Data monitoring method, storage medium, electronic equipment and program product

Abstract

The invention discloses a data monitoring method, a storage medium, electronic equipment and a program product. Relates to the field of big data, and comprises the following steps: obtaining interaction data of a plurality of clients and a formation time point of the interaction data, the interaction data being data generated by interaction behaviors among the plurality of clients; a dynamic network structure of a network model is determined based on the interaction data and the formation time, the network model is used for representing interaction behaviors among the multiple clients, and the dynamic network structure represents a network structure displaying the interaction data according to the sequence of the formation time; the dynamic network structure is input into an anomaly monitoring model, anomaly monitoring is carried out on the multiple clients through the anomaly monitoring model, a monitoring result is obtained, and the monitoring result is used for representing whether abnormal clients with abnormal interaction exist in the multiple clients or not. Through the data monitoring method and device, the problem of low data monitoring accuracy in related technologies is solved.

Description

Technical Field

[0001] The present application relates to the field of big data, and specifically, to a data monitoring method, storage medium, electronic device and program product. Background Art

[0002] Dynamic network data has two core characteristics: complexity and timeliness. The complexity comes from the high dimensionality and diverse data forms of network data, while timeliness is reflected in the rapid changes that may occur in network structure and potential structure within a given time interval.

[0003] In the existing technology, feature-based methods and generation methods are mostly used when performing dynamic network data detection. The former focuses on extracting network features and detecting changes, while the latter fits the network through a probabilistic model. However, there is a general problem of failing to effectively integrate time information, resulting in the inability to timely detect changes in the network structure during the monitoring process, which in turn leads to low data monitoring accuracy in related technologies.

[0004] Currently, no effective solution has been proposed to the problem of low data monitoring accuracy in related technologies. Summary of the invention

[0005] The main purpose of this application is to provide a data monitoring method, storage medium, electronic device and program product to solve the problem of low data monitoring accuracy in related technologies.

[0006] In order to achieve the above-mentioned purpose, according to one aspect of the present application, a data monitoring method is provided. The method includes: obtaining the interaction data of multiple clients and the formation time point of the interaction data, wherein the interaction data is the data generated by the interaction behavior between the multiple clients; determining the dynamic network structure of the network model based on the interaction data and the formation time, wherein the network model is used to represent the interaction behavior between the multiple clients, and the dynamic network structure represents the network structure that displays the interaction data in the order of the formation time; inputting the dynamic network structure into the abnormal monitoring model, using the abnormal monitoring model to perform abnormal monitoring on the multiple clients, and obtaining the monitoring results, wherein the monitoring results are used to indicate whether there are abnormal clients with abnormal interactions among the multiple clients.

[0007] Furthermore, an anomaly monitoring model is used to perform anomaly monitoring on multiple clients to obtain monitoring results, including: using the anomaly monitoring model to perform anomaly monitoring on multiple clients to obtain interaction change time points of the network model, wherein the interaction change time points are used to indicate time points when interaction data in a dynamic network structure changes; based on the interaction change time points and the dynamic network structure, anomaly monitoring is performed on multiple clients to obtain monitoring results.

[0008] Furthermore, an anomaly monitoring model is used to perform anomaly monitoring on multiple clients to obtain interaction change time points of the network model, including: monitoring the interaction activity and preset interaction activity intervals of multiple clients, wherein the preset interaction activity is used to represent an interaction activity interval that conforms to the client interaction state; in response to the presence of at least one target client among the multiple clients whose interaction activity is not in the preset interaction activity interval, determining the interaction change time points of the network model based on the interaction activity change time points of the at least one target client.

[0009] Furthermore, based on the interaction change time point and the dynamic network structure, multiple clients are monitored for abnormalities to obtain monitoring results, including: based on the interaction change time point and the dynamic network structure, determining a first network structure and a second network structure of a network model, wherein the first network structure is used to represent the network structure of the network model before the interaction change time point, and the second network structure is used to represent the network structure of the network model after the interaction change time point; based on the first network structure and the second network structure, multiple clients are monitored for abnormalities to obtain monitoring results.

[0010] Furthermore, based on the first network structure and the second network structure, multiple clients are monitored for abnormalities to obtain monitoring results, including: comparing the first network structure and the second network structure to determine whether there is a target client among the multiple clients, wherein the target client is at least one client among the multiple clients whose interaction activity change rate is greater than a preset activity change rate; in response to the existence of the target client among the multiple clients, determining that the target client is an abnormal client, and determining that the monitoring result is an abnormal client with interaction abnormalities among the multiple clients based on the abnormal client; in response to the absence of the target client among the multiple clients, determining that the monitoring result is that there is no abnormal client with interaction abnormalities among the clients.

[0011] Further, after responding to the existence of the target client among multiple clients, the method also includes: outputting the target client; in response to receiving an abnormal confirmation instruction from the target client within a preset time period, determining that the target client is an abnormal client, and determining that the monitoring result is that there is an abnormal client with interaction abnormalities among the multiple clients; in response to not receiving an abnormal confirmation instruction from the target client within the preset time period, determining that the monitoring result is that there is no abnormal client with interaction abnormalities among the clients.

[0012] Furthermore, the method also includes: obtaining interaction relationships among multiple clients, wherein the interaction relationships are formed by interaction behaviors among the multiple clients; and constructing a network model with the multiple clients as nodes and the interaction relationships as edges.

[0013] In order to achieve the above-mentioned purpose, according to another aspect of the present application, a data monitoring device is provided. The device includes: a first acquisition module, used to acquire the interaction data of multiple clients and the formation time point of the interaction data, wherein the interaction data is the data generated by the interaction behavior between multiple clients; a first determination module, used to determine the dynamic network structure of the network model based on the interaction data and the formation time, wherein the network model is used to represent the interaction behavior between multiple clients, and the dynamic network structure represents the network structure that displays the interaction data in the order of formation time; a monitoring module, used to input the dynamic network structure into the abnormal monitoring model, use the abnormal monitoring model to perform abnormal monitoring on multiple clients, and obtain monitoring results, wherein the monitoring results are used to indicate whether there are abnormal clients with abnormal interactions among multiple clients.

