Crowd role identification method and device, equipment, storage medium and product

Abstract

The invention discloses a crowd role recognition method and device, equipment, a storage medium and a product, and relates to the technical field of data processing, and the crowd role recognition method comprises the steps: obtaining an access log of a client accessing a domain name system in a local area network; determining domain name access information of the client based on the access log; performing feature filtering according to the domain name access information to obtain target domain name access information; performing access score calculation based on the target domain name access information to obtain a domain name access score; and determining a crowd role of the client according to the domain name access score. As the behavior data is acquired by mining the access log of the DNS of the local area network, data does not need to be acquired from a plurality of data sources, the stability of the data is improved, and the conditions of label loss and the like caused by the fact that part of data is indeed are avoided. And meanwhile, crowd tag portraying is performed based on the DNS access log, the crowd role of each client is determined, and the cost required for data purchase, storage processing and the like is saved.

Description

Technical Field

[0001] The present application relates to the field of data processing technology, and in particular to methods, devices, equipment, storage media and products for crowd role recognition. Background Art

[0002] When profiling and grouping people, different types of data (such as static data such as age, gender, occupation, income, etc.) and dynamic behavior data (such as web access logs, shopping records, APP click behavior logs, etc.) are needed. By counting and filtering dynamic behavior data, such as frequently browsing electronic product review websites such as CSDN and liking to buy electronic products, labels such as electronic product enthusiasts and technical engineers are given. At the same time, combined with static data, such as age 25-35 years old, a youth label is given. Combine dynamic labels and static labels to finally determine IT engineers. The current crowd profiling process has many shortcomings. First of all, data from various sources is required, and these behavioral data need to be obtained through various means.

[0003] The traditional method of building a crowd portrait is to connect the data to build a unique ID after obtaining the data, and use various data analysis and statistical methods to build labels of different dimensions. The entire process is relatively complicated, and the time cost and data storage and processing cost are relatively high. In addition, due to the large number of data sources, some data is missing, resulting in the loss of labels, and even the inability to determine the unique ID. Summary of the invention

[0004] The main purpose of this application is to provide a crowd role recognition method, device, equipment, storage medium and product, aiming to solve the technical problems of the existing crowd portrait construction method, such as the difficulty in data acquisition, the multiple data sources, and the easy loss of labels.

[0005] To achieve the above objectives, the present application proposes a crowd role identification method, which includes:

[0006] Get the access log of the client accessing the domain name system in the LAN;

[0007] Determine domain name access information of the client based on the access log;

[0008] Perform feature filtering according to the domain name access information to obtain target domain name access information;

[0009] Calculate the access score based on the target domain name access information to obtain the domain name access score;

[0010] The population role of the client is determined according to the domain name access score.

[0011] In one embodiment, the domain name access information includes complete domain name access information and multi-level domain name access information; the step of determining the domain name access information of the client based on the access log includes:

[0012] Determine the full domain name access information of the client based on the access log;

[0013] The multi-level domain name access information of the client is determined according to the complete domain name access information.

[0014] In one embodiment, the step of performing feature filtering according to the domain name access information to obtain the target domain name access information includes:

[0015] Get static resource domain name filtering rules;

[0016] Filter the domain name access information based on the static domain name filtering rule to obtain first filtered domain name access information;

[0017] Perform feature scoring based on the first filtered domain name access information to obtain a first domain name score;

[0018] Filter the first filtered domain name access information according to the first domain name score to obtain second filtered domain name access information;

[0019] Filter the second filtering domain name access information according to the preset interference domain name information to obtain third filtering domain name access information;

[0020] The domain name access information in the third filtered domain name access information, whose domain name access times are lower than the preset access times and whose domain name classification is not in the preset domain name category, is filtered to obtain the target domain name access information.

[0021] In one embodiment, the step of performing feature scoring based on the first filtered domain name access information to obtain a first domain name score includes:

[0022] Determine the number of domain name accesses and multi-level domain name feature information of the client according to the first filtered domain name access information;

[0023] The first filtered domain name access information is scored based on the domain name access times and the multi-level domain name feature information to obtain a first domain name score.

[0024] In one embodiment, the step of calculating the access score based on the target domain name access information to obtain the domain name access score includes:

[0025] Determine request volume information, duration information, and popularity information based on the target domain name access information;

[0026] An access score is calculated for the target domain name access information based on the request volume information, the duration information, and the prevalence information to obtain a domain name access score.

[0027] In one embodiment, the step of obtaining the access log of accessing the domain name system in the local area network includes:

[0028] Capture the server target port traffic of the domain name system through the probe;

[0029] The server target port traffic is parsed according to the communication protocol of the domain name system to obtain an access log of a client in a local area network accessing the domain name system.

