System access amount monitoring method and device, electronic equipment and storage medium

Abstract

The application provides a system access amount monitoring method and device, electronic equipment and a storage medium, and the method comprises the following steps: obtaining historical access amount data of a to-be-monitored system; determining a first confidence interval of the historical access amount data based on a first preset confidence, and determining an upper limit value of the first confidence interval as a warning threshold; and monitoring the access amount of the to-be-monitored system based on the warning threshold. The method, device, electronic equipment and storage medium provided by the application can improve the accuracy, flexibility and efficiency of system access amount monitoring.

Description

Technical Field

[0001] This invention relates to the field of traffic monitoring technology, and in particular to a system access monitoring method, device, electronic device, and storage medium. Background Technology

[0002] System access monitoring is a crucial function for system security early warning. By monitoring system access volume, abnormal access can be identified, including unusual network segment IPs, security drill IPs, bypass IPs, and suspected DDoS attacks.

[0003] Currently, system traffic is monitored based on manually set alert thresholds. However, manually setting alert thresholds relies on professionals' in-depth understanding of the business, which makes them inaccurate and reduces the accuracy of traffic monitoring, ultimately affecting the system's normal operation. Furthermore, since traffic data changes over time, manually set alert thresholds are too rigid. Even with real-time manual updates, the efficiency of manually setting alert thresholds is low, further impacting system performance. Summary of the Invention

[0004] This invention provides a system access volume monitoring method, device, electronic device, and storage medium to solve the defects of low accuracy, low flexibility, and low efficiency of manually setting early warning thresholds in the prior art, and to achieve high accuracy, high flexibility, and high efficiency in system access volume monitoring.

[0005] This invention provides a system access monitoring method, comprising:

[0006] Obtain historical access data for the system to be monitored;

[0007] Based on the first preset confidence level, a first confidence interval for the historical access data is determined, and the upper limit of the first confidence interval is determined as the warning threshold.

[0008] Based on the aforementioned warning threshold, the access volume of the system to be monitored is monitored.

[0009] According to a system access volume monitoring method provided by the present invention, determining a first confidence interval of the historical access volume data based on a first preset confidence level includes:

[0010] The historical access data is clustered to obtain the clustering results;

[0011] Data cleaning is performed on each cluster in the clustering results to obtain cleaned clusters;

[0012] Based on the first preset confidence level and the cleaned clusters, a first confidence interval for the historical access data is determined.

[0013] According to a system access monitoring method provided by the present invention, the step of cleaning the data of each cluster in the clustering result to obtain the cleaned clusters includes:

[0014] The quartile method is used to process each cluster in the clustering results to obtain the lower quartile and upper quartile of each cluster.

[0015] Based on the lower quartile and the upper quartile, data cleaning is performed on each cluster to obtain cleaned clusters. Each cleaned cluster includes data from the lower quartile to the upper quartile.

[0016] According to a system access volume monitoring method provided by the present invention, the method further includes, after obtaining historical access volume data of the system to be monitored, the following steps:

[0017] Based on different time granularities, the historical access volume data is normalized to obtain historical access volume data corresponding to each time granularity, so as to obtain the early warning threshold for each time granularity.

[0018] According to a system access monitoring method provided by the present invention, the early warning threshold includes thresholds for multiple time points, and the step of monitoring the access volume of the system to be monitored based on the early warning threshold further includes:

[0019] Determine the first time point corresponding to the minimum threshold among the warning thresholds, and determine the second time point corresponding to the maximum threshold among the warning thresholds;

[0020] Determine the median of the warning threshold, and based on the second preset confidence level, determine the second confidence interval of the warning threshold;

[0021] The threshold at the first time point in the warning threshold is updated to the median, and the threshold at the second time point in the warning threshold is updated to the upper limit of the second confidence interval.

[0022] According to a system access monitoring method provided by the present invention, the early warning threshold includes a threshold for off-peak hours and a threshold for peak hours;

[0023] Determining the first time point corresponding to the minimum threshold among the warning thresholds, and determining the second time point corresponding to the maximum threshold among the warning thresholds, includes:

[0024] Determine the first idle time point corresponding to the minimum threshold of the idle period in the warning threshold, and determine the first busy time point corresponding to the minimum threshold of the busy period in the warning threshold;

[0025] Determine the second idle time point corresponding to the maximum threshold of the idle period in the warning threshold, and determine the second busy time point corresponding to the maximum threshold of the busy period in the warning threshold;

[0026] The step of determining the median of the warning threshold and, based on a second preset confidence level, determining the second confidence interval of the warning threshold includes:

[0027] Determine the median of the off-peak period in the warning threshold, and determine the median of the busy period in the warning threshold;

[0028] Based on the second preset confidence level, a second confidence interval for the off-peak period in the warning threshold is determined, and based on the second preset confidence level, a second confidence interval for the busy period in the warning threshold is determined.

[0029] The step of updating the threshold at the first time point in the warning threshold to the median, and updating the threshold at the second time point in the warning threshold to the upper limit of the second confidence interval, includes:

[0030] The threshold of the first off-peak time point in the warning threshold is updated to the median of the off-peak period, and the threshold of the first busy time point in the warning threshold is updated to the median of the busy period;

[0031] The threshold of the second off-peak time point in the warning threshold is updated to the upper limit of the second confidence interval of the off-peak period, and the threshold of the second busy time point in the warning threshold is updated to the upper limit of the second confidence interval of the busy period.

