Iptv epg box end user abnormal behavior real-time monitoring method, device, storage medium and server

Abstract

The application provides a user abnormal behavior real-time monitoring method of an IPTV EPG box terminal, through a user abnormal behavior real-time monitoring model privately deployed in an IPTV environment, user behavior data (user behavior logs, system reverse proxy logs, exchange interface logs and payment interface logs) of an EPG box terminal are input into the user abnormal behavior real-time monitoring model after being cleaned and preprocessed, and monitoring results are obtained and output. AI algorithms are used to perform deep learning on user behavior of a set-top box, system reverse proxy logs, exchange interface and payment interface collected log data and establish a model, the model can intelligently analyze and detect whether user behavior of the IPTV box terminal is abnormal, server resources used are less, the model can be privately deployed in the IPTV environment, greatly reduces the scheme cost, the user abnormal behavior of the EPG box terminal can be monitored in real time, interception or shielding processing can be found in time, and loss is avoided.

Description

Technical Field

[0001] This application relates to the field of IPTV technology, and more specifically, to a method for real-time monitoring of abnormal user behavior at an IPTV EPG box. Background Technology

[0002] The usual practice for monitoring IPTV EPG set-top box behavior is to deploy a big data system to collect and analyze user behavior data, and generate a report the next day or a few hours later; or to deploy a risk control system to monitor user behavior in a timely manner and predict and block risks.

[0003] However, the solution of deploying a big data system for monitoring involves collecting user behavior data and then performing big data analysis to generate reports. Technical personnel then use these reports to identify and take actions such as blocking or restricting abnormal user behavior. This approach is reactive; the abnormal user behavior has already occurred, making real-time monitoring impossible. Furthermore, the servers required for this deployment have high requirements, resulting in a high cost for deploying a big data system. Therefore, in monitoring IPTV EPG box behavior, deploying a big data system is costly but yields poor results.

[0004] Deploying a risk control system to monitor abnormal user behavior yields better monitoring results with a wider range of user behavior data dimensions. However, IPTV EPG boxes only handle user viewing and playback, resulting in limited data dimensions and hindering effective monitoring. Furthermore, risk control systems are generally expensive to purchase, and in IPTV environments, they can only be deployed privately. Risk control systems are typically deployed as SaaS, further increasing the cost of the private portion.

[0005] Therefore, how to achieve real-time risk monitoring of user behavior on IPTV EPG boxes at a lower cost is an urgent problem to be solved in this field. Summary of the Invention

[0006] The purpose of this application is to provide a method for real-time monitoring of abnormal user behavior on IPTV EPG boxes, so as to achieve real-time risk monitoring of user behavior on IPTV EPG boxes at low cost.

[0007] To achieve the above objectives, the embodiments of this application are implemented in the following manner:

[0008] In a first aspect, embodiments of this application provide a method for real-time monitoring of abnormal user behavior on an IPTV EPG box, comprising: acquiring user behavior data on the EPG box, wherein the user behavior data includes user behavior logs, system reverse proxy logs, exchange interface logs, and payment interface logs; cleaning and preprocessing the user behavior data; inputting the preprocessed user behavior data into a real-time monitoring model for abnormal user behavior privately deployed in the IPTV environment, obtaining monitoring results, and outputting them.

[0009] In conjunction with the first aspect, in the first possible implementation of the first aspect, the construction process of the real-time monitoring model for abnormal user behavior is as follows: A deep learning model framework is built using the TensorFlow module; training data is acquired, including historical user behavior logs, historical system reverse proxy logs, historical exchange interface logs, and historical payment interface logs; a training set, test set, and validation set are determined based on the training data; the training set, test set, and validation set are imported into the TensorFlow module, and the model is trained using the training set and test set, and validated using the validation set; abnormal behavior data is acquired, and the validated model is trained using abnormal behavior weighted training to obtain the real-time monitoring model for abnormal user behavior.

[0010] In conjunction with the first possible implementation of the first aspect, in the second possible implementation of the first aspect, a deep learning model framework is built using the TensorFlow module, including: building four sub-models using the TensorFlow module; using a multilayer perceptron or convolutional neural network as the framework for each sub-model, wherein the four sub-models are a user behavior sub-model, a reverse proxy sub-model, an exchange behavior sub-model, and a payment behavior sub-model; selecting mean squared error as the loss function for each sub-model; and merging the four sub-models as the deep learning model framework.

