Browpage anomaly detection method and device, electronic equipment, storage medium and program product

Abstract

The embodiment of the invention discloses a page view anomaly detection method and device, electronic equipment, a storage medium and a program product. The method can comprise the steps that in response to a detected target page with the page view returning to zero, a plurality of previous time periods are obtained, and the previous time periods are time periods before a zero returning time period with the page view returning to zero of the target page; for each previous time period in the plurality of previous time periods, obtaining a target page view of the target page in the previous time period; and performing page view anomaly detection on the target page according to the obtained multiple target page views. According to the technical scheme provided by the embodiment of the invention, the page view anomaly detection is carried out by analyzing the change trend of the page view of the target page before the zeroing time period, so that the situation that the target page with the normal page view zeroing condition is detected to be abnormal can be avoided, the false detection rate is reduced, and the accuracy of page view anomaly detection is improved.

Description

Technical Field

[0001] Embodiments of the present invention relate to the field of computer technology, and in particular, to a method, device, electronic device, storage medium, and program product for detecting abnormal pageview volume. Background Art

[0002] At present, in order to ensure the security of the website, many website developers will develop an alarm system, and use the alarm system to issue an alarm when it is detected that the number of page views on a certain page on the website is abnormal.

[0003] In the process of realizing the present invention, the inventors found that the following technical problems exist in the prior art: when performing abnormal page view detection on a page, false detections occur, resulting in low detection accuracy, which needs to be solved urgently. Summary of the invention

[0004] The embodiments of the present invention provide a method, device, electronic device, storage medium and program product for detecting abnormal page views, which solve the problem of low accuracy of abnormal page view detection for a web page.

[0005] According to one aspect of the present invention, a method for detecting abnormal pageview volume is provided, which may include:

[0006] In response to detecting a target page whose pageviews are reset to zero, acquiring a plurality of previous time periods, wherein the previous time period is a time period before the reset time period in which the pageviews of the target page are reset to zero;

[0007] For each of the multiple previous time periods, obtain a target pageview count of the target page in the previous time period;

[0008] Based on the obtained multiple target page views, the page view anomaly detection of the target page is performed.

[0009] According to another aspect of the present invention, a device for detecting abnormal pageview volume is provided, which may include:

[0010] A previous time period acquisition module, which can be used to acquire multiple previous time periods in response to the target page whose pageviews are detected to be zero, wherein the previous time period is a time period before the zeroing time period in which the pageviews of the target page are zeroed;

[0011] A target pageview obtaining module may be used to obtain a target pageview of a target page in each of a plurality of previous time periods;

[0012] The pageview anomaly detection module can be used to perform pageview anomaly detection on a target page based on the obtained multiple target pageviews.

[0013] According to another aspect of the present invention, there is provided an electronic device, which may include:

[0014] at least one processor; and

[0015] a memory communicatively connected to at least one processor; wherein,

[0016] The memory stores a computer program that can be executed by at least one processor. The computer program is executed by at least one processor so that the at least one processor implements the pageview anomaly detection method provided by any embodiment of the present invention when executing the computer program.

[0017] According to another aspect of the present invention, a computer-readable storage medium is provided, on which computer instructions are stored, and the computer instructions are used to enable a processor to implement the pageview anomaly detection method provided by any embodiment of the present invention when executed.

[0018] According to another aspect of the present invention, a computer program product is provided, on which a computer program is stored. When the computer program is executed by a processor, the method for detecting abnormal pageview volume provided by any embodiment of the present invention is implemented.

[0019] The technical solution of the embodiment of the present invention is to obtain multiple previous time periods before the zeroing period when the target page's page views are zeroed in response to the target page detected, and the multiple previous time periods are used to analyze the change trend of the page views of the target page before the zeroing period; for each of the multiple previous time periods, the target page views of the target page in the previous time period are obtained, thereby obtaining the target page views of the target page in each previous time period; then, according to the obtained multiple target page views, the change trend of the page views of the target page before the zeroing period is analyzed, and based on this, the page view anomaly detection of the target page is performed, that is, whether the page views of the target page are zeroed this time is an abnormal situation. Compared with the implementation scheme of directly judging that the page views of the target page are abnormal when the page views are detected to be zeroed, the above technical scheme performs page view anomaly detection by analyzing the change trend of the page views of the target page before the zeroing period, thereby avoiding detecting the target page whose page views are zeroed as normal as abnormal, reducing the false detection rate, and thus improving the accuracy of page view anomaly detection.

[0020] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0022] Figure 1 is a flow chart of a method for detecting abnormal pageview volume provided by an embodiment of the present invention;

[0023] Figure 2 is a flow chart of another method for detecting abnormal pageview volume provided according to an embodiment of the present invention;

[0024] Figure 3 is a flow chart of another method for detecting abnormal pageview volume provided according to an embodiment of the present invention;

[0025] Figure 4 is a flow chart of another method for detecting abnormal pageview volume provided according to an embodiment of the present invention;

[0026] Figure 5 is a flowchart of another method for detecting abnormal pageview volume provided according to an embodiment of the present invention;

[0027] Figure 6a is a schematic diagram of an alarm system in another method for detecting abnormal pageview volume provided according to an embodiment of the present invention;

[0028] Figure 6b According to another method for detecting abnormal browsing volume provided by an embodiment of the present invention, Figure 6a A schematic diagram of the workflow of the pageview anomaly detection module in ;

[0029] Figure 7a is a schematic diagram of sliding window aggregation in another method for detecting abnormal pageviews provided in an embodiment of the present invention;

[0030] Figure 7b is a schematic diagram of rolling window aggregation in another method for detecting abnormal pageviews provided according to an embodiment of the present invention;

[0031] Figure 7c is a schematic diagram of combining sliding and scrolling windows in another method for detecting abnormal pageviews provided by an embodiment of the present invention;