[0032] According to a system access volume monitoring method provided by the present invention, the step of obtaining historical access volume data of the system to be monitored includes:

[0033] Historical access data for different user dimensions in the system to be monitored are obtained to obtain the early warning threshold for each user dimension, wherein the user dimension is used to characterize the accessing user.

[0034] The present invention also provides a system access monitoring device, comprising:

[0035] The acquisition module is used to acquire historical access data of the system to be monitored.

[0036] The determination module is used to determine a first confidence interval of the historical access data based on a first preset confidence level, and to determine the upper limit of the first confidence interval as a warning threshold;

[0037] The monitoring module is used to monitor the access volume of the system to be monitored based on the warning threshold.

[0038] The present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the system access monitoring method as described above.

[0039] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the system access monitoring method as described above.

[0040] The present invention provides a system access volume monitoring method, apparatus, electronic device, and storage medium that acquires historical access volume data of the system to be monitored; determines a first confidence interval of the historical access volume data based on a first preset confidence level, and sets the upper limit of the first confidence interval as a warning threshold; and monitors the access volume of the system to be monitored based on the warning threshold. Through the above method, historical access volume data is statistically analyzed, and a confidence-based threshold determination method is used to determine the warning threshold, ensuring that the warning threshold is a limit under the preset confidence level. Compared to manually setting the warning threshold, the warning threshold determined by the present invention is more accurate, thereby improving the accuracy of system access volume monitoring. Furthermore, even if access traffic data changes over time, the warning threshold can be automatically adjusted based on dynamic historical access volume data, thereby improving the flexibility and efficiency of warning threshold setting, and thus improving the flexibility and efficiency of system access volume monitoring. In summary, the present invention can improve the accuracy, flexibility, and efficiency of system access volume monitoring. Attached Figure Description

[0041] To more clearly illustrate the technical solutions in this invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0042] Figure 1 This is one of the flowcharts illustrating the system access volume monitoring method provided by the present invention;

[0043] Figure 2 The second flowchart illustrates the system access volume monitoring method provided by this invention.

[0044] Figure 3 The third flowchart illustrating the system access volume monitoring method provided by this invention;

[0045] Figure 4 A schematic diagram of the system access volume monitoring device provided by the present invention;

[0046] Figure 5 This is a schematic diagram of the structure of the electronic device provided by the present invention. Detailed Implementation

[0047] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention.

[0048] System access monitoring is a crucial function for system security early warning. By monitoring system access volume, abnormal access can be identified, including unusual network segment IPs, security drill IPs, bypass IPs, and suspected DDoS attacks.

[0049] Currently, the primary method for monitoring access volume in the telecommunications industry is manual, meaning that alert thresholds are subjectively set by individuals. However, manually setting alert thresholds relies on professionals' in-depth understanding of the business, combining human experience with historical access traffic data to subjectively set the thresholds. Therefore, current solutions based on manually set alert thresholds are overly dependent on experienced personnel with deep business knowledge to set the thresholds and calculation rules, thus having limitations. This leads to inaccurate manually set alert thresholds, reducing the reliability of access volume monitoring and ultimately affecting the normal operation of the system. Furthermore, since access traffic data changes over time, alert thresholds must also change accordingly. However, access traffic data contains a large amount of noise or invalid data, requiring manual filtering and continuous modification of the alert thresholds to ensure accuracy. Manually setting alert thresholds is inefficient, further impacting system operation. Simultaneously, manually setting alert thresholds requires frequent adjustments based on experience, defining calculation rules and adjusting threshold values. This rigid approach lacks flexibility and cannot adapt to fluctuations or periodic changes in access traffic, often resulting in false alarms or missed alarms during large-scale user access.

[0050] To address the above problems, the present invention proposes the following embodiments. Figure 1 This is one of the flowcharts illustrating the system access volume monitoring method provided by the present invention, such as... Figure 1 As shown, the system's access volume monitoring methods include:

[0051] Step 110: Obtain historical access data for the system to be monitored.

[0052] Here, the system to be monitored is the system that needs to have its access volume monitored. This system can be an online betting system or other system that needs to have user access security monitored.

[0053] Here, historical access data refers to access data prior to the current time. The size of this access data can be set according to actual needs, specifically the time period. For example, historical access data refers to access data of the system to be monitored within 30 days prior to the current time.

[0054] In one embodiment, historical access data may include historical access data for different user dimensions. These different user dimensions may include dimensions such as IP address, account (USER), and mobile number (MOBILE) used to represent accessing users.

[0055] In one specific embodiment, historical access data is transmitted as a byte stream, and the file stream data of this historical access data is quickly stored in CSV format. Of course, other methods and formats can also be used for transmission and storage, and this embodiment of the invention does not limit this.

[0056] Based on the two embodiments above, historical access data for the three dimensions of IP, account, and number can be stored in three CSV files.

[0057] Step 120: Based on the first preset confidence level, determine the first confidence interval of the historical access data, and determine the upper limit of the first confidence interval as the warning threshold.

[0058] It should be noted that the warning threshold is calculated here based on reliability theory and the Gaussian distribution reliability principle.

[0059] Here, the first preset confidence level is the Gaussian distribution confidence level. This first preset confidence level can be set according to actual needs, such as 95% confidence level, 90% confidence level, etc. The embodiments of the present invention do not make specific limitations on this.

