Internet advertisement false flow monitoring method and system, and medium

Abstract

The invention relates to the field of false flow monitoring, in particular to an internet advertisement false flow monitoring method and system and a medium. The method comprises the following steps: firstly, obtaining traffic data packets of an internet advertisement in different monitoring periods of each monitoring period, dividing the traffic data packets with the same access environment data of all fields in a target monitoring period into the same traffic class cluster, and according to the distribution of the access environment data of each field of each traffic data packet in the target monitoring period, obtaining the traffic data packets of the internet advertisement in the target monitoring period; obtaining a proportionality coefficient of the target traffic class cluster according to the access environment data of each field of the traffic data packets in the target traffic class cluster and the number of the traffic data packets having the same access environment data as the access environment data of each field of the traffic data packets in the target traffic class cluster in the target monitoring time period, and analyzing the difference of the proportionality coefficients of the traffic class clusters of the same type in the time sequence to obtain the false possibility of the traffic data packets; and performing false flow monitoring on the flow data packet through the constructed decision tree in combination with the false possibility. According to the invention, the false traffic of the internet advertisement can be accurately monitored.

Description

Technical Field

[0001] The present invention relates to the field of false traffic monitoring, and in particular to a method, system and medium for monitoring false traffic of Internet advertisements. Background Art

[0002] Fake traffic in Internet advertising refers to clicks, displays or interactions generated by unnatural or deceptive means. These behaviors usually come from automated programs. This type of traffic does not bring actual user attention or conversions, but instead creates false advertising interaction data to obtain advertising revenue or other improper benefits. Therefore, in order to improve the authenticity and accuracy of advertising effects and reduce unfair transactions caused by fake traffic, it is necessary to monitor fake traffic in Internet advertising.

[0003] In the related technology, machine learning technology is usually used to identify and monitor false traffic of Internet advertisements. However, since the amount of false traffic of Internet advertisements is usually large and the types are diverse, and some false traffic is slightly different from normal traffic, the existing methods are unable to accurately monitor the false traffic of Internet advertisements. Summary of the invention

[0004] In order to solve the technical problem that the existing methods cannot accurately monitor the false traffic of Internet advertisements, the purpose of the present invention is to provide a method, system and medium for monitoring the false traffic of Internet advertisements. The technical solutions adopted are as follows: The present invention proposes a method for monitoring false traffic of Internet advertisements, the method comprising: Acquire multiple traffic data packets of Internet advertisements in different monitoring periods of each monitoring cycle within a preset time period, wherein the traffic data packets include access environment data of different fields; Taking any monitoring cycle as the target monitoring cycle, taking any monitoring period in the target monitoring cycle as the target monitoring period, classifying the traffic data packets with the same access environment data in all fields in the target monitoring period into one category, and obtaining different types of traffic clusters in the target monitoring period; taking any traffic cluster in the target monitoring period as the target traffic cluster; obtaining the proportional coefficient of the target traffic cluster according to the distribution of access environment data of each field of each traffic data packet in the target monitoring period, and the number of traffic data packets with the same access environment data of each field as the traffic data packets in the target traffic cluster in the target monitoring period; According to the difference in the proportional coefficients between the same type of traffic clusters in the same monitoring period of different monitoring cycles, and the number of traffic data packets in the same monitoring period of different monitoring cycles, the initial falsehood of the target traffic cluster is obtained; according to the initial falsehood of the same type of traffic clusters in different monitoring periods in the target monitoring cycle, the real falsehood of the target traffic cluster is obtained; based on the real falsehood, the false possibility of each traffic data packet in a preset time period is obtained; All traffic data packets in a preset time period are labeled and trained to construct multiple decision trees; a false score for each traffic data packet is obtained based on the false possibility of each traffic data packet and the prediction result of each decision tree for each traffic data packet; and false traffic monitoring is performed on each traffic data packet based on the false score.

[0005] Furthermore, the ratio coefficient of the target traffic cluster is obtained including: Taking any field as the target field, filtering out characteristic traffic data packets about the target field in the target monitoring period from all traffic data packets in the target monitoring period, wherein the access environment data of the target field of the characteristic traffic data packets are the same as the access environment data of the target field of the traffic data packets in the target traffic cluster; taking the number of characteristic traffic data packets about the target field in the target monitoring period as the numerator, taking the number of all traffic data packets in the target monitoring period as the denominator, and taking the ratio as the initial proportion parameter of the target monitoring period about the target field; Divide the traffic data packets with the same access environment data of the target field in the target monitoring period into the same set to obtain multiple traffic sets about the target field in the target monitoring period; negatively correlate the variance of the number of traffic data packets in all the traffic sets about the target field in the target monitoring period to obtain the traffic distribution uniformity about the target field in the target monitoring period; synthesize and normalize the number of traffic sets about the target field in the target monitoring period and the traffic distribution uniformity to obtain the weight parameter about the target field in the target monitoring period; The weight parameter of each field in the target monitoring period is used to perform weighted summation on the initial proportion parameter of each field in the target monitoring period to obtain the proportion coefficient of the target traffic cluster.

[0006] Furthermore, obtaining the initial falseness of the target traffic cluster includes: In each monitoring period other than the target monitoring period within the preset time period, a monitoring period is selected as a reference monitoring period of each other monitoring period, and the position of the reference monitoring period in each other monitoring period is the same as the position of the target monitoring period in the target monitoring period; a traffic cluster is selected from each reference monitoring period as a reference traffic cluster of each reference monitoring period, and the type of the reference traffic cluster is the same as the type of the target traffic cluster; The absolute value of the difference between the target traffic cluster and the reference traffic cluster in each reference monitoring period is used as the difference value of the proportionality coefficient in each reference monitoring period; The number of traffic data packets in each reference monitoring period is used as the numerator, the average number of traffic data packets in all reference monitoring periods is used as the denominator, and the comparison value is negatively correlated and normalized to obtain the confidence parameter of each reference monitoring period; The confidence parameter of each reference monitoring period is used to perform weighted summation on the proportional coefficient difference values ​​of each reference monitoring period to obtain the initial falsehood of the target traffic cluster.

