B+ tree-based triggered sliding window traffic anomaly monitoring method, device and equipment

Abstract

The application discloses a B+ tree-based triggered sliding window traffic anomaly monitoring method to solve the problems of large calculation, high calculation resource consumption and large calculation delay in related art monitoring, and cannot meet real-time support requirements. The method comprises the following steps: obtaining full-volume call behavior events to be monitored; screening target call behavior events suspected to be abnormal from the full-volume call behavior events through a pre-constructed left B+ tree; wherein the left B+ tree records information capable of representing whether the call behavior events are abnormal; triggering the pre-constructed right B+ tree to monitor the call behavior events of target user numbers contained in the target call behavior events; and the right B+ tree records identification information of each user number and event information of the call behavior events of each user number. The application also discloses a B+ tree-based triggered sliding window traffic anomaly monitoring device, an electronic device and a computer readable storage medium.

Description

Technical Field

[0001] The present application relates to the technical field of abnormal traffic event monitoring, and in particular to a B+ tree-based triggered sliding window traffic abnormality monitoring method, device and equipment. Background Art

[0002] In order to ensure the normal operation of call center services, it is usually necessary to continuously monitor call behavior events that may occur for a period of time so that when abnormal call behavior is detected, timely processing can be carried out. However, in actual applications, since it is unknown when the abnormality will occur, when monitoring call behavior events, it is usually necessary to first collect and store the full amount of call behavior events at each time point in the monitoring period, and then set a scheduled task according to the monitoring interval to perform real-time sliding window monitoring of the full amount of call behavior events, where the full amount of call behavior events at each time point refers to the call behavior events in the time period starting at that time point and ending at the historical time point t, and the interval between the historical time point t and the current time point is equal to the monitoring period.

[0003] For example, Figure 1 As shown, taking a monitoring period of 5 minutes and a monitoring interval of 1 minute as an example, if you want to monitor the call event behavior in the time period t1 to t3, you need to first collect and store the full amount of call behavior events at each time point (for example, t1, t2, t3) in the monitored time period, that is, collect and store the full amount of call behavior events in the T1, T2 and T3 monitoring periods respectively, and then use every 1 minute as the monitoring interval, slide the window forward for 5 minutes, and use the computing power of the database to calculate the call behavior events within these 5 minutes.

[0004] When using the methods provided by relevant technologies, the need to monitor all call behavior events within the monitoring period in real time results in a large amount of calculation and easily consumes more computing resources. In addition, due to the limited computing power of the database and the large amount of calculation, there may be a problem of large computing delay, which makes it difficult to meet real-time support needs. Summary of the Invention

[0005] The embodiment of the present application provides a B+ tree-based triggered sliding window traffic anomaly monitoring method to solve the problem that the relevant monitoring technologies have large computational complexity, easily consume a lot of computing resources, and have large computational delays that make it difficult to meet real-time support needs.

[0006] The embodiments of the present application also provide a B+ tree-based triggered sliding window traffic anomaly monitoring device, an electronic device, and a computer-readable storage medium.

[0007] The embodiments of this application adopt the following technical solutions:

[0008] A B+ tree-based triggered sliding window traffic anomaly monitoring method, comprising:

[0009] Obtaining full-volume call behavior events to be monitored;

[0010] According to the full-volume call behavior events, the target call behavior events suspected of being abnormal are screened out through a pre-constructed left B+ tree; wherein the left B+ tree records information capable of representing whether the call behavior events are abnormal;

[0011] Triggering a pre-constructed right B+ tree to monitor the call behavior events of the target user number contained in the target call behavior events; the right B+ tree records the identification information of each user number and the event information of the call behavior events of each user number.

[0012] Optionally, the information capable of representing whether the call behavior events are abnormal recorded in the left B+ tree includes the calling user number, the called user number and the calling call times of the call behavior events.

[0013] Optionally, according to the full-volume call behavior events, the target call behavior events suspected of being abnormal are screened out through a pre-constructed left B+ tree, comprising:

[0014] According to the full-volume call behavior events, the first calling user number, the first called user number and the first calling call times of the full-volume call behavior events are determined through a pre-constructed left B+ tree;

[0015] According to the first calling user number, the first called user number and the first calling call times, the number of the called user numbers of the first calling user number and the call behavior events with the first calling call times greater than a preset monitoring threshold are screened out as the target call behavior events suspected of being abnormal.

[0016] Optionally, before triggering the pre-constructed right B+ tree to monitor the call behavior events of the target user number contained in the target call behavior events, the method further comprises:

[0017] According to the target user number contained in the target call behavior events, a pre-constructed right B+ tree is searched to determine whether the right B+ tree contains the call behavior events matching the target user number;

[0018] If not, a leaf node with the target user number as the key and the called user number and the calling call times of the target user number as the key values is inserted into the left B+ tree.

[0019] Optionally, the pre-constructed right B+ tree is triggered to monitor the call behavior events of the target user number contained in the target call behavior events, and the right B+ tree is used to monitor the call behavior events, comprising:

[0020] determining a target user number contained in the target call behavior event;

[0021] determining a second called user number and a second calling number of the target user number according to the event information of the call behavior event of the target user number and the user number recorded in the right B+ tree;

[0022] triggering the right B+ tree to monitor the call behavior event of the target user number contained in the target call behavior event when the second called user number and the second calling number are greater than a preset monitoring threshold.

[0023] Optionally, triggering the right B+ tree to monitor the call behavior event of the target user number contained in the target call behavior event when the second called user number and the second calling number are greater than a preset monitoring threshold, comprises:

[0024] constructing a leaf node of the right B+ tree with the target user number as a key and the second called user number and the second calling number as key values;

[0025] storing the information of the call behavior event matching the target user number recorded in the left B+ tree into the leaf node of the right B+ tree;

[0026] triggering the right B+ tree to monitor the call behavior event of the target user number contained in the target call behavior event.