[0060] For ease of understanding, the first pre-set confidence level here is illustrated using a 95% confidence level as an example. The calculation method for this 95% confidence level is as follows:

[0061]

[0062] In the formula: P represents probability; μ is the mean of historical visit data; z is the corresponding value of the 95% confidence interval in the z table (z critical value of confidence interval), and the z value corresponding to the 95% confidence interval in the z table is 1.96; Let σ be the standard error, σ be the standard deviation of historical visit data, and n be the sample size of historical visit data; the minimum value of the confidence interval is... The maximum value is At this time, the warning threshold is

[0063] Based on the above calculation method for 95% confidence level, such as Figure 2 As shown, the confidence interval is calculated at a predetermined significance level, usually called α, which is typically set to 0.05. The confidence level is (1-α), meaning it's 0.95 or 95%. This results in a confidence interval centered at μ with an area of ​​0.95. In other words, in the 95% confidence level calculation method described above, M has a 95% probability of falling within this confidence interval.

[0064] In one embodiment, prior to step 120 above, historical access data is normalized based on different time granularities to obtain historical access data corresponding to each time granularity. Based on this, a first confidence interval for the historical access data corresponding to each time granularity is determined based on a first preset confidence level, and the upper limit of the first confidence interval for each time granularity is determined as the warning threshold for each time granularity.

[0065] In another embodiment, a warning threshold is calculated for the entire sampling time range dimension of historical access data.

[0066] In one embodiment, historical access data may include historical access data for different user dimensions. Based on this, a first confidence interval for the historical access data of each user dimension is determined based on a first preset confidence level, and the upper limit of the first confidence interval for each user dimension is determined as the warning threshold for each user dimension.

[0067] In one specific embodiment, the warning threshold is transmitted in JSON format. If warning thresholds for each user dimension are included, they are transmitted and stored in list format. Of course, other methods and formats can also be used for transmission and storage, and this embodiment of the invention does not limit this.

[0068] Step 130: Based on the warning threshold, monitor the access volume of the system to be monitored.

[0069] In one embodiment, the application terminal of this invention is an early warning system, which monitors the access volume of the system to be monitored based on an early warning threshold. In another embodiment, an early warning threshold is sent to the early warning system so that the early warning system monitors the access volume of the system to be monitored based on the received early warning threshold.

[0070] In one specific embodiment, the current access volume of the system to be monitored is obtained; a first threshold and a second threshold are determined based on the warning threshold, wherein the second threshold is greater than the first threshold; if the current access volume is greater than the first threshold and less than the second threshold, a warning is issued; if the current access volume is greater than or equal to the second threshold, the user corresponding to the current access volume is prohibited from accessing the system to be monitored.

[0071] The current visit count is a user-specific count.

[0072] The first threshold and the second threshold can be set according to actual needs. The first threshold is twice the warning threshold, and the second threshold is three times the warning threshold. This embodiment of the invention does not limit this.

[0073] The warning and alert settings can be configured according to the actual situation. For example, a yellow security alert will be issued for the current access and sent to the responsible person's email and mobile phone via email and / or SMS.

[0074] In addition, when the current number of visits is greater than or equal to the second threshold, a warning will also be issued. For example, a red security alert will be issued for the current visit and sent to the person in charge's email and mobile phone via email and / or SMS.

[0075] Understandably, blocking the user corresponding to the current access volume from accessing the monitored system can freeze the accessing user, and the person in charge of the early warning system can enter the backend of the early warning system to decide whether to allow the user. If the person in charge decides to allow the user, the accessing user will no longer be subject to the access volume monitoring of the early warning system for a preset time (e.g., 12 hours).

[0076] In addition, operators of the early warning system can view specific abnormal information by checking the abnormal logs within the system.

[0077] In some embodiments, the warning threshold can be updated within a preset time period, for example, daily. That is, steps 110 and 120 above are repeated daily to continuously update the warning threshold. Based on this, the accuracy of the warning threshold can be ensured even if the access volume fluctuates periodically.

[0078] In one embodiment, the aforementioned warning threshold may include warning thresholds at various time granularities. Based on this, different time granularity warning thresholds can be selected to monitor the access volume of the system to be monitored according to the specific application scenario.

[0079] In one embodiment, historical access data may include historical access data from different user dimensions. Based on this, different warning thresholds for different user dimensions can be selected to monitor the access volume of the system to be monitored, according to the specific application scenario.

[0080] The system access volume monitoring method provided in this invention acquires historical access volume data of the system to be monitored; determines a first confidence interval of the historical access volume data based on a first preset confidence level, and determines the upper limit of the first confidence interval as a warning threshold; and monitors the access volume of the system to be monitored based on the warning threshold. Through the above method, historical access volume data is statistically analyzed, and a confidence-based threshold determination method is used to determine the warning threshold, ensuring that the warning threshold is a limit under the preset confidence level. Compared with manually setting the warning threshold, the warning threshold determined by this invention is more accurate, thereby improving the accuracy of system access volume monitoring. Furthermore, even if access traffic data changes over time, the warning threshold can be automatically adjusted based on dynamic historical access volume data, thereby improving the flexibility and efficiency of warning threshold setting, and thus improving the flexibility and efficiency of system access volume monitoring. In summary, this invention can improve the accuracy, flexibility, and efficiency of system access volume monitoring.

[0081] Based on the above embodiments, Figure 2 This is a second flowchart illustrating the system access volume monitoring method provided by the present invention, as shown below. Figure 2 As shown, in step 120 above, determining the first confidence interval of the historical access data based on the first preset confidence level includes:

[0082] Step 121: Perform clustering processing on the historical access data to obtain clustering results.

[0083] Here, the clustering processing method can be set according to actual needs. This embodiment of the invention uses the K-means clustering algorithm as an example for illustration.