[0030] In addition, to achieve the above-mentioned purpose, the present application also proposes a crowd role recognition device, the crowd role recognition device comprising:

[0031] The log acquisition module is used to obtain the access log of the client accessing the domain name system in the local area network;

[0032] A log parsing module, used to determine the domain name access information of the client based on the access log;

[0033] A feature filtering module, used to perform feature filtering according to the domain name access information to obtain target domain name access information;

[0034] A domain name scoring module, used to calculate the access score based on the target domain name access information to obtain the domain name access score;

[0035] A portrait generation module is used to determine the population role of the client according to the domain name access score.

[0036] In addition, to achieve the above objectives, the present application also proposes a crowd role identification device, which includes: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the computer program is configured to implement the steps of the crowd role identification method described above.

[0037] In addition, to achieve the above-mentioned purpose, the present application also proposes a storage medium, which is a computer-readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by a processor, the steps of the crowd role recognition method described above are implemented.

[0038] In addition, to achieve the above-mentioned purpose, the present application also provides a computer program product, which includes a computer program, and when the computer program is executed by a processor, the steps of the crowd role identification method described above are implemented.

[0039] One or more technical solutions proposed in this application have at least the following technical effects:

[0040] This application obtains the access log of the client accessing the domain name system in the local area network; determines the domain name access information of the client based on the access log; performs feature filtering based on the domain name access information to obtain the target domain name access information; calculates the access score based on the target domain name access information to obtain the domain name access score; and determines the client's population role based on the domain name access score. Since the behavioral data is obtained by mining the DNS access log of the local area network, there is no need to obtain data from multiple data sources, which improves the stability of the data and avoids the loss of labels due to the fact that some data is actually lost. At the same time, based on the DNS access log, the population label profiling is performed to determine the population role of each client, eliminating the cost required for data purchase, storage and processing. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0042] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the following is a brief introduction to the drawings required for use in the embodiments or the description of the prior art. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0043] Figure 1 A flowchart of the first embodiment of the method for identifying a person's role in the present application;

[0044] Figure 2 A flow chart of the second embodiment of the method for identifying the roles of people provided by the present application;

[0045] Figure 3 A flowchart of the third embodiment of the method for identifying a person's role in the present application;

[0046] Figure 4 A schematic diagram of a working scenario in one implementation of the crowd role identification method of the present applicant;

[0047] Figure 5 This is a schematic diagram of the module structure of the crowd role recognition device according to an embodiment of the present application;

[0048] Figure 6 Schematic diagram of the device structure of the hardware operating environment involved in the crowd role identification method in the embodiment of the present application.

[0049] The purpose, features and advantages of this application will be further described in conjunction with the embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0050] It should be understood that the specific embodiments described herein are only used to explain the technical solutions of the present application and are not used to limit the present application.

[0051] In order to better understand the technical solution of the present application, a detailed description will be given below in conjunction with the accompanying drawings and specific implementation methods.

[0052] The main solution of the embodiment of the present application is: obtaining the access log of the client accessing the domain name system in the local area network; determining the domain name access information of the client based on the access log; performing feature filtering according to the domain name access information to obtain the target domain name access information; performing access score calculation based on the target domain name access information to obtain the domain name access score; determining the population role of the client according to the domain name access score.

[0053] At present, the existing technology collects behavioral data from various sources, and the data collection methods are complicated. At the same time, the traditional method of building user portraits is to connect the data to build a unique identification ID after obtaining these data, and to build labels of different dimensions through data analysis and statistical methods. The entire data processing process is relatively complicated, and the time cost and data storage and processing cost are relatively high. In addition, due to the complexity of data sources, the actual situation of some data leads to the loss of labels, and even the inability to determine the unique identification ID.

[0054] This application provides a solution that mines the local area network DNS data source, which is easy to obtain and does not require synchronization of relevant data from apps, websites, personnel systems, etc. Since this application uses the characteristics of DNS data to solve the problem of complex data sources and easy loss of labels, and combines DNS access records and domain name classification data to give a reasonable crowd label portrait, it saves the cost of data purchase, storage and processing, and improves the practicality of this application solution.

[0055] It should be noted that the execution subject of this embodiment can be a computing service device with data processing, network communication and program running functions, such as a computer, server, etc., or an electronic device, virtual device, etc. that can realize the above functions. The following takes a crowd role recognition device (referred to as recognition device) as an example to illustrate this embodiment and the following embodiments.

[0056] Based on this, the present application embodiment provides a method for identifying roles of a group of people, referring to Figure 1 , Figure 1 This is a flow chart of the first embodiment of the method for identifying group roles of the present application.