[0011] In conjunction with the second possible implementation of the first aspect, the third possible implementation of the first aspect involves determining the training set, test set, and validation set based on the training data. This includes: cleaning and preprocessing the training data; dividing the processed historical user behavior logs into a user behavior training set, a user behavior test set, and a user behavior validation set; dividing the processed historical system reverse proxy logs into a reverse proxy training set, a reverse proxy test set, and a reverse proxy validation set; dividing the processed historical exchange interface logs into an exchange behavior training set, an exchange behavior test set, and an exchange behavior validation set; and dividing the processed historical payment interface logs into a payment behavior training set, a payment behavior test set, and a payment behavior validation set.

[0012] In conjunction with the third possible implementation of the first aspect, the fourth possible implementation of the first aspect involves importing the training set, test set, and validation set into the TensorFlow module. The training and test sets are used for model training, and the validation set is used to validate the trained model. This includes: training a user behavior sub-model using a user behavior training set, testing the user behavior sub-model using a user behavior test set, and validating the user behavior sub-model using a user behavior validation set; training a reverse proxy sub-model using a reverse proxy training set, testing the reverse proxy sub-model using a reverse proxy test set, and validating the reverse proxy sub-model using a reverse proxy validation set; training a redemption behavior sub-model using a redemption behavior training set, testing the redemption behavior sub-model using a redemption behavior test set, and validating the redemption behavior sub-model using a redemption behavior validation set; and training a payment behavior sub-model using a payment behavior training set, testing the payment behavior sub-model using a payment behavior test set, and validating the payment behavior sub-model using a payment behavior validation set.

[0013] In conjunction with the first possible implementation of the first aspect, in the fifth possible implementation of the first aspect, abnormal behavior data is acquired, and the verified model is trained using abnormal behavior weighting using the abnormal behavior data. This includes: acquiring abnormal behavior data, wherein the abnormal behavior data includes Type I abnormal behavior data of abnormally claiming activity gifts, Type II abnormal behavior data of users maliciously increasing playback time, and Type III abnormal behavior data of users fraudulently claiming membership benefits; importing Type I, Type II, and Type III abnormal behavior data into the TensorFlow module respectively; and training the verified model using abnormal behavior weighting using the Type I, Type II, and Type III abnormal behavior data.

[0014] In conjunction with the first aspect, in the sixth possible implementation of the first aspect, after obtaining the monitoring results, the method further includes: if the monitoring result is a Class I result, conducting the next round of monitoring, wherein a Class I result indicates that the user on the EPG box terminal has a low probability of abnormal behavior risk; if the monitoring result is a Class II result, issuing a risk warning, wherein a Class II result indicates that the user on the EPG box terminal may have abnormal behavior risk; and if the monitoring result is a Class III result, forcibly intercepting, wherein a Class III result indicates that the user on the EPG box terminal has abnormal behavior risk.

[0015] Secondly, embodiments of this application provide a real-time monitoring device for abnormal user behavior at an IPTV EPG box, comprising: a data acquisition unit for acquiring user behavior data at the EPG box, wherein the user behavior data includes user behavior logs, system reverse proxy logs, exchange interface logs, and payment interface logs; a data processing unit for cleaning and preprocessing the user behavior data; and a behavior monitoring unit for inputting the preprocessed user behavior data into a privately deployed real-time monitoring model for abnormal user behavior in the IPTV environment, obtaining monitoring results, and outputting them.

[0016] Thirdly, embodiments of this application provide a storage medium disposed within a server, the storage medium including a stored program, wherein, when the program is running, it controls the server where the storage medium is located to execute the real-time monitoring method for abnormal user behavior at the IPTV EPG box terminal, as described in any one of the first aspects or possible implementations of the first aspect.

[0017] Fourthly, embodiments of this application provide a server, including a memory and a processor. The memory is used to store information including program instructions, and the processor is used to control the execution of the program instructions. When the program instructions are loaded and executed by the processor, they implement the real-time monitoring method for abnormal user behavior at the IPTV EPG box terminal, as described in any one of the first aspects or possible implementations of the first aspect.

[0018] Beneficial effects:

[0019] 1. This solution utilizes a real-time monitoring model for abnormal user behavior, privately deployed within an IPTV environment. User behavior data from the EPG box (user behavior logs, system reverse proxy logs, redemption interface logs, and payment interface logs) is cleaned and preprocessed before being input into the model to obtain and output monitoring results. AI algorithms are used to perform deep learning on the set-top box user behavior, system reverse proxy logs, and logs collected from the redemption and payment interfaces to build a model. This model can intelligently analyze and detect abnormal user behavior on the IPTV box, using fewer server resources and allowing for private deployment in an IPTV environment, significantly reducing costs. It enables real-time monitoring of abnormal user behavior on the EPG box (e.g., unauthorized redemption of promotional gifts, malicious overspending of playback time, fraudulent claims of membership benefits, and malicious forgery of user orders), allowing for timely detection, interception, or blocking to prevent losses. Compared to traditional solutions deploying big data systems or risk control systems, this significantly reduces costs and achieves superior real-time monitoring results for abnormal user behavior.