[0014] In order to achieve the above-mentioned purpose, according to another aspect of the present application, a computer-readable storage medium is provided, and the computer-readable storage medium includes a stored executable program, wherein when the executable program runs, the device where the computer-readable storage medium is located is controlled to execute the above-mentioned data monitoring method.

[0015] In order to achieve the above-mentioned purpose, according to another aspect of the present application, an electronic device is provided, comprising: a memory storing an executable program; and a processor for running the program, wherein the above-mentioned data monitoring method is executed when the program is running.

[0016] In order to achieve the above-mentioned purpose, according to another aspect of the present application, a computer program product is provided, including a computer program, and the computer program implements the above-mentioned data monitoring method when executed by a processor.

[0017] In an embodiment of the present application, first, the interaction data of multiple clients and the formation time point of the interaction data are obtained; secondly, the dynamic network structure of the network model is determined based on the interaction data and the formation time point; finally, the dynamic network structure is input into the anomaly monitoring model, and the anomaly monitoring model is used to perform anomaly monitoring on multiple clients in the dynamic network structure to obtain monitoring results. It is easy to notice that while obtaining the interaction data, the present application obtains the formation time point of the interaction data, and jointly determines the dynamic network structure based on the interaction data and the formation time point. The above process takes into account the time characteristics and structural characteristics of the network model, and can timely obtain the changes of the network model in the time dimension, so as to timely discover the time point of abnormal behavior, effectively improve the accuracy and timeliness of anomaly monitoring, and thus solve the technical problem of low data monitoring accuracy in related technologies. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] The drawings constituting a part of the present application are used to provide a further understanding of the present application. The illustrative embodiments and descriptions of the present application are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0019] Figure 1 A hardware structure block diagram of a computer terminal for implementing a data monitoring method is shown;

[0020] Figure 2 is a flow chart of a data monitoring method according to an embodiment of the present application;

[0021] Figure 3 is a schematic diagram of a data monitoring device according to an embodiment of the present application;

[0022] Figure 4 It is a structural block diagram of an electronic device according to an embodiment of the present application. DETAILED DESCRIPTION

[0023] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present application.

[0024] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0025] First, some nouns or terms that appear in the description of the embodiments of the present application are subject to the following explanations:

[0026] Change-Point Dynamic Network LatentSpace Model (CP-DLS Model): The Change-Point Dynamic Network LatentSpace Model can better fit the dynamic network by adding the time factor to the latent space model through the idea of ​​change points, timely capture the changes in the network's latent structure and network structure, and find the change points. It can further infer how the latent structure and network structure of the dynamic network change at which moment, and can better perform dynamic network analysis.

[0027] Latent Space Model (DLS Model) is a statistical model that is mainly used to understand and predict the connection patterns between nodes in complex networks.

[0028] It should be noted that the collected information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data for display, data for analysis, etc.) involved in this application are information and data authorized by the user or fully authorized by all parties, and the collection, storage, use, processing, transmission, provision, disclosure and application of relevant data are in compliance with relevant laws, regulations and standards, necessary confidentiality measures are taken, and public order and good customs are not violated, and corresponding operation entrances are provided for users to choose to authorize or refuse. For example, an interface is set up between this system and relevant users or institutions to provide users with corresponding operation entrances for users to choose to agree or refuse the results of automated decision-making; if the user chooses to refuse, the expert decision-making process will be entered.

[0029] Example 1

[0030] According to an embodiment of the present application, a method embodiment of data monitoring is also provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although the logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0031] The method embodiment provided in the first embodiment of the present application can be executed in a mobile terminal, a computer terminal or a similar computing device. Figure 1 FIG. 1 shows a hardware structure block diagram of a computer terminal for implementing a data monitoring method. Figure 1As shown, the computer terminal 10 (or mobile device) may include one or more (102a, 102b, ..., 102n are used to illustrate) processors 102 (the processor 102 may include but is not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA), a memory 104 for storing data, and a transmission device 106 for communication functions. In addition, it may also include: a display, an input / output interface (I / O interface), a universal serial bus (USB) port (which may be included as one of the ports of the BUS bus), a network interface, a power supply and / or a camera. It can be understood by those skilled in the art that Figure 1 The structure shown is only for illustration and does not limit the structure of the above electronic device. Figure 1 More or fewer components as shown, or with Figure 1 Different configurations shown.

[0032] It should be noted that the one or more processors 102 and / or other data processing circuits described above may generally be referred to herein as "data processing circuits". The data processing circuits may be embodied in whole or in part as software, hardware, firmware, or any other combination thereof. In addition, the data processing circuit may be a single independent processing module, or may be incorporated in whole or in part into any of the other components in the computer terminal 10 (or mobile device). As described in the embodiments of the present application, the data processing circuit acts as a processor control (e.g., selection of a variable resistor terminal path connected to an interface).

[0033] The memory 104 can be used to store software programs and modules of application software, such as the program instructions / data storage device corresponding to the data monitoring method in the embodiment of the present application. The processor 102 executes various functional applications and data processing by running the software programs and modules stored in the memory 104, that is, realizing the above-mentioned data monitoring method. The memory 104 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some examples, the memory 104 may further include a memory remotely arranged relative to the processor 102, and these remote memories may be connected to the computer terminal 10 via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and a combination thereof.

[0034] The transmission device 106 is used to receive or send data via a network. The specific example of the above network may include a wireless network provided by a communication provider of the computer terminal 10. In one example, the transmission device 106 includes a network adapter (Network Interface Controller, NIC), which can be connected to other network devices through a base station so as to communicate with the Internet. In one example, the transmission device 106 can be a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

[0035] The display may be, for example, a touch screen liquid crystal display (LCD) that enables a user to interact with a user interface of the computer terminal 10 (or mobile device).

[0036] Under the above operating environment, this application provides Figure 2 The data monitoring method shown. Figure 2 is a flow chart of a data monitoring method according to an embodiment of the present application. Figure 2 As shown, the method comprises the following steps:

[0037] Step S202, obtaining interaction data of multiple clients and the time point at which the interaction data is formed, wherein the interaction data is data generated by interaction behaviors between the multiple clients.

