A data detection method, device, equipment and readable storage medium

Abstract

The application discloses a data detection method and device, equipment and a readable storage medium, and is applied to the computer technology field. According to the classification category, the application classifies the data to be detected, obtains a plurality of character categories, then determines the frequency domain features of each character category, and if the frequency domain features of any character category exceed the frequency domain feature range corresponding to the current character category, the current character category is alarmed. When the alarm of any character category is a false alarm, the frequency domain feature range corresponding to the current character category is optimized according to the frequency domain features of the false alarm character category, so that the frequency domain feature range corresponding to each character category is adaptively optimized, and the accuracy of the frequency domain feature range is gradually improved. The scheme obtains the frequency domain features by analyzing the features of the characters in the frequency domain, detects and alarms the frequency domain features, improves the detection accuracy and efficiency by converting the detection angle, and gradually improves the accuracy of the frequency domain feature range, and further improves the detection accuracy.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of computer, in particular to a data detection method and device, equipment and readable storage medium. BACKGROUND

[0002] Currently, in order to monitor the running process of a computer system, abnormal logs can be selected from the running logs of the system by using matching rules, and analyzed as alarm data. However, since the matching rules need to be strictly, clearly and completely defined, the cost of designing the rules is high, and the matching rules can only match the existing black list data, and cannot detect unknown black list data, so the matching rules can be bypassed, for example, abnormal information is slightly changed to become "normal information" to avoid the matching of the matching rules.

[0003] Therefore, how to accurately and efficiently detect alarm data is a problem to be solved by those skilled in the art. SUMMARY

[0004] Therefore, the purpose of the present application is to provide a data detection method, device, equipment and readable storage medium to accurately and efficiently detect alarm data. The specific scheme is as follows:

[0005] In a first aspect, the present application provides a data detection method, comprising:

[0006] obtaining target data to be detected;

[0007] classifying characters in the target data according to a preset classification category to obtain a plurality of character classes;

[0008] determining the frequency domain feature of each character class, and if the frequency domain feature of any character class exceeds the frequency domain feature range corresponding to the current character class, the current character class is alarmed;

[0009] if the alarm of any character class is a false alarm, the frequency domain feature range corresponding to the current character class is optimized according to the frequency domain feature of the character class of the false alarm.

[0010] Optionally, the obtaining of the target data to be detected comprises:

[0011] obtaining log information in the running process of a computer device to obtain the target data;

[0012] and / or

[0013] obtaining webpage text information to obtain the target data;

[0014] and / or

[0015] obtaining traffic information in a target network to obtain the target data.

[0016] Optionally, the determining the frequency domain feature of each character class comprises:

[0017] determining a feature value of a character in each character class;

[0018] normalizing the feature value of the character in each character class;

[0019] performing Fourier transform on the feature value of the character in each character class after the normalization to obtain the frequency domain feature of each character class.

[0020] Optionally, the method further comprises:

[0021] if the frequency domain feature of any character class does not exceed the frequency domain feature range corresponding to the current character class, the current character class is not alarmed.

[0022] Optionally, the optimizing the frequency domain feature range corresponding to the current character class according to the frequency domain feature of the mis-alarmed character class comprises:

[0023] making the frequency domain feature of the mis-alarmed character class within the optimized frequency domain feature range corresponding to the current character class.

[0024] Optionally, the method further comprises:

[0025] if the optimization instruction of the frequency domain feature range is received, collecting the frequency domain features of unalarmed character classes within a preset time length;

[0026] in a case where it is determined that the frequency domain feature of the unalarmed character class is a misjudgment, optimizing the frequency domain feature range corresponding to the current character class according to the frequency domain feature of the unalarmed character class.

[0027] Optionally, the optimizing the frequency domain feature range corresponding to the current character class according to the frequency domain feature of the unalarmed character class comprises:

[0028] making the frequency domain feature of the unalarmed character class not within the optimized frequency domain feature range corresponding to the current character class.

[0029] In a second aspect, the present application provides a data detection device, comprising:

[0030] an acquisition module configured to acquire target data to be detected;

[0031] a classification module configured to classify characters in the target data according to a preset classification category to obtain a plurality of character classes;

[0032] a detection module configured to determine a frequency domain feature of each character class, and if the frequency domain feature of any character class exceeds a frequency domain feature range corresponding to a current character class, the current character class is alarmed.