[0084] K-means clustering is a numerical clustering algorithm that uses k to determine the number of clusters and distance as a measure of similarity between data objects. The value of k is set according to the characteristics of different regions or data. Further, in one embodiment, the value of k is set based on human experience, and then automatic classification is performed using a self-organizing network method to obtain the magnitude of k, thereby obtaining multiple classification clusters.

[0085] In one embodiment, prior to step 121 above, the historical access data is normalized based on different time granularities to obtain historical access data corresponding to each time granularity. Based on this, the historical access data corresponding to each time granularity is clustered to obtain the clustering results corresponding to each time granularity.

[0086] In one embodiment, historical access data may include historical access data for different user dimensions. Based on this, the historical access data for each user dimension is clustered to obtain the clustering results for each user dimension.

[0087] Step 122: Perform data cleaning on each cluster in the clustering results to obtain cleaned clusters.

[0088] It should be noted that, since there is a large amount of noisy and invalid data in the historical visit data, it is necessary to clean the data of each cluster in the clustering results to remove a large amount of noisy and invalid data, that is, to remove abnormal data in the historical visit data.

[0089] Here, the data cleaning method can be set according to actual needs, and the embodiments of the present invention do not impose specific limitations on it.

[0090] In one embodiment, the largest and smallest values ​​in historical access data are usually noisy data. Therefore, data cleaning is to remove the largest and smallest values ​​in historical access data.

[0091] In one embodiment, prior to step 121 above, historical access data is normalized based on different time granularities to obtain historical access data corresponding to each time granularity. Based on this, data cleaning is performed on each cluster in the clustering results corresponding to each time granularity to obtain cleaned clusters.

[0092] In one embodiment, historical access data may include historical access data from different user dimensions. Based on this, the clusters in the clustering results for each user dimension are cleaned to obtain cleaned clusters.

[0093] Step 123: Based on the first preset confidence level and the cleaned clusters, determine the first confidence interval of the historical access data.

[0094] In one embodiment, the cleaned clusters are merged to obtain new access volume data, and then a first confidence interval for the new access volume data is determined based on a first preset confidence level.

[0095] In another embodiment, based on a first preset confidence level, the confidence interval of each cluster is determined. Then, the upper limit of the confidence interval of each cluster is determined as the warning threshold of each cluster. Finally, the warning threshold of the whole is obtained by averaging the warning thresholds of each cluster, which is the warning threshold of step 120 above.

[0096] In one embodiment, prior to step 121 above, historical access data is normalized based on different time granularities to obtain historical access data corresponding to each time granularity. Based on this, a first confidence interval for the historical access data corresponding to each time granularity is determined based on a first preset confidence level and the cleaned clusters corresponding to each time granularity.

[0097] In one embodiment, historical access data may include historical access data for different user dimensions. Based on this, a first confidence interval for the historical access data for each user dimension is determined based on a first preset confidence level and the cleaned clusters for each user dimension.

[0098] The system access volume monitoring method provided in this embodiment of the invention performs clustering processing on historical access volume data in the above manner. This allows for the determination of early warning thresholds at multiple levels, thereby improving the accuracy of early warning thresholds and ultimately enhancing the accuracy of system access volume monitoring. Simultaneously, clustering historical access volume data facilitates better subsequent data cleaning. Data cleaning of each cluster in the clustering results removes abnormal data from each cluster, ensuring the stability and relevance of the early warning threshold determination process, thus improving the accuracy of early warning thresholds and ultimately enhancing the accuracy of system access volume monitoring.

[0099] Based on any of the above embodiments, in this method, step 122 includes:

[0100] The quartile method is used to process each cluster in the clustering results to obtain the lower quartile and upper quartile of each cluster.

[0101] Based on the lower quartile and the upper quartile, data cleaning is performed on each cluster to obtain cleaned clusters. Each cleaned cluster includes data from the lower quartile to the upper quartile.

[0102] Specifically, the minimum and maximum values ​​in each cluster of the clustering results are determined, as well as the median, lower quartile, and upper quartile in each cluster of the clustering results. Then, the data segment from the minimum to the lower quartile is removed, and the data segment from the upper quartile to the maximum value is removed, leaving only the data segment from the lower quartile to the median and the data segment from the median to the upper quartile.

[0103] Understandably, according to the quartile method, we can obtain four data segments: from the minimum value to the lower quartile, from the lower quartile to the median, from the median to the upper quartile, and from the upper quartile to the maximum value.

[0104] To facilitate understanding of the interquartile range method, the following explanation uses the interquartile range calculation formula.

[0105] Arrange the n numbers in each cluster from smallest to largest. Q1, Q2, and Q3 are called the lower quartile, median, and upper quartile of the dataset, respectively. Divide the dataset into four parts: the minimum to the lower quartile, the lower quartile to the median, the median to the upper quartile, and the upper quartile to the maximum value. Q1, Q2, and Q3 are shown below:

[0106] Q1 = (n+1) / 4;

[0107] Q2 = 2(n+1) / 4;

[0108] Q3 = 3(n+1) / 4.

[0109] In one embodiment, the larger and smaller values ​​in the historical access data are usually noisy or invalid data. Therefore, the quartile method is used to process each cluster in the clustering results, thereby removing a large amount of noisy and invalid data. Specifically, the data segment from the minimum value to the lower quartile is removed, and the data segment from the upper quartile to the maximum value is removed.

[0110] In one embodiment, prior to step 121 above, historical access data is normalized based on different time granularities to obtain historical access data corresponding to each time granularity. Based on this, the quartile method is used to process each cluster in the clustering results corresponding to each time granularity to obtain the lower quartile and upper quartile of each cluster corresponding to each time granularity. Based on the lower quartile and upper quartile of each cluster corresponding to each time granularity, data cleaning is performed on each cluster corresponding to each time granularity to obtain the cleaned clusters corresponding to each time granularity.