[0007] Furthermore, obtaining the true falsehood of the target traffic cluster includes: In the target monitoring period, a traffic cluster is selected from each other monitoring period except the target monitoring period as a control traffic cluster for each other monitoring period, and the type of the control traffic cluster is the same as the type of the target traffic cluster; Any other monitoring period except the target monitoring period within the target monitoring cycle is used as the monitoring period to be tested, and the minimum value among the initial falseness of the control flow cluster of other monitoring periods between the target monitoring period and the monitoring period to be tested, the initial falseness of the target flow cluster and the initial falseness of the control flow cluster of the monitoring period to be tested is used as the false factor of the monitoring period to be tested; The false factor of the monitoring period to be tested and the initial false degree of the control traffic cluster of the monitoring period to be tested are combined to obtain a continuous false index of the monitoring period to be tested; The accumulated value of the continuous false indicators in all other monitoring periods except the target monitoring period within the target monitoring cycle is used as the true falsehood degree of the target traffic cluster.

[0008] Further, obtaining the false possibility of each traffic data packet within a preset time period includes: For any monitoring period of any monitoring cycle within the preset time period, the true falsehood degree of each traffic cluster is used as the falsehood possibility of each traffic data packet in each traffic cluster.

[0009] Furthermore, the labeling and training of all traffic data packets in a preset time period to construct multiple decision trees includes: Manually label each traffic data packet in a preset time period to obtain manual labeling information of each traffic data packet, wherein the labeling information is divided into false traffic labeling and normal traffic labeling; The random forest algorithm is used to train all traffic data packets with manually labeled information in a preset time period to construct multiple decision trees.

[0010] Further, obtaining the false score of each traffic data packet includes: Input the false possibility of all traffic data packets within a preset time period into the Otsu threshold segmentation algorithm to obtain the optimal segmentation threshold for the preset time period; Performing negative correlation normalization processing on the absolute value of the difference between the false possibility of each traffic data packet and the optimal segmentation threshold to obtain an analysis weight of each traffic data packet; Take any decision tree as the target decision tree, input each traffic data packet into the target decision tree, obtain the predicted labeling information of each traffic data packet by the target decision tree, take the traffic data packet with the same predicted labeling information as the manually labeled information as the traffic data packet to be tested, normalize the accumulated values ​​of the analysis weights of all the traffic data packets to be tested, and obtain the decision confidence of the target decision tree; Any traffic data packet within the preset time period is taken as the target traffic data packet. If the predicted labeling information of the target traffic data packet by each decision tree is a false traffic label, each decision tree is taken as the decision tree to be tested for the target traffic data packet, and the average value of the decision confidence of all the decision trees to be tested is taken as the false score of the target traffic data packet.

[0011] Further, the performing false traffic monitoring on each traffic data packet based on the false score includes: The traffic data packet whose false score is greater than a preset false threshold is regarded as a false traffic data packet.

[0012] The present invention also proposes a system for monitoring false traffic of Internet advertisements, the system comprising: A data collection module, used to obtain a plurality of traffic data packets of Internet advertisements in different monitoring periods of each monitoring cycle within a preset time period, wherein the traffic data packets include access environment data of different fields; The first analysis module is used to take any monitoring cycle as a target monitoring cycle, take any monitoring period in the target monitoring cycle as a target monitoring period, classify the traffic data packets with the same access environment data in all fields in the target monitoring period into one category, and obtain different types of traffic clusters in the target monitoring period; take any traffic cluster in the target monitoring period as a target traffic cluster; obtain the proportion coefficient of the target traffic cluster according to the distribution of access environment data of each field of each traffic data packet in the target monitoring period, and the number of traffic data packets with the same access environment data of each field as the traffic data packets in the target traffic cluster in the target monitoring period; The second analysis module is used to obtain the initial falsehood of the target traffic cluster according to the difference in the proportional coefficients between the same type of traffic clusters in the same monitoring period of different monitoring cycles and the number of traffic data packets in the same monitoring period of different monitoring cycles; obtain the real falsehood of the target traffic cluster according to the initial falsehood of the same type of traffic clusters in different monitoring periods in the target monitoring cycle; and obtain the false possibility of each traffic data packet in a preset time period based on the real falsehood; The false monitoring module is used to label and train all traffic data packets in a preset time period and construct multiple decision trees; obtain the false score of each traffic data packet based on the false possibility of each traffic data packet and the prediction result of each decision tree for each traffic data packet; and perform false traffic monitoring on each traffic data packet based on the false score.

[0013] The present invention also proposes a computer medium, which includes a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, it implements any step of a method for monitoring false traffic of Internet advertisements.