[0038] The above-mentioned client may refer to any entity or system participating in the interaction. The types of clients may include but are not limited to individual customers, corporate customers, and any nodes that can initiate, receive or participate in data interaction. The specific client should be determined based on actual conditions and is not limited here. The client can be used as the basis of the network structure to generate and receive data.

[0039] The above-mentioned interactive behavior may refer to any interactive activities between clients that can be recorded and analyzed. The types of interactive behaviors may include but are not limited to transaction behaviors, social behaviors, and communication behaviors. The specific interactive behaviors should be determined based on the nature of the behaviors between the clients and are not limited here. Interactive behaviors can be used to reveal the patterns of data flow in the network and help understand the dynamic characteristics and functional properties of the network.

[0040] The above-mentioned interaction data may refer to data records generated by interaction behaviors between clients. The types of interaction data may include but are not limited to financial transaction records, information transaction records, device communication records, etc. The specific interaction data should be determined based on the system usage scenario and actual interaction behavior. No limitation is made here. The interaction data can be used to provide specific records of network behavior and is the basic data for analyzing network structure, monitoring abnormal behavior, and predicting future trends.

[0041] The above-mentioned formation time point may refer to the specific time when each interaction data is generated or recorded. The formation time point may be used to give the network data a time attribute. By analyzing the interaction data at different time points, the evolution of the network structure and behavior over time may be tracked.

[0042] In an optional embodiment, by collecting the interaction data of multiple clients and the time point corresponding to each interaction data, the specific interaction behaviors between multiple clients and the time when the interaction behaviors occurred can be obtained, so as to facilitate the subsequent monitoring and analysis of the client interaction behaviors. At the same time, through the above data collection process, not only can the changes in the network structure be captured in a timely manner, but also the time when these changes occur can be accurately located, which is crucial for identifying abnormal behaviors and potential risks.

[0043] Step S204, determining a dynamic network structure of a network model based on the interaction data and the formation time, wherein the network model is used to represent the interaction behavior between multiple clients, and the dynamic network structure represents a network structure that displays the interaction data in the order of the formation time.

[0044] The above-mentioned network model may refer to an interaction data time model constructed based on interaction data and formation time. The network model may be used to quantify the strength and type of relationships between clients, and to reveal the topological structure and potential properties of a dynamic network.

[0045] The above dynamic network structure can refer to the network structure of interactive data formed in the network model in chronological order. The dynamic network structure not only includes the static description of nodes and edges, but also takes into account the time dimension, that is, according to the formation time of interactive data, it shows the process of network evolution over time. The dynamic network structure can capture the temporal characteristics of the increase, decrease, and attribute change of edges in the network, thereby providing a network view that changes over time.

[0046] In an optional embodiment, the dynamic network structure is determined by the interaction data and the formation time corresponding to the interaction data. The obtained dynamic network structure enhances the time sensitivity of the network model, so that the network model can track the changes of the network structure over time, which is crucial for understanding and predicting time-based system behaviors, such as risk propagation in financial transaction networks and information diffusion in social networks.

[0047] Step S206, inputting the dynamic network structure into the anomaly monitoring model, using the anomaly monitoring model to perform anomaly monitoring on multiple clients to obtain monitoring results, wherein the monitoring results are used to indicate whether there are abnormal clients with abnormal interactions among the multiple clients.

[0048] The above-mentioned anomaly monitoring model may refer to a statistical or machine learning model that analyzes patterns and trends in a data set to identify data points or data sequences that do not follow regular patterns. The anomaly monitoring model may include but is not limited to a dynamic network latent space model with a change point (Change-Point Dynamic Network Latent Space Model, abbreviated as CP-DLS Model), a latent space model (Latent Space Model, abbreviated as DLS Model), etc. The specific network model should be determined based on whether there are change points in the network and actual needs. No limitation is made here. The anomaly detection model can be used to monitor dynamic network structures, identify abnormal behaviors or abnormal patterns in the network, etc.

[0049] The above-mentioned anomaly monitoring may refer to the process of real-time or periodic inspection of the dynamic network structure based on the anomaly detection model. Anomaly monitoring may be used to discover potential security risks, system failure points or abnormal behaviors in advance so as to take timely response measures.

[0050] The above-mentioned monitoring results may refer to the output of the anomaly monitoring process. The monitoring results provide clear information about whether and where anomalies exist in the network. The types of monitoring results may include but are not limited to no abnormal clients, abnormal clients with specific abnormal clients identified, as well as specific information such as the time point of the abnormality, the type of abnormal behavior, etc. This information is crucial for further investigation and risk assessment.

[0051] The above-mentioned abnormal clients may refer to clients whose behaviors, attributes or interaction patterns deviate from the normal range and are identified by the anomaly detection model in the dynamic network structure analysis. The types of abnormal clients may include but are not limited to low-risk abnormal clients, medium-risk abnormal clients, high-risk abnormal clients, etc. The specific abnormal clients need to be determined based on the actual monitoring results and are not limited here. Abnormal clients may involve security issues such as fraud, attack, system abuse, etc., which require further investigation and processing.

[0052] In an optional embodiment, by inputting the dynamic network structure into the anomaly detection model, the anomaly detection model can be used to timely capture the changes in the dynamic network structure and accurately locate the change points, and further use the anomaly monitoring model to detect abnormal behavior of the changing network structure, so that financial institutions can discover potential risks earlier, improve the timeliness and accuracy of risk warnings, and effectively prevent financial crimes and protect customer asset security. In addition, this anomaly detection method based on dynamic networks is also applicable to other complex interactive systems that need to be monitored, such as telecommunications networks, power networks, etc., and can quickly respond to abnormal activities in the system, reduce system failures and security threats, and improve overall operational efficiency and security.

[0053] In an optional embodiment, considering that dynamic network data may have mutation points, the present application improves on the basis of the latent space model, adds the time factor through the idea of ​​change points, and establishes a dynamic network latent space model with change points, namely the above-mentioned CP-DLS model.