[0020] 2. A deep learning model framework was built using the TensorFlow module, consisting of four sub-models (user behavior sub-model, reverse proxy sub-model, exchange behavior sub-model, and payment behavior sub-model). Each sub-model was constructed using a multilayer perceptron or convolutional neural network as its framework, with mean squared error (MSE) as the loss function. These four sub-models were then merged into a single deep learning model framework. Training, testing, and validation sets were determined using training data (historical user behavior logs, historical system reverse proxy logs, historical exchange interface logs, and historical payment interface logs). These sets were imported into the TensorFlow module. The model was trained using the training and testing sets, and validated using the validation set. Finally, the validated model was trained with anomaly behavior weighting to obtain a real-time user anomaly behavior monitoring model. This approach enables the real-time user anomaly behavior monitoring model to dynamically and accurately monitor user anomaly behavior in real-time using limited data (user behavior logs, system reverse proxy logs, exchange interface logs, and payment interface logs), ensuring effective real-time monitoring and preventing data loss.

[0021] To make the above-mentioned objectives, features and advantages of this application more apparent and understandable, preferred embodiments are described below in detail with reference to the accompanying drawings. Attached Figure Description

[0022] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments of this application will be briefly introduced below. It should be understood that the following drawings only show some embodiments of this application and should not be regarded as a limitation of the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0023] Figure 1 A flowchart illustrating a real-time monitoring method for abnormal user behavior on an IPTV EPG box, provided in an embodiment of this application.

[0024] Figure 2 This is a schematic diagram of a real-time monitoring device for abnormal user behavior at an IPTV EPG box, provided as an embodiment of this application.

[0025] Icons: 10-Real-time monitoring device for abnormal user behavior at IPTV EPG box; 11-Data acquisition unit; 12-Data processing unit; 13-Behavior monitoring unit. Detailed Implementation

[0026] The technical solutions in the embodiments of this application will now be described with reference to the accompanying drawings.

[0027] Please see Figure 1 , Figure 1 This is a flowchart illustrating a real-time monitoring method for abnormal user behavior on an IPTV EPG box, provided in an embodiment of this application. The real-time monitoring method for abnormal user behavior on an IPTV EPG box may include steps S10, S20, and S30.

[0028] In this embodiment, the real-time monitoring method for abnormal user behavior at the IPTV EPG box is executed by a server, and the operation of the method depends on a real-time monitoring model for abnormal user behavior privately deployed in the IPTV environment. Therefore, to facilitate understanding of this solution, the real-time monitoring model for abnormal user behavior privately deployed in the IPTV environment will be introduced here before introducing step S10.

[0029] In this embodiment, a deep learning model framework can be built using the TensorFlow module to construct a real-time monitoring model for abnormal user behavior.

[0030] For example, four sub-models can be built using the TensorFlow module: user behavior sub-model, reverse proxy sub-model, exchange behavior sub-model, and payment behavior sub-model.

[0031] A multilayer perceptron can be used as the framework for each sub-model:

[0032] h (l) =f(W (l) h (l-1) +b (l) (1)

[0033] y = softmax(W (l) h (l-1) +b (l) (2)

[0034] Among them, h (l) and h (l-1) W represents the activation of the l-th and (l-1)-th hidden layers, respectively. (l) Let b be the weight matrix of the l-th layer. (l) Let f(·) be the bias vector of the l-th layer, f(·) represent the activation function, and y be the prediction result of the output layer.

[0035] Alternatively, a convolutional neural network can be used as the framework for each sub-model:

[0036] h conv =f(W conv *x+b conv (3)

[0037] h pool =pool(h conv (4)

[0038] y = softmax(W fc h pool +b fc (5)

[0039] Among them, h conv For activation of the convolutional layer, W conv Here, b represents the weight matrix of the convolutional layer, * denotes the convolution operation, x is the feature representation of the input sample, and b is the weight matrix of the convolutional layer. conv h is the bias vector of the convolutional layer. pool The pooling layer is activated by the pooling operation, pool(·) represents the pooling operation, y is the prediction result of the output layer, and W is the activation value of the pooling layer. fc Let b be the weight matrix of the fully connected layer. fc This is the bias vector for the fully connected layer.

[0040] This embodiment takes the use of a convolutional neural network as the framework for each sub-model as an example, selects mean squared error as the loss function for each sub-model, and merges the four sub-models as a deep learning model framework.

[0041] After setting up the deep learning model framework, training data can be obtained, including historical user behavior logs, historical system reverse proxy logs, historical exchange interface logs, and historical payment interface logs.

