Method, device and equipment for system anomaly detection and storage medium

Abstract

The invention relates to the technical field of system anomaly detection, and discloses a system anomaly detection method, device and equipment and a storage medium, the method comprises the following steps: scene data corresponding to each system scene in a system use process is acquired, and the scene data comprises time data, a user identifier and user behavior data corresponding to the user identifier; integrating the scene data based on the time dimension represented by the time data to obtain a data link; and based on the user identifier, the user behavior data and the data link, judging whether a target user represented by the user identifier has target user behavior data within a preset time in the data link, and based on a judgment result, judging whether an abnormal condition exists in the system. Therefore, in the operation process of the system, the data stream or the user behavior in the system is monitored, the abnormity in the operation process of the system can be reasonably and accurately detected, and the safety and the stability of the system are improved.

Description

Technical Field

[0001] The present invention relates to the technical field of system anomaly detection, and in particular to a method, device, equipment and storage medium for system anomaly detection. Background Art

[0002] Anomaly detection is the process of identifying events or observations that do not conform to the expected pattern during system operation. If anomalies during system operation cannot be accurately identified, the security and stability of the system will be low. Summary of the invention

[0003] In view of this, the present invention provides a method, apparatus, device and storage medium for system anomaly detection to solve the problem that anomalies during system operation cannot be accurately identified, resulting in low security and stability of the system.

[0004] In a first aspect, the present invention provides a method for detecting system anomalies, the method comprising: obtaining scenario data corresponding to each system scenario during system use, the scenario data comprising: time data, a user identifier, and user behavior data corresponding to the user identifier; integrating the scenario data based on a time dimension represented by the time data to obtain a data link; based on the user identifier, the user behavior data and the data link, determining in the data link whether a target user represented by the user identifier has target user behavior data within a preset time, and determining whether the system has an abnormal situation based on the determination result.

[0005] In an optional embodiment, the scene data are integrated based on the time dimension represented by the time data to obtain a data link, including: sorting the scene data based on the time order represented by the time data; combining the sorted scene data to obtain the data link, wherein the scene data triggered by each system scene are associated based on the data link.

[0006] In an optional embodiment, based on the user identifier, the user behavior data and the data link, it is determined whether there is target user behavior data for the target user represented by the user identifier in the data link within a preset time, and based on the determination result, it is determined whether there is an abnormal situation in the system, including: based on the user identifier, intercepting and combining to obtain a target data link corresponding to the user identifier; obtaining the target user behavior data based on historical system scenario data; based on whether there is target user behavior data in the target data link within the preset time; or, whether the target user behavior data meets preset requirements, determining whether there is an abnormal situation in the system.

[0007] In an optional embodiment, whether the target user behavior data meets preset requirements and whether the system is in an abnormal situation includes: in the target data link, if the target user behavior data represents: the target user enters a first system scenario interface at a first time and leaves the first system scenario interface at a third time; and the target user enters a second system scenario interface at a second time, it is determined that the system is in an abnormal situation; wherein the first time is less than the second time and the third time, the second time is less than the third time, the system scenario includes the first system scenario interface and the second system scenario interface, the first system scenario interface is different from the second system scenario interface, and the target user cannot enter the first system scenario interface and the second system scenario interface at the same time.

[0008] In an optional embodiment, whether the target user behavior data meets preset requirements and whether the system has an abnormal situation further includes: in the target data link, if there is third target user behavior data at the sixth time, and there is no fourth target user behavior data after the sixth time, it is determined that the system has an abnormal situation; wherein the target user behavior data includes the third target user behavior data and the fourth target user behavior data, and the third target user behavior data and the fourth target user behavior data are different.

[0009] In an optional embodiment, judging whether the system has an abnormal situation based on whether the target user behavior data exists in the target data link within the preset time also includes: in the target data link, if first target user behavior data exists at a fourth time, and second target user behavior data exists at a fifth time, and the time difference between the fifth time and the fourth time is greater than a preset duration, it is judged that the system has an abnormal situation; wherein the fourth time is less than the fifth time, the target user behavior data includes the first target user behavior data and the second target user behavior data, the first target user behavior data is different from the second target user behavior data, and the first target user behavior data is associated with the second target user behavior data.