[0014] The present invention has the following beneficial effects: The present invention takes into account that the existing machine learning algorithms are unable to accurately monitor the false traffic of Internet advertisements, and therefore first obtains multiple traffic data packets of different monitoring time periods of each monitoring cycle within a preset time period, and takes into account that the false traffic is generally generated from the same proxy server or device group, and the access environment data of each field thereof are similar, and therefore firstly divides the traffic data packets with the same access environment data of all fields within the target monitoring period into the same traffic cluster, and subsequently analyzes the characteristic differences in the timing of the same type of traffic clusters, and accurately calculates the false possibility of the traffic data packets, and takes into account that the amount of false traffic is generally large, and the proportion thereof in the target monitoring period is large, and the access environment data of each field are relatively similar, and therefore the proportional coefficient can be used to reflect the amount of traffic in the target monitoring period that is similar to the access environment of the target traffic cluster. Based on the proportion of false data packets, the initial falseness of the target traffic cluster can be accurately analyzed based on the difference in the proportional coefficients of the same type of traffic clusters in time series. Considering that the proportional coefficients of the same type of false traffic clusters and normal traffic clusters in the same monitoring period of different monitoring cycles are quite different, and the possibility of the existence of normal traffic clusters in the monitoring period with fewer traffic data packets is greater, the initial falseness can be used to preliminarily reflect the possibility that the traffic data packets contained in the target traffic cluster are false traffic, and the true falseness can be used to accurately reflect the possibility that the traffic data packets contained in the target traffic cluster are false traffic. Then, by constructing a decision tree and monitoring the false traffic of each traffic data packet based on the false possibility of each traffic data packet, the accuracy of monitoring the false traffic of Internet advertising is improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] In order to more clearly illustrate the technical solutions and advantages in the embodiments of the present invention or the prior art, the drawings required for use in the embodiments or the prior art descriptions are briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0016] Figure 1 A flow chart of a method for monitoring false traffic of Internet advertisements provided by an embodiment of the present invention; Figure 2 A block diagram of a system for monitoring false traffic of Internet advertisements provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0017] In order to further explain the technical means and effects adopted by the present invention to achieve the predetermined invention purpose, the following is a detailed description of the Internet advertising false traffic monitoring method, system and medium proposed by the present invention, its specific implementation method, structure, characteristics and effects, in combination with the accompanying drawings and preferred embodiments. In the following description, different "one embodiment" or "another embodiment" does not necessarily refer to the same embodiment. In addition, specific features, structures or characteristics in one or more embodiments may be combined in any suitable form.

[0018] Unless defined otherwise, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention belongs.

[0019] The following is a detailed description of a method, system and medium for monitoring false traffic of Internet advertisements provided by the present invention in conjunction with the accompanying drawings.

[0020] See also Figure 1 , which shows a flow chart of a method for monitoring false traffic of Internet advertisements provided by an embodiment of the present invention, the method comprising: Step S1: Acquire multiple traffic data packets of Internet advertisements in different monitoring periods of each monitoring cycle within a preset time period, where the traffic data packets include access environment data of different fields.

[0021] When a user uses an electronic device such as a mobile phone or computer to click on an Internet advertisement on a browser, the mobile phone or computer will generate and send a corresponding traffic data packet to the server. The traffic data packet usually contains multiple different fields such as IP address, device type, operating system and browser, which are used to record the access environment data of the client when the user accesses Internet advertisements. The IP address represents the network address information of the electronic device used by the user, usually expressed in dotted decimal form. The device type represents the type of electronic device used by the user, including mobile phones, computers and tablets. The operating system represents the type and version of the operating system of the electronic device used by the user, including Windows 7, Windows 10 and Android 11. The browser represents the type and version of the browser used by the user when accessing Internet advertisements, including Chrome 93.0, Firefox 90.0 and Safari 14.0. In other words, the access environment data in the same field of different traffic data packets may be the same or different.

[0022] Therefore, the embodiment of the present invention first uses a packet capture tool such as Wireshark or Tcpdump to obtain multiple traffic data packets of Internet advertisements in different monitoring time periods of each monitoring cycle within a preset time period, and uses the packet capture tool to analyze the access environment data of each field of each traffic packet. In one embodiment of the present invention, the preset time period is set to 7 days, the monitoring cycle is set to 1 day, and the monitoring period is set to 1 hour. That is to say, within 7 days, the traffic data packets within each hour of each day are obtained, wherein the specific values ​​of the preset time period, monitoring cycle and monitoring period can also be set by the implementer according to the specific implementation scenario, which is not limited here.

[0023] Step S2: Take any monitoring cycle as the target monitoring cycle, take any monitoring period in the target monitoring cycle as the target monitoring period, classify the traffic data packets with the same access environment data of all fields in the target monitoring period into one category, and obtain different types of traffic clusters in the target monitoring period; take any traffic cluster in the target monitoring period as the target traffic cluster; obtain the proportional coefficient of the target traffic cluster according to the distribution of access environment data of each field of each traffic data packet in the target monitoring period, and the number of traffic data packets with the same access environment data of each field as the traffic data packets in the target traffic cluster in the target monitoring period.

[0024] The embodiment of the present invention first analyzes multiple traffic data packets in any monitoring time period in any monitoring cycle, takes any monitoring cycle as the target monitoring cycle, and takes any monitoring time period in the target monitoring cycle as the target monitoring time period. The subsequent analysis method for other monitoring time periods in the target monitoring cycle and monitoring time periods in other monitoring cycles is the same as the analysis method for the target monitoring time period. Considering that false traffic is generally generated from a proxy server or device group with the same access environment, resulting in similarity in the access environment data of each field of different false traffic, the traffic data packets with the same access environment data of all fields in the target monitoring time period can be first divided into one category to obtain different types of traffic clusters in the target monitoring time period, and any type of traffic cluster in the target monitoring time period can be taken as the target traffic cluster. Subsequently, based on the characteristic differences in the timing of traffic clusters of the same type, the falsity of the target traffic cluster can be accurately analyzed to improve the accuracy of false traffic monitoring.

[0025] It should be noted that the same fields of different traffic data packets in a traffic cluster have the same access environment data. Therefore, the type of a traffic cluster depends on the access environment data of each field of the traffic data packets it contains. For example, one traffic cluster contains multiple traffic data packets with an IP address of 192.168.1.10, a device type of mobile phone, an operating system of Windows 7, and a browser of Chrome 93.0, while another traffic cluster contains multiple traffic data packets with an IP address of 192.168.1.10, a device type of mobile phone, an operating system of Windows 10, and a browser of Chrome 93.0. Then these two traffic clusters are of different types.