[0057] In this embodiment, the crowd role identification method includes steps S10 to S50:

[0058] Step S10, obtaining the access log of the client accessing the domain name system in the local area network;

[0059] It should be noted that the Domain Name System (DNS) is a core service of the Internet, which is used to map domain names and IP addresses to each other, so that users do not need to remember complex IP addresses, and can access network resources through domain names that are easier to remember.

[0060] In the embodiment of the present application, a probe can be added to the DNS server to capture the corresponding target port traffic and perform data parsing according to the DNS protocol. Specifically, the captured basic data packet of the port traffic contains the client IP, access time, specific domain name information accessed, and the content of the request response when each user initiates a request. That is, the step of obtaining the access log of accessing the domain name system in the local area network includes:

[0061] Capture the server target port traffic of the domain name system through the probe;

[0062] The server target port traffic is parsed according to the communication protocol of the domain name system to obtain an access log of a client in a local area network accessing the domain name system.

[0063] It is understandable that the server of the above domain name coefficient is also a DNS server. In the embodiment of the present application, the network traffic of the target port of the DNS server is monitored and captured by a probe, thereby obtaining the server target port traffic. By analyzing the server target port traffic, the access log of each user's client can be determined.

[0064] It should be understood that the communication protocol of the above-mentioned domain name system is also the DNS protocol. By parsing the server target port traffic according to the DNS protocol, the log of the user accessing the DNS in the local area network can be obtained.

[0065] In a specific implementation, in the embodiment of the present application, a probe is added to the DNS server to capture the corresponding target server port traffic and parse the captured target server port traffic according to the DNS protocol, thereby obtaining the access log of each user's client. Since the behavioral data for crowd role identification is obtained based on the access log of the domain name system, there is no need to obtain data from various sources, which improves the stability of data analysis.

[0066] Step S20, determining the domain name access information of the client based on the access log;

[0067] Step S30, performing feature filtering according to the domain name access information to obtain target domain name access information;

[0068] It should be noted that in the access log, the total number of visits and the number of occurrences of each client's IP to each fully qualified domain name (FQDN) can be counted to obtain the domain name access information of each client. By performing feature filtering on the domain name access information of each client, the target domain name access information of each client can be obtained.

[0069] It should be understood that feature filtering is a data processing technology used to filter domain name access information. It can analyze the features contained in the domain name access information and then filter out some domain name access information that is not related to the target domain name access information, thereby leaving the target domain name access information.

[0070] Step S40, calculating the access score based on the target domain name access information to obtain a domain name access score;

[0071] Step S50: determining the population role of the client according to the domain name access score.

[0072] It should be noted that when determining the target domain name access information, each domain name can be scored according to the number of domain name accesses, domain name access frequency, domain name type and other information in the target domain name access information to obtain a domain name access score, and then the population role of each client can be determined based on the access score of each client to each domain name.

[0073] It is understandable that the above-mentioned population roles, that is, the user identities corresponding to the user portraits, such as security practitioners, design practitioners, human resources personnel, marketing personnel, programmers, etc., are not limited to this in the embodiments of the present application.

[0074] The embodiment of the present application obtains the access log of the client accessing the domain name system in the local area network; determines the domain name access information of the client based on the access log; performs feature filtering based on the domain name access information to obtain the target domain name access information; calculates the access score based on the target domain name access information to obtain the domain name access score; and determines the client's population role based on the domain name access score. Since the behavioral data is obtained by mining the DNS access log of the local area network, there is no need to obtain data from multiple data sources, which improves the stability of the data and avoids the loss of labels due to the fact that some data is actually lost. At the same time, based on the DNS access log, the population label profiling is performed to determine the population role of each client, eliminating the cost required for data purchase, storage and processing.

[0075] Based on the first embodiment of the present application, in the second embodiment of the present application, the same or similar contents as those in the above-mentioned embodiment 1 can be referred to the above introduction, and will not be repeated in the following. Figure 2In an embodiment of the present application, the domain name access information includes complete domain name access information and multi-level domain name access information; the step of determining the domain name access information of the client based on the access log includes:

[0076] Step S21, determining the full domain name access information of the client based on the access log;

[0077] Step S22: determining the multi-level domain name access information of the client according to the complete domain name access information.

[0078] It should be noted that the above-mentioned multi-level domain names are also the second-level domain names and subdomain names of the full domain name.

[0079] It is understood that the full domain name described in the embodiments of the present application is also known as the fully qualified domain name, which can also be called the absolute domain name or absolute domain name, and is a domain name that can determine its position in the domain name system tree. The full domain name can be composed of a host name and a full path, in which all domain members in the sequence are listed, so that the location of the host in the network can be logically and accurately represented.