[0111] In one embodiment, historical access data may include historical access data for different user dimensions. Based on this, the quartile method is used to process each cluster in the clustering results for each user dimension to obtain the lower quartile and upper quartile of each cluster for each user dimension; based on the lower quartile and upper quartile of each cluster for each user dimension, data cleaning is performed on each cluster corresponding to each user dimension to obtain the cleaned clusters for each user dimension.

[0112] The system access volume monitoring method provided in this embodiment of the invention, by adopting the quartile method as described above, can better clean the data of each cluster in the clustering results, thereby further ensuring the stability and pertinence of the early warning threshold determination process, and further improving the accuracy of the early warning threshold, and ultimately further improving the accuracy of system access volume monitoring.

[0113] Based on any of the above embodiments, the method further includes the following after step 110:

[0114] Based on different time granularities, the historical access volume data is normalized to obtain historical access volume data corresponding to each time granularity, so as to obtain the early warning threshold for each time granularity.

[0115] Here, different time granularities may include, but are not limited to, hours, days, weeks, minutes, months, etc., and the embodiments of the present invention do not specifically limit them.

[0116] In one embodiment, historical access data is divided into 25 dimensions at both hourly and daily granularity. Specifically, historical access data is divided into 24 parts by hour and 1 part by day.

[0117] Accordingly, step 120 includes: determining the first confidence interval of historical access data corresponding to each time granularity based on the first preset confidence level, and determining the upper limit of the first confidence interval corresponding to each time granularity as the warning threshold of each time granularity.

[0118] For example, by dividing historical access data into hourly granularities, a 24-hour early warning threshold can be obtained, as shown in Table 1 below:

[0119] Hour 0 1 2 3 4 5 6 7 8 9 10 11 Warning threshold 10 7 7 5 6 2 3 9 7 32 67 40 Hour 12 13 14 15 16 17 18 19 20 21 22 23 Warning threshold 15 20 38 23 15 28 34 40 47 30 18 105

[0120] Table 1

[0121] Accordingly, step 130 above includes: monitoring the access volume of the system to be monitored based on the warning thresholds at each time granularity.

[0122] In one embodiment, historical access data may include historical access data for different user dimensions. Based on this, historical access data for different user dimensions is normalized according to different time granularities to obtain historical access data corresponding to each time granularity of different user dimensions, so as to obtain the early warning threshold for each time granularity of different user dimensions.

[0123] For example, by dividing historical access data into hourly granularities, a 24-hour warning threshold can be obtained. Different user dimensions are set as IP, account, and number, as shown in Tables 2, 3, and 4 below. Table 2 shows the 24-hour warning threshold for IP, Table 3 shows the 24-hour warning threshold for account, and Table 4 shows the 24-hour warning threshold for number.

[0124] Hour 0 1 2 3 4 5 6 7 8 9 10 11 Warning threshold 30 14 14 14 14 14 14 14 14 35 36 41 Hour 12 13 14 15 16 17 18 19 20 21 22 23 Warning threshold 21 13 34 29 14 23 44 42 52 29 14 14

[0125] Table 2

[0126] Hour 0 1 2 3 4 5 6 7 8 9 10 11 Warning threshold 17 102 50 16 16 16 16 16 25 25 38 38 Hour 12 13 14 15 16 17 18 19 20 21 22 23 Warning threshold 11 25 25 22 16 15 78 77 17 14 18 36

[0127] Table 3

[0128] Hour 0 1 2 3 4 5 6 7 8 9 10 11 Warning threshold 10 10 10 10 10 10 10 10 90 90 90 90 Hour 12 13 14 15 16 17 18 19 20 21 22 23 Warning threshold 90 90 90 90 90 90 90 90 90 90 90 90

[0129] Table 4

[0130] Understandably, by dividing historical access data into 25 dimensions at the hourly and daily granularity levels, and setting different user dimensions as IP, account, and number, 75 warning thresholds can be generated daily, including 24-hour warning thresholds for three user dimensions and overall daily warning thresholds.

[0131] The system access volume monitoring method provided in this embodiment of the invention, through the above-mentioned method, standardizes historical access volume data based on different time granularities, thereby obtaining both the overall warning threshold and the time range of the warning threshold, that is, the warning threshold at different times, thus enabling more flexible and accurate warning threshold settings, and further improving the flexibility and accuracy of system access volume monitoring.

[0132] Based on any of the above embodiments Figure 3 This is the third flowchart illustrating the system access volume monitoring method provided by the present invention, as shown below. Figure 3 As shown, the warning threshold includes thresholds for multiple time points, and the process before step 130 includes:

[0133] Step 310: Determine the first time point corresponding to the minimum threshold among the warning thresholds, and determine the second time point corresponding to the maximum threshold among the warning thresholds.

[0134] It should be noted that during the determination of the warning threshold, the access traffic data may have values ​​that are small or large at certain times depending on the user's access situation. This may result in the calculated warning threshold being too small or too large. Therefore, it is necessary to replace the minimum and maximum thresholds in the warning threshold.

[0135] Here, the first time point can include multiple time points, and the second time point can also include multiple time points; that is, the smaller value can include multiple time points, and the larger value can also include multiple time points.

[0136] In one embodiment, the warning thresholds include 24-hour warning thresholds, i.e., 24 warning thresholds ranging from 0 to 23.

