Signaling-based behavior detection method, apparatus, device, medium, and program product

Abstract

The application provides a behavior detection method and device based on signaling, equipment, medium and program product. The method comprises: obtaining an initial object identifier, and obtaining a plurality of first signaling corresponding to the initial object identifier based on a parameter analysis model, wherein the initial object identifier represents a detection object that has not undergone behavior detection, and the first signaling is used to represent online behavior characteristics and offline behavior characteristics of the detection object; obtaining target setting data, wherein the target setting data represents a determination rule of abnormal behavior characteristics; determining a target object identifier according to the initial object identifier, the target setting data and the plurality of first signaling, wherein the target object identifier represents a target detection object that meets the determination rule; and generating object management information according to the target object identifier, wherein the object management information represents a behavior control mode of the target detection object. The method of the application can improve the stability of the behavior detection process by introducing signaling data.

Description

Technical Field

[0001] This application relates to the field of signaling, and more particularly to a signaling-based behavior detection method, apparatus, device, medium, and program product. Background Technology

[0002] Behavioral detection includes offline and online behavioral detection. Online behavioral detection refers to monitoring the source, browsing history, and return visits of a target object across various platforms to obtain diverse online data, providing enterprises or managers with more accurate analytical data. Offline behavioral detection involves collecting offline data using image acquisition equipment such as detection devices to determine the positional relationship between various objects within the target object and the detection area.

[0003] Currently, behavior detection systems can perform the aforementioned behavior detection, with offline and online detection processes operating independently; moreover, the resources allocated by the behavior detection system for the offline and online detection processes are fixed.

[0004] However, the relative sizes of online and offline data are not always consistent. When the size relationship between online and offline data is inconsistent with the size relationship between resources, it may cause stuttering issues in either the online or offline detection process. For example, when the offline resource volume is greater than the online resource volume and the offline data volume is less than the online data volume, the above-mentioned size relationship is inconsistent; when the offline resource volume is greater than the online resource volume and the offline data volume is greater than the online data volume, the above-mentioned size relationship is consistent.

[0005] Therefore, how to improve the stability of the behavior detection process is a technical problem that urgently needs to be solved by those skilled in the art. Summary of the Invention

[0006] This application provides a signaling-based behavior detection method, apparatus, equipment, medium, and program product to solve the technical problem of instability in the behavior monitoring process.

[0007] Firstly, this application provides a signaling-based behavior detection method, including:

[0008] An initial object identifier is obtained, and based on the parameter parsing model, multiple first signaling messages corresponding to the initial object identifier are obtained. The initial object identifier represents a detected object that has not undergone behavior detection, and the first signaling messages are used to represent the online and offline behavior characteristics of the detected object.

[0009] Acquire target setting data, wherein the target setting data represents the judgment rules for abnormal behavior characteristics;

[0010] Based on the initial object identifier, the target setting data, and the plurality of first signaling, a target object identifier is determined, wherein the target object identifier represents a target detection object that conforms to the determination rule;

[0011] Based on the target object identifier, object management information is generated, wherein the object management information represents the behavior control method for the target detection object.

[0012] Optionally, in the method described above, obtaining the target setting data includes:

[0013] Obtain configuration data, wherein the configuration data is rule data generated based on configuration rules;

[0014] Based on the configuration data and the configuration rules, target setting data is obtained, wherein the configuration rules can be obtained based on the initial object identifier.

[0015] Optionally, in the method described above, the parameter parsing model includes multiple sub-parsing models with an ordered arrangement, and the target setting data is obtained according to the configuration data and the configuration rules, including:

[0016] Determine the current sub-model and its corresponding preceding sub-model, wherein the current sub-model is the sub-parse model that is currently in operation, and the preceding sub-model is the sub-parse model that precedes the current sub-model;

[0017] Obtain the commonly used parsing template and the preceding parsing result corresponding to the current sub-model, wherein the preceding parsing result is the output result of the preceding sub-model;

[0018] Based on the preceding parsing results and the commonly used parsing templates, the current parsing result is obtained, wherein the current parsing result is the output result of the current sub-model;

[0019] Based on the configuration rules and the current parsing results, the target setting data is obtained.

[0020] Optionally, in the method described above, the configuration data includes multiple sets of first data labeled with rule types, and obtaining the target setting data based on the configuration data and the configuration rules includes:

[0021] Based on preset rule types, the multiple first data with rule type labels are grouped to obtain multiple initial groups;

[0022] Obtain the target rule type, and based on the target rule type and the multiple initial groups, obtain multiple target groups, wherein the target rule type can be obtained based on the configuration rules;

[0023] The target setting data is obtained based on the preset parsing rules and the multiple target groups.

[0024] Optionally, in the method described above, the target setting data includes multiple sets of setting rules, and before obtaining the target setting data based on the configuration data and the configuration rules, the method further includes:

[0025] Determine the rule group type corresponding to the plurality of set rule groups, and obtain the current parameter type corresponding to each of the plurality of set rule groups;

[0026] Obtain the target parameter type corresponding to the rule type, and determine whether the current parameter type is qualified based on the target parameter type;

[0027] Based on the configuration data and the configuration rules, the target setting data is obtained, including:

[0028] If the result is unsatisfactory, updated configuration data will be obtained based on the target parameter type.

[0029] Optionally, in the method described above, the target setting data includes at least a location detection range and a time detection range. Determining the target object identifier based on the initial object identifier, the target setting data, and the plurality of first signaling statements includes:

[0030] When the time falls within the time detection range, multiple object identifier groups corresponding to each time moment are obtained, wherein the object identifier group represents the detected object located within the location detection range;

[0031] Based on the object identifier group, an identifier control group is determined, wherein the identifier control group includes at least two object identifier groups that are adjacent in time.

[0032] Based on the identified control group, the target object identifier is determined.

[0033] Optionally, in the method described above, the object management information includes multiple sub-management information. The object management information is generated based on the first signaling corresponding to the target object identifier, including:

[0034] Obtain the target group type corresponding to the target object identifier, and obtain multiple target detection identifier groups based on the target group type;

[0035] Based on the first signaling corresponding to the target detection identifier, the sub-management information corresponding to the target detection identifier group is obtained.

[0036] Secondly, this application provides a signaling-based behavior detection device, comprising:

[0037] The first acquisition module is used to acquire an initial object identifier and obtain multiple first signaling messages corresponding to the initial object identifier based on a parameter parsing model. The initial object identifier represents a detection object that has not undergone behavior detection, and the first signaling messages are used to represent the online behavior characteristics and offline behavior characteristics of the detection object.