[0027] Optionally, the method further comprises:

[0028] if the second called user number and the second calling number of the target user number are less than or equal to the preset monitoring threshold, emptying the information matching the target user number recorded in the left B+ tree;

[0029] outputting the call behavior event information of the target user number through the right B+ tree and emptying the call behavior event information in the right B+ tree to end the monitoring.

[0030] Optionally, before the target call behavior event suspected to be abnormal is filtered out from the full-amount call behavior event through the left B+ tree constructed in advance, the method further comprises:

[0031] obtaining the call behavior event of the user number to determine a calling user number, a called user number, a calling number, a cell where the user is located and a call duration;

[0032] constructing the left B+ tree with the calling user number as a key and the called user number and the calling number as key values of the leaf node;

[0033] constructing the right B+ tree with the calling user number as a key and the calling user number, the called user number, the calling number, the cell where the user is located and the call duration as key values of the leaf node.

[0034] A B+ tree-based triggered sliding window traffic anomaly monitoring device, comprising an acquisition module, a screening module and a triggering module, wherein:

[0035] The acquisition module is configured to acquire full-volume call behavior events to be monitored.

[0036] The screening module is configured to screen out target call behavior events suspected of being abnormal from the full-volume call behavior events by using a pre-constructed left B+ tree, wherein the left B+ tree records information capable of representing whether a call behavior event is abnormal.

[0037] The triggering module is configured to trigger a pre-constructed right B+ tree to monitor call behavior events of a target user number contained in the target call behavior events, wherein the right B+ tree records identification information of each user number and event information of call behavior events of each user number.

[0038] Optionally, the information capable of representing whether a call behavior event is abnormal recorded in the left B+ tree comprises a calling user number, a called user number and a calling call number of the call behavior event.

[0039] Optionally, the screening module is configured to:

[0040] determine a first calling user number, a first called user number and a first calling call number of the full-volume call behavior events by using the pre-constructed left B+ tree according to the full-volume call behavior events.

[0041] screen out a number of called user numbers of the first calling user number and call behavior events with a first calling call number greater than a preset monitoring threshold as target call behavior events suspected of being abnormal according to the first calling user number, the first called user number and the first calling call number.

[0042] Optionally, the B+ tree-based triggered sliding window traffic anomaly monitoring device is further configured to:

[0043] find, by using the pre-constructed right B+ tree, whether the right B+ tree contains call behavior events matching a target user number contained in the target call behavior events.

[0044] If not, insert a leaf node with the target user number as a key and called user numbers and calling call numbers of the target user number as key values into the left B+ tree.

[0045] Optionally, the triggering module is configured to:

[0046] determine a target user number contained in the target call behavior events.

[0047] determining a second called user number and a second calling number of the target user number according to the target user number and the event information of the call behavior event of the user number recorded in the right B+ tree;

[0048] triggering the right B+ tree to monitor the call behavior event of the target user number contained in the target call behavior event when the second called user number and the second calling number are greater than a preset monitoring threshold.

[0049] Optionally, when the second called user number and the second calling number are greater than the preset monitoring threshold, the triggering module is configured to:

[0050] constructing a leaf node of the right B+ tree with the target user number as a keyword and the second called user number and the second calling number as key values;

[0051] storing the information of the call behavior event matching the target user number recorded in the left B+ tree into the leaf node of the right B+ tree;

[0052] triggering the right B+ tree to monitor the call behavior event of the target user number contained in the target call behavior event.

[0053] Optionally, the B+ tree-based triggered sliding window traffic anomaly monitoring device is further configured to:

[0054] if the second called user number and the second calling number of the target user number are less than or equal to the preset monitoring threshold, emptying the information matching the target user number recorded in the left B+ tree;

[0055] outputting the call behavior event information of the target user number through the right B+ tree, emptying the call behavior event information in the right B+ tree, and ending the monitoring.

[0056] Optionally, the B+ tree-based triggered sliding window traffic anomaly monitoring device is further configured to:

[0057] obtaining the call behavior event of the user number to determine a calling user number, a called user number, a calling number, a cell where the user is located, and a call duration;

[0058] constructing a left B+ tree with the calling user number as a keyword and the called user number and the calling number as key values of a leaf node;

[0059] constructing a right B+ tree with the calling user number as a keyword and the calling user number, the called user number, the calling number, the cell where the user is located, and the call duration as key values of a leaf node.

[0060] An electronic device comprises a memory, a processor, and a computer program stored on the memory and executable on the processor, which, when executed by the processor, implements the steps of the B+ tree-based triggered sliding window traffic anomaly monitoring method as described above.

[0061] A computer readable storage medium, characterized in that the computer readable storage medium stores a computer program, which, when executed by a processor, implements the steps of the B+ tree-based triggered sliding window traffic anomaly monitoring method as described above.