[0137] Step 320: Determine the median of the warning threshold, and determine the second confidence interval of the warning threshold based on the second preset confidence level.

[0138] Step 330: Update the threshold at the first time point in the warning threshold to the median, and update the threshold at the second time point in the warning threshold to the upper limit of the second confidence interval.

[0139] Here, the second preset confidence level is the Gaussian distribution confidence level. This second preset confidence level can be set according to actual needs, such as 95% confidence level, 90% confidence level, etc. The embodiments of the present invention do not make specific limitations on this.

[0140] The system access volume monitoring method provided in this embodiment of the invention, by adjusting and optimizing the early warning threshold according to dynamic data changes in the above manner, can effectively cope with the periodic changes in historical access volume data, further improve the accuracy of the early warning threshold, and thus further improve the accuracy of system access volume monitoring.

[0141] Based on any of the above embodiments, in this method, the warning threshold includes a threshold for off-peak hours and a threshold for peak hours, and step 310 includes:

[0142] Determine the first idle time point corresponding to the minimum threshold of the idle period in the warning threshold, and determine the first busy time point corresponding to the minimum threshold of the busy period in the warning threshold;

[0143] Determine the second idle time point corresponding to the maximum threshold of the idle period in the warning threshold, and determine the second busy time point corresponding to the maximum threshold of the busy period in the warning threshold.

[0144] Step 320 above includes:

[0145] Determine the median of the off-peak period in the warning threshold, and determine the median of the busy period in the warning threshold;

[0146] Based on the second preset confidence level, a second confidence interval for the off-peak period in the warning threshold is determined, and based on the second preset confidence level, a second confidence interval for the busy period in the warning threshold is determined.

[0147] Step 330 above includes:

[0148] The threshold of the first off-peak time point in the warning threshold is updated to the median of the off-peak period, and the threshold of the first busy time point in the warning threshold is updated to the median of the busy period;

[0149] The threshold of the second off-peak time point in the warning threshold is updated to the upper limit of the second confidence interval of the off-peak period, and the threshold of the second busy time point in the warning threshold is updated to the upper limit of the second confidence interval of the busy period.

[0150] Here, the off-peak and peak periods can be set according to actual needs, and this embodiment of the invention does not impose specific limitations on them. For example, at the hourly level, 0:00 to 8:00 in a 24-hour period can be set as off-peak and 8:00 to 24:00 as peak. As another example, at the daily level, Monday to Friday can be set as off-peak and Saturday to Sunday as peak. As yet another example, at the daily level, weekdays can be set as off-peak and holidays as peak.

[0151] The system access volume monitoring method provided in this embodiment of the invention divides the warning threshold into a threshold for off-peak hours and a threshold for peak hours in the above manner. Then, the warning thresholds for off-peak hours and peak hours are replaced separately. Compared with replacing them all at once, the replacement of warning thresholds in this embodiment of the invention is more accurate, thereby further improving the accuracy of warning thresholds and thus further improving the accuracy of system access volume monitoring. At the same time, the warning thresholds have off-peak and non-off-peak modes, so the modes can be switched to cope with the periodic changes in system access volume.

[0152] Based on any of the above embodiments, in this method, step 110 includes:

[0153] Historical access data for different user dimensions in the system to be monitored are obtained to obtain the early warning threshold for each user dimension, wherein the user dimension is used to characterize the accessing user.

[0154] Here, different user dimensions can include, but are not limited to, IP address, account (USER), and mobile number (MOBILE). Based on this, data from three dimensions—abnormal source IP address, high-frequency mobile number queries, and account logins—can be monitored.

[0155] In one embodiment, historical access data of IPs, accounts, and numbers in the system to be monitored is obtained to determine the warning thresholds for IPs, accounts, and numbers.

[0156] Accordingly, step 120 includes: determining the first confidence interval of historical access data for each user dimension based on the first preset confidence level, and determining the upper limit of the first confidence interval for each user dimension as the warning threshold for each user dimension.

[0157] Accordingly, step 130 above includes: monitoring the access volume of the system to be monitored based on the warning thresholds for each user dimension.

[0158] Furthermore, prior to step 120 above, the historical access data for each user dimension can be normalized based on different time granularities to obtain the historical access data corresponding to each time granularity for each user dimension.

[0159] The system access volume monitoring method provided in this embodiment of the invention can monitor access volume data of different user dimensions through the above-described method, thereby ensuring that access volume of each user dimension can be monitored, and further improving the accuracy of system access volume monitoring.

[0160] The system access volume monitoring device provided by the present invention is described below. The system access volume monitoring device described below can be referred to in correspondence with the system access volume monitoring method described above.

[0161] Figure 4 This is a schematic diagram of the system access monitoring device provided by the present invention, as shown below. Figure 4 As shown, the system access monitoring device includes:

[0162] Module 410 is used to acquire historical access data of the system to be monitored.

[0163] The determination module 420 is used to determine a first confidence interval of the historical access volume data based on a first preset confidence level, and to determine the upper limit of the first confidence interval as a warning threshold;

[0164] The monitoring module 430 is used to monitor the access volume of the system to be monitored based on the warning threshold.