[0038] The second acquisition module is used to acquire target setting data, wherein the target setting data represents the judgment rules for abnormal behavior characteristics;

[0039] The analysis module is used to determine the target object identifier based on the initial object identifier, the target setting data, and the plurality of first signaling, wherein the target object identifier represents a target detection object that conforms to the determination rule;

[0040] The generation module is used to generate object management information based on the target object identifier, wherein the object management information represents the behavior control method for the target detection object.

[0041] Optionally, the second acquisition module described above, when performing the acquisition of target set data, is used to:

[0042] Obtain configuration data, wherein the configuration data is rule data generated based on configuration rules;

[0043] Based on the configuration data and the configuration rules, target setting data is obtained, wherein the configuration rules can be obtained based on the initial object identifier.

[0044] Optionally, the parameter parsing model includes multiple sub-parsing models that have an ordered arrangement.

[0045] The second acquisition module described above, when executing the process of obtaining target setting data based on the configuration data and the configuration rules, is used for:

[0046] Determine the current sub-model and its corresponding preceding sub-model, wherein the current sub-model is the sub-parse model that is currently in operation, and the preceding sub-model is the sub-parse model that precedes the current sub-model;

[0047] Obtain the commonly used parsing template and the preceding parsing result corresponding to the current sub-model, wherein the preceding parsing result is the output result of the preceding sub-model;

[0048] Based on the preceding parsing results and the commonly used parsing templates, the current parsing result is obtained, wherein the current parsing result is the output result of the current sub-model;

[0049] Based on the configuration rules and the current parsing results, the target setting data is obtained.

[0050] Optionally, the configuration data includes multiple sets of first data labeled with rule types.

[0051] The second acquisition module described above, when executing the process of obtaining target setting data based on the configuration data and the configuration rules, is used for:

[0052] Based on preset rule types, the multiple first data with rule type labels are grouped to obtain multiple initial groups;

[0053] Obtain the target rule type, and based on the target rule type and the multiple initial groups, obtain multiple target groups, wherein the target rule type can be obtained based on the configuration rules;

[0054] The target setting data is obtained based on the preset parsing rules and the multiple target groups.

[0055] Optionally, the target setting data includes multiple setting rule groups, and the above-mentioned device further includes:

[0056] The parameter type validation module is used for:

[0057] Determine the rule group type corresponding to the plurality of set rule groups, and obtain the current parameter type corresponding to each of the plurality of set rule groups;

[0058] Obtain the target parameter type corresponding to the rule type, and determine whether the current parameter type is qualified based on the target parameter type; if it is not qualified, trigger the second acquisition module mentioned above.

[0059] Accordingly, the second acquisition module described above, when executing the process of obtaining target setting data based on the configuration data and the configuration rules, is used to:

[0060] Based on the target parameter type, the updated configuration data is obtained.

[0061] Optionally, the target setting data includes at least a location detection range and a time detection range. The analysis module, when determining the target object identifier based on the initial object identifier, the target setting data, and the plurality of first signaling statements, is used to:

[0062] When the time falls within the time detection range, multiple object identifier groups corresponding to each time moment are obtained, wherein the object identifier group represents the detected object located within the location detection range;

[0063] Based on the object identifier group, an identifier control group is determined, wherein the identifier control group includes at least two object identifier groups that are adjacent in time.

[0064] Based on the identified control group, the target object identifier is determined.

[0065] Optionally, the object management information includes multiple sub-management information. When the generation module generates object management information based on the target object identifier, it is used to:

[0066] Obtain the target group type corresponding to the target object identifier, and obtain multiple target detection identifier groups based on the target group type;

[0067] Based on the target detection identifier, the sub-management information corresponding to the target detection identifier group is obtained.

[0068] Thirdly, an electronic device includes: a processor, and a memory communicatively connected to the processor;

[0069] The memory stores computer-executed instructions;

[0070] The processor executes computer execution instructions stored in the memory to implement the signaling-based behavior detection method as described in the first aspect.

[0071] Fourthly, a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, are used to implement the signaling-based behavior detection method as described in the first aspect.

[0072] Fifthly, a computer program product includes a computer program that, when executed by a processor, implements the signaling-based behavior detection method as described in the first aspect.

[0073] The signaling-based behavior detection method, apparatus, device, medium, and program products provided in this application first obtain an initial object identifier to identify the detection objects that have not undergone behavior detection; then, based on a parameter parsing model, they obtain a first signaling that includes the online and offline behavior characteristics of the detection objects to merge the online and offline detection processes; next, they obtain target setting data to determine the judgment rules for abnormal behavior characteristics; when it is determined that a target detection object exists among the detection objects according to the above judgment rules, an object management instruction is generated based on the target object identifier to achieve the beneficial effect of improving the stability of the behavior detection process. Attached Figure Description

[0074] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0075] Figure 1 A schematic diagram illustrating the application scenario of the signaling-based behavior detection method provided in this application;

[0076] Figure 2A schematic diagram of the first process of the signaling-based behavior detection method provided in this application;

[0077] Figure 3 A schematic diagram of the second process of the signaling-based behavior detection method provided in this application;

[0078] Figure 4 A schematic diagram of the second process of the signaling-based behavior detection method provided in this application;

[0079] Figure 5 A schematic diagram of data transmission for the parameter analysis model provided in this application;

[0080] Figure 6 A schematic diagram of the signaling-based behavior detection device provided in this application;

[0081] Figure 7 A schematic diagram of the structure of the electronic device provided in this application.

[0082] The accompanying drawings illustrate specific embodiments of this application, which will be described in more detail below. These drawings and descriptions are not intended to limit the scope of the concept in any way, but rather to illustrate the concept of this application to those skilled in the art through reference to particular embodiments. Detailed Implementation

[0083] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numbers in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this application. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this application as detailed in the appended claims.

[0084] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, use and processing of the relevant data must comply with relevant laws, regulations and standards, and corresponding operation entry points are provided for users to choose to authorize or refuse.

[0085] With the widespread use of the internet in daily life, people's activities have gradually spread from real life to the internet. Therefore, the detection of human behavior has gradually evolved into two parts: online detection and offline behavior detection.

[0086] Currently, when online behavior detection and offline behavior detection occur simultaneously in related technologies, the two behavior detection processes are generally treated as two independent processes, and fixed resources are allocated to these processes. Finally, the processes perform behavior detection based on the allocated resources.