[0062] The above at least one technical solution adopted by the embodiments of the present application can achieve the following beneficial effects:

[0063] By using the method provided by the embodiments of the present application, the target call behavior event suspected of being abnormal can be filtered out from the full-amount call behavior event through the pre-constructed left B+ tree, and then the pre-constructed right B+ tree is triggered to monitor the call behavior event of the target user number contained in the target call behavior event, so that only the target call behavior event suspected of being abnormal needs to be monitored, thereby avoiding the problem of large amount of calculation and easy consumption of a large amount of computing resources caused by the real-time monitoring of the full-amount call behavior event in the related art. On the other hand, the computing amount is small, so the computing delay can be reduced. BRIEF DESCRIPTION OF DRAWINGS

[0064] The accompanying drawings, which are included to provide a further understanding of the present application, constitute a part of the present application and illustrate the illustrative embodiments of the present application and their description serve to explain the present application, and do not constitute improper limitations on the present application. In the drawings:

[0065] Figure 1 An implementation flowchart of a real-time sliding window monitoring method for full-amount call behavior events provided in the related art;

[0066] Figure 2 An implementation flowchart of a B+ tree-based triggered sliding window traffic anomaly monitoring method provided by the embodiments of the present application;

[0067] Figure 3 An implementation flowchart of a method for filtering out a target call behavior event suspected of being abnormal through a pre-constructed left B+ tree provided by the embodiments of the present application;

[0068] Figure 4 A specific structure diagram of a B+ tree-based triggered sliding window traffic anomaly monitoring device provided by the embodiments of the present application;

[0069] Figure 5 A structure diagram of an electronic device provided by the embodiments of the present application. DETAILED DESCRIPTION

[0070] In order to make the objects, technical solutions and advantages of the present application clearer, the following will clearly and completely describe the technical solutions of the present application with reference to the specific embodiments and corresponding drawings. Obviously, the described embodiments are only a part of the embodiments of the present application, but not all the embodiments. Based on the embodiments in the present application, all the other embodiments obtained by a person of ordinary skill in the art without creative work fall within the protection scope of the present application.

[0071] The technical solutions provided by the embodiments of the present application are described in detail below with reference to the drawings.

[0072] Embodiment 1

[0073] In order to solve the problem that the calculation amount is large, the calculation resource is easily consumed and the calculation delay is large when the related technology is used for monitoring, and the real-time support demand cannot be met, the present embodiment provides a B+ tree-based triggered sliding window traffic anomaly monitoring method.

[0074] The execution subject of the method can be various types of computing devices, or can be an application program or application (APP) installed on a computing device. The computing device can be, for example, a user terminal such as a mobile phone, a tablet computer, a smart wearable device, etc., or a server, etc.

[0075] For ease of description, the present embodiment takes the execution subject of the method as a server as an example to introduce the method. It can be understood by those skilled in the art that the present embodiment takes the server as an example to introduce the method, which is only an exemplary description, and does not limit the protection scope of the corresponding claims of the present solution.

[0076] Specifically, the implementation process of the method provided by the present embodiment is as shown in Figure 2 The method includes the following steps:

[0077] Step 21, obtaining full-volume call behavior events to be monitored.

[0078] The full-volume call behavior events to be monitored can be understood as all call behavior events in a to-be-monitored time period; wherein the full-volume call behavior events can include event information such as calling user number callingnum, called user number callednum, call duration callduration, calling / called user cell LacCi, start time STime of the call behavior event, process type EventId, and calling number calling_cnt.

[0079] For example, it is assumed that the present embodiment needs to monitor the call behavior events in the time period of t A ~tB The call behavior events in the time period are monitored, and then the t A ~t B All call behavior events occurring in the time period.

[0080] In step 22, according to the full-quantity call behavior events, the target call behavior events suspected of being abnormal are screened out through the pre-constructed left B+ tree; wherein, the left B+ tree records information capable of representing whether the call behavior event is abnormal.

[0081] The information capable of representing whether the call behavior event is abnormal recorded in the left B+ tree can include the calling user number, the called user number, and the calling call times.

[0082] In the embodiment of the present application, before the target call behavior events suspected of being abnormal are screened out through the pre-constructed left B+ tree according to the full-quantity call behavior events, the call behavior events of the user number can be acquired to determine the calling user number, the called user number, the calling call times, the cell where the user is located, and the call duration; then, the left B+ tree is constructed with the calling user number as the key, and the called user number and the calling call times as the key values of the leaf nodes; and the right B+ tree is constructed with the calling user number as the key, and the calling user number, the called user number, the calling call times, the cell where the user is located, and the call duration as the key values of the leaf nodes.

[0083] For example, assuming that the calling user number is callingnum, the called user number is callednum, the calling call times is calling_cnt, the cell where the user is located is LacCi, and the call duration is callduration in actual application, the left B+ tree with callingnum as the key can be constructed, and the value of the leaf of the left B+ tree is {callednum, calling_cnt}. And the right B+ tree with callingnum as the key is constructed, and the value stored in the leaf of the right B+ tree is {LacCi, callednum, calling_cnt, callduration}.

[0084] After the left B+ tree and the right B+ tree are constructed according to the above method, the target call behavior events suspected of being abnormal can be screened out through the pre-constructed left B+ tree according to the full-quantity call behavior events. As shown in Figure 3 In the embodiment of the present application, the target call behavior events suspected of being abnormal can be screened out through the pre-constructed left B+ tree according to the full-quantity call behavior events according to the following implementation steps:

[0085] Step 31, according to the full-amount call behavior event, determining the first caller number, the first called number and the first calling times of the full-amount call behavior event through the pre-constructed left B+ tree.

[0086] The first caller number refers to the user number of the user who initiates the call in the full-amount call behavior event. Correspondingly, the first calling times refer to the total calling times of the first caller number in the full-amount call behavior event. The first called number refers to the user number of the user who receives the call in the full-amount call behavior event.

[0087] Step 32, according to the first caller number, the first called number and the first calling times, screening out the number of called numbers of the first caller number and the call behavior events whose first calling times are greater than the preset monitoring threshold, as the target call behavior events of suspected abnormality.

[0088] In the embodiment of the application, whether the user number is abnormal can be determined according to the number of called numbers of the caller number and the calling times, and then the call behavior event of the caller number is determined as the suspected abnormal call behavior event.

[0089] Specifically, the ratio between the number of called numbers of the caller number and the sum of calling times can be compared with the preset monitoring threshold, and then the call behavior event of the caller number is determined as the suspected abnormal call behavior event.