[0080] It should be noted that the total number of visits and the number of occurrences of each FQDN by each client IP are recorded in the access log, and the corresponding multi-level domain name is determined based on the FQDN. The record format is domain name, number of requests, total number of requests, and multi-level domain name. Specifically, when parsing the FQDN, the various levels of the domain name can be extracted according to the preset separator (such as the "."). Generally speaking, the top-level domain name is the part after the last dot, and the second-level domain name is the part before the second-to-last dot. When there are more multi-level domain names, you can continue to extract forward according to the separator to determine the client's multi-level domain name access information.

[0081] It is understandable that when the complete domain name access information and the multi-level domain name access information are determined, the domain name access information is further subjected to feature filtering. Specifically, the step of performing feature filtering according to the domain name access information to obtain the target domain name access information includes:

[0082] Get static resource domain name filtering rules;

[0083] Filter the domain name access information based on the static domain name filtering rule to obtain first filtered domain name access information;

[0084] Perform feature scoring based on the first filtered domain name access information to obtain a first domain name score;

[0085] Filter the first filtered domain name access information according to the first domain name score to obtain second filtered domain name access information;

[0086] Filter the second filtering domain name access information according to the preset interference domain name information to obtain third filtering domain name access information;

[0087] The domain name access information in the third filtered domain name access information, whose domain name access times are lower than the preset access times and whose domain name classification is not in the preset domain name category, is filtered to obtain the target domain name access information.

[0088] It should be noted that the domain name access information usually includes some common static resource domain name records, such as 'js', 'font', 'img', 'static', 'css', 'avatar', 'cdn', 'statistic', 'icon', 'pic', 'logo', 'ajax', 'images', etc., which are not limited in the present embodiment. In practical applications, these static resource domain names are usually not related to the user's access purpose, so they need to be filtered to obtain the first filtered domain name access information.

[0089] Furthermore, when obtaining the first filtered domain name access information, the number of domain name accesses, the number of access clients, the number of times the domain name appears together with other domain names, the number of subdomains under the domain name, the depth of multi-level domain names, and other characteristic information of all intranets within a preset time period (such as one week, three days, etc.) can be determined based on the first filtered domain name access information to score each complete domain name, thereby obtaining a score lower than the domain name score. The higher the number of visits, the more customer calls, and the more subdomains the complete domain name has, the higher the score will be. Specifically, the step of performing characteristic scoring based on the first filtered domain name access information to obtain the first domain name score includes:

[0090] Determine the number of domain name accesses and multi-level domain name feature information of the client according to the first filtered domain name access information;

[0091] The first filtered domain name access information is scored based on the domain name access times and the multi-level domain name feature information to obtain a first domain name score.

[0092] It should be noted that when determining the first domain name score of each complete domain name, the complete domain name score can be filtered according to the preset domain name score threshold. Specifically, when the first domain name score is greater than the preset domain name score, the corresponding complete domain name can be filtered, thereby excluding the frequently visited intranet domain names and heartbeat domain names, and obtaining the second filtered domain name access information.

[0093] It is understandable that the above domain name scoring threshold can be set according to the actual application situation, and the embodiment of the present application is not limited to this.

[0094] It should be noted that when obtaining the second filtering domain name access information, the complete domain name can be further purified based on the preset interference domain name information. Specifically, in practical applications, domain names such as anti-virus software, office software, front-end CDN, browser, social networking site, etc. usually have little relationship with the user's portrait features. The preset domain name interference information can be determined based on the features of these domain names, and then the preset domain name interference information contained in the second filtering domain name access information can be filtered.

[0095] In one implementation of the embodiment of the present application, interference from domain names including 'apple.com', 'wps.cn', 'gvt1.com', 'skype.com', 'gvt2.com', '360safe.com', 'gvt3.com', 'windowsupdate.com', 'googleapis.com', 'ntp.org', 'gpsonextra.net', 'icloud.com', 'verisign.com', 'cnzz.com', 'mozilla.com', 'jquery.com', etc. can be filtered out.

[0096] In one implementation method of an embodiment of the present application, WHOIS and ICP information of relevant domain names can be obtained based on the multi-level domain names of the second filtering domain name access information record, and relevant information can be supplemented through a public API, and domain names of companies such as 'Amazon Technologies, Inc.', 'Google LLC', 'Google LLC.', 'Qualcomm Inc.', 'Google Inc.', 'Microsoft Corporation', 'Adobe Inc', etc. in the registered names obtained can be removed, and the full domain names corresponding to these domain names can be removed.