[0087] However, the relative sizes of online and offline data are not always consistent. When the size of the data and the size of the resources are inconsistent, it may cause lag in the offline or online detection process.

[0088] For example, when the ratio of offline data volume to offline data volume is 3:7 and the ratio of online resources volume to offline resources volume is 8:2, the offline detection process may experience lag when processing offline data based on offline resources volume, which will reduce the operational stability of the behavior detection process.

[0089] Therefore, how to improve the stability of the behavior detection process is a technical problem that urgently needs to be solved by those skilled in the art.

[0090] This application provides a signaling-based behavior detection method to address the aforementioned technical problems of the prior art, executed by an electronic device. This electronic device can be a server or a terminal device. The server can be a standalone physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server providing cloud computing services. The terminal device can be a smartphone, tablet, laptop, desktop computer, etc., but is not limited to these. The terminal device and the server can be directly or indirectly connected via wired or wireless communication, and this application does not impose any limitations on this connection.

[0091] Figure 1 This is a schematic diagram of an application scenario provided in an embodiment of this application, with reference to... Figure 1 As shown, this embodiment can be executed by an electronic device. After the user terminal collects user detection data, it sends the user detection data to the electronic device. For example, the user terminal can be a terminal device running a behavior detection program. The user detection data includes an initial object identifier and data representing abnormal behavior judgment rules. The electronic device obtains object behavior data from the terminal corresponding to the detected object based on the initial object identifier. The object behavior data is signaling data. Then, the electronic device obtains object management information based on the object behavior data and the data representing abnormal behavior judgment rules. Based on the above object management information, it generates an abnormal behavior judgment result and a behavior control method. The electronic device sends the abnormal behavior judgment result to the user terminal, and the user terminal performs behavior control on the terminal corresponding to the detected object based on the behavior control method.

[0092] The technical solution of this application and how the technical solution of this application solves the above-mentioned technical problems are described in detail below with specific embodiments. These specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments. The embodiments of this application will now be described with reference to the accompanying drawings.

[0093] like Figure 2 As shown, a signaling-based behavior detection method may specifically include steps S101 to S104, wherein:

[0094] S101. Obtain the initial object identifier and, based on the parameter parsing model, obtain multiple first signaling messages corresponding to the initial object identifier. The initial object identifier represents the detected object that has not undergone behavior detection, and the first signaling messages are used to represent the online and offline behavior characteristics of the detected object.

[0095] Obtaining the initial object identifier can specifically include: when the user receives a detection request, generating a target object selection interface, wherein the detection request is generated when the behavior detection process is triggered on the user, and the detection request can be information representing the detection destination; the target object selection interface includes a detection object upload window and a detection object marking window; the user obtains the initial object identifier based on the target object selection interface and sends the initial object identifier to the electronic device; the initial object identifier can represent the identity information of the detection object, such as the name, phone number, etc. of the detection object.

[0096] Users can upload files in Excel or TXT format, containing multiple object identifiers, through the object upload window. Users can also select object identifiers through the object tagging window.

[0097] The parameter parsing model described above includes at least a signaling packetization module. For example, a first signaling message with an initial object identifier is input into the signaling packetization module. This module groups the first signaling message based on the initial object identifier, resulting in multiple first signaling groups corresponding to different initial object identifiers. Online behaviors include actions such as opening an app or browsing a website, while offline behaviors include actions such as leaving a geographical area. Online behavior features are feature data that characterizes online behavior, and offline behavior features are feature data that characterizes offline behavior.

[0098] S102. Obtain target setting data, wherein the target setting data represents the judgment rules for abnormal behavior characteristics.

[0099] Specifically, when the user terminal obtains the custom detection rules, it sends the custom detection rules to the electronic device. The custom detection rules are the detection rules entered by the user in the user terminal's custom interface. For example, the custom detection rule is that a detection object with feature A is browsing website B. The electronic device parses the custom detection rules and converts them into judgment rules for abnormal behavior features that the electronic device can use.

[0100] S103. Determine the target object identifier based on the initial object identifier, target setting data, and multiple first signaling commands, wherein the target object identifier represents the target detection object that conforms to the judgment rules.

[0101] For example, the target setting data includes the behavioral characteristics corresponding to online behavior A and online behavior B respectively; for the first signaling corresponding to each initial object identifier, it is determined whether there are behavioral characteristics corresponding to online behavior A and online behavior B in the first signaling. If so, the initial object identifier is determined to be the target object identifier; otherwise, it indicates that the detection object corresponding to the initial object identifier does not meet the above judgment rules. The detection object corresponding to the target object identifier is the target detection object.

[0102] S104. Generate object management information based on the target object identifier, wherein the object management information represents the behavior control method for the target detection object.

[0103] The aforementioned behavior control methods can include restricting the target object's access to any specific website and the duration of its browsing, etc. The target object is the object corresponding to any set of target data, and the target data corresponds to at least one type of abnormal behavior.

[0104] For example, the target classification method is obtained, which can be classified by object or by abnormal behavior type. When the target classification method is classified by object, several abnormal behavior types corresponding to the target detection object are obtained, and the preset control methods corresponding to each of the above-mentioned abnormal behavior types are determined. The preset control methods are preset by technicians and stored in electronic devices. When the target classification method is classified by abnormal behavior type, the initial behavior type group corresponding to all the above-mentioned target detection objects is determined, the abnormal behavior types in the above-mentioned initial behavior type group are deduplicated to obtain the target behavior type group, and the target detection identifier group corresponding to each abnormal behavior type in the target behavior type group is determined, wherein the target detection identifier group includes several target detection identifiers.

[0105] The signaling-based behavior detection method provided in this application first obtains an initial object identifier to identify detection objects that have not undergone behavior detection; then, based on a parameter parsing model, it obtains a first signaling that includes the online and offline behavior characteristics of the detection objects to merge the online and offline detection processes; next, it obtains target setting data to determine the judgment rules for abnormal behavior characteristics; when it is determined that a target detection object exists among the detection objects according to the above judgment rules, it generates an object management instruction based on the target object identifier to achieve the beneficial effect of improving the stability of the behavior detection process.

[0106] In one possible implementation, S102, which involves acquiring target setting data, may specifically include S102-1 and S102-2, wherein:

[0107] S102-1. Obtain configuration data, where the configuration data is rule data generated based on configuration rules.