[0010] In an optional embodiment, the aforementioned method for system anomaly detection further includes preprocessing the scene data and integrating the time dimension based on the processed scene data, wherein the preprocessing includes cleaning and standardizing the scene data, the cleaning includes deleting duplicate data in the scene data, and the standardization includes deleting data in the cleaned scene data that does not comply with preset rules.

[0011] In a second aspect, the present invention provides a device for system anomaly detection, the device comprising: an acquisition module for acquiring scene data corresponding to each scene during the use of the system, the scene data comprising: time data, a user identifier and user behavior data corresponding to the user identifier; an integration module for integrating the scene data based on the time dimension represented by the time data to obtain a data link; and a judgment module for judging, based on the user identifier, the user behavior data and the data link, whether the target user represented by the user identifier in the data link has target user behavior data within a preset time, and judging whether the system has an abnormal situation based on the judgment result.

[0012] In a third aspect, the present invention provides a computer device, comprising: a memory and a processor, the memory and the processor being communicatively connected to each other, the memory storing computer instructions, and the processor executing the method for system anomaly detection of the above-mentioned first aspect or any corresponding embodiment thereof by executing the computer instructions.

[0013] In a fourth aspect, the present invention provides a computer-readable storage medium having computer instructions stored thereon, the computer instructions being used to enable a computer to execute the method for system anomaly detection of the above-mentioned first aspect or any corresponding embodiment thereof.

[0014] In a fifth aspect, the present invention provides a computer program product, comprising computer instructions for causing a computer to execute the method for system anomaly detection according to the first aspect or any corresponding embodiment thereof.

[0015] Acquire the scenario data corresponding to each scenario during the use of the system, establish a data link based on the scenario data, integrate and associate the scenario data triggered at different times during the use of the system, and facilitate the detection of system anomalies. Based on the user identifier, user behavior data and data link, determine whether the target user represented by the user identifier performs certain operations within a period of time, and then determine whether the system is abnormal. In this way, by monitoring the data flow or user behavior in the system during the operation of the system, anomalies in the operation of the system can be reasonably and accurately detected, thereby improving the security and stability of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] In order to more clearly illustrate the specific embodiments of the present invention or the technical solutions in the related technologies, the drawings required for use in the specific embodiments or the related technical descriptions will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0017] Figure 1 A schematic diagram of a process for detecting system anomalies provided by an embodiment of the present invention is shown;

[0018] Figure 2 A schematic flow chart showing another method for detecting system anomalies according to an embodiment of the present invention is shown;

[0019] Figure 3 A schematic flow chart showing another method for detecting system anomalies according to an embodiment of the present invention is shown;

[0020] Figure 4 A schematic diagram showing the structure of a device for system anomaly detection according to an embodiment of the present invention is shown;

[0021] Figure 5 It is a schematic diagram of the hardware structure of a computer device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0022] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present invention.

[0023] According to an embodiment of the present invention, a method embodiment for system anomaly detection is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0024] In this embodiment, a method for detecting system anomalies is provided, which can be used in a mobile terminal, such as a mobile phone, a laptop computer, or a tablet computer, or a terminal with an operating system. Figure 1 A schematic diagram of a process for detecting system anomalies provided by an embodiment of the present invention is shown. Figure 1 As shown, the process includes the following steps:

[0025] Step S101, obtaining scene data corresponding to each scene during the use of the system, wherein the scene data includes: time data, a user identifier, and user behavior data corresponding to the user identifier.

[0026] In this step, the various scenarios during the use of the system may be scenarios such as a user logging into the system, a user logging out of the system, a user entering the system homepage, a user logging out of the system homepage, a user entering the system introduction page, or a user logging out of the system introduction page. Specifically, it may be a scenario experienced by a user when using a system function, such as a scenario where a user enters the system login page, or a scenario where a user clicks a system login button to log in, or a scenario where a user enters the logout page, or a scenario where a user clicks a logout button to log out, etc.

[0027] The user identifier is a unique identifier (ID) representing the user.