[0026] Since fake traffic is usually generated by non-natural swiping means using a proxy server or device group with the same access environment, the access environment data of each field of different fake traffic is relatively similar, and the amount of fake traffic is large, resulting in a large proportion of fake traffic packets with similar access environment data in each field in the target monitoring period. Therefore, if the traffic data packets contained in the target traffic cluster are fake traffic, then in the target monitoring period, the number of traffic data packets with the same access environment data of each field as the traffic data packets in the target traffic cluster accounts for a large proportion. Therefore, the number of traffic data packets with the same access environment data of each field as the traffic data packets in the target traffic cluster in the target monitoring period can be analyzed, and combined with the distribution of access environment data of each field of each traffic data packet in the target monitoring period, the proportion of traffic data packets with similar access environment to the target traffic cluster in the target monitoring period can be reflected through the obtained proportional coefficient. Subsequently, based on the difference in proportional coefficients of traffic clusters of the same type in timing, the initial falsehood of the target traffic cluster can be accurately analyzed.

[0027] Preferably, in one embodiment of the present invention, the method for obtaining the proportional coefficient of the target traffic cluster specifically includes: First, any field is taken as the target field, and characteristic traffic data packets about the target field in the target monitoring period are screened out from all traffic data packets in the target monitoring period, wherein the access environment data of the target field of the characteristic traffic data packet is the same as the access environment data of the target field of the traffic data packets in the target traffic cluster. For example, if the target field is the device type field, and the device type of the traffic data packets in the target traffic cluster is a mobile phone, then the traffic data packets with the device type of the mobile phone in the target monitoring period are taken as the characteristic traffic data packets about the target field in the target monitoring period; then, the number of characteristic traffic data packets about the target field in the target monitoring period is taken as the numerator, and the number of all traffic data packets in the target monitoring period is taken as the denominator, and the ratio is taken as the initial proportion parameter of the target monitoring period about the target field. The larger the initial proportion parameter is, the more traffic data packets with the same access environment data of the target field as the traffic data packets in the target traffic cluster are in the target monitoring period, and then the proportion of traffic data packets with access environments similar to those of the traffic data packets in the target traffic cluster is larger.

[0028] Since false traffic is distinguished to different degrees in different fields, the traffic data packets with the same access environment data of the target field in the target monitoring period can be divided into the same set to obtain multiple traffic sets about the target field in the target monitoring period. The more consistent the distribution of the number of traffic data packets in each traffic set and the more traffic sets there are, the easier it is to distinguish the false traffic in the target monitoring period in the target field. Therefore, the variance of the number of traffic data packets in all traffic sets about the target field in the target monitoring period can be negatively correlated to obtain the uniformity of traffic distribution about the target field in the target monitoring period. The number of traffic sets and the uniformity of traffic distribution about the target field in the target monitoring period are integrated and normalized to obtain the weight parameter of the target monitoring period about the target field. Subsequently, the accuracy of calculating the proportional coefficient of the target traffic cluster can be improved based on the weight parameter.

[0029] In the embodiment of the present invention, the combination of the two can be achieved by calculating the sum or product of the number of traffic sets and the traffic distribution uniformity of the target field in the target monitoring period, which is not limited here.

[0030] In one embodiment of the present invention, the normalization processing can be specifically, for example, maximum and minimum value normalization processing, and the normalization in subsequent steps can all adopt maximum and minimum value normalization processing. In other embodiments of the present invention, other normalization methods can be selected according to the specific range of numerical values, which will not be described in detail.

[0031] The same method as above can be used to obtain the weight parameters and initial proportion parameters of each field in the target monitoring period. Then, the weight parameters of each field in the target monitoring period can be used to perform weighted summation on the initial proportion parameters of each field in the target monitoring period to obtain the proportion coefficient of the target traffic cluster.

[0032] As an example, in one embodiment of the present invention, the expression of the proportional coefficient of the target traffic cluster may be specifically, for example, as follows: in, represents the proportionality factor of the target traffic cluster; Indicates the target monitoring period about The weight parameter of each field; Indicates the target monitoring period about The number of characteristic traffic packets in each field; Indicates the number of all traffic packets within the target monitoring period; Indicates the target monitoring period about The initial scale parameter of the field; Indicates the target monitoring period about The number of traffic sets for each field; Indicates the target monitoring period about The variance of the number of flow packets in all flow sets of the field; Indicates the target monitoring period about The uniformity of traffic distribution in each field; represents the normalization function; Indicates the preset adjustment parameters, The value range is In one embodiment of the present invention, Set to 0.01, The specific value of can also be set by the implementer according to the specific implementation scenario and is not limited here.

[0033] It should be noted that in other embodiments of the present invention, negative correlation mapping may be achieved through other basic mathematical operations, which will not be elaborated herein.

[0034] The proportional coefficient of each traffic cluster in each monitoring period of each monitoring cycle can be obtained by the same method as above.

[0035] Step S3: According to the difference in proportional coefficients between the same type of traffic clusters in the same monitoring period of different monitoring cycles, and the number of traffic data packets in the same monitoring period of different monitoring cycles, the initial falsehood of the target traffic cluster is obtained; according to the initial falsehood of the same type of traffic clusters in different monitoring periods in the target monitoring cycle, the real falsehood of the target traffic cluster is obtained; based on the real falsehood, the false possibility of each traffic data packet in the preset time period is obtained.

[0036] Because in the same monitoring period of different monitoring cycles, the greater the difference in the proportional coefficients of the same type of traffic clusters, the more likely it is false traffic. At the same time, the difference in the proportional coefficients between the same type of false traffic clusters and normal traffic clusters is large, and the possibility of the existence of normal traffic clusters in the monitoring period with fewer traffic data packets is greater. Therefore, the embodiment of the present invention analyzes the differences in proportional coefficients between the same type of traffic clusters in the same monitoring period of different monitoring cycles, and at the same time, combines the number of traffic data packets in the same monitoring period of different monitoring cycles to preliminarily reflect the possibility that the traffic data packets contained in the target traffic cluster are false traffic through the obtained initial falseness. Subsequently, based on the initial falseness, the falseness of the target traffic cluster can be further analyzed to improve the accuracy of false monitoring.