[0108] The configuration data includes multiple custom rule groups, which represent user-defined detection rules. The configuration rules represent the rules by which the electronic device collects the configuration data. For example, when a user enters a custom detection rule, they should enter it according to the above collection rules; otherwise, the electronic device will not be able to successfully collect the configuration data.

[0109] Specifically, when a user's custom detection rule is received, the parser parses the custom rule data to obtain the preset rule type corresponding to each custom rule data. The custom detection rule can be an interface screen containing the custom detection rule or a data packet containing the custom detection rule. According to the preset rule type, the custom rule data is grouped to obtain the custom rule group corresponding to the preset rule type. The preset rule types include web rules, app rules, URL rules, call rules, SMS rules, and location rules. The above custom rule groups are stored in a MySQL database in the electronic device. Preferably, the MySQL database is a HiveQL database.

[0110] The process of grouping custom rule data according to preset rule types to obtain custom rule groups corresponding to preset rule types is implemented based on javax.validation.

[0111] S102-2. Based on the configuration data and configuration rules, obtain the target setting data, wherein the configuration rules can be obtained based on the initial object identifier.

[0112] The target setting data includes multiple sub-target setting data.

[0113] Specifically, the following steps are taken: First, obtain the preset personnel category corresponding to the initial object identifier. The preset personnel category represents the identity type of the detected object, such as the position of employee or human resources, or the permission type of whitelist object or blacklist object. In this embodiment, the identity type is not specifically limited. Second, determine the sub-configuration rules corresponding to the preset personnel category corresponding to the initial object identifier. Third, for each preset personnel category, verify the custom rule group corresponding to the preset personnel category based on the sub-configuration rules corresponding to the preset personnel category to obtain the sub-target setting data. The sub-configuration rules are rules such as non-empty constraints.

[0114] The signaling-based behavior detection method provided in this application obtains configuration data to determine user-defined detection rules; and by verifying the aforementioned user-defined detection rules, the accuracy of the target setting data can be improved.

[0115] Furthermore, since different detection objects can be sampled with different types of signaling, this solution can further improve the accuracy of target setting data by obtaining configuration rules based on the initial object identifier.

[0116] In one possible implementation, the parameter parsing model includes multiple sub-parsing models with an ordered arrangement. S102-2 above, based on configuration data and configuration rules, obtains the target setting data, which may specifically include S102-2-a1 to S102-2-a4, wherein:

[0117] S102-2-a1. Determine the current sub-model and its corresponding predecessor sub-model, where the current sub-model is the sub-analytical model that is currently working, and the predecessor sub-model is the sub-analytical model that precedes the current sub-model.

[0118] S102-2-a2, Obtain the commonly used parsing template and the preceding parsing result corresponding to the current sub-model, where the preceding parsing result is the output result of the preceding sub-model.

[0119] S102-2-a3. Based on the previous analysis results and commonly used analysis templates, the current analysis result is obtained, where the current analysis result is the output result of the current sub-model.

[0120] S102-2-a4. Based on the configuration rules and the current parsing results, obtain the target setting data.

[0121] Commonly used parsing templates represent the preset parsing method of the current sub-model, such as parsing and obtaining key field values ​​in signaling data.

[0122] For example, the above sub-parsing models are the SELECT module, WHERE module, FROM module, GROUP BY module, and HAVING module arranged in sequence.

[0123] The SELECT module is used to extract common and personalized fields from custom rule groups. Common fields include identity information such as the name and mobile phone number of the detected object, while personalized fields include abnormal triggering conditions such as swipe-in ​​and swipe-out rules.

[0124] The WHERE module is used to extract the billing period, start time, detection end time, and rule-specific conditions. The billing period represents the time when the electronic device receives the first signaling, the start time represents the start time of the action corresponding to the signaling, and the end time represents the end time of the action corresponding to the signaling. The above time points include specific time nodes and dates. The rule-specific conditions are the target time point conditions required by the user.

[0125] The FROM module is used to determine the name of the full data table corresponding to the preset rule type of the custom rule group. The name includes the billing period range of the data table and the corresponding preset rule type. The full data table includes at least the custom rule group corresponding to the preset rule type.

[0126] The GROUP BY module is used to group the first signaling based on common fields to obtain the first signaling corresponding to each detected object. Furthermore, personalized grouping can be performed, for example, based on the number of times the user 18 in APP1 has opened the app.

[0127] The HAVING module is used to obtain a threshold list, which corresponds to the exception triggering conditions in the SELECT module. In other words, the threshold list is the specific value of the exception triggering conditions. Based on the custom rule group, the target statistical type is determined, which is the number of times, duration, and / or traffic. The target statistical type and the above specific values ​​are concatenated to obtain the final judgment condition.

[0128] It can be seen that the common parsing template for the SELECT module is to collect user requirements, which include the detection object and the judgment logic of the judgment rule. For example, when the duration of behavior A reaches the threshold M, the behavior is judged as abnormal. The common parsing template for the WHERE module is to extract time points, which include the time point when the electronic device collects the first signaling and the time point corresponding to the judgment rule. The common parsing template for the FROM module is to determine the name of the data table to be called in the HiveQL library. The data table to be called includes real-time data such as the signaling table and the custom rule table. The common parsing template for the GROUP BY module is to group the first signaling. The common parsing template for the HAVING module is to extract the specific thresholds contained in the judgment rule, such as parameters such as traffic and duration.

[0129] The signaling-based behavior detection method provided in this application determines the preset parsing method of the current sub-parsing model by identifying the currently working sub-parsing model and the most recently working sub-parsing model, and then obtaining the commonly used parsing template corresponding to the current sub-model. It also obtains the previous parsing result to determine the output result of the previous sub-model. It should be noted that since the sub-parsing model uses a categorized processing method, the input data of the sub-parsing model in this embodiment is less than the output data. Therefore, the output data of the previous sub-parsing model is used as the input data of the current sub-model. Compared to multiple sub-parsing models directly processing configuration data simultaneously, the method used in this embodiment can reduce the probability of distortion of the target setting data.

[0130] In another possible implementation, the configuration data includes multiple first data items labeled with rule types. In step S102-2 above, target setting data is obtained based on the configuration data and configuration rules. Specifically, this can include steps S102-2-b1 to S102-2-b3, where:

[0131] S102-2-b1. Based on the preset rule type, group the first data with multiple rule type labels to obtain multiple initial groups.

[0132] Among them, the rule type tag is the tag corresponding to the preset rule type, which can be a web rule, app rule, or URL rule tag, etc.