[0032] Figure 8a It is a schematic diagram of a process of obtaining 11-minute record details in another method for detecting abnormal pageviews provided according to an embodiment of the present invention;

[0033] Figure 8bIt is a schematic diagram of the aggregation process of 11-minute record details in another method for detecting abnormal pageviews provided according to an embodiment of the present invention;

[0034] Figure 8c It is a schematic diagram of the aggregation result of 11 minutes of record details in another method for detecting abnormal pageviews provided according to an embodiment of the present invention;

[0035] Fig. 9 is a structural block diagram of a device for detecting abnormal pageview volume provided according to an embodiment of the present invention;

[0036] Fig.10 It is a schematic diagram of the structure of an electronic device that implements the method for detecting abnormal pageview volume according to an embodiment of the present invention. DETAILED DESCRIPTION

[0037] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0038] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. The situations of "target", "original", etc. are similar and will not be repeated here. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0039] Before introducing the embodiments of the present invention, the cause of the technical problem described in the background technology that there are false detections when detecting abnormal page views, resulting in low detection accuracy, is explained by way of example, so as to better understand how the embodiments of the present invention solve the technical problem.

[0040] For example, according to the currently used pageview anomaly detection mechanism, when the pageview of a certain page is detected to be zero, the pageview of the page is judged to be abnormal and an alarm is issued. However, it is found in practice that the pageview of some pages does occasionally return to zero. If it is judged as abnormal pageview, it is obviously a false detection.

[0041] On this basis, in order to solve the technical problems described above, the embodiment of the present invention proposes a technical solution that, when detecting that the pageviews of a certain page have returned to zero, the pageviews of the page before the zeroing period can be analyzed to determine whether the pageviews returning to zero is abnormal, thereby reducing the false detection rate and ensuring the detection accuracy. Next, the technical solution will be described in detail.

[0042] Figure 1 This is a flow chart of a method for detecting abnormal page views provided by an embodiment of the present invention. This embodiment is applicable to the case where abnormal page views are detected for a page, and in particular, is applicable to the case where abnormal page views are detected when the page views return to zero. The method can be executed by the abnormal page views detection device provided by an embodiment of the present invention, which can be implemented by software and / or hardware, and can be integrated in an electronic device, which can be various user terminals or servers.

[0043] See also Figure 1 The method of the embodiment of the present invention specifically includes the following steps:

[0044] S110. In response to detecting a target page whose pageviews have returned to zero, obtaining a plurality of previous time periods;

[0045] The previous time period is a time period before the zeroing time period in which the page views of the target page are reset to zero.

[0046] The target page can be understood as a page with zero pageviews, that is, a page with a pageview count that drops from non-zero to zero. In the embodiment of the present invention, optionally, a page with a pageview count that drops to zero can be used as the target page; a page with a pageview count that drops to zero and a page with a pageview count that is zero for a preset time after dropping to zero can also be called the target page; and so on. This can be set according to actual needs and is not specifically limited here.

[0047] The zeroing period can be understood as the period when the page views of the target page are zero. For example, assuming that the page views are non-zero during the period from 10:00 to 10:01, and zero during the period from 10:01 to 10:02, the page views are zero, then the period from 10:01 to 10:02 can be regarded as the zeroing period.

[0048] The previous time period can be understood as the time period before the zeroing time period, and the number of such time periods is multiple, so as to obtain the change trend of the page views of the target page before the zeroing time period. In the embodiment of the present invention, optionally, the multiple previous time periods can be multiple time periods starting from the previous time period of the zeroing time period; or they can be a preset number of time periods before the previous time period, and one of the preset number of time periods is adjacent to the previous time period, that is, the multiple previous time periods include a preset number of time periods before the previous time period, and one of the multiple previous time periods is adjacent to the previous time period; of course, it can also be the previous time period of other situations, which can be set according to actual needs and is not specifically limited here.

[0049] It should be noted that, in the embodiments of the present invention, optionally, the above-mentioned views can be represented by a variety of methods, for example, it can be represented by page views (pv) and / or unique visitors (uv), etc., which can be set according to actual needs and is not specifically limited here; optionally, the above-mentioned views can be offline views or online views. Compared with offline views, online views help to achieve timely detection and alarm of abnormal views.

[0050] In response to the detected target page, a plurality of previous time periods corresponding to the target page are acquired.

[0051] S120. For each previous time period among the multiple previous time periods, obtain a target pageview count of the target page in the previous time period.

[0052] Here, each previous time period is processed separately by using this step. Here, any previous time period among multiple previous time periods is taken as an example, and the target page views of the target page in the previous time period can be obtained.

[0053] On this basis, in combination with the application scenarios that may be involved in the embodiments of the present invention, optionally, the target page views can be obtained by aggregation through windows with aggregation functions such as sliding windows and / or rolling windows; of course, it can also be obtained through other methods, which are not specifically limited here.

[0054] S130. Perform target page view anomaly detection based on the obtained multiple target page views.

[0055] After obtaining the target page views corresponding to each previous time period, the target page views can be comprehensively analyzed to obtain the change trend of the page views of the target page before the zeroing period. In the embodiment of the present invention, the change trend can optionally indicate whether the page views of the target page are occasionally zeroed or zeroed for a long time, whether the target page is a high-traffic page, etc. Then, it can be determined based on the change trend whether the page views of the target page are zeroed this time is an abnormal situation.

[0056] Exemplarily, when the number of views of a target page is simply reset to zero, view anomaly detection can be performed by analyzing whether there is a target view that is zero among multiple target views; view anomaly detection can also be performed by analyzing whether there is a target view that is zero among multiple target views and the numerical relationship between a non-zero target view and a preset view threshold; and so on, which are not specifically limited here.