[0033] The self-learning module is configured to, if the alarm of any character class is a false alarm, optimize the frequency domain feature range corresponding to the current character class according to the frequency domain feature of the false alarm character class.

[0034] Optionally, the obtaining module is specifically configured to:

[0035] Obtain log information in a running process of the computer device to obtain the target data.

[0036] And / or

[0037] Obtain webpage text information to obtain the target data.

[0038] And / or

[0039] Obtain traffic information in a target network to obtain the target data.

[0040] Optionally, the detection module is specifically configured to:

[0041] Determine the feature value of the character in each character class.

[0042] Perform normalization processing on the feature value of the character in each character class.

[0043] Perform Fourier transform on the feature value of the character in each character class after the normalization processing to obtain the frequency domain feature of each character class.

[0044] Optionally, the detection module is further configured to:

[0045] If the frequency domain feature of any character class does not exceed the frequency domain feature range corresponding to the current character class, no alarm is given to the current character class.

[0046] Optionally, the self-learning module is specifically configured to:

[0047] Make the frequency domain feature of the false alarm character class within the optimized frequency domain feature range corresponding to the current character class.

[0048] Optionally, the self-learning module is further configured to:

[0049] If the optimization instruction of the frequency domain feature range is received, collect the frequency domain features of unalarmed character classes within a preset time length.

[0050] In a case where it is determined that the frequency domain feature of the unalarmed character class belongs to a false judgment, optimize the frequency domain feature range corresponding to the current character class according to the frequency domain feature of the unalarmed character class.

[0051] Optionally, the self-learning module is further configured to:

[0052] This ensures that the frequency domain characteristics of non-alarm character classes are not within the range of the optimized frequency domain characteristics corresponding to the current character class.

[0053] Thirdly, this application provides a data detection device, comprising:

[0054] Memory, used to store computer programs;

[0055] A processor is used to execute the computer program to implement the aforementioned disclosed data detection method.

[0056] Fourthly, this application provides a readable storage medium for storing a computer program, wherein the computer program, when executed by a processor, implements the aforementioned disclosed data detection method.

[0057] As can be seen from the above scheme, this application provides a data detection method, including: acquiring target data to be detected; classifying the characters in the target data according to a preset classification category to obtain multiple character classes; determining the frequency domain features of each character class; if the frequency domain features of any character class exceed the frequency domain feature range corresponding to the current character class, then issuing an alarm for the current character class; if the alarm for any character class is a false alarm, then optimizing the frequency domain feature range corresponding to the current character class based on the frequency domain features of the false alarm character class.

[0058] As can be seen, this application first classifies the target data to be detected according to classification categories, resulting in multiple character classes. Then, it determines the frequency domain features of each character class. If the frequency domain features of any character class exceed the frequency domain feature range corresponding to the current character class, an alarm is issued for that character class. Simultaneously, when any alarm for any character class is a false alarm, the frequency domain feature range corresponding to the current character class is optimized based on the frequency domain features of the false alarm character classes. This allows for adaptive optimization of the frequency domain feature range corresponding to each character class, gradually improving the accuracy of the frequency domain feature range during actual detection. This scheme no longer analyzes data from the time domain but instead obtains frequency domain features from the character features in the frequency domain data, and then detects and issues alarms based on these frequency domain features. This shift in detection perspective improves detection accuracy and efficiency. Furthermore, since the frequency domain feature range of each character class can be gradually optimized during actual detection, detection accuracy is further improved.

[0059] Correspondingly, the data detection device, equipment, and readable storage medium provided in this application also have the above-mentioned technical effects.

[0060] Other features and advantages of this application will be described in detail in the following detailed description section. Attached Figure Description

[0061] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of this application. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0062] Figure 1 This is a flowchart illustrating a data detection method according to an exemplary embodiment;

[0063] Figure 2 This is a schematic diagram of a curve distribution according to an exemplary embodiment;

[0064] Figure 3 This is a flowchart illustrating another data detection method according to an exemplary embodiment;

[0065] Figure 4 This is a schematic diagram of a data detection device according to an exemplary embodiment;

[0066] Figure 5 This is a schematic diagram of a data detection device according to an exemplary embodiment;

[0067] Figure 6 A server architecture diagram provided in this application;

[0068] Figure 7 A terminal structure diagram provided for this application. Detailed Implementation

[0069] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0070] Currently, to monitor the operation of computer systems, abnormal logs can be extracted from the system's operation logs using matching rules and analyzed as alarm data. However, because matching rules require strict, clear, and complete definitions, the cost of designing these rules is high. Furthermore, matching rules can only match existing blacklisted data and cannot detect unknown blacklisted data. Therefore, matching rules can be bypassed; for example, abnormal information can be slightly altered to appear as "normal information," thus evading the matching rules. To address this, this application provides a data detection scheme that can accurately and efficiently detect alarm data.