[0133] S102-2-b2. Obtain the target rule type and, based on the target rule type and multiple initial groups, obtain multiple target groups, wherein the target rule type can be obtained based on the configuration rules.

[0134] Obtaining the target rule type based on the configuration rules can specifically include: extracting the preset rule type from the configuration rules and using the preset rule type from the configuration rules as the target rule type.

[0135] Specifically, the target rule type is obtained based on the configuration rules; the initial groups other than the preset rule types corresponding to the above initial groups are filtered out to obtain multiple target groups.

[0136] S102-2-b3. Based on the preset parsing rules and multiple target groups, obtain the target setting data.

[0137] The preset parsing rules can be a preset parser or the parameter parsing model mentioned above.

[0138] The signaling-based behavior detection method provided in this application groupes multiple first data with rule type labels according to a preset rule type, determines the target group from multiple initial groups, and verifies the preset rule type; it then parses the target group according to a preset parsing rule to obtain the target setting data. Compared with direct parsing without grouping, this solution can obtain the target setting data faster.

[0139] In one possible implementation, the target setting data includes multiple sets of setting rules. Before obtaining the target setting data based on the configuration data and configuration rules in S102-2, the implementation further includes S100-1 and S100-2, wherein:

[0140] S100-1. Determine the rule group type corresponding to multiple rule groups and obtain the current parameter type corresponding to each of the multiple rule groups.

[0141] Setting a rule group is equivalent to defining a custom rule group. The parameter type indicates the common data types of the data in the set rule group.

[0142] Obtain the current parameter type corresponding to each of the multiple set rule groups. Specifically, this may include: for each rule group, randomly select multiple data for type identification to obtain the parameter type corresponding to each of the multiple data, and take the parameter type with the highest frequency as the current parameter type corresponding to the set rule group.

[0143] S100-2. Obtain the target parameter type corresponding to the rule type, and determine whether the current parameter type is qualified based on the target parameter type.

[0144] The target parameter type is the preset parameter type or reference parameter type corresponding to the rule type. The reference parameter type is the parameter type that appears most frequently in the historical parameter types.

[0145] If the target parameter type is the same as the current parameter type, the current parameter type is deemed qualified; otherwise, it is deemed unqualified.

[0146] If it passes the test, it means that the configuration data does not need to be changed and can be used directly.

[0147] Accordingly, S102-2, based on the configuration data and configuration rules, obtains the target setting data, which may specifically include:

[0148] If the result is unsatisfactory, the updated configuration data will be obtained based on the target parameter type.

[0149] Specifically, based on the target parameter type and the rule type corresponding to the current parameter type, a data re-acquisition instruction corresponding to that rule type is generated. The data re-acquisition instruction is used to retrieve the configuration data corresponding to the above rule type again from the user terminal.

[0150] The signaling-based behavior detection method provided in this application, compared with the logical rules in related technologies that determine whether parameters are qualified based on non-empty constraints, can reduce the probability of parameters being qualified due to non-empty constraints because the configuration data includes parameters unrelated to behavior detection, by verifying the parameter type, thereby improving the accuracy of parameter qualification determination results.

[0151] In one possible implementation, the target setting data includes at least a position detection range and a time detection range. In step S103, the target object identifier is determined based on the initial object identifier, the target setting data, and multiple first signaling statements. Specifically, this may include steps S103-1 to S103-3, wherein:

[0152] S103-1. When the time falls within the time detection range, acquire multiple object identifier groups corresponding to each time point. The object identifier group represents the detected object located within the location detection range.

[0153] S103-2. Based on the object identifier group, determine the identifier control group, wherein the identifier control group includes at least two object identifier groups that are adjacent in time.

[0154] Taking the changes between 18:10 and 18:11 as an example: In the first minute, User_1, User_2, User_3, and User_4 were within the fence; in the next minute, the members changed to User_2, User_5, User_7, and User_7. 18:10 to 18:11 is the time detection range, and 18:10 and 18:11 are two adjacent moments. User_1, User_2, User_3, and User_4 are the object identifier group 1 corresponding to moment 18:10, and User_2, User_5, User_7, and User_7 are the object identifier group 2 corresponding to moment 18:11. Object identifier group 1 and object identifier group 2 form the identifier control group.

[0155] S103-3. Based on the identification control group, determine the target object identification.

[0156] Specifically, the control group is identified as including multiple control subjects; for each control subject, the attribution relationship between the control subject and each object identification group in the control group is determined, wherein the attribution relationship is either included or excluded; based on the attribution relationship, the positional relationship between the control subject and the fenced area is determined, wherein when the attribution relationship of the object identification group at the earlier time is included and the attribution relationship of the object identification group at the later time is excluded, the positional relationship is overflowing; when the attribution relationship of the object identification group at the earlier time is excluded and the attribution relationship of the object identification group at the later time is included, the positional relationship is overflowing; when the attribution relationship of the object identification group at the earlier time is the same as the attribution relationship of the object identification group at the later time, the positional relationship is unchanged.

[0157] "Overflow" refers to the detected object leaving the fenced area, while "overflow" refers to the detected object entering the fenced area. The aforementioned fenced area is determined by the location detection range.

[0158] The location detection range includes the selection of provinces, cities, and districts, as well as custom area selection. Area selection can be achieved using AOI regions and POI points with a radius. AOI regions can be polygons, rectangles, or circles. When the electronic device detects the generation of the location detection range, the fenced area is defined. The electronic device will capture the real-time personnel distribution within the fenced area in snapshot form, and efficiently store the personnel distribution data in the HBase database, ensuring immediate data accessibility and analysis efficiency. The snapshot frequency in this embodiment is per minute.

[0159] The signaling-based behavior detection method provided in this application determines whether the position movement behavior of the detected object is abnormal by judging whether the detected object in the position detection range exhibits ingress or egress behavior at adjacent time points. It can implement the steps and record the individual's movement trajectory.

[0160] In one possible implementation, the object management information includes multiple sub-management information. S104 above generates object management information based on the target object identifier, specifically including S104-1 and S104-2, wherein:

[0161] S104-1. Obtain the target group type corresponding to the target object identifier, and obtain multiple target detection identifier groups based on the target group type.

[0162] Each target detection identifier corresponds to a unique signaling group.