[0097] It should be noted that, by filtering the second filtered domain name access information based on the preset interference domain name information, the third filtered domain name access information can be obtained.

[0098] Furthermore, in order to improve the accuracy of user portraits, the identification device can be set with a preset number of access times and a preset domain name category. For complete domain names whose domain name access times are lower than the preset number of access times and whose domain name classification is not in the preset domain name category, filtering can be performed to obtain the target domain name access information.

[0099] It should be noted that the above-mentioned preset number of visits can be set according to the needs of the actual application, such as 1 time, 3 times, etc., and the embodiment of the present application does not limit this. The above-mentioned preset domain name categories can be divided according to the attributes of the crowd in the actual application. For example, for the corresponding crowd attributes in the Internet company, there can be corresponding UI design categories, program design categories, personnel categories, etc., and the embodiment of the present application does not limit this.

[0100] In one implementation of the embodiment of the present application, the preset number of visits is set to 1, and the preset domain name categories may include: Computer_Security (security practitioners), Visual_Arts_and_Design (designers), Jobs_and_Career and Law_and_Government (HR / HRBP personnel), Graphics_Multimedia_and_Web_Design (marketing personnel), Programming_and_Developer_Software (programming personnel), etc. In this case, the records indicating that the number of visits is 1 and the domain name category is not in 'Computer_Security', 'Graphics_Multimedia_and_Web_Design', 'Jobs_and_Career', 'Reference_Materials', 'Law_and_Government', 'Programming_and_Developer_Software', 'Telecommunications', 'Banking_Credit_and_Lending', 'Finance', 'Investing', etc. can be removed.

[0101] The embodiment of the present application determines the full domain name access information of the client based on the access log; determines the multi-level domain name access information of the client based on the full domain name access information; performs feature filtering based on the domain name access information to obtain the target domain name access information. Since some interfering domain names and irrelevant domain names in the domain name access information are filtered out, the accuracy of user portrait recognition is improved.

[0102] Based on the first embodiment and / or the second embodiment of the present application, in the third embodiment of the present application, the same or similar contents as those of the above-mentioned first embodiment and / or the second embodiment can refer to the above introduction, and will not be repeated later. Figure 3 In an embodiment of the present application, the step of calculating the access score based on the target domain name access information to obtain the domain name access score includes:

[0103] Step S41, determining request volume information, duration information and popularity information based on the target domain name access information;

[0104] Step S42: Calculate the access score of the target domain name access information based on the request volume information, the duration information, and the popularity information to obtain a domain name access score.

[0105] It should be noted that, based on the target domain name access score information, the request volume information request_sum, duration information exists_count, and prevalence information of the domain name can be determined, and the access score of each complete domain name can be calculated based on the request volume information request_sum, duration information exists_count, and prevalence information, to obtain the domain name access score of each complete domain name. Specifically, the calculation formula can be as follows:

[0106] Score=log(1+request_sum)*(1+exists_count)) / (2+prevalence);

[0107] Among them, Score is the domain name access score, request_sum is the request volume information, exists is the duration information, and prevalence is the prevalence information.

[0108] It should be noted that the above-mentioned prevalence information is a parameter that characterizes the popularity, popularity and wide recognition of a domain name, and can be comprehensively evaluated through information such as search engine query volume, website statistical traffic, and domain name value. In the embodiment of the present application, the prevalence evaluation method for each complete domain name can be based on a deep learning algorithm or determined according to a preset prevalence table, and the embodiment of the present application does not limit this.

[0109] In an implementation of the embodiment of the present application, based on the domain name information of each complete domain name, its corresponding preset domain name category can be determined.

[0110] It should be noted that, based on the domain name access scores of each full domain name corresponding to the preset domain name category, the domain name category score of the client browsing the preset domain name category can be determined. Specifically, the score ranking of each preset domain name category can be constructed by indicators such as full domain name, preset domain name category, domain name access score, multi-level domain name, etc. Specifically, the calculation method of the domain name category score corresponding to the preset domain name category can be as follows:

[0111] category_score=score_sum*sld_cnt;

[0112] Among them, category_score is the domain name category score corresponding to the preset domain name category, score_sum is the sum of the domain name access scores of all complete domain names under the preset domain name category, and sld_cnt is the number of all non-repeating multi-level domain names under the preset domain name category.

[0113] It is understandable that by determining the domain name category score, the overall importance of the preset domain name category to the client can be reflected. The domain name access score of the complete domain name under the preset domain name category is combined to reflect the comprehensive importance of all domain names under the category. Multiplying it by the number of non-repeating multi-level domain names further emphasizes the number of unique domain names covered by the category, achieving a balance between quality and quantity. At the same time, the impact of a single high-scoring domain name on the preset domain name category is reduced.