[0042] For example, historical user behavior logs, historical system reverse proxy logs, historical exchange interface logs, and historical payment interface logs of IPTV EPG box users (covering a large number of users) can be collected over the past 12 months.

[0043] For example, collecting historical user behavior logs from the past 12 months:

[0044] Specifically, logs of type userlog will be captured.

[0045] Extract the following field values ​​from the logs as the main log features: userid (user ID), stbid (set-top box ID), pagename (accessed page), scene (accessed scene), mediacode (media asset code), playtime (playback duration), medianame (media asset name), and datetime (reporting time).

[0046] Collect historical system reverse proxy logs from the past 12 months:

[0047] Specifically, logs of type "system" will be captured.

[0048] Extract the following fields from the logs as the main log features for processing: remote_addr (client's IP address), request (specific request), status (request status code), request_time (request time), $http_referer (referencing page URL), and datetime (reporting time).

[0049] Collect historical exchange interface logs from the past 12 months:

[0050] Specifically, the logs to be crawled are those of type exchange.

[0051] Extract the following fields from the logs as the main log features: userid, stbid, exchangecode, exchangename, scene, result, desc, and datetime.

[0052] Collect historical payment interface logs from the past 12 months:

[0053] Specifically, logs of type "payment" will be crawled.

[0054] Extract the following fields from the logs as the main log features: userid, stbid, paymentcode, payment name, scene, paymenttype, result, desc, and datetime.

[0055] Collecting 12 months of log data, covering a full year, can improve the accuracy of the trained model.

[0056] After obtaining the training data, the training set, test set, and validation set can be determined based on the training data.

[0057] For example, training data can be cleaned and preprocessed, including removing duplicates, handling missing values, and correcting formatting errors. The four types of logs are then aggregated and cleaned, removing invalid data and retaining valid data.

[0058] To improve model efficiency and accuracy, this embodiment can further extract features from the collected historical user behavior logs, historical system reverse proxy logs, historical exchange interface logs, and historical payment interface logs.

[0059] This section uses the extraction of user behavior log features from historical user behavior logs as an example for illustration.

[0060] After extracting the values ​​of userid, stbid, pagename, scene, mediacode, playtime, medianame, and datetime from the logs, the features are processed and transformed to better reflect user behavior patterns. For example, the timestamp is converted into a time period, 2023-06-01 19:00:22.312--2023-06-01 19:00:23.411; and the average page dwell time is added, staytime: 200s.

[0061] Then the features are encoded: discrete features are encoded so that they can be processed during the modeling process. For example, the scene is encoded as 01: page visit; 02: player visit, etc.

[0062] The final user behavior log characteristics are as follows:

[0063] Userlogfeature={"userid":"iptv-2399123441","stbid":"00500300001968000415B49F4D5C49AC","pagename":"index.html"," scene":"01","mediacode":"","playtime":"","medianame":"","datetime":"2023-06-0119:00:22.312","staytime":"200s"}.

[0064] It's important to note that this feature applies when media assets are not being played; therefore, features such as mediacode, playtime, and medianame will have no field values. When media assets are being played, the corresponding feature field values ​​will correspond to the specific media asset.

[0065] Similar feature extraction can be performed on historical system reverse proxy logs, historical exchange interface logs, and historical payment interface logs to form reverse proxy log features, exchange interface log features, payment interface log features, etc., which will not be elaborated here.

[0066] After extracting user behavior log features, reverse proxy log features, exchange interface log features, and payment interface log features from historical user behavior logs, historical system reverse proxy logs, historical exchange interface logs, and historical payment interface logs, four files can be generated: User-log.log (a package of all user behavior log features extracted from historical user behavior logs), system-log.log (a package of all reverse proxy log features extracted from historical system reverse proxy logs), exchange-log.log (a package of all exchange interface log features extracted from historical exchange interface logs), and payment-log.log (a package of all payment interface log features extracted from historical payment interface logs).

[0067] For each file (User-log.log, system-log.log, exchange-log.log, payment-log.log), divide it into training, test, and validation sets according to a ratio of 0.7, 0.15, 0.15 (or other ratios such as 0.7, 0.2, 0.1), resulting in:

[0068] User behavior training set, user behavior test set, and user behavior verification set (based on User-log.log, i.e., based on processed historical user behavior logs); reverse proxy training set, reverse proxy test set, and reverse proxy verification set (based on system-log.log, i.e., based on processed historical system reverse proxy logs); exchange behavior training set, exchange behavior test set, and exchange behavior verification set (based on exchange-log.log, i.e., based on processed historical exchange interface logs); payment behavior training set, payment behavior test set, and payment behavior verification set (based on payment-log.log, i.e., based on processed historical payment interface logs).