[0054] Dynamic network data can be expressed as Y = (Y 1 ,Y 2 ,...,Y T ), where Y t Represents the adjacency matrix of the network at time t. In the present invention, an undirected and unweighted network is considered, that is, or 1, the number of network nodes does not change with time, and is always n. Adding time information to the latent space model through the idea of ​​change points, we get the following calculation formula:

[0055]

[0056] In the formula, P(Y T |φ) represents a dynamic network model, It represents the multiplication of the probability of the network at each time point before the change point occurs. It represents the multiplication of the probability of the network at each time point after the change point occurs. It indicates whether there is a connection between node i and node j at time t, the change point position k is unknown, and φ is a parameter set consisting of the estimated parameter α and the potential position Z.

[0057] Assuming that there are no change points in the dynamic network, the CP-DLS model degenerates into a classic latent space model. The estimation of the latent position in the latent space model is simplified by using a logistic regression model, and the confidence interval of the latent position is calculated using a standard Markov random simulation algorithm. Since the latent space model uses conditional independence for modeling, the log-likelihood function is relatively simple, and the calculation formula is as follows:

[0058]

[0059] Where logP(Y|η) represents the log-likelihood network of the dynamic network, η ij represents the weight associated with the node pair (i, j), η is a function of the parameter and the potential position, ∑ represents the iterative calculation of all node pairs (i, j), and y ij It indicates whether there is a connection between the node pair (i, j), so the likelihood-based estimation method is feasible.

[0060] According to the hypothesis testing problem, a likelihood ratio statistic is constructed, and the calculation formula is as follows:

[0061]

[0062] In the formula, represents the likelihood ratio statistic, which is used to detect change points, represents the dynamic network likelihood ratio before the change point occurs, represents the dynamic network likelihood ratio after the change point occurs, represents the overall dynamic network likelihood ratio, t n Indicates the time when the change point may occur, Y t represents the observed value at time t, φ α ,φ b They represent the parameter sets before and after the change point respectively, φ0 represents the overall parameter set, and ln represents the natural logarithm function.

[0063] To identify potential change points, select the value with the largest likelihood ratio statistic, calculated as follows:

[0064]

[0065] Where, t n Indicates the moment when a change point may occur. represents the likelihood ratio statistic, max represents the maximum value, is the estimated change point location.

[0066] In an embodiment of the present application, first, the interaction data of multiple clients and the formation time point of the interaction data are obtained; secondly, the dynamic network structure of the network model is determined based on the interaction data and the formation time point; finally, the dynamic network structure is input into the anomaly monitoring model, and the anomaly monitoring model is used to perform anomaly monitoring on multiple clients in the dynamic network structure to obtain monitoring results. It is easy to notice that while obtaining the interaction data, the present application obtains the formation time point of the interaction data, and jointly determines the dynamic network structure based on the interaction data and the formation time point. The above process takes into account the time characteristics and structural characteristics of the network model, and can timely obtain the changes of the network model in the time dimension, so as to timely discover the time point of abnormal behavior, effectively improve the accuracy and timeliness of anomaly monitoring, and thus solve the technical problem of low data monitoring accuracy in related technologies.

[0067] Optionally, in the data monitoring method provided in the embodiment of the present application, an anomaly monitoring model is used to perform anomaly monitoring on multiple clients to obtain monitoring results, including: using the anomaly monitoring model to perform anomaly monitoring on multiple clients to obtain interaction change time points of the network model, wherein the interaction change time points are used to indicate the time points when interaction data changes in the dynamic network structure; based on the interaction change time points and the dynamic network structure, multiple clients are monitored for anomalies to obtain monitoring results.

[0068] The above-mentioned interaction change time point may refer to a specific time point at which the interaction data in the network structure changes significantly. The types of interaction change time points may include but are not limited to connection establishment / disconnection time points, attribute change time points, structure change time points, and abnormal behavior time points. The specific interaction change time points should be determined based on actual conditions and are not limited here. The interaction change time points can be used to reveal sudden changes in behavior patterns or attributes in the network, which helps the anomaly monitoring model identify potential anomalies or risks.

[0069] In an optional embodiment, when performing anomaly detection on multiple clients through an anomaly detection model, the time point at which the interaction data in the dynamic network structure changes, i.e., the interaction change time point, can be first obtained, and then anomaly detection is performed on multiple clients based on the interaction change time point and the dynamic network structure to obtain monitoring results. In the above process, by accurately identifying and analyzing the interaction change time point, the anomaly monitoring model can provide an in-depth understanding of the changes in the dynamic network structure, thereby helping decision makers to promptly discover and respond to anomalies in complex systems, thereby improving the security and stability of the system.

[0070] Optionally, in the data monitoring method provided in the embodiment of the present application, an anomaly monitoring model is used to perform anomaly monitoring on multiple clients to obtain the interaction change time point of the network model, including: monitoring the interaction activity and preset interaction activity interval of multiple clients, wherein the preset interaction activity is used to represent the interaction activity interval that conforms to the client interaction state; in response to the presence of at least one target client among the multiple clients whose interaction activity is not in the preset interaction activity interval, determining the interaction change time point of the network model based on the interaction activity change time point of the at least one target client.

[0071] The above-mentioned interactive activity may refer to an indicator used to measure the frequency and intensity of interactive behaviors participated in by nodes (i.e., clients) in the network. The types of interactive activity may include but are not limited to time point activity, weighted activity, etc. The specific interactive activity needs to be determined based on information such as transaction frequency and information sending and receiving volume. No limitation is made here. The interactive activity can be used to reflect the activity level of the client in the network.

[0072] The above-mentioned preset interaction activity interval may refer to a pre-defined activity range that reflects the normal client interaction status. The types of preset interaction activity intervals may include but are not limited to preset interaction activity intervals based on average values ​​and standard deviations and dynamically adjusted activity intervals. The preset interaction activity intervals may be determined based on historical data statistics and data types, which are not limited here. The preset interaction activity intervals can be used to identify abnormal behaviors whose interaction activity exceeds the normal range.