[0114] In a specific implementation, for the domain name category scores corresponding to all preset domain name categories of each client, a preset number of preset domain name categories and their corresponding domain name category scores can be selected from high to low according to the scores, and the user label corresponding to the client can be determined based on these domain name categories, that is, the population role of the client can be determined.

[0115] It can be understood that the above preset number can be selected according to the needs of actual applications, such as 3, 5, etc., and the embodiment of the present application does not limit this.

[0116] In one implementation of the embodiment of the present application, the top three preset domain name categories in terms of domain name category scores may be selected. If the domain name category score of the first-ranked preset domain name category is much higher than the others, the user tag corresponding to the preset domain name category may be used as the population role of the client; if the domain name category scores are not much different, the user tags corresponding to the top three preset domain name categories may all be used as the population role of the client.

[0117] The embodiment of the present application determines the request volume information, duration information and prevalence information based on the target domain name access information; calculates the access score of the target domain name access information based on the request volume information, duration information and prevalence information to obtain the domain name access score. The present application improves the crowd portrait analysis method, and can quickly obtain crowd portraits using DNS log data, and conduct risk management of different behaviors of different groups of people in the local area network, so as to better protect users and assets in the local area network. The present invention mainly relies on DNS access data and domain name related data to determine the labels of user roles and portraits, and does not require detailed website access records of users. Most domain name data markets have public related data, which is easy to obtain. DNS is the basis of the network, and only probes need to be deployed, and the difficulty of obtaining is relatively low.

[0118] In one implementation of the embodiment of the present application, refer to Figure 4, the identification device in the present application may include a DNS log acquisition device, a data storage device, a data processing program and a label storage device;

[0119] In one embodiment, the DNS log acquisition device may be provided with a DNS probe module, which can monitor the target port of the DNS server through the DNS probe, and then obtain the server target port traffic. By parsing the server target port traffic, the DNS access log can be obtained.

[0120] In one embodiment, the DNS log acquisition device may be provided with a DNS mirror module, which may copy the data of the DNS server, thereby achieving the acquisition of the DNS access log.

[0121] In one embodiment, the DNS log acquisition device may be provided with a DNS log module, which may directly capture the DNS access log based on the DNS server configuration and log records.

[0122] In one implementation, the DNS log acquisition device may also acquire the DNS access log by other acquisition methods, which is not limited in this embodiment of the present application.

[0123] It is understandable that the DNS access log captured by the DNS log acquisition device can be transmitted to the data storage device for storage.

[0124] Furthermore, the data processing program can obtain the DNS access log from the data storage device, and determine the domain name access information of each client based on the DNS access log, and then perform feature filtering, access score calculation and other steps, thereby determining the label of each client (that is, the population role).

[0125] It is understandable that when the tag of each client is determined, the tag of each client can be stored by the tag storage device, thereby realizing the identification of the population role of each client in the local area network.

[0126] It should be understood that the local area network in the embodiment of the present application includes office areas and other terminal network areas, which can be connected to the DNS server through switches, respectively, so as to convert the domain name input by each client in each network area into an IP address, thereby realizing the network communication of the client. The identification device in the embodiment of the present application obtains and analyzes the access log of the DNS server, thereby realizing the identification of the crowd role of each client in the local area network, without the need to obtain behavioral data from multiple data sources, and improving the stability of label generation.

[0127] It should be noted that the above examples are only used to understand the present application and do not constitute a limitation on the crowd role identification method of the present application. More simple transformations based on this technical concept are all within the protection scope of the present application.

[0128] This application also provides a crowd role recognition device, please refer to Figure 5 , the crowd role identification device comprises:

[0129] The log acquisition module 10 is used to obtain the access log of the client accessing the domain name system in the local area network;

[0130] A log parsing module 20, configured to determine the domain name access information of the client based on the access log;

[0131] A feature filtering module 30, configured to perform feature filtering according to the domain name access information to obtain target domain name access information;

[0132] A domain name scoring module 40, configured to calculate an access score based on the target domain name access information to obtain a domain name access score;

[0133] The portrait generation module 50 is used to determine the population role of the client according to the domain name access score.

[0134] The crowd role recognition device provided by the present application adopts the crowd role recognition method in the above embodiment, which can solve the technical problems of the existing crowd portrait construction method, such as the difficulty in data acquisition and the multiple data sources, which easily lead to label loss. Compared with the prior art, the beneficial effects of the crowd role recognition device provided by the present application are the same as the beneficial effects of the crowd role recognition method provided by the above embodiment, and the other technical features in the crowd role recognition device are the same as the features disclosed in the above embodiment method, which will not be repeated here.