[0069] After obtaining the training set, test set, and validation set, you can import them into the TensorFlow module, use the training set and test set to train the model, and use the validation set to validate the trained model.

[0070] For example, a user behavior sub-model can be trained using a user behavior training set, tested using a user behavior test set, and validated using a user behavior validation set; a reverse proxy sub-model can be trained using a reverse proxy training set, tested using a reverse proxy test set, and validated using a reverse proxy validation set; a redemption behavior sub-model can be trained using a redemption behavior training set, tested using a redemption behavior test set, and validated using a redemption behavior validation set; and a payment behavior sub-model can be trained using a payment behavior training set, tested using a payment behavior test set, and validated using a payment behavior validation set.

[0071] For example, taking the user behavior training set UserTrainingList, the user behavior test set UserTestList, and the user behavior validation set UserValidationList, which are divided based on User-log.log, as an example, we can import the training set UserTrainingList, the test set UserTestList, and the validation set UserValidationList using the TensorFlow module, start training, and obtain the sub-model userlogModel.temp (i.e., the user behavior sub-model) after training. Similarly, we can train the sub-model systemlogModel.temp (i.e., the reverse proxy sub-model), the sub-model exchangeModel.temp (exchange behavior sub-model), and the sub-model paymentlogModel.temp (payment behavior sub-model).

[0072] The four sub-models are merged to obtain the AIUserActiondetectionModel.temp model as follows:

[0073] AIUserActiondetectionModel.temp=f(merge:userlogModel.temp, systemlogModel.temp, exchangeModel.temp, paymentlogModel.temp).

[0074] Afterwards, abnormal behavior data can be obtained, and the validated model can be trained with abnormal behavior weighting using the abnormal behavior data to obtain a real-time monitoring model for abnormal user behavior.

[0075] For example, abnormal behavior data can be obtained, wherein the abnormal behavior data includes Class I abnormal behavior data of abnormally claiming event gifts, Class II abnormal behavior data of users maliciously brushing playback duration, and Class III abnormal behavior data of users falsely claiming membership benefits. And the Class I abnormal behavior data, Class II abnormal behavior data and Class III abnormal behavior data are processed (e.g., data cleaning, preprocessing, feature extraction, etc.).

[0076] For example, an example of processed Class I abnormal behavior data (data of abnormally claiming event gifts) is as follows:

[0077] ExchangelogErrorfeature={"userid":"iptv-155122322","stbid":"00500300001968000415B49F4DAD2231C","pagename":index.html","stbid":"","scene":"03","mediacode":"","playtime":"","medianame":"","datetime":"2023-06-0220:11:51.523","error":"10032","desc":"iptv-155122322 claimed multiple times on multiple boxes"}

[0078] An example of processed Class II abnormal behavior data (data of users maliciously brushing playback duration) is as follows:

[0079] UserlogErrorfeature={"userid":"iptv-155122322","stbid":"00500300001968000415B49F4DAD2231C","pagename":"vodplay.html","scene":"01","mediacode":"DIJWIEJSDN123231NN23","playtime":"2000","medianame":"Tycoon","datetime":"2023-06-0119:00:22.312","error":"10035","desc":"iptv-155122322 reported playback durations of multiple media assets simultaneously at the same time"}

[0080] An example of processed Class III abnormal behavior data (data of users falsely claiming membership benefits) is as follows:

[0081] UserlogErrorfeature = {"userid":"iptv-155122322","stbid":"00500300001968000415B49F4DAD2231C","datetime":"2023-06-0408:41:32.422","error":"10056","desc":"The benefits claimed by iptv-155122322 were not used on the commonly used set-top box. The abnormal use of the set-top box is indicated by stbid: 0412303041234196800041523DAD2231C, 04123032512123296800213JS123SDAD"}

[0082] The processed Type I, Type II, and Type III abnormal behavior data were imported into the TensorFlow module, and the validated model was trained using the Type I, Type II, and Type III abnormal behavior data.

[0083] For example, import the Class I abnormal behavior data ExchangelogErrorfeature, Class II abnormal behavior data UserlogErrorfeature, and Class III abnormal behavior data UserlogErrorfeature into the TensorFlow module respectively, and perform weighted training on the model AIUserActiondetectionModel.temp:

[0084] AIUserActiondetectionModel.Model=f(iteration:ExchangelogErrorfeature,UserlogErrorfeature,UserlogErrorfeature,10%).

