or combined in various ways, even if such combinations or combinations are not explicitly described in this disclosure. In particular, the features described in the various embodiments and / or claims of this disclosure can be combined or combined in various ways without departing from the spirit and teachings of this disclosure. All such combinations and / or combinations fall within the scope of this disclosure.

[0178] The embodiments of this disclosure have been described above. However, these embodiments are for illustrative purposes only and are not intended to limit the scope of this disclosure. Although various embodiments have been described above, this does not mean that the measures in the various embodiments cannot be used advantageously in combination. The scope of this disclosure is defined by the appended claims and their equivalents. Various substitutions and modifications can be made by those skilled in the art without departing from the scope of this disclosure, and all such substitutions and modifications should fall within the scope of this disclosure.

Claims

1. An application of a hierarchical method, comprising: Based on the application level data and inter-application call relationship data of multiple graded applications, a number of first call feature matrices associated with the multiple graded applications are constructed, and a second call feature matrix associated with the application to be graded is constructed. The first call feature matrix is ​​used to characterize the first call relationship between the multiple graded applications, and the second call feature matrix is ​​used to characterize the second call relationship between the application to be graded and the multiple graded applications. Based on the clustering results of the clustering processing of the multiple first call feature matrices, the application levels of the multiple graded applications are reclassified, and at least one set of reference applications is output. The clustering results are used to classify the second call feature matrix to determine the target reference application set to which the application to be classified belongs. The second application level of the application to be classified is determined based on the first application level corresponding to the target classified application in the target reference application set.

2. The method according to claim 1, wherein, Based on application level data and inter-application call relationship data of multiple tiered applications, several first call feature matrices associated with multiple tiered applications are constructed, including: Read application level data of multiple graded applications from the database, and first call relationship data representing the call relationship between the multiple graded applications; Based on the application level data and the first call relationship data, construct multiple first call feature matrices associated with multiple graded applications.

3. The method according to claim 2, wherein, Based on application level data and inter-application call relationship data of multiple graded applications, a second call feature matrix associated with the application to be graded is constructed, including: Read application level data of multiple graded applications from the database, and second call relationship data representing the call relationship between the application to be graded and the multiple graded applications; Based on the application level data and the second call relationship data, a second call feature matrix associated with the application to be classified is constructed.

4. The method according to claim 3, wherein, The values ​​of the elements in the first call feature matrix are used to characterize: the number of applications of each level called by the hierarchical application and the number of applications of each level called. The values ​​of the elements in the second call feature matrix are used to characterize: the number of applications of each level called by the application to be classified and the number of applications of each level called.

5. The method according to claim 1, wherein, Clustering the plurality of first call feature matrices includes: Based on the total number of levels corresponding to the application levels of multiple graded applications, determine the total number of clusters that need to be predetermined to perform the clustering process; Based on the application level of multiple graded applications and the total number of the clusters, the multiple first call feature matrices are initially classified to determine at least one initial data set; Calculate the average value of at least one first call feature matrix associated with at least one hierarchical application in each of the initial data sets, and output at least one initial cluster center that needs to be predetermined to perform the clustering process; Based on the at least one initial cluster center, the clustering results are output after multiple iterative clustering of multiple first call feature matrices contained in the at least one initial data set.

6. The method according to any one of claims 1-5, wherein, The clustering result includes at least one target data set and at least one target cluster center associated with the at least one target data set, each of the target data sets including at least one first call feature matrix associated with at least one hierarchical application; The clustering results are used to classify the second call feature matrix to determine the target reference application set to which the application to be classified belongs, including: Calculate the similarity between the second call feature matrix and at least one of the target cluster centers to obtain at least one target similarity value; Based on the at least one target similarity value, determine the target reference application set to which the application to be classified belongs.

7. The method according to claim 6, wherein, Calculating the similarity between the second call feature matrix and at least one of the target cluster centers to obtain at least one target similarity value includes: Calculate at least one Euclidean distance between the second call feature matrix and at least one of the target cluster centers; The at least one target similarity value is determined based on the at least one Euclidean distance.

8. An application grading device, comprising: The construction module is used to construct multiple first call feature matrices associated with multiple classified applications and second call feature matrices associated with the application to be classified, based on application level data and inter-application call relationship data of multiple classified applications. The first call feature matrices are used to characterize the first call relationship between the multiple classified applications, and the second call feature matrix is ​​used to characterize the second call relationship between the application to be classified and the multiple classified applications. The clustering module is used to reclassify the application levels of the multiple graded applications based on the clustering results of the clustering processing of the multiple first call feature matrices, and output at least one set of reference applications. The classification module is used to classify the second call feature matrix using the clustering results, and to determine the target reference application set to which the application to be classified belongs. The determination module is used to determine the second application level of the application to be classified based on the first application level corresponding to the target classified application in the target reference application set.

9. An electronic device, comprising: One or more processors; Storage device for storing one or more programs. Wherein, when the one or more programs are executed by the one or more processors, the one or more processors perform the method according to any one of claims 1 to 7.

10. A computer-readable storage medium having executable instructions stored thereon, which, when executed by a processor, cause the processor to perform the method according to any one of claims 1 to 7.

11. A computer program product comprising a computer program that, when executed by a processor, implements the method according to any one of claims 1 to 7.

Citation Information

Patent Citations

  • Dynamic detection method and system for malicious application of Android system

    CN114547605A

  • Business scene classification method and device, storage medium and electronic equipment

    CN115795342A