[0028] The user behavior data includes data triggered by the target user represented by the target user identifier in the above scenarios. When the target user represented by the target user identifier enters the system login page, the obtained user behavior data is the login page, or the obtained user behavior data is the code corresponding to the login page.

[0029] Step S103, integrating the scene data based on the time dimension represented by the time data to obtain a data link.

[0030] In this step, time data may be extracted from the scene data, the time data format may be unified, and the scene data may be sorted based on the unified time data to obtain a data link.

[0031] Step S105, based on the user identifier, user behavior data and data link, determine whether the target user represented by the user identifier in the data link has target user behavior data within a preset time, and determine whether the system has an abnormal situation based on the determination result.

[0032] In this step, in the data link, if the target user behavior data exists within the preset time, it is determined that there is no abnormality in the system; if the target user behavior data does not exist within the preset time, it is determined that there is an abnormality in the system.

[0033] The method for system anomaly detection provided in this embodiment obtains scenario data corresponding to each scenario during the use of the system, establishes a data link based on the scenario data, integrates and associates the scenario data triggered at different times during the use of the system, and facilitates the detection of system anomalies. Based on the user identifier, user behavior data and data link, it is determined whether the target user represented by the user identifier performs certain operations within a period of time, and then determines whether the system is abnormal. In this way, by monitoring the data flow or user behavior in the system during the operation of the system, anomalies in the operation of the system can be reasonably and accurately detected, thereby improving the security and stability of the system.

[0034] In this embodiment, a method for detecting system anomalies is provided, which can be used in the above-mentioned mobile terminals, such as mobile phones, laptop computers or tablet computers, etc. Figure 2 A flow chart of another method for detecting system anomalies according to an embodiment of the present invention is shown. Figure 2 As shown, the process includes the following steps:

[0035] Step S201, obtaining scene data corresponding to each scene during the use of the system, the scene data includes: time data, user identifier and user behavior data corresponding to the user identifier. For details, please refer to Figure 1 Step S101 of the illustrated embodiment will not be described in detail here.

[0036] Step S203, integrating the scene data based on the time dimension represented by the time data to obtain a data link.

[0037] Specifically, the above step S203 includes:

[0038] Step S2031, sorting the scene data based on the time sequence represented by the time data.

[0039] In this step, time data is extracted from each scene data. The time data may exist in different formats, such as a date timestamp YYYY-MM-DD HH:MM, a timestamp representing the number of seconds or milliseconds since a specific time point, or other custom formats. If the time data exists in different formats, the time data can be unified into the same format, for example, by converting the time data into a standard timestamp format for comparison and sorting. Sorting the scene data based on the time data unified into the same format can be accomplished by sorting functions in various programming languages. For example, the sorted function in Python, or collections.sort in JAVA.

[0040] Step S2032: Combining the sorted scene data to obtain a data link, wherein the scene data triggered by each scene are associated based on the data link.

[0041] In this step, the data link is a logical structure used to represent the association relationship between scene data. The data link can be a simple linked list, in which each node represents a scene data, and the linked list between nodes represents the association between data.

[0042] Step S205: Based on the user identifier, user behavior data and data link, determine whether the target user represented by the user identifier has target user behavior data within a preset time, and determine whether the system has an abnormal situation based on the determination result. Figure 1Step S105 of the illustrated embodiment will not be described in detail here.

[0043] The method for system anomaly detection provided in this embodiment can effectively sort the scene data based on the time sequence represented by the time data, and can combine the sorted scene data into a data link, and associate the scene data triggered by each scene based on the data link, which helps to better understand and analyze the user behavior data in the system and improve the efficiency and accuracy of the system business.

[0044] In this embodiment, a method for detecting system anomalies is provided, which can be used in the above-mentioned mobile terminals, such as mobile phones, laptop computers or tablet computers, etc. Figure 3 A flow chart of another method for detecting system anomalies according to an embodiment of the present invention is shown. Figure 3 As shown, the process includes the following steps:

[0045] Step S301, obtaining scene data corresponding to each scene during the use of the system, the scene data includes: time data, user identifier and user behavior data corresponding to the user identifier. For details, please refer to Figure 1 Step S101 of the illustrated embodiment will not be described in detail here.