[0085] The final model, AIUserActiondetectionModel.Model, is obtained, which is the real-time monitoring model for abnormal user behavior. Based on this, the real-time monitoring model for abnormal user behavior can be privately deployed in an IPTV environment, so that the server can run the real-time monitoring method for abnormal user behavior on the IPTV EPG box.

[0086] In order to enable real-time monitoring of abnormal user behavior at the IPTV EPG box, the server can execute step S10.

[0087] Step S10: Obtain user behavior data from the EPG box, including user behavior logs, system reverse proxy logs, redemption interface logs, and payment interface logs.

[0088] In this embodiment, the server can obtain user behavior data from the EPG box in real time, including user behavior logs, system reverse proxy logs, redemption interface logs, and payment interface logs.

[0089] For example, obtaining user behavior logs in real time:

[0090] Specifically, logs of type userlog will be captured.

[0091] Extract the following field values ​​from the logs as the main log features: userid (user ID), stbid (set-top box ID), pagename (accessed page), scene (accessed scene), mediacode (media asset code), playtime (playback duration), medianame (media asset name), and datetime (reporting time).

[0092] Real-time acquisition of system reverse proxy logs:

[0093] Specifically, logs of type "system" will be captured.

[0094] Extract the following fields from the logs as the main log features for processing: remote_addr (client's IP address), request (specific request), status (request status code), request_time (request time), $http_referer (referencing page URL), and datetime (reporting time).

[0095] Get exchange interface logs in real time:

[0096] Specifically, the logs to be crawled are those of type exchange.

[0097] Extract the following fields from the logs as the main log features: userid, stbid, exchangecode, exchangename, scene, result, desc, and datetime.

[0098] Real-time acquisition of payment interface logs:

[0099] Specifically, logs of type "payment" will be crawled.

[0100] Extract the following fields from the logs as the main log features: userid, stbid, paymentcode, payment name, scene, paymenttype, result, desc, and datetime.

[0101] After obtaining user behavior data, the server can proceed to step S20.

[0102] Step S20: Clean and preprocess the user behavior data.

[0103] In this embodiment, the server can clean and preprocess data such as user behavior logs, system reverse proxy logs, exchange interface logs, and payment interface logs.

[0104] For example, user behavior data can be cleaned and preprocessed, including removing duplicates, handling missing values, and correcting formatting errors. The four types of logs are aggregated and cleaned, removing invalid data and retaining valid data. Further feature extraction can be performed on user behavior logs, system reverse proxy logs, exchange interface logs, and payment interface logs (extraction methods are as described above and will not be repeated here).

[0105] After processing the user behavior data, the server can run step S30.

[0106] Step S30: Input the preprocessed user behavior data into the real-time monitoring model for abnormal user behavior deployed in the private IPTV environment, obtain the monitoring results, and output them.

[0107] In this embodiment, the server can input preprocessed user behavior data into a privately deployed real-time monitoring model for abnormal user behavior in the IPTV environment, obtain monitoring results, and output them. For example, the monitoring results can be risk scores or conclusions.

[0108] After obtaining the monitoring results, the server can make the following judgments:

[0109] If the monitoring result is Class I, the next round of monitoring will be conducted. Class I results indicate that the possibility of abnormal behavior risk from users on the EPG box side is low.

[0110] If the monitoring result is Category II, a risk warning will be issued. Category II results indicate that users on the EPG box may have abnormal behavior risks.

[0111] If the monitoring result is Category III, the system will forcibly block the device. Category III results indicate that the user on the EPG box has a risk of abnormal behavior.

[0112] For example,

[0113] Riskconfiguration={

[0114] If Risk≤75: "Low Risk".

[0115] If Risk > 75: "Risk Warning".

[0116] If Risk>85: "Force interception, execute the trigger strategy chain".

[0117] Defult: eventfiter[event1,event2,event3....]}

[0118] Please see Figure 2 Based on the same inventive concept, this application also provides a real-time monitoring device 10 for abnormal user behavior at an IPTV EPG box, comprising:

[0119] The data acquisition unit 11 is used to acquire user behavior data from the EPG box, including user behavior logs, system reverse proxy logs, exchange interface logs, and payment interface logs.

[0120] The data processing unit 12 is used to clean and preprocess user behavior data.

[0121] The behavior monitoring unit 13 is used to input the preprocessed user behavior data into the real-time monitoring model of abnormal user behavior deployed in the private IPTV environment, obtain the monitoring results and output them.

[0122] In this embodiment, the real-time monitoring device 10 for abnormal user behavior further includes a risk warning unit, which is used to make a judgment after the behavior monitoring unit 13 obtains the monitoring results:

[0123] If the monitoring result is Class I, the next round of monitoring will be conducted. Class I results indicate that the possibility of abnormal behavior risk from users on the EPG box side is low.