[0090] If the ratio is greater than the preset monitoring threshold, the call behavior event of the caller number is considered as the suspected abnormal call behavior event. Otherwise, if the ratio is less than or equal to the preset monitoring threshold, the call behavior event of the caller number is not considered as the suspected abnormal call behavior event.

[0091] In actual application, for example, assuming that the number of called numbers of a caller number Callingnum is callednum_sum, the calling times of the caller number Callingnum is calling_cnt, the sum of calling times of the caller number Callingnum is calling_cnt_sum, and the preset monitoring threshold is Mf, the ratio between callednum_sum and calling_cnt_sum can be calculated first, and then the ratio and the preset monitoring threshold Mf are compared.

[0092] Step 23, triggering the pre-constructed right B+ tree to monitor the call behavior event of the target user number contained in the target call behavior event. The right B+ tree records the identification information of each user number and the event information of the call behavior event of each user number.

[0093] After the step 22 is performed to screen out the suspected abnormal target call behavior event through the left B+ tree, the pre-constructed right B+ tree can be triggered to monitor the call behavior event of the target user number contained in the target call behavior event.

[0094] In one embodiment, before the pre-constructed right B+ tree is triggered to monitor the call behavior event of the target user number contained in the target call behavior event, the pre-constructed right B+ tree can be searched according to the target user number contained in the target call behavior event to determine whether the right B+ tree contains a call behavior event matching the target user number; if not, a leaf node with the target user number as the key and the called user number and the calling number of the target user number as the key value is inserted in the left B+ tree.

[0095] In the embodiments of the present application, triggering the pre-constructed right B+ tree to monitor the call behavior event of the target user number contained in the target call behavior event can include the following steps: determining the target user number contained in the target call behavior event; determining the second called user number and the second calling number of the target user number according to the event information of the call behavior event of the user number recorded in the right B+ tree and the target user number; and triggering the right B+ tree to monitor the call behavior event of the target user number contained in the target call behavior event when the second called user number and the second calling number are greater than a preset monitoring threshold. The second called user number refers to the user number called by the target calling user number, in other words, the user number called by the target calling user; and the second calling number refers to the calling number of the target calling user number.

[0096] Specifically, when the second called user number and the second calling number are greater than the preset monitoring threshold, the leaf node of the right B+ tree can be constructed with the target user number as the key and the second called user number and the second calling number as the key value; the information of the call behavior event matching the target user number recorded in the left B+ tree can be stored in the leaf node of the right B+ tree; and the right B+ tree is triggered to monitor the call behavior event of the target user number contained in the target call behavior event.

[0097] Alternatively, if the second called user number and the second calling number of the target user number are less than or equal to the preset monitoring threshold, the information matching the target user number recorded in the left B+ tree can be emptied; then the call behavior event information of the target user number is output through the right B+ tree, the call behavior event information in the right B+ tree is emptied, and the monitoring is ended.

[0098] By adopting the method provided in the embodiments of the present application, the target call behavior event suspected of being abnormal can be filtered from the full call behavior event through the pre-constructed left B+ tree, and then the pre-constructed right B+ tree is triggered to monitor the call behavior event of the target user number contained in the target call behavior event, so that only the target call behavior event suspected of being abnormal needs to be monitored, thereby the problem that the calculation amount is large and a large amount of computing resources are easily consumed due to the real-time monitoring of the full call behavior event in the related art can be avoided; on the other hand, the calculation amount is small, so that the calculation delay can be reduced.

[0099] Embodiment 2

[0100] The following describes how the method provided in the embodiments of the present application is applied in practice in combination with an actual scenario.

[0101] Firstly, a left B+ tree with callingnum as the key can be established, and the value of the leaf of the left B+ tree is {callednum, calling_cnt}; and a right B+ tree with callingnum as the key can be established, and the value stored in the leaf of the right B+ tree is {LacCi, callednum, calling_cnt, callduration}.

[0102] Then, the file identification bit of the left B+ tree cleaning is initialized; wherein the file identification bit of the cleaning is used to indicate whether the call behavior event is a record in a preset time period (for example, within 1 minute) to control the separate processing of the file in the preset time period.

[0103] When the value of the file identification bit of the left B+ tree cleaning becomes 1, that is, the call behavior event in the preset time period is processed, the right B+ tree can be searched according to the calling user number Callingnum to determine whether there is a node with Callingnum as the key in the right B+ tree.

[0104] Case one: if there is a node with Callingnum as the key in the right B+ tree, then the calling user number can be accumulated and counted on the corresponding value={LacCi, callednum, calling_cnt} in the right B+ tree according to Callingnum.

[0105] Case two: if there is no node with Callingnum as the key in the right B+ tree, then a leaf node with Value={callednum, calling_cnt} can be constructed in the left B+ tree with Callingnum as the key.

[0106] After a preset time period, the callednum quantity of the Callingnum can be viewed and recorded as callednum_sum; and the sum of calling_cnt is determined and recorded as calling_cnt_sum. The following two cases are processed respectively:

[0107] When callednum_sum / calling_cnt_sum>Mf: the Callingnum is taken as the key of the right B+ tree, the right B+ tree with value {LacCi, callednum, calling_cnt} is constructed, the {Callingnum, Callednum, calling_cnt} of the left B+ tree is moved to the tree with Callingnum as the key of the right B+ tree, and a monitoring period with ATime is started. ATime represents the monitoring accumulated time length, which can be temporarily set as 5 minutes in the present application.

[0108] When callednum_sum / calling_cnt_sum<=Mf: the node of the Callingnum in the left B+ tree is emptied. When the monitoring time length of the monitoring node in the right B+ tree reaches ATime, {Callingnum, LacCi, callednum, calling_cnt, callduration} is outputted, and then the node information of the Callingnum in the right B+ tree is emptied and the monitoring is ended.