[0135] The present application provides a crowd role identification device, which includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the crowd role identification method in the above-mentioned embodiment 1.

[0136] Reference below Figure 6, which shows a schematic diagram of the structure of a crowd role recognition device suitable for implementing the embodiment of the present application. The crowd role recognition device in the embodiment of the present application may include but is not limited to mobile terminals such as mobile phones, laptop computers, digital broadcast receivers, PDAs (Personal Digital Assistants), PADs (Portable Application Descriptions), PMPs (Portable Media Players), vehicle-mounted terminals (such as vehicle-mounted navigation terminals), etc., and fixed terminals such as digital TVs, desktop computers, etc. Figure 6 The crowd role recognition device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0137] like Figure 6 As shown, the crowd role recognition device may include a processing device 1001 (e.g., a central processing unit, a graphics processor, etc.), which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM: Read Only Memory) 1002 or a program loaded from a storage device 1003 to a random access memory (RAM: Random Access Memory) 1004. In RAM1004, various programs and data required for the operation of the crowd role recognition device are also stored. The processing device 1001, ROM1002, and RAM1004 are connected to each other through a bus 1005. An input / output (I / O) interface 1006 is also connected to the bus. Generally, the following systems can be connected to the I / O interface 1006: an input device 1007 including, for example, a touch screen, a touch pad, a keyboard, a mouse, an image sensor, a microphone, an accelerometer, a gyroscope, etc.; an output device 1008 including, for example, a liquid crystal display (LCD: Liquid Crystal Display), a speaker, a vibrator, etc.; a storage device 1003 including, for example, a magnetic tape, a hard disk, etc.; and a communication device 1009. The communication device 1009 can allow the crowd role recognition device to communicate with other devices wirelessly or by wire to exchange data. Although the crowd role recognition device with various systems is shown in the figure, it should be understood that it is not required to implement or have all the systems shown. More or fewer systems can be implemented or have alternatively.

[0138] In particular, according to the embodiments disclosed in the present application, the process described above with reference to the flowchart can be implemented as a computer software program. For example, the embodiments disclosed in the present application include a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network through a communication device, or installed from a storage device 1003, or installed from a ROM 1002. When the computer program is executed by the processing device 1001, the above-mentioned functions defined in the method of the embodiment disclosed in the present application are executed.

[0139] The crowd role recognition device provided by the present application adopts the crowd role recognition method in the above embodiment, which can solve the technical problems of the existing crowd portrait construction method that data acquisition is difficult, there are many data sources, and labels are easily lost. Compared with the prior art, the beneficial effects of the crowd role recognition device provided by the present application are the same as the beneficial effects of the crowd role recognition method provided by the above embodiment, and other technical features in the crowd role recognition device are the same as the features disclosed in the method of the previous embodiment, which will not be repeated here.

[0140] It should be understood that the various parts disclosed in this application can be implemented by hardware, software, firmware or a combination thereof. In the description of the above embodiments, specific features, structures, materials or characteristics can be combined in any one or more embodiments or examples in a suitable manner.

[0141] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

[0142] The present application provides a computer-readable storage medium having computer-readable program instructions (ie, computer programs) stored thereon, and the computer-readable program instructions are used to execute the crowd role identification method in the above-mentioned embodiment.

[0143] The computer-readable storage medium provided in the present application may be, for example, a USB flash drive, but is not limited to electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, systems or devices, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In this embodiment, the computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, system or device. The program code contained on the computer-readable storage medium may be transmitted using any appropriate medium, including but not limited to: wires, optical cables, RF (Radio Frequency), etc., or any suitable combination of the above.

[0144] The computer-readable storage medium may be included in the crowd role recognition device; or may exist independently without being assembled into the crowd role recognition device.

[0145] The computer-readable storage medium carries one or more programs. When the one or more programs are executed by the crowd role recognition device, the crowd role recognition device:

[0146] Get the access log of the client accessing the domain name system in the LAN;

[0147] Determine domain name access information of the client based on the access log;

[0148] Perform feature filtering according to the domain name access information to obtain target domain name access information;

[0149] Calculate the access score based on the target domain name access information to obtain the domain name access score;

[0150] The population role of the client is determined according to the domain name access score.

[0151] Computer program code for performing the operations of the present application may be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, C++, and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0152] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present application. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0153] The modules involved in the embodiments described in this application may be implemented by software or hardware, wherein the name of the module does not constitute a limitation on the unit itself in some cases.