[0124] If the monitoring result is Category II, a risk warning will be issued. Category II results indicate that users on the EPG box may have abnormal behavior risks.

[0125] If the monitoring result is Category III, the system will forcibly block the device. Category III results indicate that the user on the EPG box has a risk of abnormal behavior.

[0126] This application embodiment also provides a storage medium, which is disposed in a server. The storage medium includes a stored program, wherein when the program is running, it controls the server where the storage medium is located to execute the real-time monitoring method for abnormal user behavior at the IPTV EPG box terminal in this embodiment.

[0127] This application embodiment also provides a server, including a memory and a processor. The memory is used to store information including program instructions, and the processor is used to control the execution of the program instructions. When the program instructions are loaded and executed by the processor, the real-time monitoring method for abnormal user behavior at the IPTV EPG box terminal in this embodiment is implemented.

[0128] In summary, this application provides a method for real-time monitoring of abnormal user behavior on an IPTV EPG box:

[0129] 1. A real-time monitoring model for abnormal user behavior, privately deployed in an IPTV environment, utilizes user behavior data from the EPG box (user behavior logs, system reverse proxy logs, redemption interface logs, and payment interface logs). After cleaning and preprocessing, this data is input into the model to obtain and output monitoring results. AI algorithms are used to perform deep learning on the set-top box user behavior, system reverse proxy logs, and logs collected from the redemption and payment interfaces to build a model. This model can intelligently analyze and detect abnormal user behavior on the IPTV box, using fewer server resources and allowing for private deployment in an IPTV environment, significantly reducing costs. It enables real-time monitoring of abnormal user behavior on the EPG box (e.g., unauthorized redemption of promotional gifts, malicious overspending of playback time, fraudulent claims of membership benefits, and malicious forgery of user orders), allowing for timely detection, interception, or blocking to prevent losses. Compared to traditional solutions deploying big data systems or risk control systems, this significantly reduces costs and achieves superior real-time monitoring results for abnormal user behavior.

[0130] 2. A deep learning model framework was built using the TensorFlow module, consisting of four sub-models (user behavior sub-model, reverse proxy sub-model, exchange behavior sub-model, and payment behavior sub-model). Each sub-model was constructed using a multilayer perceptron or convolutional neural network as its framework, with mean squared error (MSE) as the loss function. These four sub-models were then merged into a single deep learning model framework. Training, testing, and validation sets were determined using training data (historical user behavior logs, historical system reverse proxy logs, historical exchange interface logs, and historical payment interface logs). These sets were imported into the TensorFlow module. The model was trained using the training and testing sets, and validated using the validation set. Finally, the validated model was trained with anomaly behavior weighting to obtain a real-time user anomaly behavior monitoring model. This approach enables the real-time user anomaly behavior monitoring model to dynamically and accurately monitor user anomaly behavior in real-time using limited data (user behavior logs, system reverse proxy logs, exchange interface logs, and payment interface logs), ensuring effective real-time monitoring and preventing data loss.

[0131] In this document, relational terms such as first and second are used only to distinguish one entity or operation from another entity or operation, without necessarily requiring or implying any such actual relationship or order between these entities or operations.

[0132] The above description is merely an embodiment of this application and is not intended to limit the scope of protection of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of protection of this application.

Claims

1. A method for real-time monitoring of abnormal user behavior at an IPTV EPG box, characterized in that, include: Obtain user behavior data from the EPG box, including user behavior logs, system reverse proxy logs, redemption interface logs, and payment interface logs. Clean and preprocess user behavior data; The preprocessed user behavior data is input into a real-time monitoring model for abnormal user behavior deployed in a private IPTV environment to obtain and output the monitoring results. The construction process of the real-time monitoring model for abnormal user behavior is as follows: Use the TensorFlow module to build a deep learning model framework; Acquire training data, which includes historical user behavior logs, historical system reverse proxy logs, historical exchange interface logs, and historical payment interface logs. The training set, test set, and validation set are determined based on the training data; Import the training set, test set, and validation set into the TensorFlow module. Use the training set and test set to train the model, and use the validation set to validate the trained model. Obtain abnormal behavior data, and use the abnormal behavior data to train the validated model with abnormal behavior weighting to obtain a real-time monitoring model for abnormal user behavior. This includes using TensorFlow modules to build a deep learning model framework, including: Use TensorFlow modules to build 4 sub-models: A multilayer perceptron or convolutional neural network is used as the framework for each sub-model. The four sub-models are user behavior sub-model, reverse proxy sub-model, exchange behavior sub-model and payment behavior sub-model. Mean squared error was chosen as the loss function for each sub-model; The four sub-models are merged into a deep learning model framework.