[0109] By using the method provided in the embodiments of the present application, the left B+ tree constructed in advance can be used to filter the target call behavior event suspected to be abnormal from the full-amount call behavior event, and then the right B+ tree constructed in advance is triggered to monitor the call behavior event of the target user number contained in the target call behavior event. In this way, only the target call behavior event suspected to be abnormal needs to be monitored, so that the problem that the calculation amount is large and the computing resources are easily consumed due to the real-time monitoring of the full-amount call behavior event in the related art can be avoided. On the other hand, the calculation amount is small, so that the calculation time delay can be reduced.

[0110] Embodiment 3

[0111] To solve the problems that the calculation amount is large, the computing resources are easily consumed, and the calculation time delay is large and difficult to meet the real-time support demand in the related art, the embodiment of the present application provides a B+ tree-based triggered sliding window traffic anomaly monitoring device 40. The specific structure diagram of the device is shown in Figure 4 The device includes an acquisition module 41, a screening module 42, and a triggering module 43. The functions of the modules are as follows:

[0112] The acquisition module 41 is configured to acquire full-volume call behavior events to be monitored.

[0113] The screening module 42 is configured to screen out target call behavior events suspected to be abnormal from the full-volume call behavior events by using a pre-constructed left B+ tree, wherein the left B+ tree records information capable of representing whether a call behavior event is abnormal.

[0114] The triggering module 43 is configured to trigger a pre-constructed right B+ tree to monitor call behavior events of a target user number contained in the target call behavior event, wherein the right B+ tree records identification information of each user number and event information of call behavior events of each user number.

[0115] Optionally, the information capable of representing whether a call behavior event is abnormal recorded in the left B+ tree includes a calling user number, a called user number and a calling call number of the call behavior event.

[0116] Optionally, the screening module 42 is configured to:

[0117] determine, according to the full-volume call behavior events, a first calling user number, a first called user number and a first calling call number of the full-volume call behavior events by using the pre-constructed left B+ tree;

[0118] screen out, according to the first calling user number, the first called user number and the first calling call number, a number of called user numbers of the first calling user number and a call behavior event with a first calling call number greater than a preset monitoring threshold, as the target call behavior events suspected to be abnormal.

[0119] Optionally, the B+ tree-based triggered sliding window traffic anomaly monitoring apparatus is further configured to:

[0120] perform a search on the right B+ tree according to a target user number contained in the target call behavior event, to determine whether the right B+ tree contains a call behavior event matching the target user number;

[0121] if not, insert a leaf node with the target user number as a key and called user numbers and calling call numbers of the target user number as key values into the left B+ tree.

[0122] Optionally, the triggering module 43 is configured to:

[0123] determine a target user number contained in the target call behavior event;

[0124] determine, according to the target user number and event information of call behavior events of user numbers recorded in the right B+ tree, a second called user number and a second calling call number of the target user number;

[0125] When the second called user number and the second calling number are greater than the preset monitoring threshold, the right B+ tree is triggered to monitor the call behavior event of the target user number contained in the target call behavior event.

[0126] Optionally, when the second called user number and the second calling number are greater than the preset monitoring threshold, the triggering module 43 is configured to:

[0127] The leaf node of the right B+ tree is constructed with the target user number as the keyword and the second called user number and the second calling number as the key value.

[0128] The information of the call behavior event matching the target user number recorded in the left B+ tree is stored in the leaf node of the right B+ tree.

[0129] The right B+ tree is triggered to monitor the call behavior event of the target user number contained in the target call behavior event.

[0130] Optionally, the B+ tree-based triggered sliding window traffic anomaly monitoring device is further configured to:

[0131] If the second called user number and the second calling number of the target user number are less than or equal to the preset monitoring threshold, the information matching the target user number recorded in the left B+ tree is emptied.

[0132] The call behavior event information of the target user number is output through the right B+ tree, and the call behavior event information is emptied in the right B+ tree, and the monitoring is ended.

[0133] Optionally, the B+ tree-based triggered sliding window traffic anomaly monitoring device is further configured to:

[0134] The call behavior event of the user number is obtained to determine the calling user number, the called user number, the calling number, the cell where the user is located, and the call duration.

[0135] The left B+ tree is constructed with the calling user number as the keyword and the called user number and the calling number as the key value of the leaf node.

[0136] The right B+ tree is constructed with the calling user number as the keyword and the calling user number, the called user number, the calling number, the cell where the user is located, and the call duration as the key value of the leaf node.

[0137] The device provided in the embodiment of the present application can filter out the target call behavior event suspected of being abnormal from the full amount of call behavior events through the left B+ tree constructed in advance, and then trigger the right B+ tree constructed in advance to monitor the call behavior event of the target user number contained in the target call behavior event, so that only the target call behavior event suspected of being abnormal needs to be monitored, thereby avoiding the problem that the calculation amount is large and a large amount of computing resources are easily consumed due to the real-time monitoring of the full amount of call behavior events in the related art. On the other hand, the calculation amount is small, and thus the calculation delay can be reduced.

[0138] Embodiment 4

[0139] The embodiment of the present application relates to an electronic device, such as Figure 5 As shown in the figure. At the hardware level, the electronic device includes a processor, and optionally further includes an internal bus, a network interface, and a memory. The memory can include a memory, such as a high-speed random access memory (RAM), and can also include a non-volatile memory, such as at least one disk memory. Of course, the electronic device can also include other hardware required by the business.