[0163] Specifically, abnormal features are extracted from the signaling group to obtain the abnormal feature group corresponding to the signaling group. The abnormal feature group includes multiple abnormal features, and the signaling group includes multiple first signaling signals corresponding to the target detection object. Among the abnormal features, multiple high-frequency features with high occurrence frequency are identified. The number of the above multiple high-frequency features is preset by the technician and stored in the electronic device. The high-frequency features are determined as target grouping types. Multiple detection identifiers corresponding to each target grouping type are determined, and the multiple detection identifiers corresponding to the target grouping type are used as the target detection identifier group.

[0164] S104-2. Based on the target detection identifier, obtain the sub-management information corresponding to the target detection identifier group.

[0165] The sub-management information includes the target group type corresponding to the target detection identifier. For example, when the target group type is "location abnormal", the resource management information corresponding to the target detection identifier group is: prompt the user that the detected object's location is abnormal; where the detected object is a variable determined by the target detection identifier group.

[0166] The signaling-based behavior detection method provided in this application, compared to integrating abnormal behaviors of the same detection object or abnormal personnel under the same abnormal type, obtains the real-time target group type to perceive real-time abnormal behavior in the detection object.

[0167] The following example illustrates the signaling-based behavior detection method provided in the above embodiments. Figure 3 As shown, it includes the following steps:

[0168] S201. Obtain the initial object identifier and, based on the parameter parsing model, obtain multiple first signaling messages corresponding to the initial object identifier. The initial object identifier represents the detected object that has not undergone behavior detection, and the first signaling messages are used to represent the online and offline behavior characteristics of the detected object.

[0169] S202. Obtain configuration data and verify the configuration data to obtain updated configuration data. The configuration data is rule data generated based on configuration rules, and the configuration rules can be obtained based on the initial object identifier.

[0170] Specifically, determine the rule group type corresponding to multiple rule groups, and obtain the current parameter type corresponding to each rule group; obtain the target parameter type corresponding to the rule type, and determine whether the current parameter type is qualified based on the target parameter type; if it is not qualified, obtain the updated configuration data based on the target parameter type.

[0171] S203. Obtain the updated configuration data, which includes multiple first data items with rule type labels.

[0172] In one possible implementation, after step S203, the following is included:

[0173] S204-1. Obtain the target setting data based on the first data with the rule type label.

[0174] Specifically, based on the preset rule type, multiple first data with rule type labels are grouped to obtain multiple initial groups; the target rule type is obtained, and based on the target rule type and multiple initial groups, multiple target groups are obtained, wherein the target rule type can be obtained based on the configuration rule; the target setting data is obtained based on the preset parsing rule and multiple target groups.

[0175] In another possible implementation, the parameter parsing model includes multiple sub-parsing models with an ordered arrangement; specifically, after step S202, it also includes:

[0176] S204-2. Based on the updated configuration data and multiple sub-parsing models, determine the target setting data.

[0177] Specifically, the process involves determining the current sub-model and its preceding sub-model, where the current sub-model is the currently working sub-parsing model and the preceding sub-model is the sub-parsing model that preceded the current sub-model; obtaining the commonly used parsing templates and preceding parsing results corresponding to the current sub-model, where the preceding parsing results are the output results of the preceding sub-model; obtaining the current parsing result based on the preceding parsing results and commonly used parsing templates, where the current parsing result is the output result of the current sub-model; and obtaining the target setting data based on the configuration rules and the current parsing result, whereby the target setting data represents the judgment rules for abnormal behavior characteristics.

[0178] S205. Based on the target setting data, obtain the position detection range and time detection range.

[0179] S206. When the time falls within the time detection range, acquire multiple object identifier groups corresponding to each time point, wherein the object identifier group represents the detected object located within the location detection range; based on the object identifier group, determine the identifier control group, wherein the identifier control group includes at least two object identifier groups with adjacent time points; determine the target object identifier based on the identifier control group.

[0180] S207. Obtain the target group type corresponding to the target object identifier, and obtain multiple target detection identifier groups based on the target group type; obtain the sub-management information corresponding to the target detection identifier group based on the target detection identifier, and obtain object management information based on the multiple sub-management information.

[0181] The following example illustrates the signaling-based behavior detection method provided in the above embodiments. Figure 4 As shown, it includes the following steps:

[0182] S301, Obtain target setting data.

[0183] S302. Obtain the detection object data, which includes the detection identifier.

[0184] S303. Generate HiveQL scripts corresponding to the target setting data and the detection object data respectively. The process of generating HiveQL scripts can be based on the parameter parsing model.

[0185] like Figure 5 As shown, the parameter parsing model includes the SELECT module, WHERE module, FROM module, GROUP BY module, and HAVING module arranged in order.

[0186] The SELECT module, based on the HiveQL script corresponding to the target data, obtains the detection identifier and the judgment logic of the judgment rule, and sends the detection identifier and the judgment logic of the judgment rule to the WHERE module. The WHERE module, based on the judgment logic of the judgment rule, extracts the time point from the HiveQL script corresponding to the target data, and sends the time point, judgment logic, and detection identifier to the FROM module. The time point includes the time point when the electronic device collects the first signaling and the time point corresponding to the judgment rule. The FROM module, based on the time point, judgment logic, and detection identifier, determines the name of the data table to be called in the HiveQL library, and sends the name of the data table to be called, the time point, and the detection identifier to the GROUP BY module. It also sends the judgment logic and the name of the data table to be called to the HAVING module. The GROUP BY module, based on the detection identifier, groups the first signaling in the data table to be called to obtain a signaling group, and generates the HiveQL script corresponding to the detection target data. The HAVING module, based on the judgment logic and the name of the data table to be called, obtains the judgment threshold and generates the HiveQL script corresponding to the target data.

[0187] S304. Based on the HiveQL script corresponding to the target setting data, filter the HiveQL script corresponding to the test object data to obtain the abnormal data that triggers the judgment rule. The abnormal data is the first signaling corresponding to the target detection object.

[0188] S305. Generate a message queue based on the abnormal data, and generate control information and analysis information based on the above abnormal message queue. The control information is equivalent to the object management information and is used to issue SMS warnings or block Internet access for the target detection object. The analysis information represents the visualization screen display and data analysis steps.

[0189] It should be noted that, for the sake of simplicity, the foregoing method embodiments are all described as a series of actions. However, those skilled in the art should understand that this application is not limited to the described order of actions, as some steps may be performed in other orders or simultaneously according to this application. Furthermore, those skilled in the art should also understand that the embodiments described in the specification are all optional embodiments, and the actions and modules involved are not necessarily essential to this application.

[0190] It should be further noted that although the steps in the flowchart are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowchart may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these sub-steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the sub-steps or stages of other steps.