[0057] As another example, when not only the target page's page views are reset to zero, but also the duration of the page views being zero after being reset to zero reaches a preset time, page view anomaly detection can be performed by analyzing the number of non-zero target page views among multiple target page views; page view anomaly detection can also be performed by analyzing the number of non-zero target page views and the numerical relationship between the non-zero target page views and a preset page view threshold; and so on, which are not specifically limited here.

[0058] The technical solution of the embodiment of the present invention is to obtain multiple previous time periods before the zeroing period when the target page's page views are zeroed in response to the target page detected, and the multiple previous time periods are used to analyze the change trend of the page views of the target page before the zeroing period; for each of the multiple previous time periods, the target page views of the target page in the previous time period are obtained, thereby obtaining the target page views of the target page in each previous time period; then, according to the obtained multiple target page views, the change trend of the page views of the target page before the zeroing period is analyzed, and based on this, the page view anomaly detection of the target page is performed, that is, whether the page views of the target page are zeroed this time is an abnormal situation. Compared with the implementation scheme of directly judging that the page views of the target page are abnormal when the page views are detected to be zeroed, the above technical scheme performs page view anomaly detection by analyzing the change trend of the page views of the target page before the zeroing period, thereby avoiding detecting the target page whose page views are zeroed as normal as abnormal, reducing the false detection rate, and thus improving the accuracy of page view anomaly detection.

[0059] Figure 2It is a flowchart of another method for detecting abnormal page views provided in an embodiment of the present invention. This embodiment is optimized based on the above-mentioned technical solutions. In this embodiment, optionally, in response to the detected page views returning to zero, the target page includes: in response to the detected page views returning to zero, and the page views are zero for a preset time after returning to zero. The explanations of the terms that are the same or corresponding to the above-mentioned embodiments are not repeated here.

[0060] See also Figure 2 The method of this embodiment may specifically include the following steps:

[0061] S210. In response to the detected page views being reset to zero, and the duration of the page views being zero after being reset to zero reaching a preset duration for the target page, obtaining multiple prior time periods;

[0062] The previous time period is a time period before the zeroing time period in which the page views of the target page are reset to zero.

[0063] The duration can be understood as the duration of time that the page views remain zero after the page views of the target page return to zero. The preset duration can be understood as a preset duration, which can be, for example, 4 minutes, 5 minutes, or 6 minutes, etc. This can be set according to actual needs and is not specifically limited here.

[0064] Taking into account that the page views of many pages occasionally return to zero, in an embodiment of the present invention, not only is the page views reset to zero, but also the page whose page views are zero for a preset time after being reset (i.e., the page views are zero for a preset time) is called a target page, and abnormal page view detection is performed on the target page, which has more practical value.

[0065] S220. For each previous time period among the multiple previous time periods, obtain the target page views of the target page in the previous time period.

[0066] S230. Perform target page view anomaly detection based on the obtained multiple target page views.

[0067] The technical solution of the embodiment of the present invention takes into account that the page views of many pages will occasionally return to zero, so the page views are returned to zero, and the page whose page views are zero for a preset period of time after the page views are returned to zero is called the target page, and the page view anomaly detection is performed on the target page, which can further reduce the false detection rate.

[0068] Before introducing the following embodiments, an exemplary description of its application scenarios is given. For example, when the alarm system is a zero-configuration system, that is, when there is no configuration for pages that need to be detected for abnormal page views, it can only detect pages with non-zero page views, but cannot detect pages with zero page views. This results in the inability to detect a page when its page views return to zero, resulting in missed detection.

[0069] In order to solve the above technical problems and further improve the detection accuracy, the following embodiments are proposed herein.

[0070] Figure 3 It is a flow chart of another method for detecting abnormal page views provided in an embodiment of the present invention. This embodiment is optimized based on the above-mentioned technical solutions. In this embodiment, optionally, the above-mentioned method for detecting abnormal page views may also include: using a first aggregation window to aggregate the first page browsing data within the first time period where the first aggregation window is located, and obtain the first page views of each first page represented by the first page browsing data within the first time period; using a second aggregation window to aggregate the second page browsing data within the second time period where the second aggregation window is located, and obtain the second page views of each second page represented by the second page browsing data within the second time period, wherein the second time period is within the first time period, and the preset time length is the time period length related to the first time period and / or the second time period; according to the obtained first page views and second page views, the target page is detected for each first page and each second page. Among them, the explanations of the terms that are the same as or corresponding to the above-mentioned embodiments are not repeated here.

[0071] See also Figure 3 The method of this embodiment may specifically include the following steps:

[0072] S310. Using the first aggregation window, perform aggregation processing on the first page browsing data within the first time period where the first aggregation window is located, and obtain the first page browsing volume of each first page represented by the first page browsing data within the first time period.

[0073] Among them, the first aggregation window can be understood as a window with an aggregation function. On this basis, combined with the application scenarios that may be involved in the embodiments of the present invention, optionally, the window can be a window obtained by a pre-created sliding window during the sliding process, or a window obtained by a pre-created first rolling window during the rolling process, and so on. This can be set according to actual needs and is not specifically limited here.

[0074] The first time period may be understood as the time period in which the first aggregation window is located.

[0075] The first page can be understood as a page browsed in the first period. The first page browsing data can represent the browsing situation of the first page in the first period, and the browsing situation may include at least one of browsing time, browsing object, and browsing times, which is related to the actual situation and is not specifically limited here.

[0076] On this basis, in an embodiment of the present invention, optionally, the first page can be represented by a Universal Resource Locator (URL) in the first page browsing data; of course, it can also be represented by other identifiers that can uniquely identify the page, which is not specifically limited here.

[0077] Optionally, the first page browsing data can be obtained through a data source, which can be various types of data sources, for example, at least one of open source message queues (MQ), Iceberg, Kafka, Hive, and Doris, etc., which are not specifically limited here.