[0071] SeeFigure 1 As shown in an exemplary embodiment, this application discloses a data detection method, including:

[0072] S101. Obtain the target data to be detected.

[0073] In this embodiment, the target data to be detected may be: logs during the operation of a computer device, web page text, and / or traffic in a network (such as a local area network). Therefore, in one implementation, obtaining the target data to be detected includes: obtaining log information during the operation of a computer device to obtain target data; and / or obtaining web page text information to obtain target data; and / or obtaining traffic information in the target network to obtain target data.

[0074] S102. Classify the characters in the target data according to the preset classification categories to obtain multiple character classes.

[0075] It should be noted that the preset classification categories are defined based on the target data. The more detailed and numerous the classification categories, the higher the detection accuracy. For example, when the target data is traffic in a local area network (LAN), the classification categories can include both upstream and downstream traffic. Thus, the traffic in the LAN can be divided into upstream character traffic and downstream character traffic, as shown in Table 1.

[0076] Table 1

[0077] Classification category Explanation Proportion Upward character class Characters transmitted from LAN to external network 5％ Downward character class Characters transmitted from external network to LAN 95％

[0078] In Table 1, each character class obtained through classification corresponds to a specific percentage of character count. Based on this percentage, a distribution diagram of different character classes can be constructed and displayed. For example... Figure 2 As shown, by labeling the category on the horizontal X-axis and the character quantity percentage on the vertical Y-axis, we can obtain the following results: Figure 2 The curve shown. The more categories there are, the longer the curve will be.

[0079] For example, when the target data is text from a webpage, the classification categories can include: politics and law, humanities and social sciences, marriage and family, and science and technology, etc. The classification results can be found in Table 2.

[0080] Table 2

[0081] Classification category Proportion Political and legal category 50％ Humanities and social sciences category 35％ Marriage and family category 5％ Science and technology category 10％

[0082] For example, when the target data is the logs of a computer device during operation, the classification categories can be set according to computer components such as CPU, storage, and software.

[0083] S103. Determine the frequency domain characteristics of each character class. If the frequency domain characteristics of any character class exceed the frequency domain characteristic range corresponding to the current character class, then issue an alarm for the current character class.

[0084] In one implementation, determining the frequency domain features of each character class includes: determining the feature values ​​of characters in each character class (e.g., the frequency of character occurrence, the total number of times a character appears, etc.); normalizing the feature values ​​of characters in each character class; and performing a Fourier transform on the normalized feature values ​​of characters in each character class to obtain the frequency domain features of each character class. The Fourier transform on the normalized feature values ​​of characters in each character class can be performed according to preset weight values ​​corresponding to each character class.

[0085] In one example, if N character classes are obtained through classification, and for character class i (i = 1, 2, ..., N), its corresponding preset weight value is h(i), and its feature value at time t is c(i, t), then the normalization process can be expressed by the formula: f(t) = ∑ i＝1 N h(i)×c(i,t) / ∑ i＝1 N When constructing the distribution diagram, f(t) can be used as the value of the Y-axis.

[0086] Then, according to the Fourier transform formula: Perform a Fourier transform on f(t), and F(ω) becomes the frequency domain function. Finally, combine the sampling measurements to obtain the frequency value, which can be a range or a single numerical value; this is the frequency characteristic.

[0087] In one implementation, if the frequency domain characteristics of any character class do not exceed the frequency domain characteristic range corresponding to the current character class, no alarm is issued for the current character class.

[0088] S104. If any character class alarm is a false alarm, then optimize the frequency domain feature range corresponding to the current character class based on the frequency domain features of the false alarm character class.

[0089] If any character-based alarm is not a false alarm, then the characters in the alarm's character class are analyzed to locate the cause of the alarm and determine the strategy for handling the alarm.

[0090] In one implementation, optimizing the frequency domain feature range corresponding to the current character class based on the frequency domain features of the false alarm character class includes: making the frequency domain features of the false alarm character class within the optimized frequency domain feature range corresponding to the current character class (i.e., the false alarm character class).