[0073] The above-mentioned target client may refer to a network node whose interactive activity is found not to be within a preset interactive activity range during abnormal monitoring. The interactive activity of the target client may deviate from the normal range due to abnormal behavior, system failure or fraudulent activities.

[0074] The above-mentioned interaction activity change time point may refer to the specific time point when the interaction activity of the target client significantly deviates from the preset interval. The interaction activity change time point may correspond to the beginning or end of abnormal behavior and is a key time marker for risk monitoring and event response.

[0075] In an optional embodiment, the interaction behaviors of multiple clients are deeply analyzed through an abnormal monitoring model to identify the time points of significant changes in the interaction activity in the network model, that is, the interaction change time points. This process first monitors the interaction activity of each client and compares it with the preset interaction activity interval. When it is found that the interaction activity of at least one target client exceeds this preset interval, it indicates that the behavior of the client deviates from the normal state and may involve abnormal activities. At this time, the interaction activity change time points of the target client are further analyzed, and then the interaction change time points of the network model are determined based on the interaction activity change time points. This series of monitoring steps can quickly locate abnormal behaviors in the network and accurately capture the time points when abnormal behaviors occur, so as to take timely measures, such as effectively defending against fraudulent transactions in financial networks, preventing the spread of malicious information in social networks, or warning of equipment failures in production networks. This method not only improves the accuracy and response speed of anomaly detection, but also provides clear time clues for subsequent abnormal behavior analysis and risk control, enhances the efficiency and pertinence of risk management and security protection, and helps maintain the stability and security of the network system.

[0076] Optionally, in the data monitoring method provided in the embodiment of the present application, multiple clients are monitored for abnormalities based on the interaction change time point and the dynamic network structure to obtain monitoring results, including: based on the interaction change time point and the dynamic network structure, determining a first network structure and a second network structure of the network model, wherein the first network structure is used to represent the network structure of the network model before the interaction change time point, and the second network structure is used to represent the network structure of the network model after the interaction change time point; multiple clients are monitored for abnormalities based on the first network structure and the second network structure to obtain monitoring results.

[0077] The above-mentioned first network structure may refer to a collection of connection relationships and attribute characteristics between nodes (i.e., clients) in a network model before the interaction change time point. The types of the first network structure may include but are not limited to directed / undirected network structures, weighted / unweighted network structures, and static / dynamic network structures, etc. The specific first network structure should be determined based on the design of the network model and actual needs, and is not limited here. The first network structure can be used to reflect the stable state of the network model before the interaction change time point.

[0078] The above-mentioned second network structure may refer to the connection relationship and attributes between network nodes after the interaction change time point. The types of the second network structure may include but are not limited to directed / undirected network structures, weighted / unweighted network structures, static / dynamic network structures, etc. The specific second network structure should be determined according to the design of the network model and actual needs, and is not limited here. The second network structure can be used for network status analysis, anomaly monitoring and risk assessment, system decision-making and optimization, and prediction and analysis of future network trends.

[0079] In an optional embodiment, the first network structure of the dynamic network structure before the interaction change time point and the second network structure of the dynamic network structure after the interaction change time point are determined respectively, so that the change of the network structure can be obtained based on the comparison analysis of the first network structure and the second network structure, and then the abnormal behavior in multiple clients can be determined to obtain the monitoring results. This process can not only analyze network dynamics and identify abnormal client behavior, but also help to quickly respond to potential risks, deeply understand the behavior patterns and optimization strategies of the network system, and thus improve the overall system security and efficiency.

[0080] Optionally, in the data monitoring method provided in the embodiment of the present application, multiple clients are monitored for abnormalities based on the first network structure and the second network structure to obtain monitoring results, including: comparing the first network structure and the second network structure to determine whether there is a target client among the multiple clients, wherein the target client is at least one client among the multiple clients whose interaction activity change rate is greater than a preset activity change rate; in response to the existence of the target client among multiple clients, determining that the target client is an abnormal client, and determining that the monitoring result is an abnormal client with interaction abnormalities among the multiple clients based on the abnormal client; in response to the absence of the target client among the multiple clients, determining that the monitoring result is that there is no abnormal client with interaction abnormalities among the clients.

[0081] The above-mentioned interaction activity change rate may refer to the ratio of the change in interaction activity of a network node (ie, client) to its original activity during the transition from the first network structure to the second network structure. The interaction activity change rate may be used to evaluate the dynamics of node behavior in the network.

[0082] The above-mentioned preset activity change rate may refer to a preset standard threshold value. The preset activity change rate may be determined based on historical data analysis and business needs. The preset activity change rate may be used as a judgment standard to determine whether the change in node interaction activity is abnormal.

[0083] The above-mentioned interaction anomaly may refer to the interaction behavior of the network node deviating from the normal or preset behavior pattern. The types of interaction anomalies may include but are not limited to sudden anomalies, continuous anomalies, abnormal connection patterns, and attribute anomalies. The specific interaction anomalies need to be determined based on the actual situation and are not limited here. Interaction anomalies may arise from a variety of situations such as fraud, misoperation, network attacks, or system failures. Their common feature is the sudden change in node interaction activity, which exceeds the preset activity change rate.

[0084] In an optional embodiment, by analyzing the difference between the first network structure and the second network structure, a node whose interactive activity change rate exceeds a preset interactive activity change rate is determined, i.e., a target client. Once the target client is detected, the target client is marked as an abnormal client; if the target client is not detected, it means that the monitoring result is that there is no abnormal client among the clients. The above process can effectively identify whether the change in interactive activity in the network is abnormal. By setting a reasonable preset activity change rate, truly vigilant abnormal behaviors can be screened out, avoiding misjudgment of normal fluctuations. At the same time, abnormal behaviors can be captured in real time to ensure the security and stable operation of the network, reduce potential risks, and improve overall operational efficiency.