2. The method for real-time monitoring of abnormal user behavior at the IPTV EPG box terminal according to claim 1, characterized in that, Based on the training data, the training set, test set, and validation set are determined, including: Clean and preprocess the training data; The processed historical user behavior logs are divided into user behavior training set, user behavior test set, and user behavior verification set. The processed historical system reverse proxy logs are divided into a reverse proxy training set, a reverse proxy test set, and a reverse proxy validation set. The processed historical redemption interface logs are divided into a redemption behavior training set, a redemption behavior test set, and a redemption behavior verification set. The processed historical payment interface logs are divided into a payment behavior training set, a payment behavior test set, and a payment behavior verification set.

3. The method for real-time monitoring of abnormal user behavior at the IPTV EPG box terminal according to claim 2, characterized in that, Import the training, test, and validation sets into the TensorFlow module. Train the model using the training and test sets, and validate the trained model using the validation set. This includes: The user behavior sub-model is trained using the user behavior training set, tested using the user behavior test set, and validated using the user behavior validation set. The reverse proxy sub-model is trained using the reverse proxy training set, tested using the reverse proxy test set, and validated using the reverse proxy validation set. The exchange behavior sub-model is trained using the exchange behavior training set, tested using the exchange behavior test set, and validated using the exchange behavior validation set. The payment behavior sub-model is trained using the payment behavior training set, tested using the payment behavior test set, and validated using the payment behavior validation set.

4. The method for real-time monitoring of abnormal user behavior at the IPTV EPG box terminal according to claim 1, characterized in that, Acquire abnormal behavior data and use this data to train the validated model using weighted abnormal behavior training, including: Obtain abnormal behavior data, which includes Category I abnormal behavior data such as abnormally claiming event gifts, Category II abnormal behavior data such as users maliciously increasing playback time, and Category III abnormal behavior data such as users fraudulently claiming membership benefits. Import the anomalous behavior data of type I, type II, and type III into the tensorflow module respectively; The validated model was trained using aberrant behavior weighting data from types I, II, and III.

5. The method for real-time monitoring of abnormal user behavior at the IPTV EPG box terminal according to claim 1, characterized in that, After obtaining the monitoring results, the method further includes: If the monitoring result is Class I, the next round of monitoring will be conducted. Class I results indicate that the possibility of abnormal behavior risk from users on the EPG box is low. If the monitoring result is a Class II result, a risk warning will be issued. A Class II result indicates that the user on the EPG box may have abnormal behavior risks. If the monitoring result is Category III, the system will forcibly block the device. Category III results indicate that the user on the EPG box has a risk of abnormal behavior.

6. A real-time monitoring device for abnormal user behavior at an IPTV EPG box, characterized in that, include: The data acquisition unit is used to acquire user behavior data from the EPG box, including user behavior logs, system reverse proxy logs, redemption interface logs, and payment interface logs. The data processing unit is used to clean and preprocess user behavior data; The behavior monitoring unit is used to input preprocessed user behavior data into a real-time monitoring model for abnormal user behavior deployed in a private IPTV environment, obtain monitoring results, and output them. The construction process of the real-time monitoring model for abnormal user behavior is as follows: Use the TensorFlow module to build a deep learning model framework; Acquire training data, which includes historical user behavior logs, historical system reverse proxy logs, historical exchange interface logs, and historical payment interface logs. The training set, test set, and validation set are determined based on the training data; Import the training set, test set, and validation set into the TensorFlow module. Use the training set and test set to train the model, and use the validation set to validate the trained model. Obtain abnormal behavior data, and use the abnormal behavior data to train the validated model with abnormal behavior weighting to obtain a real-time monitoring model for abnormal user behavior. This includes using TensorFlow modules to build a deep learning model framework, including: Use TensorFlow modules to build 4 sub-models: A multilayer perceptron or convolutional neural network is used as the framework for each sub-model. The four sub-models are user behavior sub-model, reverse proxy sub-model, exchange behavior sub-model and payment behavior sub-model. Mean squared error was chosen as the loss function for each sub-model; The four sub-models are merged into a deep learning model framework.

7. A storage medium, characterized in that, The storage medium is located within a server, and the storage medium includes a stored program, wherein, when the program is running, it controls the server where the storage medium is located to execute the real-time monitoring method for abnormal user behavior at the IPTV EPG box terminal as described in any one of claims 1 to 5.

8. A server, characterized in that, The device includes a memory and a processor. The memory is used to store information including program instructions, and the processor is used to control the execution of the program instructions. When the program instructions are loaded and executed by the processor, they implement the real-time monitoring method for abnormal user behavior at the IPTV EPG box terminal as described in any one of claims 1 to 5.

Images