[0091] In one implementation, if an optimization instruction for the frequency domain feature range is received, the frequency domain features of non-alarm character classes within a preset time period are collected. If it is determined that the frequency domain features of the non-alarm character classes are misjudged, the frequency domain feature range corresponding to the current character class (i.e., the non-alarm character class) is optimized based on the frequency domain features of the non-alarm character classes. Optimizing the frequency domain feature range corresponding to the current character class based on the frequency domain features of the non-alarm character classes includes ensuring that the frequency domain features of the non-alarm character classes are not within the optimized frequency domain feature range corresponding to the current character class. It is evident that the frequency domain feature range corresponding to the current character class can be optimized based on both the frequency domain features of character classes that should alarm but should alarm and those that should alarm but should alarm. Therefore, by continuously optimizing the frequency domain feature range corresponding to the corresponding character class using the frequency domain features of real data, it can be made closer to the real detection scenario and the real detected data. In the initial stage of detection, the frequency domain feature range of each character class is set based on experience. As detection progresses, the frequency domain feature range of each character class is gradually optimized, and the detection accuracy becomes increasingly higher.

[0092] As can be seen, this embodiment first classifies the target data to be detected according to classification categories, resulting in multiple character classes. Then, it determines the frequency domain features of each character class. If the frequency domain features of any character class exceed the frequency domain feature range corresponding to the current character class, an alarm is issued for that character class. Simultaneously, when any alarm for any character class is a false alarm, the frequency domain feature range corresponding to the current character class is optimized based on the frequency domain features of the false alarm character class. This allows for adaptive optimization of the frequency domain feature range corresponding to the current character class, gradually improving the accuracy of the frequency domain feature range during actual detection. This scheme no longer analyzes data from the time domain but instead obtains frequency domain features from the character features in the frequency domain data, and then detects and issues alarms based on these frequency domain features. This approach improves detection accuracy and efficiency by shifting the detection perspective, thus performing data detection from the frequency domain. Furthermore, since the frequency domain feature range of each character class can be gradually optimized during actual detection, detection accuracy is further improved.

[0093] The following example, which involves detecting traffic on a local area network, will further illustrate this application.

[0094] In a local area network (LAN), the overall traffic area will always form a dynamic equilibrium. Based on this, this embodiment sets a corresponding frequency domain characteristic range for each type of traffic in the LAN to represent the characteristics of that type of traffic, and uses this characteristic as a standard to detect newly generated traffic in the LAN.

[0095] Please see Figure 3In this embodiment, during the detection process, curve distribution diagrams of different types of traffic collected at each moment can be plotted and displayed. Simultaneously, spectral analysis is performed on the collected different types of traffic, and the obtained spectral characteristics are judged using the corresponding frequency domain feature range. An alarm is issued based on the judgment result. Furthermore, in the case of a correct alarm, the corresponding frequency domain feature range can be adjusted using the currently analyzed spectral characteristics to adaptively learn and adjust the evaluation criteria.

[0096] In the spectrum analysis, Fourier transform is used to find the spectrum within a certain range, which is then discretized to obtain the corresponding characteristic values. Furthermore, each type of traffic is subjected to spectrum analysis based on its corresponding weight.

[0097] As can be seen, this embodiment classifies network traffic and analyzes the characteristics of each category from the frequency domain, thereby improving detection accuracy and efficiency by changing the detection perspective; at the same time, since the frequency domain feature range of each character category can be gradually optimized in the actual detection process, the detection accuracy is further improved.

[0098] In this embodiment, certain tolerance controls are applied to the frequency domain characteristic values ​​during spectrum analysis to achieve qualitative analysis. After an alarm is triggered, quantitative analysis can be performed on the alarm data to pinpoint the cause. During the detection process, a self-learning approach is used to dynamically adjust the evaluation criteria for various traffic types, making the evaluation criteria closer to real-world detection scenarios. This improves the solution's anti-interference capabilities and efficiency while reducing costs.

[0099] The following describes a data detection device provided in an embodiment of this application. The data detection device described below and the data detection method described above can be referred to each other.