[0078] Aggregation processing is performed on the first page browsing data using the first aggregation window to obtain the first page browsing volume of each first page represented by the first page browsing data within the first time period.

[0079] S320. Using the second aggregation window, aggregate the second page browsing data in the second time period where the second aggregation window is located to obtain the second page browsing volume of each second page represented by the second page browsing data in the second time period;

[0080] The second time period is within the first time period, and the preset duration is a time period duration related to the first time period and / or the second time period.

[0081] Among them, the second aggregation window, the second time period, the second page browsing data, the second page and the second page views are similar to the meanings of the corresponding concepts explained in S310, and will not be repeated here.

[0082] It should be noted that the second time period is within the first time period, that is, the time periods corresponding to the two aggregation windows overlap, so the target page can be detected through the page views obtained from the two aggregation windows.

[0083] It should be further explained that the preset duration is a time period duration related to the first time period and / or the second time period. There are many possibilities for the time period duration, for example, it may be the first duration of the first time period, the second duration of the second time period, the difference between the first duration and the second duration, the duration of a sub-time period in the first time period that is located after the second time period, or the duration of a sub-time period in the first time period that is located before the second time period, etc. This is related to the design method of the first aggregation window and the second aggregation window, and is not specifically limited here.

[0084] S330. Detecting a target page for each first page and each second page according to each first page view and each second page view obtained;

[0085] The target page is a page whose page views are reset to zero and whose page views remain zero for a preset time period after being reset to zero.

[0086] According to all the first page views and all the second page views, it is detected whether the target page exists in all the first pages and the second pages. This detection process can be implemented in many ways.

[0087] Exemplarily, when the end time of the first time period is the same as the end time of the second time period, and the time period duration is the second duration of the second time period, if the first pageviews of a certain page in the first time period are non-zero and the second pageviews in the second time period are zero, then the page is detected as the target page. Moreover, it can be known from the analysis that the page is a certain first page and not any second page.

[0088] As another example, when the start time of the first time period is the same as the start time of the second time period, and the time period duration is the duration of a sub-time period in the first time period that is located after the second time period, for each first page, if there is an identical page as the first page in all second pages, and the first page views are equal to the second page views of the same page, it can be detected that the first page is the target page.

[0089] On this basis, optionally, a sliding window and a first rolling window are created in advance for the page browsing data, the start time of the sliding window is equal to the start time of the first rolling window, and the step size of the sliding window is equal to the width of the first rolling window. At this time, the first aggregation window can be a window obtained during the sliding process of the sliding window, and the second aggregation window can be a window obtained during the rolling process of the first rolling window. The above-mentioned page browsing data may include the first page browsing data and the second page browsing data. Here, through the mutual cooperation of the sliding window and the first rolling window, accurate detection of the target page is achieved, and the time period when the browsing volume drops to zero is captured.

[0090] Of course, the target page can also be detected by other methods, which are not specifically limited here.

[0091] S340. In response to the detected target page, obtaining multiple prior time periods;

[0092] The previous time period is a time period before the zeroing time period in which the page views of the target page are reset to zero.

[0093] S350. For each previous time period among the multiple previous time periods, obtain the target page views of the target page in the previous time period.

[0094] S360. Perform target page view anomaly detection based on the obtained multiple target page views.

[0095] The technical solution of the embodiment of the present invention solves the problem of missed detection in zero-configuration application scenarios and further improves the detection accuracy by utilizing two aggregation windows corresponding to different time periods to aggregate page browsing data and detecting target pages based on the browsing volume obtained therefrom.

[0096] Figure 4 It is a flow chart of another method for detecting abnormal page views provided by an embodiment of the present invention. This embodiment is optimized based on the above-mentioned technical solutions. In this embodiment, optionally, the target page views of the target page in the previous time period are obtained, including: obtaining the third page views of each third page in the previous time period obtained by aggregating the third page browsing data, wherein the third page is a page represented by the third page browsing data, and the third page browsing data is the page browsing data in the previous time period; according to the obtained third page views, the target page views of the target page in the previous time period are obtained. Among them, the explanations of the terms that are the same or corresponding to the above-mentioned embodiments are not repeated here.

[0097] See also Figure 4 The method of this embodiment may specifically include the following steps:

[0098] S410. In response to detecting a target page whose pageviews are zero, obtaining multiple prior time periods;

[0099] The previous time period is a time period before the zeroing time period in which the page views of the target page are reset to zero.

[0100] S420. For each of the plurality of previous time periods, obtaining the third page views of each third page in the previous time period obtained by aggregating the third page view data;

[0101] The third page is a page represented by third page browsing data, and the third page browsing data is page browsing data in a previous time period.

[0102] Among them, the third page browsing data, the third page and the third page views are similar to the meanings of the corresponding concepts explained in S310, and are not repeated here.

[0103] On this basis, optionally, the third page views can be obtained by aggregation through a third aggregation window corresponding to the previous time period, and when the target page is detected by using a second aggregation window obtained during the scrolling process of the first scrolling window, the third aggregation window can also be obtained during the scrolling process. Moreover, according to the sequence between the second time period and the previous time period, it can be known that through the scrolling process of the first scrolling window, the second aggregation window is obtained first, and then the third aggregation window is obtained.

[0104] S430. Obtain a target pageview count of the target page in the previous time period according to the acquired third pageview counts.

[0105] The target page views are obtained according to each acquired third page views. For example, the third page views of the third page that is the same as the target page in each third page can be used as the target page views.

[0106] S440. Perform target page view anomaly detection based on the obtained multiple target page views.

[0107] The technical solution of the embodiment of the present invention realizes accurate determination of the target page views corresponding to the target page in the previous time period by aggregating the third page browsing data corresponding to the third page in the previous time period.