[0191] Figure 6 A schematic diagram of the signaling-based behavior detection device 40 provided in this application is shown below. Figure 6 As shown, the signaling-based behavior detection device 40 provided in this embodiment includes:

[0192] The first acquisition module 401 is used to acquire the initial object identifier and obtain multiple first signals corresponding to the initial object identifier based on the parameter parsing model. The initial object identifier represents the detection object that has not undergone behavior detection, and the first signals are used to represent the online behavior characteristics and offline behavior characteristics of the detection object.

[0193] The second acquisition module 402 is used to acquire target setting data, wherein the target setting data represents the judgment rules of abnormal behavior characteristics;

[0194] Analysis module 403 is used to determine the target object identifier based on the initial object identifier, target setting data and multiple first signaling, wherein the target object identifier represents the target detection object that conforms to the judgment rule;

[0195] The generation module 404 is used to generate object management information based on the target object identifier, wherein the object management information represents the behavior control method for the target detection object.

[0196] Optionally, the second acquisition module 402 described above, when performing the acquisition of target setting data, is used to:

[0197] Retrieve configuration data, where the configuration data is rule data generated based on configuration rules;

[0198] Based on the configuration data and configuration rules, the target setting data is obtained, where the configuration rules can be obtained based on the initial object identifier.

[0199] Optionally, the parameter parsing model includes multiple sub-parsing models that have an ordered arrangement.

[0200] The second acquisition module 402 mentioned above, when executing the process of obtaining target setting data based on configuration data and configuration rules, is used for:

[0201] Determine the current sub-model and its predecessor sub-model, where the current sub-model is the sub-analytical model that is currently in operation, and the predecessor sub-model is the sub-analytical model that precedes the current sub-model;

[0202] Obtain the commonly used parsing template and the preceding parsing result corresponding to the current sub-model, where the preceding parsing result is the output result of the preceding sub-model;

[0203] Based on the previous analysis results and commonly used analysis templates, the current analysis result is obtained, where the current analysis result is the output result of the current sub-model;

[0204] Based on the configuration rules and the current parsing results, the target setting data is obtained.

[0205] Optionally, the configuration data includes multiple sets of initial data labeled with rule types.

[0206] The second acquisition module 402 mentioned above, when executing the process of obtaining target setting data based on configuration data and configuration rules, is used for:

[0207] Based on the preset rule type, multiple first data with rule type labels are grouped to obtain multiple initial groups;

[0208] Obtain the target rule type, and based on the target rule type and multiple initial groups, obtain multiple target groups, where the target rule type can be obtained based on the configuration rules;

[0209] Based on preset parsing rules and multiple target groups, target setting data is obtained.

[0210] Optionally, the target setting data includes multiple setting rule groups, and the aforementioned device 40 further includes:

[0211] The parameter type validation module is used for:

[0212] Determine the rule group type corresponding to multiple rule groups, and obtain the current parameter type corresponding to each of the multiple rule groups;

[0213] Obtain the target parameter type corresponding to the rule type, and determine whether the current parameter type is qualified based on the target parameter type; if it is not qualified, trigger the second acquisition module 402 mentioned above.

[0214] Accordingly, the second acquisition module 402, when executing the process of obtaining target setting data based on configuration data and configuration rules, is used to:

[0215] Based on the target parameter type, the updated configuration data is obtained.

[0216] Optionally, the target setting data includes at least the location detection range and the time detection range. The analysis module 403, when determining the target object identifier based on the initial object identifier, the target setting data, and multiple first signaling commands, is used to:

[0217] When the time falls within the time detection range, multiple object identifier groups corresponding to each time moment are obtained. The object identifier group represents the detected object located within the location detection range.

[0218] Based on the object identifier group, an identifier control group is determined, wherein the identifier control group includes at least two object identifier groups that are adjacent in time.

[0219] Based on the identification control group, the target object identification is determined.

[0220] Optionally, the object management information includes multiple sub-management information. The generation module 404, when generating object management information based on the target object identifier, is used to:

[0221] Obtain the target group type corresponding to the target object identifier, and based on the target group type, obtain multiple target detection identifier groups;

[0222] Based on the target detection identifier, obtain the sub-management information corresponding to the target detection identifier group.

[0223] The signaling-based behavior detection device provided in this embodiment can execute the method provided in the above method embodiment. Its implementation principle and technical effect are similar, and will not be described in detail here.

[0224] It should be understood that the above-described device embodiments are merely illustrative, and the device of this application can also be implemented in other ways. For example, the division of units / modules in the above embodiments is only a logical functional division, and there may be other division methods in actual implementation. For example, multiple units, modules, or components may be combined, or integrated into another system, or some features may be ignored or not executed.

[0225] Furthermore, unless otherwise specified, the functional units / modules in the various embodiments of this application can be integrated into one unit / module, or each unit / module can exist physically separately, or two or more units / modules can be integrated together. The integrated units / modules described above can be implemented in hardware or as software program modules.

[0226] When an integrated unit / module is implemented in hardware, that hardware can be digital circuits, analog circuits, etc. The physical implementation of the hardware structure includes, but is not limited to, transistors, memristors, etc.

[0227] Figure 7 A schematic diagram of the structure of the electronic device provided in this application. Figure 7 As shown, the electronic device 50 provided in this embodiment includes at least one processor 501 and a memory 502. Optionally, the device 50 further includes a communication component 503. The processor 501, memory 502, and communication component 503 are connected via a bus 504.

[0228] In a specific implementation, at least one processor 501 executes computer execution instructions stored in memory 502, causing at least one processor 501 to perform the above-described method.

[0229] The specific implementation process of processor 501 can be found in the above method embodiments, and its implementation principle and technical effect are similar. It will not be repeated here.

[0230] Unless otherwise specified, processor 501 can be any suitable hardware processor, such as CPU, GPU, FPGA, DSP, and ASIC. Unless otherwise specified, memory 502 can be any suitable magnetic or magneto-optical storage medium, such as resistive random access memory (RRAM), dynamic random access memory (DRAM), static random access memory (SRAM), enhanced dynamic random access memory (EDRAM), high-bandwidth memory (HBM), hybrid memory cube (HMC), etc.

[0231] If the integrated unit / module is implemented as a software program module and sold or used as an independent product, it can be stored in a computer-readable storage device (CMD). Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a memory and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of this application. The aforementioned memory includes various media capable of storing program code, such as a USB flash drive, read-only memory (ROM), random access memory (RAM), portable hard drive, magnetic disk, or optical disk.