[0100] See Figure 4 As shown in an exemplary embodiment, this application discloses a data detection device, including:

[0101] The acquisition module 401 is used to acquire the target data to be detected;

[0102] The classification module 402 is used to classify the characters in the target data according to the preset classification categories to obtain multiple character classes;

[0103] The detection module 403 is used to determine the frequency domain characteristics of each character class. If the frequency domain characteristics of any character class exceed the frequency domain characteristic range corresponding to the current character class, an alarm is issued for the current character class.

[0104] The self-learning module 404 is used to optimize the frequency domain feature range corresponding to the current character class based on the frequency domain features of the character class of the false alarm if any character class alarm is a false alarm.

[0105] In one implementation, the acquisition module is specifically used for:

[0106] Obtain the target data by acquiring log information during the operation of computer equipment;

[0107] and / or

[0108] Extract text information from web pages to obtain target data;

[0109] and / or

[0110] Obtain traffic information from the target network to obtain the target data.

[0111] In one implementation, the detection module is specifically used for:

[0112] Determine the feature values ​​of characters in each character class;

[0113] Normalize the feature values ​​of characters in each character class;

[0114] Perform a Fourier transform on the feature values ​​of characters in each character class after normalization to obtain the frequency domain features of each character class.

[0115] In one implementation, the detection module is further configured to:

[0116] If the frequency domain characteristics of any character class do not exceed the frequency domain characteristic range corresponding to the current character class, no alarm will be issued for the current character class.

[0117] In one implementation, the self-learning module is specifically used for:

[0118] Make the frequency domain characteristics of the character class that falsely alarms fall within the range of the optimized frequency domain characteristics corresponding to the current character class.

[0119] In one implementation, the self-learning module is also used for:

[0120] If an optimization instruction for the frequency domain feature range is received, then collect the frequency domain features of non-alarm character classes within a preset time period.

[0121] If it is determined that the frequency domain features of the non-alarm character class are misjudged, the frequency domain feature range corresponding to the current character class is optimized based on the frequency domain features of the non-alarm character class.

[0122] In one implementation, the self-learning module is also used for:

[0123] This ensures that the frequency domain characteristics of non-alarm character classes are not within the range of the optimized frequency domain characteristics corresponding to the current character class.

[0124] For more detailed information on the working process of each module and unit in this embodiment, please refer to the relevant content disclosed in the foregoing embodiments, which will not be repeated here.

[0125] As can be seen, this embodiment provides a data detection device that analyzes the characteristics of characters in the data in the frequency domain to obtain frequency domain features, detects the frequency domain features and issues an alarm, thereby performing data detection from the frequency domain and improving detection accuracy and efficiency by changing the detection perspective; at the same time, since the frequency domain feature range of each character class can be gradually optimized in the actual detection process, the detection accuracy is further improved.

[0126] The following describes a data detection device provided in an embodiment of this application. The data detection device described below can be referred to in conjunction with the data detection method and apparatus described above.

[0127] See Figure 5 As shown in an exemplary embodiment, this application discloses a data detection device, including:

[0128] Memory 501 is used to store computer programs;

[0129] Processor 502 is configured to execute the computer program to implement the method disclosed in any of the above embodiments.

[0130] In this embodiment, the computer program executed by the processor can specifically perform the following steps: acquire the target data to be detected; classify the characters in the target data according to a preset classification category to obtain multiple character classes; determine the frequency domain features of each character class; if the frequency domain features of any character class exceed the frequency domain feature range corresponding to the current character class, then issue an alarm for the current character class; if the alarm for any character class is a false alarm, then optimize the frequency domain feature range corresponding to the current character class based on the frequency domain features of the false alarm character class.

[0131] In this embodiment, the computer program executed by the processor can specifically perform the following steps: obtaining log information during the operation of the computer device to obtain target data; and / or obtaining web page text information to obtain target data; and / or obtaining traffic information in the target network to obtain target data.

[0132] In this embodiment, the computer program executed by the processor can specifically perform the following steps: determining the feature values ​​of characters in each character class; normalizing the feature values ​​of characters in each character class; and performing a Fourier transform on the normalized feature values ​​of characters in each character class to obtain the frequency domain features of each character class.

[0133] In this embodiment, the computer program executed by the processor can specifically perform the following steps: if the frequency domain characteristics of any character class do not exceed the frequency domain characteristic range corresponding to the current character class, then no alarm is issued for the current character class.

[0134] In this embodiment, the computer program executed by the processor may specifically perform the following steps: making the frequency domain characteristics of the character class that falsely alarms fall within the range of the optimized frequency domain characteristics corresponding to the current character class.