[0037] Preferably, in one embodiment of the present invention, the method for obtaining the initial falseness of the target traffic cluster specifically includes: Firstly, a monitoring period is selected from each other monitoring period except the target monitoring period within a preset time period as a reference monitoring period for each other monitoring period, and the position of the reference monitoring period in each other monitoring period is the same as the position of the target monitoring period in the target monitoring period; a traffic cluster is selected from each reference monitoring period as a reference traffic cluster for each reference monitoring period, and the type of the reference traffic cluster is the same as the type of the target traffic cluster.

[0038] Then, the absolute value of the difference in the proportional coefficient between the target traffic cluster and the reference traffic cluster in each reference monitoring period is taken as the proportional coefficient difference value of each reference monitoring period. The larger the proportional coefficient difference value, the greater the difference in the proportional coefficient between the target traffic cluster and the reference traffic cluster in each reference monitoring period, which means that the traffic data packets in the target traffic cluster are more likely to be false traffic.

[0039] From the above analysis, it can be seen that the difference in proportionality coefficients between the same type of false traffic clusters and normal traffic clusters is more obvious. Therefore, if the traffic data packets contained in the target traffic cluster are false traffic, the difference in proportionality coefficient between it and the same type of normal traffic cluster is greater. The fewer the number of traffic data packets, the greater the possibility of the existence of normal traffic clusters in the monitoring period. Therefore, the number of traffic data packets in each reference monitoring period can be used as the numerator, and the average number of traffic data packets in all reference monitoring periods can be used as the denominator. The comparison value is negatively correlated and normalized to obtain the confidence parameter of each reference monitoring period. The larger the confidence parameter, the more likely it is that a normal traffic cluster exists in each reference monitoring period, and further the reference traffic cluster in the reference monitoring period is more likely to be a normal traffic cluster. The confidence parameter can be used later to improve the calculation accuracy of the initial falseness of the target traffic cluster.

[0040] In one embodiment of the present invention, the natural constant The negative exponential function with the base value is used to realize the normalization of negative correlation, and the natural constant can be used in the subsequent steps. A negative exponential function with α as the base realizes the normalization of negative correlation.

[0041] Then, the confidence parameter of each reference monitoring period is used to perform weighted summation on the difference value of the proportional coefficient of each reference monitoring period to obtain the initial falseness of the target traffic cluster.

[0042] As an example, in one embodiment of the present invention, the expression of the initial falseness of the target traffic cluster may be specifically, for example, as follows: in, represents the initial falseness of the target traffic cluster; Indicates confidence parameters for a reference monitoring period; represents the proportionality factor of the target traffic cluster; Indicates The proportionality coefficient of the reference traffic clusters for the reference monitoring period; Indicates The difference value of the proportionality coefficient for each reference monitoring period; represents the number of reference monitoring periods; Indicates The number of traffic packets in a reference monitoring period; represents the average value of the number of traffic packets in all reference monitoring periods; Indicated by natural constant An exponential function with base .

[0043] The initial falseness of each traffic cluster in each monitoring period of each monitoring cycle can be obtained by the same method as above.

[0044] The initial falseness of false traffic clusters is high, and because the virtual traffic is continuously refreshed, the high initial falseness of false traffic clusters is stable in time series. That is to say, the initial falseness of the same type of false traffic clusters in different monitoring periods within the same detection cycle is high. Therefore, the initial falseness of the same type of traffic clusters in different monitoring periods in the target monitoring cycle can be analyzed. The actual falseness obtained can accurately reflect the possibility that the traffic data packets contained in the target traffic cluster are false traffic, thereby improving the accuracy of subsequent false traffic monitoring.

[0045] Preferably, in one embodiment of the present invention, the method for obtaining the authenticity of the target traffic cluster specifically includes: First, within the target monitoring cycle, a traffic cluster is selected from each other monitoring period except the target monitoring period as the control traffic cluster for each other monitoring period, wherein the type of the control traffic cluster is the same as the type of the target traffic cluster.

[0046] Then, any other monitoring period except the target monitoring period within the target monitoring cycle is taken as the monitoring period to be tested, and the minimum value among the initial falsehood of the control traffic cluster of other monitoring periods between the target monitoring period and the monitoring period to be tested, the initial falsehood of the target traffic cluster and the initial falsehood of the control traffic cluster of the monitoring period to be tested is taken as the falsehood factor of the monitoring period to be tested, and then the falsehood factor of the monitoring period to be tested and the initial falsehood of the control traffic cluster of the monitoring period to be tested are combined to obtain a continuous falsehood index of the monitoring period to be tested. The larger the continuous falsehood index is, the higher the initial falsehood of the control traffic cluster of the monitoring period between the target monitoring period and the monitoring period to be tested is, which means that the traffic data packets in the target traffic cluster are more likely to be false traffic.

[0047] It should be noted that if there is no other monitoring period between the target monitoring period and the monitoring period to be tested, the minimum value of the initial falseness of the target traffic cluster and the initial falseness of the control traffic cluster in the monitoring period to be tested needs to be used as the falseness factor of the monitoring period to be tested.

[0048] In an embodiment of the present invention, the sum or product of the false factor of the monitoring period to be tested and the initial false degree of the control traffic cluster of the monitoring period to be tested can be used as a continuous false indicator of the monitoring period to be tested to achieve a combination of the two, which is not limited here.

[0049] The same method as above can be used to obtain the continuous false indicators of all other monitoring periods except the target monitoring period within the target monitoring cycle, and then the accumulated value of the continuous false indicators of all other monitoring periods except the target monitoring period within the target monitoring cycle can be used as the true falseness of the target traffic cluster.

[0050] As an example, in one embodiment of the present invention, the expression of the true falsehood of the target traffic cluster may be specifically, for example, as follows: in, Indicates the true falsehood of the target traffic cluster; Indicates the target monitoring period except the target monitoring period. False factors for other monitoring periods; Indicates the target monitoring period except the target monitoring period. The initial falsehood of the control traffic clusters in other monitoring periods; Indicates the target monitoring period except the target monitoring period. Continuous false indicators of control traffic clusters in other monitoring periods; Indicates the number of monitoring periods other than the target monitoring period within the target monitoring period.