[0232] This application also provides a computer-readable storage medium storing computer-executable instructions. When a processor executes the computer-executable instructions, it implements the above-described method for updating redundant fields in a distributed system.

[0233] This application also provides a computer program product, including a computer program that, when executed by a processor, implements the above-described method for updating redundant fields in a distributed system.

[0234] In the above embodiments, the descriptions of each embodiment have their own emphasis. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments. The technical features of the above embodiments can be combined arbitrarily. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as these combinations of technical features do not contradict each other, they should be considered within the scope of this specification.

[0235] Other embodiments of this application will readily occur to those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of this application that follow the general principles of this application and include common knowledge or customary techniques in the art not disclosed herein. The specification and examples are to be considered exemplary only, and the true scope and spirit of this application are indicated by the following claims.

[0236] It should be understood that this application is not limited to the precise structure described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope. The scope of this application is limited only by the appended claims.

Claims

1. A method for signaling-based behavior detection, the method comprising: include: An initial object identifier is obtained, and based on the parameter parsing model, multiple first signaling messages corresponding to the initial object identifier are obtained. The initial object identifier represents a detected object that has not undergone behavior detection, and the first signaling messages are used to represent the online and offline behavior characteristics of the detected object. Obtain configuration data, wherein the configuration data is rule data generated based on configuration rules; Based on the configuration data and the configuration rules, target setting data is obtained, wherein the configuration rules can be obtained based on the initial object identifier, and the target setting data represents the judgment rules for abnormal behavior characteristics; Based on the initial object identifier, the target setting data, and the plurality of first signaling, a target object identifier is determined, wherein the target object identifier represents a target detection object that conforms to the determination rule; Based on the target object identifier, object management information is generated, wherein the object management information represents the behavior control method for the target detection object; The parameter parsing model includes multiple sub-parsing models arranged in an order. Based on the configuration data and the configuration rules, target setting data is obtained, including: Determine the current sub-model and its corresponding preceding sub-model, wherein the current sub-model is the sub-parse model that is currently in operation, and the preceding sub-model is the sub-parse model that precedes the current sub-model; Obtain the commonly used parsing template and the preceding parsing result corresponding to the current sub-model, wherein the preceding parsing result is the output result of the preceding sub-model; Based on the preceding parsing results and the commonly used parsing templates, the current parsing result is obtained, wherein the current parsing result is the output result of the current sub-model; Based on the configuration rules and the current parsing results, the target setting data is obtained.

2. The signaling-based behavior detection method of claim 1, wherein, The configuration data includes multiple sets of first data labeled with rule types. The step of obtaining the target setting data based on the configuration data and the configuration rules includes: Based on preset rule types, the multiple first data with rule type labels are grouped to obtain multiple initial groups; Obtain the target rule type, and based on the target rule type and the multiple initial groups, obtain multiple target groups, wherein the target rule type can be obtained based on the configuration rules; The target setting data is obtained based on the preset parsing rules and the multiple target groups.

3. The signaling-based behavior detection method of claim 2, wherein, The target setting data includes multiple sets of setting rules. Before obtaining the target setting data based on the configuration data and the configuration rules, the process also includes: Determine the rule group type corresponding to the plurality of set rule groups, and obtain the current parameter type corresponding to each of the plurality of set rule groups; Obtain the target parameter type corresponding to the rule type, and determine whether the current parameter type is qualified based on the target parameter type; Based on the configuration data and the configuration rules, the target setting data is obtained, including: If the result is unsatisfactory, updated configuration data will be obtained based on the target parameter type.

4. The signaling-based behavior detection method of claim 1, wherein, The target setting data includes at least the location detection range and the time detection range. Determining the target object identifier based on the initial object identifier, the target setting data, and the plurality of first signaling statements includes: When the time falls within the time detection range, multiple object identifier groups corresponding to each time moment are obtained, wherein the object identifier group represents the detected object located within the location detection range; Based on the object identifier group, an identifier control group is determined, wherein the identifier control group includes at least two object identifier groups that are adjacent in time. Based on the identified control group, the target object identifier is determined.

5. The signaling-based behavior detection method of claim 1, wherein, The object management information includes multiple sub-management information. Based on the target object identifier, object management information is generated, including: Obtain the target group type corresponding to the target object identifier, and obtain multiple target detection identifier groups based on the target group type; Based on the target detection identifier, the sub-management information corresponding to the target detection identifier group is obtained.

6. A signaling-based behavior detection apparatus, characterized by, include: The first acquisition module is used to acquire an initial object identifier and obtain multiple first signaling messages corresponding to the initial object identifier based on a parameter parsing model. The initial object identifier represents a detection object that has not undergone behavior detection, and the first signaling messages are used to represent the online behavior characteristics and offline behavior characteristics of the detection object. The second acquisition module is used to acquire configuration data and obtain target setting data based on the configuration data and configuration rules. The configuration data is rule data generated based on the configuration rules, the configuration rules can be obtained based on the initial object identifier, and the target setting data represents the judgment rules for abnormal behavior characteristics. The analysis module is used to determine the target object identifier based on the initial object identifier, the target setting data, and the plurality of first signaling, wherein the target object identifier represents a target detection object that conforms to the determination rule; The generation module is used to generate object management information based on the target object identifier, wherein the object management information represents the behavior control method for the target detection object; The parameter parsing model includes multiple sub-parsing models with an ordered arrangement. The second acquisition module, when executing the process of obtaining target setting data based on configuration data and configuration rules, specifically determines the current sub-model and its corresponding preceding sub-model, wherein the current sub-model is the currently working sub-parsing model, and the preceding sub-model is the sub-parsing model preceding the current sub-model; acquires the commonly used parsing template and preceding parsing results corresponding to the current sub-model, wherein the preceding parsing results are the output results of the preceding sub-model; obtains the current parsing result based on the preceding parsing results and the commonly used parsing template, wherein the current parsing result is the output result of the current sub-model; and obtains the target setting data based on the configuration rules and the current parsing result.

7. An electronic device, comprising: include: A processor, and a memory communicatively connected to the processor; The memory stores computer-executed instructions; The processor executes computer execution instructions stored in the memory to implement the method as described in any one of claims 1 to 5.

8. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-executable instructions, which, when executed by a processor, are used to implement the method as described in any one of claims 1 to 5.

9. A computer program product comprising a computer program that, when executed by a processor, implements the method of any one of claims 1 to 5.

Images