[0108] Before introducing the following embodiments, the application scenarios thereof are first described by way of example. For example, in some application scenarios, such as the application scenario of using open source Flink SQL to detect pageview anomalies, it is impossible to further process the obtained target pageviews, for example, it is impossible to accurately count the number of non-zero target pageviews in each target pageview, etc. This will result in the inability to use these target pageviews to accurately detect pageview anomalies of the target page, which needs to be solved urgently.

[0109] Figure 5 It is a flowchart of another method for detecting abnormal page views provided in an embodiment of the present invention. This embodiment is optimized based on the above-mentioned technical solutions. In this embodiment, optionally, based on the obtained multiple target page views, abnormal page views detection of the target page may include: generating record details for each non-zero target page views among the obtained multiple target page views; and performing abnormal page views detection of the target page based on the generated record details. Among them, the explanations of the terms that are the same as or corresponding to the above-mentioned embodiments are not repeated here.

[0110] See also Figure 5The method of this embodiment may specifically include the following steps:

[0111] S510. In response to detecting a target page whose pageviews are zero, obtaining multiple prior time periods;

[0112] The previous time period is a time period before the zeroing time period in which the page views of the target page are reset to zero.

[0113] S520. For each previous time period in the plurality of previous time periods, obtain the target page views of the target page in the previous time period, and if the target page views are non-zero, generate a record detail for the target page views.

[0114] Wherein, when the target page views are non-zero, a record detail is generated for the target page views. In the embodiment of the present invention, the target page views may be optionally recorded in the record detail. On this basis, the start time and end time of the previous time period corresponding to the target page views may be optionally recorded; further optionally, the start time and end time of the first aggregation window for detecting the target page and the first page views obtained through the first aggregation window may be recorded; etc., which are not specifically limited here.

[0115] By using this step, the record details corresponding to each non-zero target pageview volume can be obtained.

[0116] S530. Perform abnormal detection of page views of the target page based on the generated record details.

[0117] According to the generated record details, the change trend of the page views of the target page before the zero period is analyzed, and based on this, the page view anomaly detection of the target page is performed.

[0118] The technical solution of the embodiment of the present invention performs page view anomaly detection by utilizing record details generated based on a non-zero target page view, thereby solving the problem that in certain application scenarios it is impossible to accurately detect whether the page view is abnormal by directly processing the target page view, and further improves the detection accuracy.

[0119] An optional technical solution is to detect the abnormality of the page views of the target page according to the generated record details, including:

[0120] Obtain a second rolling window created for each generated record detail;

[0121] The second rolling window is used to aggregate the record details, and based on the obtained aggregation results, the pageview anomaly detection of the target page is performed.

[0122] The above technical solution aggregates each record detail by applying a second rolling window created for each record detail. The application of the second rolling window achieves accurate detection of abnormal page views.

[0123] On this basis, optionally, since a certain record detail records the target page views in the corresponding previous time period, when the target page is detected by the second aggregation window obtained during the scrolling process of the first scrolling window, the width of the second aggregation window is equal to the third duration of the previous time period. Therefore, the width of the second scrolling window can be equal to the width of the first scrolling window to ensure accurate processing of the target traffic.

[0124] Optionally, the aggregation result may include the number of details of the record, which is equal to the number of non-zero target views in all target views. This number can reflect whether the target page has been reset to zero in each previous time period, or whether it has been browsed relatively continuously. Therefore, this number can be used to detect page view anomalies to determine whether the page view returning to zero is abnormal.

[0125] Optionally, the aggregation result may include the number of details and the average pageviews. The average pageviews is obtained based on the number of time periods in the previous time period and the sum of the target pageviews in each record detail, for example, the average pageviews = summation result / number of time periods. Since the average pageviews can reflect whether the target page is a low-traffic page or a high-traffic page, based on the number of details, the average pageviews are applied to limit the pageview anomaly detection for low-traffic pages or high-traffic pages. Exemplarily, in the case where pageview anomaly detection is expected for high-traffic pages, the average pageviews can be used to filter out noise data, which is the low-traffic page; vice versa.

[0126] On this basis, in order to understand the above technical solutions more vividly as a whole, the following is an illustrative explanation of them in combination with specific examples applied in the open source Flink SQL.

[0127] For example, see Figure 6a The alarm system shown in the figure includes an MQ data source, a pageview anomaly detection module, and an alarm module. The pageview anomaly detection module can be implemented through Flink SQL real-time processing. Figure 6b ,The page view anomaly detection module can be divided into 6 steps: data preprocessing, sliding window aggregation, rolling window aggregation, sliding and rolling window combination, page view anomaly detection and alarm notification.,Next, these 6 steps will be elaborated in detail.

[0128] a. Data preprocessing: Clean and format the page browsing data input from the MQ data source, for example, remove invalid URLs and filter out unnecessary parameters.

[0129] b. Sliding window aggregation: Figure 7a As shown, a sliding window with a step length of 1 minute and a width of 6 minutes is pre-created based on the page browsing data. For the 6-minute window (i.e., the first aggregation window described above) obtained during the sliding process of the sliding window, the first page browsing data falling within the 6-minute window is aggregated using the 6-minute window, and the sum of the pvs (i.e., pv_6m) of each URL in the first page browsing data within the 6 minutes (i.e., the first time period described above) of the 6-minute window is calculated. In this example, the preset duration is 5 minutes.

[0130] c. Rolling window aggregation: Figure 7b As shown, a first rolling window with a width of 1 minute is pre-created based on the page browsing data. For the 1-minute window (i.e., the second aggregation window described above) obtained during the rolling process of the first rolling window, the 1-minute window is used to aggregate the second page browsing data in the page browsing data that falls within the 1-minute window, so as to calculate the sum of the pvs (i.e., pv_1m) of each URL in the second page browsing data within the 1-minute window (i.e., the second time period described above).