[0140] The processor, the network interface, and the memory can be connected to each other through the internal bus, which can be an ISA (Industry Standard Architecture) bus, a PCI (Peripheral Component Interconnect) bus, or an EISA (Extended Industry Standard Architecture) bus, etc. The bus can be divided into an address bus, a data bus, a control bus, etc. For the convenience of representation, Figure 5 Only one bidirectional arrow is used, but it does not mean that there is only one bus or one type of bus.

[0141] The memory is used to store programs. Specifically, the program can include program code, and the program code includes computer operation instructions. The memory can include a memory and a non-volatile memory, and provides instructions and data to the processor.

[0142] The processor reads the corresponding computer program from the non-volatile memory into the memory and then runs, and forms a B+ tree-based triggered sliding window traffic anomaly monitoring device at the logical level. The processor executes the program stored in the memory, and is specifically used for the following operations:

[0143] Obtaining full amount of call behavior events to be monitored;

[0144] According to the full-quantity call behavior event, a suspected abnormal target call behavior event is screened out through a pre-constructed left B+ tree, wherein the left B+ tree records information capable of representing whether the call behavior event is abnormal.

[0145] A pre-constructed right B+ tree is triggered to monitor the call behavior event of the target user number contained in the target call behavior event, and the right B+ tree records the identification information of each user number and the event information of the call behavior event of each user number.

[0146] Optionally, the information capable of representing whether the call behavior event is abnormal recorded in the left B+ tree includes the calling user number, the called user number and the calling call times of the call behavior event.

[0147] Optionally, according to the full-quantity call behavior event, a suspected abnormal target call behavior event is screened out through a pre-constructed left B+ tree, comprising:

[0148] According to the full-quantity call behavior event, a first calling user number, a first called user number and a first calling call times of the full-quantity call behavior event are determined through a pre-constructed left B+ tree;

[0149] According to the first calling user number, the first called user number and the first calling call times, the number of called user numbers of the first calling user number and the call behavior event with the first calling call times greater than a preset monitoring threshold are screened out as the suspected abnormal target call behavior event.

[0150] Optionally, before triggering the pre-constructed right B+ tree to monitor the call behavior event of the target user number contained in the target call behavior event, the method further comprises:

[0151] According to the target user number contained in the target call behavior event, a pre-constructed right B+ tree is searched to determine whether the right B+ tree contains a call behavior event matching the target user number;

[0152] If not, a leaf node with the target user number as the key and the called user number and the calling call times of the target user number as the key value is inserted in the left B+ tree.

[0153] Optionally, the pre-constructed right B+ tree is triggered to monitor the call behavior event of the target user number contained in the target call behavior event, and the right B+ tree is used to monitor the call behavior event, comprising:

[0154] The target user number contained in the target call behavior event is determined;

[0155] determining a second called user number and a second calling number of the target user number according to the target user number and the event information of the call behavior event of the user number recorded in the right B+ tree;

[0156] triggering the right B+ tree to monitor the call behavior event of the target user number contained in the target call behavior event when the second called user number and the second calling number are greater than a preset monitoring threshold.

[0157] Optionally, triggering the right B+ tree to monitor the call behavior event of the target user number contained in the target call behavior event when the second called user number and the second calling number are greater than a preset monitoring threshold, comprises:

[0158] constructing a leaf node of the right B+ tree with the target user number as a keyword and the second called user number and the second calling number as key values;

[0159] storing the information of the call behavior event matching the target user number recorded in the left B+ tree into the leaf node of the right B+ tree;

[0160] triggering the right B+ tree to monitor the call behavior event of the target user number contained in the target call behavior event.

[0161] Optionally, the method further comprises:

[0162] if the second called user number and the second calling number of the target user number are less than or equal to the preset monitoring threshold, emptying the information matching the target user number recorded in the left B+ tree;

[0163] outputting the call behavior event information of the target user number through the right B+ tree and emptying the call behavior event information in the right B+ tree to end the monitoring.

[0164] Optionally, before the target call behavior event suspected to be abnormal is filtered out from the full-amount call behavior event through the left B+ tree constructed in advance, the method further comprises:

[0165] obtaining the call behavior event of the user number to determine a calling user number, a called user number, a calling number, a cell where the user is located and a call duration;

[0166] constructing the left B+ tree with the calling user number as a keyword and the called user number and the calling number as key values of the leaf node;

[0167] constructing the right B+ tree with the calling user number as a keyword and the calling user number, the called user number, the calling number, the cell where the user is located and the call duration as key values of the leaf node.

[0168] The B+ tree-based triggered sliding window traffic anomaly monitoring method provided in the specification can be applied to a processor or implemented by the processor. The processor can be an integrated circuit chip with signal processing capability. In the implementation process, each step of the method can be completed by integrated logic circuits of hardware in the processor or instructions in the form of software. The processor can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; or a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field-programmable gate array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components. Each method, step and logic block disclosed in the embodiments of the specification can be implemented or executed. The general-purpose processor can be a microprocessor or any conventional processor.

[0169] The steps of the method disclosed in the embodiments of the specification can be directly embodied as hardware code processing for execution, or executed by a combination of hardware and software modules in the code processing. The software module can be located in a random access memory, a flash memory, a read-only memory, a programmable read-only memory, an electrically erasable programmable memory, a register, or other mature storage media in the art. The storage medium is located in the memory, and the processor reads the information in the memory and combines the hardware to complete the steps of the method.

[0170] The embodiments of the specification also propose a computer-readable storage medium storing one or more programs, the one or more programs including instructions that, when executed by an electronic device including a plurality of applications, can cause the electronic device to execute a B+ tree-based triggered sliding window traffic anomaly monitoring method, and specifically for executing:

[0171] Obtaining full-volume call behavior events to be monitored;

[0172] According to the full-volume call behavior events, the target call behavior events suspected of being abnormal are filtered out through a pre-constructed left B+ tree; wherein the left B+ tree records information capable of representing whether the call behavior event is abnormal;

[0173] Triggering the pre-constructed right B+ tree to monitor the target call behavior event of the target user number contained in the target call behavior event, the right B+ tree recording the identification information of each user number and the event information of the call behavior event of each user number.