[0046] Step S303, integrating the scene data based on the time dimension represented by the time data to obtain a data link.

[0047] Specifically, the above step S303 includes:

[0048] Step S3031, sorting the scene data based on the time sequence represented by the time data.

[0049] Step S3032: Combine the sorted scene data to obtain a data link, wherein the scene data triggered by each scene are associated based on the data link. Figure 2 Step S2031 and step S2032 of the illustrated embodiment are not described in detail here.

[0050] Step S305 , based on the user identifier, the user behavior data and the data link, it is determined whether the target user represented by the user identifier has target user behavior data within a preset time, and based on the determination result, it is determined whether the system has an abnormal situation.

[0051] Specifically, the above step S305 includes:

[0052] Step S3051: Based on the user identifier, intercept and combine to obtain a target data link corresponding to the user identifier.

[0053] In this step, the user identifier is identified, data query is performed based on the identification result, a data link related to the target user identifier is obtained, the required data fragments are intercepted in the data link, and the data fragments are combined to obtain the target data link corresponding to the user identifier. The interception of the required data fragments may be achieved by parsing JSON objects, processing strings, or filtering database columns. The combination of data fragments can be achieved by connecting strings, creating a new data structure, or merging data tables.

[0054] Step S3052, obtaining target user behavior data based on historical scenario data; judging whether the system has abnormal conditions based on whether target user behavior data exists in the target data link within a preset time; or whether the target user behavior data meets preset requirements.

[0055] In this step, normal user behavior data can be established based on historical scenario data, which can be achieved through statistical methods, such as mean, median or standard deviation, or through machine learning models. If the target user behavior data representing normal user behavior does not exist in the target data link within the preset time, it can be determined that the system has an abnormal situation; or, if the target user behavior data in the target data link does not meet the preset requirements, it can be determined that the system has an abnormal situation.

[0056] In this way, it is possible to effectively determine whether the system has abnormal conditions based on the target user behavior data in the target data link, which helps maintain the stability and security of the system.

[0057] In some optional implementations, the above step S3052 includes:

[0058] Step b1, in the target data link, if the target user behavior data characterizes: the target user enters the first system scenario interface at the first time, and leaves the first system scenario interface at the third time; and the target user enters the second system scenario interface at the second time, it is determined that an abnormal situation exists in the system; wherein the first time is less than the second time and the third time, the second time is less than the third time, the system scenario includes a first system scenario interface and a second system scenario interface, the first system scenario interface is different from the second system scenario interface, and the target user cannot enter the first system scenario interface and the second system scenario interface at the same time.

[0059] This step is explained as an example. If the target user logs into the system homepage at 7:02 and leaves the system homepage at 7:10, it can be determined that the target user has been staying on the system homepage from 7:02 to 7:10. If the target user enters the system introduction page at 7:08, it is determined that the system is abnormal. It should be noted that if the data link is not integrated and associated, the system abnormality cannot be identified based on the scenario data that the target user entered the system introduction page at 7:08.

[0060] Step b2, in the target data link, if there is first target user behavior data at the fourth time, there is second target user behavior data at the fifth time, and the time difference between the fifth time and the fourth time is greater than the preset time length, it is determined that there is an abnormal situation in the system; wherein the fourth time is less than the fifth time, the target user behavior data includes the first target user behavior data and the second target user behavior data, the first target user behavior data is different from the second target user behavior data, and the first target user behavior data is associated with the second target user behavior data.

[0061] In this step, in a normal system usage scenario, if there is first target user behavior data, second target user behavior data will inevitably be generated within the preset time. The following is an exemplary explanation of this step. The target user logs into the system at 7:00:05, and the first target user behavior data of successful login is reported at this time. After the system logs in successfully, it will automatically jump to the system homepage. At this time, the second target user behavior data of the target user entering the system homepage and the login time 7:00:08 will be reported. In a normal system usage scenario, the time difference between the time the target user enters the system homepage and the time the target user logs in successfully is a few seconds. If the time difference is greater than the preset time, it is determined that the system is abnormal. Among them, the preset time can be set according to the actual application scenario of the system. For example, in the above exemplary description, the preset time can be set to twenty seconds.