[0131] d. Slide and scroll window combination: Figure 7c As shown, a connection query is performed on each 6-minute window and each 1-minute window to find out the URL whose start time of the 6-minute window is equal to the start time of the 1-minute window, and whose pv_6m in the 6-minute window is equal to pv_1m in the 1-minute window, that is, the URL that has no page views after 1 minute of the 1-minute window. This URL is a URL that may have abnormal page views (hereinafter referred to as a possible abnormal point). Figure 7c In the example, url1 is used as a possible abnormal point. Here, by combining the sliding and rolling windows, the period when the number of URL views drops to zero can be captured.

[0132] In this example, when a 6-minute window of pv_6m=pv_1m is queried, a 6-minute record detail corresponding to the 6-minute window can be output. The 6-minute record detail can record the start time and end time of the 6-minute window and the total pv of each URL in the 6-minute window.

[0133] e. Abnormal pageview detection: see Figure 8a, according to the 6-minute record details, find out the 5 consecutive 1-minute windows before the possible abnormal point. The 1-minute in which the 1-minute window is located is the previous time period described above; the 5 is the preset number described above. For example, the 1-minute window that meets the following conditions can be used as the 1-minute window found here: the start time of the 6-minute window - 5 <= the start time of the 1-minute window < the start time of the 6-minute window.

[0134] Then, for each of the five 1-minute windows found, when the pv_1m or uv_1m aggregated for url1 in the 1-minute window is non-zero, a record is generated based on the 1-minute window. In particular, an 11-minute record detail can be generated based on the 1-minute window and the above-mentioned 6-minute record details. For example, the start time and end time of the 1-minute window and the total uv of the corresponding url1 can be added to the 6-minute record details. The 11-minute record details are the record details generated based on the non-zero target page views described above. Figure 8a In the example, url1 is detected in four 1-minute windows, so a total of four 11-minute record details are generated.

[0135] For further information, see Figure 8b , create a second rolling window with a width of 1 minute based on the 4 11-minute record details, which is used to aggregate the 4 11-minute record details and output the 1-minute window corresponding to the second rolling window (i.e. Figure 8b The aggregation result of the light purple 1-minute window in the figure under the preset aggregation conditions. In this example, the aggregation conditions can be the start time of the first 5 minutes, the start time and end time of the last 6 minutes, and url1 in the 11-minute record details. Here, by aggregating the performance of url1 within 5 minutes before 6 minutes, it is determined whether url1 is a real outlier, that is, whether the page corresponding to url1 has abnormal page views.

[0136] Further, see Figure 8c The aggregation results may include the smallest 1-minute start time and the largest 1-minute start time in the first 5 minutes of the 11-minute record details, the end time of the last 6 minutes, and the number of 1-minute minutes count_before_6m (i.e. the number of details described above) in which url1 was detected in the 5 minutes before the last 6 minutes, and the average pageviews uv_avg_before_6m, etc.

[0137] In this example, count_before_6m>=4 and uv_avg_before_6m>=2 are used to detect whether url1 is a real outlier. The former is used to determine whether url1 is browsed relatively continuously; the latter is used to determine whether url1 is a URL with large traffic, thereby effectively filtering out noise data.

[0138] f. Alarm notification: Convert the detected URL with abnormal page views into JSON format and send it to the alarm module to generate an alarm notification.

[0139] The above example has at least the following advantages:

[0140] 1. Improve real-time performance: By utilizing the window operations and data aggregation logic in Flink SQL, the processing efficiency and response speed of real-time data can be significantly improved, ensuring that the alarm system can detect and respond to abnormal situations in a timely manner and meet the needs of real-time monitoring and analysis.

[0141] 2 Reduce complexity: By using built-in functions and custom functions in Flink SQL, the complexity of data cleaning, preprocessing, and window operations is simplified, the code maintenance cost and error rate are reduced, and the stability and reliability of the alarm system are improved.

[0142] 3 Enhanced flexibility: The window operation and data aggregation logic of this example application are highly flexible and can be adjusted according to different business needs to adapt to diverse data processing needs, so that the alarm system can flexibly respond to different application scenarios and business changes.

[0143] 4 Improve scalability: This example supports access to a variety of data sources and data formats, has good scalability, and can adapt to different data processing environments and application scenarios. The alarm system can easily expand and integrate new data sources to meet the growing data processing needs.

[0144] In addition, the above example can significantly reduce the false negative rate and missed detection rate by combining the sliding window and the rolling window, thereby improving the accuracy and reliability of page view anomaly detection.

[0145] Fig. 9 : This is a structural block diagram of a browsing volume anomaly detection device provided in an embodiment of the present invention. The device is used to execute the browsing volume anomaly detection method provided in any of the above embodiments. The device and the browsing volume anomaly detection method in the above embodiments belong to the same inventive concept. For details not described in detail in the embodiment of the browsing volume anomaly detection device, please refer to the above embodiments of the browsing volume anomaly detection method. Fig. 9The device may specifically include: a previous time period acquisition module 610, a target pageview acquisition module 620, and a pageview anomaly detection module 630.

[0146] The previous time period acquisition module 610 may be used to acquire a plurality of previous time periods in response to a detected target page whose pageviews are reset to zero, wherein the previous time period is a time period before the reset time period in which the pageviews of the target page are reset to zero;

[0147] The target pageview obtaining module 620 may be used to obtain the target pageview of the target page in each of the plurality of previous time periods.

[0148] The pageview anomaly detection module 630 may be used to perform pageview anomaly detection on a target page based on the obtained multiple target pageviews.

[0149] Optionally, the previous time period acquisition module 610 includes:

[0150] The target page response unit is used to respond to the target page detected when the page views are reset to zero and the duration of the page views being zero after the page views are reset to zero reaches a preset duration.