[0165] The system access volume monitoring device provided in this embodiment of the invention acquires historical access volume data of the system to be monitored; determines a first confidence interval of the historical access volume data based on a first preset confidence level, and determines the upper limit of the first confidence interval as a warning threshold; and monitors the access volume of the system to be monitored based on the warning threshold. Through the above method, historical access volume data is statistically analyzed, and a confidence-based threshold determination method is used to determine the warning threshold, so that the warning threshold is a limit under the preset confidence level. Compared with manually setting the warning threshold, the warning threshold determined by this embodiment of the invention is more accurate, thereby improving the accuracy of system access volume monitoring. Simultaneously, even if the access traffic data changes over time, the warning threshold can be automatically adjusted according to the dynamic historical access volume data, thereby improving the flexibility and efficiency of warning threshold setting, and thus improving the flexibility and efficiency of system access volume monitoring. In summary, this embodiment of the invention can improve the accuracy, flexibility, and efficiency of system access volume monitoring.

[0166] Based on any of the above embodiments, the determining module 420 includes:

[0167] A clustering processing unit is used to perform clustering processing on the historical access data to obtain clustering results;

[0168] The data cleaning unit is used to clean the data of each cluster in the clustering result to obtain cleaned clusters.

[0169] An interval determination unit is used to determine a first confidence interval of the historical access data based on a first preset confidence level and the cleaned clusters.

[0170] Based on any of the above embodiments, the data cleaning unit is further configured to:

[0171] The quartile method is used to process each cluster in the clustering results to obtain the lower quartile and upper quartile of each cluster.

[0172] Based on the lower quartile and the upper quartile, data cleaning is performed on each cluster to obtain cleaned clusters. Each cleaned cluster includes data from the lower quartile to the upper quartile.

[0173] Based on any of the above embodiments, the device further includes:

[0174] The standardization processing module is used to standardize the historical access data based on different time granularities to obtain historical access data corresponding to each time granularity, so as to obtain the warning threshold for each time granularity.

[0175] Based on any of the above embodiments, the warning threshold includes thresholds for multiple time points, and the device further includes:

[0176] The time determination module is used to determine the first time point corresponding to the minimum threshold among the warning thresholds, and to determine the second time point corresponding to the maximum threshold among the warning thresholds;

[0177] An interval determination module is used to determine the median of the warning threshold and, based on a second preset confidence level, determine a second confidence interval for the warning threshold.

[0178] The threshold replacement module is used to update the threshold at the first time point in the warning threshold to the median, and to update the threshold at the second time point in the warning threshold to the upper limit of the second confidence interval.

[0179] Based on any of the above embodiments, the warning threshold includes a threshold for off-peak hours and a threshold for peak hours;

[0180] This time determination module is also used for:

[0181] Determine the first idle time point corresponding to the minimum threshold of the idle period in the warning threshold, and determine the first busy time point corresponding to the minimum threshold of the busy period in the warning threshold;

[0182] Determine the second idle time point corresponding to the maximum threshold of the idle period in the warning threshold, and determine the second busy time point corresponding to the maximum threshold of the busy period in the warning threshold;

[0183] This interval determination module is also used for:

[0184] Determine the median of the off-peak period in the warning threshold, and determine the median of the busy period in the warning threshold;

[0185] Based on the second preset confidence level, a second confidence interval for the off-peak period in the warning threshold is determined, and based on the second preset confidence level, a second confidence interval for the busy period in the warning threshold is determined.

[0186] This threshold replacement module is also used for:

[0187] The threshold of the first off-peak time point in the warning threshold is updated to the median of the off-peak period, and the threshold of the first busy time point in the warning threshold is updated to the median of the busy period;

[0188] The threshold of the second off-peak time point in the warning threshold is updated to the upper limit of the second confidence interval of the off-peak period, and the threshold of the second busy time point in the warning threshold is updated to the upper limit of the second confidence interval of the busy period.

[0189] Based on any of the above embodiments, the acquisition module 410 is further configured to:

[0190] Historical access data for different user dimensions in the system to be monitored are obtained to obtain the early warning threshold for each user dimension, wherein the user dimension is used to characterize the accessing user.

[0191] Figure 5 An example is a schematic diagram of the physical structure of an electronic device, such as... Figure 5 As shown, the electronic device may include a processor 510, a communications interface 520, a memory 530, and a communication bus 540, wherein the processor 510, communications interface 520, and memory 530 communicate with each other via the communication bus 540. The processor 510 can invoke logical instructions in the memory 530 to execute a system access monitoring method, which includes: acquiring historical access data of the system to be monitored; determining a first confidence interval of the historical access data based on a first preset confidence level, and determining the upper limit of the first confidence interval as a warning threshold; and monitoring the access volume of the system to be monitored based on the warning threshold.

[0192] Furthermore, the logical instructions in the aforementioned memory 530 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, essentially, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0193] On the other hand, the present invention also provides a computer program product, which includes a computer program that can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute the system access volume monitoring method provided by the above methods. The method includes: acquiring historical access volume data of the system to be monitored; determining a first confidence interval of the historical access volume data based on a first preset confidence level, and determining the upper limit of the first confidence interval as a warning threshold; and monitoring the access volume of the system to be monitored based on the warning threshold.

[0194] In another aspect, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon. When executed by a processor, the computer program implements the system access volume monitoring method provided by the above methods. The method includes: acquiring historical access volume data of the system to be monitored; determining a first confidence interval of the historical access volume data based on a first preset confidence level, and determining the upper limit of the first confidence interval as a warning threshold; and monitoring the access volume of the system to be monitored based on the warning threshold.