[0154] The readable storage medium provided by the present application is a computer-readable storage medium, which stores computer-readable program instructions (i.e., computer programs) for executing the above-mentioned crowd role identification method, and can solve the technical problems of the existing crowd portrait construction method that data acquisition is difficult, there are many data sources, and labels are easily lost. Compared with the prior art, the beneficial effects of the computer-readable storage medium provided by the present application are the same as the beneficial effects of the crowd role identification method provided by the above-mentioned embodiment, and will not be repeated here.

[0155] The present application also provides a computer program product, including a computer program, which implements the steps of the above-mentioned crowd role identification method when executed by a processor.

[0156] The computer program product provided by this application can solve the technical problems of the existing crowd portrait construction method, such as the difficulty in data acquisition and the multiple data sources, which easily lead to label loss. Compared with the prior art, the beneficial effects of the computer program product provided by this application are the same as those of the crowd role recognition method provided by the above embodiment, which will not be repeated here.

[0157] The above are only some embodiments of the present application, and the patent scope of the present application is not limited thereto. All equivalent structural changes made by using the contents of the present application specification and drawings under the technical concept of the present application, or directly / indirectly applied in other related technical fields are included in the patent protection scope of the present application.

Claims

1. A method for identifying crowd roles, It is characterized in that The method comprises: Get the access log of the client accessing the domain name system in the LAN; Determine domain name access information of the client based on the access log; Perform feature filtering according to the domain name access information to obtain target domain name access information; Calculate the access score based on the target domain name access information to obtain the domain name access score; The population role of the client is determined according to the domain name access score.

2. The method for identifying roles of a group of people as claimed in claim 1, It is characterized in that The domain name access information includes complete domain name access information and multi-level domain name access information; The step of determining the domain name access information of the client based on the access log includes: Determine the full domain name access information of the client based on the access log; The multi-level domain name access information of the client is determined according to the complete domain name access information.

3. The method for identifying roles of a group of people as claimed in claim 1, It is characterized in that The step of performing feature filtering according to the domain name access information to obtain the target domain name access information includes: Get static resource domain name filtering rules; Filter the domain name access information based on the static domain name filtering rule to obtain first filtered domain name access information; Perform feature scoring based on the first filtered domain name access information to obtain a first domain name score; Filter the first filtered domain name access information according to the first domain name score to obtain second filtered domain name access information; Filter the second filtering domain name access information according to the preset interference domain name information to obtain third filtering domain name access information; The domain name access information in the third filtered domain name access information, whose domain name access times are lower than the preset access times and whose domain name classification is not in the preset domain name category, is filtered to obtain the target domain name access information.

4. The method for identifying roles of a group of people as claimed in claim 3, It is characterized in that The step of performing feature scoring based on the first filtered domain name access information to obtain a first domain name score comprises: Determine the number of domain name accesses and multi-level domain name feature information of the client according to the first filtered domain name access information; The first filtered domain name access information is scored based on the domain name access times and the multi-level domain name feature information to obtain a first domain name score.

5. The method for identifying roles of a group of people as claimed in claim 1, It is characterized in that The step of calculating the access score based on the target domain name access information to obtain the domain name access score includes: Determine request volume information, duration information, and popularity information based on the target domain name access information; An access score is calculated for the target domain name access information based on the request volume information, the duration information, and the prevalence information to obtain a domain name access score.

6. The method for identifying roles of a group of people as claimed in claim 1, It is characterized in that The step of obtaining the access log of accessing the domain name system in the local area network includes: Capture the server target port traffic of the domain name system through the probe; The server target port traffic is parsed according to the communication protocol of the domain name system to obtain an access log of a client in a local area network accessing the domain name system.

7. A crowd role recognition device, It is characterized in that The crowd role identification device comprises: The log acquisition module is used to obtain the access log of the client accessing the domain name system in the local area network; A log parsing module, used to determine the domain name access information of the client based on the access log; A feature filtering module, used to perform feature filtering according to the domain name access information to obtain target domain name access information; A domain name scoring module, used to calculate the access score based on the target domain name access information to obtain the domain name access score; A portrait generation module is used to determine the population role of the client according to the domain name access score.

8. A crowd role recognition device, It is characterized in that The device comprises: a memory, a processor, and a crowd role identification program stored in the memory and executable on the processor, wherein the crowd role identification program is configured to implement the steps of the crowd role identification method according to any one of claims 1 to 6.

9. A storage medium, It is characterized in that The storage medium stores a crowd role identification program, and when the crowd role identification program is executed by the processor, the steps of the crowd role identification method according to any one of claims 1 to 6 are implemented.

10. A computer program product, It is characterized in that The computer program product comprises a computer program, and when the computer program is executed by a processor, the steps of the crowd role identification method according to any one of claims 1 to 6 are implemented.

Images