[0051] The same method as above can be used to obtain the true falsehood of each traffic cluster in each monitoring period of each monitoring cycle. The true falsehood is used to reflect the possibility that the traffic data packet in the traffic cluster is false traffic. Therefore, based on the true falsehood of the traffic cluster, the false possibility of each traffic data packet in the preset time period can be obtained. Subsequently, based on the false possibility of each traffic data packet and combined with the decision tree, false traffic monitoring can be performed on each traffic data packet.

[0052] Preferably, in one embodiment of the present invention, the method for obtaining the false possibility of each traffic data packet within a preset time period specifically includes: For any monitoring period of any monitoring cycle within the preset time period, the true falsehood of each traffic cluster is used as the false possibility of each traffic data packet in each traffic cluster, so as to obtain the false possibility of each traffic data packet within the preset time period.

[0053] Step S4: All traffic data packets in a preset time period are labeled and trained to construct multiple decision trees; based on the false possibility of each traffic data packet and the prediction results of each decision tree for each traffic data packet, a false score of each traffic data packet is obtained; based on the false score, false traffic monitoring is performed on each traffic data packet.

[0054] In existing methods, machine learning algorithms are usually used, such as by building a decision tree, to identify and monitor false traffic of Internet advertisements. Therefore, the embodiment of the present invention first labels and trains all traffic data packets in a preset time period, builds multiple decision trees, and then uses the predictive performance of the decision trees, combined with the false possibility of each traffic data packet, to accurately monitor the false traffic of the traffic data packets.

[0055] Preferably, in one embodiment of the present invention, the method for constructing multiple decision trees specifically includes: Each traffic data packet in a preset time period is manually labeled to obtain the manually labeled information of each traffic data packet, so as to preliminarily distinguish the false traffic and normal traffic in the traffic data packet, wherein the labeled information is divided into false traffic labeling and normal traffic labeling. In one embodiment of the present invention, a value 1 can be used to represent a false traffic labeling, and a value 0 can be used to represent a normal traffic labeling. The random forest algorithm is used to train all traffic data packets with manually labeled information in the preset time period to construct multiple decision trees, wherein the random forest algorithm is a technical means well known to those skilled in the art and will not be elaborated here.

[0056] Because when manually labeling traffic data packets, only traffic data packets with obvious false traffic characteristics or normal traffic characteristics can be distinguished, and traffic data packets with unclear false traffic characteristics or normal traffic characteristics cannot be distinguished, errors occur in manual labeling, which in turn causes the decision tree to be unable to accurately judge whether the traffic data packet is false traffic. Therefore, the embodiment of the present invention obtains a false score for each traffic data packet based on the false possibility of each traffic data packet and the prediction result of each decision tree for each traffic data packet. The false score accurately reflects the possibility that each traffic data packet is false traffic. Subsequently, based on the false score, false traffic can be accurately monitored, thereby improving the accuracy of monitoring false traffic of Internet advertisements.

[0057] Preferably, in one embodiment of the present invention, the method for obtaining the false score of each traffic data packet specifically includes: First, the false possibility of all traffic data packets within a preset time period is input into the Otsu threshold segmentation algorithm to obtain the optimal segmentation threshold for the preset time period. The smaller the difference between the false possibility of the traffic data packet and the optimal segmentation threshold, the more difficult it is for manual labeling to accurately distinguish between false traffic and normal traffic. Therefore, the absolute value of the difference between the false possibility of each traffic data packet and the optimal segmentation threshold can be negatively correlated and normalized to obtain the analysis weight of each traffic data packet. Subsequently, the decision confidence of each decision tree can be accurately calculated based on the analysis weight. Among them, the Otsu threshold segmentation algorithm is a technical means well known to technical personnel in this field and will not be elaborated here.

[0058] As an example, in one embodiment of the present invention, the expression of the analysis weight of each traffic data packet may be specifically, for example, as follows: in, Indicates the first The analysis weight of each traffic data packet; Indicates the first The possibility of false traffic packets; Indicates the optimal segmentation threshold for a preset time period; Indicated by natural constant An exponential function with base .

[0059] Then, any decision tree is taken as the target decision tree, and each traffic data packet is input into the target decision tree to obtain the predicted labeling information of the target decision tree for each traffic data packet. For traffic data packets with higher analysis weights, if the predicted labeling information of the target decision tree for the traffic data packet is the same as the manual labeling information, it means that the decision effect of the target decision tree is better and the contribution weight to the final decision is greater. Therefore, the traffic data packets with the same predicted labeling information and manual labeling information can be used as the traffic data packets to be tested, and the accumulated values ​​of the analysis weights of all the traffic data packets to be tested are normalized to obtain the decision confidence of the target decision tree. Subsequently, the false score of each traffic data packet can be accurately calculated based on the decision confidence of the decision tree.

[0060] As an example, in one embodiment of the present invention, the expression of the decision confidence of the target decision tree may be specifically, for example, as follows: in, Represents the decision confidence of the target decision tree; Indicates The analysis weight of the traffic data packets to be tested; represents the normalization function; Indicates the number of traffic packets to be tested.

[0061] The decision confidence of each decision tree can be obtained by the same method as above.

[0062] Finally, any traffic data packet within the preset time period is taken as the target traffic data packet. If the predicted labeling information of the target traffic data packet by each decision tree is a false traffic label, each decision tree is taken as the decision tree to be tested for the target traffic data packet. In other words, the target traffic data packet predicted by the decision tree to be tested is a false traffic. However, due to the different decision effects of different decision trees to be tested, the average value of the decision confidence of all decision trees to be tested can be taken as the false score of the target traffic data packet.

[0063] As an example, in one embodiment of the present invention, the expression of the false score of the target traffic data packet may be specifically, for example, as follows: in, Indicates the false score of the target traffic data packet, the value range is ; Indicates The decision confidence of the decision tree to be tested; Represents the number of decision trees to be tested.