[0135] In this embodiment, the computer program executed by the processor can specifically perform the following steps: if an optimization instruction for the frequency domain feature range is received, the frequency domain features of non-alarm character classes within a preset time period are collected; if it is determined that the frequency domain features of the non-alarm character classes are misjudged, the frequency domain feature range corresponding to the current character class is optimized based on the frequency domain features of the non-alarm character classes.

[0136] In this embodiment, the computer program executed by the processor may specifically perform the following steps: making the frequency domain features of the non-alarm character class outside the range of the optimized frequency domain features corresponding to the current character class.

[0137] Furthermore, embodiments of this application also provide an electronic device. The aforementioned electronic device can be, for example,... Figure 6 The server 50 shown can also be as follows: Figure 7 Terminal 60 is shown. Figure 6 and Figure 7 These are all diagrams illustrating the structure of an electronic device according to an exemplary embodiment. The content in the diagrams should not be considered as any limitation on the scope of this application.

[0138] Figure 6 This is a schematic diagram of a server structure provided in an embodiment of this application. The server 50 may specifically include: at least one processor 51, at least one memory 52, a power supply 53, a communication interface 54, an input / output interface 55, and a communication bus 56. The memory 52 stores a computer program, which is loaded and executed by the processor 51 to implement the relevant steps in monitoring the published application disclosed in any of the foregoing embodiments.

[0139] In this embodiment, the power supply 53 is used to provide operating voltage for each hardware device on the server 50; the communication interface 54 can create a data transmission channel between the server 50 and external devices, and the communication protocol it follows can be any communication protocol applicable to the technical solution of this application, and is not specifically limited here; the input / output interface 55 is used to acquire external input data or output data to the outside world, and its specific interface type can be selected according to specific application needs, and is not specifically limited here.

[0140] In addition, the memory 52, as a carrier for resource storage, can be a read-only memory, random access memory, disk, or optical disk, etc. The resources stored on it include operating system 521, computer program 522, and data 523, etc., and the storage method can be temporary storage or permanent storage.

[0141] The operating system 521 manages and controls the various hardware devices on the server 50 and the computer program 522 to enable the processor 51 to perform operations and processing on the data 523 in the memory 52. ​​The operating system 521 can be Windows Server, Netware, Unix, Linux, etc. The computer program 522, in addition to including a computer program capable of performing the application distribution monitoring method disclosed in any of the foregoing embodiments, may further include computer programs capable of performing other specific tasks. The data 523 may include application update information and other data, as well as application developer information.

[0142] Figure 7 This is a schematic diagram of the structure of a terminal provided in an embodiment of this application. The terminal 60 may specifically include, but is not limited to, a smartphone, tablet computer, laptop computer, or desktop computer.

[0143] Typically, the terminal 60 in this embodiment includes a processor 61 and a memory 62.

[0144] The processor 61 may include one or more processing cores, such as a quad-core processor or an octa-core processor. The processor 61 may be implemented using at least one hardware form selected from DSP (Digital Signal Processing), FPGA (Field-Programmable Gate Array), and PLA (Programmable Logic Array). The processor 61 may also include a main processor and a coprocessor. The main processor, also known as a CPU (Central Processing Unit), is used to process data in the wake-up state; the coprocessor is a low-power processor used to process data in the standby state. In some embodiments, the processor 61 may integrate a GPU (Graphics Processing Unit), which is responsible for rendering and drawing the content to be displayed on the screen. In some embodiments, the processor 61 may also include an AI (Artificial Intelligence) processor, which is used to handle computational operations related to machine learning.

[0145] The memory 62 may include one or more computer-readable storage media, which may be non-transitory. The memory 62 may also include high-speed random access memory and non-volatile memory, such as one or more disk storage devices or flash memory devices. In this embodiment, the memory 62 is used to store at least the following computer program 621, which, after being loaded and executed by the processor 61, is capable of implementing the relevant steps in the monitoring method for the published application executed on the terminal side as disclosed in any of the foregoing embodiments. In addition, the resources stored in the memory 62 may also include an operating system 622 and data 623, and the storage method may be temporary or permanent storage. The operating system 622 may include Windows, Unix, Linux, etc. The data 623 may include, but is not limited to, application update information.