[0174] Optionally, the information recorded in the left B+ tree and capable of representing whether the call behavior event is abnormal includes the calling user number, the called user number and the calling call times of the call behavior event.

[0175] Optionally, according to the full-amount call behavior event, the target call behavior event suspected to be abnormal is screened out through the pre-constructed left B+ tree, including:

[0176] According to the full-amount call behavior event, the first calling user number, the first called user number and the first calling call times of the full-amount call behavior event are determined through the pre-constructed left B+ tree;

[0177] According to the first calling user number, the first called user number and the first calling call times, the number of the called user numbers of the first calling user number and the call behavior event with the first calling call times greater than a preset monitoring threshold are screened out as the target call behavior event suspected to be abnormal.

[0178] Optionally, before triggering the pre-constructed right B+ tree to monitor the target call behavior event of the target user number contained in the target call behavior event, the method further includes:

[0179] According to the target user number contained in the target call behavior event, the pre-constructed right B+ tree is searched to determine whether the right B+ tree contains the call behavior event matching the target user number;

[0180] If not, a leaf node with the target user number as the key and the called user number and the calling call times of the target user number as the key values is inserted into the left B+ tree.

[0181] Optionally, the pre-constructed right B+ tree is triggered to monitor the target call behavior event of the target user number contained in the target call behavior event, and the right B+ tree is used to monitor the call behavior event, including:

[0182] The target user number contained in the target call behavior event is determined;

[0183] According to the target user number and the event information of the call behavior event of the user number recorded in the right B+ tree, the second called user number and the second calling call times of the target user number are determined;

[0184] When the second called user number and the second calling number are greater than the preset monitoring threshold, the right B+ tree is triggered to monitor the call behavior event of the target user number contained in the target call behavior event.

[0185] Optionally, when the second called user number and the second calling number are greater than the preset monitoring threshold, the right B+ tree is triggered to monitor the call behavior event of the target user number contained in the target call behavior event, comprising:

[0186] The leaf node of the right B+ tree is constructed with the target user number as a keyword and the second called user number and the second calling number as key values.

[0187] The information of the call behavior event matching the target user number recorded in the left B+ tree is stored in the leaf node of the right B+ tree.

[0188] The right B+ tree is triggered to monitor the call behavior event of the target user number contained in the target call behavior event.

[0189] Optionally, the method further comprises:

[0190] If the second called user number and the second calling number of the target user number are less than or equal to the preset monitoring threshold, the information matching the target user number recorded in the left B+ tree is emptied.

[0191] The call behavior event information of the target user number is output through the right B+ tree, and the call behavior event information is emptied in the right B+ tree, and the monitoring is ended.

[0192] Optionally, before the suspected abnormal target call behavior event is filtered out from the full-amount call behavior event through the pre-constructed left B+ tree, the method further comprises:

[0193] The call behavior event of the user number is obtained to determine the calling user number, the called user number, the calling number, the cell where the user is located, and the call duration.

[0194] The left B+ tree is constructed with the calling user number as a keyword and the called user number and the calling number as key values of the leaf node.

[0195] The right B+ tree is constructed with the calling user number as a keyword and the calling user number, the called user number, the calling number, the cell where the user is located, and the call duration as key values of the leaf node.

[0196] The system, device, module or unit illustrated in the above embodiments can be specifically implemented by a computer chip or entity, or by a product with certain functions. A typical implementation device is a computer.

[0197] For the sake of description, the aforementioned apparatuses are described with various units in function to describe the embodiments. Of course, the units can be implemented by one or more software and / or hardware in the implementation of the specification.

[0198] Those skilled in the art should understand that the embodiments of the specification can be provided as a method, apparatus or computer program product. Therefore, the specification can take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment combining software and hardware aspects. Moreover, the specification can take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk memory, CD-ROM, optical memory, etc.) containing computer-usable program code.

[0199] These computer program instructions can also be stored in a computer-readable memory that can direct the computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer-readable memory produce a manufactured product including instruction apparatus, which implements the flow Figure 1 one or more flows and / or blocks Figure 1 one or more blocks or multiple blocks.

[0200] These computer program instructions can also be loaded into a computer or other programmable data processing device, so that a series of operation steps are performed on the computer or other programmable device to produce a computer-implemented process, so that the instructions executed on the computer or other programmable device provide steps for implementing the flow Figure 1 one or more flows and / or blocks Figure 1 one or more blocks or multiple blocks.

[0201] In a typical configuration, the computing device includes one or more processors (CPU), input / output interface, network interface and memory.

[0202] The memory can include non-permanent memory in the computer-readable medium, random access memory (RAM) and / or non-volatile memory such as read-only memory (ROM) or flash memory (flash RAM). The memory is an example of the computer-readable medium.

[0203] The computer-readable medium includes permanent and non-permanent, removable and non-removable media, which can be implemented by any method or technology to store information. The information can be computer-readable instructions, data structures, program modules or other data.

[0204] It is also to be noted that the terms "comprising", "including", and any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but can include other elements not expressly listed or inherent to such process, method, article, or apparatus. An element proceeded by "comprises a... " does not, without more constraints, exclude the existence of additional identical elements in the process, method, article, or apparatus that comprises the recited element.