[0151] On this basis, optionally, the above-mentioned abnormal pageview detection device further includes:

[0152] A first pageview obtaining module is used to use a first aggregation window to perform aggregation processing on first page browsing data within a first time period where the first aggregation window is located, and obtain the first pageviews of each first page represented by the first page browsing data within the first time period;

[0153] A second pageview obtaining module is used to use a second aggregation window to perform aggregation processing on second page browsing data within a second time period where the second aggregation window is located, and obtain the second pageviews of each second page represented by the second page browsing data within the second time period, wherein the second time period is within the first time period, and the preset time length is a time period length related to the first time period and / or the second time period;

[0154] The target page detection module is used to detect the target page for each first page and each second page according to each first pageview amount and each second pageview amount obtained.

[0155] On this basis, optionally, when the start time of the first time period is the same as the start time of the second time period, and the time period duration is the duration of the sub-time period in the first time period that is located after the second time period,

[0156] The target page detection module is specifically used for:

[0157] For each first page, if there is an identical page as the first page among all second pages and the first pageview count of the first page is equal to the second pageview count of the identical page, the first page is detected as the target page.

[0158] On this basis, optionally, a sliding window and a first rolling window are created in advance for the page browsing data, the start time of the sliding window is equal to the start time of the first rolling window, and the step length of the sliding window is equal to the width of the first rolling window;

[0159] The first aggregation window is a window obtained during the sliding process of the sliding window, and the second aggregation window is a window obtained during the rolling process of the first rolling window;

[0160] The page browsing data includes first page browsing data and second page browsing data.

[0161] Based on any of the above devices, optionally, the target pageview obtaining module 620 includes:

[0162] a third pageview obtaining unit, configured to obtain the third pageviews of each third page in a previous time period, obtained by aggregating the third page view data, wherein the third page is a page represented by the third page view data, and the third page view data is page view data in the previous time period;

[0163] The target pageview obtaining unit is used to obtain the target pageview of the target page in the previous time period according to the obtained third pageviews.

[0164] On this basis, optionally, the third page views can be obtained by aggregation through a third aggregation window corresponding to the previous time period; when the target page is detected using the second aggregation window obtained during the scrolling process of the first scrolling window, the third aggregation window is obtained during the scrolling process.

[0165] Based on any of the above devices, optionally, the pageview anomaly detection module 630 includes:

[0166] A record detail generating unit, used for generating a record detail for each non-zero target pageview amount among the obtained multiple target pageview amounts;

[0167] The pageview anomaly detection unit is used to detect the pageview anomaly of the target page based on the generated record details.

[0168] On this basis, the optional pageview anomaly detection unit is specifically used to:

[0169] Obtain a second rolling window created for each generated record detail;

[0170] The second rolling window is used to perform aggregation processing on the details of each record, and based on the obtained aggregation result, the pageview anomaly detection of the target page is performed.

[0171] On this basis, optionally, the aggregation result may include the number of details of the record details; or, the aggregation result may include the number of details and an average number of page views, wherein the average number of page views is obtained based on the sum of the number of time periods in the previous time period and the target page views in each record detail;

[0172] and / or,

[0173] In the case where the target page is detected by using the second aggregation window obtained in the scrolling process of the first scrolling window, the width of the second scrolling window is equal to the width of the first scrolling window.

[0174] Optionally, the multiple preceding time periods include a preset number of consecutive time periods before a previous time period of the return-to-zero time period, and one of the multiple preceding time periods is adjacent to the previous time period.

[0175] The browsing volume abnormality detection device provided by the embodiment of the present invention, in response to the target page whose browsing volume is detected to be zero, obtains multiple previous time periods before the zeroing period when the browsing volume of the target page is zeroed through the previous time period acquisition module, and the multiple previous time periods are used to analyze the change trend of the browsing volume of the target page before the zeroing period; through the target browsing volume acquisition module, for each of the multiple previous time periods, the target browsing volume of the target page in the previous time period is obtained, thereby obtaining the target browsing volume of the target page in each previous time period; then, through the browsing volume abnormality detection module, according to the obtained multiple target browsing volumes, the change trend of the browsing volume of the target page before the zeroing period is analyzed, and based on this, the browsing volume abnormality detection of the target page is performed, that is, whether the browsing volume of the target page is zeroed this time is abnormal. Compared with the implementation scheme of directly judging the browsing volume abnormality of the target page when the browsing volume of the target page is detected to be zeroed, the above device performs browsing volume abnormality detection by analyzing the change trend of the browsing volume of the target page before the zeroing period, thereby avoiding detecting the target page whose browsing volume is normal to be zeroed as abnormal, reducing the false detection rate, and thus improving the accuracy of browsing volume abnormality detection.

[0176] The abnormal browsing volume detection device provided in the embodiment of the present invention can execute the abnormal browsing volume detection method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0177] It is worth noting that in the embodiment of the above-mentioned browsing volume anomaly detection device, the various units and modules included are only divided according to functional logic, but are not limited to the above-mentioned division, as long as the corresponding functions can be achieved; in addition, the specific names of the functional units are only for the convenience of distinguishing each other, and are not used to limit the scope of protection of the present invention.

[0178] Fig.10 A schematic diagram of the structure of an electronic device 10 that can be used to implement an embodiment of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.

[0179] like Fig.10 As shown, the electronic device 10 includes at least one processor 11, and a memory connected to the at least one processor 11, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 11 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 12 or the computer program loaded from the storage unit 18 to the random access memory (RAM) 13. In the RAM 13, various programs and data required for the operation of the electronic device 10 can also be stored. The processor 11, the ROM 12, and the RAM 13 are connected to each other through a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0180] A number of components in the electronic device 10 are connected to the I / O interface 15, including: an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a disk, an optical disk, etc.; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0181] The processor 11 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any appropriate processor, controller, microcontroller, etc. The processor 11 executes the various methods and processes described above, such as the browsing volume anomaly detection method.