[0146] In some embodiments, the terminal 60 may further include a display screen 63, an input / output interface 64, a communication interface 65, a sensor 66, a power supply 67, and a communication bus 68.

[0147] Those skilled in the art will understand that Figure 7 The structure shown does not constitute a limitation on terminal 60 and may include more or fewer components than shown.

[0148] The following describes a readable storage medium provided in an embodiment of this application. The readable storage medium described below can be referred to in conjunction with the data detection method, apparatus and device described above.

[0149] A readable storage medium is provided for storing a computer program, wherein the computer program, when executed by a processor, implements the data detection method disclosed in the foregoing embodiments. Specific steps of the method can be found in the corresponding content disclosed in the foregoing embodiments, and will not be repeated here.

[0150] The preferred embodiments of this application have been described in detail above with reference to the accompanying drawings. However, this application is not limited to the specific details of the above embodiments. Within the scope of the technical concept of this application, various simple modifications can be made to the technical solution of this application, and these simple modifications all fall within the protection scope of this application.

[0151] It should also be noted that the various specific technical features described in the above embodiments can be combined in any suitable manner without contradiction. To avoid unnecessary repetition, this application will not describe the various possible combinations separately.

[0152] Furthermore, various different implementations of this application can be combined in any way, as long as they do not violate the spirit of this application, they should also be regarded as the content disclosed in this application.

Claims

1. A data detection method, characterized in that, include: Acquire the target data to be detected; The characters in the target data are classified according to preset classification categories to obtain multiple character classes; Determine the frequency domain characteristics of each character class. If the frequency domain characteristics of any character class exceed the frequency domain characteristic range corresponding to the current character class, then issue an alarm for the current character class. If any character class alarm is a false alarm, then optimize the frequency domain feature range corresponding to the current character class based on the frequency domain features of the false alarm character class.

2. The data detection method according to claim 1, characterized in that, The acquisition of the target data to be detected includes: Obtain the target data by acquiring log information during the operation of the computer device; and / or Obtain the target data by acquiring the text information of the webpage; and / or Obtain traffic information from the target network to obtain the target data.

3. The data detection method according to claim 1, characterized in that, The determination of the frequency domain features of each character class includes: Determine the feature values ​​of characters in each character class; Normalize the feature values ​​of characters in each character class; Perform a Fourier transform on the feature values ​​of characters in each character class after normalization to obtain the frequency domain features of each character class.

4. The data detection method according to claim 1, characterized in that, Also includes: If the frequency domain characteristics of any character class do not exceed the frequency domain characteristic range corresponding to the current character class, no alarm will be issued for the current character class.

5. The data detection method according to any one of claims 1 to 4, characterized in that, The step of optimizing the frequency domain feature range corresponding to the current character class based on the frequency domain features of the false alarm character class includes: Make the frequency domain characteristics of the character class that falsely alarms fall within the range of the optimized frequency domain characteristics corresponding to the current character class.

6. The data detection method according to any one of claims 1 to 4, characterized in that, Also includes: If an optimization instruction for the frequency domain feature range is received, then the frequency domain features of non-alarm character classes within a preset time period are collected. If it is determined that the frequency domain features of the non-alarm character class are misjudged, the frequency domain feature range corresponding to the current character class is optimized based on the frequency domain features of the non-alarm character class.

7. The data detection method according to claim 6, characterized in that, The step of optimizing the frequency domain feature range corresponding to the current character class based on the frequency domain features of the non-alarm character class includes: This ensures that the frequency domain characteristics of non-alarm character classes are not within the range of the optimized frequency domain characteristics corresponding to the current character class.

8. A data detection device, characterized in that, include: The acquisition module is used to acquire the target data to be detected; The classification module is used to classify the characters in the target data according to preset classification categories to obtain multiple character classes; The detection module is used to determine the frequency domain features of each character class. If the frequency domain features of any character class exceed the frequency domain feature range corresponding to the current character class, an alarm is issued for the current character class. The self-learning module is used to optimize the frequency domain feature range corresponding to the current character class based on the frequency domain features of the character class that issued the false alarm if any character class alarm is a false alarm.

9. A data detection device, characterized in that, include: Memory, used to store computer programs; A processor for executing the computer program to implement the data detection method as described in any one of claims 1 to 7.

10. A readable storage medium, characterized in that, Used to store a computer program, wherein the computer program, when executed by a processor, implements the data detection method as described in any one of claims 1 to 7.

Images