[0085] Optionally, in the data monitoring method provided in an embodiment of the present application, after responding to the existence of a target client among multiple clients, the method further includes: outputting the target client; in response to receiving an abnormality confirmation instruction from the target client within a preset time period, determining that the target client is an abnormal client, and determining that the monitoring result is that there is an abnormal client with interaction abnormalities among the multiple clients; in response to not receiving an abnormality confirmation instruction from the target client within the preset time period, determining that the monitoring result is that there is no abnormal client with interaction abnormalities among the clients.

[0086] The above-mentioned abnormal confirmation instruction may refer to an instruction from the system or user to further confirm the validity and specific nature of the abnormal behavior after monitoring the abnormal behavior of the target client. The abnormal confirmation instruction may be automatically issued by the system, or sent after manual review. The abnormal confirmation instruction can be used to verify whether the change in the interactive activity of the target client does constitute abnormal behavior, as well as the potential causes of such abnormal behavior.

[0087] The above-mentioned preset time period may refer to a specific time window for waiting to receive an abnormal confirmation instruction after the system detects abnormal behavior of the target client. The preset time period can be used to balance the needs of immediate response and in-depth analysis of abnormal behavior, ensuring that the confirmation and processing of abnormal behavior are completed within a reasonable time, while avoiding premature misjudgment or unnecessary emergency measures.

[0088] In an optional embodiment, after outputting the target client, if an abnormal confirmation instruction from the target client is received within a preset time period, the target client is determined to be an abnormal client; if no abnormal confirmation instruction from the target client is received within the preset time period, it means that there is no abnormal client among the clients. This process not only ensures the accurate confirmation of abnormal behavior, but also strengthens communication with the client, providing a basis for taking reasonable risk management measures. At the same time, the setting of the preset time period improves the response efficiency of the system and the accuracy of decision-making, which plays an important role in ensuring the security and stability of the network.

[0089] Optionally, in the data monitoring method provided in the embodiment of the present application, the method also includes: obtaining interaction relationships among multiple clients, wherein the interaction relationships are formed by interaction behaviors among multiple clients; and constructing a network model with multiple clients as nodes and interaction relationships as edges.

[0090] The above-mentioned interactive relationship may refer to the connection formed between multiple clients through some form of interaction or transaction activities. The types of interactive relationships may include but are not limited to financial transaction-type interactive relationships, information exchange-type interactive relationships, cooperative interactive relationships, and service-type interactive relationships. The specific types of interactive relationships need to be determined based on the actual interactive behavior and are not limited here. The interactive relationship can be used to reflect the direct behavioral interaction between clients, and may also involve indirect influences, such as interactive behaviors conducted through third-party platforms or services. In dynamic network analysis, interactive relationships are the basis for building a network model, in which each client is regarded as a node in the network, and the interactive relationship between nodes is represented in the model in the form of edges.

[0091] In an optional embodiment, each client is regarded as a node in the network, and the interaction relationship between them becomes the edge connecting these nodes, thus forming a dynamic network structure that reflects the actual interaction pattern. The above network model can quickly identify the mutation points of the interaction pattern, that is, the time points when abnormal changes may occur in the network structure, so as to quickly lock those clients with abnormal activity changes, and conduct in-depth analysis and necessary intervention on them. In addition, by incorporating time information into the network model, it is possible to analyze network dynamics more accurately and adjust strategies in time to deal with potential risks, thereby significantly improving network security, stability and efficiency.

[0092] The present application obtains the formation time point of the interaction data while obtaining the interaction data, and determines the dynamic network structure based on the interaction data and the formation time point, taking into account the time characteristics and structural characteristics of the network model, and can timely obtain the changes of the network model in the time dimension, so as to timely discover the time point of abnormal behavior, effectively improve the accuracy and timeliness of anomaly monitoring, and thus solve the technical problem of low data monitoring accuracy in related technologies.

[0093] It should be noted that the steps shown in the flowcharts of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and that, although a logical order is shown in the flowcharts, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0094] Example 2

[0095] The embodiment of the present application also provides a data monitoring device. It should be noted that the Z device of the embodiment of the present application can be used to execute the data monitoring method provided by the embodiment of the present application. The data monitoring device provided by the embodiment of the present application is introduced below.

[0096] According to an embodiment of the present application, a device for implementing the above data monitoring method is also provided. Figure 3 is a schematic diagram of a data monitoring device according to an embodiment of the present application, such as Figure 3 As shown, the device comprises:

[0097] The first acquisition module 302 is used to obtain the interaction data of multiple clients and the formation time point of the interaction data, wherein the interaction data is the data generated by the interaction behavior between multiple clients; the first determination module 304 is used to determine the dynamic network structure of the network model based on the interaction data and the formation time, wherein the network model is used to represent the interaction behavior between multiple clients, and the dynamic network structure represents the network structure that displays the interaction data in the order of formation time; the monitoring module 306 is used to input the dynamic network structure into the abnormal monitoring model, and use the abnormal monitoring model to perform abnormal monitoring on multiple clients to obtain monitoring results, wherein the monitoring results are used to indicate whether there are abnormal clients with abnormal interactions among multiple clients.

[0098] The data monitoring device provided in the embodiment of the present application obtains the formation time point of the interaction data while obtaining the interaction data, and determines the dynamic network structure based on the interaction data and the formation time point, taking into account the time characteristics and structural characteristics of the network model, and can timely obtain the changes of the network model in the time dimension, so as to timely discover the time point of abnormal behavior, effectively improve the accuracy and timeliness of abnormal monitoring, and thus solve the technical problem of low data monitoring accuracy in related technologies.

[0099] Optionally, in the data monitoring device provided in the embodiment of the present application, the detection module includes: a first monitoring unit, used to perform anomaly monitoring on multiple clients using an anomaly monitoring model to obtain the interaction change time point of the network model, wherein the interaction change time point is used to indicate the time point when the interaction data in the dynamic network structure changes; a second monitoring unit, used to perform anomaly monitoring on multiple clients based on the interaction change time point and the dynamic network structure to obtain monitoring results.