[0182] In some embodiments, the browsing volume anomaly detection method may be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 10 via the ROM 12 and / or the communication unit 19. When the computer program is loaded into the RAM 13 and executed by the processor 11, one or more steps of the browsing volume anomaly detection method described above may be performed. Alternatively, in other embodiments, the processor 11 may be configured to execute the browsing volume anomaly detection method in any other appropriate manner (e.g., by means of firmware).

[0183] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0184] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer program is executed by the processor, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer program may be executed entirely on the machine, partially on the machine, partially on the machine as a stand-alone software package and partially on a remote machine, or entirely on a remote machine or server.

[0185] In the context of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in combination with an instruction execution system, device or equipment. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0186] To provide interaction with a user, the systems and techniques described herein may be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).

[0187] The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0188] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The client and server relationship is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services.

[0189] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

[0190] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A method for detecting abnormal pageview volume, characterized in that: include: In response to detecting a target page whose pageviews are reset to zero, acquiring a plurality of previous time periods, wherein the previous time periods are time periods before the reset-to-zero time period in which the pageviews of the target page are reset to zero; For each of the plurality of previous time periods, obtaining a target pageview count of the target page in the previous time period; Based on the obtained multiple target page views, abnormal page view detection of the target page is performed.

2. The method according to claim 1, characterized in that The target page in response to detecting that the pageview count is zero includes: In response to the detected page views returning to zero, and the duration of the page views being zero after returning to zero reaching a preset duration, a target page is selected.

3. The method according to claim 2, characterized in that Also includes: Using a first aggregation window, performing aggregation processing on first page browsing data within a first time period where the first aggregation window is located, to obtain first page browsing counts of each first page represented by the first page browsing data within the first time period; Using a second aggregation window, performing aggregation processing on the second page browsing data within a second time period where the second aggregation window is located, to obtain the second page browsing volume of each second page represented by the second page browsing data within the second time period, wherein the second time period is within the first time period, and the preset time length is a time period length related to the first time period and / or the second time period; The target page is detected for each of the first pages and each of the second pages according to the obtained first page views and second page views.

4. The method according to claim 3, characterized in that In the case where the start time of the first time period is the same as the start time of the second time period, and the time period duration is the duration of a sub-time period in the first time period that is located after the second time period, The detecting of the target page for each of the first pages and each of the second pages according to each of the first page views and each of the second page views includes: For each of the first pages, if there is an identical page as the first page among all the second pages and the first pageview count of the first page is equal to the second pageview count of the identical page, it is detected that the first page is the target page.

5. The method according to claim 4, characterized in that A sliding window and a first rolling window are created in advance for the page browsing data, the start time of the sliding window is equal to the start time of the first rolling window, and the step length of the sliding window is equal to the width of the first rolling window; The first aggregation window is a window obtained during the sliding process of the sliding window, and the second aggregation window is a window obtained during the rolling process of the first rolling window; The page browsing data includes the first page browsing data and the second page browsing data.

6. The method according to any one of claims 1 to 5, characterized in that: The obtaining of the target page views of the target page in the previous time period includes: Obtaining the third page views of each third page in the previous time period, obtained by aggregating the third page view data, wherein the third page is a page represented by the third page view data, and the third page view data is page view data in the previous time period; According to each of the acquired third page views, a target page view of the target page in the previous time period is obtained.

7. The method according to claim 6, characterized in that The third pageviews are obtained by aggregation through a third aggregation window corresponding to the previous time period; In a case where the target page is detected using a second aggregation window obtained during a scrolling process of a first scrolling window, the third aggregation window is obtained during the scrolling process.

8. The method according to any one of claims 1 to 5, characterized in that The step of performing abnormal detection of page views of the target page according to the obtained multiple target page views includes: Generate a record detail for each non-zero target pageview count among the obtained multiple target pageview counts; Based on the generated record details, abnormal page views of the target page are detected.

9. The method according to claim 8, characterized in that The detecting of abnormal browsing volume of the target page according to each of the generated record details includes: Obtain a second scroll window created for each of the generated record details; Aggregation processing is performed on each of the record details using the second scrolling window, and abnormal page views detection of the target page is performed based on the obtained aggregation result.

10. The method according to claim 9, characterized in that The aggregation result includes the number of details of the record details; or, the aggregation result includes the number of details and an average number of page views, wherein the average number of page views is obtained according to the sum of the number of time periods in the previous time period and the target page views in each of the record details; and / or, In the case where the target page is detected by using a second aggregation window obtained during the scrolling process of the first scrolling window, the width of the second scrolling window is equal to the width of the first scrolling window.

11. The method according to claim 1, characterized in that The plurality of preceding time periods include a preset number of time periods that are continuous before a previous time period of the return-to-zero time period, and one of the plurality of preceding time periods is adjacent to the previous time period.

12. A device for detecting abnormal pageview volume, characterized in that: include: A previous time period acquisition module, configured to acquire a plurality of previous time periods in response to a detected target page whose pageviews are reset to zero, wherein the previous time periods are time periods before the reset time period in which the pageviews of the target page are reset to zero; A target pageview obtaining module, used for obtaining, for each of the plurality of previous time periods, a target pageview of the target page in the previous time period; The pageview anomaly detection module is used to perform pageview anomaly detection on the target page based on the obtained multiple target pageviews.

13. An electronic device, characterized in that: include: at least one processor; as well as a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor executes the browsing volume anomaly detection method according to any one of claims 1 to 11.

14. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the browsing volume anomaly detection method as described in any one of claims 1-11 when executed.

15. A computer program product, characterized in that The computer program product comprises a computer program, and when the computer program is executed by a processor, the computer program implements the method for detecting abnormal browsing volume according to any one of claims 1 to 11.

Images