[0064] The same method as above can be used to obtain the false score of each traffic data packet within the preset time period. The larger the false score, the greater the possibility that the traffic data packet is false traffic. Therefore, based on the false score, false traffic monitoring can be performed on each traffic data packet to improve the accuracy of false traffic monitoring of Internet advertisements.

[0065] Preferably, in one embodiment of the present invention, a traffic data packet whose false score is greater than a preset false threshold is regarded as a false traffic data packet, wherein the preset false threshold is set to 0.5, and the specific value of the preset false threshold can also be set by the implementer according to the specific implementation scenario, which is not limited here.

[0066] An embodiment of the present invention provides a system for monitoring false traffic of Internet advertisements. Figure 2 , which shows a block diagram of an Internet advertising false traffic monitoring system provided by an embodiment of the present invention, the system comprising: The data collection module is used to obtain multiple traffic data packets of Internet advertisements in different monitoring periods of each monitoring cycle within a preset time period, and the traffic data packets include access environment data of different fields.

[0067] The first analysis module is used to take any monitoring cycle as the target monitoring cycle, any monitoring period in the target monitoring cycle as the target monitoring period, classify the traffic data packets with the same access environment data in all fields in the target monitoring period into one category, and obtain different types of traffic clusters in the target monitoring period; take any traffic cluster in the target monitoring period as the target traffic cluster; and obtain the proportion coefficient of the target traffic cluster based on the distribution of access environment data of each field of each traffic data packet in the target monitoring period and the number of traffic data packets with the same access environment data for each field as the traffic data packets in the target traffic cluster in the target monitoring period.

[0068] The second analysis module is used to obtain the initial falsehood of the target traffic cluster based on the difference in proportional coefficients between the same type of traffic clusters in the same monitoring period of different monitoring cycles, and the number of traffic data packets in the same monitoring period of different monitoring cycles; obtain the true falsehood of the target traffic cluster based on the initial falsehood of the same type of traffic clusters in different monitoring periods in the target monitoring cycle; and obtain the false possibility of each traffic data packet within a preset time period based on the true falsehood.

[0069] The false monitoring module is used to label and train all traffic data packets in a preset time period and construct multiple decision trees; obtain the false score of each traffic data packet based on the false possibility of each traffic data packet and the prediction result of each decision tree for each traffic data packet; and perform false traffic monitoring on each traffic data packet based on the false score.

[0070] The present invention further proposes a computer medium, the medium comprising a memory and a processor, wherein the memory stores a computer program, and the processor can implement the method described in steps S1 to S4 when executing the computer program.

[0071] It should be noted that the sequence of the above embodiments of the present invention is only for description and does not represent the advantages and disadvantages of the embodiments. The processes depicted in the accompanying drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0072] The various embodiments in this specification are described in a progressive manner, and the same or similar parts between the various embodiments can be referenced to each other, and each embodiment focuses on the differences from other embodiments.

Claims

1. A method for monitoring false traffic of Internet advertisements, characterized in that: The method comprises: Acquire multiple traffic data packets of Internet advertisements in different monitoring periods of each monitoring cycle within a preset time period, wherein the traffic data packets include access environment data of different fields; Taking any monitoring cycle as the target monitoring cycle, taking any monitoring period in the target monitoring cycle as the target monitoring period, classifying the traffic data packets with the same access environment data in all fields in the target monitoring period into one category, and obtaining different types of traffic clusters in the target monitoring period; taking any traffic cluster in the target monitoring period as the target traffic cluster; obtaining the proportional coefficient of the target traffic cluster according to the distribution of access environment data of each field of each traffic data packet in the target monitoring period, and the number of traffic data packets with the same access environment data of each field as the traffic data packets in the target traffic cluster in the target monitoring period; According to the difference in the proportional coefficients between the same type of traffic clusters in the same monitoring period of different monitoring cycles, and the number of traffic data packets in the same monitoring period of different monitoring cycles, the initial falsehood of the target traffic cluster is obtained; according to the initial falsehood of the same type of traffic clusters in different monitoring periods in the target monitoring cycle, the real falsehood of the target traffic cluster is obtained; based on the real falsehood, the false possibility of each traffic data packet in a preset time period is obtained; All traffic data packets in a preset time period are labeled and trained to construct multiple decision trees; a false score for each traffic data packet is obtained based on the false possibility of each traffic data packet and the prediction result of each decision tree for each traffic data packet; and false traffic monitoring is performed on each traffic data packet based on the false score.

2. A method for monitoring false traffic of Internet advertisements according to claim 1, characterized in that: The ratio coefficient of obtaining the target traffic cluster includes: Taking any field as the target field, filtering out characteristic traffic data packets about the target field in the target monitoring period from all traffic data packets in the target monitoring period, wherein the access environment data of the target field of the characteristic traffic data packets are the same as the access environment data of the target field of the traffic data packets in the target traffic cluster; taking the number of characteristic traffic data packets about the target field in the target monitoring period as the numerator, taking the number of all traffic data packets in the target monitoring period as the denominator, and taking the ratio as the initial proportion parameter of the target monitoring period about the target field; Divide the traffic data packets with the same access environment data of the target field in the target monitoring period into the same set to obtain multiple traffic sets about the target field in the target monitoring period; negatively correlate the variance of the number of traffic data packets in all the traffic sets about the target field in the target monitoring period to obtain the traffic distribution uniformity about the target field in the target monitoring period; synthesize and normalize the number of traffic sets about the target field in the target monitoring period and the traffic distribution uniformity to obtain the weight parameter about the target field in the target monitoring period; The weight parameter of each field in the target monitoring period is used to perform weighted summation on the initial proportion parameter of each field in the target monitoring period to obtain the proportion coefficient of the target traffic cluster.