[0062] Step b3, in the target data link, if there is third target user behavior data at the sixth time, and there is no fourth target user behavior data after the sixth time, it is determined that there is an abnormal situation in the system; wherein the target user behavior data includes the third target user behavior data and the fourth target user behavior data, and the third target user behavior data and the fourth target user behavior data are different.

[0063] In this step, in a normal system scenario, after a user successfully logs in, there must be user behavior data of the user entering the system homepage. If there is third target user behavior data of successful system login at the sixth time, but there is no fourth target user behavior data of the target user entering the system homepage after the sixth time, it is determined that the system has an abnormal situation.

[0064] In this way, based on the data link in each system scenario, abnormal situations in the system can be accurately identified, which can improve the stability of the system, optimize operation and maintenance efficiency, reduce errors and risks of human intervention, shorten the time for troubleshooting and processing, reduce the impact of faults on system business, promote business optimization, thereby reducing losses and improving business stability and service quality.

[0065] In some optional embodiments, the aforementioned method for system anomaly detection also includes: preprocessing the scene data, and integrating the time dimension based on the processed scene data, wherein the preprocessing includes cleaning and standardizing the scene data, the cleaning includes deleting duplicate data in the scene data, and the standardization includes deleting data in the cleaned scene data that does not comply with preset rules.

[0066] In this embodiment, the scene data can be pre-processed in real time or according to a preset time period to delete duplicate data in the scene data. It can be that only the last scene data of multiple identical duplicate data in a short period of time is retained and the rest of the duplicate data are deleted. Standardization is to delete the scene data that lacks necessary information. For example, if there is no user identifier in the reported scene data, it is considered that the scene data does not meet the preset rules, and the aforementioned reported scene data is deleted.

[0067] In this way, the uniqueness of the cleaned data can be guaranteed through cleaning, and the relative accuracy of the scene data can be guaranteed through standardization.

[0068] In some optional implementations, the scenario data also includes: device status data. The device status data includes information about the carrier device on which the system is running, for example, when a user enters the login page, the memory usage, CPU usage, or storage usage of the carrier device (such as a mobile application or a computer device, etc.).

[0069] If there is no unique device identifier in the reported device status data, it is considered that the scene data does not meet the preset rules, and the reported device status data can be deleted. In this way, redundant information can be eliminated, which is convenient for system anomaly detection.

[0070] In an optional implementation, the scene data may be classified based on the system scene, that is, the scene data may be classified according to the scene, so that the scene data understanding capability may be enhanced, and the classified scene data may be easier to understand and analyze, and facilitate the judgment of abnormal situations of the system.

[0071] In some optional implementations, after determining that the system has an abnormal situation, an alarm mechanism is triggered, and an alarm message can be sent to relevant personnel via email, SMS, phone, or in-application message push, etc. The alarm message may include relevant information such as the time and scene of the system abnormality.

[0072] In this embodiment, a device for system anomaly detection is also provided, which is used to implement the above-mentioned embodiments and preferred implementation modes, and the descriptions that have been made will not be repeated. As used below, the term "module" can implement a combination of software and / or hardware of a predetermined function. Although the devices described in the following embodiments are preferably implemented in software, the implementation of hardware, or a combination of software and hardware, is also possible and conceivable.

[0073] Figure 4 FIG. 1 is a schematic diagram showing the structure of a device for detecting system anomalies according to an embodiment of the present invention. This embodiment provides a device for detecting system anomalies, such as Figure 4 As shown, including:

[0074] The acquisition module 401 is used to acquire the scene data corresponding to each scene during the use of the system, and the scene data includes: time data, user identifier and user behavior data corresponding to the user identifier.

[0075] The integration module 403 is used to integrate the scene data based on the time dimension represented by the time data to obtain a data link.

[0076] The judgment module 405 is used to judge whether the target user represented by the user identifier in the data link has target user behavior data within a preset time based on the user identifier, the user behavior data and the data link, and judge whether there is an abnormal situation in the system based on the judgment result.