[0205] The various embodiments described in this specification are presented as examples. Each example is provided by way of explanation of the overall subject matter and is not a limitation on the overall subject matter. Changes in, or replacements to, parts of certain examples are covered by this specification. The various embodiments described in this specification are presented as examples. Each example is provided by way of explanation of the overall subject matter and is not a limitation on the overall subject matter. Changes in, or replacements to, parts of certain examples are covered by this specification.

Claims

1. A B+ tree-based trigger-type sliding window traffic anomaly monitoring method, characterized in that: The method comprises the following steps: acquiring full-volume call behavior events to be monitored; screening out target call behavior events suspected to be abnormal from the full-volume call behavior events through a pre-constructed left B+ tree, wherein the left B+ tree records information capable of representing whether a call behavior event is abnormal; triggering the pre-constructed right B+ tree to monitor call behavior events of a target user number contained in the target call behavior events, wherein the right B+ tree records identification information of each user number and event information of the call behavior events of the each user number; the step of screening out target call behavior events suspected to be abnormal from the full-volume call behavior events through the pre-constructed left B+ tree comprises the following steps: determining a first calling user number, a first called user number and a first calling call number of the full-volume call behavior events through the pre-constructed left B+ tree; screening out the number of called user numbers of the first calling user number and call behavior events whose first calling call number is greater than a preset monitoring threshold value, as target call behavior events suspected to be abnormal; the step of triggering the pre-constructed right B+ tree to monitor call behavior events of a target user number contained in the target call behavior events, wherein the right B+ tree is used to monitor call behavior events, comprises the following steps: determining the target user number contained in the target call behavior events; determining a second called user number and a second calling call number of the target user number according to the target user number and the event information of the call behavior events of the user numbers recorded in the right B+ tree; when the second called user number and the second calling call number are greater than a preset monitoring threshold value, triggering the right B+ tree to monitor call behavior events of the target user number contained in the target call behavior events.

2. The method of claim 1, wherein, The information capable of representing whether a call behavior event is abnormal recorded in the left B+ tree comprises a calling user number, a called user number and a calling call number of the call behavior event.

3. The method of claim 1, wherein, Before triggering the pre-constructed right B+ tree to monitor call behavior events of a target user number contained in the target call behavior events, the method further comprises the following steps: searching through the pre-constructed right B+ tree according to the target user number contained in the target call behavior events, to determine whether the right B+ tree contains a call behavior event matching the target user number; if not, inserting a leaf node with the target user number as a key and the called user number and the calling call number of the target user number as key values into the left B+ tree.

4. The method of claim 1, wherein, When the second called user number and the second calling call number are greater than a preset monitoring threshold value, triggering the right B+ tree to monitor call behavior events of the target user number contained in the target call behavior events, comprises the following steps: constructing a leaf node of the right B+ tree with the target user number as a key and the second called user number and the second calling call number as key values. storing information of a call behavior event matching the target user number recorded in the left B+ tree to a leaf node of the right B+ tree; triggering the right B+ tree to monitor a call behavior event of a target user number contained in the target call behavior event.

5. The method of claim 4, wherein, The method further comprises: if the second called user number and the second calling number of the target user number are less than or equal to the preset monitoring threshold, emptying information matching the target user number recorded in the left B+ tree; outputting the call behavior event information of the target user number through the right B+ tree, and emptying the call behavior event information in the right B+ tree to end the monitoring.

6. The method of claim 1, wherein, Before filtering out the target call behavior event suspected to be abnormal from the full call behavior event through the pre-constructed left B+ tree, the method further comprises: obtaining a call behavior event of a user number to determine a calling user number, a called user number, a calling number, a cell where the user is located, and a call duration; constructing a left B+ tree with the calling user number as a key, and the called user number and the calling number as key values of leaf nodes; constructing a right B+ tree with the calling user number as a key, and the calling user number, the called user number, the calling number, the cell where the user is located, and the call duration as key values of leaf nodes.

7. A trigger-type sliding window traffic anomaly monitoring device based on B+ tree, characterized in that: The system comprises an obtaining module, a filtering module, and a triggering module, wherein: the obtaining module is configured to obtain full call behavior events to be monitored; the filtering module is configured to filter out a target call behavior event suspected to be abnormal from the full call behavior event through a pre-constructed left B+ tree, wherein the left B+ tree records information capable of representing whether a call behavior event is abnormal; the triggering module is configured to trigger a pre-constructed right B+ tree to monitor a call behavior event of a target user number contained in the target call behavior event, wherein the right B+ tree records identification information of each user number and event information of a call behavior event of each user number; in the filtering module, filtering out a target call behavior event suspected to be abnormal from the full call behavior event through a pre-constructed left B+ tree comprises: determining a first calling user number, a first called user number, and a first calling number of the full call behavior event through the pre-constructed left B+ tree according to the full call behavior event; filtering out a target call behavior event suspected to be abnormal from the full call behavior event through the pre-constructed left B+ tree according to the first calling user number, the first called user number, and the first calling number, wherein the target call behavior event is a call behavior event of a called user number of the first calling user number and a call behavior event whose first calling number is greater than a preset monitoring threshold; in the triggering module, triggering a pre-constructed right B+ tree to monitor a call behavior event of a target user number contained in the target call behavior event, wherein the right B+ tree is configured to monitor a call behavior event, comprises: determining a target user number contained in the target call behavior event; determining a second called user number and a second calling number of the target user number according to the target user number and the event information of the call behavior event of the user number recorded in the right B+ tree; when the second called user number and the second calling number are greater than a preset monitoring threshold, triggering the right B+ tree to monitor the call behavior event of the target user number contained in the target call behavior event.

8. An electronic device, comprising: comprise: a memory, a processor and a computer program stored in the memory and executable on the processor, when the computer program is executed by the processor, the steps of the B+ tree based triggered sliding window traffic anomaly monitoring method in any one of claims 1 to 6 are implemented.

Images