3. The method for monitoring false traffic of Internet advertisements according to claim 1, characterized in that: The step of obtaining the initial falseness of the target traffic cluster includes: In each monitoring period other than the target monitoring period within the preset time period, a monitoring period is selected as a reference monitoring period of each other monitoring period, and the position of the reference monitoring period in each other monitoring period is the same as the position of the target monitoring period in the target monitoring period; a traffic cluster is selected from each reference monitoring period as a reference traffic cluster of each reference monitoring period, and the type of the reference traffic cluster is the same as the type of the target traffic cluster; The absolute value of the difference between the target traffic cluster and the reference traffic cluster in each reference monitoring period is used as the difference value of the proportionality coefficient in each reference monitoring period; The number of traffic data packets in each reference monitoring period is used as the numerator, the average number of traffic data packets in all reference monitoring periods is used as the denominator, and the comparison value is negatively correlated and normalized to obtain the confidence parameter of each reference monitoring period; The confidence parameter of each reference monitoring period is used to perform weighted summation on the proportional coefficient difference values ​​of each reference monitoring period to obtain the initial falsehood of the target traffic cluster.

4. The method for monitoring false traffic of Internet advertisements according to claim 1, characterized in that: The method of obtaining the true falsehood of the target traffic cluster includes: In the target monitoring period, a traffic cluster is selected from each other monitoring period except the target monitoring period as a control traffic cluster for each other monitoring period, and the type of the control traffic cluster is the same as the type of the target traffic cluster; Any other monitoring period except the target monitoring period within the target monitoring cycle is used as the monitoring period to be tested, and the minimum value among the initial falseness of the control flow cluster of other monitoring periods between the target monitoring period and the monitoring period to be tested, the initial falseness of the target flow cluster and the initial falseness of the control flow cluster of the monitoring period to be tested is used as the false factor of the monitoring period to be tested; The false factor of the monitoring period to be tested and the initial false degree of the control traffic cluster of the monitoring period to be tested are combined to obtain a continuous false index of the monitoring period to be tested; The accumulated value of the continuous false indicators in all other monitoring periods except the target monitoring period within the target monitoring cycle is used as the true falsehood degree of the target traffic cluster.

5. The method for monitoring false traffic of Internet advertisements according to claim 1, characterized in that: The false possibility of obtaining each traffic data packet within the preset time period includes: For any monitoring period of any monitoring cycle within the preset time period, the true falsehood degree of each traffic cluster is used as the falsehood possibility of each traffic data packet in each traffic cluster.

6. The method for monitoring false traffic of Internet advertisements according to claim 1, characterized in that: The labeling and training of all traffic data packets in a preset time period to construct multiple decision trees includes: Manually label each traffic data packet in a preset time period to obtain manual labeling information of each traffic data packet, wherein the labeling information is divided into false traffic labeling and normal traffic labeling; The random forest algorithm is used to train all traffic data packets with manually labeled information in a preset time period to construct multiple decision trees.

7. The method for monitoring false traffic of Internet advertisements according to claim 6, characterized in that: The method of obtaining a false score for each traffic data packet includes: Inputting the false possibility of all traffic data packets within a preset time period into the Otsu threshold segmentation algorithm to obtain the optimal segmentation threshold for the preset time period; Performing negative correlation normalization processing on the absolute value of the difference between the false possibility of each traffic data packet and the optimal segmentation threshold to obtain an analysis weight of each traffic data packet; Take any decision tree as the target decision tree, input each traffic data packet into the target decision tree, obtain the predicted labeling information of each traffic data packet by the target decision tree, take the traffic data packet with the same predicted labeling information as the manually labeled information as the traffic data packet to be tested, normalize the accumulated values ​​of the analysis weights of all the traffic data packets to be tested, and obtain the decision confidence of the target decision tree; Any traffic data packet within the preset time period is taken as the target traffic data packet. If the predicted labeling information of the target traffic data packet by each decision tree is a false traffic label, each decision tree is taken as the decision tree to be tested for the target traffic data packet, and the average value of the decision confidence of all the decision trees to be tested is taken as the false score of the target traffic data packet.

8. The method for monitoring false traffic of Internet advertisements according to claim 1, characterized in that: The performing false traffic monitoring on each traffic data packet based on the false score includes: The traffic data packet whose false score is greater than a preset false threshold is regarded as a false traffic data packet.

9. A system for monitoring false traffic of Internet advertisements, characterized in that: The system comprises: A data collection module, used to obtain a plurality of traffic data packets of Internet advertisements in different monitoring periods of each monitoring cycle within a preset time period, wherein the traffic data packets include access environment data of different fields; The first analysis module is used to take any monitoring cycle as a target monitoring cycle, take any monitoring period in the target monitoring cycle as a target monitoring period, classify the traffic data packets with the same access environment data in all fields in the target monitoring period into one category, and obtain different types of traffic clusters in the target monitoring period; take any traffic cluster in the target monitoring period as a target traffic cluster; obtain the proportion coefficient of the target traffic cluster according to the distribution of access environment data of each field of each traffic data packet in the target monitoring period, and the number of traffic data packets with the same access environment data of each field as the traffic data packets in the target traffic cluster in the target monitoring period; The second analysis module is used to obtain the initial falsehood of the target traffic cluster according to the difference in the proportional coefficients between the same type of traffic clusters in the same monitoring period of different monitoring cycles and the number of traffic data packets in the same monitoring period of different monitoring cycles; obtain the real falsehood of the target traffic cluster according to the initial falsehood of the same type of traffic clusters in different monitoring periods in the target monitoring cycle; and obtain the false possibility of each traffic data packet in a preset time period based on the real falsehood; The false monitoring module is used to label and train all traffic data packets in a preset time period and construct multiple decision trees; obtain the false score of each traffic data packet based on the false possibility of each traffic data packet and the prediction result of each decision tree for each traffic data packet; and perform false traffic monitoring on each traffic data packet based on the false score.

10. A computer medium, comprising a memory and a processor, wherein the memory stores a computer program, characterized in that: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 8 are implemented.

Images