[0077] In some optional implementations, the integration module 403 includes:

[0078] The first integration unit is used to sort the scene data based on the time sequence represented by the time data.

[0079] The second integration unit is used to combine the sorted scene data to obtain a data link, wherein the scene data triggered by each system scene are associated based on the data link.

[0080] In some optional implementations, the determination module 405 includes:

[0081] The first judgment unit is used to intercept and combine the target data link corresponding to the user identifier based on the user identifier.

[0082] The second judgment unit is used to obtain target user behavior data based on historical system scenario data.

[0083] The third judgment unit is used to judge whether there is an abnormal situation in the system based on whether there is target user behavior data in the target data link within a preset time; or whether the target user behavior data meets preset requirements.

[0084] In some optional implementations, the third determination unit includes:

[0085] The third judgment first subunit is used to determine that there is an abnormal situation in the system if the target user behavior data in the target data link represents: the target user enters the first system scenario interface at the first time and leaves the first system scenario interface at the third time; and the target user enters the second system scenario interface at the second time; wherein the first time is less than the second time and the third time, the second time is less than the third time, the system scenario includes a first system scenario interface and a second system scenario interface, the first system scenario interface is different from the second system scenario interface, and the target user cannot enter the first system scenario interface and the second system scenario interface at the same time.

[0086] In some optional implementations, the third determination unit further includes:

[0087] The third judgment second subunit is used to determine that there is an abnormal situation in the system in the target data link if there is third target user behavior data at the sixth time and there is no fourth target user behavior data after the sixth time; wherein the target user behavior data includes third target user behavior data and fourth target user behavior data, and the third target user behavior data and the fourth target user behavior data are different.

[0088] In some optional implementations, the third determination unit further includes:

[0089] The third judgment third subunit is used to determine that there is an abnormal situation in the system in the target data link if there is first target user behavior data at the fourth time, there is second target user behavior data at the fifth time, and the time difference between the fifth time and the fourth time is greater than a preset time length; wherein the fourth time is less than the fifth time, the target user behavior data includes the first target user behavior data and the second target user behavior data, the first target user behavior data is different from the second target user behavior data, and the first target user behavior data is associated with the second target user behavior data.

[0090] In some optional embodiments, the aforementioned device for system anomaly detection also includes a preprocessing module for preprocessing the scene data and integrating the time dimension based on the processed scene data, wherein the preprocessing includes cleaning and standardizing the scene data, the cleaning includes deleting duplicate data in the scene data, and the standardization includes deleting data in the cleaned scene data that does not comply with preset rules.

[0091] The further functional description of each of the above modules and units is the same as that of the above corresponding embodiments and will not be repeated here.

[0092] The device for system anomaly detection provided by the present invention obtains scene data corresponding to each scene during the use of the system, establishes a data link based on the scene data, integrates and associates the scene data triggered at different times during the use of the system, and is convenient for detecting system anomalies. Based on the user identifier, user behavior data and data link, it is determined whether the target user represented by the user identifier performs certain operations within a period of time, and then determines whether the system is in an abnormal state. In this way, by monitoring the data flow or user behavior in the system during the operation of the system, the anomaly in the system operation process can be reasonably and accurately detected, thereby improving the security and stability of the system.

[0093] The device for system anomaly detection in this embodiment is presented in the form of a functional unit, where the unit refers to an application specific integrated circuit (ASIC) circuit, a processor and memory that executes one or more software or fixed programs, and / or other devices that can provide the above functions.

[0094] The embodiment of the present invention also provides a computer device having the above Figure 4 An apparatus for system anomaly detection is shown.