[0100] Optionally, in the data monitoring device provided in the embodiment of the present application, the first monitoring unit includes: a first monitoring sub-unit, used to monitor the interaction activity and preset interaction activity interval of multiple clients, wherein the preset interaction activity is used to represent the interaction activity interval that conforms to the client interaction state; a first determination sub-unit, used to determine the interaction change time point of the network model based on the interaction activity change time point of the at least one target client among the multiple clients whose interaction activity is not in the preset interaction activity interval.

[0101] Optionally, in the data monitoring device provided in the embodiment of the present application, the second monitoring unit includes: a second determination subunit, used to determine the first network structure and the second network structure of the network model based on the interaction change time point and the dynamic network structure, wherein the first network structure is used to represent the network structure of the network model before the interaction change time point, and the second network structure is used to represent the network structure of the network model after the interaction change time point; the second monitoring subunit is used to perform abnormality monitoring on multiple clients based on the first network structure and the second network structure to obtain monitoring results.

[0102] Optionally, in the data monitoring device provided in the embodiment of the present application, the second monitoring sub-unit includes: comparing the first network structure and the second network structure to determine whether there is a target client among the multiple clients, wherein the target client is at least one client among the multiple clients whose interaction activity change rate is greater than a preset activity change rate; in response to the existence of the target client among the multiple clients, determining that the target client is an abnormal client, and determining based on the abnormal client that the monitoring result is that there is an abnormal client with interaction abnormalities among the multiple clients; in response to the absence of the target client among the multiple clients, determining that the monitoring result is that there is no abnormal client with interaction abnormalities among the clients.

[0103] Optionally, in the data monitoring device provided in the embodiment of the present application, after responding to the existence of a target client among multiple clients, the device also includes: an output module for outputting the target client; a second determination module for determining that the target client is an abnormal client in response to an abnormal confirmation instruction received from the target client within a preset time period, and determining that the monitoring result is that there is an abnormal client with interaction abnormalities among the multiple clients; and a third determination module for determining that the monitoring result is that there is no abnormal client with interaction abnormalities among the clients in response to not receiving an abnormal confirmation instruction from the target client within the preset time period.

[0104] Optionally, in the data monitoring device provided in the embodiment of the present application, the device also includes: a second acquisition module, used to obtain the interaction relationship between multiple clients, wherein the interaction relationship is formed by the interaction behavior between multiple clients; and to construct a network model with multiple clients as nodes and the interaction relationship as edges.

[0105] It should be noted that the above-mentioned modules or units can be hardware components or software components stored in a memory (e.g., memory 104) and processed by one or more processors (e.g., processors 102a, 102b, ..., 102n), and the above-mentioned modules can also be run as part of the device in the computer terminal 10 provided in Example 1.

[0106] Example 3

[0107] An embodiment of the present application may provide an electronic device, Figure 4 is a structural block diagram of an electronic device according to an embodiment of the present application. Figure 4 As shown, the electronic device may include: one or more ( Figure 4 (only one is shown) processor 402, memory 404, storage controller, and peripheral interface, wherein the peripheral interface is connected to the radio frequency module, audio module and display.

[0108] Among them, the memory can be used to store software programs and modules, such as program instructions / modules corresponding to the methods and devices in the embodiments of the present application, and the processor executes various functional applications and data processing by running the software programs and modules stored in the memory, that is, realizing the above-mentioned method. The memory may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory may further include a memory remotely arranged relative to the processor, and these remote memories may be connected to the terminal via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0109] The processor can also call the information and applications stored in the memory through the transmission device to perform the following steps: use the anomaly monitoring model to perform anomaly monitoring on multiple clients to obtain the interaction change time point of the network model, wherein the interaction change time point is used to indicate the time point when the interaction data in the dynamic network structure changes; based on the interaction change time point and the dynamic network structure, perform anomaly monitoring on multiple clients to obtain monitoring results.

[0110] The processor can also call the information and application programs stored in the memory through the transmission device to perform the following steps: monitor the interaction activity and preset interaction activity intervals of multiple clients, wherein the preset interaction activity is used to represent the interaction activity interval that conforms to the client interaction state; in response to the presence of at least one target client among the multiple clients whose interaction activity is not in the preset interaction activity interval, determine the interaction change time point of the network model based on the interaction activity change time point of the at least one target client.

[0111] The processor can also call the information and application programs stored in the memory through the transmission device to perform the following steps: based on the interaction change time point and the dynamic network structure, determine the first network structure and the second network structure of the network model, wherein the first network structure is used to represent the network structure of the network model before the interaction change time point, and the second network structure is used to represent the network structure of the network model after the interaction change time point; perform abnormal monitoring on multiple clients based on the first network structure and the second network structure to obtain monitoring results.

[0112] The processor can also call the information and application stored in the memory through the transmission device to perform the following steps: compare the first network structure and the second network structure to determine whether there is a target client among the multiple clients, wherein the target client is at least one client among the multiple clients whose interaction activity change rate is greater than a preset activity change rate; in response to the existence of the target client among the multiple clients, determine that the target client is an abnormal client, and based on the abnormal client, determine that the monitoring result is an abnormal client with interaction abnormalities among the multiple clients; in response to the absence of the target client among the multiple clients, determine that the monitoring result is that there is no abnormal client with interaction abnormalities among the clients.

[0113] The processor can also call the information and application stored in the memory through the transmission device to perform the following steps: output the target client; in response to receiving an abnormal confirmation instruction from the target client within a preset time period, determine that the target client is an abnormal client, and determine that the monitoring result is an abnormal client with interaction abnormalities among multiple clients; in response to not receiving an abnormal confirmation instruction from the target client within the preset time period, determine that the monitoring result is that there is no abnormal client with interaction abnormalities among the clients.

[0114] The processor can also call the information and applications stored in the memory through the transmission device to perform the following steps: obtain the interaction relationship between multiple clients, where the interaction relationship is formed by the interaction behavior between multiple clients; and build a network model with multiple clients as nodes and the interaction relationship as edges.