[0195] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0196] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0197] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for monitoring system access volume, characterized in that, include: Obtain historical access data for the system to be monitored; Based on the first preset confidence level, a first confidence interval for the historical access data is determined, and the upper limit of the first confidence interval is determined as the warning threshold. Based on the aforementioned warning threshold, the access volume of the system to be monitored is monitored. The warning threshold includes thresholds for multiple time points. Before monitoring the access volume of the system to be monitored based on the warning threshold, the following steps are also included: Determine the first time point corresponding to the minimum threshold among the warning thresholds, and determine the second time point corresponding to the maximum threshold among the warning thresholds; Determine the median of the warning threshold, and based on the second preset confidence level, determine the second confidence interval of the warning threshold; The threshold at the first time point in the warning threshold is updated to the median, and the threshold at the second time point in the warning threshold is updated to the upper limit of the second confidence interval; The warning thresholds include thresholds for off-peak hours and thresholds for peak hours; Determining the first time point corresponding to the minimum threshold among the warning thresholds, and determining the second time point corresponding to the maximum threshold among the warning thresholds, includes: Determine the first idle time point corresponding to the minimum threshold of the idle period in the warning threshold, and determine the first busy time point corresponding to the minimum threshold of the busy period in the warning threshold; Determine the second idle time point corresponding to the maximum threshold of the idle period in the warning threshold, and determine the second busy time point corresponding to the maximum threshold of the busy period in the warning threshold; The step of determining the median of the warning threshold and, based on a second preset confidence level, determining the second confidence interval of the warning threshold includes: Determine the median of the off-peak period in the warning threshold, and determine the median of the busy period in the warning threshold; Based on the second preset confidence level, a second confidence interval for the off-peak period in the warning threshold is determined, and based on the second preset confidence level, a second confidence interval for the busy period in the warning threshold is determined. The step of updating the threshold at the first time point in the warning threshold to the median, and updating the threshold at the second time point in the warning threshold to the upper limit of the second confidence interval, includes: The threshold of the first off-peak time point in the warning threshold is updated to the median of the off-peak period, and the threshold of the first busy time point in the warning threshold is updated to the median of the busy period; The threshold of the second idle time point in the warning threshold is updated to the upper limit of the second confidence interval of the idle time period, and the threshold of the second busy time point in the warning threshold is updated to the upper limit of the second confidence interval of the busy time period.

2. The system access volume monitoring method according to claim 1, characterized in that, The step of determining the first confidence interval of the historical access data based on a first preset confidence level includes: The historical access data is clustered to obtain the clustering results; Data cleaning is performed on each cluster in the clustering results to obtain cleaned clusters; Based on the first preset confidence level and the cleaned clusters, a first confidence interval for the historical access data is determined.

3. The system access volume monitoring method according to claim 2, characterized in that, The step of cleaning the data of each cluster in the clustering result to obtain the cleaned clusters includes: The quartile method is used to process each cluster in the clustering results to obtain the lower quartile and upper quartile of each cluster. Based on the lower quartile and the upper quartile, data cleaning is performed on each cluster to obtain cleaned clusters. Each cleaned cluster includes data from the lower quartile to the upper quartile.

4. The system access volume monitoring method according to any one of claims 1 to 3, characterized in that, The process of obtaining historical access data for the system to be monitored also includes: Based on different time granularities, the historical access volume data is normalized to obtain historical access volume data corresponding to each time granularity, so as to obtain the early warning threshold for each time granularity.

5. The system access volume monitoring method according to any one of claims 1 to 3, characterized in that, The acquisition of historical access data for the system to be monitored includes: Historical access data for different user dimensions in the system to be monitored are obtained to obtain the early warning threshold for each user dimension, wherein the user dimension is used to characterize the accessing user.

6. A system access volume monitoring device, characterized in that, include: The acquisition module is used to acquire historical access volume data of the system to be monitored. The determination module is used to determine a first confidence interval of the historical access data based on a first preset confidence level, and to determine the upper limit of the first confidence interval as a warning threshold; The monitoring module is used to monitor the access volume of the system to be monitored based on the warning threshold. The warning threshold includes thresholds for multiple time points, and the device further includes: The time determination module is used to determine the first time point corresponding to the minimum threshold among the warning thresholds, and to determine the second time point corresponding to the maximum threshold among the warning thresholds; An interval determination module is used to determine the median of the warning threshold and, based on a second preset confidence level, determine a second confidence interval for the warning threshold. A threshold replacement module is used to update the threshold at the first time point in the warning threshold to the median, and to update the threshold at the second time point in the warning threshold to the upper limit of the second confidence interval; The warning thresholds include thresholds for off-peak hours and thresholds for peak hours; The time determination module is also used for: Determine the first idle time point corresponding to the minimum threshold of the idle period in the warning threshold, and determine the first busy time point corresponding to the minimum threshold of the busy period in the warning threshold; Determine the second idle time point corresponding to the maximum threshold of the idle period in the warning threshold, and determine the second busy time point corresponding to the maximum threshold of the busy period in the warning threshold; The interval determination module is also used for: Determine the median of the off-peak period in the warning threshold, and determine the median of the busy period in the warning threshold; Based on the second preset confidence level, a second confidence interval for the off-peak period in the warning threshold is determined, and based on the second preset confidence level, a second confidence interval for the busy period in the warning threshold is determined. The threshold replacement module is also used for: The threshold of the first off-peak time point in the warning threshold is updated to the median of the off-peak period, and the threshold of the first busy time point in the warning threshold is updated to the median of the busy period; The threshold of the second idle time point in the warning threshold is updated to the upper limit of the second confidence interval of the idle time period, and the threshold of the second busy time point in the warning threshold is updated to the upper limit of the second confidence interval of the busy time period.

7. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the system access monitoring method as described in any one of claims 1 to 5.

8. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the system access monitoring method as described in any one of claims 1 to 5.

Images