[0095] See also Figure 5 , Figure 5 is a schematic diagram of the structure of a computer device provided by an optional embodiment of the present invention, such as Figure 5As shown, the computer device includes: one or more processors 10, a memory 20, and interfaces for connecting various components, including high-speed interfaces and low-speed interfaces. Various components are connected to each other using different buses for communication, and can be installed on a common mainboard or installed in other ways as needed. The processor can process instructions executed in the computer device, including instructions stored in or on the memory to display graphical information of a graphical user interface on an external input / output device (such as a display device coupled to an interface). In some optional embodiments, if necessary, multiple processors and / or multiple buses can be used together with multiple memories and multiple memories. Similarly, multiple computer devices can be connected, and each device provides some necessary operations (for example, as a server array, a group of blade servers, or a multi-processor system). Figure 5 A processor 10 is taken as an example.

[0096] The processor 10 may be a central processing unit, a network processor or a combination thereof. The processor 10 may further include a hardware chip. The hardware chip may be a dedicated integrated circuit, a programmable logic device or a combination thereof. The programmable logic device may be a complex programmable logic device, a field programmable gate array, a general purpose array logic or any combination thereof.

[0097] The aforementioned memory 20 stores instructions executable by at least one processor 10, so that the aforementioned at least one processor 10 executes the method shown in the above embodiment.

[0098] The memory 20 may include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application required for at least one function; the data storage area may store data created according to the use of the computer device, etc. In addition, the memory 20 may include a high-speed random access memory, and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some optional embodiments, the memory 20 may optionally include a memory remotely arranged relative to the processor 10, and these remote memories may be connected to the computer device via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0099] The memory 20 may include a volatile memory, such as a random access memory; the memory may also include a non-volatile memory, such as a flash memory, a hard disk or a solid state drive; the memory 20 may also include a combination of the above types of memory.

[0100] The computer device also includes an input device 30 and an output device 40. The processor 10, the memory 20, the input device 30 and the output device 40 may be connected via a bus or other means. Figure 5 The example of connecting through bus is taken in the following.

[0101] The input device 30 can receive input digital or character information, and generate key signal input related to the user settings and function control of the computer device, such as a touch screen, a keypad, a mouse, a track pad, a touch pad, an indicator rod, one or more mouse buttons, a trackball, a joystick, etc. The output device 40 may include a display device, an auxiliary lighting device (such as a light emitting diode) and a tactile feedback device (such as a vibration motor), etc. The above-mentioned display device includes but is not limited to a liquid crystal display, a light emitting diode, a display and a plasma display. In some optional embodiments, the display device can be a touch screen.

[0102] The embodiment of the present invention also provides a computer-readable storage medium. The method according to the embodiment of the present invention can be implemented in hardware, firmware, or can be implemented as a computer code that can be recorded in a storage medium, or can be implemented as a computer code that is originally stored in a remote storage medium or a non-temporary machine-readable storage medium and will be stored in a local storage medium through a network download, so that the method described herein can be stored in such software processing on a storage medium using a general-purpose computer, a dedicated processor, or programmable or dedicated hardware. Among them, the storage medium can be a magnetic disk, an optical disk, a read-only storage memory, a random access memory, a flash memory, a hard disk or a solid-state hard disk, etc.; further, the storage medium can also include a combination of the above types of memories. It can be understood that a computer, a processor, a microprocessor controller, or programmable hardware includes a storage component that can store or receive software or computer code. When the software or computer code is accessed and executed by a computer, a processor, or hardware, the method shown in the above embodiment is implemented.

[0103] A part of the present invention may be applied as a computer program product, such as a computer program instruction, which, when executed by a computer, can call or provide the method and / or technical solution according to the present invention through the operation of the computer. Those skilled in the art should understand that the existence of the computer program instruction in a computer-readable medium includes, but is not limited to, a source file, an executable file, an installation package file, etc., and accordingly, the way in which the computer program instruction is executed by the computer includes, but is not limited to: the computer directly executes the instruction, or the computer compiles the instruction and then executes the corresponding compiled program, or the computer reads and executes the instruction, or the computer reads and installs the instruction and then executes the corresponding installed program. Here, the computer-readable medium may be any available computer-readable storage medium or communication medium accessible to the computer.

[0104] Although the embodiments of the present invention have been described in conjunction with the accompanying drawings, those skilled in the art may make various modifications and variations without departing from the spirit and scope of the present invention, and such modifications and variations are all within the scope defined by the appended claims.