[0115] By adopting the embodiment of the present application, a data monitoring solution is provided. By acquiring the formation time point of the interaction data while acquiring the interaction data, and jointly determining the dynamic network structure based on the interaction data and the formation time point, the time characteristics and structural characteristics of the network model are taken into account, and the changes of the network model in the time dimension can be obtained in time, so as to timely discover the time point of abnormal behavior, effectively improve the accuracy and timeliness of abnormal monitoring, and thus solve the technical problem of low data monitoring accuracy in related technologies.

[0116] It can be understood by those skilled in the art that Figure 4 The structure shown is for illustration only, and the electronic device may also be a smart phone (such as an Android phone, an iOS phone, etc.), a tablet computer, a PDA, a mobile Internet device (Mobile Internet Devices, MID), a PAD, or other terminal devices. Figure 4 The structure of the electronic device is not limited. Figure 4 More or fewer components (such as network interfaces, display devices, etc.) shown in, or having Figure 4 Different configurations shown.

[0117] A person of ordinary skill in the art can understand that all or part of the steps in the various methods of the above embodiments can be completed by instructing the hardware related to the terminal device through a program, and the program can be stored in a computer-readable storage medium, and the storage medium may include: a flash drive, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, etc.

[0118] Example 4

[0119] The embodiment of the present application further provides a storage medium. Optionally, in this embodiment, the storage medium can be used to store the program code executed by the data monitoring method provided in the first embodiment.

[0120] Optionally, in this embodiment, the above storage medium may be located in any computer terminal in a computer terminal group in a computer network, or in any mobile terminal in a mobile terminal group.

[0121] The present application also provides a computer program product, which, when executed on a data processing device, is suitable for executing the program steps of the data monitoring method.

[0122] The serial numbers of the above-mentioned embodiments of the present application are for description only and do not represent the advantages or disadvantages of the embodiments.

[0123] In the above embodiments of the present application, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, please refer to the relevant description of other embodiments.

[0124] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0125] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0126] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0127] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, in essence, or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions to enable a computer device (which can be a personal computer, a server or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, disk or optical disk and other media that can store program codes.

[0128] The above is only a preferred implementation of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. A data monitoring method, characterized in that: include: Acquire interaction data of multiple clients and a time point at which the interaction data is formed, wherein the interaction data is data generated by interaction behaviors between the multiple clients; Determining a dynamic network structure of a network model based on the interaction data and the formation time, wherein the network model is used to represent the interaction behavior between the multiple clients, and the dynamic network structure represents a network structure that displays the interaction data in the order of the formation time; The dynamic network structure is input into an abnormality monitoring model, and the abnormality monitoring model is used to perform abnormality monitoring on the multiple clients to obtain monitoring results, wherein the monitoring results are used to indicate whether there are abnormal clients with abnormal interactions among the multiple clients.

2. The data monitoring method according to claim 1, characterized in that: The abnormality monitoring model is used to perform abnormality monitoring on the multiple clients to obtain monitoring results, including: Performing anomaly monitoring on the multiple clients using the anomaly monitoring model to obtain an interaction change time point of the network model, wherein the interaction change time point is used to indicate a time point at which the interaction data in the dynamic network structure changes; Based on the interaction change time point and the dynamic network structure, the multiple clients are monitored for abnormalities to obtain the monitoring results.

3. The data monitoring method according to claim 2, characterized in that: Using the anomaly monitoring model to perform anomaly monitoring on the multiple clients to obtain the interaction change time points of the network model includes: Monitoring the interaction activity and preset interaction activity intervals of the multiple clients, wherein the preset interaction activity is used to represent an interaction activity interval that conforms to the client interaction state; In response to the presence of at least one target client among the multiple clients whose interaction activity is not within the preset interaction activity interval, the interaction change time point of the network model is determined based on the interaction activity change time point of the at least one target client.

4. The data monitoring method according to claim 2, characterized in that: The plurality of clients are monitored for abnormalities based on the interaction change time point and the dynamic network structure to obtain the monitoring result, including: Based on the interaction change time point and the dynamic network structure, determine a first network structure and a second network structure of the network model, wherein the first network structure is used to represent the network structure of the network model before the interaction change time point, and the second network structure is used to represent the network structure of the network model after the interaction change time point; Based on the first network structure and the second network structure, abnormality monitoring is performed on the multiple clients to obtain the monitoring result.

5. The data monitoring method according to claim 4, characterized in that: Performing abnormal monitoring on the multiple clients based on the first network structure and the second network structure to obtain the monitoring result includes: Comparing the first network structure with the second network structure, determining whether there is a target client among the multiple clients, wherein the target client is at least one client among the multiple clients whose interaction activity change rate is greater than a preset activity change rate; In response to the target client being present among the multiple clients, determining that the target client is an abnormal client, and determining, based on the abnormal client, that the monitoring result is the abnormal client having an interaction abnormality among the multiple clients; In response to the target client not existing among the multiple clients, it is determined that the monitoring result is that the abnormal client with abnormal interaction does not exist among the clients.

6. The data monitoring method according to claim 5, characterized in that: After responding to the target client existing among the multiple clients, the method further includes: outputting the target client; In response to receiving an abnormality confirmation instruction from the target client within a preset time period, determining that the target client is the abnormal client, and determining that the monitoring result is the abnormal client with interaction abnormality among the multiple clients; In response to not receiving the abnormality confirmation instruction from the target client within the preset time period, determining that the monitoring result is that there is no abnormal client with interaction abnormality among the clients.

7. The data monitoring method according to claim 1, characterized in that: The method further comprises: Acquire an interaction relationship between the multiple clients, wherein the interaction relationship is formed by interaction behaviors between the multiple clients; A network model is constructed with the multiple clients as nodes and the interaction relationships as edges.

8. A computer-readable storage medium, characterized in that: The computer-readable storage medium includes a stored executable program, wherein when the executable program is executed, the device where the computer-readable storage medium is located is controlled to execute the method according to any one of claims 1 to 7.

9. An electronic device, characterized in that: include: A memory storing an executable program; A processor, configured to run the program, wherein the program executes the method according to any one of claims 1 to 7 when running.

10. A computer program product comprising computer instructions, characterized in that: When the computer instructions are executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images