Claims

1. A method for system anomaly detection, characterized in that: The method comprises: Acquire scenario data corresponding to each system scenario during system use, the scenario data including: time data, a user identifier, and user behavior data corresponding to the user identifier; Integrate the scene data based on the time dimension represented by the time data to obtain a data link; Based on the user identifier, the user behavior data and the data link, it is determined whether the target user represented by the user identifier in the data link has target user behavior data within a preset time, and based on the determination result, it is determined whether the system has an abnormal situation.

2. The method according to claim 1, characterized in that Integrating the scene data based on the time dimension represented by the time data to obtain a data link includes: sorting the scene data based on the time order represented by the time data; The sorted scene data are combined to obtain the data link, wherein the scene data triggered by each system scene are associated based on the data link.

3. The method according to claim 1 or 2, characterized in that: Based on the user identifier, the user behavior data and the data link, determining whether the target user represented by the user identifier in the data link has target user behavior data within a preset time, and determining whether the system has an abnormal situation based on the determination result, including: Based on the user identifier, intercepting and combining to obtain a target data link corresponding to the user identifier; Obtaining the target user behavior data based on historical system scenario data; Based on whether the target user behavior data exists in the target data link within the preset time; or Whether the target user behavior data meets the preset requirements is determined to determine whether there is any abnormality in the system.

4. The method according to claim 3, characterized in that Whether the target user behavior data meets the preset requirements and whether the system has abnormal conditions includes: In the target data link, if the target user behavior data represents: The target user enters the first system scenario interface at a first time, and leaves the first system scenario interface at a third time; Furthermore, the target user enters the second system scenario interface at a second time and determines that an abnormal situation exists in the system; Among them, the first time is less than the second time and the third time, the second time is less than the third time, the system scenario includes the first system scenario interface and the second system scenario interface, the first system scenario interface is different from the second system scenario interface, and the target user cannot enter the first system scenario interface and the second system scenario interface at the same time.

5. The method according to claim 3, characterized in that: Whether the target user behavior data meets the preset requirements and whether the system has an abnormal situation also includes: In the target data link, if the third target user behavior data exists at the sixth time, and the fourth target user behavior data does not exist after the sixth time, it is determined that the system has an abnormal situation; The target user behavior data includes the third target user behavior data and the fourth target user behavior data, and the third target user behavior data is different from the fourth target user behavior data.

6. The method according to claim 3, characterized in that: Based on whether the target user behavior data exists in the target data link within the preset time, determining whether the system has an abnormal situation further includes: In the target data link, if the first target user behavior data exists at the fourth time, the second target user behavior data exists at the fifth time, and the time difference between the fifth time and the fourth time is greater than the preset time length, it is determined that the system has an abnormal situation; Among them, the fourth time is less than the fifth time, the target user behavior data includes the first target user behavior data and the second target user behavior data, the first target user behavior data is different from the second target user behavior data, and the first target user behavior data is associated with the second target user behavior data.

7. The method according to claim 1, characterized in that The method also includes preprocessing the scene data and integrating the time dimension based on the processed scene data, wherein the preprocessing includes cleaning and standardizing the scene data, the cleaning includes deleting duplicate data in the scene data, and the standardization includes deleting data that does not comply with preset rules in the cleaned scene data.

8. A device for system anomaly detection, characterized in that: The device comprises: An acquisition module, used to acquire scene data corresponding to each scene during the use of the system, wherein the scene data includes: time data, a user identifier, and user behavior data corresponding to the user identifier; an integration module, configured to integrate the scene data based on a time dimension represented by the time data to obtain a data link; and A judgment module is used to judge whether the target user represented by the user identifier in the data link has target user behavior data within a preset time based on the user identifier, the user behavior data and the data link, and judge whether there is an abnormal situation in the system based on the judgment result.

9. A computer device, characterized in that: include: A memory and a processor, wherein the memory and the processor are communicatively connected to each other, the memory stores computer instructions, and the processor executes the method for system anomaly detection according to any one of claims 1 to 7 by executing the computer instructions.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a computer to execute the method for system anomaly detection according to any one of claims 1 to 7.

Images